Compare

Compare and drift

Sextant compares an object with another one — in another cluster, another namespace or under another name — with its last-applied configuration, or with its Helm release's manifest, and compares two namespaces as a whole. Comparing is read-only: nothing is changed, and a cluster that is not connected is connected only when you click Connect.

Contents: Compare with… · What is left out · Ignored paths · Drift from last-applied and from Helm · Secrets · Compare namespaces · Limits

Compare with…

Compare with… is in the actions of every object (the row's ⋮, the details, the command palette). Choose what to compare with:

• Another object: pick the Cluster, Namespace and Name; names of that kind are suggested as you type (Matching objects). A cluster that is not connected shows Not connected and a Connect button.
• Its last-applied configuration: the kubectl.kubernetes.io/last-applied-configuration annotation, offered only when the object has one (it was created or changed with kubectl apply).
• Its Helm release manifest: offered only for an object of a Helm release (it carries meta.helm.sh/release-name and meta.helm.sh/release-namespace).

Press Compare. The result is a side-by-side view with the number of fields that differ and a list of them; No differences. when there are none.

Typical uses: staging against production (payments in staging and in prod), two replicas of a configuration in different namespaces, or "what did someone change by hand?".

What is left out

So that the comparison shows what you care about, these are never compared:

• status;
• what the API server writes: managedFields, uid, resourceVersion, generation, creationTimestamp, selfLink, the namespace, owner references' uid;
• generated names (a name from generateName is compared as its prefix);
• controller labels such as pod-template-hash, controller-revision-hash, controller-uid, job-name;
• the annotations kubectl.kubernetes.io/last-applied-configuration and deployment.kubernetes.io/revision;
• a Secret's values (see Secrets).

Hide defaults (off by default) also leaves out fields the API server fills in when a manifest does not set them (for example imagePullPolicy, terminationMessagePath, a Deployment's revisionHistoryLimit) while they still hold the default value, and assigned cluster IPs.

Ignored paths

Under every result, Ignored paths of : lists the paths left out of every comparison of that kind; type one and press Ignore, or remove one. A path starts with / and names keys separated by /; * stands for any key or list item:

Path	Leaves out
/spec/replicas	The replica count (scaled by an HPA)
/metadata/labels/team	One label
/metadata/annotations/*	All annotations
/spec/template/spec/containers/*/image	The image of every container

The paths are saved in the settings (compare.ignorePaths in settings.json, per kind), at most 50 per kind.

Drift from last-applied and from Helm

Against a last-applied configuration or a Helm manifest, Sextant shows drift: the fields the desired side sets that the live object has otherwise. Fields the API server or a controller added (defaults, assigned values) are not drift. "The live object has every field of the last-applied configuration unchanged" means no drift.

For a Helm release, Check all of Helm release compares every object of the latest readable revision's manifest with its live copy: In sync, N differences, Missing (the object does not exist in the cluster) or Cannot be read; Details shows the fields. Documents of the manifest that cannot be read are counted and not compared.

Secrets

Secret values are compared inside Sextant's backend by their SHA-256 hashes. The window receives only the key names and, per key, Same value, Different value, Only on the left or Only on the right — neither the values nor their hashes. A value is read into the window only when you click Show values on a key of a live Secret, the same way the Secret's details show one value.

A Secret compared with its last-applied configuration, and a Secret in a Helm manifest, are compared the same way.

Compare namespaces

Cluster → Compare namespaces compares two sides, each a cluster and a namespace (Left and Right), kind by kind. Choose the Kinds (Deployments, StatefulSets, DaemonSets, Services, ConfigMaps, Secrets, Ingresses, HorizontalPodAutoscalers, PodDisruptionBudgets, CronJobs, ServiceAccounts, Roles and RoleBindings; all ticked by default) and compare.

Objects are matched by kind and name into Only on the left, Only on the right, Different and Same (hidden unless you show it); click an object to see its differences. Secrets whose values differ count as Different even when everything else is the same. A kind that cannot be listed on one side is reported and the others are still compared.

The comparison is a snapshot taken when you press the button; it does not follow later changes.

Limits

• At most 500 objects of a kind per side and 40 kinds in one namespace comparison; the rest are not compared, and the page says so.
• At most 500 Secrets per namespace for the value comparison, and 300 objects of a Helm release.
• Only kinds that live in a namespace; cluster-wide kinds are compared object by object with Compare with….
• AI agents (MCP server) and extensions cannot use any of it.