I'd usually expect (and for that matter, encourage) separate upgrades of Cilium vs. Kubernetes. At a glance I found this a bit ambiguous as to whether this is a step we're trying to say users should run during Cilium upgrade or trying to give them a heads up if they're upgrading K8s...?

Maybe splitting out into a few questions:

• Do users on K8s 1.16 or higher have to take any action?
• Do users on k8s 1.15 or lower have to take any action?
• Is this action required during Cilium 1.9 upgrade?
• Is this action required during K8s version upgrade?

To answer your questions, users do not have to take any additional action if they are keeping their K8s version the same all users should run the preflight checker before upgrading. See @aanm's note below. Updating to address his review.

Users who are upgrading
from Kubernetes below v1.16.0 to past Kubernetes v1.16.0, while running
Cilium v1.9 or greater, should run the pre-flight checker mentioned above.
The pre-flight check will ensure the custom resources installed inside the
cluster are well-formed.

this whole section can be removed. When performing the upgrade, users should run the pre-flight build regardless of the information is written here.

That's a good point. We don't really need the extra contraints. We should detect badly formed CRDs regardless of K8s version.