Patch Rings for staged update deployment
Summary
Introduce a Patch Rings feature that allows administrators to define and manage multiple update deployment stages (rings) for controlled, phased rollout of patches across systems.
Problem statement
Currently, patches are deployed uniformly to all assigned hosts. This increases operational risk, as updates cannot be validated on a small subset of systems before wider deployment. In enterprise environments, administrators require a reliable way to test updates first and reduce the blast radius of faulty patches.
Proposed solution
Implement Patch Rings, enabling administrators to create multiple deployment stages with configurable rollout logic. Each system or host group can be assigned to a specific patch ring. Updates are deployed progressively from lower-risk rings to higher-impact production systems.
Functional requirements
- Ability to create and manage multiple patch rings, e.g. Ring 0 – Test / Lab, Ring 1 – Pilot / Early Adopters, Ring 2 – Production
- Assign individual hosts or host groups to a specific patch ring
- Configure deployment delay per ring (e.g. deploy to Ring 1 after X days)
- Optional manual approval before promotion to the next ring
- Clear visibility in the UI showing ring assignment per host, update status per ring, and pending/completed deployments
- Ring-aware patch execution for both Linux and Windows systems
Optional enhancements
- Ability to pause or halt rollout across all higher rings
- Integration with existing host groups and policies
- Notifications or alerts if a patch fails in an early ring
- Audit log of patch progression between rings (useful for compliance)
Business value
- Reduces risk of widespread outages caused by faulty updates
- Enables safer, enterprise-grade patch management
- Aligns PatchMon with best practices used in large IT environments
- Improves trust and adoption for production-critical systems
Originally requested by venom_39393 in Discord #ideas.
I had a DM chat with @user about this a few weeks ago. I'm totally with you on this. One customer I worked was a hospital, so phased rollouts were very carefully planned, monitored and deployed with several rings, like 3-4 early adopters and several for production - don't hit all servers and especially PCs all at once. I'm wondering if something like n8n may help with this.