The lookup template function queries the live cluster and is the only way for a chart to read existing objects at render time. It returns an empty map, not an error, when there is no cluster connection or when Helm is rendering without applying. That includes helm template, helm install --dry-run, and every offline linting or diffing tool.
The usual pattern is a chart that generates a random password on first install and reuses the existing Secret on upgrade. Under helm template the lookup misses and a fresh random value is rendered, so a diff tool reports a password change on every run, and any CI gate that compares rendered output to the cluster produces permanent noise.
Guard every lookup so the empty result is handled, and treat rendered output from helm template as not authoritative for lookup-derived fields. Helm 3.13 added --dry-run=server, which performs a server-side dry run and does populate lookups, which is the right flag for diffing charts that use them.