Upgrading Kubernetes, Rancher and cert-manager with No Spare Capacity

Rolling upgrades assume spare capacity: drain a node, let its workloads reschedule, upgrade, repeat. This test platform was deliberately built without that margin, so it was a good place to find out what a safe upgrade looks like when the standard procedure cannot work.










