Signed and pinned
Agent releases are signed by FluenceSecurity. At install time the agent pins the public key from the bundle. When a new version is offered, the agent verifies its signature against the pinned key, applies it and restarts itself. An update whose signature does not verify is refused and the refusal is logged.
If a new version fails to start cleanly three times, the agent restores the previous version.
Rolling out a release
Settings › Fleet › Release rollout controls who is offered the staged release. Move it through the stages one step at a time:
| Stage | Offered to |
|---|---|
| Held | Nobody. |
| Canary | The fleet groups you mark as canary. |
| 5% | Canary groups and 5 percent of the fleet. |
| 25% | Canary groups and 25 percent of the fleet. |
| Fleet | Every host. |
Nothing promotes itself. Watch the version and health columns on the Hosts page before each step. Without a rollout, the staged release is offered to every host.
Across an update
An update keeps the enrolled identity, the enrolment credential and the containment state. A host that is isolated stays isolated across an update.