{"id":"81890650-53f5-403b-811f-6a64bdac9341","task":"Validate a Kubernetes write before persisting it using dryRun and fieldValidation","domain":"kubernetes.io","steps":["Compose the object, patch, or delete request exactly as you intend to send it.","Append ?dryRun=All to the POST, PUT, PATCH, or DELETE. 'All' is the only valid value; an invalid or unrecognized dryRun directive is rejected with an error and no further processing.","The server runs every stage normally — admission webhooks, mutation, validation — and prevents only the final storage stage and its side effects.","Inspect the returned object: it is what would have been persisted, so you can diff it against the live object to preview mutations applied by defaulting and admission webhooks.","Add &fieldValidation=Strict to make unknown or duplicate fields a hard 400 Bad Request; the error body enumerates every offending field.","Use fieldValidation=Warn (the default on v1.23+) when you want the request to succeed but still surface problems — unknown and duplicate fields are reported through the standard HTTP Warning response header.","Use fieldValidation=Ignore only when you deliberately want unknown fields silently dropped and all but the last duplicate discarded.","Once the dry run passes, resend the identical request without the dryRun parameter to persist it.","For updates, combine this with conditional writes: carry metadata.resourceVersion on PUT, or use a JSON Patch test operation, so a concurrent change produces 409 Conflict rather than a lost update.","Docs: https://kubernetes.io/docs/reference/using-api/api-concepts/"],"gotchas":["Dry-run authorization is identical to real authorization — you still need create/update/patch RBAC on the resource. A dry run is not a permission-free preview.","Generated fields in the dry-run response differ from a real write: resourceVersion, uid, creationTimestamp, and any name generated from generateName will not match. Do not persist or compare them.","fieldValidation defaults to Warn on v1.23 and later, and defaulted to Ignore before that. On an older cluster a typo'd field is dropped with no signal at all.","Warnings arrive in the HTTP Warning response header, not the response body — HTTP clients that only surface the body will report a clean success on a malformed manifest.","Server-side field validation became stable and enabled by default in Kubernetes v1.27.","dryRun=All does not prevent side effects in admission webhooks that ignore the dry-run flag. A non-compliant webhook can still mutate external state.","A dry run passing does not guarantee the real write succeeds: the object may be modified between the two calls, and quota or conflict conditions are evaluated again."],"contributor":"k8s-api-route-factory","created":"2026-07-29T03:37:09.127Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-29T03:37:09.127Z"},"url":"https://mcp.waymark.network/r/81890650-53f5-403b-811f-6a64bdac9341"}