Cloudflare ล่ม 12 ก.ย. 2025: React useEffect Bug → Tenant Service 5xx Kubernetes
Back to articles

Cloudflare ล่ม 12 ก.ย. 2025: React useEffect Bug → Tenant Service 5xx Kubernetes

Cloudflare outage 12/9/2025 React useEffect infinite API calls → Tenant Service overload Timeline, Kubernetes metrics, rate limiting, Argo Rollouts fix, code examples

cloudflare Updated: January 9, 2026

Cloudflare ล่ม 12 ก.ย. 2025: React useEffect Bug → Tenant Service API 5xx ทั่วโลก
Cloudflare outage จาก React useEffect hook bug ใน Dashboard เรียก Tenant Service API ซ้ำ → Kubernetes pods overload Global rate limit + Argo Rollouts fix

Root Cause: React useEffect Bug

🐛 Dashboard component:
useEffect(() => {
fetchTenantAPI(); // ❌ Runs on EVERY render
}, []); // Dependency array ignored
✅ Fixed version:
useEffect(() => {
let mounted = true;
fetchTenantAPI().then(data => {
if (mounted) setTenant(data);
});
return () => { mounted = false; };
}, []);
Thundering Herd: 10K+ users hit API simultaneously

Timeline Cloudflare Outage

09:15 UTC: Dashboard deploy (buggy useEffect)
09:22 UTC: Tenant Service CPU 1200%
09:28 UTC: API 5xx errors spike
09:45 UTC: Global rate limit (100 req/min)
10:15 UTC: Scale pods 2x → Still failing
10:30 UTC: Rollback dashboard → Secondary outage
11:12 UTC: Staggered API calls (random delay)
12:05 UTC: Full recovery
Duration: 2 ชม. 50 นาที

Impact: Services & Metrics

ServiceError RateUsers Affected
Tenant Service API99% 5xx500K+
Cloudflare Dashboard95%1M+
Workers KV45%100K
Access Policies78%200K
DownDetector: 850K reports peak

Technical Deep Dive: Kubernetes Overload

Kubernetes Metrics:
- Pods: 50 → 200 (auto-scaling failed)
- CPU: 1200% sustained
- Memory: 95% cluster capacity
- API calls/sec: 50K → 500K spike
Rate Limiting Fix:
// Global rate limiter
const rateLimit = new RateLimiter({
points: 100, // requests
duration: 60, // seconds
});

Cloudflare Response & Mitigation

🔧 09:45: Global rate limit 100/min
⚙️ 10:15: Horizontal Pod Autoscaler 2x
🔄 10:30: Argo Rollout rollback
⏱️ 11:12: Random jitter (100-500ms delay)
📊 11:45: Custom metrics (new vs retry)
Argo Rollouts Config:
strategy:
canary:
steps:
- setWeight: 20
- pause: {duration: 300}

Lessons Learned: Production Best Practices

✅ useEffect cleanup + abort controller
✅ Rate limiting ALL public APIs
✅ Staggered deploys (Argo CD)
✅ Circuit breakers (Istio)
✅ Thundering herd protection

Post-Mortem Action Items

IssueFixTimeline
useEffect bugESLint rules + review✅ Done
No rate limitsGlobal API limits✅ Done
AutoscalingHPA tuning + VPAQ4 2025
MonitoringCustom retry metrics✅ Live
RollbackArgo Rollouts PA✅ Live

Code: The Bug + Production Fix

Buggy Dashboard (React 18):
useEffect(() => {
fetch('/api/tenant').then(setData); // Runs infinitely
}, [userId]); // Missing deps
Fixed Production:
const abortController = useRef();
useEffect(() => {
abortController.current = new AbortController();
fetch('/api/tenant', { signal: abortController.current.signal })
.then(setData)
.catch(err => err.name === 'AbortError' || handleError(err));
return () => abortController.current?.abort();
}, []);
D

DRITESTUDIO

DRITESTUDIO COMPANY LIMITED - Cloud, VPS, Hosting and Colocation provider in Thailand

Manage your cookie settings

We use different types of cookies to optimize your experience on our website. Click on the categories below to learn more and customize your preferences. Note that blocking some types of cookies may impact your experience.

Necessary Cookies

These cookies are essential for the website to function properly. They enable basic functions like page navigation and access to secure areas.

View cookies used
  • Session cookies (session management)
  • Security cookies (CSRF protection)
Always On

Functional Cookies

These cookies enable personalized features like language preferences and theme settings. Without these, some features may not work properly.

View cookies used
  • lang (language preference)
  • theme (dark/light mode)

Analytics Cookies

These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously.

View cookies used
  • _ga (Google Analytics)
  • _gid (Google Analytics)

Marketing Cookies

These cookies are used to track visitors across websites to display relevant advertisements based on your interests.

View cookies used
  • Advertising cookies
  • Remarketing pixels

Privacy Policy