fix: pvc-autoresizer + TF drift safety — bulk add ignore_changes

After fixing the threshold=80% misconfig and seeing two PVCs
(prometheus + technitium primary) get stuck Terminating, a 3rd round
showed four more PVCs (frigate, hackmd, immich-postgresql,
paperless-ngx) in the same state. Same root cause: TF spec'd a
smaller storage size than the autoresizer-grown live value, K8s
rejected the shrink, TF force-replaced the PVC, and the
pvc-protection finalizer held it in Terminating while the pod kept
using the underlying volume.

Bulk-inject lifecycle.ignore_changes = [spec[0].resources[0].requests]
on every kubernetes_persistent_volume_claim block that has
resize.topolvm.io/threshold annotations. The pattern was already
documented in .claude/CLAUDE.md but ~63 stacks were missing it.

Live PVCs are unaffected; this only prevents future TF applies from
attempting the destroy+recreate.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

stacks/actualbudget/factory/main.tf

@@ -58,6 +58,13 @@ resource "kubernetes_persistent_volume_claim" "data_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "actualbudget" {

stacks/affine/main.tf

@@ -169,6 +169,13 @@ resource "kubernetes_persistent_volume_claim" "data_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "affine" {

stacks/beads-server/main.tf

@@ -55,6 +55,13 @@ resource "kubernetes_persistent_volume_claim" "dolt_data" {
       requests = { storage = "2Gi" }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_config_map" "dolt_init" {

stacks/broker-sync/main.tf

@@ -73,6 +73,13 @@ resource "kubernetes_persistent_volume_claim" "data_encrypted" {
       requests = { storage = "1Gi" }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 locals {

stacks/changedetection/main.tf

@@ -82,6 +82,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "changedetection" {

stacks/chrome-service/main.tf

@@ -88,6 +88,13 @@ resource "kubernetes_persistent_volume_claim" "profile_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 # --- NFS backup target ---

stacks/claude-agent-service/main.tf

@@ -212,6 +212,13 @@ resource "kubernetes_persistent_volume_claim" "workspace" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 # --- Deployment ---

stacks/dbaas/modules/dbaas/main.tf

@@ -360,6 +360,13 @@ resource "kubernetes_persistent_volume_claim" "pgadmin_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 module "nfs_postgresql_backup_host" {

stacks/diun/main.tf

@@ -105,6 +105,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "diun" {

stacks/ebooks/main.tf

@@ -164,6 +164,13 @@ resource "kubernetes_persistent_volume_claim" "calibre_config_iscsi" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 module "nfs_calibre_ingest_host" {
@@ -219,6 +226,13 @@ resource "kubernetes_persistent_volume_claim" "abs_config_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 module "nfs_audiobookshelf_metadata_host" {

stacks/excalidraw/main.tf

@@ -46,6 +46,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "excalidraw" {

stacks/f1-stream/main.tf

@@ -97,6 +97,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "f1-stream" {

stacks/freshrss/main.tf

@@ -81,6 +81,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_persistent_volume_claim" "extensions_proxmox" {
@@ -103,6 +110,13 @@ resource "kubernetes_persistent_volume_claim" "extensions_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 

stacks/frigate/main.tf

@@ -47,6 +47,13 @@ resource "kubernetes_persistent_volume_claim" "config_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 module "nfs_media_host" {

stacks/grampsweb/main.tf

@@ -85,6 +85,13 @@ resource "kubernetes_persistent_volume_claim" "data_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "random_password" "secret_key" {

stacks/hackmd/main.tf

@@ -44,6 +44,13 @@ resource "kubernetes_persistent_volume_claim" "data_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "hackmd" {

stacks/headscale/modules/headscale/main.tf

@@ -68,6 +68,13 @@ resource "kubernetes_persistent_volume_claim" "data_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "headscale" {

stacks/health/main.tf

@@ -44,6 +44,13 @@ resource "kubernetes_persistent_volume_claim" "uploads_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "health" {

stacks/hermes-agent/main.tf

@@ -75,6 +75,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 # --- ConfigMaps ---

stacks/immich/main.tf

@@ -107,6 +107,13 @@ resource "kubernetes_persistent_volume_claim" "immich_postgresql_encrypted" {
       requests = { storage = "10Gi" }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 module "nfs_ml_cache_host" {

stacks/insta2spotify/main.tf

@@ -65,6 +65,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "insta2spotify" {

stacks/instagram-poster/modules/instagram-poster/main.tf

@@ -201,6 +201,13 @@ resource "kubernetes_persistent_volume_claim" "data" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "instagram_poster" {

stacks/isponsorblocktv/main.tf

@@ -36,6 +36,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 # Mute and skip ads for vermont smart tv

stacks/mailserver/modules/mailserver/roundcubemail.tf

@@ -60,6 +60,13 @@ resource "kubernetes_persistent_volume_claim" "roundcube_html_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_persistent_volume_claim" "roundcube_enigma_encrypted" {
@@ -82,6 +89,13 @@ resource "kubernetes_persistent_volume_claim" "roundcube_enigma_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "roundcubemail" {

stacks/matrix/main.tf

@@ -80,6 +80,13 @@ resource "kubernetes_persistent_volume_claim" "data_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "matrix" {

stacks/meshcentral/main.tf

@@ -45,6 +45,13 @@ resource "kubernetes_persistent_volume_claim" "data_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_persistent_volume_claim" "files_encrypted" {
@@ -67,6 +74,13 @@ resource "kubernetes_persistent_volume_claim" "files_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 module "nfs_backups_host" {

stacks/n8n/main.tf

@@ -138,6 +138,13 @@ resource "kubernetes_persistent_volume_claim" "data_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 # --- RBAC: Allow n8n to exec into OpenClaw pods for task execution ---

stacks/navidrome/main.tf

@@ -82,6 +82,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 module "nfs_music" {

stacks/nextcloud/main.tf

@@ -208,6 +208,13 @@ resource "kubernetes_persistent_volume_claim" "nextcloud_data_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 module "nfs_nextcloud_backup_host" {

stacks/novelapp/main.tf

@@ -69,6 +69,13 @@ resource "kubernetes_persistent_volume_claim" "novelapp-data" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "novelapp" {

stacks/ntfy/main.tf

@@ -44,6 +44,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "ntfy" {

stacks/onlyoffice/main.tf

@@ -112,6 +112,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "onlyoffice-document-server" {

stacks/openclaw/main.tf

@@ -302,6 +302,13 @@ resource "kubernetes_persistent_volume_claim" "home_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 module "nfs_workspace_host" {
@@ -332,6 +339,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 ## cc-config NFS volume removed — replaced by dotfiles repo clone in init container
@@ -1126,6 +1140,13 @@ resource "kubernetes_persistent_volume_claim" "openlobster_data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "random_password" "openlobster_graphql_token" {

stacks/paperless-ngx/main.tf

@@ -84,6 +84,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_persistent_volume_claim" "data_encrypted" {
@@ -106,6 +113,13 @@ resource "kubernetes_persistent_volume_claim" "data_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 

stacks/plotting-book/main.tf

@@ -69,6 +69,13 @@ resource "kubernetes_persistent_volume_claim" "plotting-book-data" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "plotting-book" {

stacks/postiz/modules/postiz/main.tf

@@ -57,6 +57,13 @@ resource "kubernetes_persistent_volume_claim" "uploads" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 # ExternalSecret: patches the chart-managed `postiz-secrets` Secret with

stacks/priority-pass/main.tf

@@ -52,6 +52,13 @@ resource "kubernetes_persistent_volume_claim" "uploads" {
       requests = { storage = "1Gi" }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "priority-pass" {

stacks/privatebin/main.tf

@@ -45,6 +45,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "privatebin" {

stacks/resume/main.tf

@@ -182,6 +182,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 # Reactive Resume app

stacks/rybbit/main.tf

@@ -86,6 +86,13 @@ resource "kubernetes_persistent_volume_claim" "clickhouse_data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_config_map" "clickhouse_memory" {

stacks/send/main.tf

@@ -46,6 +46,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "send" {

stacks/servarr/aiostreams/main.tf

@@ -40,6 +40,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "aiostreams" {

stacks/servarr/listenarr/main.tf

@@ -23,6 +23,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 module "nfs_downloads_host" {

stacks/servarr/mam-farming/main.tf

@@ -41,6 +41,13 @@ resource "kubernetes_persistent_volume_claim" "mam_data" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 # --------------------------- Grabber ---------------------------------

stacks/servarr/prowlarr/main.tf

@@ -27,6 +27,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 module "nfs_downloads_host" {

stacks/servarr/qbittorrent/main.tf

@@ -27,6 +27,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 module "nfs_downloads_host" {

stacks/speedtest/main.tf

@@ -77,6 +77,13 @@ resource "kubernetes_persistent_volume_claim" "config_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "speedtest" {

stacks/stirling-pdf/main.tf

@@ -45,6 +45,13 @@ resource "kubernetes_persistent_volume_claim" "configs_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "stirling-pdf" {

stacks/tandoor/main.tf

@@ -78,6 +78,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "tandoor" {

stacks/technitium/modules/technitium/ha.tf

@@ -26,6 +26,13 @@ resource "kubernetes_persistent_volume_claim" "secondary_config_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 # Primary-only service for zone transfers (AXFR) and API access
@@ -214,6 +221,13 @@ resource "kubernetes_persistent_volume_claim" "tertiary_config_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "technitium_tertiary" {

stacks/tor-proxy/main.tf

@@ -157,6 +157,13 @@ resource "kubernetes_persistent_volume_claim" "torrserver_data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "torrserver" {

stacks/uptime-kuma/modules/uptime-kuma/main.tf

@@ -64,6 +64,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "uptime-kuma" {

stacks/vaultwarden/modules/vaultwarden/main.tf

@@ -43,6 +43,13 @@ resource "kubernetes_persistent_volume_claim" "vaultwarden_data_encrypted" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "vaultwarden" {

stacks/wealthfolio/main.tf

@@ -123,6 +123,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "wealthfolio" {

stacks/whisper/main.tf

@@ -44,6 +44,13 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" {
       }
     }
   }
+  lifecycle {
+    # The autoresizer expands requests.storage up to storage_limit and
+    # PVCs can't shrink. Without this, every TF apply tries to revert
+    # to the spec value, K8s rejects the shrink, and the PVC ends up
+    # in Terminating-but-in-use limbo.
+    ignore_changes = [spec[0].resources[0].requests]
+  }
 }
 
 resource "kubernetes_deployment" "whisper" {