IL-0547 Buildkite · 2025-11-10database
Buildkite annotation queries timed out and drove database CPU up across shards after a migration removed an index
At 04:48 UTC on 10 November 2025 Buildkite applied a database migration that removed an index on the annotations table of its Pipelines product. Another index was already in place to replace it, but a small number of high-traffic queries did not use the new index as expected. From 04:53 UTC those queries timed out, the agent command that creates annotations was behind many of them, and the CPU load they put on the affected PostgreSQL databases degraded every Pipelines feature. Migrations at Buildkite apply to all shards at the same time.
The team began recreating the removed index at once and finished it on about half of the shards by 05:30 UTC, which partly restored service. On the remaining shards the query load prevented efficient index creation. The team split up to try several ways of reducing that load: disabling annotations in the product, sending new annotations to a separate table, and blocking the table through table-level permissions. Temporarily revoking the application user's read and write permissions on the annotations table, together with raising max_parallel_maintenance_workers in Postgres, made index creation much faster, and between 07:50 and 08:43 UTC the index was rebuilt on the remaining shards, after which latency and error rates were back to normal.
Some agents and jobs were left in an inconsistent state. Where the system could not heal itself, engineers freed the agents and cleaned up job states by hand, which was finished by 11:56 UTC. Buildkite said the migration had exposed gaps in its review process.
- Severity
- –
- Scope
- Agent API severely degraded for most customers from 04:48 to 05:30 UTC and for some until 08:43 UTC; REST API, GraphQL and Web UI degraded from 04:48 to 08:43 UTC; some agents and jobs left inconsistent until 11:56 UTC
- Users affected
- Most Buildkite customers
- Region
- –
- Time to detect
- 5m
- Time to resolve
- 3h 55m
Symptoms
From 04:48 UTC on 10 November 2025, queries on the table that stores annotations in Buildkite Pipelines timed out, CPU load on the affected databases rose sharply, and the Agent API, the REST API, GraphQL and the Web UI slowed down and returned more errors.
Many of the timed-out queries came from the agent command that creates a new annotation. The status page first reported problems displaying build annotations, then increased error rates and slow performance on the REST and GraphQL APIs and the Web UI. The Agent API was severely degraded for most customers until 05:30 UTC and for some remaining customers until 08:43 UTC, and the REST API and GraphQL were degraded from 04:48 until 08:43 UTC.
Recreating the removed index restored about half of the database shards by 05:30 UTC. On the other shards the ongoing load from annotation queries kept the index from being rebuilt efficiently, so recovery there stalled until that load was cut off.
Symptom Intermittent timeoutsDatabase overloadHigh error rateHigh latency
Root cause
Root cause Faulty deployment
- Trigger
- At 04:48 UTC a database migration removed an index on the annotations table of the Pipelines product.
Detection
At 04:53 UTC the impact of the removed index was detected as queries timing out on the annotations table.
Remediation
- Recreated the removed index, finishing on about half of the database shards by 05:30 UTC
- Temporarily revoked the application user's permission to read from and write to the annotations table
- Increased max_parallel_maintenance_workers in Postgres to speed up index creation
- Finished recreating the index on the remaining shards between 07:50 and 08:43 UTC
- Freed the agents and cleaned up the job states left inconsistent, handling by hand the cases the system could not self-heal, by 11:56 UTC
Action items
- Extend the internal tooling that flags risky migrations in code review to cover index removals and ask engineers to verify an index is no longer needed
- Roll out high-risk migrations to shards in phases instead of to all shards at once
- Evaluate tools such as HypoPG to analyse index creation and removal
- Show index usage data from pganalyze more prominently in the development workflow
- Automate the manual cleanup of inconsistent agent states so the system can heal itself
Lessons
Buildkite said the incident was mainly caused by a database migration that exposed gaps in its review process.
Sources
- https://www.buildkitestatus.com/incidents/sv6phcn6xwwg · official-status · archived copy
Related cases
IL-0356Every domain hosted on Railway returned HTTP 404 to new connections for five minutes because route lookups failedRailway · 2026same root cause · shared Database
IL-0136A deployment that cleared an internal service's caches at peak traffic sent 20 times the normal load to the Azure OpenAI metadata backend in Sweden Central, and health checks that depended on its database restarted instances in a loop for almost six hoursMicrosoft Azure · 2026same root cause · shared Database
IL-0570Dropping an unused MySQL table stalled queries on its busy parent table and crowdworks.jp was hard to reach for a minuteCrowdWorks · 2026same root cause · shared Database
IL-0510MIT Learn's RDS PostgreSQL ran out of storage after a release and learn.mit.edu returned 503s and 504s for hoursMIT Open Learning · 2026same root cause · shared Database
IL-0380A compaction change in InfluxDB Cloud us-east-1 dropped data from compacted files, and queries missed data for weeksInfluxData · 2026same root cause · shared Database
IL-0369Railway's backend API went down when a column migration waited on locks and replicas could not get database connectionsRailway · 2025same root cause · shared Database
IL-0315Railway's backend API went down when an index build locked a billion-row Postgres table and used up every connectionRailway · 2025same root cause · shared Database
IL-0327After a blue/green upgrade of CircleCI's workflows database every query hit disk, and workflow starts lagged or failedCircleCI · 2025same root cause · shared Database
IL-0324Three MediaWiki deployments lost Memcached after a PHP 8.1 rollout and overloaded the External Storage database clusterWikimedia Foundation · 2025same root cause · shared Database
IL-0307Supabase's Postgres connection pooler Supavisor 2.0 dropped connections for about 80% of us-east-1 tenantsSupabase · 2025same root cause · shared Database
IL-0552CircleCI's archival database ran out of storage, slowing workflow and job starts and the display of workflows in the UICircleCI · 2025same root cause · shared Database
IL-0554A database migration used up Sentry US's Postgres connections, and the site and event ingestion were down for 22 minutesSentry · 2024same root cause · shared Database
IL-0571STORES reservation returned bursts of 504 errors when a smart-list query held a database process for over 20 minutesSTORES · 2024same root cause · shared Database
IL-0293Cloud Bigtable in us-central1 had higher latency and connection errors for about 32 hours from low-rate packet lossGoogle Cloud · 2023same root cause · shared Database
IL-0523TANF-app production deployments were blocked for two months when a search-index migration ran out of database disk spaceU.S. Department of Health and Human Services · 2023same root cause · shared Database
IL-0567Aurora MySQL behind Cookie Run: OvenBreak hit 100% CPU after a sales-ranking feature launch, and players could not playDevsisters · 2023same root cause · shared Database
IL-0483Replicate's website and API returned slow responses and HTTP 500s for two hours as PostgreSQL connections ran outReplicate · 2023same root cause · shared Database
IL-0371Half of new connections to Render Postgres databases with point-in-time recovery failed while their backup jobs ranRender · 2023same root cause · shared Database
IL-0524An index migration locked Open Collective's whole Transactions table and degraded the service for nearly an hourOpen Collective · 2023same root cause · shared Database
IL-0328A field type change in the database of CircleCI's job distribution service left all jobs stuck in "not running"CircleCI · 2021same root cause · shared Database
IL-0566Hot ranges after a Cookie Run: Kingdom guild update drove CockroachDB nodes to 100% CPU, forcing emergency maintenanceDevsisters · 2021same root cause · shared Database
IL-0391GoCardless API requests timed out for about 15 seconds while a Postgres migration waited for an AccessExclusive lockGoCardless · 2015same root cause · shared Database
Check your cluster for this
For AI tools and scripts
- This case as JSON: https://incidentlib-api.benchlet.com/cases/IL-0547
- The cases most like it: https://incidentlib-api.benchlet.com/cases/IL-0547/similar
- MCP server (Streamable HTTP, no key):
https://incidentlib-mcp.benchlet.com/mcp
The API needs no key. The MCP server offers search_incidents, get_incident, list_incidents, get_topic and vocab; both are explained on API and MCP.