Before installing a third-party chart into a production municipal namespace, a developer wants to inspect the rendered manifests without creating a release. Which command supports that review?

Before installing a third-party chart into a production municipal namespace, helm template <name> <chart> with the intended values renders fully expanded manifests locally without creating a release. Developers can inspect Deployments, RBAC, ServiceAccounts, and volume mounts for least-privilege and policy fit—an essential change-control practice when city production namespaces enforce Pod Security and tight RBAC. Reading the assembly instructions before building the furniture prevents shipping surprise ClusterRoles with a “simple” dashboard chart.

Why the other options fail by concept: helm uninstall --dry-run is not the standard workflow for rendering templates of a chart you have not installed yet. kubectl exec into kube-apiserver is inappropriate, usually impossible on managed clusters, and does not dump chart source. helm rollback --dry-run against a nonexistent release does not produce a third-party chart render for pre-install review.

Exam caveat: helm template does not contact the cluster by default, so it will not catch admission webhook denials; pair with helm install --dry-run/--debug when you need server-side validation. Values used in the template review must match production values or the review is incomplete. Some charts branch templates on kubeVersion capabilities that only become visible when dry-running against a live API.

Operational check: helm template <release> <chart> -f prod-values.yaml > /tmp/render.yaml, review for ClusterRoles, hostPath, privileged containers, and wildcard RBAC, attach the artifact to the change ticket, then install only after policy approval. Re-run template whenever values change before upgrading production.