docs(upgrade): prioritized 2026-10 upgrade plan, cert-manager log

[surrealwolf]

Summary

Revises docs/UPGRADE_PLAN.md with a reviewed next upgrade wave. It's a plan only; nothing in it is applied except the cert-manager rollout from #36.

• Live snapshot of every component across manager, poc, nprd, and prd (versions read from the clusters, Helm releases, nodes over SSH, and the Terraform lock file).
• Prioritized table (P0 security/EOL → P2 hygiene) with current → target, risk notes, owner (Terraform var/module, Fleet repo path, or manual Helm), and effort.
• Dependencies (Rancher before RKE2; Gateway API CRDs vs Envoy Gateway vs Traefik's CRD chart; cert-manager vs Barman plugin; CNPG vs backups) and a recommended window sequence.
• cert-manager v1.21.2 rollout log (owner findings, verification, follow-ups, backup locations).
• The completed 2026-07-31/08-01 Rancher 2.13→2.15 / RKE2 1.34→1.36 runbook is kept below as history, unchanged.

Top P0 items: Rancher 2.15.2 (SAML replay CVE in HA plus login-page XSS), Envoy Gateway 1.6 is EOL and untested on k8s 1.36, CNPG 1.28 is out of support, all 31 nodes are pending a reboot, Grafana 12.3 is out of support, and leftover democratic-csi credentials should be rotated.

docs/OPS_NOTES.md is intentionally untouched.

---

Note

Low Risk
Documentation-only updates to the upgrade plan and changelog; no cluster or Terraform behavior changes in this diff.

Overview
Reframes docs/UPGRADE_PLAN.md from a single poc canary runbook into a two-part doc: a 2026-10-04 “next wave” plan (live version snapshot, P0–P2 prioritized table with owners/effort, dependency notes, and recommended maintenance windows) plus a cert-manager v1.21.2 rollout log referencing PR #36; the completed Rancher 2.13→2.15 / RKE2 1.34→1.36 procedure is preserved unchanged under a History section.

CHANGELOG.md gains a Changed bullet that points at the new upgrade plan and cert-manager log, alongside existing unreleased cert-manager pin/module notes (implementation may live in a separate PR).

^{Reviewed by Cursor Bugbot for commit 92984cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Approved. Cursor Bugbot completed successfully with no findings that need human review, and no approval policy requires a human reviewer.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}