K8s Manifest Diff

Render manifests, diff against cluster or git, flag risks. Read-only.

1. Prerequisites

• command -v kubectl -- REQUIRED. Abort immediately if missing.
• helm, kustomize -- optional, detected from input. kubectl kustomize as fallback.
• If --context in $ARGUMENTS, pass --context <value> to all kubectl calls.
• Run kubectl cluster-info to test access. If unreachable, set CLUSTER_AVAILABLE=false

and continue (git-based diff still works). Print kubectl config current-context if available.

• Fail fast only if kubectl binary is missing.

2. Detection

Determine type from input path in $ARGUMENTS:

• Chart.yaml in directory --> Helm (helm template).
• kustomization.yaml/kustomization.yml --> Kustomize (kubectl kustomize).
• Plain .yaml/.yml --> raw YAML (cat). Single file always uses raw mode.

3. Render

Render to temp file (mktemp, cleaned up via trap on exit):

• Helm: helm template <release> <chart-path> [--values values.yaml] > "$RENDERED"
• Kustomize: kubectl kustomize <dir> > "$RENDERED"
• Raw: cat <files> > "$RENDERED"

Split into individual resources keyed by apiVersion/kind/namespace/name.

4. Diff

Live cluster diff (when --context present or cluster reachable): Fetch live version per resource: kubectl get <kind> <name> -n <ns> -o yaml. Strip .metadata.managedFields and kubectl.kubernetes.io/last-applied-configuration annotation. Compare with diff -u.

Git diff (no cluster target): Render the same manifests at git merge-base HEAD main. Diff with diff -u.

5. Risk Flags

Scan each diff hunk:

6. Secret Masking

Before display, scan for keys matching password, secret, token, key, credential (case-insensitive). Replace values with [REDACTED] in both rendered and live YAML.

7. Resource Identity

Match by apiVersion/kind/namespace/name. Use - as namespace for cluster-scoped resources.

• In render but not cluster: NEW. In cluster but not render: ORPHANED.

8. Output

Print in order:

1. Summary: N added, M modified, K removed
2. Risk table (if any):

| Resource | Risk | Detail |
|----------|------|--------|
| apps/v1/Deployment/prod/api | CRITICAL | replicas: 3 -> 0 |

1. Full unified diff with secrets redacted.

No preamble. Lead with summary tables.

9. Idempotency

Strictly read-only. Temp files only, cleaned on exit. Never applies, patches, or deletes resources.

$ARGUMENTS