One or more software products/services may be installed on a cloud deployment. Product versions of such services can be upgraded (or rolled back) based on a deployment plan comprising tasks adapted to reach a target deployment state. A central upgrade server can forward tasks to an upgrade agent for execution, the tasks being based on a current operational state of the cloud deployment (obtained by the upgrade agent) and one or more constraints. In multiple node deployments, some nodes may be upgraded to a new product version, while other nodes are kept at a current product version until stability of the new product version is determined. Traffic across nodes can be shaped to ensure a deployment is healthy before upgrading other nodes/deployments. If the health of a node/deployment does not meet specified criteria, an upgrade can be stopped, an alert can be triggered, and the node/deployment can be rolled back.