Safe apply

Safe apply (Preview changes)

Before a change reaches a cluster, Sextant can show you what the API server would store, next to what is there now. The preview is the API server's own answer to a server-side dry run (dryRun=All) of exactly the request the change would send, so it includes what a plain text diff misses: defaults the server fills in, labels and sidecars added by admission webhooks, and objects that validation or a policy would refuse. Nothing is changed by a preview.

Contents: Where it works · Preview changes before applying · Reading a preview · Helm upgrades and installs · Secrets · AI agents · Limits

Where it works

Change	How to preview it
Edit (the YAML editor)	Preview changes next to Save; on a cluster that asks for previews, Save becomes Preview and save…
Create resource (Apply YAML, one or more documents)	Preview changes next to Apply; on a cluster that asks for previews, Apply becomes Preview and apply…
Helm: Edit values (upgrade) and Install of a chart	Preview changes in the dialog; on a cluster that asks for previews, the dialog's confirm button is enabled only after a preview of what you entered

After a preview, Save or Apply sends the change you previewed; Back to editing returns to the text. The change is sent only when you confirm it, exactly as without a preview, and is marked with the field manager sextant.

Preview changes before applying

Each cluster has the setting Preview changes before applying (right-click the cluster in the rail → Settings → Change preview; see Settings). With it on, every save in the editor, every apply in Create resource and every Helm upgrade or install on that cluster shows the preview first. With it off, the preview is one button away.

Until you choose, the setting follows the cluster's name: it is on when the display name, the kubeconfig context or the kubeconfig cluster name contains prod or production as a word of its own (prod, eks_production, gke_acme_europe-west1_prod-eu, prod1), and off otherwise (products, preprod do not count). The section says which default applies; Use the default returns to it after you changed it.

Reading a preview

The list on the left names every object of the change and what would happen to it:

State	Meaning
New	The object does not exist yet: it would be created.
Changed	The live object and the stored result differ; both are shown side by side with the differences highlighted.
Unchanged	The API server would store the object as it is.
Refused	The API server would refuse it (validation, an admission webhook, a missing namespace…), with its message.

Fields that change on every write (resourceVersion, generation, managedFields) are left out, so the diff shows only what your change does.

An apply stops at the first refused document after applying the ones before it, so when the preview refuses something, fix the text first: Apply stays disabled while a document is refused. A document whose namespace is created by an earlier document of the same apply cannot be checked yet (the namespace does not exist during the dry run); the preview says so, and applying creates the namespace first.

Helm upgrades and installs

For a Helm release the preview compares the release's current manifest with the manifest Helm would apply, like helm diff upgrade. Sextant runs helm upgrade or helm install with --dry-run=server, so Helm renders the chart against the cluster (its lookup functions see real objects) and installs nothing. Both manifests are cut into objects and sorted by kind, namespace and name, so the same object lines up on both sides whatever order the chart uses.

• An install of a release name that does not exist yet shows every object as new.
• Helm hooks are not part of the comparison.
• A Helm older than 3.13 cannot render against the cluster; Sextant then uses its plain --dry-run and says that Secrets and other values a chart reuses through lookup may show as changed.
• Rendering is stopped after 2 minutes, and when you close the dialog or the cluster.

Secrets

A preview never shows a Secret value, on either side. A Secret appears as everywhere in Sextant, its values empty, and what would change is told by key names: "Values added: tls.key", "Values changed: password", "Values removed: old". The values are compared inside Sextant's backend and never reach the window.

AI agents

Agents connected through the MCP server can check a change the same way: apply_yaml and patch_resource take dryRun: true. A dry run follows the cluster's access rules like the change itself but is never confirmed in the window (nothing changes), and it is recorded in the activity log as "(dry run)". A dry run that touches a Secret also needs the Secret values permission, and it never tells whether a Secret value would differ. See MCP server.

Limits

• A preview shows what the API server says now; another change between the preview and your Save can make the result differ (the editor's conflict check still applies).
• The API server refuses a dry run that would call an admission webhook declaring side effects; the preview then shows that refusal.
• Extensions cannot request previews.

Next: Using Sextant, Settings.