No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

Just to confirm:
* CLI upgrade or one or more package upgrades?
* From what versions?

```
        "@pulumi/kubernetes": {
-            "version": "1.1.0",                                                                                                                                                                                                            -            "resolved": "<https://registry.npmjs.org/@pulumi/kubernetes/-/kubernetes-1.1.0.tgz>",                                                                                                                                                                                                                                                     +            "version": "1.2.0",                                                                                                                                                                                                            +            "resolved": "<https://registry.npmjs.org/@pulumi/kubernetes/-/kubernetes-1.2.0.tgz>",                                                                                                                                            
```
1.1 -&gt; 1.2 both k8s package and cli

also google protobuf package was upgraded from 3.9.2 to 3.10.0

Might need <@UE1LN7A22>'s eyes on this one.

I went through this upgrade. It's just adding an annotation, so "mostly harmless".

yea most are fine, but a few are causing a replace

i tried downgrading back to 1.1 but still seeing the same issue which is strange so maybe something else is going on.

is it possible to just manually update the stack and add these annotations? for most resources i am fine with recreating but a couple i would like to not have to recreate

<@UKV77NZJT> this should _not_ cause replacements. could you post the complete diff so we can take a look?

So it ended up being a couple issues that were causing the replacements. First, a namespace update was triggering a replacement of secrets that depended on that namespace, which then triggered the replacements of helm charts that were using those secrets. Second was a storage class update which triggered the replacement of helm charts using that storage class. I manually updated the namespace and the storage class to include the annotation and now everything is just a clean update.