Using Lookup Function

1. Reading Existing Resources

SignatureReturns
lookup "apiVersion" "Kind" "ns" "name"Single resource map (empty if missing)
lookup "v1" "ConfigMap" "default" ""List of all ConfigMaps in namespace
lookup "v1" "Namespace" "" "default"Cluster-scoped lookup

2. Querying ConfigMaps

Example: Read existing CM

{{- $cm := lookup "v1" "ConfigMap" .Release.Namespace "shared-config" }}
{{- if $cm }}
sharedKey: {{ index $cm.data "key" | quote }}
{{- end }}

3. Querying Secrets

Example: Preserve existing secret across upgrades

{{- $existing := lookup "v1" "Secret" .Release.Namespace (printf "%s-creds" (include "myapp.fullname" .)) }}
{{- $password := "" }}
{{- if $existing }}
{{- $password = index $existing.data "password" | b64dec }}
{{- else }}
{{- $password = randAlphaNum 24 }}
{{- end }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "myapp.fullname" . }}-creds
type: Opaque
data:
  password: {{ $password | b64enc | quote }}

4. Checking Resource Existence

PatternBehavior
{{ if lookup ... }}Empty map is falsy
{{ with lookup ... }}{{ . }}{{ end }}Rebind only when found

5. Reading Resource Fields

Example: Navigate fields

{{- $svc := lookup "v1" "Service" .Release.Namespace "myservice" }}
clusterIP: {{ $svc.spec.clusterIP | default "auto" }}
port: {{ (index $svc.spec.ports 0).port }}

6. Using Lookup in Conditionals

Example: Create only if absent

{{- if not (lookup "v1" "Namespace" "" "monitoring") }}
apiVersion: v1
kind: Namespace
metadata:
  name: monitoring
{{- end }}

7. Handling Missing Resources

ScenarioLookup result
Resource existsMap with full object
Resource missingEmpty map (no error)
Permission deniedEmpty map (silent failure)
helm template (no cluster)Always returns empty

8. Querying Across Namespaces

Example: All Services across ns

{{- range (lookup "v1" "Service" "" "").items }}
- {{ .metadata.namespace }}/{{ .metadata.name }}
{{- end }}

9. Understanding Performance Implications

ConcernMitigation
API call per lookupCache in $var :=; avoid in loops
List-all is expensivePrefer named lookups
Renders break offline toolsGuard with if .Release.IsUpgrade or feature flag

10. Understanding Security Implications

Warning: lookup runs with the caller's RBAC. A chart can exfiltrate secrets if the user has read access. Never trust chart-rendered output as confidential.
RiskMitigation
Exposes Secrets in rendered manifestsReview chart before installing; use OPA/Kyverno admission policies
RBAC requiredService accounts running Helm need get/list on looked-up kinds
GitOps + dry-run mismatchDry-run output differs from live render; document any lookup usage