KUBERNETES(1)(kubernetes)

💅 KUBERNETES(1)(kubernetes) — the kubectl diff era ✨

okay bestie, welcome to the kubernetes manual section, bestie. this page is filed under the manual name kubernetes, it's the kubectl diff page, and the original was put together by Eric Paris back in Jan 2015. sit down, hydrate, and let's get into it 🫶

---

🎀 NAME 🎀

kubectl diff — diff the live version against a would-be applied version 💖

✨ SYNOPSIS ✨

kubectl diff [OPTIONS]

🌸 DESCRIPTION 🌸

So here's the vibe: this command diffs the configurations you specify — by file name or via stdin — between the current online configuration and the configuration as it would be if applied. literally the "what if" of your cluster. no cap.

The output is always YAML. always. periodt.

You can also pick your own diff command with the KUBECTL_EXTERNAL_DIFF environment variable. and yes queen, you can pass params to those external commands too, like:

KUBECTL_EXTERNAL_DIFF="colordiff -N -u"

By default though, the "diff" command hanging out in your path gets run with the -u (unified diff) and -N (treat absent files as empty) options. iconic behaviour tbh.

Exit status, and this part matters so read it fr fr:

• 0 — no differences were found 🙌
• 1 — differences were found 👀
• >1 — kubectl or diff failed with an error 💀

Note: KUBECTL_EXTERNAL_DIFF, if used, is expected to follow that convention. it's giving "please stay on brand".

---

👑 OPTIONS 👑

• --concurrency=1 — how many objects get processed in parallel when diffing against the live version. bigger number = faster, but more memory, I/O and CPU all crammed into that shorter period of time. it's a tradeoff bestie, choose your fighter.
• --field-manager="kubectl-client-side-apply" — the name of the manager used to track field ownership.
• -f, --filename=[] — filename, directory, or URL to files contains the configuration to diff.
• --force-conflicts=false — if true, server-side apply will force the changes against conflicts. main character energy, honestly.
• -k, --kustomize="" — process the kustomization directory. heads up: this flag can't be used together with -f or -R.
• --prune=false — include resources that would be deleted by pruning. can be used with -l, and by default it shows all resources that would be pruned.
• --prune-allowlist=[] — overwrite the default allowlist with < > for --prune.
• -R, --recursive=false — process the directory used in -f, --filename recursively. super useful when you want to manage related manifests organized within the same directory.
• -l, --selector="" — selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'. (e.g. -l key1=value1,key2=value2,key3 in (value3)). matching objects must satisfy all of the specified label constraints. all of them. no skipping.
• --server-side=false — if true, apply runs in the server instead of the client.
• --show-managed-fields=false — if true, include managed fields in the diff.
• --show-secrets=false — if true, do not mask secret values in the diff. 🫣

---

🌈 OPTIONS INHERITED FROM PARENT COMMANDS 🌈

these are the ones that come from the parent command, and honestly they're the whole personality of your kubeconfig:

• --as="" — username to impersonate for the operation. user could be a regular user or a service account in a namespace.
• --as-group=[] — group to impersonate for the operation. this flag can be repeated to specify multiple groups.
• --as-uid="" — UID to impersonate for the operation.
• --as-user-extra=[] — user extras to impersonate for the operation. this flag can be repeated to specify multiple values for the same key.
• --cache-dir="/home/username/.kube/cache" — default cache directory.
• --certificate-authority="" — path to a cert file for the certificate authority.
• --client-certificate="" — path to a client certificate file for TLS.
• --client-key="" — path to a client key file for TLS.
• --cluster="" — the name of the kubeconfig cluster to use.
• --context="" — the name of the kubeconfig context to use.
• --disable-compression=false — if true, opt-out of response compression for all requests to the server.
• --insecure-skip-tls-verify=false — if true, the server's certificate will not be checked for validity. > this will make your HTTPS connections insecure. bestie, be careful, this is not the slay you think it is 😭
• --kubeconfig="" — path to the kubeconfig file to use for CLI requests.
• --kuberc="" — path to the kuberc file to use for preferences. this can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
• --match-server-version=false — require server version to match client version.
• -n, --namespace="" — if present, the namespace scope for this CLI request.
• --password="" — password for basic authentication to the API server.
• --profile="none" — name of profile to capture. one of (none|cpu|heap|goroutine|threadcreate|block|mutex|trace).
• --profile-output="profile.pprof" — name of the file to write the profile to.
• --proxy-url="" — proxy URL to use for requests to the API server.
• --request-timeout="0" — the length of time to wait before giving up on a single server request. non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). a value of zero means don't timeout requests.
• -s, --server="" — the address and port of the Kubernetes API server.
• --tls-server-name="" — server name to use for server certificate validation. if it is not provided, the hostname used to contact the server is used.
• --token="" — bearer token for authentication to the API server.
• --user="" — the name of the kubeconfig user to use.
• --username="" — username for basic authentication to the API server.
• --version=false — --version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version.
• --warnings-as-errors=false — treat warnings received from the server as errors and exit with a non-zero exit code.

---

🦋 EXAMPLE 🦋

look at her go 💅

# Diff resources included in pod.json
kubectl diff -f pod.json

# Diff file read from stdin
cat service.yaml | kubectl diff -f -

---

🍓 SEE ALSO 🍓

• kubectl(1),

---

🧚 HISTORY 🧚

January 2015, originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material — but hopefully they have been automatically generated since! 😌✨

---

and that's the whole page bestie 🫶 this one lives in the Manuals manual, in the User section, and it's filed as KUBERNETES(1)(kubernetes). it's giving iconic, it's giving reference material, and it's giving "go diff something and come back and tell me everything" 💖⭐