Live data from Hacker News

A skeptic's first contact with Kubernetes

blog.davidv.dev

21–30 of 105 posts

Re: A skeptic's first contact with Kubernetes

#21
post #4

> Why are the storage and networking implementations "out of tree" (CNI / CSI)? Given the above question, why is there explicit support for Cloud providers? eg: LoadBalancer supports AWS/GCP/Azure/.. Kubernetes has been pruning out vendor-specific code for a while now, moving it out of tree. The upcoming 1.31 release will drop a lot of existing, already deprecated support for AWS & others from Kubernetes proper. http…

> Kubernetes has been pruning out vendor-specific code for a while now, moving it out of tree. I wasn't aware, but it makes sense, and explains the current "confusing" state.

Off topic - thank you for not having a super narrow text layout for your site. It seems like every other website these days has an incredibly narrow text width (I've seen as small as 600px which is so annoying to read). It was like a breath of fresh air to go to your site and have the text be a reasonable width without me having to fiddle with page styles.

Re: A skeptic's first contact with Kubernetes

#22
This is a good start. It misses an important thing about Kubernetes that is often missed: extensibility. Each and every thing within Kubernetes can be swapped out for something else, including the scheduler. There are Custom Resource Definitions that supports these extensions and operators.

For example, there is no built-in autoscaler for nodes, but someone wrote one and you can add one in there. It uses a constraint solver for determining whether to expand or shrink node groups. If you want to use something else, you can find something or write it and install it.

Another example, you don't have to use kube-proxy. There are other ways to manage inter-node networking.

To address some of the questions:

> Why does it not matter if the state is unstable? If I'm operating a cluster that can't settle, I'd like to know immediately!

I'd point to the Cynefine framework to help make sense of this. Kubernetes is a tool that helps manage things in the complex domain, rather than the complicated domain. Unlike complicated systems, complex systems and complex adaptive systems may never reach a defined settled state.

> Basically, Horizontal Pod Autoscaler but with sensors which are not just "CPU"

That's already available. In addition to scaling on built-in metrics such as cpu and mem, there are ways to create custom metrics, including queue depth. You can do this because Kubernetes is extensible

> Why are the storage and networking implementations "out of tree" (CNI / CSI)?

It used to be in-tree, until the number of third party cloud and in-house storage and networking providers became unwieldy. This goes along with that fundemental characteristic of the Kubernetes design -- extensibility. AWS owns the Elastic Block Storage CSI, and GCP owns its CSI for its storage device. CNI allowed for the various service meshes, including exciting new ones such as the one based on eBFP.

The Cynefine framework again, helps sheds some light on this: the best way to respond to things in the complex domain is to try a lot of different approaches. Even if one approach doesn't look like it works now, some future state may make that previously impractical approach to work well.

> Given the above question, why is there explicit support for Cloud providers?

The current versions of Kubernetes pushes those implementations to CNI and operators. So for example, in order to make use of AWS ELB/ALB for the Ingress object, you have to additionally install the AWS-specific driver. If you are using AWS's EKS service, this is managed as an EKS addon. Under the hood, these drivers are, guess what, pods managed by replicasets managed by deployments that listens to the Kubernetes API servers for changes to the Ingress resource.

Not everyone uses it. On one of the Kubernetes sites I worked on, we used Traefik inside Kubernetes and its custom resource definition, IngressRoute. Everytime you create an Ingress, the AWS driver will create a completely new Load Balancer, which of course, drives up cost for very little gain.

Re: A skeptic's first contact with Kubernetes

#23
post #7

His take on text interpolation is very right. I'm a SWE turned SRE because as a developer I really enjoyed using K8s. But as a full-time SRE where I work just means YAML juggling. It's mind numbing that everybody is okay with this, this really is our domain's assembly era, albeit with whitespace, colons, dashes and brackets. I've found solace in CUE which I just run locally to catch all the small errors everybody mak…

> ...just means YAML juggling.

Perhaps I'm missing something, but even the "YAML juggling" still seems to be in an immature stage. As an example, a problem I've been wrestling with recently where I could not find a solution with yq or other YAML wrangling tooling is the following.

Say I have a YAML fragment like this:

rules: - apiGroups: - rbac.authorization.k8s.io resources: -clusterroles verbs: - get - apiGroups: - rbac.authorization.k8s.io resources: -clusterroles verbs: - list

I want to condense it to this: rules: - apiGroups: - rbac.authorization.k8s.io resources: -clusterroles verbs: - get - list

More generally, I want to find the smallest most compact representation possible between the apiGroups, resources and verbs terms, combining everywhere possible. In the example, I combined the verbs, but the same combining can take place for the apiGroups and resources terms. This comes in really handy when cleaning up a litter trail of these constructs built from figuring out what resources to add to enable more complex Helm Chart installs (the iterative nature of that exercise is another rant in itself) in reasonably restrictive environments.

I resorted to writing a script to solve just this problem, but I keep thinking I must have missed some solution to this everyone else seems to have solved but me. Apparently the solution eludes my local K8S experts as well, because they condense it by hand, which I refuse to accept as the proper solution.

Re: A skeptic's first contact with Kubernetes

#25
post #7

His take on text interpolation is very right. I'm a SWE turned SRE because as a developer I really enjoyed using K8s. But as a full-time SRE where I work just means YAML juggling. It's mind numbing that everybody is okay with this, this really is our domain's assembly era, albeit with whitespace, colons, dashes and brackets. I've found solace in CUE which I just run locally to catch all the small errors everybody mak…

> which I just run locally to catch all the small errors everybody makes on a daily basis

What small errors?

Re: A skeptic's first contact with Kubernetes

#26
post #15

My problem with K8s: the network abstraction layer just feels _wrong_. It's an attempt to replicate the old model of "hard exterior, gooey interior" model of corporate networks. I would very much prefer if K8s used public routable IPv6 for traffic delivery, and then simply provided an authenticated overlay on top of it.

Something like? https://john-millikin.com/stateless-kubernetes-overlay-netwo...

Re: A skeptic's first contact with Kubernetes

#28
Here's what I would like from a Kubernetes-like system.

I have a collection of machines.

I have a very simple file that defines A) what I want to run, B) how the pieces communicate to each other, and C) how I want it to scale.

Make that work without me having to think about any of the underlying infrastructure. (If this sounds suspiciously similar to Heroku, there you go)

Re: A skeptic's first contact with Kubernetes

#29
post #28

Here's what I would like from a Kubernetes-like system. I have a collection of machines. I have a very simple file that defines A) what I want to run, B) how the pieces communicate to each other, and C) how I want it to scale. Make that work without me having to think about any of the underlying infrastructure. (If this sounds suspiciously similar to Heroku, there you go)

I think I'd be even happier if it had reasonable defaults for C. At least as a novice, I probably don't know how it wants to scale, and should be able to figure it out better than me.

Re: A skeptic's first contact with Kubernetes

#30
post #28

Here's what I would like from a Kubernetes-like system. I have a collection of machines. I have a very simple file that defines A) what I want to run, B) how the pieces communicate to each other, and C) how I want it to scale. Make that work without me having to think about any of the underlying infrastructure. (If this sounds suspiciously similar to Heroku, there you go)

There are tools that can do that, and are not as complex as Kubernetes

I once interviewed at a place where their notion of "scaling" is to turn up the knob on Heroku. They also pay for it. They did not have anyone on their team who knew what questions to ask. They had grown to the point where they had outgrown their approach, and yet, have never developed the in-house capability.

I mentioned the Cynefine framework elsewhere, and I'll mention it again. Infrastructure and how it supports application, users, stakeholders, is a complex system.

A lot of people treat this as if it were in the complicated, or even clear domain. For certain class of use-cases, you can get away with this. But a company itself is a complex adaptive system, whose needs changes as it matures and scales ... or it doesn't, and it collapses.

The Cynefine framework describes four different domains, and the way you make decisions are different for each of them. You start getting in trouble when you attempt to use the decision-making process for one domain to a different domain. This often happens when the situation has evolved without the decision-makers noticing. It is easier for experts to see how clear domains changes to complicated domains, but it is more difficult to see when complicated domains change to complex domains.

Kubernetes is a sophisticated, adaptive, extensible tool for the complex domain. If it seems overly complex, it is because the domain is complex, and is not necessary if you are working from the complicated or clear domain.

Post reply on HN