Clarify ExtendedDaemonSet migration prerequisites

Require Operator 1.30.0 for the safe migration, preserve edsMaxPodUnavailable in the native DaemonSet strategy, and scope resource verification to the migrated Agent workload.\n\nCONTP-1895

Author: tbavelier

docs/extendeddaemonset_migration.md

@@ -11,21 +11,47 @@ EDS resources.
 
 ## Upgrade procedure
 
-1. While running the last EDS-capable Operator release, disable EDS by removing
-   `--supportExtendedDaemonset=true` or setting it to `false`. Remove any
-   `--eds*` options as well.
-2. Wait for that Operator release to migrate the node Agent to a native
+1. Upgrade to Datadog Operator `1.30.0`, keeping EDS enabled during this
+   upgrade. Version `1.30.0` is the last EDS-capable release and contains the
+   migration that safely retires the Agent EDS and lets the native DaemonSet
+   adopt its pods.
+2. If `--edsMaxPodUnavailable` is configured, preserve its value in the
+   DatadogAgent before removing the EDS options:
+
+   ```yaml
+   spec:
+     override:
+       nodeAgent:
+         updateStrategy:
+           rollingUpdate:
+             maxUnavailable: <edsMaxPodUnavailable-value>
+   ```
+
+3. While running Operator `1.30.0`, disable EDS by removing
+   `--supportExtendedDaemonset=true` or setting it to `false`. Remove the
+   `--eds*` options after translating `--edsMaxPodUnavailable` as described
+   above.
+4. Wait for Operator `1.30.0` to migrate the node Agent to a native
    DaemonSet. Confirm the DaemonSet is fully ready:
 
    ```shell
    kubectl -n <agent-namespace> get daemonset
    kubectl -n <agent-namespace> rollout status daemonset/<agent-name>
    ```
 
-3. Confirm that no ExtendedDaemonSet or ExtendedDaemonSetReplicaSet remains in
-   the Agent namespace. Do not remove the EDS controller or CRDs until the
-   native DaemonSet is healthy.
-4. Upgrade the Datadog Operator and remove the obsolete EDS controller and CRDs
+5. Confirm that the migrated Agent's ExtendedDaemonSet and its replica sets are
+   gone. Other workloads may still use EDS resources in the same namespace.
+
+   ```shell
+   kubectl -n <agent-namespace> get extendeddaemonset <agent-name>
+   kubectl -n <agent-namespace> get extendeddaemonsetreplicaset \
+     -l extendeddaemonset.datadoghq.com/name=<agent-name>
+   ```
+
+   The first command should report `NotFound` and the second should return no
+   resources. Do not remove the EDS controller or CRDs until the native
+   DaemonSet is healthy.
+6. Upgrade the Datadog Operator and remove the obsolete EDS controller and CRDs
    if no other workload uses them.
 
 Custom Operator Deployment manifests must not pass the removed EDS flags. Helm