Keep your pool's images up to date

Every private pool runs Cequence images: the Operator, Armor, DLP Engine, SIEM Manager and Redis. Cequence scans each release every night and publishes security patches and new releases. The portal shows you where each image stands and lets you choose when it changes. It works out what changes for you.

Quick Start

I want to...	Go to
See which images have known vulnerabilities	See where your images stand
Install a security patch right now	Apply security patches now
Have patches installed every week in a quiet hour	Turn on automatic security updates
Move every component to the latest release now	Upgrade to the latest release
Upgrade to the latest release during a maintenance window	Schedule the upgrade
Stop an upgrade I scheduled	Cancel a scheduled upgrade
Understand "Updating…" or "Latest unknown"	What the statuses mean

Security patch or latest release?

There are two ways an image can move forward. They are kept separate on purpose: a patch should be safe to install without anyone watching, and a new release is a change you plan.

	Security patch	Latest release
What it is	A newer build of the same release line, for example Armor v28.2.0 to v28.2.1	The release Cequence currently recommends, for example Armor v28.1.3 to v28.2.1
When it is offered	When it fixes at least one high or critical vulnerability in the image you run	When it is newer than the image you run
What it changes	Only the components that have a patch	Every component that is behind, together
Apply it now	Configuration → Images → Apply patches	Overview → Upgrade images to latest → Now
Apply it on a schedule	Every week, in your automatic security update window	Once, at a date and time you pick

Neither one ever moves a component to an older version.

See where your images stand

Open the pool from the Private Pools page. The Images card on the Overview tab gives the summary:

• A security banner, when an image has known vulnerabilities. It names the images, counts the critical and high findings, and says what fixes them: "A security patch is ready.", "Upgrading to latest fixes it." or "No patch is available yet." Select Review in Configuration to see the details.
• Newer releases, one row per component with its version and its standing against the latest release. The heading says one of:
  • All images are on the latest release
  • N images have a newer release with new features and fixes, with an Upgrade N images to latest button
  • No updates available, when nothing is newer, or when the portal can't compare an image (each such row says why).

For the full picture, select the Configuration tab, then Images. The table shows each component with its image, its Vulnerabilities, and a Fix:

Fix	What it means
Patch ready → version	A Cequence patch on the same release line fixes some or all of the findings ("Fixes 4 of 6", "Fixes all 4"). You can apply it now.
Fixed in a newer release (version)	Only a newer release line fixes it. Upgrade to the latest release, or wait for a patch.
Waiting for Cequence patch	A fix was released upstream. Cequence usually ships a patched image within 48 hours for critical findings and 1 week for high.
No upstream fix yet	The package maintainer hasn't published a fix.

Select View report on a row to see each finding, the package it affects, and whether the patch or newer release fixes it.

Scans run nightly. A version that was just released shows Not scanned yet until the next scan.

Apply security patches now

1. Open the pool, select Configuration, then Images.
2. Select Apply N patches above the table, or Apply on one row.
3. In Apply security patches, check what each patch fixes and what remains, clear any component you want to leave, then select Apply N patches.
4. Select Save changes at the top of the page.

Each patched component restarts with a rolling update. The patch keeps your image's registry and repository; only the version changes.

Turn on automatic security updates

Pick a weekly window, and Cequence installs ready security patches in it. Nothing else changes: a window never moves a component to a newer release line.

1. Open the pool, select Configuration, then Images.
2. Select Edit images.
3. Turn on Install security patches automatically.
4. Under On, choose the days. Under At, set the start time, and choose the Time zone. Daylight saving time is handled for you.
5. Select Apply, then Save changes.

Configuration → Images then shows the Schedule and the Next run, with what it would install if it ran now, for example "Sun, Nov 8, 2:00 AM · installs 1 patch (Armor)".

How a window works:

• The window opens at the start time and stays open for 30 minutes. Cequence checks the pool once in that time.
• If a patch is ready, it is installed and the component restarts with a rolling update.
• If nothing needs patching, nothing restarts. The pool waits for the next window.
• If the pool's Operator isn't connected when the window opens, nothing is installed and that window is over. The next one tries again.
• If a change is still rolling out when the window opens (you saved new images shortly before), the check waits until the rollout finishes, as long as the window is still open.
• Redis is patched in the window only when its mode is Cequence Deployed.

To pause the schedule, turn Install security patches automatically off. Your days and time are kept for when you turn it back on.

Upgrade to the latest release

1. On the Overview tab, in the Images card, select Upgrade N images to latest.
2. Review the list. Every component with a newer release is upgraded together; you can't pick some of them.
3. Under When, keep Now and select Upgrade N now.

The Operator rolls the new versions out within a minute or two. Each row shows Updating… until the pool reports the new version.

A component whose only newer version is a security patch isn't listed. Apply it from Configuration → Images instead.

Schedule the upgrade

1. In Upgrade images to latest, under When, choose Schedule for….
2. Pick the date and time, and the time zone. If that time falls inside your automatic security update window, the dialog warns you; the patch check then waits for the upgrade to finish rolling out.
3. Select Schedule N updates.

The Images card shows "Update to latest scheduled for …" with the time you chose.

When the time comes, Cequence checks the latest release again (it may be newer than when you scheduled it) and upgrades every component that is behind. Afterwards the card says what changed, or that everything was already on the latest release.

• You can schedule up to 90 days ahead. A pool has one scheduled upgrade at a time; scheduling again replaces it.
• If the upgrade can't run within 30 minutes of the time you chose, for example because the Operator is disconnected, it is skipped. The card says "The update scheduled for … did not run". Schedule it again for a new time.

Cancel a scheduled upgrade

On the Overview tab, in the Images card, select Cancel next to the scheduled upgrade. Nothing changes on the pool.

What the statuses mean

You see	What it means
Latest	The component runs the latest release.
Updating…	A new version is saved and still rolling out. It clears once the pool reports the new version, usually within a few minutes.
Latest unknown · not a release build	The component runs a build that isn't a numbered release, so it can't be compared.
Latest unknown · latest isn't a release build	The latest version Cequence lists for this component isn't a numbered release.
Latest unknown · latest is a different image variant	The latest release is a different flavour of the image from the one you run.
Latest unknown · pulled from your own registry	The image comes from your registry, so it isn't compared or upgraded automatically.
Off for this pool	The component isn't deployed in this pool.
Pinned by digest	The image is set by digest rather than a version, so it isn't upgraded.
Operator default	Redis has no image set and runs the version the Operator chooses. Patches for it can still be applied.
Operator offline. Tags may be out of date.	The pool hasn't reported in recently, so the versions shown may not be what is running.

What's never changed automatically

• Older versions. Nothing is ever downgraded. To go back to an earlier version, set it yourself in Edit images.
• Images from your own registry, such as in an air-gapped cluster. Copy the new version into your registry and set it in Edit images.
• Images pinned by digest.
• Redis, when upgrading to the latest release. Redis gets security patches only.
• Images you just changed by hand. If you set a different version than the one running, Cequence works from your change once it has rolled out.

Real-World Examples

Patch every Sunday night

Your team wants security fixes installed without anyone on call, outside business hours.

Setting	Value
Install security patches automatically	On
On	S (Sunday)
At	02:00
Time zone	America/New_York

Each Sunday at 2:00 AM Eastern, any ready patch is installed with a rolling update. Weeks with nothing to patch change nothing.

A planned upgrade on a Saturday evening

A new release adds features your team wants. Your change process needs a set time and a heads-up to users.

1. Select Upgrade N images to latest and review what will change.
2. Choose Schedule for…, Saturday at 22:00 in your time zone, and schedule it.
3. Share the time with your users. Cancel it from the Images card if the change is postponed.

An air-gapped pool

The pool pulls every image from your own registry, so nothing is upgraded for you. Use the Images card and View report to see which findings a newer version fixes, copy that version into your registry, and set it in Edit images. See Air-gapped clusters.

What to ask your IT team

Ask for	Why
A weekly maintenance window, with its day, time and time zone	For automatic security updates. Components restart with a rolling update.
Whether upgrades need a change request	Upgrading to the latest release brings new features, not just fixes. Schedule it for an approved time.
Pull access from the Cequence registry, or a process to mirror new versions	Pools that pull from Cequence get new versions automatically; mirrored pools need each version copied first.

Tips

• Reload the pool page before you edit images. A page left open since before a scheduled change still shows the old versions, and saving from it would put them back.
• Let "Updating…" clear before changing images again. A second change on top of an unfinished rollout is harder to follow, and automatic updates wait for it anyway.
• Turn on automatic security updates even if you also upgrade on a schedule. Patches arrive between releases; the weekly window installs them without waiting for your next planned upgrade.
• Check the report before upgrading. If a finding is "Fixed in a newer release" that is newer than the latest release, upgrading to latest may not fix it yet.