{{- if not (lookup "v1" "Namespace" "" "monitoring") }}apiVersion: v1kind: Namespacemetadata: name: monitoring{{- end }}
7. Handling Missing Resources
Scenario
Lookup result
Resource exists
Map with full object
Resource missing
Empty map (no error)
Permission denied
Empty map (silent failure)
helm template (no cluster)
Always returns empty
8. Querying Across Namespaces
Example: All Services across ns
{{- range (lookup "v1" "Service" "" "").items }}- {{ .metadata.namespace }}/{{ .metadata.name }}{{- end }}
9. Understanding Performance Implications
Concern
Mitigation
API call per lookup
Cache in $var :=; avoid in loops
List-all is expensive
Prefer named lookups
Renders break offline tools
Guard with if .Release.IsUpgrade or feature flag
10. Understanding Security Implications
Warning:lookup runs with the caller's RBAC. A chart can exfiltrate secrets if the user has read access. Never trust chart-rendered output as confidential.
Risk
Mitigation
Exposes Secrets in rendered manifests
Review chart before installing; use OPA/Kyverno admission policies
RBAC required
Service accounts running Helm need get/list on looked-up kinds
GitOps + dry-run mismatch
Dry-run output differs from live render; document any lookup usage