How are Tanzu Kubernetes clusters upgraded?

To configure a cluster with user authentication in Tanzu Kubernetes Grid (TKG), which options are needed to deploy Dex on a management cluster running on vSphere? (Choose two.)

An architect is designing the infrastructure for multiple applications and needs to ensure isolation and control over resources and permissions assigned to each application team.
Which is the easiest and least expensive way to satisfy these requirements?

A customer needs to use Kubernetes and wants to use networking solution, Antrea.
Which product from Tanzu portfolio should the customer use?

An administrator was asked to run a conformance testing on all Kubernetes clusters managed by Tanzu Mission Control.
What are the required steps?