Cloud customers are increasingly running workloads in Kubernetes clusters. Applying security patches can be fraught — but it doesn’t have to be.