# Upgrading and removing

> Upgrade or roll back Continuum Local on each platform, replace its credentials, revoke it in Blueprintr, and uninstall it.

An upgrade keeps the configuration, the enrolled identity and any credentials
sent from Blueprintr, so the agent needs no new token. An older agent keeps
working until you upgrade it, because Blueprintr sends an agent only the work it
reports it can do (see
[compatibility](/foliums/blueprintr-user-guide/continuum/local-agent/releases#supported-versions-and-compatibility)).
The Continuum Local panel shows each agent's version, and **Update available**
when a newer release exists.

## Upgrade

Download the new release,
[verify it](/foliums/blueprintr-user-guide/continuum/local-agent/releases#verify-the-downloads),
and set `V` to its version. Then:

| Install | Upgrade |
| --- | --- |
| Debian, Ubuntu | `sudo apt install ./continuum-local_${V}_amd64.deb` |
| RHEL, Rocky, Alma | `sudo dnf install ./continuum-local-${V}-1.x86_64.rpm` |
| Windows | Run the new `.msi`. |
| Docker | Pull the new image and replace the container, keeping the state volume (below). |
| Kubernetes | `helm upgrade agent oci://ghcr.io/blueprintr-io/charts/continuum-local --version $V --reuse-values` |
| Node.js host | Replace the `.mjs` file and restart the process. |

On Linux, a running agent restarts on the new version and a stopped one stays
stopped. On Windows, a service set to Automatic stays Automatic and restarts; a
Manual service stays Manual, and runs again after the upgrade if it was
running. In Kubernetes the old pod stops before the new one starts.

For Docker:

```bash
docker pull ghcr.io/blueprintr-io/continuum-local:$V
docker stop continuum-local && docker rm continuum-local
docker run -d --name continuum-local --restart=unless-stopped \
  -v /etc/continuum-local:/etc/continuum-local:ro \
  -v continuum-local-state:/var/lib/continuum-local \
  ghcr.io/blueprintr-io/continuum-local:$V
```

Upgrading a running agent restarts it. A request the agent was answering at
the time fails as not answered in time: refresh the tab once the agent is back
online. A network sweep that was running stops and is kept as a partial result,
so upgrade between scheduled sweeps. Afterwards,
confirm the new version in the panel or with `continuum-local --version`.

## Roll back

The [download page](https://blueprintr.io/download/continuum-local) lists
**Other versions** under the current release: the current release and a few
earlier ones, each with its own files and verify commands. For a version that
is no longer listed, email support@blueprintr.io.

Install the older release over the newer one, with `V` set to the older
version:

| Install | Roll back |
| --- | --- |
| Debian, Ubuntu | `sudo dpkg -i continuum-local_${V}_amd64.deb` |
| RHEL, Rocky, Alma | `sudo dnf downgrade ./continuum-local-${V}-1.x86_64.rpm` |
| Windows | Uninstall, then run the older `.msi`. The installer refuses to install over a newer version. |
| Docker | Run the older tag with the same state volume. |
| Kubernetes | `helm rollback agent`, or `helm upgrade` with the older `--version` |
| Node.js host | Run the older `.mjs` file. |

On Windows, uninstalling keeps `C:\ProgramData\Continuum Local`, so the
configuration and identity survive. The reinstalled service starts as Manual:
set it to Automatic and start it again. On every format, run `check` afterwards
and confirm the agent is online. If the older release lacks something a
connector needs, the connector list asks you to upgrade the agent.

## Replace the agent's credential

The agent keeps its own credential for Blueprintr in its state directory.
Replace it to rotate it, to move the agent to another machine, or to retire a
host you no longer trust.

> [!STEPS]
>
> === Issue a new token
>
> On the agent in the Continuum Local panel, choose **Re-enroll** and confirm.
> Blueprintr shows a new enrolment token and cancels any earlier unused one.
>
> === Put it in the configuration
>
> Set it as `enrollmentToken` in `config.json` on the machine that will run the
> agent.
>
> === Restart the agent
>
> It enrols again as the same agent, and the previous credential stops working.
> An install still using the previous credential is disconnected.
>
> === Remove the token
>
> Delete the `enrollmentToken` line.

If Blueprintr refuses the new token, the agent keeps its stored identity, says
so in its log, and does not send that token again. Credentials sent from
Blueprintr stay on the machine that received them. After a move, send them
again to the new machine, and delete the old machine's state.

A revoked agent cannot be re-enrolled. Create a new agent, set its token as
`enrollmentToken`, and restart. The agent enrols as the new agent and deletes
everything Blueprintr sent to the old one, so send those credentials again.

## Rotate a monitored system's credential

Blueprintr stores no credential for your on-premise systems, so you rotate one
in the monitored system and on the agent:

| Where the credential is | To change it |
| --- | --- |
| In `config.json`, a `credentialFile`, or a file or variable used in an `env:` or `file:` reference | Change the value, then restart the agent. The agent reads references once, when it starts. |
| Sent from Blueprintr | Choose **send credentials** on that connection again while the agent is online and connected to the gateway. The new value replaces the old one. |

On the Linux packages, the variables used in `env:` references are in
`/etc/continuum-local/environment`.

## Revoke or delete in Blueprintr

| Action | What happens |
| --- | --- |
| **Revoke** | The agent stops working at once: Blueprintr refuses its requests, closes its connection and drops its queued work. This cannot be undone. To use that machine again, create a new agent. |
| **Delete** | The agent is removed from Blueprintr with its network sweep results, and stops working at once if it is still running. The audit log keeps a record. |

Neither changes anything on the agent's machine. Credentials sent from
Blueprintr stay there until you choose **remove from agent** on each while the
agent is online and connected to the gateway, or delete the agent's state as
below.

## Uninstall

Uninstalling stops the agent and removes the program. It keeps the
configuration, with any credentials in it, and the state directory, with the
enrolled identity and any credentials sent from Blueprintr. Removing those is a
separate step:

| Install | Uninstall | Also remove the configuration and state |
| --- | --- | --- |
| Debian, Ubuntu | `sudo apt remove continuum-local` | `sudo apt purge continuum-local` deletes `/etc/continuum-local` and `/var/lib/continuum-local`. |
| RHEL, Rocky, Alma | `sudo dnf remove continuum-local` | rpm has no purge: `sudo rm -rf /etc/continuum-local /var/lib/continuum-local` |
| Windows | **Programs and Features** in Control Panel, or `msiexec /x continuum-local-<version>-x64.msi` | Delete `C:\ProgramData\Continuum Local`. |
| Docker | `docker stop continuum-local && docker rm continuum-local` | `docker volume rm continuum-local-state`, and the configuration directory on the host. |
| Kubernetes | `helm uninstall agent` | `kubectl delete pvc agent-continuum-local`, and the Secret you created: `kubectl delete secret continuum-local-config`. |
| Node.js host | Stop the process and delete the `.mjs` file. | Delete `config.json` and the state directory. |

On Linux, the `continuum-local` account stays after both remove and purge.
Delete it with `sudo userdel continuum-local`. Reinstalling after a plain remove
finds the kept configuration and leaves the service disabled until you enable
it. In Kubernetes, `helm uninstall` keeps the PersistentVolumeClaim, and removes
a Secret only when the chart created it from `config`.

To retire an agent completely:

1. Choose **remove from agent** for each credential sent from Blueprintr, while
   the agent is online and connected to the gateway. If it is not, step 3
   removes them.
2. Revoke or delete the agent in Blueprintr.
3. Uninstall it, and remove its configuration and state.