tare manage upgrade

Upgrade an existing Agent Router management-plane release.

Refuses to fresh-install (use 'tare manage install' for that). Reads the live
release's Helm values so operator config (database URL, secrets, corporate
login, image repositories, …) carries forward — pass flags to override
individually, e.g. --image-tag to move to a new version.

Defaults to helm upgrade --atomic so a failed rollout auto-rolls back to the
previous revision. Pass --no-atomic to leave a stuck release in place for
debugging.

Env overlays supplied via --values at install time (e.g. local KMS/berglas
settings) are NOT carried forward automatically — re-pass --values on upgrade.

Examples:
  # Move the management plane to a new image tag
  tare manage upgrade --customer acme --image-tag v1.3.0 --chart-version v0.2.0

  # Preview the merged upgrade values without applying
  tare manage upgrade --customer acme --print-helm-values

Usage:
  tare manage upgrade [flags]

Flags:
      --admin-key string                    global.adminKey.
      --api-image-repository string         Override api.image.repository (e.g. "valet") so --image-registry does not double-prefix the api image.
      --api-key string                      global.apiKey.
      --api-key-secret string               global.apiKeySecret.
      --app-image-repository string         Override app.image.repository (e.g. "app") for mirrored registries.
      --auth-image-repository string        Override auth.image.repository (e.g. "auth") for mirrored registries.
      --auth-secret string                  global.auth.secret.
      --chart-no-cache                      Bypass the ~/.tare/charts cache when fetching --chart-version.
      --chart-path string                   Local path or oci:// reference to the manage-helm chart. Overrides --chart-version.
      --chart-registry string               OCI registry for --chart-version (default: registry.tetrate.ai, or --image-registry when set).
      --chart-version string                manage-helm chart version to fetch from --chart-registry. Required unless --chart-path is a local path.
      --corporate-admin-email string        global.corporate.adminEmail (chart-mandated). Required.
      --corporate-email-domains string      global.corporate.emailDomains, comma-separated (chart-mandated). Required.
      --corporate-login-enabled             global.corporateLoginEnabled: corporate SSO gate. Default true (enterprise); --deployment-mode saas turns it off. (default true)
      --cron-secret string                  global.cronSecret (OAuth-refresh CronJob auth).
      --customer string                     Organization (customer) identifier (drives namespace names and service domains). Required (defaults to "saas" with --deployment-mode saas).
      --dashboard-image-repository string   Override dashboard.image.repository (e.g. "dashboard") for mirrored registries.
      --database-url string                 PostgreSQL connection string for the management plane. Required.
      --deployment-mode string              Deployment mode: enterprise or saas. saas defaults --customer to "saas" (the chart derives DEPLOYMENT_PRODUCT + public domains from customer=="saas") and turns corporate login off. (default "enterprise")
      --enable-archival                     Enable the request-log archival CronJob (archival.enabled; SaaS-only, needs a GCS bucket + workload identity via --values).
      --environment string                  Deployment environment (empty = production); selects the service-domain suffix.
      --gcp-project-id string               global.gcpProjectId (archival/usage-rollup + secret-manager valet).
      --hmac-key-secret string              global.hmacKeySecret.
      --image-registry string               Registry for management-plane images (global.imageRegistry).
      --image-tag string                    Tag for management-plane images (global.imageTag; also applied to auth/dashboard tags).
      --namespace string                    Helm release namespace (default: tars-release-{customer}).
      --no-atomic                           Do not use helm --atomic; leave a failed upgrade in place for debugging instead of auto-rolling back.
      --no-bootstrap                        Disable the bootstrapper subchart (skip DB migrate + seed). The DB must already be migrated.
      --playground-key string               global.playgroundKey.
      --print-helm-values                   Print the merged upgrade values (after carry-forward) and exit without upgrading.
      --release-name string                 Helm release name (default: tars-{customer}).
      --secret-manager-type string          global.env.common.SECRET_MANAGER_TYPE. Default "none" (keys passed as plaintext flags); set to "valet" only when keys are secret-manager refs. (default "none")
      --serve-url string                    Data plane URL (global.serveUrl). Optional; chart computes proxy.{customer}.… when empty.
      --skip-preflight                      Skip Helm/kubectl/cluster preflight checks (also TARE_SKIP_PREFLIGHT=1).
      --timeout string                      Timeout for the helm upgrade wait and the bootstrapper hook. (default "10m")
      --values string                       Extra Helm values file merged after the generated values (-f). Re-supply any env overlay used at install time.

Global Flags:
  -q, --quiet     Suppress progress output; only errors and the final summary go to stderr
  -v, --verbose   Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr