To ensure the best security of your cluster and the underlying infrastructure, you must ensure that you are running an operating system with the latest patches on your nodes. Fortunately, Kubernetes is flexible when it comes to the maintenance of nodes. The general approach for any maintenance, including applying OS patches that require reboot, is as follows:
- Cordon (mark the node as unschedulable) the node and drain the existing pods.
- Apply the required updates and reboot the machine.
- Uncordon the node to make it schedulable again.
Alternatively, if you use an immutable infrastructure approach, the preceding steps have to be extended by the creation of a new patched machine and the deletion of the old machine. For example, in AKS Engine, this scenario could look as follows, providing that you use Virtual Machine Scale Sets (VMSS) with a custom VM image for your...