UpgradePath
165 upgrade pairs · 29 add-ons

Know what breaks before your cluster does.

Upgrade runbooks for Kubernetes and EKS add-ons, served to your coding agent over MCP. Each one is verified on a live cluster or reviewed and signed by a person before it publishes, and carries the migration steps, the checks that prove it worked and the way back out.

Your agent stops guessing from release notes and stale training data.

Connect your agentSee coverage

Free tier: no key, no signup, 100 requests per hour.

3.11 7 breaking 3.12 ✓

What you get

Fewer tokens

One tool call returns the upgrade path already distilled. Your agent skips fetching and reading the release notes, changelog and chart diff of every version in between.

Less time

The research is done before you ask: breaking changes, migration steps, verification and rollback for each step of the range, in order.

Fewer surprises

Cluster runs surface behaviour the release notes don't mention. You read about it in the runbook, before the upgrade shows you.

No silent gaps

A step we don't cover comes back as a gap, never as safe. Your agent hears what is missing, never a guess.

Kept current

We watch upstream chart releases. Each new one opens a runbook for its upgrade pair.

Caught on a real cluster

Grafana: a plain upgrade on emptyDir storage loses dashboards

A release on the chart's default emptyDir storage lost every seeded dashboard across a plain helm upgrade. Moving it to persistence first, as the runbook describes, kept all of them. Real cluster upgrades confirmed both outcomes.

See the evidence

Three stored values keep a starting controller from ever becoming Ready on v1.10.6 and v1.11.8

The harness seeds 278 annotation and path probes through the admission dry-run and then starts each controller version with them stored. On v1.10.6 and v1.11.8, three probes break startup, so a pod that starts with one of them stored never turns Ready: `auth-method` with a space (`"GET, POST"`), an `Exact` path containing `;`, and `proxy-http-version: "1.2"`. Upstream documents none of this. Cells 1.29 and 1.30.

See the evidence

Stored values that keep a starting controller from ever becoming Ready on v1.11.8 and v1.12.8

The harness seeds 278 annotation and path probes through the admission dry-run and then starts each controller version with them stored. `auth-method` with a space (`"GET, POST"`) and an `Exact` path containing `;` break startup on both v1.11.8 and v1.12.8; `proxy-http-version: "1.2"` breaks it on v1.11.8 only, because v1.12.8 ignores the value. A pod that starts with one stored never turns Ready. Upstream documents none of this. Cells 1.29 and 1.30>1.31.

See the evidence

Two stored values keep a starting v1.12.8 controller from ever becoming Ready; v1.13.9 starts with all 278 probes

The harness seeds 278 annotation and path probes through the admission dry-run and then starts each controller version with them stored. On v1.12.8, `auth-method` with a space (`"GET, POST"`) and an `Exact` path containing `;` break startup, so a pod that starts with one stored never turns Ready. v1.13.9 starts with all 278 probes stored. Upstream documents none of this. Cells 1.31 and 1.32.

See the evidence

Prometheus 3.12: a rollback with st-storage on drops histogram samples

With the st-storage flag on, 3.12 writes histogram samples as a new WAL record type that 3.11 skips on replay, so a rollback loses them. The 3.12 release notes don't mention the rollback effect. A real cluster upgrade and rollback surfaced it, and a control run with the flag off replayed clean.

See the evidence · Read the runbook

How a runbook gets published

  1. Upstream release. A new chart release opens a work item for its from→to pair.
  2. Draft. A runbook is drafted from the release notes, changelog and chart diff, citing its sources.
  3. Review. Three lenses check it: source verification, expert critique and an ingestion probe.
  4. Cluster run. The add-on is installed at the old version on a live kubeadm cluster and upgraded to the new one. Only a clean run, or a human signature, publishes it.

See the evidence for every published pair, or read a full sample runbook.

What your agent can now answer

Which add-ons and upgrades are covered?

list_addonsfree

Every covered add-on and the upgrade pairs with published runbooks.

Does this add-on version support my Kubernetes version, and until when on EKS?

check_compatfree

Which Kubernetes minors each add-on series supports, plus EKS support dates.

How risky is this upgrade, and what breaks?

upgrade_overviewfree

Severity and breaking-change titles for a from→to range, with any uncovered segments reported as gaps.

A step failed on my cluster. Who hears about it?

report_issuefree

File a failed step, an undocumented behaviour, a wrong claim or a missing range. Your agent shows you the report and sends it only after you approve; a person verifies it before any runbook changes.

How do I make this upgrade, prove it worked and back out if it didn't?

get_runbook

The full runbook for each published segment in a range: breaking changes explained, migration steps, gotchas, verification and rollback.

Which of my add-ons need work before the next Kubernetes minor?

plan_upgrade

Per-add-on upgrade advisories for a fleet inventory against a target Kubernetes minor, ordered riskiest-first.

Connect in one line

claude mcp add --transport http upgradepath https://upgradepath.io/mcp

Cursor and other clients are on the connect page.

Pricing

A week costs less than the hour you would spend reading one changelog.

Free

$0

Compatibility checks and breaking-change overviews. 100 requests per hour per IP, no monthly limit.

Connect

Weekly

$9/week

For one upgrade window. Full runbooks that ran clean on a real cluster or carry a human signature, and fleet upgrade plans, for every published pair.

Get a key

Monthly

$29/month

For upgrades all year, with new runbooks as charts release. Full runbooks that ran clean on a real cluster or carry a human signature, and fleet upgrade plans, for every published pair.

Get a key

Three refunds: within 7 days of your first payment if it isn't what you needed, when a paid tool reports your range uncovered, and for a renewal you forgot and haven't used. The refund policy has the terms.