@@ -220,7 +220,7 @@
           }
         },
         "cilium": {
-          "description": "Cilium CNI plugin.",
+          "description": "Cilium CNI plugin. Always installed: it is the tenant cluster's CNI and has no enable switch, so this section only overrides its Helm values.",
           "type": "object",
           "default": {},
           "required": [
@@ -236,7 +236,7 @@
           }
         },
         "coredns": {
-          "description": "CoreDNS addon.",
+          "description": "CoreDNS addon. Always installed: it is the tenant cluster's DNS and has no enable switch, so this section only overrides its Helm values.",
           "type": "object",
           "default": {},
           "required": [
@@ -417,7 +417,7 @@
           }
         },
         "verticalPodAutoscaler": {
-          "description": "Vertical Pod Autoscaler.",
+          "description": "Vertical Pod Autoscaler. Has no enable switch of its own: it is installed and removed together with addons.monitoringAgents.enabled, so this section only overrides its Helm values.",
           "type": "object",
           "default": {},
           "required": [
 
@@ -184,15 +184,15 @@ proxmox:
 
 ## @typedef {struct} Addons - Cluster addons configuration.
 ## @field {CertManagerAddon} certManager - Cert-manager addon.
-## @field {CiliumAddon} cilium - Cilium CNI plugin.
+## @field {CiliumAddon} cilium - Cilium CNI plugin. Always installed: it is the tenant cluster's CNI and has no enable switch, so this section only overrides its Helm values.
 ## @field {GatewayAPIAddon} gatewayAPI - Gateway API addon.
 ## @field {IngressNginxAddon} ingressNginx - Ingress-NGINX controller.
 ## @field {GPUOperatorAddon} gpuOperator - NVIDIA GPU Operator.
 ## @field {HAMiAddon} hami - HAMi GPU virtualization middleware.
 ## @field {MonitoringAgentsAddon} monitoringAgents - Monitoring agents.
-## @field {VerticalPodAutoscalerAddon} verticalPodAutoscaler - Vertical Pod Autoscaler.
+## @field {VerticalPodAutoscalerAddon} verticalPodAutoscaler - Vertical Pod Autoscaler. Has no enable switch of its own: it is installed and removed together with addons.monitoringAgents.enabled, so this section only overrides its Helm values.
 ## @field {VeleroAddon} velero - Velero backup/restore addon.
-## @field {CoreDNSAddon} coredns - CoreDNS addon.
+## @field {CoreDNSAddon} coredns - CoreDNS addon. Always installed: it is the tenant cluster's DNS and has no enable switch, so this section only overrides its Helm values.
 ## @field {OuroborosAddon} ouroboros - Hairpin-NAT fix for ingress-nginx with PROXY-protocol.
 
 ## @param {Addons} addons - Cluster addons configuration.
 
@@ -0,0 +1,66 @@
+import { describe, expect, it } from "vitest"
+import { render, screen } from "@testing-library/react"
+import type { ObjectFieldTemplateProps, ObjectFieldTemplatePropertyType } from "@rjsf/utils"
+import { CustomObjectFieldTemplate } from "./CustomObjectFieldTemplate.tsx"
+
+const prop = (name: string): ObjectFieldTemplatePropertyType => ({
+  name,
+  content: <div data-testid={`field-${name}`} />,
+  disabled: false,
+  readonly: false,
+  hidden: false,
+})
+
+// One cast at the fixture boundary keeps every render call below fully typed;
+// `registry` is a large RJSF object this template never reads.
+const base = {
+  idSchema: { $id: "root_addons_cilium" },
+  schema: {},
+  title: "cilium",
+  description: "Cilium CNI plugin.",
+  formData: {},
+  properties: [],
+  onAddClick: () => () => {},
+  registry: {},
+} as unknown as ObjectFieldTemplateProps
+
+describe("addons with no enable switch", () => {
+  it("says the switch is absent when the object carries only valuesOverride", () => {
+    render(<CustomObjectFieldTemplate {...base} properties={[prop("valuesOverride")]} />)
+    expect(screen.getByText(/No enable switch/)).toBeTruthy()
+    expect(screen.queryByRole("checkbox")).toBeNull()
+  })
+
+  it("warns that an enabled field in YAML does nothing", () => {
+    render(<CustomObjectFieldTemplate {...base} properties={[prop("valuesOverride")]} />)
+    expect(screen.getByText(/adding an enabled field in YAML has no effect/)).toBeTruthy()
+  })
+
+  // The three addons in this class are not all always-on: verticalPodAutoscaler
+  // follows addons.monitoringAgents.enabled. Only the schema description knows
+  // which is which, so the fixed copy must not claim any of them is mandatory.
+  it("leaves the reason to the schema description", () => {
+    render(
+      <CustomObjectFieldTemplate
+        {...base}
+        title="verticalPodAutoscaler"
+        description="Vertical Pod Autoscaler. Has no enable switch of its own: it is installed and removed together with addons.monitoringAgents.enabled, so this section only overrides its Helm values."
+        properties={[prop("valuesOverride")]}
+      />,
+    )
+    expect(screen.getByText(/together with addons.monitoringAgents.enabled/)).toBeTruthy()
+    expect(screen.queryByText(/cannot be disabled/)).toBeNull()
+    expect(screen.queryByText(/Always on/)).toBeNull()
+  })
+
+  it("leaves a toggleable addon alone", () => {
+    render(
+      <CustomObjectFieldTemplate
+        {...base}
+        properties={[prop("enabled"), prop("valuesOverride")]}
+      />,
+    )
+    expect(screen.queryByText(/No enable switch/)).toBeNull()
+    expect(screen.getByTestId("field-enabled")).toBeTruthy()
+  })
+})
@@ -53,6 +53,38 @@ export function CustomObjectFieldTemplate<
   const hasOtherFields = props.properties.some((p) => p.name !== "enabled")
   const isAddon = hasEnabledField && hasOtherFields
 
+  // An addon carrying only overrides and no 'enabled' has no switch of its own:
+  // cilium and coredns are always installed, verticalPodAutoscaler follows
+  // monitoringAgents. Rendered as a plain group it reads as a toggleable addon
+  // whose switch failed to appear, which is how users end up adding
+  // `<addon>.enabled: true` in YAML — the schema sets no additionalProperties,
+  // so the API stores that field, echoes it back, and nothing reads it. State
+  // the absence here; the per-addon schema description says why.
+  const hasNoToggle =
+    !hasEnabledField &&
+    props.properties.length > 0 &&
+    props.properties.every((p) => p.name === "valuesOverride")
+
+  if (hasNoToggle) {
+    return (
+      <fieldset id={props.idSchema.$id} className="border border-slate-200 rounded-lg p-3 mb-3">
+        {props.title && (
+          <legend className="text-xs font-semibold text-slate-700 px-1">{props.title}</legend>
+        )}
+        <p className="text-xs text-slate-500 mb-2">
+          No enable switch. This section only overrides Helm values — adding an enabled field in
+          YAML has no effect.
+        </p>
+        {props.description && (
+          <p className="field-description text-xs text-slate-400 mb-2">{props.description}</p>
+        )}
+        {props.properties.map((prop) => (
+          <div key={prop.name}>{prop.content}</div>
+        ))}
+      </fieldset>
+    )
+  }
+
   if (isAddon) {
     const isEnabled = (formData as { enabled?: unknown } | undefined)?.enabled === true
     const enabledProp = props.properties.find((p) => p.name === "enabled")