<p>I'd like to diff a Kubernetes YAML template against the actual deployed ressources. This should be possible using <a href="https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#diff" rel="nofollow noreferrer">kubectl diff</a>. However, on my Kubernetes cluster in Azure, I get the following error:</p>

<pre><code>Error from server (InternalError): Internal error occurred: admission webhook "aks-webhook-admission-controller.azmk8s.io" does not support dry run
</code></pre>

<p>Is there something I can enable on AKS to let this work or is there some other way of achieving the diff?</p>

<p>As a workaround you can use standard GNU/Linux <code>diff</code> command in the following way:</p>

<pre><code>diff -uN &lt;(kubectl get pods nginx-pod -o yaml) example_pod.yaml
</code></pre>

<hr>

<p>I know this is not a solution but just workaround but I think it still can be considered as full-fledged replacement tool.</p>

<blockquote>
  <p>Thanks, but that doesn't work for me, because it's not just one pod
  I'm interested in, it's a whole Helm release with deployment,
  services, jobs, etc. – dploeger</p>
</blockquote>

<p>But anyway you won't compare everything at once, will you ?</p>

<p>You can use it for any resource you like, not only for <code>Pods</code>. Just substitute <code>Pod</code> by any other resource you like.</p>

<p>Anyway, under the hood <code>kubectl diff</code> uses <code>diff command</code></p>

<p>In <code>kubectl diff --help</code> you can read:</p>

<blockquote>
  <p>KUBECTL_EXTERNAL_DIFF environment variable can be used to select your
  own diff command. By default, the "diff" command available in your
  path will be run with "-u" (unified diff) and "-N" (treat absent files
  as empty) options.</p>
</blockquote>

<hr>

<p>The real problem in your case is that you cannot use for some reason <code>--dry-run</code> on your AKS Cluster, which is question to AKS users/experts. Maybe it can be enabled somehow but unfortunately I have no idea how.</p>

<p>Basically <code>kubectl diff</code> compares already deployed resource, which we can get by:</p>

<pre><code>kubectl get resource-type resource-name -o yaml
</code></pre>

<p>with the result of:</p>

<pre><code>kubectl apply -f nginx.yaml --dry-run --output yaml
</code></pre>

<p>and not with actual content of your yaml file (simple <code>cat nginx.yaml</code> would be ok for that purpose).</p>

<hr>

<p>You can additionally use:</p>

<pre><code>kubectl get all -l "app.kubernetes.io/instance=&lt;helm_release_name&gt;" -o yaml 
</code></pre>

<p>to get <code>yamls</code> of all resources belonging to specific <strong>helm release</strong>. </p>

<p>As you can read in <code>man diff</code> it has following options:</p>

<pre><code>   --from-file=FILE1
          compare FILE1 to all operands; FILE1 can be a directory

   --to-file=FILE2
          compare all operands to FILE2; FILE2 can be a directory
</code></pre>

<p>so we are not limited to comparing single files but also files located in specific directory. Only we can't use these two options together.</p>

<p>So the full <code>diff</code> command for comparing all resources belonging to specific <strong>helm release</strong> currently deployed on our <strong>kubernetes cluster</strong> with <strong><code>yaml</code> files from a specific directory</strong> may look like this:</p>

<pre><code>diff -uN &lt;(kubectl get all -l "app.kubernetes.io/instance=&lt;helm_release_name&gt;" -o yaml) --to-file=directory_containing_yamls/
</code></pre>
