<p>I have a need to define a standalone patch as YAML.</p>
<p>More specifically, I want to do the following:</p>
<pre><code>kubectl patch serviceaccount default -p '{&quot;imagePullSecrets&quot;: [{&quot;name&quot;: &quot;registry-my-registry&quot;}]}'
</code></pre>
<p>The catch is I can't use <code>kubectl patch</code>. I'm using a GitOps workflow with flux, and that resource I want to patch is a default resource created outside of flux.</p>
<p>In other terms, I need to do the same thing as the command above but with <code>kubectl apply</code> only:</p>
<pre><code>kubectl apply patch.yaml
</code></pre>
<p>I wasn't able to figure out if you can define such a patch.</p>
<p><strong>The key bit is that I can't predict the name of the default secret token on a new cluster (as the name is random, i.e. <code>default-token-uudge</code>)</strong></p>

Juicy
<blockquote>
<ul>
<li>Fields set and deleted from Resource Config are merged into Resources by <code>Kubectl apply</code>:</li>
<li>If a Resource already exists, Apply updates the Resources by merging the
local Resource Config into the remote Resources</li>
<li>Fields removed from the Resource Config will be deleted from the remote Resource</li>
</ul>
</blockquote>
<p>You can learn more about <a href="https://kubectl.docs.kubernetes.io/pages/app_management/field_merge_semantics.html" rel="nofollow noreferrer">Kubernetes Field Merge Semantics</a>.</p>
<ul>
<li><p>If your limitation is not knowing the secret <code>default-token-xxxxx</code> name, no problem, just keep that field out of your yaml.</p>
</li>
<li><p>As long as the yaml has enough fields to identify the target resource (name, kind, namespace) it will add/edit the fields you set.</p>
</li>
<li><p>I created a cluster (minikube in this example, but it could be any) and retrieved the current default serviceAccount:</p>
</li>
</ul>
<pre><code>$ kubectl get serviceaccount default -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: &quot;2020-07-01T14:51:38Z&quot;
  name: default
  namespace: default
  resourceVersion: &quot;330&quot;
  selfLink: /api/v1/namespaces/default/serviceaccounts/default
  uid: a9e5ff4a-8bfb-466f-8873-58c2172a5d11
secrets:
- name: default-token-j6zx2
</code></pre>
<ul>
<li>Then, we create a yaml file with the content's that we want to add:</li>
</ul>
<pre><code>$ cat add-image-pull-secrets.yaml 
apiVersion: v1
kind: ServiceAccount
metadata:
  name: default
  namespace: default
imagePullSecrets:
 - name: registry-my-registry
</code></pre>
<ul>
<li>Now we apply and verify:</li>
</ul>
<pre><code>$ kubectl apply -f add-image-pull-secrets.yaml 
serviceaccount/default configured

$ kubectl get serviceaccount default -o yaml
apiVersion: v1
imagePullSecrets:
- name: registry-my-registry
kind: ServiceAccount
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {&quot;apiVersion&quot;:&quot;v1&quot;,&quot;imagePullSecrets&quot;:[{&quot;name&quot;:&quot;registry-my-registry2&quot;}],&quot;kind&quot;:&quot;ServiceAccount&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;name&quot;:&quot;default&quot;,&quot;namespace&quot;:&quot;default&quot;}}
  creationTimestamp: &quot;2020-07-01T14:51:38Z&quot;
  name: default
  namespace: default
  resourceVersion: &quot;2382&quot;
  selfLink: /api/v1/namespaces/default/serviceaccounts/default
  uid: a9e5ff4a-8bfb-466f-8873-58c2172a5d11
secrets:
- name: default-token-j6zx2
</code></pre>
<p>As you can see, the ImagePullPolicy was added to the resource.</p>
<p>I hope it fits your needs. If you have any further questions let me know in the comments.</p>
