Hulumi 2.0.1 fixes a live Kubernetes admission-defaulting mismatch in
BrokeredAuroraPostgresBoundary and WorkloadCapabilityIssuerBoundary.
Kubernetes adds two standard NoExecute tolerations to Pods during admission:
node.kubernetes.io/not-ready and node.kubernetes.io/unreachable, each with
the Exists operator and a 300-second duration. The prior exact envelope
allowed only the caller-declared workload-pool toleration, so the API server
correctly failed closed before creating protected Pods.
The corrected envelope accepts either the configured workload-pool toleration alone or that exact toleration plus both standard Kubernetes defaults. An explicit allowlist continues to reject additional keys, changed operators, values, effects, durations, or partial default pairs.
All six @hulumi/* packages remain on the atomic 2.0.1 release train.