What is the suggested approach to safely restart a node?
Should I cordon or drain the node first, then find the vm and restart it?
Yes, drain and restart should be fine.
You can get more fancy if you want to use pod disruption budget or something else in some apps. But drain and restart is the way to go 