Updates¶

Use the Updates page to see which Privitty Edge agent version your Edges run and to roll out a newer signed release.

Owners and Admins can start an update.

Read the page¶

Edges by agent version¶

Lists each agent version with the number of active Edges that last reported it. Not reported counts Edges that have not reported a version yet.

The line Watchtower <version> supports agents <min> through <max>. shows the supported range. A version below it shows Below the minimum supported agent. Update those Edges.

Releases¶

Lists the releases available to roll out, each with its version, image and digest, notes, and Minimum Watchtower version. If you see No releases imported., ask your Watchtower administrator to import releases.

Before you begin¶

Each Edge you update must meet these conditions:

Its configuration has an update policy. Without one, the Edge refuses every update.
Its Overview tab lists cmd.update_agent under Capabilities. Edges without it do not receive the update.
The release's image is inside the policy's allowed_registry.

Set an update policy¶

The portal has no form for the update policy. Add it on a template's JSON tab, or in Overrides JSON on a group or an Edge.

{
  "update_policy": {
    "mode": "auto",
    "window": { "days": ["sat", "sun"], "start": "02:00", "end": "05:00", "tz": "Europe/Berlin" },
    "allowed_registry": "ghcr.io/privitty/privitty-edge"
  }
}

Field	Values
`mode`	`auto`: install the update in the next maintenance window. `download_only`: download and verify the image, but do not switch to it. `manual`: refuse updates sent from Watchtower.
`window.days`	One or more of `sun`, `mon`, `tue`, `wed`, `thu`, `fri`, `sat`.
`window.start`, `window.end`	24-hour `HH:MM`, different from each other. If `end` is earlier than `start`, the window runs past midnight.
`window.tz`	A time zone name such as `Europe/Berlin` or `America/Chicago`.
`allowed_registry`	The image repository the Edge accepts updates from.

In auto mode, an update that arrives outside the window waits for it. The window must open within 8 days. To turn updates off, set "update_policy": null. Wait until the Edge shows In sync before you roll out. See Edge configuration.

Roll out a release¶

Open Updates.
Choose the Version.
Choose the Scope: org, site, group or device.
For any scope other than org, enter the id in Scope id. An Edge's id is the last part of its page address, /edges/<id>.
Click Roll out version version. The page shows Rollout <id> is running. Progress is on the Rollouts page.

The update proceeds in steps like any other rollout, and pauses if too many Edges fail.

Check the result¶

Rollouts: progress and failures per step.
The Edge's Commands tab: the update_agent row, its State and Error. See Edge commands.
Edges: the Agent column shows the new version once the Edge reconnects with it.

If the new version does not start correctly, the Edge returns to its previous version on its own.

Error on the `update_agent` row	Fix
`update_policy is not set`	Add an update policy, wait for In sync, roll out again.
`image_ref is outside the allowed registry`	Correct `allowed_registry`.
`manual mode does not apply an image from Watchtower`	Set `mode` to `auto` or `download_only`.
`the maintenance window does not open within 8 days`	Correct `window`.
`update window timezone is not known`	Use a time zone name such as `Europe/Berlin`.

If an update keeps failing, collect diagnostics from the Edge's Commands tab and contact Privitty support through the channel listed in your Privitty agreement.