Incident Library
Applied filters SymptomCluster or node provisioning stallFactorIgnored early signalClear allEvery case under the filters, with no sentence; newest first.
Suggested filters Search, and the values found in your words appear here.

Graph

  • Root cause
  • Component
  • Symptom
  • Contributing factor
  • Case

Cases1 case

1 to 1 of 1

  1. IL-0529 New Google Cloud VMs and other instances came up without network connectivity in all zones after VPC controllers stopped
    Google Cloud2024
    Symptoms

    From 15:22 US/Pacific on 16 May 2024, new VMs and other new instances across Google Cloud came up without network programming, so the new instances could not open network connections, and VMs that were migrated or restarted lost connectivity. Changes to virtual network configuration, such as firewall rules and load balancers, were not applied. Internal monitoring alerted Google engineers at 15:41.

    Network unreachablePacket lossCluster or node provisioning stallScale-up failureHigh error rate
    Trigger

    Google's infrastructure team ran a routine maintenance action meant to shut down one unused VPC Controller in a single Google Cloud zone, and the automation shut down VPC controllers in all zones where the controllers were still in use.

    Root cause
    Software defect
    Component
    Network control plane (SDN)Cloud load balancerNAT gateway
    Contributing factor
    Change with a delayed effectIgnored early signalNo safeguard on destructive changeExcessive blast radius
    Detection

    Internal monitoring alerts reached Google engineers at 15:41 US/Pacific, and the investigation started immediately.

    Remediation
    • Paused maintenance operations to prevent the shutdown from repeating
    • Brought the affected VPC Controllers back into a serving state in every zone
    • Stopped the automation responsible for the shutdown until safeguards are in place
    • Recovered partial Apigee proxy deployments by hand
    • Cleaned up VMs left behind by failed Dataproc cluster deletions
    Action items
    • Add safety measures that check that maintenance operations carry correctly scoped zone information
    • Make the underlying tools reject maintenance operations that do not specify zones
    • Tighten on-demand access control so one maintenance invocation cannot work across multiple zones
    • Add safety checks, testing and validation for maintenance operations, including positive and negative test cases for the new safety measures
    View case
Check your cluster for this

This case involves Cloud load balancer and NAT gateway. kubegap audits a Kubernetes cluster for gaps like these, read-only, from Claude Code or Codex; its checks cite public reports like the ones in this library.

Open kubegap

By root cause1

Software defect1 case

Component
Cloud load balancerNAT gatewayNetwork control plane (SDN)
Contributing factor
Excessive blast radiusChange with a delayed effectIgnored early signalNo safeguard on destructive change
Organisation
Google Cloud
  1. IL-0529 New Google Cloud VMs and other instances came up without network connectivity in all zones after VPC controllers stopped
    Google Cloud2024