Comparison
Image bakingvsPatch cadence
Image baking
a scheduled job boots a base machine, applies the configuration, snapshots it and publishes a new version every week.
The pipeline that produces golden images: start from a base, run configuration management once, test it, snapshot it, promote it. It is where configuration management survives in an immutable world — run once at build time instead of forever at run time. The cadence is the whole point, since the security value of a golden image comes from being rebuilt, not from being golden.
Full entry →Patch cadence
you fell four versions behind and now the upgrade is a project, because you can only move one version at a time.
How regularly the platform's own components — nodes, orchestrator, plugins, base images — are updated. Falling behind compounds nonlinearly: support windows close, upgrades must be taken in sequence, and each step's incompatibilities arrive together. Frequent small upgrades are boring and cheap; infrequent large ones are a quarterly project with an incident attached.
Full entry →