Upgrade analysis

Upgrade analysis is an operation on the Cluster Mirror, and it's opt-in: the operator runs it only with upgrade.enabled=true in Helm. Turn it on when an upgrade is coming; the mirror itself keeps running either way.

The ClusterMirror knows what is running and at risk right now — what is down, pending or lost, and its blast radius. It has no target version. An UpgradeAnalysis names one, reads the same mirror against it, and adds what only an upgrade needs:

• Add-on compatibility with the target version, from a vendor-verified matrix.
• Removed APIs — the API versions the target version drops.
• Drain blockers — a PodDisruptionBudget that would stall a node drain.
• A readiness score (0–100) — a gauge, never a gate.
• A deterministic verdict — SAFE, WARNING or CRITICAL, with every blocker listed.

This static illustration provides a quick visual summary of the same flow:

Its report is an <name>.mirops file like the mirror's, and the CLI gates a pipeline on its verdict.

When to run it

UpgradeAnalysis is an operation on the same mirror

The ClusterMirror remains the current-state source. UpgradeAnalysis adds a target Kubernetes version and upgrade-specific checks when enabled.

Risk on the same graph

Upgrade analysis reuses the mirror's risk propagation, with one addition: now there is a target version, add-ons get a risk of their own.

Add-on against the target version	Base risk
Incompatible	90 (Critical)
Compatibility unknown	40
Compatible	0

That risk flows to everything that depends on the add-on, decaying × 0.6 per hop like any other — so an incompatible ingress controller shows its whole blast radius: the Ingresses on it, the Services they route to, the workloads behind them.

Propagated risk still only shows where the upgrade would hurt. What stops it is the verdict: an incompatible add-on is a deterministic blocker that makes it CRITICAL, and the readiness score is a gauge that never blocks.

In this section

• Readiness score vs. upgrade decision — why the score is a gauge and the verdict a gate, and what blocks.
• AI as a copilot — optional reasoning that nudges the score, never the verdict.
• Remediation — fixes proposed for an analysis, run only after you approve them.

To run one, see Create an UpgradeAnalysis.