News › networking
By Zayden R., August 16, 2026
A new pipeline on Kairos automates Kubernetes upgrades in just 11 minutes without human intervention. This advancement enhances reliability and efficiency, crucial for sysadmins dealing with frequent updates and security patches.
In a significant step forward for Kubernetes management, a new self-healing upgrade pipeline built on Kairos now automates the process in a mere 11 minutes, requiring no human intervention. This development is a boon for sysadmins who have long grappled with the complexities of manually upgrading Kubernetes control planes.
The pipeline leverages a robust setup featuring three control plane nodes, k3s HA, and Kairos Hadron, an immutable Linux distribution known for its A/B partition upgrades. Unlike traditional patching methods, Kairos writes a new OS image to an inactive partition, ensuring a smooth transition with a simple reboot. Rollbacks are equally straightforward, involving merely booting from the old partition. This approach not only simplifies the upgrade process but also strengthens the supply chain by using cosign-signed images.
However, the journey wasn't without its hiccups. An earlier version of the pipeline had a critical flaw: a concurrency setting of 0 in the upgrade specification, which mistakenly triggered all nodes to reboot simultaneously. Although etcd quorum survived this test by sheer luck, the issue was rectified by setting concurrency to 1, ensuring upgrades occur one node at a time. This fix forms the backbone of the current pipeline's reliability.
The pipeline integrates six key tools, each serving a distinct purpose. Gitea, a self-hosted git service, runs on its own Kairos and k3s cluster, executing CI tasks via a Gitea Actions runner. Renovate plays a crucial role by monitoring quay.io/kairos/hadron for new tags, opening pull requests for image tag updates and upgrade CR metadata changes. Meanwhile, Kyverno acts as a gatekeeper, rejecting any upgrade CRs that don't meet image criteria.
For engineers and sysadmins, this streamlined process means less downtime and a more secure, reliable Kubernetes environment. The use of CNCF projects ensures minimal vendor lock-in, aligning with the broader trend towards open-source, community-driven solutions.
The Linux Camp teaches these topics as hands-on labs on real virtual machines, verified as you type.