Live data from Hacker News

Kubermesh: self-hosted/healing/provisioning, partial-mesh network K8s cluster

github.com

11–20 of 25 posts

Re: Kubermesh: self-hosted/healing/provisioning, partial-mesh network K8s cluster

#11
post #7

kubernetes has so much momentum and developer interest. I rarely see anything about DC/OS which is what they choose at my work last month, apparently its DC/OS is more 'battle tested' in enterprise. I don't think i even want to setup dc/os on my laptop and play with it, seems almost impossible to run mesos on osx . All these articles are making me resent DC/OS :D.

DC/OS was developed with objectives that are not overlapping with K8s'. Namely, they target machine management. While K8s is about container centric job management. Seems subtle, but if you think along these 2 lines, design decisions in 2 systems fall through naturally.

>DC/OS was developed with objectives that are not overlapping with K8s'.

from their home page ' deploys containers, distributed services, and legacy applications into those machines; '

Containers is listed first and its definitely an overlap with kubernetes . I understand that mesos was originally developed with non container centric focus but dc/os now definitely container focused. First example on their site in graphic is 'Containerized Workloads '.

Re: Kubermesh: self-hosted/healing/provisioning, partial-mesh network K8s cluster

#12

Earlier quoted context omitted.

I've found a few not-so-obvious pain points on my very limited k8s experience. 1) k8s makes a lot of sense for stateless applications (such as your website) but not so much for stateful applications that require a client to connect to the same container every time (there are ways to do it, but they are a pain in the ass.) 2) Tooling is getting better with time, but it's still pretty green. Packages for your usual orc…

1) That's true, but why not support shared state on shared storage. If that's not an option. 2) What exactly do you not like tooling wise. 3) Totally agree. I am actually working on replacing etcd with postgresql though.

Regarding #2, I think it's hard to integrate k8s with the rest of your infrastructure. If you are using, say, a combination of Terraforms + Ansible or Puppet to keep everything in shape, right now you have two options:

1) Write a bunch of bash scripts around kubectl and a bunch of YAML files. While painful, this the way I ended up going for (plus blackbox to GPG encrypt/decrypt secrets on the repo)

2) Try to use your usual tools (Ansible/Puppet) as a replacement for kubectl. This is the dream, but the plugins for Ansible and Puppet only support subsets of the latest k8s features, or require annoying stuff like setting your API endpoint on every task.

In other words, getting reproducible deploys between different k8s clusters (say, one for staging and one for production) is not really a thing yet. I guess there's an argument for saying that one should use k8s-native solutions for that (such as namespaces) but what about having clusters in different data centers?

Re: Kubermesh: self-hosted/healing/provisioning, partial-mesh network K8s cluster

#13

As someone who doesn't know enough about K8s, this looks like an amazingly easy way to get stuck in. Can anyone who has experience with real deployments advise on what pain-points may be encountered by growing something like this further than N nodes (and talk about what N might be?)

I've found a few not-so-obvious pain points on my very limited k8s experience. 1) k8s makes a lot of sense for stateless applications (such as your website) but not so much for stateful applications that require a client to connect to the same container every time (there are ways to do it, but they are a pain in the ass.) 2) Tooling is getting better with time, but it's still pretty green. Packages for your usual orc…

For #1 have you tried using local storage available in 1.7, see example https://github.com/kubernetes-incubator/external-storage/tre...

Re: Kubermesh: self-hosted/healing/provisioning, partial-mesh network K8s cluster

#14
post #7

kubernetes has so much momentum and developer interest. I rarely see anything about DC/OS which is what they choose at my work last month, apparently its DC/OS is more 'battle tested' in enterprise. I don't think i even want to setup dc/os on my laptop and play with it, seems almost impossible to run mesos on osx . All these articles are making me resent DC/OS :D.

Having worked in DC/OS prior to Kubernetes, I'm going to say that it's much easier to jump into DC/OS development (working with the API etc). However, Kubernetes has been a lot easier for me to get running a lot faster, mostly due to the much more active community.

It also feels like the recent feature sets that Mesosphere has been delivering to Marathon (their choice of scheduler to sit on top of Mesos) is playing catchup to a lot of the features that Kubernetes already has.

Re: Kubermesh: self-hosted/healing/provisioning, partial-mesh network K8s cluster

#15

Earlier quoted context omitted.

1) That's true, but why not support shared state on shared storage. If that's not an option. 2) What exactly do you not like tooling wise. 3) Totally agree. I am actually working on replacing etcd with postgresql though.

Regarding #2, I think it's hard to integrate k8s with the rest of your infrastructure. If you are using, say, a combination of Terraforms + Ansible or Puppet to keep everything in shape, right now you have two options: 1) Write a bunch of bash scripts around kubectl and a bunch of YAML files. While painful, this the way I ended up going for (plus blackbox to GPG encrypt/decrypt secrets on the repo) 2) Try to use your…

2) This is a very bad idea

Re: Kubermesh: self-hosted/healing/provisioning, partial-mesh network K8s cluster

#16

As someone who doesn't know enough about K8s, this looks like an amazingly easy way to get stuck in. Can anyone who has experience with real deployments advise on what pain-points may be encountered by growing something like this further than N nodes (and talk about what N might be?)

I've found a few not-so-obvious pain points on my very limited k8s experience. 1) k8s makes a lot of sense for stateless applications (such as your website) but not so much for stateful applications that require a client to connect to the same container every time (there are ways to do it, but they are a pain in the ass.) 2) Tooling is getting better with time, but it's still pretty green. Packages for your usual orc…

> Using their suggested YAML format leads to another problem: there's no easy way to keep secrets outside of the configuration files, unless you build your own process around it

Isn’t that what the Secrets resources are for? Just use those, and mount them into your containers in the filesystem or environment variables.

Re: Kubermesh: self-hosted/healing/provisioning, partial-mesh network K8s cluster

#17
post #16

Earlier quoted context omitted.

I've found a few not-so-obvious pain points on my very limited k8s experience. 1) k8s makes a lot of sense for stateless applications (such as your website) but not so much for stateful applications that require a client to connect to the same container every time (there are ways to do it, but they are a pain in the ass.) 2) Tooling is getting better with time, but it's still pretty green. Packages for your usual orc…

> Using their suggested YAML format leads to another problem: there's no easy way to keep secrets outside of the configuration files, unless you build your own process around it Isn’t that what the Secrets resources are for? Just use those, and mount them into your containers in the filesystem or environment variables.

Kubernetes "secrets" aren't actually...well...secret. They're stored unencrypted in etcd with no ACLs. You must go outside the Kubernetes system to do this.

If I control a physical cluster of machines end-to-end, I might consider Kubernetes (because I don't have any better options and doing the work to actually secure it is probably less work than my alternatives), but it's also one of the reasons--though far from the only reason--that I couldn't begin to consider k8s if I'm running in AWS or another cloud environment.

Re: Kubermesh: self-hosted/healing/provisioning, partial-mesh network K8s cluster

#18
post #4

This sounds like buzzword bingo. I can't tell without reading the source, is this any different from minikube? I see a mention of NUCs and netboot in the README, so I'm guessing it's slightly more, but not documented.

There's a better explanation of what's going on over here: http://ocadotechnology.com/blog/creating-a-distributed-data-...

There's some libvirt stuff, but that's mostly for local testing without having a bunch of physical hardware.

The key things I'm trying to do are: - Automatically provision new machines, just by plugging them in. - Don't have a traditional network (i.e. switches)

Re: Kubermesh: self-hosted/healing/provisioning, partial-mesh network K8s cluster

#19
post #18
post #4

This sounds like buzzword bingo. I can't tell without reading the source, is this any different from minikube? I see a mention of NUCs and netboot in the README, so I'm guessing it's slightly more, but not documented.

There's a better explanation of what's going on over here: http://ocadotechnology.com/blog/creating-a-distributed-data-... There's some libvirt stuff, but that's mostly for local testing without having a bunch of physical hardware. The key things I'm trying to do are: - Automatically provision new machines, just by plugging them in. - Don't have a traditional network (i.e. switches)

From the article, you're using Quagga -- are you aware of the active fork FRRouting[0]? It was forked about 8 months ago and is over 3,000 commits ahead since most of the core developers have stopped developing Quagga.

[0] https://github.com/FRRouting/frr

Re: Kubermesh: self-hosted/healing/provisioning, partial-mesh network K8s cluster

#20
post #17
post #16

Earlier quoted context omitted.

> Using their suggested YAML format leads to another problem: there's no easy way to keep secrets outside of the configuration files, unless you build your own process around it Isn’t that what the Secrets resources are for? Just use those, and mount them into your containers in the filesystem or environment variables.

Kubernetes "secrets" aren't actually...well...secret. They're stored unencrypted in etcd with no ACLs. You must go outside the Kubernetes system to do this. If I control a physical cluster of machines end-to-end, I might consider Kubernetes (because I don't have any better options and doing the work to actually secure it is probably less work than my alternatives), but it's also one of the reasons--though far from th…

> Kubernetes "secrets" aren't actually...well...secret. They're stored unencrypted in etcd with no ACLs. You must go outside the Kubernetes system to do this.

They are in progress towards encrypting at rest the etcd database. You can experimentally turn it on by following this doc:

https://kubernetes.io/docs/tasks/administer-cluster/encrypt-...

Post reply on HN