3 ms·

This is the kind of stuff that makes the internet fun. I really like the types of projects that exist simply to exist. People putting out things that have no re

This is the kind of stuff that makes the internet fun. I really like the types of projects that exist simply to exist. People putting out things that have no reason except for the enjoyment. It seems like we're missing this kind of stuff lately. Even the April 1st hacks have failed to be interesting on the same level. I wonder what has happened and why.

crabbone 4y ago
Yeah, and then this "enjoyment" spills into real-life widely used programs, s.a. Kubernetes. This is literally me, yesterday discovering a little "gotcha" of an L7 reverse proxy in Kubernetes: # netstat $(hostname) 40443 Trying 10.X.X.X Connected to hostname.foo.bar Escape character is '^]' ... # ss -tpln | grep 40443 # # lsof -i :40443 # This kind of fun makes you want to punch each individual ITF member as well as people in Kubernetes who decided it'd be cool to implement L7 proxy using DNAT.
- p_l 4y ago
  Good that they didn't, then. No, seriously, there is no L7 reverse proxy implemented using kube-proxy mechanism (aforementioned DNAT) - It's L4 proxy for supporting legacy code that doesn't support intelligently querying for endpoints (by SRV record, k8s API, or other service discovery protocol). It's not even required to use it, Services can be declared to not need it (common example is using service mesh or ingress controller with http)
  - crabbone 4y ago
    We are talking about Kubernetes ingress controllers, in particular, ngnix-based one.
    - p_l 4y ago
      Which doesn't use DNAT unless you explicitly configure it to do so. nginx-ingress will read Service Endpoints through k8s API and resolve connections to specific pod IPs so long as your network is properly deployed. Of course it's also possible to make it go through serviceIP (which by default is still implemented using DNAT in kube-proxy), but it's not recommended. NodePorts like the example given earlier exist for dealing with external traffic from hosts unaware of (possibly unroutable) serviceIP and podIP ranges. I had lots of !FUN! with nginx-ingress, but that's not one of its faults.
knewter 4y ago
I made an elixir library called mechanical turk down that blocks until the newly created mechanical turk job gets a response to render the markdown

crabbone 4y ago

Yeah, and then this "enjoyment" spills into real-life widely used programs, s.a. Kubernetes. This is literally me, yesterday discovering a little "gotcha" of an L7 reverse proxy in Kubernetes: # netstat $(hostname) 40443 Trying 10.X.X.X Connected to hostname.foo.bar Escape character is '^]' ... # ss -tpln | grep 40443 # # lsof -i :40443 # This kind of fun makes you want to punch each individual ITF member as well as people in Kubernetes who decided it'd be cool to implement L7 proxy using DNAT.

p_l 4y ago
Good that they didn't, then. No, seriously, there is no L7 reverse proxy implemented using kube-proxy mechanism (aforementioned DNAT) - It's L4 proxy for supporting legacy code that doesn't support intelligently querying for endpoints (by SRV record, k8s API, or other service discovery protocol). It's not even required to use it, Services can be declared to not need it (common example is using service mesh or ingress controller with http)
- crabbone 4y ago
  We are talking about Kubernetes ingress controllers, in particular, ngnix-based one.
  - p_l 4y ago
    Which doesn't use DNAT unless you explicitly configure it to do so. nginx-ingress will read Service Endpoints through k8s API and resolve connections to specific pod IPs so long as your network is properly deployed. Of course it's also possible to make it go through serviceIP (which by default is still implemented using DNAT in kube-proxy), but it's not recommended. NodePorts like the example given earlier exist for dealing with external traffic from hosts unaware of (possibly unroutable) serviceIP and podIP ranges. I had lots of !FUN! with nginx-ingress, but that's not one of its faults.

knewter 4y ago

I made an elixir library called mechanical turk down that blocks until the newly created mechanical turk job gets a response to render the markdown