K8s Manifest Diff
Render manifests, diff against cluster or git, flag risks. Read-only.
1. Prerequisites
command -v kubectl -- REQUIRED. Abort immediately if missing.helm, kustomize -- optional, detected from input. kubectl kustomize as fallback.- If
--context in $ARGUMENTS, pass --context <value> to all kubectl calls.
- Run
kubectl cluster-info to test access. If unreachable, set CLUSTER_AVAILABLE=false
and continue (git-based diff still works). Print kubectl config current-context if available.
- Fail fast only if kubectl binary is missing.
2. Detection
Determine type from input path in $ARGUMENTS:
Chart.yaml in directory --> Helm (helm template).kustomization.yaml/kustomization.yml --> Kustomize (kubectl kustomize).- Plain
.yaml/.yml --> raw YAML (cat). Single file always uses raw mode.
3. Render
Render to temp file (mktemp, cleaned up via trap on exit):
- Helm:
helm template <release> <chart-path> [--values values.yaml] > "$RENDERED"
- Kustomize:
kubectl kustomize <dir> > "$RENDERED"
- Raw:
cat <files> > "$RENDERED"
Split into individual resources keyed by apiVersion/kind/namespace/name.
4. Diff
Live cluster diff (when --context present or cluster reachable):
Fetch live version per resource: kubectl get <kind> <name> -n <ns> -o yaml. Strip .metadata.managedFields and kubectl.kubernetes.io/last-applied-configuration annotation. Compare with diff -u.
Git diff (no cluster target):
Render the same manifests at git merge-base HEAD main. Diff with diff -u.
5. Risk Flags
Scan each diff hunk:
| Level |
Patterns |
| CRITICAL |
Namespace deletion, PV/PVC removal, RBAC escalation (new ClusterRoleBinding, added verbs) |
| HIGH |
Resource limits reduced >50%, replicas to 0, image tag to latest |
| MEDIUM |
New CRD apiVersion, Service port change, ConfigMap key removal |
| LOW |
Label/annotation changes, resource request adjustments |
6. Secret Masking
Before display, scan for keys matching password, secret, token, key, credential (case-insensitive). Replace values with [REDACTED] in both rendered and live YAML.
7. Resource Identity
Match by apiVersion/kind/namespace/name. Use - as namespace for cluster-scoped resources.
- In render but not cluster: NEW. In cluster but not render: ORPHANED.
8. Output
Print in order:
- Summary:
N added, M modified, K removed
- Risk table (if any):
| Resource | Risk | Detail |
|----------|------|--------|
| apps/v1/Deployment/prod/api | CRITICAL | replicas: 3 -> 0 |
- Full unified diff with secrets redacted.
No preamble. Lead with summary tables.
9. Idempotency
Strictly read-only. Temp files only, cleaned on exit. Never applies, patches, or deletes resources.
$ARGUMENTS
1---2name: k8s-diff3description: Render Kubernetes manifests (Helm, Kustomize, raw YAML) and diff against a live cluster or previous render, flagging risky changes. Use when the user says "k8s diff", "manifest diff", "helm diff", "kustomize diff", "what changed in k8s", "compare manifests", "show k8s changes", "what will deploy", "dry run deploy", "preview deploy", "cluster drift", or wants to see Kubernetes resource changes before applying.4---56# K8s Manifest Diff78Render manifests, diff against cluster or git, flag risks. Read-only.910## 1. Prerequisites11- `command -v kubectl` -- REQUIRED. Abort immediately if missing.12- `helm`, `kustomize` -- optional, detected from input. `kubectl kustomize` as fallback.13- If `--context` in `$ARGUMENTS`, pass `--context <value>` to all kubectl calls.14- Run `kubectl cluster-info` to test access. If unreachable, set `CLUSTER_AVAILABLE=false`15 and continue (git-based diff still works). Print `kubectl config current-context` if available.16- Fail fast only if kubectl binary is missing.1718## 2. Detection19Determine type from input path in `$ARGUMENTS`:20- `Chart.yaml` in directory --> Helm (`helm template`).21- `kustomization.yaml`/`kustomization.yml` --> Kustomize (`kubectl kustomize`).22- Plain `.yaml`/`.yml` --> raw YAML (`cat`). Single file always uses raw mode.2324## 3. Render25Render to temp file (`mktemp`, cleaned up via `trap` on exit):26- Helm: `helm template <release> <chart-path> [--values values.yaml] > "$RENDERED"`27- Kustomize: `kubectl kustomize <dir> > "$RENDERED"`28- Raw: `cat <files> > "$RENDERED"`29Split into individual resources keyed by `apiVersion/kind/namespace/name`.3031## 4. Diff32**Live cluster diff** (when `--context` present or cluster reachable):33Fetch live version per resource: `kubectl get <kind> <name> -n <ns> -o yaml`. Strip `.metadata.managedFields` and `kubectl.kubernetes.io/last-applied-configuration` annotation. Compare with `diff -u`.3435**Git diff** (no cluster target):36Render the same manifests at `git merge-base HEAD main`. Diff with `diff -u`.3738## 5. Risk Flags39Scan each diff hunk:4041| Level | Patterns |42|-------|----------|43| CRITICAL | Namespace deletion, PV/PVC removal, RBAC escalation (new ClusterRoleBinding, added verbs) |44| HIGH | Resource limits reduced >50%, replicas to 0, image tag to `latest` |45| MEDIUM | New CRD apiVersion, Service port change, ConfigMap key removal |46| LOW | Label/annotation changes, resource request adjustments |4748## 6. Secret Masking49Before display, scan for keys matching `password`, `secret`, `token`, `key`, `credential` (case-insensitive). Replace values with `[REDACTED]` in both rendered and live YAML.5051## 7. Resource Identity52Match by `apiVersion/kind/namespace/name`. Use `-` as namespace for cluster-scoped resources.53- In render but not cluster: **NEW**. In cluster but not render: **ORPHANED**.5455## 8. Output56Print in order:571. Summary: `N added, M modified, K removed`582. Risk table (if any):59```60| Resource | Risk | Detail |61|----------|------|--------|62| apps/v1/Deployment/prod/api | CRITICAL | replicas: 3 -> 0 |63```643. Full unified diff with secrets redacted.65No preamble. Lead with summary tables.6667## 9. Idempotency68Strictly read-only. Temp files only, cleaned on exit. Never applies, patches, or deletes resources.6970$ARGUMENTS
indrasvat