A hosted provider like GKE will update the OS of the master/nodes for you. (although the OS itself doesn't do much; Google uses a container-optimized OS that only handles containers and has a much smaller footprint)