Updating Riptides

Update the Riptides daemon and kernel driver on an already-installed node in place. The daemon keeps its existing identity and configuration, so no re-authentication happens - updating never re-runs enrollment.

The installer leaves an update helper at /usr/local/bin/riptides-update.sh (alongside riptides-uninstall.sh), so on any node installed with install.sh you can run it directly:

# Update both the daemon and the driver to the latest release
sudo riptides-update.sh

# Daemon only - no kernel-module reload, so no traffic interruption
sudo riptides-update.sh --update-daemon

# Reinstall/restart even if already at the target version
sudo riptides-update.sh --force

The helper is a thin wrapper: it fetches the current installer and runs it in update mode, forwarding any flags. The equivalent one-liner (for a first upgrade before the helper exists, or in automation) is:

curl -fsSL https://docs.riptides.io/install.sh | sudo bash -s -- --update

What Gets Updated

The update compares the installed versions against the latest releases and only reinstalls what is out of date. If everything is already current it exits without restarting anything.

Flag	Effect
--update	Update the daemon and the driver
--update-daemon	Update only the daemon
--update-driver	Update only the driver
--force	Reinstall/restart even if already at the target version

Pinning a Version

By default the latest release of each component is installed. Pin a specific target with --daemon-version / --driver-version - the daemon and driver are versioned independently:

sudo riptides-update.sh --daemon-version v0.5.13

# or via the installer one-liner:
curl -fsSL https://docs.riptides.io/install.sh | sudo bash -s -- --update --daemon-version v0.5.13

Driver updates briefly interrupt traffic

--update and --update-driver reload the kernel module, which momentarily tears down active mTLS interception on the node. Use --update-daemon to update the daemon alone with no effect on intercepted connections.

No Re-authentication

Updating never re-enrolls the node: credentials and identity persist in /var/lib/riptides, and the configuration in /etc/riptides/config.yaml is preserved. No control plane URL or join token is needed to update.

Kubernetes (Helm)

On Kubernetes the daemon runs from its Helm chart, not this installer, so update it with helm upgrade instead of riptides-update.sh. Reuse the same values file you installed with:

helm upgrade riptides-daemon oci://ghcr.io/riptides-packages/helm/daemon \
  --namespace riptides-system \
  -f daemon-values.yaml

The chart deploys a DaemonSet, so this performs a rolling update across nodes; on each node the driver-loader init container reloads the kernel module as the pod restarts.

Pin the chart with --version <chart-version> (omit it to move to the latest chart). The kernel driver version is set separately by the driverLoader.driverVersion chart value - bump it in your values and re-run helm upgrade:

daemon-values.yaml

driverLoader:
  driverVersion: "v0.5.15"

See Daemon on Kubernetes for the full chart reference and values.

Next Steps

• Uninstalling Riptides - remove the daemon, driver, and services from a node.