<p>With the below yml file:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: my-nginx
spec:
  containers:
  - name: my-nginx
    image: nginx:alpine
</code></pre>
<hr />
<p>On running <code>kubectl create -f nginx.pod.yml --save-config</code>, then as per the <a href="https://jamesdefabia.github.io/docs/user-guide/kubectl/kubectl_create/" rel="nofollow noreferrer">documentation</a>: <code>If true, the configuration of current object will be saved in its annotation.</code></p>
<p>Where exactly is this annotation saved? How to view this annotation?</p>

overexchange
<p>Below command would print all the annotations present in the pod <code>my-nginx</code>:</p>
<pre><code>kubectl get pod my-nginx  -o jsonpath='{.metadata.annotations}'
</code></pre>
<p>Under <code>kubectl.kubernetes.io/last-applied-configuration</code> of the above output, your configuration used is stored.</p>
<p>Here is an example showing the usage:</p>
<p>Original manifest for my deployment:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  labels:
    app: my-deploy
  name: my-deploy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: my-deploy
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: my-deploy
    spec:
      containers:
      - image: nginx
        name: nginx
        resources: {}
status: {}
</code></pre>
<p>Created the deployment as follow:</p>
<pre><code>k create  -f x.yml --save-config
deployment.apps/my-deploy created

kubectl get deployments.apps my-deploy   -o jsonpath='{.metadata.annotations.kubectl\.kubernetes\.io\/last-applied-configuration}' |jq .
{
  &quot;apiVersion&quot;: &quot;apps/v1&quot;,
  &quot;kind&quot;: &quot;Deployment&quot;,
  &quot;metadata&quot;: {
    &quot;annotations&quot;: {},
    &quot;creationTimestamp&quot;: null,
    &quot;labels&quot;: {
      &quot;app&quot;: &quot;my-deploy&quot;
    },
    &quot;name&quot;: &quot;my-deploy&quot;,
    &quot;namespace&quot;: &quot;default&quot;
  },
  &quot;spec&quot;: {
    &quot;replicas&quot;: 1,
    &quot;selector&quot;: {
      &quot;matchLabels&quot;: {
        &quot;app&quot;: &quot;my-deploy&quot;
      }
    },
    &quot;strategy&quot;: {},
    &quot;template&quot;: {
      &quot;metadata&quot;: {
        &quot;creationTimestamp&quot;: null,
        &quot;labels&quot;: {
          &quot;app&quot;: &quot;my-deploy&quot;
        }
      },
      &quot;spec&quot;: {
        &quot;containers&quot;: [
          {
            &quot;image&quot;: &quot;nginx&quot;,
            &quot;name&quot;: &quot;nginx&quot;,
            &quot;resources&quot;: {}
          }
        ]
      }
    }
  },
  &quot;status&quot;: {}
}

kubectl get deployments.apps my-deploy   -o jsonpath='{.spec.template.spec.containers[*].image}'
nginx
</code></pre>
<p>Now some user came and changed the image on nginx from <code>nginx</code> to <code>httpd</code>, using <code>imperative</code> commands.</p>
<pre><code>k set image deployment/my-deploy nginx=httpd --record
deployment.apps/my-deploy image updated


kubectl get deployments.apps my-deploy   -o jsonpath='{.spec.template.spec.containers[*].image}'
httpd
</code></pre>
<p>However, we can check that the last applied declarative configuration is not updated.</p>
<pre><code>kubectl get deployments.apps my-deploy   -o jsonpath='{.metadata.annotations.kubectl\.kubernetes\.io\/last-applied-configuration}' |jq .
{
  &quot;apiVersion&quot;: &quot;apps/v1&quot;,
  &quot;kind&quot;: &quot;Deployment&quot;,
  &quot;metadata&quot;: {
    &quot;annotations&quot;: {},
    &quot;creationTimestamp&quot;: null,
    &quot;labels&quot;: {
      &quot;app&quot;: &quot;my-deploy&quot;
    },
    &quot;name&quot;: &quot;my-deploy&quot;,
    &quot;namespace&quot;: &quot;default&quot;
  },
  &quot;spec&quot;: {
    &quot;replicas&quot;: 1,
    &quot;selector&quot;: {
      &quot;matchLabels&quot;: {
        &quot;app&quot;: &quot;my-deploy&quot;
      }
    },
    &quot;strategy&quot;: {},
    &quot;template&quot;: {
      &quot;metadata&quot;: {
        &quot;creationTimestamp&quot;: null,
        &quot;labels&quot;: {
          &quot;app&quot;: &quot;my-deploy&quot;
        }
      },
      &quot;spec&quot;: {
        &quot;containers&quot;: [
          {
            &quot;image&quot;: &quot;nginx&quot;,
            &quot;name&quot;: &quot;nginx&quot;,
            &quot;resources&quot;: {}
          }
        ]
      }
    }
  },
  &quot;status&quot;: {}
}
</code></pre>
<p>Now, change the image name in the original manifest file from <code>nginx</code> to <code>flask</code>, then do <code>kubectl apply</code>(a declarative command)</p>
<pre><code>kubectl apply -f orig.yml
deployment.apps/my-deploy configured
kubectl get deployments.apps my-deploy   -o jsonpath='{.spec.template.spec.containers[*].image}'
flask
</code></pre>
<p>Now check the last applied configuration annotation, this would have <code>flask</code> in it. Remember, it was missing when <code>kubectl set image</code> command was used.</p>
<pre><code>kubectl get deployments.apps my-deploy   -o jsonpath='{.metadata.annotations.kubectl\.kubernetes\.io\/last-applied-configuration}' |jq .
{
  &quot;apiVersion&quot;: &quot;apps/v1&quot;,
  &quot;kind&quot;: &quot;Deployment&quot;,
  &quot;metadata&quot;: {
    &quot;annotations&quot;: {},
    &quot;creationTimestamp&quot;: null,
    &quot;labels&quot;: {
      &quot;app&quot;: &quot;my-deploy&quot;
    },
    &quot;name&quot;: &quot;my-deploy&quot;,
    &quot;namespace&quot;: &quot;default&quot;
  },
  &quot;spec&quot;: {
    &quot;replicas&quot;: 1,
    &quot;selector&quot;: {
      &quot;matchLabels&quot;: {
        &quot;app&quot;: &quot;my-deploy&quot;
      }
    },
    &quot;strategy&quot;: {},
    &quot;template&quot;: {
      &quot;metadata&quot;: {
        &quot;creationTimestamp&quot;: null,
        &quot;labels&quot;: {
          &quot;app&quot;: &quot;my-deploy&quot;
        }
      },
      &quot;spec&quot;: {
        &quot;containers&quot;: [
          {
            &quot;image&quot;: &quot;flask&quot;,
            &quot;name&quot;: &quot;nginx&quot;,
            &quot;resources&quot;: {}
          }
        ]
      }
    }
  },
  &quot;status&quot;: {}
}
</code></pre>
<p><strong>Where is the &quot;last-applied&quot; annotation saved:</strong></p>
<p>Just like everything else, Its saved in <code>etcd</code> , created the pod using the manifest provided in the question and ran <code>raw</code> etcd command to print the content. (in this dev environment, etcd was not encrypted).</p>
<pre><code>ETCDCTL_API=3 etcdctl --cert /etc/kubernetes/pki/apiserver-etcd-client.crt --key /etc/kubernetes/pki/apiserver-etcd-client.key --cacert /etc/kubernetes/pki/etcd/ca.crt get /registry/pods/default/my-nginx
/registry/pods/default/my-nginx
k8s

v1Pod⚌
⚌
                                                                                                                                                                   my-nginxdefault&quot;*$a3s4b729-c96a-40f7-8de9-5d5f4ag21gfa2⚌⚌⚌b⚌
0kubectl.kubernetes.io/last-applied-configuration⚌{&quot;apiVersion&quot;:&quot;v1&quot;,&quot;kind&quot;:&quot;Pod&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;name&quot;:&quot;my-nginx&quot;,&quot;namespace&quot;:&quot;default&quot;},&quot;spec&quot;:{&quot;containers&quot;:[{&quot;image&quot;:&quot;nginx:alpine&quot;,&quot;name&quot;:&quot;my-nginx&quot;}]}}
</code></pre>
