# Panfactum Changelog — edge.24-12-10

> Changes TLS certificate provisioning architecture to avoid rate limits on large clusters, adds backwards compatibility for EKS cluster creator privileges, and improves Authentik stability during PostgreSQL failovers.

## Highlights

- TLS certificate provisioning architecture changed — must upgrade `kube_cert_issuers` then `kube_ingress_nginx` in order
- New `bootstrap_cluster_creator_admin_privileges` input in `aws_eks` for backwards compatibility

## Breaking Changes

- This release changes the way public ingress TLS certificates are provisioned to avoid hitting rate limits on large clusters. Modules
  - Impacts: iac-module `kube_cert_issuers` — TLS certificate provisioning architecture changed to avoid rate limits
  - Impacts: iac-module `kube_ingress_nginx` — Must be upgraded after kube_cert_issuers for new TLS provisioning

## Fixes

- Adds `bootstrap_cluster_creator_admin_privileges` input to [`aws_eks`](https://panfactum.com/docs/edge/reference/infrastructure-modules/direct/aws/aws_eks) to provide backwards compatibility with clusters created with this field set to `true`.
  - Impacts: iac-module `aws_eks` — Adds backwards-compatible cluster creator admin privileges input
- Temporary Authentik disruptions caused by PostgreSQL database failovers have been mitigated.
  - Impacts: iac-module `kube_authentik` — Mitigates disruptions during PostgreSQL database failovers

## Upgrade Instructions

## Upgrade Modules in Order

This release changes the way that public ingress TLS certificates are provisioned in order to avoid
hitting rate limits on large clusters. **This architectural update requires that the modules be upgraded in
the following order:**

1. [`kube_cert_issuers`](https://panfactum.com/docs/edge/reference/infrastructure-modules/direct/kubernetes/kube_cert_issuers)

2. [`kube_ingress_nginx`](https://panfactum.com/docs/edge/reference/infrastructure-modules/direct/kubernetes/kube_ingress_nginx).
   **To avoid service disruptions, you MUST wait until all the old NGINX pods have been fully terminated
   before proceeding.**

3. The remainder of the modules may be updated in any order.

## Related Resources

- [JSON Data](https://panfactum.com/docs/changelog/edge.24-12-10.json): Machine-readable data
- [Channel Release List](https://panfactum.com/docs/changelog/edge.json): All releases in this channel