Protect control-plane availability, etcd health, certificates, and critical add-ons. Plan version-skew-safe upgrades, node draining, maintenance windows, and API migration when resources are deprecated.
