docs: add no-SSH alternative for manual MKE backup prerequisite

[james-nesbitt]

PRODENG-3628

Fixes one of the impediments discovered running the bootc-e2e-test skill's Phases A–G end-to-end against a real 33-node bootc-mke3 cluster (3 managers + 30 no-touch workers) on AWS — build MCR 29.4.1 / MKE 3.9.4 / Rocky 9.8 (dev, AMI-based), account 533267045383, region us-east-2, 2026-08-05.

Observed

docs/operations-guide/upgrade-with-controller.md's Prerequisites section requires a manual MKE backup to already exist on each manager before applying a ClusterUpgrade CR, and documents the only method as SSH + docker run:

sudo mkdir -p <backup-dir> && sudo chmod o+w <backup-dir>
docker run --rm --log-driver none \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v <backup-dir>:/backup \
  mirantis/ucp:<current-version> backup --no-passphrase --file <name>.tar

A vanilla bootc-mke3 install revokes SSH/sudo on every manager as its last install step by default (disable_sshd_after_install / revoke_sudo_after_install, both true by default in ansible/vars/common-vars.yml). An operator who followed the documented, recommended hardened defaults has no way to run this without first re-enabling the SSH access they were told to disable — the doc doesn't acknowledge or resolve this conflict.

Changed

• Added docs/examples/mke-manual-backup-job.yaml.example: a kube-native, kubectl-only alternative. It's a privileged, hostPID/hostNetwork, host-root-bind-mount Job — the identical pattern cluster-upgrade-controller and machine-config-controller already use for their own node-mutating SUC Jobs (see docs/operations-guide/controller-security-analysis.md §1) — that chroot /hosts and runs the same docker run ... mirantis/ucp ... backup --no-passphrase --file ... command against the node's own Docker socket. It reuses the system-upgrade ServiceAccount, which is already granted the needed privileged/hostPID/hostNetwork/hostBindMounts UCPAuthorization attributes at install time (ansible/tasks/suc-priv-grant-tasks.yml), so no extra MKE grant is required. Backups run "on each manager" per the documented procedure, so the manifest is designed to be copied/applied once per manager (nodeName pinned) — documented in the manifest's own header comments, along with idempotency (safe to re-run; each run just writes another timestamped tar).
• Updated docs/operations-guide/upgrade-with-controller.md's Prerequisites section to cross-reference the new manifest as the no-SSH alternative, explicitly naming the disable_sshd_after_install/revoke_sudo_after_install conflict as the reason it exists. The existing SSH-based instructions remain the documented default (simpler when SSH is available) — this is framed as an alternative, not a replacement.

Verification

• docs/examples/mke-manual-backup-job.yaml.example validated as a structurally valid Kubernetes Job manifest via kubeconform -strict (no local cluster available in this sandbox to run kubectl apply --dry-run=client against — it requires network access to a cluster's OpenAPI schema even in --dry-run=client mode on this kubectl version; kubeconform performs the same offline OpenAPI schema validation): Summary: 1 resource found in 1 file - Valid: 1, Invalid: 0, Errors: 0, Skipped: 0.
• Read through the updated Prerequisites section end-to-end to confirm the new note reads as an alternative, not a replacement, and that cross-references resolve to real files/anchors in this repo.

Written by AI: claude-sonnet-5