See: #42367

howto/upgrades.md

@@ -341,6 +341,8 @@ run `needrestart` on a particular host by hand:
 
 Important notes:
 
+1. Some hosts get blocked from restarting certain services but they are known
+   special cases:
    1. Ganeti instance (VM) processes (kvm) might show up as running with an
       outdated library and `needrestart` will try to restart the `ganeti.service`
       unit but that will not fix the issue. In this situation, you can reboot the
@@ -353,6 +355,10 @@ Important notes:
         cluster's main server (issuing a reboot from within the instance e.g. with
         the `reboot` fabric script might not stop the instance's KVM process on the
         ganeti node so is not enough)
+   2. carinatum.tpo runs some punctual jobs that can take a long time to run.
+      the `cron` service will then be blocked from restarting while those tasks
+      are still running. If finding a gap in execution is too hard, a server
+      reboot can clear out the alert.
 
 2. Some services are blocked from automatic restarts in the needrestart
    configuration file. (look for `$nrconf{override_rc}` in `needrestart.conf`)