kubernetes manifest diff derived

{
  "input": {
    "body": {
      "after": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: web\n  labels:\n    app: web\nspec:\n  replicas: 5\n  selector:\n    matchLabels:\n      app: web-v2\n  template:\n    metadata:\n      labels:\n        app: web\n    spec:\n      containers:\n        - name: web\n          image: ghcr.io/example/web:2.1.0\n          ports:\n            - containerPort: 8080\n          resources:\n            requests:\n              cpu: 500m\n              memory: 256M\n            limits:\n              cpu: 200m\n              memory: 512Mi\n          env:\n            - name: DATABASE_PASSWORD\n              value: hunter2\n            - name: FEATURE_FLAG\n              value: no\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: web\nspec:\n  type: LoadBalancer\n  selector:\n    app: webserver\n  ports:\n    - port: 80\n      targetPort: 9090\n",
      "before": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: web\n  labels:\n    app: web\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: web\n  template:\n    metadata:\n      labels:\n        app: web\n    spec:\n      containers:\n        - name: web\n          image: ghcr.io/example/web:latest\n          ports:\n            - containerPort: 8080\n          resources:\n            requests:\n              cpu: 500m\n              memory: 256M\n            limits:\n              cpu: 200m\n              memory: 512Mi\n          env:\n            - name: DATABASE_PASSWORD\n              value: hunter2\n            - name: FEATURE_FLAG\n              value: no\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: web\nspec:\n  selector:\n    app: webserver\n  ports:\n    - port: 80\n      targetPort: 9090\n"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxFindings": 500,
        "maxDocuments": 100,
        "maxYamlBytes": 262144,
        "maxDockerfileBytes": 131072
      },
      "passed": false,
      "objects": [
        {
          "kind": "Deployment",
          "object": "apps/v1/Deployment/default/web",
          "changed": true,
          "restarts_pods": true,
          "immutable_fields_changed": [
            "spec.selector"
          ]
        },
        {
          "kind": "Service",
          "object": "v1/Service/default/web",
          "changed": true,
          "restarts_pods": false,
          "immutable_fields_changed": [
            "spec.type"
          ]
        }
      ],
      "complete": true,
      "findings": [
        {
          "code": "SCALAR_IS_A_YAML_BOOLEAN",
          "line": 33,
          "detail": "before: \"no\" is an unquoted YAML 1.1 boolean and reads as false, not as the text no. Quoting it keeps it a string.",
          "location": "spec.template.spec.containers[0].env[1].value"
        },
        {
          "code": "SCALAR_IS_A_YAML_BOOLEAN",
          "line": 33,
          "detail": "after: \"no\" is an unquoted YAML 1.1 boolean and reads as false, not as the text no. Quoting it keeps it a string.",
          "location": "spec.template.spec.containers[0].env[1].value"
        },
        {
          "code": "IMMUTABLE_FIELD_CHANGED",
          "detail": "apps/v1/Deployment/default/web changes spec.selector, which is immutable for a Deployment. An apply fails and the object has to be deleted and recreated, which for a Service means losing its cluster I...",
          "location": "apps/v1/Deployment/default/web"
        }
      ],
      "unchanged": false,
      "request_id": "example-request",
      "service_id": "kubernetes_manifest_diff",
      "assumptions": [
        "Objects are matched by apiVersion, kind, namespace and name, which is how an apply matches them. A rename is therefore a removal and an addition, not a change, which is exactly what the cluster will d...",
        "A change under the pod template recreates every pod and a change anywhere else does not, so the two are reported separately rather than as one undifferentiated diff.",
        "The immutable field list is per kind and is published in the response, so a caller can see which fields were considered rather than trusting an unstated list."
      ],
      "limitations": [
        "The two document sets supplied. Admission controllers, defaulted fields and server-side apply field ownership are outside this, and nothing is fetched.",
        "unchanged is true only when every object was compared and nothing differed."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 5,
      "service_version": "1.0.0",
      "findings_by_code": {
        "REPLICAS_CHANGED": 1,
        "IMMUTABLE_FIELD_CHANGED": 2,
        "SCALAR_IS_A_YAML_BOOLEAN": 2
      },
      "after_object_count": 2,
      "before_object_count": 2,
      "changed_object_count": 2,
      "immutable_change_count": 2,
      "restarting_object_count": 1
    }
  }
}