A Helm values string containing `{{ .Release.Name }}` renders literally into the manifest — why, and what fixes it?

## Why the braces survive Rendering a chart is a single, well-defined pass: Helm parses each file under `templates/`, executes it against a context built from the merged values, the release metadata, `Chart.yaml` and the cluster capabilities, and collects the text. Values are one of the inputs to that execution, not part of the program being executed. So a values file that says ```yaml ingress: host: "{{ .Release.Name }}-scoring.internal.example" ``` hands the template a plain string that happens to contain braces. `{{ .Values.ingress.host }}` writes those characters into the manifest, the API server stores them, and a single-service chart with an Ingress and an autoscaler comes up serving traffic on a hostname nobody can resolve. There is no second pass that would notice. ## `tpl` is the opt-in second pass Helm adds a `tpl` function for exactly this: it takes a string and a context, parses the string as a template, executes it, and returns the result. The chart writes ``` host: {{ tpl .Values.ingress.host . | quote }} ``` and from then on a caller may put template actions in that one field. Note the argument order — the string first, the context second — and note who has to make the change: the **chart author**. A consumer cannot make a value template-aware from the outside; if the chart interpolates the field plainly, the only options are to ask for `tpl` on that field or to compute the string at the call site. ## The context argument is the interesting half The second argument decides what the string's own actions can see. Passing `.` gives the string the same context the surrounding template has, which is what you almost always want at the top level of a chart. Inside a subchart the same `.` is the subchart's context, so `.Values` there means the subchart's values, not the umbrella's — a string written by someone thinking about the parent will resolve to nothing. Passing a dict instead lets a chart offer a deliberately narrow surface: the string can then see only the keys you put in it. A related use is rendering a whole configuration file that a chart ships as an asset rather than as a template, by reading the file's contents and passing them through `tpl`. Same mechanism: the text becomes template source, evaluated against the context you nominate. ## What it costs and what it risks `tpl` parses on every call. One field per manifest is free; a `tpl` inside a range over the members of a large list re-parses for each element, and on a big umbrella that shows up as a render that takes seconds instead of milliseconds. Hoist the parse out of the loop when the string does not depend on the loop variable. The risk is subtler and worth saying out loud in an interview: the string is executed with the same function set the chart's own templates have. A values file is usually reviewed less carefully than chart source, and it may be supplied by another team, generated by a pipeline, or committed to a config repository with looser review. Whatever ends up in a `tpl`-rendered field runs at render time with the privileges of whoever runs the install, including anything that reaches the cluster. Treat a `tpl` field as an execution surface: use it for the small, specific values that genuinely need release-awareness — hostnames, annotation values, a job argument — and not as a general escape hatch for arbitrary chart logic supplied from outside. ## Reading the failure Two failure shapes are common. The first is the literal braces described above, which is not an error at all — it renders, applies, and only fails as a wrong hostname or an annotation nothing matches. Render the chart and read the field; the braces are right there in the output. The second is a render error from a malformed string: an unclosed action, or a field that does not exist in the context you nominated. The message is attributed to the template that called `tpl`, because that is what the engine was executing — it does not point at the line in the values file where the bad string actually lives. When a chart uses `tpl` in several places, the fastest way to localise it is to render with only one of the suspect values set, or to bisect the values file, rather than to stare at the reported template line. ## Where it belongs in a chart's design A field rendered through `tpl` is part of the chart's public contract, so document it: say in the values documentation that the field is templated and against which context, because to a consumer the difference between a plain string field and a templated one is invisible until it misbehaves.