Module #39 · beginner Article
Dry-Run Validation: Client-Side vs. Server-Side Mutation Testing
`--dry-run=client` validates locally without hitting the API server; `--dry-run=server` sends the request to the API server for full validation including adm...
2 min read+10 XPPublished 2026-07-11
Quick Answer: --dry-run=client validates locally without hitting the API server; --dry-run=server sends the request to the API server for full validation including admission webhooks — server-side is more accurate.
Detailed Answer:
# Client-side dry run — fast, no API call, limited validation
kubectl apply -f deployment.yaml --dry-run=client
# Use for: quick syntax check, generating output
# Server-side dry run — full API server validation including:
# - Admission webhooks (OPA, Kyverno policies)
# - Schema validation against CRDs
# - RBAC (in some configurations)
kubectl apply -f deployment.yaml --dry-run=server
# Use for: pre-flight check before production apply
# The most common use — generate YAML scaffold from imperative command
kubectl create deployment my-app \
--image=nginx:1.27 \
--replicas=3 \
--dry-run=client -o yaml
# Diff live state vs local manifest (uses server-side dry run internally)
kubectl diff -f deployment.yaml
Key Takeaway: Use --dry-run=server before any production change — it catches policy violations that client-side misses.
Finished reading?
Mark as complete to claim your +10 XP and track progress.