Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale Kubernetes Operator

tailscale.com

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Tailscale Kubernetes Operator

#21

Post by sneak »

api wrote: post #18
sneak wrote: post #12

The amount of trust placed in DockerHub to serve the correct images to everyone for uncritical download and execution is insane to me. The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash. If I were TAO I'd apply for a job at Docker or their hosting provider.

We have collectively decided as an industry to place infinite trust in a handful of vendors for the sake of convenience. Auth providers (OIDC), cloud providers, and numerous software repositories and SaaS providers effectively have root on the entire universe. A major compromise of any number of these large vendors could expose millions of systems to total compromise.

Resultantly, these systems are almost certainly already compromised by organizations skilled enough to not get caught.

Re: Tailscale Kubernetes Operator

#23

Post by api »

sneak wrote: post #21
api wrote: post #18

Earlier quoted context omitted.

We have collectively decided as an industry to place infinite trust in a handful of vendors for the sake of convenience. Auth providers (OIDC), cloud providers, and numerous software repositories and SaaS providers effectively have root on the entire universe. A major compromise of any number of these large vendors could expose millions of systems to total compromise.

Resultantly, these systems are almost certainly already compromised by organizations skilled enough to not get caught.

I'd say nation states, which means the US and possibly other nation states effectively have root on virtually all SaaS systems.

It's exactly the architecture I'd promote if I wanted a total panopticon, but I'm not suggesting a conspiracy. Ease of use is the most powerful force in computing and history has shown that people will trade privacy, security, freedom, cost, and virtually anything else for it.

It does make a certain amount of sense. Time is non-fungible; no amount of money can buy more of it. So ease of use by saving time is extremely valuable and commands a high price.

The problem is that IMO the cost of all this SaaS automation is higher than most people understand. There's some rather huge hidden costs here.

Re: Tailscale Kubernetes Operator

#24

Post by maisem »

HappyCathode wrote: post #10

That's really neat. Cloudflare tunnel for external customer egress, and Tailscale for internal tool egress. No more costly cloud specific load balancers !

Hi Tailscale engineer here. The operator also supports Tailscale Funnel so you could use that instead of Cloudflare tunnel if you desired.

Re: Tailscale Kubernetes Operator

#26

Post by vorpalhex »

shawabawa3 wrote: post #16

One thing that i think is really missing is redundancy on the proxies Currently there's no way to have two proxies that listen on the same tailscale hostname/ip Ideally in Kubernetes every pod is redundant to allow downscaling of nodes efficiently, so this means we have to eat a minute or so of downtime randomly every now and then on our tailscale endpoints

Can't you expose the services to two load balancers?

Not ideal for anything customer facing but fine enough for staff.

Re: Tailscale Kubernetes Operator

#27

Post by leetrout »

valvar wrote: post #22
leetrout wrote: post #3

Earlier quoted context omitted.

You can use, instead: Keep it simple, smarty

Is "stupid" really one of the words that the Ministry of Truth no longer permits us to use?

They felt the need to censor it as st*pid so I merely offered the alternative I use.

Re: Tailscale Kubernetes Operator

#28

Post by HappyCathode »

maisem wrote: post #24
HappyCathode wrote: post #10

That's really neat. Cloudflare tunnel for external customer egress, and Tailscale for internal tool egress. No more costly cloud specific load balancers !

Hi Tailscale engineer here. The operator also supports Tailscale Funnel so you could use that instead of Cloudflare tunnel if you desired.

Hey ! I see Tailscale Funnels as maybe a good replacement for Ngrok, but not for Cloudflare Tunnels.

Your Funnels are in Beta, MUST use your tailnet’s domain name, have bandwitdh limits, no failover and no load balancing. If my website goes down, I close shop. Cloudflare Tunnels are just way more mature for production loads. CF Tunnels technically don't have load balancing, but if you set multiple Tunnels with the same ID, you get some sort of load balancing AND failovers if a tunnel goes down. And after that, they have a paid Load Balancer option.

Even for internal admin portals, the mention that "Traffic over Funnel is subject to bandwidth limits." with absolutely no defined numbers is just a turn off. If you added a number to that, like a limit of MBPS or GB/Month of transfer, it would be something I can bring to my colleagues, something we can discuss and weight on. For now, with no number, it's just a threat.

Everything else about Tailscale is chefskiss tho ;)

Re: Tailscale Kubernetes Operator

#29

Post by anonfunction »

sneak wrote: post #12

The amount of trust placed in DockerHub to serve the correct images to everyone for uncritical download and execution is insane to me. The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash. If I were TAO I'd apply for a job at Docker or their hosting provider.

What's TAO?

Re: Tailscale Kubernetes Operator

#30

Post by Infernal »

anonfunction wrote: post #29
sneak wrote: post #12

The amount of trust placed in DockerHub to serve the correct images to everyone for uncritical download and execution is insane to me. The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash. If I were TAO I'd apply for a job at Docker or their hosting provider.

What's TAO?

I am not sure but maybe referring to this? https://en.wikipedia.org/wiki/Tailored_Access_Operations
Post reply on HN