# Panfactum Changelog — edge.24-12-13

> Replaces kube_rbac with EKS access entries, consolidates priority classes into kube_policies, upgrades Authentik to 2024.8.2, and fixes Argo Workflows permissions and NATS connection issues.

## Highlights

- `kube_rbac` deprecated — destroy it after upgrading `aws_eks` which now uses EKS access entries
- `kube_priority_classes` consolidated into `kube_policies` — destroy it before upgrading `kube_policies`
- Provider versions updated: `pf` 0.0.4→0.0.5, `authentik` 2024.6.1→2024.8.4
- `eks_cluster_name` removed from most submodules — now resolved dynamically

## Breaking Changes

- The `kube_rbac` module has been deprecated and replaced by EKS access entries in [`aws_eks`](https://panfactum.com/docs/edge/reference/infrastructure-modules/direct/aws/aws_eks). Destroy any deployments of `kube_rbac` after
  - Impacts: iac-module `aws_eks` — Now manages RBAC via EKS access entries instead of kube_rbac
- The `kube_priority_classes` module has been consolidated into [`kube_policies`](https://panfactum.com/docs/edge/reference/infrastructure-modules/direct/kubernetes/kube_policies). Destroy it immediately before upgrading `kube_policies`.
  - Impacts: iac-module `kube_policies` — Now includes priority classes previously in kube_priority_classes
- `eks_cluster_name` is no longer an input to most submodules as it is now dynamically resolved.
- Terraform provider versions upgraded: `pf` 0.0.4→0.0.5, `authentik` 2024.6.1→2024.8.4. Update these in first-party IaC.

## Improvements

- Upgrades Authentik in [`kube_authentik`](https://panfactum.com/docs/edge/reference/infrastructure-modules/direct/kubernetes/kube_authentik) to 2024.8.2.
  - Impacts: iac-module `kube_authentik` — Authentik upgraded to version 2024.8.2

## Fixes

- Adds correct permissions to allow users to retry specific Workflow nodes in Argo Workflows.
  - Impacts: iac-module `kube_argo` — Fixes permissions for retrying specific Workflow nodes
- Adds automatic NATS connection retries to Argo Events components.
  - Impacts: iac-module `kube_argo_event_bus` — Adds automatic NATS connection retries
  - Reference (issue-report): [NATS connection failures in Argo Events](https://github.com/Panfactum/stack/issues/309)
- Addresses issue in [`wf_dockerfile_build`](https://panfactum.com/docs/edge/reference/infrastructure-modules/submodule/workflow/wf_dockerfile_build) where the `git_ref` could not be a branch name.
  - Impacts: iac-module `wf_dockerfile_build` — Fixes git_ref to accept branch names

## Upgrade Instructions

import MarkdownAlert from "@/components/markdown/MarkdownAlert.astro"

<MarkdownAlert severity="warning">
  This Authentik upgrade contains
  [a problem](https://github.com/goauthentik/authentik/issues/12321) that will result in updates to group names
  not automatically synchronizing with AWS. If that is a problem, defer upgrading until the issue is resolved.
</MarkdownAlert>

<MarkdownAlert severity="warning">
  This release contains a bug that will cause Cilium to crash if deployed via
  [`wf_tf_deploy`](https://panfactum.com/docs/edge/reference/infrastructure-modules/submodule/workflow/wf_tf_deploy).
  Please ensure you upgrade to `edge.25-01-04` locally before re-enabling CI/CD deployments for the core infrastructure.
</MarkdownAlert>

## Remove `kube_rbac`

The `kube_rbac` module has been deprecated and replaced by EKS access entries in
[`aws_eks`](https://panfactum.com/docs/edge/reference/infrastructure-modules/direct/aws/aws_eks).

1. First, upgrade [`aws_eks`](https://panfactum.com/docs/edge/reference/infrastructure-modules/direct/aws/aws_eks).
2. After the `aws_eks` upgrade is complete, destroy any deployments of `kube_rbac`.

## Remove `kube_priority_classes`

The `kube_priority_classes` module has been consolidated into
[`kube_policies`](https://panfactum.com/docs/edge/reference/infrastructure-modules/direct/kubernetes/kube_policies).

1. Destroy `kube_priority_classes` **immediately before** upgrading
   [`kube_policies`](https://panfactum.com/docs/edge/reference/infrastructure-modules/direct/kubernetes/kube_policies).

## Update Provider Versions

This release upgrades the following Terraform provider versions — update these in first-party IaC:

* `pf`: 0.0.4 → 0.0.5
* `authentik`: 2024.6.1 → 2024.8.4

## Related Resources

- [JSON Data](https://panfactum.com/docs/changelog/edge.24-12-13.json): Machine-readable data
- [Channel Release List](https://panfactum.com/docs/changelog/edge.json): All releases in this channel