From b39d705244696fbdcf1deacf754e671e9fbdfc7a Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Sun, 30 Aug 2026 11:22:12 +0200
Subject: [PATCH] fix(kube): reject dry run when server-side apply is disabled
 in Update()

Client-side update paths (patchResourceClientSide, replaceResource) do not
honor the dryRun flag, so Update(..., DryRun(true), ServerSideApply(false))
would still perform real writes. Add a guard that returns an error in the
same style as the existing forceConflicts && !serverSideApply check.

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/kube/client.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkg/kube/client.go b/pkg/kube/client.go
index da3016fc9..e5e7aa8d3 100644
--- a/pkg/kube/client.go
+++ b/pkg/kube/client.go
@@ -831,6 +831,10 @@ func (c *Client) Update(originals, targets ResourceList, options ...ClientUpdate
 		return &Result{}, errors.New("invalid operation: cannot use server-side apply and force replace together")
 	}
 
+	if updateOptions.dryRun && !updateOptions.serverSideApply {
+		return &Result{}, errors.New("invalid operation: dry run requires server-side apply")
+	}
+
 	createApplyFunc := c.makeCreateApplyFunc(
 		updateOptions.serverSideApply,
 		updateOptions.forceConflicts,