Safety nets

Before you start

• Staging of express-checkout is deployed, and the policy Release approvals exists.
• The flag holiday-banner exists and is not deployed anywhere. The terminal from Automation and CI still has gate.sh and its three variables: FLUXGATE_URL, FLUXGATE_TOKEN and FLUXGATE_ENVIRONMENT_ID.
• Start as priya Requester, then use sam Approver and admin System admin as each step says. Select the team Checkout.

Four safety nets

An approval stops a bad change before it ships. These four tools limit the damage when something slips through, or when you need to hold all change for a while.

Freeze windows

A freeze window blocks changes to the stages of one environment between a start and an end time, for example a holiday trading peak. A request for a stage change in that environment fails while the window is active, with the message Change blocked by active freeze window 'Holiday freeze'. An evaluation is not a change, so your app keeps serving flags as before.

On a stage, the Change Freeze card shows Frozen and names the window. An admin or a Team Admin can override it with a recorded Override Reason. For everyone else, the card says an admin has to override.

The kill switch

Emergency Disable turns a live flag off at once, without a request. It has three properties that matter in an incident:

• It creates no approval request, so a slow approver cannot delay it.
• A freeze window does not block it.
• It needs a Reason of at least five characters, which the flag then shows on its row.

Emergency Enable reverses it. Every kill switch use is recorded as a version.

Scheduled changes

A scheduled change runs one action, Disable feature, enable or archive, at a time you pick. It waits as Pending. A pending change can be cancelled, and then nothing runs. A reason is required.

Version history and rollback

Every update of a flag is a version. These actions create one: an Update Feature save, each emergency disable and enable (tag Kill switch), a stage criteria save and a rollback. Creating a feature or changing a stage does not. Select a version to see its diff against the previous one, with Before and After panes. Rollback restores the selected version, and the rollback becomes a version too.

How the safety nets and approvals interact

Make the flag live

To watch a kill switch work, the flag has to be live. holiday-banner has never been deployed, so run the loop from Approvals and policies for its Development stage.

Run the gate from the previous page. It exits with 0:

bash gate.sh; echo $?

banner on
0

Create a freeze window

The window blocks a request for the frozen environment. Here priya asks for a Production deployment of holiday-banner while the window is active. The API answers with a 403 and this body:

{"error":"forbidden","message":"Change blocked by active freeze window 'Holiday freeze'","code":null,"details":null}

In the UI, the toast reads "Failed to change stage" with the same message under it. A request that is already approved is blocked too: while a window covers its environment, Execute Rollback on an approved rollback fails with that toast. End the window, and the action works.

Use the kill switch

When your own flag is not deployed, the kill switch has nothing live to override. That is why you made holiday-banner live first.

End the freeze window

(opens full size in a new tab) (opens full size in a new tab)

With the window inactive, nothing blocks the stage changes of the next steps.

Schedule a change and cancel it

Version history and rollback

(opens full size in a new tab) (opens full size in a new tab)

Examples

The CI gate during a freeze

This is the gate from Automation and CI while Holiday freeze is active, then after the kill switch, then after the enable. The gate reads Development while the freeze covers Production, so the freeze cannot change the result. The point is that the kill switch works regardless of the freeze.

bash gate.sh; echo $?

banner on
0

bash gate.sh; echo $?

banner off
10

bash gate.sh; echo $?

banner on
0

The versions of holiday-banner

The numbers can differ when you edited the flag earlier.

Good to know

• Freeze Windows under Govern needs an admin or a Team Admin. So do creating, disabling and deleting a window, Emergency Disable, Emergency Enable and Update Feature.
• Scope lists each environment by name, then the choices All Development, All Staging and All Production. The table prints the first eight characters of the environment id in the Scope column, for example dc44a99a, and shows both dates in your browser locale.
• The row buttons on the freeze window are Disable or Enable, and Delete. Disable keeps the window.
• Disable timing also offers Schedule disable, and an optional Expiry restores the flag after that time.
• The emergency dialog accepts a Reason of 5 to 500 characters.
• A rollback restores everything stored in the version, including stage statuses. Roll back to a version taken after the Development deployment, so Development stays deployed.
• The rollback asks the browser to confirm, with a dialog such as "Rollback feature to version 2?". The dialog names no details. Check the version you selected before you click.
• After you switch users, reload the page if the team selector looks stale.

Troubleshooting

The freeze window shows "Starts in 15 minutes"

The default start is 15 minutes from now, so the window is not active yet. Move Starts a few minutes into the past, or wait.

The emergency dialog says "Approval required"

The banner is a preview that does not apply. The kill switch runs at once and records no request.

Next

Connect Jira so that a ticket status change drives a release in Jira setup.