--- title: Kubernetes — dry-run=client vs — dry-run=server: The... description: A focused comparison of Kubernetes `--dry-run=client` and `--dry-run=server` flags, explaining their architectural differences. Client dry run runs entirely... canonical: https://daily.dev/posts/kubernetes-dry-run-client-vs-dry-run-server-the-difference-every-cka-cks-candidate-must-know-cnptikvsr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kubernetes — dry-run=client vs — dry-run=server: The Difference Every CKA/CKS Candidate Must Know | daily.dev og:description: A focused comparison of Kubernetes `--dry-run=client` and `--dry-run=server` flags, explaining their architectural differences. Client dry run runs entirely... og:url: https://daily.dev/posts/kubernetes-dry-run-client-vs-dry-run-server-the-difference-every-cka-cks-candidate-must-know-cnptikvsr og:image: https://api.daily.dev/og/posts/cNPtiKVSR.png og:image:alt: Kubernetes — dry-run=client vs — dry-run=server: The Difference Every CKA/CKS Candidate Must Know og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kubernetes — dry-run=client vs — dry-run=server: The Difference Every CKA/CKS Candidate Must Know **[Medium](https://daily.dev/sources/medium_js)** · 5 min read · 0 upvotes · 0 comments ## Summary A focused comparison of Kubernetes `--dry-run=client` and `--dry-run=server` flags, explaining their architectural differences. Client dry run runs entirely locally in kubectl with no API server contact, making it useful only for syntax validation and manifest generation. Server dry run sends the request through the full API server pipeline — including RBAC, admission controllers, Pod Security Admission, and schema validation — without persisting the object to etcd. A practical example demonstrates how a privileged pod passes client dry run but is rejected by server dry run when the namespace enforces the Restricted Pod Security Standard. The post also highlights how combining `--dry-run=server -o yaml` reveals mutations applied by webhooks and defaulting, making it a powerful debugging tool for CKA/CKS exam scenarios. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [The Difference Between Knowing Kubernetes and Understanding Kubernetes](https://daily.dev/posts/the-difference-between-knowing-kubernetes-and-understanding-kubernetes-qve2fcly2) · Medium · 71 upvotes · 12 comments - [When Kubernetes restarts your pod — And when it doesn’t](https://daily.dev/posts/when-kubernetes-restarts-your-pod-and-when-it-doesn-t-zhrxezkcv) · CNCF · 3 upvotes · 0 comments - [SSO-Backed kubectl Access Across Many Clusters](https://daily.dev/posts/sso-backed-kubectl-access-across-many-clusters-1myvsp9ee) · Teleport · 0 upvotes · 0 comments - [Inside the Kubernetes API Server: The Brain Behind Every Kubernetes Operation](https://daily.dev/posts/inside-the-kubernetes-api-server-the-brain-behind-every-kubernetes-operation-dmpyolvtj) · Medium · 0 upvotes · 0 comments - [Why killing pods is not enough: Testing operator reconciliation with operator-chaos](https://daily.dev/posts/why-killing-pods-is-not-enough-testing-operator-reconciliation-with-operator-chaos-wpoesrwhl) · Red Hat Developer · 1 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/kubernetes-dry-run-client-vs-dry-run-server-the-difference-every-cka-cks-candidate-must-know-cnptikvsr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kubernetes — dry-run=client vs — dry-run=server: The Difference Every CKA/CKS Candidate Must Know","url":"https://daily.dev/posts/kubernetes-dry-run-client-vs-dry-run-server-the-difference-every-cka-cks-candidate-must-know-cnptikvsr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kubernetes-dry-run-client-vs-dry-run-server-the-difference-every-cka-cks-candidate-must-know-cnptikvsr"},"datePublished":"2026-07-15T07:31:18.302Z","dateModified":"2026-07-15T07:32:56.973Z","description":"A focused comparison of Kubernetes `--dry-run=client` and `--dry-run=server` flags, explaining their architectural differences. Client dry run runs entirely...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kubernetes-dry-run-client-vs-dry-run-server-the-difference-every-cka-cks-candidate-must-know-cnptikvsr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Kubernetes — dry-run=client vs — dry-run=server: The Difference Every CKA/CKS Candidate Must Know"}]} ```