konfig diff

konfig diff <env> shows what a render would change compared to a committed baseline, without writing anything. It renders the env in memory and compares it, file by file and document by document, against the YAML tree at <root>/<diff.baseline>/<env>. The comparison is structural: both sides are parsed as YAML and compared as values, so key order, quoting style, and whitespace never show up as changes.

Usage

konfig diff <env> [--format summary|detail|json]
                  [--cluster <name>] [--k8s-version <ver>] [--flag k=v ...]

Arguments

Flags

Behaviour

The command needs a baseline to compare against. diff.baseline must be set in konfig.json; otherwise the command fails with DiffBaselineMissing before rendering anything.

The left side of the comparison is every .yaml file under the baseline directory, found recursively and keyed by its relative path. The right side is the in-memory render, keyed by its path relative to the output directory. A file that exists on only one side is reported as + <file> when it is new in the render, or - <file> when it only exists in the baseline.

Files that hold several YAML documents are matched document by document using each document’s identity (kind|namespace|name), not its position in the file, so reordering documents is not a change. Single-document files are compared as one value.

Both sides are normalised before comparison so that a Helm-managed baseline stays comparable to a konfig render. The normalisation drops the following:

• object values that are null or undefined
• the helm.sh/chart label
• the app.kubernetes.io/managed-by: Helm label
• the meta.helm.sh/release-name and meta.helm.sh/release-namespace annotations

Secrets are redacted. For every document with kind: Secret, each value under data and stringData is replaced with <redacted> on both sides before comparing and printing. A key that was added or removed still shows up as a change, because it changes the map; a value that changed does not, and secret material never reaches the terminal.

Exit codes and errors

When nothing differs the command exits 0 and prints an OK line: env '<env>' matches baseline. When anything differs it prints the diff and exits non-zero, so it works as a CI gate.

Example

konfig diff prod
# ~ api/Deployment-api.yaml
# + api/ConfigMap-feature-flags.yaml

konfig diff prod --format detail
konfig diff prod --format json > diff.json