Yandex Cloud Cascade Failure October 2026 Exposes Multi-AZ Limits and Capacity Exhaustion Risks

In October 2026, Yandex Cloud suffered a prolonged cascade outage across multiple data centers in Sасово, Калуга, and Владимир, triggered by power failures and a drone-related fire that fully disabled the ru-central1-b zone. The incident revealed that standard Multi-AZ designs reach physical capacity exhaustion when multiple zones fail simultaneously, leaving insufficient resources in remaining zones for automatic failover. Businesses relying on managed Kubernetes, databases, and SaaS platforms such as Salebot and CIAN experienced extended recovery times, with backups becoming inaccessible and RTO stretching beyond 24 hours due to index rebuilds and manual quota allocation. Yandex Cloud responded by manually distributing quotas, partnering with Selectel, K2Cloud, and VK Cloud for emergency capacity, and advising clients to activate external disaster recovery plans. The outage also highlighted single points of failure in DDoS protection configurations and Control Plane dependencies that prevented timely migration of master nodes. Architectural recommendations include deploying independent edge webhook buffers using FastAPI on separate VDS instances to preserve incoming events during primary backend failures. Overall, the events underscore the necessity of true multi-cloud strategies that avoid reliance on any single provider's IAM, billing, and physical infrastructure.

HabrTranslated from Russian

Read at source

In October 2026, Yandex Cloud experienced a major cascade failure spanning data centers in Sasovo, Kaluga, and Vladimir, demonstrating the physical limits of Multi-AZ resilience when multiple zones suffer simultaneous outages.

The events began on 8 October at 01:31 MSK in zone ru-central1-b (incident 2092) with power disruptions. By 15:19 MSK, Yandex Cloud confirmed a fire caused by a drone attack that completely halted the Sasovo facility. Clients were advised to migrate workloads, yet new virtual machines, Managed Kubernetes clusters, and databases could not be created in remaining zones due to emerging capacity constraints.

At 15:30 MSK the same day, an unrelated configuration error during planned maintenance in the Curator DDoS protection service degraded access for 34 minutes to major Russian media and fintech platforms including RBK, Kommersant, Vedomosti, Interfax, T-Bank, and Avito.

On 9 October, damage was reported at the Kaluga site. Yandex Cloud arranged emergency resource placement with external providers Selectel, K2Cloud, and VK Cloud. Control Plane components for regional Kubernetes clusters could only be moved out of the affected zone after approximately 36 hours.

By 10 October, quota allocation shifted to fully manual mode, freezing automatic scaling and giving priority to critical workloads. On 11 October at 04:00 MSK, power failures struck zone ru-central1-a (incident 2136) in Vladimir, leading to another full site shutdown and an official warning that remaining capacity no longer guaranteed availability.

At 07:13 MSK on 11 October, compute resources remained available only in zones ru-central1-d and ru-central1-e. Many database clusters switched to read-only or became unavailable, while object storage allowed reads but not writes. Several Kubernetes clusters lost manageability because their control planes resided in failed zones.

Services such as Yandex Go, Yandex Eda, Yandex Pay, and Yandex 360 were impacted, along with the state VetIS system. The SaaS platform Salebot lost access to client projects and weekly backups, forcing a rollback to 4 October data and requiring more than 24 hours to rebuild indexes after restoring only six of 40 servers.

The outage illustrated that Multi-AZ architectures fail when surviving zones lack sufficient physical capacity, a condition known as Capacity Exhaustion. Additional risks included Control Plane dependency, manual quota limits blocking automated recovery, and simultaneous demand from multiple customers overwhelming alternative providers.

To mitigate such risks, the analysis recommends separating ingress buffers from primary backends. A lightweight FastAPI service deployed on an independent VDS can accept webhooks, validate tokens via constant-time comparison, and durably append events to a local JSONL queue using fsync before returning 200 OK responses.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users
Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts
Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria