Live data from Hacker News

Highly available Kubernetes with batteries for small business

cinaq.com

51–60 of 69 posts

Re: Highly available Kubernetes with batteries for small business

#51
post #42

Earlier quoted context omitted.

The overhead might get smaller but it never disappears. You'll still have maintenance and debugging issues that are specific to k8s.

True, but it also takes away some pain you'd otherwise have. I used to be in the 'Kubernetes is unnecessary overhead for most cases' camp, but since I actually started to use it I think it's a good base for even smaller setups, and I find myself prefering it to other ways of reproducably setting up infrastructure/services. Maybe that's not the case for the people posting here, but often times it seems people who argu…

This is exactly my experience.

For years I bemoaned that it doesn't scale down to the scale where most engineers work. I was wrong about that, it didn't scale down to the amount of learning I was willing to do for any one project at the scale I was doing them.

SOOO many times have I had to try to make my tools do something they weren't really capable of doing. And while it feels like a win today it never does tomorrow.

With Kubernetes most of my issues come from other things than that itself. Digital Ocean has a great small scale experience. AWS EKS has been quite a mess in comparison in terms of Ops time required. This made me realize that maybe people are suffering with ineffifcenies from the cloud provider, not Kubernetes itself.

Re: Highly available Kubernetes with batteries for small business

#52

> This setup is not trully highly available. The whole cluster depends on the Synology as data storage. You could improve this further by replacing the centralized NAS with a distributed solution. But besides that the cluster is very solid and scalable I understand that my local harddrive with excel spreadsheets detailing my entire business along side critical software is not the best place to store the lifeblood of…

I've been running DO k8s for about a year, works great. But in reality, you won't be paying $30. The node size that gives you is tiny and almost any setup will be a few hundred per month.

This is assuming you have some kind of staging environments, probably some demo, all of these come with at least one database instance. Maybe it's not something as memory polite as PostgreSQL. Etc etc, real-world setups tend use a bit of hardware.

If I wanted to save money, time and sleep I would deploy a production cluster to DO. Set up an office k8s cluster on local hardware for staging and I would host my own testing there. If it goes down I would deploy it temporarily in DO.

Re: Highly available Kubernetes with batteries for small business

#53
post #34

Earlier quoted context omitted.

A lot if you are using a managed Kubernetes solution. It is surprisingly easy and affordable to setup nowadays. We're currently running on DO and it is a pure joy. - IaC, no servers to manage (Terraform + kubectl/helm) - reasonable HA with minimal effort - easily configurable metrics (prometheus) - automated/minimal effort horizontal scaling - easy SSL certificate installation and automated renewal - operate multiple…

1. IaC / no servers isn't a plus. It's vastly easier to SSH into a server and do anything you already can on a desktop 2. So do CoLocos, but better "HA" with no effort at all 3. /var/log + bash grep 4. Reverse proxy, just add another IP address and a load balancer 5. This is true anywhere 6. Nginx and apache both do this, dead simply 7. SSH + cli editor of your choice Kubernetes does nothing new, but pad more resumes…

1. You can't replace everything that Terraform does with "SSH into a server". For example, in Terraform you are specifying exactly what the compute resources are going to be used on the node and even SSH itself might be part of the software that gets provisioned.

2. "do CoLocos" definitely has effort and does not in anyway guarantee HA. (HA is really more of a software application layer concern not hardware) Also, are you telling me you are going to engineer an HA load balancer service better than the people who work for the major cloud vendors? Are you going to setup all your own service discovery, scheduling and everything else k8s does for your application?

3. Prometheus and other solutions are so much more than "/var/log + bash grep" you can't possibly seriously equate the two. Serious applications demand serious metric solutions.

4. Sure let me do all that while my site starts getting the HN hug of death or you know I could do nothing and let my infrastructure autoscale for me. Even in a non-autoscale setup, all you have to do is change a couple of numbers in your terraform and k8s config files and reapply.

5. No it isn't. For some webservers like Caddy it's easier than others, but in many cases you are going to have to a good amount of manual steps to get auto renewal working for your Let's Encrypt certs. On K8s it's basically a config file and a helm chart install. Plus you have K8s guaranteeing that it will restart the renewal service should it go down.

6. Yes you can specify config in your webserver for the routing, but being able to run completely distinct application servers on the same nodes handling all the routing and service resiliency takes a lot of effort, while not running into conflicts with your existing applications that are already running. You are going to get a lot better bang for your buck running multiple applications on the same set of nodes than having to provision separate nodes for the other applications.

7. SSH + cli does not give you a cluster wide view of your application. You would have to feed all that information into a single location to be able to view it, which would take a lot of effort and still wouldn't provide the same level of detail.

As a small business, I'd much rather have well engineered solutions that will be able to grow with my business. A lot of what you describe might be okay when your business is very small and has a single server (basically you can afford to treat it as a pet), but as your business grows you want to avoid having to rework various parts of your infrastructure if possible. Managed k8s gives you a lot of room to grow with relatively little upfront time investment.

Re: Highly available Kubernetes with batteries for small business

#54

The small business buys AS/400. IBM configures it. Drop it in a closet, forget about it. If something goes wrong it will call for help, before you even know something was wrong. It depends on what you define a small business as though. Back in the days these were extremely reliable. I have seen them in closets, covered with everything else you would find in a closet. Used by everyone day in and day out, nobody knew w…

AS/400 lives on today as IBM i, the lifeblood of my employer (our billing system) runs on a POWER8 box running i and while I’m not a huge fan I appreciate the thing staying running without any fuss for years at a time (IPLs for periodic system updates and just to make sure it still boots notwithstanding).

Re: Highly available Kubernetes with batteries for small business

#55

I'd argue k8s is overkill for most companies that would fit the M in SMB. Regarding the purported target group of small businesses: No way. No small business has even the need for something like this, I'd argue unless you run technical setups of FAANG proportions you absolutely don't have the need, and if you think you need k8s in a medium-size business please rethink if you really need a system engineered for Google…

It's not about scaling the applications you run on it.

It's about providing leverage to your team so you need less effort to do more. And SMB can be anywhere up to 1000 employees if using semi-legal definitions, 500 employees and under 1 billion euro of turnover in case of EU's SME definition.

Depending on the area of work, there can be a lot of software to run. And that's where k8s comes in. It might seem "hard" when you're comparing it to "just throw few packages on a server", but having gone through that recently? The next time I'm setting up a single-node server to support tools for a project, I'm using k3s instead of spending 3-5 days getting software to play nice with paths changed to non-standard locations in order to keep data easy to backup and migrate to another server. Or wrestling load balancer (and ours is IaC even! Still not as nice and easy to deal with as nginx-ingress-controller...).

The real "scaling" of kubernetes is that once you pass the initial hurdle, the cost and complexity of adding more applications is greatly lowered. Even when you do a dumb lift-and-shift (like I did for >60 applications in one project).

Re: Highly available Kubernetes with batteries for small business

#56
post #55

I'd argue k8s is overkill for most companies that would fit the M in SMB. Regarding the purported target group of small businesses: No way. No small business has even the need for something like this, I'd argue unless you run technical setups of FAANG proportions you absolutely don't have the need, and if you think you need k8s in a medium-size business please rethink if you really need a system engineered for Google…

It's not about scaling the applications you run on it. It's about providing leverage to your team so you need less effort to do more. And SMB can be anywhere up to 1000 employees if using semi-legal definitions, 500 employees and under 1 billion euro of turnover in case of EU's SME definition. Depending on the area of work, there can be a lot of software to run. And that's where k8s comes in. It might seem "hard" whe…

> SMB can be anywhere up to 1000 employees, 500 employees and under 1 billion euro of turnover in case of EU's SME definition

By no-ones metric is 1000 employees a small business. The EU defines a small business as under 50 staff, and a medium business as under 250 staff.

https://ec.europa.eu/growth/smes/business-friendly-environme...

Re: Highly available Kubernetes with batteries for small business

#57

We created the Kubernetes Production Runtime helps streamline the installation of a lot of the components mentioned in the article (nginx as ingress controller, grafana, cert-manager, etc. ). It is open source, check it out: https://kubeprod.io

This was a big inspiration for a sort of self-bootstrapping kubernetes "distro" I put together for my previous employer - just wanted to give a shoutout to all the neat things I see coming from bitnami.

Re: Highly available Kubernetes with batteries for small business

#59
post #13

I've been using docker swarm on Hetzner for my fledgling business and am quite happy with it. The main feature I use is rolling upgrades that make it very easy to deploy changes. It's simple, and has all the features I need for the stage I'm at. Once I have a more demanding infrastructure I'll probably switch over to a managed kubernetes, but those platforms have a significantly higher unit cost.

With your setup, are you using a static front end web server(s?) - eg nginx - reverse proxying to the applications managed with Docker Swarm?

Yes exactly, I have an API and a couple of static sites exposed via nginx. None of the other services have exposed ports and all the networking is done through docker.

Re: Highly available Kubernetes with batteries for small business

#60
post #59

Earlier quoted context omitted.

With your setup, are you using a static front end web server(s?) - eg nginx - reverse proxying to the applications managed with Docker Swarm?

Yes exactly, I have an API and a couple of static sites exposed via nginx. None of the other services have exposed ports and all the networking is done through docker.

Just to double check (as a safety measure), are you using an external firewall for the docker container to ensure nothing can access them, or are you using customised firewall rules on the docker hosts?

Asking because from what I've seen (so far) it's only safe to use an external firewall - eg Digital Ocean (or whoever) firewall applied to hosts - rather than iptables on the hosts themselves.

Saying that because when starting the Docker service on a machine, the ~first thing it does is screw with any existing firewall config to ensure it can pipe data around between things. As a side effect, it seems to open up ports to the whole world. So any carefully secured config beforehand becomes useless. :(

Post reply on HN