Release deferral
Ping Identity defers regular channel releases to your production tenant environments for up to 7 days. This gives you the opportunity to test and validate new regular channel releases in your lower environments (development, UAT[1], and staging) using your most up-to-date configuration.
Each scheduled major release is deferred. The deferral period has the following characteristics:
-
It begins when the major release is deployed to your lower environments.
-
It ends 7 days later, or sooner if you choose.
-
It isn’t extended for minor version updates (for example,
15158.1to15158.2). These incremental updates are part of the same scheduled major release and don’t restart the deferral period.
Production upgrade options
After your lower environments are upgraded, the 7-day deferral period begins. You have several options for managing the upgrade to production during this period:
-
Automatic upgrade: At the end of the 7-day period, your production environment is automatically upgraded at your preferred UTC upgrade time. If you haven’t set a preferred upgrade time, the upgrade takes place at the same UTC time that your lower environments were upgraded.
You can set or change your preferred upgrade time to align future upgrades with your maintenance or change window by creating a support case.
-
Upgrade when you’re ready: If you complete your testing before the end of the 7-day period, you can upgrade production by running a promotion from your staging environment to your production environment.
The deployment of the release upgrade to your production environment is triggered by the first promotion to that environment during the 7-day deferral period. This means that you must pause promotions to your production environment until you have validated the new release in your lower environments.
-
Support-assisted options:
-
Upgrade without a promotion: Apply the release upgrade to your production environment without promoting any changes from staging. To do this, create a support case in the Ping Identity Support Portal to request an upgrade.
-
Promote without an upgrade: Promote configuration changes to production but wait to apply the release upgrade. To do this, create a support case in the Ping Identity Support Portal to request the configuration promotion. This option is only available if the configuration changes you’re promoting are compatible with the release version currently in your production environment.
Learn more about configuration promotion and version compatibility
If your changes were made after your staging environment was upgraded, they might depend on the new release and can’t be promoted without also upgrading production.
Scenario 1: Compatible changesYou made configuration changes before your staging environment was upgraded to the new release.
The changes can be promoted to production without the release upgrade because they’re compatible with the older version.
Scenario 2: Incompatible changesYou made configuration changes after your staging environment was upgraded.
The changes can’t be promoted to production without the release upgrade because they could depend on features only available in the new version.
Ping Identity doesn’t recommend this approach for normal release management. Promoting configuration without upgrading can result in your production environment containing configuration changes that you can’t replicate or validate in your lower environments while they are running a different release version. This can make testing, troubleshooting, and maintaining consistency between environments more difficult.
-
Track the deferral period
To monitor your 7-day deferral window and prepare for incoming production changes:
-
Track when the deferral window begins:
-
Subscribe to the tenant-specific RSS feed for one of your lower environments (development, UAT[1], or staging). While all lower environments support RSS feeds, you only need to subscribe to one because regular channel releases deploy to them simultaneously.
-
When a release deploys to your lower environments, a new RSS feed item is published. For major releases, this marks the start of your 7-day deferral period. The RSS feed item specifies the new release version and provides a link to the release notes, helping you understand the features, fixes, and changes scheduled to reach your production environment once the deferral window ends.
-
-
Confirm when production is upgraded:
-
Subscribe to the tenant-specific RSS feed for your production environment.
-
Receive confirmation when the new release has been deployed, whether triggered by a promotion or triggered automatically at the end of the 7-day deferral period.
-
For setup instructions for lower and production environments, learn more in View release information in RSS format.
Additional considerations
-
If you’ve recently promoted an upgrade to production on a deferred release, you can roll back both the upgrade and the promotion by creating a support case in the Ping Identity Support Portal.
-
In the rare event that Ping Identity applies a hotfix to the major release while you’re testing it in the lower environments, only the minor version changes, so the 7-day deferral period in your production environment isn’t extended. This ensures that Ping Identity can apply security updates quickly and effectively, without impacting the cadence of scheduled regular channel releases.
Release upgrade schedule
Release deferral changes the schedule that release upgrades follow when they are deployed to your tenant environments. The schedule is also influenced by whether it’s a single-region deployment or a multi-region deployment[2].
Single-region deployment
Single-region deployment is the default deployment option for Advanced Identity Cloud. For this deployment option, the release upgrade schedule is determined only by the 7-day deferral period.
Example upgrade scenario for a single-region deployment
The following example illustrates the upgrade sequence. It assumes the following:
-
A 7-day deferred release period.
-
The current version is 12300.1 and the new version to be deployed is 12345.1.
-
Version 12345.1 becomes available on May 1.
-
You choose not to promote the release manually to production during the deferral period.
| Date | Main region |
|---|---|
May 1 |
|
May 8 |
|
Multi-region deployment
If your tenant instance has a multi-region deployment[2], the release upgrade schedule is determined by both the 7-day deferral period and an additional multi-region delay period.
The primary region environments are upgraded first, according to the deferral period. The secondary region environments are upgraded only after the primary region has successfully completed its upgrade and a multi-region delay period has passed. This ensures that the secondary region only upgrades after the primary region has completed its upgrade, maintaining stability and minimizing risk.
Example upgrade scenario for a multi-region deployment
The following example illustrates the upgrade sequence. It assumes the following:
-
A 7-day deferred release period.
-
A 3-day multi-region delay period between regional upgrades.
-
The current version is 12300.1 and the new version to be deployed is 12345.1.
-
Version 12345.1 becomes available on May 1.
-
You choose not to promote the release manually to the primary region’s production environment during the deferral period. If you did manually promote, it would cause the secondary region’s production upgrade to be scheduled for 3 days after the promotion.
| Date | Primary region | Secondary region |
|---|---|---|
May 1 |
|
|
May 4 |
|
|
May 8 |
|
|
May 11 |
|
|
Set or update your UTC preferred upgrade time
-
Click Create a case.
-
Follow the steps in the case submission wizard by selecting your account and contract and answering questions about your tenant environments.
-
On the Please answer the following questions to help us understand the issue you’re facing page, enter the following details, and then click Next:
Field Value What product family is experiencing the issue?
Select PingOne Advanced Identity Cloud
What specific product is experiencing the issue?
Select Configuration
What version of the product are you using?
Select NA
What Hostname(s) or Tenant ID(s) does this apply to?
Enter the FQDN of your production tenant environment.
-
On the Tell us about the issue page, enter the following details, and then click Next:
Field Value Provide a descriptive title for your issue
Enter
Set or update UTC preferred upgrade timeDescribe the issue below
State the preferred upgrade time you require for your production tenant environment, represented in 24-hour UTC format. For example, for the local time of 7:00 PM PDT, state the time as 02:00 UTC.
-
Click Submit.