docs(kserve): add v0.16.x to v0.17.0 upgrade notes

Signed-off-by: abdullahpathan22 <abdullahpathan22@users.noreply.github.com>

Author: abdullahpathan22

UPGRADING.md

@@ -0,0 +1,51 @@
+# Upgrading Kubeflow Manifests
+
+This document describes breaking changes and manual upgrade steps required when moving between versions of Kubeflow manifests.
+
+## Upgrading KServe from v0.16.x to v0.17.0
+
+This section covers the upgrade of KServe to v0.17.0, which is part of the latest synchronization with upstream manifests.
+
+> **Note:** These instructions apply only to Kubeflow Manifests revisions where the KServe component in the [README component matrix](README.md#kubeflow-components-versions) is listed as v0.17.0. If your README entry still shows KServe v0.16.x, defer this section until you have applied the companion manifests upgrade (see [PR #3406](https://github.com/kubeflow/manifests/pull/3406)).
+
+### 1. Pre-upgrade Step: Delete Conflicting ClusterRoleBinding (Breaking Change)
+
+Before applying the new manifests, you **must** manually delete the following ClusterRoleBinding:
+
+```bash
+kubectl delete clusterrolebinding llmisvc-manager-rolebinding --ignore-not-found
+```
+
+**Why this is required:**
+KServe v0.17.0 restructured the `llmisvc` role bindings. The old `ClusterRoleBinding` from v0.16.x is incompatible with the new one defined in the v0.17.0 manifests. If you do not delete it manually, `kubectl apply` (or `kustomize build | kubectl apply`) will fail because Kubernetes does not allow in-place updates to immutable fields on an existing `ClusterRoleBinding` (such as `roleRef` or `subjects`).
+
+### 2. Note on the v0.17.0 Tag and Manifest Source
+
+The official `v0.17.0` tag in the upstream [kserve/kserve](https://github.com/kserve/kserve) repository was released without the necessary `install` files (see [kserve/kserve#5255](https://github.com/kserve/kserve/issues/5255)).
+
+To ensure a working installation, the manifests in this repository were synchronized manually from the upstream **`release-0.17`** branch. The exact files vendored into this repository are tracked in [PR #3406](https://github.com/kubeflow/manifests/pull/3406) (commit `5b2604281da8512bb97bb170a796b6b2b3726385`), which serves as the auditable reference point for this sync. Users should be aware of this distinction when cross-referencing upstream source code or release notes.
+
+### 3. Webhook Certificate SAN Fix
+
+KServe v0.17.0 introduced duplicate `Certificate` resources that continued to reference the upstream `kserve` namespace for Subject Alternative Names (SANs) instead of the `kubeflow` namespace used in this distribution, causing TLS verification failures on the webhook server.
+
+The manifests in this repository have been patched to correct SANs for the following resources:
+- `serving-cert`
+- `llmisvc-serving-cert`
+- `localmodel-serving-cert`
+
+If you encounter TLS verification failures after upgrading, ensure you are using the manifests from this repository and not directly from the upstream KServe repository.
+
+### 4. How to Apply the Upgrade
+
+After performing the pre-upgrade step in Section 1, apply the upgrade using the standard Kustomize pattern.
+
+**Single Command Upgrade:**
+```bash
+while ! kustomize build example | kubectl apply --server-side --force-conflicts -f -; do echo "Retrying to apply resources"; sleep 20; done
+```
+
+**Individual Component Upgrade (KServe only):**
+```bash
+kustomize build applications/kserve/kserve | kubectl apply -f -
+```