Helm template renders a chart locally and does no server side testing. Helm install with the dry run option set to server simulates the install against the cluster, so API and admission checks apply. Use template for fast policy checks on rendered YAML, and server dry run for the cluster's own verdict.
The three modes
The helm install reference describes the dry run option as taking one of three values:
| Value | Behaviour |
|---|---|
| none | Executes normally and persists changes |
| client | Simulates client side only and avoids cluster connections |
| server | Simulates on the server and requires cluster connectivity |
Helm template is a separate command. Its reference says it renders templates locally, that values normally looked up in cluster are faked, and that none of the server side testing of chart validity, such as whether an API is supported, is done.
What each is good for
| Task | Best tool |
|---|---|
| Feed rendered YAML to a policy engine in CI | helm template |
| Check the chart works with this cluster's APIs | helm install with dry run set to server |
| See what Kubernetes admission policies would say | helm install with dry run set to server |
| Run with no cluster credentials | helm template, or dry run set to client |
The security angle is admission. Policies enforced by the cluster only run when a request reaches the API server. A local render cannot tell you a policy would reject it.
The Secrets warning
Helm's reference warns that the dry run flag outputs all generated chart manifests, including Secrets which can contain sensitive values. To hide Kubernetes Secrets, use the hide secret flag. It also says to consider carefully how and when these flags are used.
In CI this matters because logs are often readable by a wide group. Two habits help:
- Pass the hide secret flag whenever you combine debug and dry run in a shared pipeline.
- Do not print rendered manifests to the build log when they could contain credentials. Write them to a protected artifact instead.
A suggested order
- Render with helm template and run policy checks on the output.
- Run a server dry run on a test cluster with the hide secret flag.
- Review the diff against what is live.
- Install.
Try it yourself
Click through it at your own pace, or open it full screen.
See how checks stack before a merge. Rendering, policy and dry run are stages of the same gate.
Quick check
Does helm template contact the cluster?
No. It renders locally and fakes values that would be looked up in cluster.
Can a dry run leak secrets into logs?
Yes. It outputs all generated manifests, including Secrets. Use the hide secret flag, or keep the output out of shared logs.
Safeguard runs policies and gates on pull requests, so a failed rule can hold a merge, and its dependency and SBOM scanning covers the packages your infrastructure code pulls in. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
