I just learned that ezjail-admin does not update /etc and /var during the freebsd-update invoked. Although I do have code that can do this, it somehow never found the way into ezjail, I guess this was because it always caused hours of resolving merge conflicts with only the CVS-IDs in rc.d-scripts and I never got around fixing that.
I guess you call mergemaster for that? This is the line I use for that (scraped together from bits here and there on this list, thanks guys!):
IGNORE_FILES='/boot/device.hints /etc/motd /root/.cshrc /root/.k5login /root/.login /root/.profile' mergemaster -iUF -D /usr/jails/jail
It ignores some files that always give me trouble and are not so important. But more importantly, the switches "-iUF" cut down A LOT on unneeded manual merges :)
I have used this (in a loop even, to quickly run through all jails) many times, I think I went from 6.x to 8.x with this on a couple of jails. Might just about call it "tried and tested" :)
Mind you, you still need to do some manual merges. And getting the hang of mergemaster and it's diff and patch tool is needed to be able to do it quickly.
Met vriendelijke scouts- en gidsengroeten,