Skip to main content

Overview

The auto-update agent is a lightweight container deployed as a Kubernetes CronJob on the existing EKS cluster. It:
  1. Polls the Hilt release ECR (297433793776) for new image tags matching a configured version policy.
  2. On a patch (same MAJOR.MINOR line): mirrors images only.
  3. On a minor/major line change: pulls the delivery bundle tagged with the resolved image tag (dag-delivery-bundle:<tag> — infra + schema snapshot), reconciles when enabled, then mirrors images.
  4. Forces ECS service redeployments and EKS rollout restarts.
  5. Verifies health after rollout.
  6. Reports status to a configurable webhook (Slack, email, etc.).
The image tag is a stack snapshot: a deployment on 0.4.0 keeps the infra of 0.4.0 even when latest is 0.6.0.

Dashboard view

Settings → System provides a management panel for the auto-update agent:
  • Current version — the active release tag (e.g., 0.4.1).
  • Previous tag — the release tag that was active before the last update.
  • Last updated — the timestamp and actor (user or system) of the most recent update.
  • Automatic updates toggle — an on/off switch to enable or disable automatic updates.
Permissions: viewing the dashboard panel requires the view_audit permission; toggling automatic updates on or off requires the manage_users permission.
Disabling updates via the dashboard toggle keeps the CronJob scheduled but causes it to take no action on each run. This is different from disabling via Terraform (auto_update_enabled = false), which removes the CronJob entirely.

Operations reference

Version policy

Release tags follow semver MAJOR.MINOR.PATCH (e.g. 0.4.1) — no v prefix. Default policy is patch (same MAJOR.MINOR only): Raising the line requires editing image_tag and re-applying. The Terraform variable auto_update_policy sets container UPDATE_POLICY (patch / minor / any). When delivery-bundle pull is enabled, a line change also pulls that tag’s infra/schema bundle before rolling images.
Last modified on October 8, 2026