zalando-incubator · mikkeloscar · Apr 22, 2026 · Apr 20, 2026 · Apr 20, 2026 · Apr 20, 2026
diff --git a/cluster/manifests/03-kube-aws-iam-controller/vpa.yaml b/cluster/manifests/03-kube-aws-iam-controller/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: kube-aws-iam-controller
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: kube-aws-iam-controller

diff --git a/cluster/manifests/03-skipper-validation-webhook/vpa.yaml b/cluster/manifests/03-skipper-validation-webhook/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: skipper-validation-webhook
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: skipper-admission-webhook

diff --git a/cluster/manifests/04-ebs-csi/vpa.yaml b/cluster/manifests/04-ebs-csi/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: ebs-csi-controller
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: ebs-plugin

diff --git a/cluster/manifests/aws-load-balancer-controller/vpa.yaml b/cluster/manifests/aws-load-balancer-controller/vpa.yaml
@@ -13,7 +13,7 @@ spec:
     kind: Deployment
     name: aws-load-balancer-controller
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: controller

diff --git a/cluster/manifests/aws-node-decommissioner/cronjob.yaml b/cluster/manifests/aws-node-decommissioner/cronjob.yaml
@@ -28,7 +28,7 @@ spec:
           restartPolicy: Never
           containers:
           - name: aws-node-decommissioner
-            image: container-registry.zalando.net/cloud-platform/aws-node-decommissioner:main-17
+            image: container-registry.zalando.net/cloud-platform/aws-node-decommissioner:main-18
             env:
             - name: AWS_REGION
               value: "{{.Cluster.Region}}"

diff --git a/cluster/manifests/cluster-lifecycle-controller/deployment.yaml b/cluster/manifests/cluster-lifecycle-controller/deployment.yaml
@@ -29,7 +29,7 @@ spec:
       serviceAccountName: cluster-lifecycle-controller
       containers:
       - name: cluster-lifecycle-controller
-        image: container-registry.zalando.net/teapot/cluster-lifecycle-controller:master-68
+        image: container-registry.zalando.net/teapot/cluster-lifecycle-controller:master-69
         args:
             - --drain-grace-period={{.Cluster.ConfigItems.drain_grace_period}}
             - --drain-min-pod-lifetime={{.Cluster.ConfigItems.drain_min_pod_lifetime}}

diff --git a/cluster/manifests/cluster-lifecycle-controller/vpa.yaml b/cluster/manifests/cluster-lifecycle-controller/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: "cluster-lifecycle-controller"
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: "cluster-lifecycle-controller"

diff --git a/cluster/manifests/cronjob-fixer/deployment.yaml b/cluster/manifests/cronjob-fixer/deployment.yaml
@@ -27,7 +27,7 @@ spec:
       serviceAccountName: cronjob-fixer
       containers:
         - name: cronjob-fixer
-          image: "container-registry.zalando.net/teapot/cronjob-fixer:master-36"
+          image: "container-registry.zalando.net/teapot/cronjob-fixer:master-37"
           resources:
             limits:
               cpu: 5m

diff --git a/cluster/manifests/cronjob-fixer/vpa.yaml b/cluster/manifests/cronjob-fixer/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: cronjob-fixer
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: cronjob-fixer

diff --git a/cluster/manifests/deployment-service/controller-deployment.yaml b/cluster/manifests/deployment-service/controller-deployment.yaml
@@ -30,7 +30,7 @@ spec:
       terminationGracePeriodSeconds: 300
       containers:
         - name: "deployment-service-controller"
-          image: "container-registry.zalando.net/teapot/deployment-controller:master-307"
+          image: "container-registry.zalando.net/teapot/deployment-controller:master-309"
           args:
             - "--config-namespace=kube-system"
             - "--decrypt-kms-alias-arn=arn:aws:kms:{{ .Cluster.Region }}:{{ .Cluster.InfrastructureAccountID }}:alias/deployment-secret"

diff --git a/cluster/manifests/efs-provisioner/vpa.yaml b/cluster/manifests/efs-provisioner/vpa.yaml
@@ -13,7 +13,7 @@ spec:
     kind: Deployment
     name: efs-provisioner
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: efs-provisioner

diff --git a/cluster/manifests/event-logger/statefulset.yaml b/cluster/manifests/event-logger/statefulset.yaml
@@ -30,7 +30,7 @@ spec:
       serviceAccountName: kubernetes-event-logger
       containers:
       - name: logger
-        image: container-registry.zalando.net/teapot/event-logger:master-34
+        image: container-registry.zalando.net/teapot/event-logger:master-35
         args:
             - --snapshot-namespace=kube-system
             - --snapshot-name=kubernetes-event-logger

diff --git a/cluster/manifests/event-logger/vpa.yaml b/cluster/manifests/event-logger/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: StatefulSet
     name: kubernetes-event-logger
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: logger

diff --git a/cluster/manifests/external-dns/vpa.yaml b/cluster/manifests/external-dns/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: external-dns
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: external-dns

diff --git a/cluster/manifests/ingress-controller/vpa.yaml b/cluster/manifests/ingress-controller/vpa.yaml
@@ -11,7 +11,7 @@ spec:
     kind: Deployment
     name: kube-ingress-aws-controller
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: kube-ingress-aws-controller

diff --git a/cluster/manifests/kube-downscaler/vpa.yaml b/cluster/manifests/kube-downscaler/vpa.yaml
@@ -13,7 +13,7 @@ spec:
     kind: Deployment
     name: kube-downscaler
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: downscaler

diff --git a/cluster/manifests/kube-janitor/vpa.yaml b/cluster/manifests/kube-janitor/vpa.yaml
@@ -13,7 +13,7 @@ spec:
     kind: Deployment
     name: kube-janitor
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: janitor

diff --git a/cluster/manifests/kube-metrics-adapter/vpa.yaml b/cluster/manifests/kube-metrics-adapter/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: kube-metrics-adapter
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: kube-metrics-adapter

diff --git a/cluster/manifests/kube-node-ready-controller/daemonset.yaml b/cluster/manifests/kube-node-ready-controller/daemonset.yaml
@@ -38,7 +38,7 @@ spec:
       dnsPolicy: Default
       containers:
       - name: controller
-        image: container-registry.zalando.net/teapot/kube-node-ready-controller:master-50
+        image: container-registry.zalando.net/teapot/kube-node-ready-controller:master-51
         resources:
           requests:
             cpu: {{.Cluster.ConfigItems.kube_node_ready_controller_cpu}}

diff --git a/cluster/manifests/kube-node-ready-controller/vpa.yaml b/cluster/manifests/kube-node-ready-controller/vpa.yaml
@@ -13,7 +13,7 @@ spec:
     kind: Deployment
     name: kube-node-ready-controller
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: controller

diff --git a/cluster/manifests/kube-state-metrics/deployment.yaml b/cluster/manifests/kube-state-metrics/deployment.yaml
@@ -32,6 +32,7 @@ spec:
         - --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpoints,horizontalpodautoscalers,ingresses,jobs,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
         - --metric-labels-allowlist=pods=[{{.Cluster.ConfigItems.observability_metrics_pods_labels}}],ingresses=[{{.Cluster.ConfigItems.observability_metrics_ingresses_labels}}],nodes=[topology.kubernetes.io/zone,node.kubernetes.io/instance-type,node.kubernetes.io/node-pool,node.kubernetes.io/role,node.kubernetes.io/profile,dedicated]
         - --metric-annotations-allowlist=pods=[{{.Cluster.ConfigItems.observability_metrics_pods_annotations}}]
+        - --custom-resource-state-config-file=/etc/config/stackset-metrics-config.yaml
         ports:
         - containerPort: 8080
           name: http-metrics
@@ -52,9 +53,16 @@ spec:
           requests:
             cpu: "{{.Cluster.ConfigItems.kube_state_metrics_cpu}}"
             memory: "{{.Cluster.ConfigItems.kube_state_metrics_mem_max}}"
+        volumeMounts:
+        - name: stackset-metrics-config
+          mountPath: /etc/config
         securityContext:
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 65534
           capabilities:
             drop: ["ALL"]
+      volumes:
+      - name: stackset-metrics-config
+        configMap:
+          name: stackset-metrics-config
diff --git a/cluster/manifests/kube-state-metrics/rbac.yaml b/cluster/manifests/kube-state-metrics/rbac.yaml
@@ -137,3 +137,20 @@ rules:
   verbs:
   - list
   - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - zalando.org
+  resources:
+  - stacks
+  - stacksets
+  verbs:
+  - get
+  - list
+  - watch
diff --git a/cluster/manifests/kube-state-metrics/stackset-metrics-config.yaml b/cluster/manifests/kube-state-metrics/stackset-metrics-config.yaml
@@ -0,0 +1,65 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: stackset-metrics-config
+  namespace: kube-system
+  labels:
+    application: kubernetes
+    component: kube-state-metrics
+data:
+  stackset-metrics-config.yaml: |
+    kind: CustomResourceStateMetrics
+    spec:
+      resources:
+      - groupVersionKind:
+          group: zalando.org
+          version: "v1"
+          kind: StackSet
+        metrics:
+        - name: stackset_labels
+          help: "Kubernetes labels converted to Prometheus labels for StackSet"
+          each:
+            type: Info
+            info:
+              labelsFromPath:
+                "label_*": [metadata, labels]
+        - name: stackset_info
+          help: "StackSet identity and version"
+          each:
+            type: Info
+            info:
+              labelsFromPath:
+                stackset: [metadata, name]
+                namespace: [metadata, namespace]
+                version: [spec, stackTemplate, spec, version]
+      - groupVersionKind:
+          group: zalando.org
+          version: "v1"
+          kind: Stack
+        metrics:
+        - name: stack_labels
+          help: "Kubernetes labels converted to Prometheus labels for Stack"
+          each:
+            type: Info
+            info:
+              labelsFromPath:
+                "label_*": [metadata, labels]
+        - name: stack_info
+          help: "Stack identity and version"
+          each:
+            type: Info
+            info:
+              labelsFromPath:
+                stack: [metadata, name]
+                namespace: [metadata, namespace]
+                version: [metadata, labels, "stack-version"]
+        - name: stack_owner
+          help: "Information about Stackset that owns Stack"
+          each:
+            type: Info
+            info:
+              path: [metadata, ownerReferences]
+              labelsFromPath:
+                owner_kind: [kind]
+                owner_name: [name]
+                owner_uid: [uid]
diff --git a/cluster/manifests/kube-state-metrics/vpa.yaml b/cluster/manifests/kube-state-metrics/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: kube-state-metrics
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: kube-state-metrics

diff --git a/cluster/manifests/kube-static-egress-controller/vpa.yaml b/cluster/manifests/kube-static-egress-controller/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: "kube-static-egress-controller"
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: "controller"

diff --git a/cluster/manifests/kubernetes-lifecycle-metrics/deployment.yaml b/cluster/manifests/kubernetes-lifecycle-metrics/deployment.yaml
@@ -32,7 +32,7 @@ spec:
       serviceAccountName: kubernetes-lifecycle-metrics
       containers:
         - name: kubernetes-lifecycle-metrics
-          image: "container-registry.zalando.net/teapot/kubernetes-lifecycle-metrics:master-47"
+          image: "container-registry.zalando.net/teapot/kubernetes-lifecycle-metrics:master-48"
           ports:
             - containerPort: 9090
               protocol: TCP

diff --git a/cluster/manifests/kubernetes-lifecycle-metrics/vpa.yaml b/cluster/manifests/kubernetes-lifecycle-metrics/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: kubernetes-lifecycle-metrics
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: kubernetes-lifecycle-metrics

diff --git a/cluster/manifests/metrics-server/metrics-server-vpa.yaml b/cluster/manifests/metrics-server/metrics-server-vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: metrics-server
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: metrics-server

diff --git a/cluster/manifests/pdb-controller/vpa.yaml b/cluster/manifests/pdb-controller/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: pdb-controller
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: pdb-controller

diff --git a/cluster/manifests/prometheus/prometheus-vpa.yaml b/cluster/manifests/prometheus/prometheus-vpa.yaml
@@ -16,7 +16,7 @@ spec:
     kind: StatefulSet
     name: prometheus
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: prometheus

diff --git a/cluster/manifests/role-sync-controller/cronjob.yaml b/cluster/manifests/role-sync-controller/cronjob.yaml
@@ -33,7 +33,7 @@ spec:
           restartPolicy: Never
           containers:
           - name: role-sync-controller
-            image: container-registry.zalando.net/teapot/role-sync-controller:main-24
+            image: container-registry.zalando.net/teapot/role-sync-controller:main-25
             args:
               - --subject-group=PowerUser
               - --subject-group=Manual

diff --git a/cluster/manifests/skipper/pod-deletion-cost-controller-vpa.yaml b/cluster/manifests/skipper/pod-deletion-cost-controller-vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: pod-deletion-cost-controller
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: pod-deletion-cost-controller

diff --git a/cluster/manifests/stackset-controller/vpa.yaml b/cluster/manifests/stackset-controller/vpa.yaml
@@ -12,7 +12,7 @@ spec:
     kind: Deployment
     name: stackset-controller
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
     - containerName: stackset-controller

diff --git a/cluster/manifests/z-karpenter/vpa.yaml b/cluster/manifests/z-karpenter/vpa.yaml
@@ -13,7 +13,7 @@ spec:
     kind: Deployment
     name: karpenter
   updatePolicy:
-    updateMode: Recreate
+    updateMode: InPlaceOrRecreate
   resourcePolicy:
     containerPolicies:
       - containerName: controller