Why must a Helm chart be rendered before conftest can evaluate its Kubernetes manifests?

## What the engine actually consumes conftest is a runner for Rego policies over **structured configuration documents**. It parses an input file (YAML, JSON and several other formats), binds the parsed document to the variable `input`, and evaluates rules in a package - conventionally `main` - collecting the messages produced by `deny`, `violation` and `warn` rules. Anything that is not parseable into a document is not something it can reason about. A Helm chart is not a document. The files under `templates/` are **Go text templates**: text with `{{ ... }}` actions that are executed against a values object to *produce* manifests. Until `helm template` (or an install/upgrade) runs, the manifest does not exist. ```yaml # templates/deployment.yaml - before rendering - name: {{ .Chart.Name }} {{- if .Values.resources }} resources: {{ toYaml .Values.resources | indent 12 }} {{- end }} ``` Two distinct things go wrong if you point a policy engine at that file. **1. It may not parse at all.** A line like `{{ toYaml .Values.resources | indent 12 }}` sitting where a mapping is expected is not valid YAML. Depending on the fragment you get a parse error - noisy, but at least honest. **2. It may parse into something that is not your manifest.** Many template files *are* accidentally valid YAML, because `{{ .Values.image.tag }}` inside quotes is just a string. Now the engine happily evaluates a document whose `kind` is a template expression, whose container image is the literal text `{{ .Values.image.repository }}`, and which is missing every field that lives behind an `{{- if }}`. This is the dangerous case, and it is dangerous because of how Rego handles absence. ## Undefined is not false A conftest rule is typically written as a rule that produces a message when something is wrong: ```rego package main deny contains msg if { input.kind == "Deployment" some c in input.spec.template.spec.containers not c.resources.limits.memory msg := sprintf("container %s has no memory limit", [c.name]) } ``` If `input.kind` is not `Deployment` - because the document is a half-parsed template, or because the field is a template expression - the body is **undefined**. Undefined is not false and it is not a failure: the rule simply yields no result, the deny set is empty, and conftest exits 0. A green gate over an un-rendered chart is not evidence that the chart is compliant; it is evidence that the rule never found anything to talk about. Junior candidates routinely read that green as a pass, and it is the single most common way an IaC gate becomes decorative. ## Rendering, and rendering *fairly* `helm template my-release ./chart -f values-prod.yaml | conftest test -` produces the multi-document manifest stream that would actually be applied, and that stream is a fair subject for rules about resource requests and limits, readiness probes, or the presence of a PodDisruptionBudget. Kustomize is the same story one layer over: `kubectl kustomize overlays/prod` applies the overlay's patches, and a base evaluated on its own can be missing - or still carrying - exactly the field the rule cares about. Which inputs you render with is then a policy decision in its own right. A chart rendered with the chart's default `values.yaml` and the same chart rendered with the production values file are two different documents, and only one of them resembles what ships. Charts with subchart dependencies add another variable: the rendered output depends on the dependency versions resolved into `charts/`. ## What rendering still does not give you The rendered stream is a set of documents this chart produces, and nothing else. It does not contain objects that already exist in the cluster, objects produced by a different chart, defaults the API server will apply on admission, or anything a controller will add afterwards. Rules that need those cannot be written here honestly, no matter how the input is rendered - that is a property of the artifact, not a gap in the engine. ## The practical shape Render once, in one place, with an explicit values file; feed the rendered output to the policy run; and keep the rendered manifest as a build artifact so a blocked developer can read the exact document the rule judged. That last part is what turns "the gate says no" into a fixable message.