Upgrade the agent

The agent is a single Deployment with one replica and a Recreate strategy, and it only makes outbound connections. An upgrade is therefore a short reconnect, not an outage of your cluster. Seylo shows the cluster as briefly offline, with the reason.

No new enrollment token is needed

After the first enrollment the agent holds its own long-lived credential in its Secret, and that Secret survives the upgrade. If the chart’s first-install guard complains, pass --set enrollmentToken=already-enrolled.

Verify the new version’s signature before upgrading — once per version.

Helm

helm upgrade seylo-agent \
  oci://ghcr.io/seylo-inc/charts/seylo-agent --version 0.2.0 \
  --namespace seylo-agent --reuse-values \
  --set image.digest=sha256:<the new digest>

--reuse-values keeps your server URL, cluster ID, RBAC scope, watched namespaces, proxy and CA settings.

Plain manifests

kubectl -n seylo-agent set image deployment/seylo-agent \
  agent=ghcr.io/seylo-inc/seylo-agent:0.2.0@sha256:<digest>

kubectl -n seylo-agent rollout status deployment/seylo-agent

You are not required to upgrade in step with the server

The wire protocol is range-negotiated. Seylo accepts any version it still supports and negotiates down. An older agent keeps doing everything it could do before, and any capability it lacks is reported as unsupported — with its version and the version required, never as zeroes or an empty chart.

The one direction that does not work: an agent newer than the server cannot be negotiated down. If you see protocol-version-unsupported after an upgrade, that is the cause.

Never track :latest

It is published for registry-UI reasons only. With imagePullPolicy: IfNotPresent, two nodes in the same cluster can end up running different builds, and re-pointing the tag does not fix a node that already pulled.

Pin a version, and preferably a digest.

Pinning a digest

A tag says which release you meant. A digest says which bytes you got, and it cannot be moved.

crane digest ghcr.io/seylo-inc/seylo-agent:0.2.0
# or
docker buildx imagetools inspect ghcr.io/seylo-inc/seylo-agent:0.2.0

Pass it alongside the tag. The chart renders repository:tag@sha256:… — Kubernetes resolves the digest and ignores the tag, so the image cannot be swapped underneath you while kubectl get pod -o wide still shows a readable version. A malformed digest is rejected by the chart at render time rather than thirty seconds later as an ImagePullBackOff.

The chart published to the registry already defaults to the digest of the image it was released with, so a Helm install from the OCI registry is digest-pinned even if you pass nothing.