11 ms·

I'm pretty sure this means Kubernetes Ingress on GCP now support WebSockets as well! People have been asking for this feature for a long time, glad it's availab

I'm pretty sure this means Kubernetes Ingress on GCP now support WebSockets as well! People have been asking for this feature for a long time, glad it's available now. (I work on GCP)

numbsafari 10y ago
SNI support would also be really awesome. For certain kinds of traffic, the risks associated with SSL proxying means the HTTP(s) Load Balancer is off limits. Which is a shame, because it's an incredibly power feature compared to AWS offering.
- doubleorseven 10y ago
  Since when AWS is offering SNI on their load balancers? I work at a SaaS company and we were facing the same issue in the cloud and have to implement our own TCP LB's to support SNI. I really hope we will see it in the near future but as i see it, Will I allow my clients to push bytecode into my production machines on demand with the lowest sandboxing possible to provide low execution times? I guess not.
  - tyingq 10y ago
    They don't have SNI, but the newer ALB does have path based routing. So you can use a wild card or multidomain cert, if you can segment routes to endpoints by uri path.
  - manigandham 10y ago
    Usually this is done with a CDN in front. Cloudfront supports SNI.
  - numbsafari 10y ago
    As far as I know it doesn't. I should have been more clear: GCP's Anycast, no-warming-need LB is way cooler than AWS traditional, single-region with totally unreliable DNS "routing" on top (because you always want to rely on client DNS TTLs to handle a service cutover...). The problem is, if you can't use a TLS proxy for security reasons, then you can't use the HTTP(s) LB, which will make you less happy than if you could use it.
    - zimbatm 10y ago
      In what scenarios is GCP's load-balancer not trusted but their compute instance is?
      - numbsafari 10y ago
        When, up until recently, not even Google was willing to cover their own load balancer under their BAA. The load balancer is a shared resource. Your data is being decrypted and re-encrypted in a shared memory space with all other customer's data. Consider the issue CloudFlare customers faced recently [1]. [1] https://techcrunch.com/2017/02/23/major-cloudflare-bug-leaked-sensitive-data-from-customers-websites/ https://techcrunch.com/2017/02/23/major-cloudflare-bug-leake...
        vgt 10y ago
        I am not in compliance, but absence of evidence doesn't imply evidence of absence. Google Cloud has probably industry's highest security standards in place [0] . Getting governing bodies to sign off on their accreditations is a very separate issue. (work on Google Cloud) [0] https://cloud.google.com/security/whitepaper https://cloud.google.com/security/whitepaper
- hosh 10y ago
  Yes, +1 on SNI support. I know there is a feature request on it, and I've already +1 there. We currently use GCP. We have custom domains. As it is, we're looking to schedule time to roll our own multi-az load balancers and using the TCP load balancer because the HTTPS load balancer doesn't support SNI. If SNI were available for HTTPS LB, we'd jump on that in a heartbeat.
  - manigandham 10y ago
    Just use Cloudfront or another CDN in front. This cant be worth the engineering time to build something yourself.
    - stephenr 10y ago
      Load Balancing software is a thing. It exists, waiting for you to install and configure it. For a site called hacker news, its fucking depressing how many people here jump at every possible chance to give up control of the most basic things in their tech stack, for no other reason than "X already runs something similar as SaaS".
      - akanet 10y ago
        I don't think I would be so quick to dismiss this sentiment. I run a profitable SaaS business, and every opportunity to give up responsibility results in highly profitable refocusing of effort on the things we do that actually matter. I'd much rather have a team of Google engineers running our LBs than myself.
        stephenr 10y ago
        This entire thread is about the hoops people are having to jump through to get pretty basic functionality from a load balancer, specifically because they took your approach. I didn't say it can't work for anyone, I said its depressing how it's the default/only approach for so many people who call themselves "hackers".
lihan 10y ago
When to support wildcard domain?
- rdeckard0104 10y ago
  Do you mean wildcard SSL certificates or SNI? You can use wildcard SSL certificates with the GCE load balancer, but it does not have native SNI support. You'd have to roll your own there.
dyngts 10y ago
Can you elaborate more? Is it means that Kubernetes can use internal load balancer? Thanks!

I'm pretty sure this means Kubernetes Ingress on GCP now support WebSockets as well! People have been asking for this feature for a long time, glad it's available now. (I work on GCP)

numbsafari 10y ago

SNI support would also be really awesome. For certain kinds of traffic, the risks associated with SSL proxying means the HTTP(s) Load Balancer is off limits. Which is a shame, because it's an incredibly power feature compared to AWS offering.

doubleorseven 10y ago
Since when AWS is offering SNI on their load balancers? I work at a SaaS company and we were facing the same issue in the cloud and have to implement our own TCP LB's to support SNI. I really hope we will see it in the near future but as i see it, Will I allow my clients to push bytecode into my production machines on demand with the lowest sandboxing possible to provide low execution times? I guess not.
- tyingq 10y ago
  They don't have SNI, but the newer ALB does have path based routing. So you can use a wild card or multidomain cert, if you can segment routes to endpoints by uri path.
- manigandham 10y ago
  Usually this is done with a CDN in front. Cloudfront supports SNI.
- numbsafari 10y ago
  As far as I know it doesn't. I should have been more clear: GCP's Anycast, no-warming-need LB is way cooler than AWS traditional, single-region with totally unreliable DNS "routing" on top (because you always want to rely on client DNS TTLs to handle a service cutover...). The problem is, if you can't use a TLS proxy for security reasons, then you can't use the HTTP(s) LB, which will make you less happy than if you could use it.
  - zimbatm 10y ago
    In what scenarios is GCP's load-balancer not trusted but their compute instance is?
    - numbsafari 10y ago
      When, up until recently, not even Google was willing to cover their own load balancer under their BAA. The load balancer is a shared resource. Your data is being decrypted and re-encrypted in a shared memory space with all other customer's data. Consider the issue CloudFlare customers faced recently [1]. [1] https://techcrunch.com/2017/02/23/major-cloudflare-bug-leaked-sensitive-data-from-customers-websites/ https://techcrunch.com/2017/02/23/major-cloudflare-bug-leake...
      - vgt 10y ago
        I am not in compliance, but absence of evidence doesn't imply evidence of absence. Google Cloud has probably industry's highest security standards in place [0] . Getting governing bodies to sign off on their accreditations is a very separate issue. (work on Google Cloud) [0] https://cloud.google.com/security/whitepaper https://cloud.google.com/security/whitepaper
hosh 10y ago
Yes, +1 on SNI support. I know there is a feature request on it, and I've already +1 there. We currently use GCP. We have custom domains. As it is, we're looking to schedule time to roll our own multi-az load balancers and using the TCP load balancer because the HTTPS load balancer doesn't support SNI. If SNI were available for HTTPS LB, we'd jump on that in a heartbeat.
- manigandham 10y ago
  Just use Cloudfront or another CDN in front. This cant be worth the engineering time to build something yourself.
  - stephenr 10y ago
    Load Balancing software is a thing. It exists, waiting for you to install and configure it. For a site called hacker news, its fucking depressing how many people here jump at every possible chance to give up control of the most basic things in their tech stack, for no other reason than "X already runs something similar as SaaS".
    - akanet 10y ago
      I don't think I would be so quick to dismiss this sentiment. I run a profitable SaaS business, and every opportunity to give up responsibility results in highly profitable refocusing of effort on the things we do that actually matter. I'd much rather have a team of Google engineers running our LBs than myself.
      - stephenr 10y ago
        This entire thread is about the hoops people are having to jump through to get pretty basic functionality from a load balancer, specifically because they took your approach. I didn't say it can't work for anyone, I said its depressing how it's the default/only approach for so many people who call themselves "hackers".

lihan 10y ago

When to support wildcard domain?

rdeckard0104 10y ago
Do you mean wildcard SSL certificates or SNI? You can use wildcard SSL certificates with the GCE load balancer, but it does not have native SNI support. You'd have to roll your own there.

dyngts 10y ago

Can you elaborate more? Is it means that Kubernetes can use internal load balancer? Thanks!