My cluster mostly updates itself: ArgoCD syncs the manifests and Renovate keeps the image tags current. The one thing I still SSH’d in to do was patch the nodes’ own OS. Now I handed that off too, with the system-upgrade-controller running a monthly apt full-upgrade Plan and unattended-upgrades applying security fixes in between.