If it’s important that it keeps running then it should just be redundant and taking one node down for an update shouldn’t be an issue. I know this is wishful thinking for a lot of services but I refuse to be on call for something if the client can’t be bothered to make it redundant.