Mechanisms to implement controlled upgrades

A non-transitory computer-readable medium having program instructions stored thereon that are capable of causing a pod upgrade controller executing on a computer system to perform operations comprising:

• determining to upgrade a first set of pods that facilitate access to at least one copy of particular data, wherein the first set of pods executes on a first set of virtual machines (VMs) of a plurality of VMs used to implement a service, wherein a given pod includes one or more containerized applications;
• obtaining a first lock on the plurality of VMs to prevent a node upgrade controller from upgrading VMs of a second set of VMs of the plurality of VMs on which a second set of pods executes that facilitates access to at least another copy of the particular data, and wherein an unavailability of the first and second sets of pods causes a requisite number of copies of the particular data to not be available;
• upgrading the first set of pods;
• and
• after upgrading the first set of pods, releasing the first lock to allow the node upgrade controller to obtain a second lock on the plurality of VMs.

A non-transitory computer-readable medium having program instructions stored thereon that are capable of causing a node upgrade controller executing on a computer system to perform operations comprising:

• determining to upgrade a first set of nodes of a plurality of nodes, wherein a first set of pods executes on the first set of nodes and facilitates access to at least one instance of a particular component, wherein a given pod includes one or more containerized applications;
• obtaining a first lock on the plurality of nodes to prevent a pod upgrade controller from upgrading pods of a second set of pods, wherein the second set of pods executes on a second set of nodes of the plurality of nodes and facilitates access to at least another instance of the particular component, and wherein an unavailability of the first and second sets of pods causes a requisite number of instances of the particular component to not be available, and wherein the pod upgrade controller is operable to upgrade pods and the node upgrade controller is operable to upgrade nodes;
• upgrading the first set of nodes;
• and
• after upgrading the first set of nodes, releasing the first lock to allow the pod upgrade controller to obtain a second lock on the plurality of nodes.