k8s.manifest.diff_set

Drift report for a desired manifest set (no mutation)

Compute a drift report for a desired manifest set without mutating the cluster.

For each manifest, GETs the live object and server-side-apply dry-runs it, diffing top-level fields (excluding metadata/status). Returns the subset that is out of sync.

Inputs:

• connection_uuid: CloudConnection UUID for the target cluster (required).
• manifests: List of resource manifest dicts (required).
• namespace: Default namespace for namespaced manifests (optional).

Outputs:

• out_of_sync: [{api_version, kind, namespace, name, status, changed_fields, live, desired}] status = "missing" (would create) | "drift" (would update). live/desired are the sanitized current and projected (dry-run server-side-apply) objects, so callers can render a full field-level / YAML diff. live is null for "missing". Secret payloads are projected to key names — every value is replaced with "[REDACTED]" so the report, which is persisted to unencrypted state_data, never carries credentials. Drift itself is computed on the raw objects, so changed_fields still reports a Secret whose data differs.
• in_sync_count: int — manifests already matching the cluster.
• is_synced: bool — True when out_of_sync is empty.

Plugin required: context.get_plugin("connection").kubernetes_runner_clients(connection_uuid, organization_uuid) exposing api_client.

Overview

Property	Value
Workflow type	Atomic
Library	App-kubernetes
Version	1.0

Input Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	Yes	—	CloudConnection UUID for the target cluster
manifests	json	Yes	—	List of resource manifest dicts
namespace	string	No	—	Default namespace for namespaced manifests

Output Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	No	—	CloudConnection UUID echoed from input.
manifests	json	No	—	—
namespace	string	No	—	—
out_of_sync	json	No	—	Drift entries. live/desired are sanitized; Secret payload values are redacted to key names.
in_sync_count	integer	No	—	—
is_synced	boolean	No	—	—
failure_reason	string	No	—	—
failure_type	string	No	—	—
failed_action	string	No	—	—
failed_at_state	string	No	—	—
failed_step	string	No	—	—
failed_layer	string	No	—	—
error	string	No	—	—
error_type	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "k8s.manifest.diff_set",
  "initial_data": {
    "connection_uuid": "value",
    "manifests": "value"
  }
}