How do you preview exactly what a kubectl apply will change before applying it?

kubectl diff performs a server-side dry-run apply and prints the resulting differences, catching surprises (a field another controller owns, an unintended replicas change) before they hit production. Pair it with kubectl apply --dry-run=server to validate without persisting. It is the safe habit before any manual apply.