Upgrading a Locked-Down Linux Fleet with Nothing but kubectl

Say you're running a fleet of machines on an immutable operating system — root filesystem read-only, nothing drifts, and you upgrade the whole OS as a single artifact instead of patching it in place. ...