Using Lookup Function
1. Reading Existing Resources
| Signature | Returns |
|---|---|
lookup "apiVersion" "Kind" "ns" "name" | Single resource map (empty if missing) |
lookup "v1" "ConfigMap" "default" "" | List of all ConfigMaps in namespace |
lookup "v1" "Namespace" "" "default" | Cluster-scoped lookup |
2. Querying ConfigMaps
Example: Read existing CM
{{- $cm := lookup "v1" "ConfigMap" .Release.Namespace "shared-config" }}
{{- if $cm }}
sharedKey: {{ index $cm.data "key" | quote }}
{{- end }}3. Querying Secrets
Example: Preserve existing secret across upgrades
{{- $existing := lookup "v1" "Secret" .Release.Namespace (printf "%s-creds" (include "myapp.fullname" .)) }}
{{- $password := "" }}
{{- if $existing }}
{{- $password = index $existing.data "password" | b64dec }}
{{- else }}
{{- $password = randAlphaNum 24 }}
{{- end }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "myapp.fullname" . }}-creds
type: Opaque
data:
password: {{ $password | b64enc | quote }}4. Checking Resource Existence
| Pattern | Behavior |
|---|---|
{{ if lookup ... }} | Empty map is falsy |
{{ with lookup ... }}{{ . }}{{ end }} | Rebind only when found |
5. Reading Resource Fields
Example: Navigate fields
{{- $svc := lookup "v1" "Service" .Release.Namespace "myservice" }}
clusterIP: {{ $svc.spec.clusterIP | default "auto" }}
port: {{ (index $svc.spec.ports 0).port }}6. Using Lookup in Conditionals
Example: Create only if absent
{{- if not (lookup "v1" "Namespace" "" "monitoring") }}
apiVersion: v1
kind: Namespace
metadata:
name: monitoring
{{- end }}7. Handling Missing Resources
| Scenario | Lookup result |
|---|---|
| Resource exists | Map with full object |
| Resource missing | Empty map (no error) |
| Permission denied | Empty map (silent failure) |
helm template (no cluster) | Always returns empty |
8. Querying Across Namespaces
Example: All Services across ns
{{- range (lookup "v1" "Service" "" "").items }}
- {{ .metadata.namespace }}/{{ .metadata.name }}
{{- end }}9. Understanding Performance Implications
| Concern | Mitigation |
|---|---|
API call per lookup | Cache in $var :=; avoid in loops |
| List-all is expensive | Prefer named lookups |
| Renders break offline tools | Guard with if .Release.IsUpgrade or feature flag |
10. Understanding Security Implications
Warning:
lookup runs with the caller's RBAC. A chart can exfiltrate secrets if the user has read access. Never trust chart-rendered output as confidential.| Risk | Mitigation |
|---|---|
| Exposes Secrets in rendered manifests | Review chart before installing; use OPA/Kyverno admission policies |
| RBAC required | Service accounts running Helm need get/list on looked-up kinds |
| GitOps + dry-run mismatch | Dry-run output differs from live render; document any lookup usage |