3 ms·
It's exciting to see that Kubernetes is ready for basically any scale. You're more likely to run out of quota (on your cloud provider, particularly IPs) or som
by boulos 11y ago
It's exciting to see that Kubernetes is ready for basically any scale. You're more likely to run out of quota (on your cloud provider, particularly IPs) or some other resource (on-prem) before you can't schedule a container quickly enough.
Disclaimer: I work on Compute Engine and chat with the Kubernetes folks a lot.
- tzaman 11y agoThat resource being money. I'm deploying a fairly simple app on GKE and things go out of hand quickly due to confusing pricing. Or maybe I just don't where to look.
- TheIronYuppie 11y agoDisclaimer: I work at Google on Kubernetes. Can you say more? Did you just spin up too many nodes?
- vetinari 11y agoI would say that there's impedance mismatch between GKE pricing and unclear requirements, how much resources in what structure you will need. I was looking at the Kubernetes tutorials and couldn't even start to figure out, how much would it cost to run them. (Well, I didn't try too hard, it wasn't that important.)
- oldmanjay 11y agoYou probably meant to disclose that information, not disclaim it. I suppose this is one of those cases like "literally" where persistent misuse will cause the word to be its own opposite, but I keep fighting the annoying fight anyway.
- boulos 11y agoIn this case, I meant both (so I chose Disclaimer). The full combo is: I work on Compute Engine (Disclosure!), but I don't actually work on Kubernetes (Disclaimer!) though I do hang out with them (both?).
- oldmanjay 11y agoFair enough! People certainly seem to do a lot of disclaiming of their credentials these days so I guess everyone is getting the picture anyway.
- zurn 11y agoIt's hard to understand why so many cloud service providers and software stacks are still v4-only considering the operational and development cost of v4+NAT (complexity, management, scaling limitations etc). For most systems it would be enough for the front load balancers to speak v4.
- endymi0n 11y agoFunny, I see it exactly the other way around. I want NAT+Firewall to have at least decent perimeter security in a private LAN, the 10/8 subnet is large enough to do anything I can ever imagine to be doing and IPv4 is so much easier to grok. For most systems it would be enough for the front load balancers to speak v6.
- kiallmacinnes 11y agoWanting a firewall is good, you can have that on v4 or v6. However, after you add 3 simple firewall rules, NAT provides no additional security. Drop state=INVALID Allow state=EATABLISHED,RELATED Drop all You're now just as secure as if you had a typical NAT setup, but without the decades of kludges that is NAT.
- zurn 11y agoThen you just have a system that has no security advantages but is harder to reason about due to the additional level of indirection in overloaded addressing (because of ambiguous addressing, management of forwarding rules, etc) vs normal firewalling without NAT. Which equates to some loss of security on the system level, because you can only effectively secure systems you understand.