Skip to content

CONCEPT Cited by 2 sources

Global configuration system

A fleet-wide configuration-delivery channel where a single edit propagates to every server in the fleet within seconds, with no canary, no staged rollout, no per-POP health gating.

Cloudflare uses the term explicitly in its 2025-12-05 post-mortem and implicitly in 2025-11-18 (the Bot Management feature-file distribution queue has the same structural property).

Why it exists

Rapid threat response requires the ability to push configuration changes to the whole fleet in seconds — DDoS mitigations, malicious-IP blacklists, bot signatures, WAF rules for zero-day CVEs. A canary rollout that takes hours defeats the point of threat response.

The trade-off: rapid reach = rapid blast radius. One bad push reaches the entire fleet just as fast as one good push.

Hazard profile

A global configuration system is a single surface where any of the following produces a fleet-wide incident:

  • Bad payload. Oversized / malformed / out-of-range values that downstream consumers cannot safely load.
  • Latent dormant code. A value that exercises a code path never before triggered in production (see concepts/latent-misconfiguration).
  • Dependency-graph surprise. A value whose downstream effect crosses module or team boundaries in unexpected ways.

Canonical Cloudflare instances

The 12-05 post states the global configuration system was "under review following the outage we experienced on November 18" — review was in progress but not complete when the same system delivered the 12-05 trigger.

Remediation stance

The structural fix is not to slow down threat-response delivery — that defeats the point. It is:

Seen in

Last updated · 200 distilled / 1,178 read