Hey again,
I misunderstood how test-upgrade is being run in Prow. Beyond the 1.9.2 issue I mentioned above, for which I submitted a fix in [1], this test only ever tests that it is possible to upgrade from the latest cert-manager tag (currently, 1.16.2) to the latest possibly unreleased commit on the release-1.16 branch. Although this upgrade test is still worthy, I didn't realize that we weren't testing common cross-minor-version upgrades such as 1.14.7 to v1.16.2 and 1.15.4 to 1.16.2.
To Chao: the `make test-upgrade` make target won't be helpful to you as it stands.