Kernel livepatch waves
Apply supported running-kernel patches with canary validation and explicit reboot fallback.
Kernel livepatch applies supported security fixes to a running host kernel. It is distinct from installing a new kernel package and does not cover every kernel or hypervisor update.
Eligibility
A node must use a supported distribution, kernel build, livepatch provider, and provider authorization. The inventory lists available patches and whether each is live-applicable, reboot-required, or unsupported.
An unsupported livepatch cannot be declared complete merely because the package manager installed its artifact. Schedule an ordinary drained reboot when the required fix needs a different booted kernel.
Create waves
Select a livepatch policy under Operations → Patching, choose canary nodes, and define subsequent waves and observation periods. The plan records target IDs, kernel build, patch set, approval, and expected workload impact.
A wave starts only after its prerequisite validation passes. A failed canary pauses admission of later waves under the default policy. Already applied patches remain in place; the plan does not imply transactional rollback across hosts.
Apply and validate
Open the livepatch plan under Operations → Patching. Run its preflight to check agent health, required storage redundancy, and provider connectivity. After required approval, start the plan and follow each wave's operation. Inspect the running kernel's reported patch state and host health in its node result. A provider response accepting the request is not the same as an observed active patch.
Some actions can still require workload evacuation or service restart according to the patch manifest. A livepatch label does not authorize skipping those declared requirements.
Failure and recovery
Read provider result, kernel build, and operation stage. If reversal is supported, use the approved reversal action. Otherwise maintain the node through the normal cordon, drain, reboot, and validation workflow.
Keep required artifacts available in an offline installation and record exceptions for kernels that remain unpatched. See patching, maintenance approvals, and node maintenance.