What happened?

Observations when using kubectl apply --dry-run=client:

We noticed inconsistent behavior depending on whether a resource already exists in the cluster:

Resource = Deployment

If the Deployment with same name already exists, --dry-run=client outputs the current live values from the cluster.

If the Deployment with same name does not exist, it outputs the values from the manifest provided.

We observed same with configmap too.

What did you expect to happen?

The expectation is the command outputs the values from the manifest provided always.

How can we reproduce it (as minimally and precisely as possible)?

Create a Deployment object with minimal configuration.
Then, apply the same Deployment manifest name again, but this time add one new field (e.g., serviceAccountName).
Run kubectl apply --dry-run=client with this updated manifest, and observe how the output behaves.

Anything else we need to know?

No response

Kubernetes version

$ kubectl version
# paste output here

Cloud provider

OS version

# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here

Install tools

Container runtime (CRI) and version (if applicable)

Related plugins (CNI, CSI, ...) and versions (if applicable)