Upgrade an existing Agent Router management-plane release.
Refuses to fresh-install (use 'tare manage install' for that). Reads the live
release's Helm values so operator config (database URL, secrets, corporate
login, image repositories, …) carries forward — pass flags to override
individually, e.g. --image-tag to move to a new version.
Defaults to helm upgrade --atomic so a failed rollout auto-rolls back to the
previous revision. Pass --no-atomic to leave a stuck release in place for
debugging.
Env overlays supplied via --values at install time (e.g. local KMS/berglas
settings) are NOT carried forward automatically — re-pass --values on upgrade.
Examples:
# Move the management plane to a new image tag
tare manage upgrade --customer acme --image-tag v1.3.0 --chart-version v0.2.0
# Preview the merged upgrade values without applying
tare manage upgrade --customer acme --print-helm-values
Usage:
tare manage upgrade [flags]
Flags:
--admin-key string global.adminKey.
--api-image-repository string Override api.image.repository (e.g. "valet") so --image-registry does not double-prefix the api image.
--api-key string global.apiKey.
--api-key-secret string global.apiKeySecret.
--app-image-repository string Override app.image.repository (e.g. "app") for mirrored registries.
--archival-bucket string archival.env.LOG_ARCHIVAL_BUCKET. A bare name selects GCS (default); s3://bucket or az://account/container select S3/Azure Blob.
--auth-image-repository string Override auth.image.repository (e.g. "auth") for mirrored registries.
--auth-secret string global.auth.secret.
--aws-region string AWS region for the AWS Secrets Manager/KMS backends (api.env.AWS_REGION, app.env.AWS_REGION). Required when --secret-manager-type is aws.
--aws-role-arn string IRSA role ARN (eks.amazonaws.com/role-arn) for the api/app/archival/auth/dashboard/bootstrapper ServiceAccounts. Optional; leave unset to rely on node-level IAM instead of per-pod identity.
--azure-vault-url string Azure Key Vault URL, e.g. https://myvault.vault.azure.net (api.env.AZURE_VAULT_URL, app.env.AZURE_KEY_VAULT_URL). Required when --secret-manager-type is azure.
--azure-workload-identity-client-id string Azure Workload Identity client id (azure.workload.identity/client-id) for the api/app/archival/auth/dashboard/bootstrapper ServiceAccounts. Also labels the api, app and archival pods with azure.workload.identity/use=true, which AKS's mutating webhook requires alongside the annotation before it will inject the federated token. Those three reach an Azure SDK: api via the valet secret store, app via getKMS(), and archival via the blob storage abstraction when its bucket is an az:// URI. auth, dashboard and bootstrapper carry the annotation but make no Azure SDK call today. Optional.
--chart-no-cache Bypass the ~/.tare/charts cache when fetching --chart-version.
--chart-path string Local path or oci:// reference to the manage-helm chart. Overrides --chart-version.
--chart-registry string OCI registry for --chart-version (default: registry.tetrate.ai, or --image-registry when set).
--chart-version string manage-helm chart version to fetch from --chart-registry. Required unless --chart-path is a local path.
--corporate-admin-email string global.corporate.adminEmail (chart-mandated). Required.
--corporate-email-domains string global.corporate.emailDomains, comma-separated (chart-mandated). Required.
--corporate-login-enabled global.corporateLoginEnabled: corporate SSO gate. Default true (enterprise); --deployment-mode saas turns it off. (default true)
--cron-secret string global.cronSecret (OAuth-refresh CronJob auth).
--customer string Organization (customer) identifier (drives namespace names and service domains). Required (defaults to "saas" with --deployment-mode saas).
--dashboard-image-repository string Override dashboard.image.repository (e.g. "dashboard") for mirrored registries.
--database-url string PostgreSQL connection string for the management plane. Required.
--deployment-mode string Deployment mode: enterprise or saas. saas defaults --customer to "saas" (the chart derives DEPLOYMENT_PRODUCT + public domains from customer=="saas") and turns corporate login off. (default "enterprise")
--doctor-uploads-bucket tare doctor api.env.TARE_DOCTOR_UPLOADS_BUCKET for tare doctor bundle uploads. Same scheme convention as --archival-bucket.
--enable-archival Enable the request-log archival CronJob (archival.enabled; SaaS-only, needs a bucket + workload identity -- see --archival-bucket).
--environment string Deployment environment (empty = production); selects the service-domain suffix.
--gcp-project-id string global.gcpProjectId (archival/usage-rollup + secret-manager valet).
--hmac-key-secret string global.hmacKeySecret.
--image-registry string Registry for management-plane images (global.imageRegistry).
--image-tag string Tag for management-plane images (global.imageTag; also applied to auth/dashboard tags).
--mcp-catalog bootstrapper seed --mcp-catalog Seed catalog passed to bootstrapper seed --mcp-catalog when the berglas-bypass command replaces the bootstrapper's default args (GCP-free installs only). Default "data", the chart's own default.
--namespace string Helm release namespace (default: tars-release-{customer}).
--no-atomic Do not use helm --atomic; leave a failed upgrade in place for debugging instead of auto-rolling back.
--no-bootstrap Disable the bootstrapper subchart (skip DB migrate + seed). The DB must already be migrated.
--playground-key string global.playgroundKey.
--print-helm-values Print the merged upgrade values (after carry-forward) and exit without upgrading.
--release-name string Helm release name (default: tars-{customer}).
--secret-manager-type string global.env.common.SECRET_MANAGER_TYPE: none, valet, aws, or azure. Default "none" (keys passed as plaintext flags, no cloud secret manager). "valet" resolves keys as secret-manager refs (GCP). "aws"/"azure" additionally select AWS Secrets Manager/KMS or Azure Key Vault for the KMS_TYPE settings below and bypass every subchart's berglas ENTRYPOINT (see NodeKMSType/GCPFree); "none" does the same but with no cloud secret manager at all. (default "none")
--serve-url string Data plane URL (global.serveUrl). Optional; chart computes proxy.{customer}.… when empty.
--skip-preflight Skip Helm/kubectl/cluster preflight checks and the KEK-resolves preflight (also TARE_SKIP_PREFLIGHT=1). A KEK that does not actually resolve in the target secret store fails silently at first decrypt, possibly long after this upgrade completes -- skip only if you have verified it yourself.
--timeout string Timeout for the helm upgrade wait and the bootstrapper hook. (default "10m")
--values string Extra Helm values file merged after the generated values (-f). Re-supply any env overlay used at install time.
--worm-bucket string api.env.AUDIT_LOG_SEAL_WORM_BUCKET, the external WORM anchor for audit-log seal checkpoints. Same scheme convention as --archival-bucket.
Global Flags:
-q, --quiet Suppress progress output; only errors and the final summary go to stderr
-v, --verbose Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr