Updating the agent

New agent versions are published as GitHub releases. The dashboard tells you when a server runs an older version: the Agent update available notice, and the Update available badge on the Servers page.

Install now#

From the notice, Install now updates one server or Install now on all of them. Only owners and admins can do it, and it needs agent 1.0.29 or later on the server. The request stays open for an hour; the agent picks it up at its next sync and usually finishes in one or two minutes. The server and its sites keep running.

Older agents show This version updates only with the command below: use the manual update.

Automatic updates#

Settings › Agent › Agent updates has two choices:

• Notify only (the default): the agent reports that a new version exists and installs nothing.
• Install automatically: the agent installs new versions by itself.

What the agent checks#

Whether it is Install now or an automatic update, the agent:

1. downloads the release only from https://github.com/infrafence/infrafence-agent/releases, whatever address it is given;
2. verifies its SHA-256 checksum and its cosign signature against the public key built into the agent, and installs nothing if either check fails;
3. runs the new binary's self-test (infrafence-agent check) before switching;
4. keeps the previous binary as /usr/local/bin/infrafence-agent.bak, then restarts the service.

If the new version crashes three times in a row, the agent goes back to the previous one by itself.

Update by hand#

Run the installer again without a token. It updates the binary and the service and keeps the registration:

curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash

Containers#

• Docker: pull the new image and recreate the container; the registration stays in the infrafence-config volume.
• Kubernetes: see Updates and GitOps.

What changed in each version is in the changelog.