Incident Library
Applied filters ComponentSecrets storeSymptomCredentials unavailableFactorChange with a delayed effectClear allEvery case under the filters, with no sentence; newest first.
Suggested filters Search, and the values found in your words appear here.

Graph

  • Root cause
  • Component
  • Symptom
  • Contributing factor
  • Case

Cases1 case

1 to 1 of 1

  1. IL-0511 MIT xPro stopped responding after a configuration deploy as pgbouncer logins to RDS failed with 'wrong password type'
    MIT Open Learning2023
    Symptoms

    On 30 October 2023 at 3:51PM, six minutes after a configuration update was deployed to the xPro production Heroku stack, Pingdom alerted the DevOps on-call engineer, who confirmed at 3:52PM that the site was not responding.

    Service outageCredentials unavailable
    Trigger

    A configuration update applied through Salt at 3:45PM found that the Vault lease of the database credentials was about to expire and could not be renewed, so Vault generated new credentials.

    Root cause
    Configuration change
    Component
    DatabaseSecrets store
    Contributing factor
    Unreviewed defaultsChange with a delayed effectConfiguration not in code
    Detection

    Pingdom alerted the DevOps on-call engineer at 3:51PM, and the alert went through OpsGenie; Pingdom closed it automatically at 4:25PM.

    Remediation
    • Created a new database parameter group and applied it to the running RDS instance
    • Cleared the cached credentials and re-applied the Heroku configuration through Salt
    Action items
    • Move the management of xPro resources, including the RDS instance, into Pulumi, where AWS default parameter groups are not used
    Lessons

    Almost none of the configuration for this stack, the RDS instance in particular, was managed as code, and that was one of the main reasons the fix took long. Under Pulumi the instance would not have used an AWS default parameter group, and the fix would have been a change to an attached group.

    View case
Check your cluster for this

This case involves Database and Secrets store. kubegap audits a Kubernetes cluster for gaps like these, read-only, from Claude Code or Codex; its checks cite public reports like the ones in this library.

Open kubegap

By root cause1

Configuration change1 case

Component
DatabaseSecrets store
Contributing factor
Configuration not in codeUnreviewed defaultsChange with a delayed effect
Organisation
MIT Open Learning
  1. IL-0511 MIT xPro stopped responding after a configuration deploy as pgbouncer logins to RDS failed with 'wrong password type'
    MIT Open Learning2023