[deleted]
Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production
31–40 of 44 posts
Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production
#32Earlier quoted context omitted.
The problem is right here in the blurb. It's not that k8s itself is complex. Ops is complex. Companies used to have entire dedicated IT departments full of sysadmins, storage engineers, network engineers, and security engineers with decades of experience configuring, deploying, maintaining, and monitoring servers, networks, hypervisors, and data centers. Newer companies just push this onto their application developer…
It's true that a developer can't be an expert in every aspect of the stack but that's where services like Datree or many of AWS' services for example come in, they bring the domain expertise and require the developer to only be familiar with the subject. The experts moved to be domain experts, working for the companies that develop the tools. You don't really need a resident storage expert in every company, since mos…
But suddenly you need to keep up with a ton of different tools and if they break you either dig into the topic or you're f**ed. This is such a productivity killer it's crazy.
Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production
#33K8s manifest are yamls that translated to tens of K8s actions that change production environment .Misconfigurtions that can be prevented by integrating datree cli into CI/CD cycle can save hours of production unreliability. For me it's must have phase in K8s release flow.
Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production
#34Earlier quoted context omitted.
IMO Kubernetes is of the level of complexity of a programming language or an OS. It's just at a larger scope, and we don't have a lot of things in that space, so we don't have well-defined concepts like "language" or "OS" to encompass them. There are basically entire industries dedicated to stopping programming languages from doing bad things (static analysis vendors, auditing consultancies, formal verification tool…
That may be true but programming languages are there to give you the power to develop any idea into a working software solution. I think K8s differs because I see it as something that simplifies infra and abstracts infra vendor specific concepts. The complexity in K8s doesn't add power, just confusion ;)
Kubernetes does simplify and abstract - just like C++ simplifies and abstracts compared to writing assembly. :) In both cases, the scope of what you can do expands significantly, which means that the systems you build with the higher-level tool are significantly more complex, which means that you see much more confusing C++ programs and Kubernetes deployments than assembly programs and five-lovingly-handcrafted-servers deployments.... but that's because you can successfully start with a more complex idea and make it happen.
Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production
#35Is it me, or is the dashboard only for paying customers? What does this add compared to Polaris by fairwinds ?
The dashboard is also offered as part of our freemium offering :) we offer 1000 policy checks per month for free. Including the dashboard. In terms of what we offer compared to Polaris: We offer pre-defined policies that comes out of the box along with the ability to write custom rules for your policy by your self. Take us for a spin and let me know what you think! thank you
FYI - Polaris open source has both these things :)
(Disclosure - I'm a maintainer)
Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production
#36I can't believe how complex a tool has to be for several startups to get funding purely to try stop it doing bad things. Kudos to Datree for making the most of this, but feels like something's wrong with k8s for this to be such a thing.
Not much different than Windows, Linux, etc (operating systems)
K8s basically implements a distributed OS that schedules across machines instead of CPU cores
Not-too-long-ago AWS had a significant outage due to misconfigured ulimits (Linux os)
Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production
#37I can't believe how complex a tool has to be for several startups to get funding purely to try stop it doing bad things. Kudos to Datree for making the most of this, but feels like something's wrong with k8s for this to be such a thing.
Have you ever tried to set up HA environments before Kubernetes and friends, let alone anything that can do failover and some form of auto-scaling? Kubernetes might have some unwarranted complexity, but let's not pretend it was a walk in the park setting environments up with ad-hoc shell scripts, HA proxy, IP failover, manual package updates and more fun stuff. Tools like Kubernetes and their general abstractions are vastly better than anything I could come up with in a time before even Puppet and Ansible existed. You have to take into consideration all that orchestrators like Kubernetes are trying to replace before you can meaningfully criticise their complexity.
Sadly enough it's all YAML, but at least it's all YAML and not random mostly undocumented arcane configuration formats...
Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production
#38Looks like this is a policy-as-code tool in the vein of Terraform Cloud's Sentinel Policies, or more generally Open Policy Agent, but specifically targeted at k8s use cases.
From the custom rules overview https://hub.datree.io/custom-rules-overview , though it is docs WIP, I noticed these are defined as YAML/JSON somehow. That's a contrast to HashiCorp's Sentinel https://docs.hashicorp.com/sentinel/concepts/language and OPA's Rego https://www.openpolicyagent.org/docs/latest/policy-language/ . Is this an intentional design decision?
Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production
#39I can't believe how complex a tool has to be for several startups to get funding purely to try stop it doing bad things. Kudos to Datree for making the most of this, but feels like something's wrong with k8s for this to be such a thing.
Have you ever tried to set up HA environments before Kubernetes and friends, let alone anything that can do failover and some form of auto-scaling? Kubernetes might have some unwarranted complexity, but let's not pretend it was a walk in the park setting environments up with ad-hoc shell scripts, HA proxy, IP failover, manual package updates and more fun stuff. Tools like Kubernetes and their general abstractions are…
My first job was managing bare metal for a variety of companies including fairly large multinational labs, all the way down to plugging in the RAM and fiddling with the routers, mostly for VoIP systems but also data backups. I didn't architect any HA environments but worked on some.
Re: Show HN: Datree (YC W20): Prevent K8s misconfigurations from reaching production
#40I can't believe how complex a tool has to be for several startups to get funding purely to try stop it doing bad things. Kudos to Datree for making the most of this, but feels like something's wrong with k8s for this to be such a thing.
Have you ever tried to set up HA environments before Kubernetes and friends, let alone anything that can do failover and some form of auto-scaling? Kubernetes might have some unwarranted complexity, but let's not pretend it was a walk in the park setting environments up with ad-hoc shell scripts, HA proxy, IP failover, manual package updates and more fun stuff. Tools like Kubernetes and their general abstractions are…
> Have you ever tried to set up HA environments before Kubernetes and friends, let alone anything that can do failover and some form of auto-scaling?
Those were simpler days for sure.
1) Set up multiple fileservers w/ DRDB or some sort of clustered filesystem like glusterfs 2) Set up multiple database servers in a cluster 3) Set up multiple web servers, all of which can connect to the NAS and DB 4) Optionally set up a cache layer like Varnish 5) Set up a hardware load balancer (or even varnish/nginx/haproxy)
Autoscaling on bare metal wasn't really a thing for most DCs, but setting up HA environments has been possible for a long time. Things were actually a lot less complicated because there weren't as many options imo. You'd generally overprovision to handle your peak loads, or maybe buy a few more servers before busy seasons/days and cancel them later.
Managing a bare metal kubernetes installation feels like it has a lot more moving pieces and ways that it can break. Cloud providers and managed services do take away a lot of the burden though.