Passing values to include function inside range, using defaults with merge

Given this deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment
spec:
  revisionHistoryLimit: 5
  template:
    spec:
      containers:
      {{- include "app.container" (merge .Values.app $) | nindent 8 }}
      {{- include "ports" (merge .Values.app ) | nindent 8 }}
      {{- range $k, $v := .Values.extraContainers }}
      {{- $nameDict := dict "name" $k -}}
        {{- include "app.container" (mustMergeOverwrite $.Values.app $nameDict $v)  | nindent 8 }}
        {{- include "ports" (merge $nameDict $v ) | nindent 8 }}
      {{- end }}

This helpers file...

{{/* vim: set filetype=helm: */}}

{{/*
app container base
*/}}
{{- define "app.containerBase" -}}
- name: {{ .name | default "app" }}
  image: {{ .image.name }}:{{ .image.tag }}
  {{- if .command }}
  command:
    {{- range .command }}
    - {{ . | quote }}
    {{- end }}
  {{- end }}
  {{- if .args }}
  args:
    {{- range .args }}
    - {{ . | quote }}
      {{- end }}
  {{- end }}
    {{- range .envVars }}
    - name: {{ .name }}
      {{- with .value }}
      value: {{ . | quote }}
      {{- end }}
      {{- with .valueFrom }}
      valueFrom:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    {{- end }}
  {{- if or .Values.configMaps .Values.secrets .Values.configMapRef }}
  envFrom:
    {{- if .Values.configMaps }}
    - configMapRef:
        name: "{{- include "app.fullname" $ }}"
    {{- end }}
    {{- range .Values.configMapRef }}
    - configMapRef:
        name: {{ . }}
    {{- end }}
    {{- range $name, $idk := $.Values.secrets }}
    - secretRef:
        name: "{{- include "app.fullname" $ }}-{{ $name }}"
    {{- end }}
  {{- end }}
{{- end -}}

{{/*
app container
*/}}
{{- define "app.container" -}}
{{- include "app.containerBase" . }}
  resources:
    limits:
      cpu: {{ .resources.limits.cpu | default "100m" | quote }}
      memory: {{ .resources.limits.memory | default "128Mi" | quote }}
      {{- if .resources.limits.ephemeralStorage }}
      ephemeral-storage: {{ .resources.limits.ephemeralStorage }}
      {{- end }}
    requests:
      cpu: {{ .resources.requests.cpu | default "100m" | quote }}
      memory: {{ .resources.requests.memory | default "128Mi" | quote }}
      {{- if .resources.requests.ephemeralStorage }}
      ephemeral-storage: {{ .resources.requests.ephemeralStorage }}
      {{- end }}
  securityContext:
    runAsNonRoot: true
    runAsUser: {{ .securityContext.runAsUser }}
    runAsGroup: {{ .securityContext.runAsGroup }}
    allowPrivilegeEscalation: false
{{- end -}}

{{/*
ports
*/}}
{{- define "ports" -}}
{{- if .port }}
  ports:
  - containerPort: {{ .port }}
  protocol: {{ .protocol | default "tcp" | upper }}
  {{- range .extraPorts}}
    - containerPort: {{ required ".port is required." .port }}
    {{- if .name }}
      name: {{ .name }}
    {{- end }}
    {{- if .protocol }}
      protocol: {{ .protocol | upper }}
    {{- end }}
  {{- end }}
{{- end }}
{{- end -}}

This values.yaml

extraContainers:
  extra-container2:
    image:
      name: xxx.dkr.ecr.eu-west-1.amazonaws.com/foobar-two
      tag: test
    command:
      - sleep
      - 10
    envVars:
      - name: FOO
        value: BAR
    probes:
      readinessProbe:
        path: /ContainerTwoReadinessPath
      livenessProbe:
        path: /ContainerTwoLivenessPath
    resources:
      limits:
        cpu: 200Mi
        memory: 2Gi
      requests:
        cpu: 200Mi
        memory: 2Gi
  extra-container3:
    image:
      name: xx.dkr.ecr.eu-west-1.amazonaws.com/foobar-three
      tag: latest
    command:
      - sleep
      - 10
    envVars:
      - name: FOO
        value: BAZ
    probes:
      readinessProbe:
        enabled: false
      livenessProbe:
        enabled: false

app:
  image:
    name: xx.dkr.ecr.eu-west-1.amazonaws.com/foobar
    tag: latest
  probes:
    readinessProbe:
      path: /_readiness
      enabled: true
    livenessProbe:
      path: /_liveness
      enabled: true
  port: 100
  resources:
    limits:
      cpu: 100Mi
      memory: 1Gi
    requests:
      cpu: 100Mi
      memory: 1Gi

Why does helm template result in the below:

---
# Source: corp-service/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment
spec:
  revisionHistoryLimit: 5
  template:
    spec:
      containers:
        - name: app
          image: xx.dkr.ecr.eu-west-1.amazonaws.com/foobar:latest
          resources:
            limits:
              cpu: "100Mi"
              memory: "1Gi"
            requests:
              cpu: "100Mi"
              memory: "1Gi"
          securityContext:
            runAsNonRoot: true
            runAsUser: 2000
            runAsGroup: 2000
            allowPrivilegeEscalation: false
        
          ports:
          - containerPort: 100
          protocol: TCP
        - name: extra-container2
          image: xx.dkr.ecr.eu-west-1.amazonaws.com/foobar-two:test
          command:
            - "sleep"
            - "10"
            - name: FOO
              value: "BAR"
          resources:
            limits:
              cpu: "200Mi"
              memory: "2Gi"
            requests:
              cpu: "200Mi"
              memory: "2Gi"
          securityContext:
            runAsNonRoot: true
            runAsUser: 2000
            runAsGroup: 2000
            allowPrivilegeEscalation: false
        
        - name: extra-container3
          image: xx.dkr.ecr.eu-west-1.amazonaws.com/foobar-three:latest
          command:
            - "sleep"
            - "10"
            - name: FOO
              value: "BAZ"
          resources:
            limits:
              cpu: "200Mi"
              memory: "2Gi"
            requests:
              cpu: "200Mi"
              memory: "2Gi"
          securityContext:
            runAsNonRoot: true
            runAsUser: 2000
            runAsGroup: 2000
            allowPrivilegeEscalation: false

i.e why does extra-container3 have resources: set with values from extra-container2 instead of taking them from the default set of resources found under .values.app.

essentially, i want extracontainers to use default values from .values.app unless i explicitly set them inside the extracontainers section. however it seems that if a previous iteration of the loop over extracontainers defines some values, they are used in the next iteration if they are not overriden.

the resources for extra-container3 i am expecting are:

resources:
    limits:
      cpu: 100Mi
      memory: 1Gi
    requests:
      cpu: 100Mi
      memory: 1Gi

what am i doing wrong?