Maintenance plans
Schedule reviewed infrastructure changes with controlled concurrency.
Maintenance plans sequence node and workload changes within a defined scope. A plan records targets, prerequisites, concurrency limits, execution windows, and stop conditions.
Create a plan
Open Operations → Maintenance → Create plan. Select explicit node IDs or a label selector, choose actions, and preview the resolved target list. Supported actions include cordon, drain, agent update, patch, validation, and uncordon.
Plans start manually unless a schedule with an explicit time zone is selected. The default concurrency is one node sequence, and the default failure policy pauses admission of new sequences. These limits control work started by this plan; they do not reserve all region capacity against unrelated requests.
Approval records the resolved target IDs. Protected actions require a valid approval for that exact revision. Reopening admission happens only after required validation succeeds. Notification suppression is separate and remains disabled unless a specific alert window is selected.
Changing the target selector after approval requires a new preview and approval revision. Adding a node with a matching label does not silently add it to an already approved target set.
Preflight
Check spare capacity, placement-group constraints, guest compatibility, storage redundancy, mesh health, and current operations. A plan that drains compute from a combined compute/storage node must also include storage evacuation or a validated storage maintenance procedure.
A successful preflight describes the inspected state. It does not guarantee future capacity when other workloads continue changing. Execution repeats the required checks before each disruptive step.
Execution windows
A window determines when new disruptive steps can start. A step already running can continue past the window end to reach a consistent state. Use action-specific timeouts rather than expecting the end of a window to interrupt a disk write or migration commit.
Scheduled times use the plan's configured time zone. Review daylight-saving transitions for recurring calendar windows. Use UTC when a fixed calendar interpretation is required across regions.
Failure and pause
The default failure policy pauses the plan after a node sequence fails. Existing children resolve according to their own lifecycles. Successfully completed work remains applied, and cordoned nodes remain cordoned until validation or an explicit operator action changes admission.
Open Operations → Maintenance → Plan and inspect the failed node sequence. Correct its reported blocker, run Preflight again, and select Resume when the required checks pass. If the target must be skipped, record the reason in the plan; its current state remains visible in the result.
Completion
A completed plan lists updated nodes, migrated workloads, failed or skipped targets, and nodes still cordoned. Verify application health independently of host health before closing the maintenance record.
Use Patching, Agent updates, and Node maintenance for the execution rules of each step.