# Panfactum Changelog — edge.25-02-07

> **Warning:** This release has been flagged as one that users should skip.

> Contains a VPA CRD bug that affects upgrades - skip this release. Improves VPA pod eviction policies, adds PostgreSQL CPU update thresholds to prevent autoscaling thrash, and fixes several deployment issues.

## Highlights

- Skip this release — VPA CRD bug makes upgrading to the next release difficult without manual intervention

## Additions

- Adds ability to pass extra service annotations through the [`kube_deployment`](https://panfactum.com/docs/edge/reference/infrastructure-modules/submodule/kubernetes/kube_deployment) module.
  - Impacts: iac-module `kube_deployment` — New support for extra service annotations

## Improvements

- Enables the Access Token auth method for the Argo Workflows server to allow direct API access programmatically.
  - Impacts: iac-module `kube_argo` — Enables Access Token auth method for direct API access
- The vertical pod autoscaler will now only evict pods when resources need to scale up, not down. This reduces unnecessary
  - Impacts: iac-module `kube_vpa` — Only evicts pods on scale-up, no longer on scale-down

## Fixes

- Added `pg_minimum_cpu_update_millicores` input to [`kube_pg_cluster`](https://panfactum.com/docs/edge/reference/infrastructure-modules/submodule/kubernetes/kube_pg_cluster) to reduce autoscaling thrash caused by frequent small VPA CPU recommendation updates.
  - Impacts: iac-module `kube_pg_cluster` — New pg_minimum_cpu_update_millicores input to reduce CPU autoscaling thrash
- Applied fix for [argo-events write hole issue](https://github.com/argoproj/argo-events/pull/3449) in [`kube_argo`](https://panfactum.com/docs/edge/reference/infrastructure-modules/direct/kubernetes/kube_argo).
  - Impacts: iac-module `kube_argo` — Fix for argo-events write hole issue
- Fixes bug that prevented [`kube_cert_manager`](https://panfactum.com/docs/edge/reference/infrastructure-modules/direct/kubernetes/kube_cert_manager) from being deployed when `self_generated_certs_enabled` was set to `true`.
  - Impacts: iac-module `kube_cert_manager` — Fix deployment failure when self_generated_certs_enabled is true
  - Reference (issue-report): [kube_cert_manager deployment fails with self_generated_certs_enabled](https://github.com/Panfactum/stack/issues/208)
- Fixes `aws_eks` subnet validation check that prevented module deployment in some valid scenarios.
  - Impacts: iac-module `aws_eks` — Fix subnet validation check blocking valid deployments

## Related Resources

- [JSON Data](https://panfactum.com/docs/changelog/edge.25-02-07.json): Machine-readable data
- [Channel Release List](https://panfactum.com/docs/changelog/edge.json): All releases in this channel