I've finished the campaign on normal and hard and have always been one upgrade short of having them all. I can't find a breakdown of how each upgrade is earned in-game but here is what I've found:

1 upgrade per level: (15)
1 upgrade for Evacuation (Cardinal)
1 upgrade for Spirit Gate
1 upgrade for Tyranid faction defeat
1 upgrade for Eldar faction end (thinks this is regardless of choice)
Grand total: 19 in total

My question is if there is anything I'm missing? I did all the side missions and hit the level cap. Or is there only 19?

I've played through the Imperial campaign once on normal and twice on hard and have been one upgrade shy of completion each time as well. Those are the upgrade opportunities I've found; if there's any others they're either well hidden, or I'm quite obtuse (very possibly the case).

I went through the Necron campaign and didn't have any issues getting all upgrades (so long as I did all side missions). I'm testing Tyranid campaign at the moment to see if it's an issue.

Personally, I hope this gets addressed since out of the three, I liked the Imperial one the most as it continues Spire's story from the first game.

I was able to get all upgrades for both the Nids and Necron campaigns on all difficulty levels.

edit: that's why it seems so weird that it doesn't seem to be the case for the Imperium campaign.