Immutable Turtles All the Way Down (froscon2025)

Shipping both the OS and Kubernetes as immutable, verifiable images sure has benefits for security, supply chain management, and compliance. But don't we just shift the load from security to operations? Doesn't the lack of flexibility and the restrictiveness add significant overhead for developers and operators? (Disclaimer: No Slides will be harmed in this talk. This is a demos-only presentation!) Quite the opposite! In this talk, we present how immutable Kubernetes images on an immutable operating system can help separate the concerns of distribution and Kubernetes maintenance, simplify day 2 operations, and make in-place updates painless. The talk will discuss systemd-sysext and the benefits it brings to the Kubernetes ecosystem. We will showcase production ready provisioning-time node composition in ClusterAPI, and dive into OS level live in-place updates, illustrating our concepts with live demos throughout the presentation. All demos in our presentation are simple and self-guiding; our audience will easily be able to reenact at their own leisure. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://programm.froscon.org/2025/events/3330.html