[infra] Suppress Goldilocks vpa-update-mode label drift on all namespaces [ci skip]

## Context

Wave 3B-continued: the Goldilocks VPA dashboard (stacks/vpa) runs a Kyverno
ClusterPolicy `goldilocks-vpa-auto-mode` that mutates every namespace with
`metadata.labels["goldilocks.fairwinds.com/vpa-update-mode"] = "off"`. This
is intentional — Terraform owns container resource limits, and Goldilocks
should only provide recommendations, never auto-update. The label is how
Goldilocks decides per-namespace whether to run its VPA in `off` mode.

Effect on Terraform: every `kubernetes_namespace` resource shows the label
as pending-removal (`-> null`) on every `scripts/tg plan`. Dawarich survey
2026-04-18 confirmed the drift. Cluster-side count: 88 namespaces carry the
label (`kubectl get ns -o json | jq ... | wc -l`). Every TF-managed namespace
is affected.

This commit brings the intentional admission drift under the same
`# KYVERNO_LIFECYCLE_V1` discoverability marker introduced in c9d221d5 for
the ndots dns_config pattern. The marker now stands generically for any
Kyverno admission-webhook drift suppression; the inline comment records
which specific policy stamps which specific field so future grep audits
show why each suppression exists.

## This change

107 `.tf` files touched — every stack's `resource "kubernetes_namespace"`
resource gets:

```hcl
lifecycle {
  # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
  ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
}
```

Injection was done with a brace-depth-tracking Python pass (`/tmp/add_goldilocks_ignore.py`):
match `^resource "kubernetes_namespace" ` → track `{` / `}` until the
outermost closing brace → insert the lifecycle block before the closing
brace. The script is idempotent (skips any file that already mentions
`goldilocks.fairwinds.com/vpa-update-mode`) so re-running is safe.

Vault stack picked up 2 namespaces in the same file (k8s-users produces
one, plus a second explicit ns) — confirmed via file diff (+8 lines).

## What is NOT in this change

- `stacks/trading-bot/main.tf` — entire file is `/* … */` commented out
  (paused 2026-04-06 per user decision). Reverted after the script ran.
- `stacks/_template/main.tf.example` — per-stack skeleton, intentionally
  minimal. User keeps it that way. Not touched by the script (file
  has no real `resource "kubernetes_namespace"` — only a placeholder
  comment).
- `.terraform/` copies (e.g. `stacks/metallb/.terraform/modules/...`) —
  gitignored, won't commit; the live path was edited.
- `terraform fmt` cleanup of adjacent pre-existing alignment issues in
  authentik, freedify, hermes-agent, nvidia, vault, meshcentral. Reverted
  to keep the commit scoped to the Goldilocks sweep. Those files will
  need a separate fmt-only commit or will be cleaned up on next real
  apply to that stack.

## Verification

Dawarich (one of the hundred-plus touched stacks) showed the pattern
before and after:

```
$ cd stacks/dawarich && ../../scripts/tg plan

Before:
  Plan: 0 to add, 2 to change, 0 to destroy.
   # kubernetes_namespace.dawarich will be updated in-place
     (goldilocks.fairwinds.com/vpa-update-mode -> null)
   # module.tls_secret.kubernetes_secret.tls_secret will be updated in-place
     (Kyverno generate.* labels — fixed in 8d94688d)

After:
  No changes. Your infrastructure matches the configuration.
```

Injection count check:
```
$ rg -c 'KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode' stacks/ | awk -F: '{s+=$2} END {print s}'
108
```

## Reproduce locally
1. `git pull`
2. Pick any stack: `cd stacks/<name> && ../../scripts/tg plan`
3. Expect: no drift on the namespace's goldilocks.fairwinds.com/vpa-update-mode label.

Closes: code-dwx

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

stacks/actualbudget/main.tf

@@ -59,6 +59,10 @@ resource "kubernetes_namespace" "actualbudget" {
       tier = local.tiers.edge
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/affine/main.tf

@@ -90,6 +90,10 @@ resource "kubernetes_namespace" "affine" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/authentik/modules/authentik/main.tf

@@ -31,6 +31,10 @@ resource "kubernetes_namespace" "authentik" {
       "resource-governance/custom-quota" = "true"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_resource_quota" "authentik" {

stacks/beads-server/main.tf

@@ -15,6 +15,10 @@ resource "kubernetes_namespace" "beads" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_persistent_volume_claim" "dolt_data" {

stacks/blog/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "website" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/broker-sync/main.tf

@@ -14,6 +14,10 @@ resource "kubernetes_namespace" "broker_sync" {
       tier              = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 # Secrets for all providers. Seeded in Vault at `secret/broker-sync`:

stacks/changedetection/main.tf

@@ -11,6 +11,10 @@ resource "kubernetes_namespace" "changedetection" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/city-guesser/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "city-guesser" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/claude-agent-service/main.tf

@@ -28,6 +28,10 @@ resource "kubernetes_namespace" "claude_agent" {
       "resource-governance/custom-quota"      = "true"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 # --- Secrets ---

stacks/claude-memory/main.tf

@@ -20,6 +20,10 @@ resource "kubernetes_namespace" "claude-memory" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/cloudflared/modules/cloudflared/main.tf

@@ -9,6 +9,10 @@ resource "kubernetes_namespace" "cloudflared" {
       tier = var.tier
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 variable "tier" { type = string }
 

stacks/cnpg/modules/cnpg/main.tf

@@ -10,6 +10,10 @@ resource "kubernetes_namespace" "cnpg_system" {
       tier = var.tier
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 # -----------------------------------------------------------------------------

stacks/coturn/main.tf

@@ -54,6 +54,10 @@ resource "kubernetes_namespace" "coturn" {
       tier = local.tiers.edge
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/crowdsec/modules/crowdsec/main.tf

@@ -31,6 +31,10 @@ resource "kubernetes_namespace" "crowdsec" {
       "resource-governance/custom-quota" = "true"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_config_map" "crowdsec_custom_scenarios" {

stacks/cyberchef/main.tf

@@ -11,6 +11,10 @@ resource "kubernetes_namespace" "cyberchef" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/dashy/main.tf

@@ -18,6 +18,10 @@ resource "kubernetes_namespace" "dashy" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_config_map" "config" {

stacks/dbaas/modules/dbaas/main.tf

@@ -37,6 +37,10 @@ resource "kubernetes_namespace" "dbaas" {
       "resource-governance/custom-quota" = "true"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 # Override Kyverno tier-1-cluster LimitRange (max 4Gi) to allow MySQL 6Gi limit

stacks/descheduler/main.tf

@@ -7,6 +7,10 @@ resource "kubernetes_namespace" "descheduler" {
       tier = local.tiers.cluster
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_cluster_role" "descheduler" {

stacks/diun/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "diun" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/ebook2audiobook/main.tf

@@ -19,6 +19,10 @@ resource "kubernetes_namespace" "ebook2audiobook" {
       tier = local.tiers.gpu
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 

stacks/ebooks/main.tf

@@ -11,6 +11,10 @@ resource "kubernetes_namespace" "ebooks" {
       tier = local.tiers.edge
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 # ExternalSecrets for all three sources

stacks/echo/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "echo" {
       tier = local.tiers.edge
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/excalidraw/main.tf

@@ -13,6 +13,10 @@ resource "kubernetes_namespace" "excalidraw" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 

stacks/external-secrets/main.tf

@@ -5,6 +5,10 @@ resource "kubernetes_namespace" "external_secrets" {
       tier = local.tiers.cluster
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "helm_release" "external_secrets" {

stacks/f1-stream/main.tf

@@ -14,6 +14,10 @@ resource "kubernetes_namespace" "f1-stream" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/foolery/main.tf

@@ -11,6 +11,10 @@ resource "kubernetes_namespace" "foolery" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/forgejo/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "forgejo" {
       tier = local.tiers.edge
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/freedify/main.tf

@@ -57,6 +57,10 @@ resource "kubernetes_namespace" "freedify" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/freshrss/main.tf

@@ -10,6 +10,10 @@ resource "kubernetes_namespace" "immich" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/frigate/main.tf

@@ -15,6 +15,10 @@ resource "kubernetes_namespace" "frigate" {
     #   "istio-injection" : "enabled"
     # }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/grampsweb/main.tf

@@ -53,6 +53,10 @@ resource "kubernetes_namespace" "grampsweb" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/hackmd/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "hackmd" {
       tier = local.tiers.edge
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/headscale/modules/headscale/main.tf

@@ -28,6 +28,10 @@ resource "kubernetes_namespace" "headscale" {
       tier = var.tier
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/health/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "health" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/hermes-agent/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "hermes_agent" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/homepage/main.tf

@@ -18,6 +18,10 @@ resource "kubernetes_namespace" "homepage" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "helm_release" "homepage" {

stacks/immich/main.tf

@@ -100,6 +100,10 @@ resource "kubernetes_namespace" "immich" {
       tier = local.tiers.gpu
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/insta2spotify/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "insta2spotify" {
       tier              = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/isponsorblocktv/main.tf

@@ -8,6 +8,10 @@ resource "kubernetes_namespace" "isponsorblocktv" {
       tier = local.tiers.edge
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 # Before running, setup config using 
 # docker run --rm -it -v ./youtube:/app/data -e TERM=$TERM -e COLORTERM=$COLORTERM ghcr.io/dmunozv04/isponsorblocktv --setup

stacks/jsoncrack/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "jsoncrack" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 module "tls_secret" {
   source          = "../../modules/kubernetes/setup_tls_secret"

stacks/k8s-dashboard/main.tf

@@ -34,6 +34,10 @@ resource "kubernetes_namespace" "k8s-dashboard" {
       tier = local.tiers.cluster
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 # }
 

stacks/k8s-portal/modules/k8s-portal/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "k8s_portal" {
       tier = var.tier
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/kms/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "kms" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/kyverno/modules/kyverno/main.tf

@@ -6,6 +6,10 @@ resource "kubernetes_namespace" "kyverno" {
       "istio-injection" : "disabled"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "helm_release" "kyverno" {

stacks/linkwarden/main.tf

@@ -21,6 +21,10 @@ resource "kubernetes_namespace" "linkwarden" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/mailserver/modules/mailserver/main.tf

@@ -25,6 +25,10 @@ resource "kubernetes_namespace" "mailserver" {
     #   "istio-injection" : "enabled"
     # }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/matrix/main.tf

@@ -13,6 +13,10 @@ resource "kubernetes_namespace" "matrix" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 # DB credentials from Vault database engine (rotated every 24h)

stacks/meshcentral/main.tf

@@ -13,6 +13,10 @@ resource "kubernetes_namespace" "meshcentral" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/metallb/modules/metallb/main.tf

@@ -7,6 +7,10 @@ resource "kubernetes_namespace" "metallb" {
       app = "metallb"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "helm_release" "metallb" {

stacks/metrics-server/modules/metrics-server/main.tf

@@ -8,6 +8,10 @@ resource "kubernetes_namespace" "metrics-server" {
       tier = var.tier
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/monitoring/modules/monitoring/main.tf

@@ -39,6 +39,10 @@ resource "kubernetes_namespace" "monitoring" {
       "resource-governance/custom-quota" = "true"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/n8n/main.tf

@@ -18,6 +18,10 @@ resource "kubernetes_namespace" "n8n" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/navidrome/main.tf

@@ -11,6 +11,10 @@ resource "kubernetes_namespace" "navidrome" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/netbox/main.tf

@@ -13,6 +13,10 @@ resource "kubernetes_namespace" "netbox" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/networking-toolbox/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "networking-toolbox" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/nextcloud/main.tf

@@ -32,6 +32,10 @@ resource "kubernetes_namespace" "nextcloud" {
       "resource-governance/custom-quota"      = "true"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/nfs-csi/modules/nfs-csi/main.tf

@@ -8,6 +8,10 @@ resource "kubernetes_namespace" "nfs_csi" {
       tier = var.tier
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "helm_release" "nfs_csi_driver" {

stacks/novelapp/main.tf

@@ -38,6 +38,10 @@ resource "kubernetes_namespace" "novelapp" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/ntfy/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "ntfy" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/nvidia/modules/nvidia/main.tf

@@ -17,6 +17,10 @@ resource "kubernetes_namespace" "nvidia" {
       "resource-governance/custom-limitrange" = "true"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 # Custom LimitRange — overrides Kyverno tier-2-gpu default (1Gi per container)

stacks/onlyoffice/main.tf

@@ -16,6 +16,10 @@ resource "kubernetes_namespace" "onlyoffice" {
       "resource-governance/custom-quota"      = "true"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/openclaw/main.tf

@@ -23,6 +23,10 @@ resource "kubernetes_namespace" "openclaw" {
       "resource-governance/custom-quota"      = "true"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/osm_routing/main.tf

@@ -14,6 +14,10 @@ resource "kubernetes_namespace" "osm-routing" {
       "resource-governance/custom-quota" = "true"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_resource_quota_v1" "osm_routing" {

stacks/owntracks/main.tf

@@ -52,6 +52,10 @@ resource "kubernetes_namespace" "owntracks" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/paperless-ngx/main.tf

@@ -26,6 +26,10 @@ resource "kubernetes_namespace" "paperless-ngx" {
     #   "istio-injection" : "enabled"
     # }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/payslip-ingest/main.tf

@@ -22,6 +22,10 @@ resource "kubernetes_namespace" "payslip_ingest" {
       "istio-injection" = "disabled"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 # App secrets sourced from multiple Vault KV keys.

stacks/phpipam/main.tf

@@ -20,6 +20,10 @@ resource "kubernetes_namespace" "phpipam" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/plotting-book/main.tf

@@ -11,6 +11,10 @@ resource "kubernetes_namespace" "plotting-book" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/poison-fountain/main.tf

@@ -13,6 +13,10 @@ resource "kubernetes_namespace" "poison_fountain" {
       tier              = local.tiers.cluster
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/priority-pass/main.tf

@@ -11,6 +11,10 @@ resource "kubernetes_namespace" "priority-pass" {
       tier              = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/privatebin/main.tf

@@ -13,6 +13,10 @@ resource "kubernetes_namespace" "privatebin" {
       tier = local.tiers.edge
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/proxmox-csi/modules/proxmox-csi/main.tf

@@ -6,6 +6,10 @@ resource "kubernetes_namespace" "proxmox_csi" {
       "resource-governance/custom-quota" = "true"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "helm_release" "proxmox_csi" {

stacks/pvc-autoresizer/modules/pvc-autoresizer/main.tf

@@ -7,6 +7,10 @@ resource "kubernetes_namespace" "pvc_autoresizer" {
       tier = var.tier
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "helm_release" "pvc_autoresizer" {

stacks/real-estate-crawler/main.tf

@@ -90,6 +90,10 @@ resource "kubernetes_namespace" "realestate-crawler" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/redis/modules/redis/main.tf

@@ -9,6 +9,10 @@ resource "kubernetes_namespace" "redis" {
       tier = var.tier
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/reloader/main.tf

@@ -5,6 +5,10 @@ resource "kubernetes_namespace" "crowdsec" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 resource "helm_release" "reloader" {
   namespace        = kubernetes_namespace.crowdsec.metadata[0].name

stacks/resume/main.tf

@@ -24,6 +24,10 @@ resource "kubernetes_namespace" "resume" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/reverse-proxy/modules/reverse_proxy/main.tf

@@ -14,6 +14,10 @@ resource "kubernetes_namespace" "reverse-proxy" {
   metadata {
     name = "reverse-proxy"
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/rybbit/main.tf

@@ -17,6 +17,10 @@ resource "kubernetes_namespace" "rybbit" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/sealed-secrets/modules/sealed-secrets/main.tf

@@ -10,6 +10,10 @@ resource "kubernetes_namespace" "sealed_secrets" {
       tier = var.tier
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 # -----------------------------------------------------------------------------

stacks/send/main.tf

@@ -14,6 +14,10 @@ resource "kubernetes_namespace" "send" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/servarr/aiostreams/main.tf

@@ -10,6 +10,10 @@ resource "kubernetes_namespace" "aiostreams" {
       "istio-injection" : "disabled"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "random_id" "secret_key" {

stacks/servarr/main.tf

@@ -51,6 +51,10 @@ resource "kubernetes_namespace" "servarr" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/servarr/readarr/main.tf

@@ -8,6 +8,10 @@ resource "kubernetes_namespace" "readarr" {
     #   "istio-injection" : "enabled"
     # }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 

stacks/shadowsocks/main.tf

@@ -13,6 +13,10 @@ resource "kubernetes_namespace" "shadowsocks" {
     #   "istio-injection" : "enabled"
     # }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/speedtest/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "speedtest" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/stirling-pdf/main.tf

@@ -13,6 +13,10 @@ resource "kubernetes_namespace" "stirling-pdf" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/tandoor/main.tf

@@ -14,6 +14,10 @@ resource "kubernetes_namespace" "tandoor" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/technitium/modules/technitium/main.tf

@@ -20,6 +20,10 @@ resource "kubernetes_namespace" "technitium" {
     #   "istio-injection" : "enabled"
     # }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/terminal/main.tf

@@ -11,6 +11,10 @@ resource "kubernetes_namespace" "terminal" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/tor-proxy/main.tf

@@ -13,6 +13,10 @@ resource "kubernetes_namespace" "tor-proxy" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/traefik/modules/traefik/main.tf

@@ -20,6 +20,10 @@ resource "kubernetes_namespace" "traefik" {
       tier                         = var.tier
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "helm_release" "traefik" {

stacks/travel_blog/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "travel-blog" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/tuya-bridge/main.tf

@@ -11,6 +11,10 @@ resource "kubernetes_namespace" "tuya-bridge" {
       tier = local.tiers.cluster
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/uptime-kuma/modules/uptime-kuma/main.tf

@@ -32,6 +32,10 @@ resource "kubernetes_namespace" "uptime-kuma" {
     #   "istio-injection" : "enabled"
     # }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/url/main.tf

@@ -27,6 +27,10 @@ resource "kubernetes_namespace" "shlink" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/vault/main.tf

@@ -13,6 +13,10 @@ resource "kubernetes_namespace" "vault" {
       tier = local.tiers.core
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {
@@ -823,6 +827,10 @@ resource "kubernetes_namespace" "user_namespace" {
       "managed-by"                      = "vault-user-onboarding"
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "vault_policy" "namespace_owner" {

stacks/vaultwarden/modules/vaultwarden/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "vaultwarden" {
       tier = var.tier
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {

stacks/wealthfolio/main.tf

@@ -12,6 +12,10 @@ resource "kubernetes_namespace" "wealthfolio" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 resource "kubernetes_manifest" "external_secret" {

stacks/webhook_handler/main.tf

@@ -15,6 +15,10 @@ resource "kubernetes_namespace" "webhook-handler" {
       tier = local.tiers.aux
     }
   }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
 }
 
 module "tls_secret" {