Apply kernel updates without rebooting Compute nodes

You can enable kernel live patching (kpatch) on a set of Compute nodes to apply critical security updates or bug fixes without rebooting your system or disrupting your workloads.

About this task

The kpatch feature is disabled by default in Compute nodes in Red Hat OpenStack Services on OpenShift. To enable kpatch on a set of Compute nodes, you must add the edpm_update_enable_kpatch: true parameter to the OpenStackDataPlaneNodeSet custom resource (CR) that defines those nodes. You include these OpenStackDataPlaneNodeSet CRs in the files that you use to update the data plane nodes during the minor update. Repeat the following procedure for each OpenStackDataPlaneNodeSet CR where you want to apply kpatch.

For more information about using kpatch, see Applying patches with kernel live patching in Managing, monitoring, and updating the kernel.

Procedure

  1. Open the OpenStackDataPlaneNodeSet CR for editing: 
    $ oc edit OpenStackDataPlaneNodeSet
  2. In the ansibleVars field, add the edpm_update_enable_kpatch parameter with a value of true: 
      nodeTemplate:
    ansible:
      ansibleUser: cloud-admin
      ansiblePort: 22
      ansibleVarsFrom:
        - secretRef:
            name: subscription-manager
        - secretRef:
            name: redhat-registry
      ansibleVars:
        edpm_update_enable_kpatch: true
    Note
    If you want to return to standard kernel updates later, change the edpm_update_enable_kpatch value to false. The system requests a reboot of the Compute node when you apply future updates.
  3. Create a new CR to apply the kpatch to all the Compute nodes in your environment, for example, kpatch-install.yaml.
  4. Add the following configuration to kpatch-install.yaml: 
    apiVersion: dataplane.openstack.org/v1beta1
kind: OpenStackDataPlaneDeployment
metadata:
  name: kpatch-install
  namespace: openstack
spec:
  nodeSets:
  - openstack-edpm
  servicesOverride:
  - update
  5. Create the deployment: 
    $ oc create -f kpatch-install.yaml -n openstack
  6. Optional: You can view the Ansible logs while the deployment executes to monitor the status: 
    $ oc get pod -l app=openstackansibleee -w
$ oc logs update-kpatch-install-openstack-edpm-2z6hb

Results

  1. Verify that the kpatch-install.yaml CR is deployed and has a status of “Setup complete”: 
    $ oc get openstackdataplanedeployment

NAME                             NODESETS                STATUS     MESSAGE
edpm-deployment-post-ceph   ["openstack-edpm"]   True     Setup complete
edpm-deployment-pre-ceph    ["openstack-edpm"]   True     Setup complete
kpatch-install                      ["openstack-edpm"]      False    Deployment in progress
  2. Log in to the Compute node and verify that kpatch is installed and loaded: 
    $ ssh <compute_node>
$ sudo systemctl status kpatch

kpatch.service - "Apply kpatch kernel patches"
    Loaded: loaded (/usr/lib/systemd/system/kpatch.service; enabled; preset: disabled)
    Active: active (exited) since Fri 2025-07-11 09:40:21 UTC; 5s ago
   Process: 465148 ExecStart=/usr/sbin/kpatch load --all (code=exited, status=0/SUCCESS)
  Main PID: 465148 (code=exited, status=0/SUCCESS)
       CPU: 24ms
Jul 11 09:40:21 osp-compute-fbp5hxc8-0.example.com systemd[1]: Starting "Apply kpatch kernel patches"...
Jul 11 09:40:21 osp-compute-fbp5hxc8-0.example.com systemd[1]: Finished "Apply kpatch kernel patches".

    where:

    <compute_node>
    Specifies the name of the Compute node.