This is what happens when you take the "it was DNS" meme too seriously. DNS is brilliant. Learn it. If you're really that ideologically opposed to such brilliance, just use the addresses directly. The system described is insane.
DNS is for people, not for IT infrastructure
11–20 of 102 posts
Re: DNS is for people, not for IT infrastructure
#12> It's easy to configure systems with tools like Ansible or pyinfra at scale.
Tell me that you've never used Ansible at scale without telling me that you've never used Ansible at scale.
Re: DNS is for people, not for IT infrastructure
#13> Instead of configuring domain names that may not resolve, we can just directly inject the appropriate IP address(ess) into configuration files Because now you've replaced one single point of failure configuration system with caching and TTLs (DNS) with a higher maintenance and much less widely supported one.
Not to mention losing load balancing and failover.
Re: DNS is for people, not for IT infrastructure
#14> Instead of configuring domain names that may not resolve, we can just directly inject the appropriate IP address(ess) into configuration files Because now you've replaced one single point of failure configuration system with caching and TTLs (DNS) with a higher maintenance and much less widely supported one.
Not to mention losing load balancing and failover.
And making TLS more difficult, especially for HA systems. Guess you would just need one cert for 127.0.0.1 for all local services.
Re: DNS is for people, not for IT infrastructure
#15History tip: Using /etc/hosts (or as it was called then, "the HOSTS.TXT file") ran into some problems.
Re: DNS is for people, not for IT infrastructure
#16It is not really true that DNS is for people only: it is used as an aliasing system, for load balancing, and for caching (with no cache invalidation mechanism other than ahead-of-time TTL setting). It is used to make entire protocols work (MX records for email, but SRV records are used for much more). Now, if we do look at the most basic of basic DNS roles — mapping a human readable name to arbitrary set of numbers i…
- note I was talking about internal infrastructure, not public services
- DNS load balancing is not that important for internal services in most Cases? Would only use it if alternatives won’t work.
- the virtual host issue is really adressed by /etc/hosts, I thought that was obvious, I now regret not explicitly adressing it.
Re: DNS is for people, not for IT infrastructure
#17> we'll just use /etc/hosts no DNS required! this is classic "easy vs. simple" folly, witness how someone too lazy to [learn how to] setup proper DNS for their infrastructure will do 10x the work hacking something "easy"
Serious response: how is templating out /etc/hosts with Ansible not 10x simpler than setting up an additional service that only introduces additional risk?
Re: DNS is for people, not for IT infrastructure
#18Seems like a weird crusade. Pointing everything directly at the IP address might not seem so swell when it's time to upgrade the server or the address has to change for some reason. Sure would be nice to just update the DNS record to point to the new address.
Proposed solution: update the inventory and run your Ansible playbook/role agains your infrastructure (or subset). I don’t see the issue, to be frank.
Re: DNS is for people, not for IT infrastructure
#19Earlier quoted context omitted.
Not to mention losing load balancing and failover.
And making TLS more difficult, especially for HA systems. Guess you would just need one cert for 127.0.0.1 for all local services.
Certs support ip addresses?
However, /etc/hosts would solve the issue probably, unless I’m missing something
Re: DNS is for people, not for IT infrastructure
#20Hard disagree - only because if you didn't have DNS you would have something else in its place. But, we understand DNS _very_ well.
People, services, machines, etc need to "dial" canonical-somewhere. Whatever does the canonical management is the piece that when it breaks everything breaks.
Doesn't matter if it's DNS, EIP rotation, some HA proxy, whatever. It'll break.
It's actually that DNS is so well understood that it doesn't fail more often.
So no, DNS is for IT Infra.