So how do you handle k8s version upgrades every three months? And please don't tell me "who needs upgrades" on a security-critical component.