INFRA Signal 473
Automated pipeline upgrades three-node K3s control plane on Kairos Hadron in 11 minutes with zero human intervention
↗
An engineer built a fully automated upgrade pipeline using six CNCF tools that upgraded a three-node K3s control plane running on Kairos Hadron in 11 minutes with no human intervention after merge.
This demonstrates a practical, vendor-lock-in-free approach to OS-level Kubernetes upgrades using A/B partitioning and GitOps, with supply-chain verification via Cosign. The pipeline also exposes a subtle concurrency misconfiguration that could silently break etcd quorum, showing that automation must be carefully validated before trusting it with control plane reboots.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The pipeline uses Renovate, Kyverno, Cosign, ArgoCD, Gitea, and kairos-operator to automate OS upgrades from image detection through node reboot.
Kairos Hadron writes new OS images to an inactive A/B partition and reboots into them, with rollback being a simple boot of the old partition.
A previous bug with concurrency: 0 caused all three control plane nodes to reboot simultaneously, risking etcd quorum; fixing it to concurrency: 1 ensures sequential upgrades.
THE CLUSTER