If the cluster has a PSP that blocks Pods from running as root the DS that handles upgrade prepull will fail to create its Pods. Workaround that by adding a PodSecurityContext with RunAsUser=999.