Eleven minutes, zero humans: Building a self-healing Kubernetes upgrade pipeline on Kairos

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Once upon a time, upgrading a Kubernetes control plane meant staying awake for it.

SSH into every node. Run the upgrade by hand. Watch etcd health the whole time, hoping quorum holds through every reboot.

This week I found out whether the pipeline I built actually ends that story.

The Roots of the Platform

This mgmt cluster is where everything starts.

It was bootstrapped with OpenTofu with three control plane nodes, K3s HA, Cilium CNI, all provisioned as code before a single workload ever ran. I think of it as the root of a platform that’s going to keep growing: more tooling, more workloads, more clusters hanging off it over time.

Roots need to be solid before you build on top of them. And in 2026, with the pace of CVEs landing across the stack, the thing I wanted most from this root wasn’t more features. It was a genuinely simple, genuinely reliable upgrade process. Something I could trust to run without me needing to relearn the steps every time a patch shipped. I wanted to use the most possible tooling from Cloud Native Computing Foundation (CNCF) to avoid any vendor lock-in and build upon my Golden Kubestronaut knowledge.

That’s what the rest of this is about.

The Setup

Three control plane nodes, k3s HA, running Kairos Hadron an immutable Linux distribution built around A/B partition upgrades and cosign-signed images. Kairos doesn’t patch in place. It writes a new OS image to an inactive partition and reboots into it. Rollback is just booting the old partition again.

That’s a strong supply-chain story. But it only matters if the upgrade actually happens. My …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://www.cncf.io/blog/2026/08/14/eleven-minutes-zero-humans-building-a-self-healing-kubernetes-upgrade-pipeline-on-kairos/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.