Summary
A chart that uses Helm's lookup function to conditionally render resources, or to pull live cluster data into a resource, drifts out of sync under HelmRelease reconciliation without any warning. Drift detection doesn't ignore the chart. It just never re-renders templates: it diffs live objects against the manifest stored from the last real render, so it can't see anything lookup would produce differently on a fresh render.
Expected behavior
helm upgrade or helm diff upgrade re-renders templates, re-evaluates lookup against current cluster state, and shows the resulting diff correctly, including resources that start or stop appearing and fields whose values depend on lookup.
Actual behavior
HelmRelease reconciliation only re-renders templates when it decides an upgrade is needed, gated by a chart+values digest comparison. If git hasn't changed, no re-render happens no matter how often spec.interval fires. Drift detection compares live objects against the manifest stored from the last real render; it never re-templates. It misses two cases:
- A field whose value came from
lookup and has since changed in the cluster.
- A resource that
lookup-driven conditionals would now include or exclude.
Charts using lookup behave correctly under plain Helm but drift out of sync under Flux. No warning, no error, no event. Drift detection reports "no drift" while the live cluster no longer matches what a fresh render would produce.
Why this matters
The driftDetection docs promise to catch "any unintentional changes ... that may have occurred outside of your Helm release process" (#643). For charts using lookup, that promise doesn't hold, and neither the feature name nor the docs disclose that it diffs against a frozen manifest snapshot instead of a live render. Nothing errors. The HelmRelease reports Ready. You only catch the mismatch by diffing manually with Helm.
Proposed fix
Re-rendering on every reconcile isn't the only option, and it carries real cost: SSA dry-run plus lookup API calls on every interval tick gets expensive across a large fleet. Options, roughly in order of preference:
- Add an opt-in drift detection mode (
enabledWithReRender?) that performs a full re-render, including live lookup evaluation, before diffing, instead of diffing against the stored manifest. Teams that accept the extra API and CPU cost for lookup-based charts can opt in per HelmRelease.
- Detect at render or install time whether a chart calls
lookup, and automatically opt-in into re-rendering, as this is expected behaviour.
Summary
A chart that uses Helm's
lookupfunction to conditionally render resources, or to pull live cluster data into a resource, drifts out of sync underHelmReleasereconciliation without any warning. Drift detection doesn't ignore the chart. It just never re-renders templates: it diffs live objects against the manifest stored from the last real render, so it can't see anythinglookupwould produce differently on a fresh render.Expected behavior
helm upgradeorhelm diff upgradere-renders templates, re-evaluateslookupagainst current cluster state, and shows the resulting diff correctly, including resources that start or stop appearing and fields whose values depend onlookup.Actual behavior
HelmReleasereconciliation only re-renders templates when it decides an upgrade is needed, gated by a chart+values digest comparison. If git hasn't changed, no re-render happens no matter how oftenspec.intervalfires. Drift detection compares live objects against the manifest stored from the last real render; it never re-templates. It misses two cases:lookupand has since changed in the cluster.lookup-driven conditionals would now include or exclude.Charts using
lookupbehave correctly under plain Helm but drift out of sync under Flux. No warning, no error, no event. Drift detection reports "no drift" while the live cluster no longer matches what a fresh render would produce.Why this matters
The
driftDetectiondocs promise to catch "any unintentional changes ... that may have occurred outside of your Helm release process" (#643). For charts usinglookup, that promise doesn't hold, and neither the feature name nor the docs disclose that it diffs against a frozen manifest snapshot instead of a live render. Nothing errors. The HelmRelease reportsReady. You only catch the mismatch by diffing manually with Helm.Proposed fix
Re-rendering on every reconcile isn't the only option, and it carries real cost: SSA dry-run plus
lookupAPI calls on everyintervaltick gets expensive across a large fleet. Options, roughly in order of preference:enabledWithReRender?) that performs a full re-render, including livelookupevaluation, before diffing, instead of diffing against the stored manifest. Teams that accept the extra API and CPU cost forlookup-based charts can opt in perHelmRelease.lookup, and automatically opt-in into re-rendering, as this is expected behaviour.