There are four custom controller items in the Toolforge Kubernetes cluster. These keep us from doing quick upgrades right now, and a lot of that is more easily available in modern code. We need to actually ensure they are all effectively replaced, document and deploy those replacements.
 Replace the uid enforcer admission controller - https://github.com/wikimedia/operations-software-kubernetes/commit/8938d75cc10b0a74afa9a10de8bbfb28807788b2
 Replace the container registry enforcement validating admission controller - https://github.com/wikimedia/operations-software-kubernetes/commit/5cad640395fee84c523c029c8fecf22afd2a060a
 Replace the host automount mutating admission controller - https://github.com/wikimedia/operations-software-kubernetes/commit/d16c091cdb30b4c8dbcc4cd923d0565b486c4a44
 Replace the host path admission controller - https://github.com/wikimedia/operations-software-kubernetes/commit/021aa3fd32932f443c1be0624d1078b619c6c05b
For each one of these, ensure we have comparable functionality enabled or deployable in some way except where we want to retire a feature altogether.