4 ms·

The overlay networks are not necessarily hacks - just a souped-up, more distributed, auto-configured VPN. Also, especially in flannel's case, you hand it IPv4 a

by kbaker 11y ago

The overlay networks are not necessarily hacks - just a souped-up, more distributed, auto-configured VPN. Also, especially in flannel's case, you hand it IPv4 address space to use for the whole network, so there is a bit more coordination of which space gets used. Even so, there are are lots of ways to get IPv6 now, I would think anywhere where you could use this fan solution to change firewall settings and route tables on the host, you could also setup an IPv6 tunnel or address space. Even with some workarounds for not having a whole routed subnet, like using Proxy NDP. It seems like a much more future-proof solution than working with something like this. Just my 2c...

epistasis 11y ago
You do not appear to be familiar with the problem domain that this addresses, and I think the fan device addresses the problem very very well compared to its competitors! It's nothing like a VPN, it's just IP encapsulation without any encryption or authentication. And it's far far far less of a hack than the distributed databases currently used for network overlays, like Calico or MidoNet or all those other guys, IMHO. For example take this sentence from the article: > Also, IPv6 is nowehre to be seen on the clouds, so addresses are more scarce than they need to be in the first place. There are a lot of people that are using AWS and not in control of the entire network. If they were in control of the entire network, they could just assign a ton of internal IP space to each host. IPV6 is great, sure, but if its not on the table its not on the table. We will be testing the fan mechanism very soon, and it will likely be used as part of any LXC/Docker deploy, if we ever get to deploying them in production.
- vosper 11y ago
  I don't know much about networking, but if you're on AWS and are using VPC then don't you have full control of the entire (virtual) network?
  - epistasis 11y ago
    Sure, but it's only IPV4: > Additionally, VPCs currently cannot be addressed from IPv6 IP address ranges. http://aws.amazon.com/vpc/faqs/ http://aws.amazon.com/vpc/faqs/ And then you still have the problem of only so many IPs per host, so it doesn't help with lots of containers.
    - rwmj 11y ago
      Anyone got the inside story on why in 2015 Amazon doesn't support IPv6?
      - falcolas 11y ago
        IPv6 is hard. It's hard to optimize, it's hard to harden, and it's hard to protect against. One small example: How do you implement a IPv6 firewall which keeps all of China and Russia out of your network? (My apologies to folks living in China and Russia, I've just seen a lot of viable reasons to do this in the past). Another small example: How do you enable "tcp_tw_recycle" or "tcp_tw_reuse" for IPv6 in Ubuntu?
        stormbrew 11y ago
        None of this really applies to VPC (which is a private virtual network for only your own hosts and access is restricted lower down than at the ip layer). You actually can have a public IPv6 address on AWS, it just has to go through ELB.
        teraflop 11y ago
        You actually have it a bit backwards: you can only assign an IPv6 address to an ELB if it's not in a VPC. http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-internet-facing-load-balancers.html http://docs.aws.amazon.com/ElasticLoadBalancing/latest/Devel... Crazy, right? Especially since new customers are forced to use VPC and don't even have the option of falling back to EC2-Classic.
        11y ago
- kbaker 11y ago
  No, I get what this addresses... It is really just a wrapper around building a network bridge and having the host do routing / packet forwarding and encapsulation. Nothing a little iptables can't handle :) I wasn't aware that AWS still doesn't have support for IPv6, that's just amazingly bad in 2015. I'll shift my blame onto them then for spawning all these crazy workarounds.

by kbaker 11y ago

epistasis 11y ago

You do not appear to be familiar with the problem domain that this addresses, and I think the fan device addresses the problem very very well compared to its competitors! It's nothing like a VPN, it's just IP encapsulation without any encryption or authentication. And it's far far far less of a hack than the distributed databases currently used for network overlays, like Calico or MidoNet or all those other guys, IMHO. For example take this sentence from the article: > Also, IPv6 is nowehre to be seen on the clouds, so addresses are more scarce than they need to be in the first place. There are a lot of people that are using AWS and not in control of the entire network. If they were in control of the entire network, they could just assign a ton of internal IP space to each host. IPV6 is great, sure, but if its not on the table its not on the table. We will be testing the fan mechanism very soon, and it will likely be used as part of any LXC/Docker deploy, if we ever get to deploying them in production.

vosper 11y ago
I don't know much about networking, but if you're on AWS and are using VPC then don't you have full control of the entire (virtual) network?
- epistasis 11y ago
  Sure, but it's only IPV4: > Additionally, VPCs currently cannot be addressed from IPv6 IP address ranges. http://aws.amazon.com/vpc/faqs/ http://aws.amazon.com/vpc/faqs/ And then you still have the problem of only so many IPs per host, so it doesn't help with lots of containers.
  - rwmj 11y ago
    Anyone got the inside story on why in 2015 Amazon doesn't support IPv6?
    - falcolas 11y ago
      IPv6 is hard. It's hard to optimize, it's hard to harden, and it's hard to protect against. One small example: How do you implement a IPv6 firewall which keeps all of China and Russia out of your network? (My apologies to folks living in China and Russia, I've just seen a lot of viable reasons to do this in the past). Another small example: How do you enable "tcp_tw_recycle" or "tcp_tw_reuse" for IPv6 in Ubuntu?
      - stormbrew 11y ago
        None of this really applies to VPC (which is a private virtual network for only your own hosts and access is restricted lower down than at the ip layer). You actually can have a public IPv6 address on AWS, it just has to go through ELB.
        teraflop 11y ago
        You actually have it a bit backwards: you can only assign an IPv6 address to an ELB if it's not in a VPC. http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-internet-facing-load-balancers.html http://docs.aws.amazon.com/ElasticLoadBalancing/latest/Devel... Crazy, right? Especially since new customers are forced to use VPC and don't even have the option of falling back to EC2-Classic.
        11y ago
kbaker 11y ago
No, I get what this addresses... It is really just a wrapper around building a network bridge and having the host do routing / packet forwarding and encapsulation. Nothing a little iptables can't handle :) I wasn't aware that AWS still doesn't have support for IPv6, that's just amazingly bad in 2015. I'll shift my blame onto them then for spawning all these crazy workarounds.