One of the truly awesome things about ACI, that might be a little underappreciated, is the fact that you can manage firmware versions for all of the physical underlay (meaning all the Nexus 9000 switches) as well as for the Application Policy Infrastructure Controller. From a central place you can see which versions everything is on (they should all be on the same firmware version, by the way).
You can also manage the upgrade when it comes time for that. In ACI you can create maintenance groups and put some of the switches in one maintenance group and some in the other and only upgrade one maintenance group at a time. This ensures your network is still up 100% of the time during the upgrade…as long as you set up your maintenance groups properly, of course. Of course, upgrading the controller will also upgrade the features that come with new versions of ACI. So again, we’re back to only managing one network from one place!