# The thing that slips first isn't the pager. It's the upgrade queue. > cert-manager, ingress, the CNI, the operator pinning your driver version. Nobody wrote down the order, so nobody wants to be the one who runs it. We cover the queue while you hire, then hand over the runbook. **In short.** While you hire a platform engineer, which takes three to six months, Dixence covers the upgrade queue. Monthly chart upgrades in a validated order, driver, operator and toolkit pinned and tested together, patching, and a changelog with the CVEs that mattered, all in your repositories and cloud accounts. When your hire arrives they inherit the runbook and the Terraform, and we step back or stay as a second pair of hands. Campaign page · For teams with an open infrastructure role · Language: English HTML page: https://dixence.dev/en/upgrade-queue/ Publisher: Dixence, a brand of Idempotent Ltd (Switzerland) · contact@dixence.dev --- Hiring a platform engineer takes three to six months. The queue doesn't wait that long. - **3 to 6** months to hire a platform engineer - **~100** upstream charts tracked for upgrade order, monthly - **15** engineering teams on one shared upgrade calendar - **0** pages sent to a customer's on-call ## While you hire, and after ### While you hire We cover the queue: monthly upgrades, patching, the runbook, in your repos and your cloud accounts. You don't lose the months. ### When your hire arrives They get the runbook and the Terraform. We step back, or stay as their second pair of hands. Either way they inherit a documented cluster, not an archaeology project. #### What's in the queue this month From the September matrix, the page we check before touching any cluster: - Kubernetes 1.36 disables the git-repo volume plugin with no way to re-enable it, and renames the metric `volume_operation_total_errors`, so dashboards and alerts stop matching. - GPU Operator 26.7.0 needs containerd 2.0. The 26.3 line still accepts containerd 1.7 but is deprecated. - ingress-nginx has had no maintainer since March 2026. No build tested on Kubernetes 1.36 will ever exist. - cert-manager 1.21 dropped the default RBAC that Vault Kubernetes auth and Route53 setups relied on. - Container Toolkit below 1.17.8 carries two published CVEs, one Critical. [The full matrix, with sources](/en/articles/gpu-on-kubernetes-2026-09/) ## How it works 1. **One written page.** Send `kubectl version` and `helm list -A`, redacted however you like. You get back what's behind, what breaks first, and the order we'd run it in. 2. **The queue, every month.** Driver, operator and toolkit pinned and tested together. Chart upgrades in the validated order, the CNI last and alone. A changelog with the CVEs that mattered. 3. **The handover.** Runbook, Terraform and state files in your repos and your cloud accounts. Your hire takes over, or we stay. ## One check before you even talk to us Run `helm list -A` and spend five minutes on the upstream release pages. How many charts are more than two minor versions behind? If that answer is clean, and the question below has a name and a written order, you don't need us, and we'll tell you so. > Who ran your last CNI upgrade, and is the order written anywhere? ## Two ways to start, lightest first [One written page about your cluster](mailto:contact@dixence.dev?subject=One%20written%20page%20about%20our%20cluster) Or the matrix, every month: leave your email and the October edition arrives when the upstream pages change. ## Questions we get asked ### What happens when our hire arrives? They get the runbook and the Terraform. We step back, or stay as their second pair of hands. Either way they inherit a documented cluster, not an archaeology project. ### In what order do you run the chart upgrades? In the validated order: the CNI last and alone, after the driver, operator and toolkit have been pinned and tested together. Each month's changelog lists the CVEs that mattered. ### How do we know whether we need you? Run `helm list -A` and spend five minutes on the upstream release pages. If few charts are more than two minor versions behind, and your last CNI upgrade has a name and a written order, you don't need us, and we'll tell you so. ### How do we start? Send `kubectl version` and `helm list -A`, redacted however you like. You get back one written page: what's behind, what breaks first, and the order we'd run it in. ## Who we are A small Swiss team, engineers only, seven hours ahead of the US East Coast. Fifteen engineering teams run on stacks we maintain. Fixed monthly fee, everything in your repos and your cloud accounts.