zester update
Manage binary publishing and fleet rollout operations.
Synopsis
zester update <subcommand> [flags]Subcommands
| Subcommand | Description |
|---|---|
publish <binary-path> | Upload a binary artifact and publish its manifest |
fetch | Download a published binary from the object store (verify / pre-stage) |
rollout | Start a rollout to target nodes |
status | Show rollout progress or node update status |
abort <rollout-id> | Abort an in-progress rollout |
rollback | Roll back selected targets to their previous version |
versions | List published versions for a component |
update publish
zester update publish <binary-path> --component <peel|master> --version <version> [--goos <os>] [--goarch <arch>]| Flag | Default | Required | Description |
|---|---|---|---|
--component | "" | yes | Component type (peel or master) |
--version | "" | yes | Version string (for example v0.5.0) |
--goos | runtime GOOS | no | Target OS |
--goarch | runtime GOARCH | no | Target architecture |
update fetch
Downloads a published binary from the object store and verifies its SHA-256 — the non-mutating counterpart to a rollout's internal download. Resolve it via the manifest (--component + --version, needs manifest-bucket access), or download an object key directly (--object-key + --sha256), which is exactly the watchdog's own path — it gets the key and hash from the master's update command and never reads the manifest bucket, so the direct form works under least-privilege peel credentials.
# via the manifest (operator creds)
zester update fetch --component <peel|master> --version <version> [--goos <os>] [--goarch <arch>] [--out <path>]
# direct object key (works under peel creds; the watchdog's path)
zester update fetch --object-key <key> --sha256 <hash> [--out <path>]| Flag | Default | Description |
|---|---|---|
--component | "" | Component type (peel or master), with --version — resolves the key via the manifest |
--version | "" | Version string, with --component |
--goos / --goarch | runtime | Target platform for the manifest lookup |
--object-key | "" | Download this object key directly, skipping the manifest (needs --sha256) |
--sha256 | "" | Expected SHA-256 (required with --object-key) |
--out | "" | Write the binary here (default: verify only, discard) |
Verify peel-cred downloads
Run it with --creds <peel.creds> (and --nats-ca / NATS_CA_FILE on a peel-only box) to confirm a peel's credentials can complete the flow-controlled object-store download that self-update depends on — the check for the grant class that broke self-update in 0.3.4.
update rollout
zester update rollout --component <peel|master> --version <version> [--target <expr>] [--batch-size <n>] [--soak-time <dur>] [--batch-pause <dur>] [--max-failed <n>] [--dry-run]| Flag | Default | Required | Description |
|---|---|---|---|
--component | "" | yes | Component type (peel or master) |
--version | "" | yes | Target version |
--target | * | no | Target expression |
--batch-size | 1 | no | Nodes per batch |
--soak-time | 60s | no | Per-node soak period |
--batch-pause | 30s | no | Pause between batches |
--max-failed | 1 | no | Abort after N failures |
--dry-run | false | no | Preview without executing |
Current behavior notes:
- Rollout target expressions are resolved by the standard targeting engine (
glob,E@PCRE,L@list,G@fact, andcompound). - Resolution scope is nodes currently reporting in
update-statusfor the selected component.
update status
zester update status --component <peel|master> [--rollout <rollout-id>]| Flag | Default | Required | Description |
|---|---|---|---|
--component | "" | yes | Component type (peel or master) |
--rollout | "" | no | Show a specific rollout |
update abort
zester update abort <rollout-id>update rollback
zester update rollback --component <peel|master> [--target <expr>]| Flag | Default | Required | Description |
|---|---|---|---|
--component | "" | yes | Component type (peel or master) |
--target | * | no | Target expression |
update versions
zester update versions [--component <peel|master>]| Flag | Default | Required | Description |
|---|---|---|---|
--component | peel | no | Component to list versions for |
zester basket
Query basket data. Basket is Zester's mechanism for peels to publish structured data that other peels or the master can consume -- enabling peel-to-peel data sharing.
zester-migrate
Convert Salt .sls files to Zester .zy format. A standalone CLI tool that automates mechanical transformations and flags patterns requiring manual review.