What's the difference between helm template, helm install --dry-run, and actually applying a chart — and when would you use each during troubleshooting?

helm template <chart> is a purely local operation: it evaluates the Go templates against the provided values.yaml (and any --set overrides) and prints the resulting Kubernetes manifests, with zero interaction with any Kubernetes API server — useful for quickly checking what a values change would produce, diffing chart versions, or debugging template logic errors, and it works even with no cluster access configured at all.

helm install --dry-run (or helm upgrade --dry-run) does the same template rendering but then submits it to the connected cluster's API server for server-side validation (and, depending on flags/version, can run it through admission controllers) without persisting anything — this can surface errors that pure templating can't, such as a CRD that doesn't exist in this cluster, an invalid apiVersion for the cluster's Kubernetes version, or a validating webhook that would reject the resource, none of which helm template alone would catch since it never talks to a real API server.

During troubleshooting: reach for helm template first when you suspect a values/templating logic bug (wrong loop, wrong conditional, missing default) since it's instant and needs no cluster; reach for --dry-run when the template renders fine locally but you suspect a cluster-specific issue (CRD version mismatch, webhook rejection, RBAC) since only a dry-run against the real cluster will surface those; only do a real install/upgrade once both have passed, ideally in a lower environment first.