Skip to main content
Deployment window rules define specific time periods when deployments are allowed or blocked. Using RFC 5545 recurrence rules (rrules), you can create flexible schedules like “weekdays 9am-5pm” or “block deployments during maintenance windows.”

​
Overview

​
Why Use Deployment Windows?

Deployment windows help you:
  • Reduce risk - Only deploy during business hours when teams are available
  • Coordinate operations - Block deployments during maintenance windows
  • Meet compliance - Enforce change control windows required by regulations
  • Protect stability - Prevent deployments during high-traffic periods

​
Configuration

Add a deployment window rule to your policy: 
policies:
  - name: business-hours-only
    selectors:
      - environment: environment.name == "production"
    rules:
      - deploymentWindow:
          rrule: "FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR;BYHOUR=9;BYMINUTE=0"
          durationMinutes: 480 # 8 hours (9am-5pm)
          timezone: "America/New_York"
          allowWindow: true

​
Properties

PropertyTypeRequiredDefaultDescription
rrulestringYes-RFC 5545 recurrence rule defining when windows start
durationMinutesintegerYes-Duration of each window in minutes
timezonestringNoUTCIANA timezone for the rrule (e.g., “America/New_York”)
allowWindowbooleanNotrueIf true, deployments only allowed during window. If false, deployments blocked during window

​
Understanding rrules

RFC 5545 recurrence rules define repeating patterns. Common components:
ComponentDescriptionExample
FREQFrequency of recurrenceDAILY, WEEKLY, MONTHLY
BYDAYDays of the weekMO,TU,WE,TH,FR
BYHOURHours of the day (0-23)9 (9am)
BYMINUTEMinutes of the hour0, 30

​
Example rrules

Patternrrule
Weekdays at 9amFREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR;BYHOUR=9;BYMINUTE=0
Daily at 2amFREQ=DAILY;BYHOUR=2;BYMINUTE=0
Every Sunday at midnightFREQ=WEEKLY;BYDAY=SU;BYHOUR=0;BYMINUTE=0
First Monday of monthFREQ=MONTHLY;BYDAY=1MO;BYHOUR=9;BYMINUTE=0

​
Window Types

​
Allow Windows

When allowWindow: true (default), deployments are only allowed during the defined window: 
rules:
  - deploymentWindow:
      rrule: "FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR;BYHOUR=9;BYMINUTE=0"
      durationMinutes: 480
      timezone: "America/New_York"
      allowWindow: true # Deployments only during 9am-5pm weekdays

​
Deny Windows (Blackouts)

When allowWindow: false, deployments are blocked during the defined window: 
rules:
  - deploymentWindow:
      rrule: "FREQ=WEEKLY;BYDAY=SU;BYHOUR=0;BYMINUTE=0"
      durationMinutes: 360
      timezone: "America/New_York"
      allowWindow: false # Block deployments Sunday 12am-6am

​
Common Patterns

​
Business Hours Only

Allow deployments only during business hours: 
policies:
  - name: business-hours-deployments
    selectors:
      - environment: environment.name == "production"
    rules:
      - deploymentWindow:
          rrule: "FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR;BYHOUR=9;BYMINUTE=0"
          durationMinutes: 480
          timezone: "America/New_York"

​
Maintenance Window Blackout

Block deployments during scheduled maintenance: 
policies:
  - name: maintenance-blackout
    selectors:
      - environment: environment.name == "production"
    rules:
      - deploymentWindow:
          rrule: "FREQ=WEEKLY;BYDAY=SU;BYHOUR=2;BYMINUTE=0"
          durationMinutes: 240 # 4-hour maintenance window
          timezone: "UTC"
          allowWindow: false

​
Weekend Freeze

Prevent deployments over weekends: 
policies:
  - name: weekend-freeze
    selectors:
      - environment: environment.name == "production"
    rules:
      - deploymentWindow:
          rrule: "FREQ=WEEKLY;BYDAY=SA;BYHOUR=0;BYMINUTE=0"
          durationMinutes: 2880 # 48 hours (entire weekend)
          timezone: "America/New_York"
          allowWindow: false

​
Late Night Deployments Only

For services that require off-peak deployments: 
policies:
  - name: off-peak-deployments
    selectors:
      - deployment: deployment.metadata.requires_off_peak == "true"
    rules:
      - deploymentWindow:
          rrule: "FREQ=DAILY;BYHOUR=2;BYMINUTE=0"
          durationMinutes: 180 # 2am-5am daily
          timezone: "America/New_York"

​
Multiple Windows

Combine multiple window rules for complex schedules: 
policies:
  # Primary deployment window
  - name: primary-window
    selectors:
      - environment: environment.name == "production"
    rules:
      - deploymentWindow:
          rrule: "FREQ=WEEKLY;BYDAY=TU,WE,TH;BYHOUR=10;BYMINUTE=0"
          durationMinutes: 360
          timezone: "America/New_York"

  # Maintenance blackout
  - name: maintenance-blackout
    selectors:
      - environment: environment.name == "production"
    rules:
      - deploymentWindow:
          rrule: "FREQ=WEEKLY;BYDAY=SU;BYHOUR=0;BYMINUTE=0"
          durationMinutes: 360
          timezone: "America/New_York"
          allowWindow: false

​
Combined with Other Rules

Use deployment windows alongside other policy rules: 
policies:
  - name: production-controlled-release
    selectors:
      - environment: environment.name == "production"
    rules:
      - approval:
          required: 1
      - deploymentWindow:
          rrule: "FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR;BYHOUR=9;BYMINUTE=0"
          durationMinutes: 480
          timezone: "America/New_York"
      - gradualRollout:
          rolloutType: linear
          timeScaleInterval: 300

​
Behavior Details

​
Window Evaluation

  • Deployments are evaluated against the current time
  • If outside an allow window (or inside a deny window), the deployment waits
  • Ctrlplane automatically re-evaluates when the window state changes

​
Gradual Rollout Integration

When combined with gradual rollout rules:
  • Allow windows: Rollout start time is adjusted to the next window opening
  • Deny windows: Individual deployments within a rollout respect the deny period

​
Timezone Handling

  • Always specify a timezone for predictable behavior
  • If omitted, UTC is used
  • Use IANA timezone names (e.g., “America/New_York”, “Europe/London”)

​
Best Practices

​
Environment-Based Windows

EnvironmentWindow TypeNotes
DevelopmentNoneDeploy anytime
QANoneDeploy anytime
StagingOptional business hoursMirror production if desired
ProductionStrict business hoursWhen support is available

​
Recommendations

  • ✅ Use timezones matching your operational team’s location
  • ✅ Account for holidays with deny windows
  • ✅ Provide adequate window duration for rollouts to complete
  • ✅ Combine with approval rules for additional oversight
  • ✅ Test rrule patterns in staging before production
  • ❌ Don’t create windows too narrow for deployments to complete
  • ❌ Don’t forget to account for gradual rollout duration

​
Next Steps