4 ms·

> An untold horror story would be the management & development overhead (and thus cost) associated with it. How do you expect to manage clusters of COTS hardwa

> An untold horror story would be the management & development overhead (and thus cost) associated with it. How do you expect to manage clusters of COTS hardware and VMs communicating through a VPN and supporting version-controlled blue-green deployments without adding any complexity?

Nextgrid 6y ago
You can have two separate machines (whether VMs or bare-metal) plus a load-balancer in front and go blue/green deployments by deploying changes on one machine then redirecting the traffic to it by reconfiguring the LB, and if all good you then update the second machine as well. You do not need a VPN if all your machines are on premises in the same network or within a VPC in case of a cloud provider. In case where you do need a VPN (let's say a hybrid on-prem + cloud architecture) you can have a single VPN gateway (either software like Strongswan on a dedicated machine, or hardware router + whatever AWS's equivalent of that is) bridging the two networks. In a lot of projects though, neither of those things are required at all. Not every project has a threat model requiring VPN'd communications between hosts or multiple environments & seamless deployments (a lot of projects would be fine with taking 10 minutes of downtime out of hours to deploy updates). I'm not saying Kubernetes is bad or should never be used, but just like any tool it should be used for the right task and in some cases the cost, complexity or downsides associated with the tool end up being a net negative. I dislike the current trend that everything should be in containers, Kubernetized, etc where you spend more time on infrastructure than writing the code you're trying to deploy in the first place.
- rumanator 6y ago
  > You can have two separate machines (whether VMs or bare-metal) plus a load-balancer in front and go blue/green deployments Congratulations, you've just added half a dozen moving parts that are untested and require constant maintenance. And you still don't get version-controlled rollbacks. What have you gained by not using Kubernetes? I see only losses. > You do not need a VPN if all your machines are on premises That assertion is simply wrong. You use a VPN to isolate your application's traffic.

Nextgrid 6y ago

You can have two separate machines (whether VMs or bare-metal) plus a load-balancer in front and go blue/green deployments by deploying changes on one machine then redirecting the traffic to it by reconfiguring the LB, and if all good you then update the second machine as well. You do not need a VPN if all your machines are on premises in the same network or within a VPC in case of a cloud provider. In case where you do need a VPN (let's say a hybrid on-prem + cloud architecture) you can have a single VPN gateway (either software like Strongswan on a dedicated machine, or hardware router + whatever AWS's equivalent of that is) bridging the two networks. In a lot of projects though, neither of those things are required at all. Not every project has a threat model requiring VPN'd communications between hosts or multiple environments & seamless deployments (a lot of projects would be fine with taking 10 minutes of downtime out of hours to deploy updates). I'm not saying Kubernetes is bad or should never be used, but just like any tool it should be used for the right task and in some cases the cost, complexity or downsides associated with the tool end up being a net negative. I dislike the current trend that everything should be in containers, Kubernetized, etc where you spend more time on infrastructure than writing the code you're trying to deploy in the first place.

rumanator 6y ago
> You can have two separate machines (whether VMs or bare-metal) plus a load-balancer in front and go blue/green deployments Congratulations, you've just added half a dozen moving parts that are untested and require constant maintenance. And you still don't get version-controlled rollbacks. What have you gained by not using Kubernetes? I see only losses. > You do not need a VPN if all your machines are on premises That assertion is simply wrong. You use a VPN to isolate your application's traffic.