kubectl apply reads Kubernetes object configuration and sends a request to the Kubernetes API to create or change the resources it describes. If a resource does not exist, apply creates it; if it already exists, apply reconciles it according to the selected apply mode. A successful command means the API accepted the configuration—not that the application is already running or healthy.
What happens when you run kubectl apply?
The command takes a declarative configuration—usually YAML or JSON—and uses it to request a change to cluster resources. Its broad sequence is:
As an Amazon Associate I earn from qualifying purchases.
- Load the configuration. You can provide a file, standard input, a directory, a URL, or a Kustomize directory. Directory processing can include subdirectories with
-R. See the kubectl apply command reference for supported inputs and options. - Prepare the operation. Flags can change validation, dry-run behavior, field-manager identity, or whether the command uses Server-Side Apply. Defaults and available behavior can vary by kubectl and API server version.
- Send the request to the API. The API receives an operation for each resource described in the input. With Server-Side Apply, the request is a create if the object is absent and a patch if it exists; this is not a general-purpose operation for every API endpoint. The Kubernetes API Concepts documentation describes the API behavior.
- Validate and process the object. Strict validation is the command-reference default. When supported, validation happens on the API server; otherwise kubectl can fall back to client-side validation. The
--validate=strict,warn, andignoresettings affect how unknown or duplicate fields are handled. - Persist the change or show a preview. A normal apply changes cluster state. Dry-run modes let you inspect a proposed operation without persisting it.
Apply is not a wholesale replacement of an object. The precise change depends on the apply mode and how fields are tracked. Nor does a successful API write prove that a workload has become ready; use workload status or rollout checks to assess that separately.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Client-side apply and Server-Side Apply compared
The key difference is how Kubernetes records intent and manages ownership of fields.
#1 Best Overall
| Aspect | Traditional client-side apply | Server-Side Apply |
|---|---|---|
| Where the apply logic runs | kubectl prepares the changes using the configuration, the live object, and the saved prior configuration. | The API server processes the apply request. |
| How prior intent or ownership is recorded | The kubectl.kubernetes.io/last-applied-configuration annotation stores the last-applied configuration. |
The API server records field ownership in metadata.managedFields. |
| Conflict behavior | The documented client-side mechanism compares configurations to determine changes; it does not use Server-Side Apply’s managed-field conflict model. | A change to a field asserted by another manager normally fails with a conflict. --force-conflicts overrides it and transfers ownership. |
| Field manager | Not the managed-field ownership mechanism used by Server-Side Apply. | Identifies the workflow asserting fields; the Server-Side Apply default is kubectl. |
Traditional client-side apply uses the saved annotation along with the live object and new configuration to work out changes. Server-Side Apply moves that work to the API server and tracks which manager asserts each field. The declarative configuration guide explains the annotation-based workflow; the Server-Side Apply documentation explains field ownership.
What field conflicts mean—and what happens when a field is omitted
A Server-Side Apply conflict means the requested change would alter a field that another manager also asserts. The default response is to reject the request rather than silently take over that field. Review which manager owns it and coordinate the intended change before retrying. Using --force-conflicts is an explicit ownership transfer, not simply a harmless retry.
Omitting a field from a later apply configuration can also change the object. Kubernetes checks whether another manager owns the field; if the applying manager is its only owner, the field is removed or reset to its applicable default. If multiple managers assert the same value, they can share ownership. This is why a manifest should be treated as the desired state for fields its manager controls, not as a harmless partial note.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow dry-run and diff let you preview changes
kubectl apply --dry-run=clientprints the object that would be sent without sending it to the API server.kubectl apply --dry-run=serversends a server-side request for evaluation without persisting the result.kubectl diffuses Server-Side Apply in dry-run mode. It depends on API server support and the permissions needed for that request.
These modes answer different questions: client dry-run shows the locally prepared object, while server dry-run asks the API server to evaluate the request. Check the command reference for the kubectl and cluster versions in use, particularly where server-side validation or dry-run support matters.
Rank #3
When to use each apply mode
- Use traditional apply when you rely on the established client-side workflow and its last-applied annotation.
- Use
kubectl apply --server-sidewhen you want API-server-managed field ownership and conflict detection among managers. - Pause on a conflict to determine which workflow owns the field and whether the proposed change is intended. Force only when you deliberately want to transfer ownership.
Server-Side Apply can combine create-or-update behavior in one request and detect ownership conflicts, but it is not designed for updates that depend on the object’s current value. Choose the method based on how the resource is managed, not just on which command appears shorter.
Quick Recap
Best Value
Two cautions before applying
- Separate API success from application health. Apply configures resources; check workload status or rollout progress to determine whether the resulting application is ready.
- Treat prune as a separate, potentially destructive feature. The current command reference says prune is not complete and advises against using it unless you are aware of its state. Prune can delete objects missing from the supplied configuration; it is not part of the normal create-or-update behavior.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
