kubectl apply --server-side -f deploy.yaml

Lets the API server compute the patch instead of the kubectl client, avoiding conflicts when multiple controllers manage the same field. The server tracks each field's owning manager, so ownership shows up in kubectl describe output. Fall back to plain kubectl apply -f deploy.yaml if your cluster predates server-side apply.