diff --git a/README.md b/README.md
index dede9b5..966b947 100644
--- a/README.md
+++ b/README.md
@@ -10,12 +10,6 @@ Kubernetes resource management with Nix
 
 ## Usage
 
-<!-- Apply all resources with
-
-    nix run github:hall/kubenix . -- apply
-
-> **HINT**: use ` --help` for more commands -->
-
 A minimal example flake (build with `nix build`):
 
 ```nix
@@ -53,6 +47,30 @@ Either way the JSON manifests will be written to `./result`.
 
 See [./docs/examples](./docs/examples) for more.
 
+## CLI
+
+> **NOTE**: this is a WIP CLI which currently reads the `k8s` attribute on a local flake
+
+Render all resources with
+
+    nix run github:hall/kubenix -- render
+
+> **HINT**: use ` --help` for more commands
+
+### Support
+
+The following table gives a general overview of currently supported functionality.
+
+|        | kubectl | kustomize | helm  | helmfile |
+| ------ | :-----: | :-------: | :---: | :------: |
+| render |    x    |           | x[^2] |          |
+| diff   |         |           |       |          |
+| apply  |  x[^1]  |           |       |          |
+| hooks  |    -    |     -     |       |          |
+
+[^1]: currently create-only
+[^2]: piping rendered helm charts to kubectl is a lossy process (e.g., [hooks](https://helm.sh/docs/topics/charts_hooks/) will not work)
+
 ## Attribution
 
 This project was forked from https://github.com/GTrunSec/kubenix which was forked from https://github.com/xtruder/kubenix.
diff --git a/pkgs/kubenix.nix b/pkgs/kubenix.nix
index c9627b8..c291fa6 100644
--- a/pkgs/kubenix.nix
+++ b/pkgs/kubenix.nix
@@ -4,11 +4,11 @@
   coreutils,
   nix,
   jq,
+  kubectl,
 }: let
   name = "kubenix";
 in
-  lib.recursiveUpdate
-  (writeShellScriptBin name ''
+  lib.recursiveUpdate (writeShellScriptBin name ''
     set -Eeuo pipefail
 
     NAME=${name}
@@ -18,16 +18,23 @@ in
 
       commands:
         apply    - create resources in target cluster
+        diff     - show a diff between rendered and live resources
         render   - print resource manifests to stdout
       "
     }
 
+    MANIFEST="$(${nix}/bin/nix eval '.#k8s.config.kubernetes.result' --raw)"
+
     function apply() {
-      echo not impremented
+      ${kubectl}/bin/kubectl apply -f $MANIFEST
     }
 
     function render() {
-      ${nix}/bin/nix eval '.#kubernetes' # | ${jq}/bin/jq 'fromjson'
+      cat $MANIFEST | ${jq}/bin/jq
+    }
+
+    function diff() {
+      ${kubectl}/bin/kubectl diff -f $MANIFEST
     }
 
     while test $# -gt 0; do
@@ -36,6 +43,10 @@ in
           shift
           apply
           ;;
+        diff)
+          shift
+          diff
+          ;;
         render)
           shift
           render