A deployment script runs kubectl diff before applying. Which exit code means changes are pending?

Answer: D. 1

kubectl diff exits 0 when nothing differs and 1 when something does; anything greater means kubectl or the diff tool itself failed.

Source: kubectl diff (Kubernetes) — Synopsis