I just wanted to add a quick note that slaves must be set to point to /var/cache/bin in /etc/bind/named.conf.local or else apparmor will break the updating.