'Must' DRS affinity rules should be disabled on the cluster when upgrading ESXi hosts. 'Should' DRS affinity rules can be kept in enabled state because they allow automatic VM relocation during host patching and return them without manual action, reducing the potential for human error.