Methods to perform an operation comprising determining that a first component of a first compute node violates a compliance rule, wherein the first compute node executes a plurality of workloads and is of a plurality of compute nodes in a computing cluster, performing a predefined operation to defer need to apply a software update configured to correct the violation of the compliance rule by the first component of the first compute node, and executing, by the first compute node, at least one of the plurality of workloads without applying the software update.