Every host runs one kernel, so an upgrade is a whole-machine change — how do you set a kernel version policy for a shared fleet?

## Why kernel version is a fleet decision A workload can be replaced copy by copy, in minutes, with no one else involved. A kernel cannot. One machine carries exactly one kernel, serving every container on it, so changing that kernel means emptying the machine and restarting it. The cost of a kernel decision is therefore denominated in **machines**, not in workloads, and it is paid again for every machine in the estate. That single fact produces the whole policy question. Two things have to be decided deliberately, and both are the kind of trade a lead owns rather than a setting someone changes. ## Decision one: one version, or several populations | | One version across the fleet | Two or more host populations | |---|---|---| | Certification and patching | one train, one thing to qualify | one per population, forever | | Placement | unconstrained; anything fits anywhere | a constraint per requirement, maintained by someone | | Capacity | one pool absorbs every workload | fragmented; each pool sized for its own peak | | Trying a new version | the fleet moves together | a population can take it first | | Urgent fix | one pass over the fleet | one pass per population | The honest reading is that a second population is not free and is rarely temporary. It buys two real things — a home for a workload whose vendor demands a particular kernel, and the ability to expose a slice of the estate to a new version before all of it — and it charges capacity fragmentation, a duplicated patch train, and a placement rule that has to survive every future reorganisation of the platform. So the policy is a number, not a principle: **how many populations will this estate carry**, and who is allowed to ask for another one. Teams will ask; the request should come with what breaks without it and whether the requirement is permanent. ## Decision two: how fast can the whole fleet turn over This is the capability that actually matters, and it is the one most estates have never measured. When an urgent kernel fix appears, every workload on every unpatched machine is still sharing the affected kernel. The exposure does not taper as machines are done — it ends at the **last** machine. So the useful number is not what fraction is patched, it is the wall-clock time from decision to the last host restarting. That number exposes the things that will actually stop you: - machines that cannot be emptied because a workload on them has nowhere else to go; - workloads nobody is willing to move during business hours; - capacity so tight that emptying machines in parallel is impossible; - host populations that each need their own pass; - machines that do not come back, and the manual work of noticing and replacing them. A turnover that has only ever been done during an incident is not a capability, it is a hope. The fix is to exercise it on an ordinary, non-urgent version change and record how long it really took. ## What to write down 1. **The supported version set** — how many, why each one exists, and the date each stops being supported. 2. **Who may add a population**, what evidence the request needs, and who pays for the capacity it strands. 3. **The turnover target** — the time within which the whole fleet, all populations, can be restarted on a new version, measured rather than asserted. 4. **How a workload's kernel requirement is recorded**, so that a rebuilt machine or a capacity move does not silently violate it. 5. **What happens to a machine that fails to return**, because at fleet scale some will not. ## Where more populations is the wrong answer Sometimes the requirement should move instead of the fleet. A workload that wants a kernel nobody else wants may be better changed, dropped or run on a boundary that brings its own kernel — a separate decision with its own trade-offs — than serviced by a permanent island of machines. And sometimes the request is really about a host-wide setting rather than a version at all, which is a cheaper conversation with the same shape: a value that belongs to a machine, and tenants who must either agree on it or stop sharing.