docs(kserve): add v0.16.x to v0.17.0 upgrade notes

Signed-off-by: abdullahpathan22 <abdullahpathan22@users.noreply.github.com>

Author: abdullahpathan22

UPGRADING.md

@@ -0,0 +1,51 @@
+# Upgrading Kubeflow Manifests
+
+This document describes breaking changes and manual upgrade steps required when moving between versions of Kubeflow manifests.
+
+## Upgrading KServe from v0.16.x to v0.17.0
+
+This section covers the upgrade of KServe to v0.17.0, which is part of the latest synchronization with upstream manifests.
+
+### 1. Pre-upgrade Step: Delete Conflicting ClusterRoleBinding (Breaking Change)
+
+Before applying the new manifests, you **must** manually delete the following ClusterRoleBinding. 
+
+```bash
+kubectl delete clusterrolebinding llmisvc-manager-rolebinding --ignore-not-found
+```
+
+**Why this is required:**
+In KServe v0.17.0, the `llmisvc` role bindings were restructured. The old `ClusterRoleBinding` from v0.16.x conflicts with the new ones defined in the v0.17.0 manifests. If you do not delete it manually, the `kubectl apply` (or `kustomize build | kubectl apply`) will fail due to naming conflicts.
+
+### 2. Note on the v0.17.0 Tag and Manifest Source
+
+The official `v0.17.0` tag in the upstream [kserve/kserve](https://github.com/kserve/kserve) repository was released without the necessary `install` files (see [kserve/kserve#5255](https://github.com/kserve/kserve/issues/5255)).
+
+To ensure a working installation, the manifests in this repository have been synchronized from the upstream **`release-0.17`** branch instead of the `v0.17.0` git tag. Users should be aware of this distinction when cross-referencing upstream source code or release notes.
+
+### 3. Webhook Certificate SAN Fix
+
+KServe v0.17.0 introduced some duplicate `Certificate` resources that continued to reference the upstream `kserve` namespace for Subject Alternative Names (SANs) instead of the `kubeflow` namespace used in this distribution. This would normally cause TLS verification failures on the webhook server.
+
+The manifests in this repository have been patched to fix SANs for the following resources:
+- `serving-cert`
+- `llmisvc-serving-cert`
+- `localmodel-serving-cert`
+
+If you encounter TLS verification failures after upgrading, ensure you are using the manifests provided in this repository and not attempting to apply them directly from the upstream KServe repository.
+
+### 4. How to Apply the Upgrade
+
+After performing the pre-upgrade step in Section 1, you can apply the upgrade using the standard Kustomize pattern.
+
+**Single Command Upgrade:**
+If you are using the default single-command installation:
+```bash
+while ! kustomize build example | kubectl apply --server-side --force-conflicts -f -; do echo "Retrying to apply resources"; sleep 20; done
+```
+
+**Individual Component Upgrade:**
+To upgrade KServe specifically:
+```bash
+kustomize build applications/kserve/kserve | kubectl apply -f -
+```