fix(chart): do not render annotations as null in APIService template

Signed-off-by: Julian van den Berkmortel <7153670+Serializator@users.noreply.github.com>

Author: Serializator

charts/metrics-server/CHANGELOG.md

@@ -17,6 +17,7 @@
 ### Fixed
 
 - Conditionally render `insecureSkipTLSVerify` field in APIService template to prevent GitOps sync drift when value is `false`. ([#1727](https://github.com/kubernetes-sigs/metrics-server/pull/1727)) _@pawl_
+- Do not render annotations as null in APIService template to prevent permanent OutOfSync in ArgoCD. ([#1752](https://github.com/kubernetes-sigs/metrics-server/pull/1752)) _@Serializator_
 
 ## [3.13.0] - 2025-07-22
 

charts/metrics-server/templates/apiservice.yaml

@@ -38,9 +38,10 @@ metadata:
   name: v1beta1.metrics.k8s.io
   labels:
     {{- include "metrics-server.labels" . | nindent 4 }}
-  {{- if or .Values.apiService.annotations .Values.tls.certManager.addInjectorAnnotations }}
+  {{- $includeCertManagerAnnotations := (and .Values.tls.certManager.addInjectorAnnotations (eq .Values.tls.type "cert-manager")) }}
+  {{- if or .Values.apiService.annotations $includeCertManagerAnnotations }}
   annotations:
-    {{- if and (eq .Values.tls.type "cert-manager") .Values.tls.certManager.addInjectorAnnotations }}
+    {{- if $includeCertManagerAnnotations }}
     cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "metrics-server.fullname" . }}
     {{- end }}
     {{- with .Values.apiService.annotations }}