Why don’t most VPC providers offer IPv6? Is there some kind of implementation issue with it, or just that you don’t need it.
DigitalOcean VPC
11–20 of 169 posts
Re: DigitalOcean VPC
#12Do they talk at all about what they're using to provide the VPC overlay? I have a DO k8s cluster and it uses Cilium for the CNI, which turns out to be quite useful, so I guess I'm wondering if they're also using Cilium for this. (Over in AWS land, they wrote a CNI for their own VPC networking. It turns out to have many strange limitations. For example, you can only run 17 pods on a certain type of node, because that…
Better way of doing natively addressable pods is assign whole subnets (like /25) as secondary interface and distribute that to pods via cni. I think gke pod network works that way. Not sure why eks decided 17 pods is ok lol
Wow the ignorance.
The AWS CNI which comes with EKS attaches ENIs (think of a NIC) to the instance. The number of these you can attach is dependent on the instance type.
Pods get an IP in the CIDR range of the subnet the instance is in. There's no additional network overlay which does any NAT when traffic leaves the instance.
If you want you can use your own CNI, but things can break.
Re: DigitalOcean VPC
#13Earlier quoted context omitted.
Pretty standard? Taking AWS for example: - You can do this, but it's highly discouraged since it means no VPC peering if you ever need that. - Can't do this at all with network interfaces, it all is via VPC peering. - Can't change the VPC after an instance has been created, you have to take a snapshot and relaunch it.
Interesting, didn’t know that about AWS. In more familiar with the Google cloud version of VPC. Seems the DO implementation is more like the AWS version
Heh, no worries -- mostly the same deal there:
- You can do it, but it's probably not a great idea if you need to do VPC peering (or attach multiple VPCs to one VM, see next).
- Does actually work, but it does not work if the VPCs you're trying to attach to a single VM have overlapping CIDRs.
- Same deal, almost. You cannot add or remove network interfaces from an existing VM.
Re: DigitalOcean VPC
#14They must be great, my servers are constantly receiving hack attempts from Digital Ocean IPs.
Does this mean that previously to this change, without a software firewall running you'd be vulnerable to attacks on the private network from other customers? (I've never used DO).
Yes, on both Digital Ocean and its 'brother from another mother' Linode. I have a client with a few Linode VPSs and their biggest attacks by far come from the 'private' network.
Re: DigitalOcean VPC
#15Not being able to reassign, delete, or change the cidr of the default VPC is going to be a problem for most folks. Looking forward to the next release where this is fixed, and the fact that we have day 1 support for Terraform is awesome!
Re: DigitalOcean VPC
#16Why don’t most VPC providers offer IPv6? Is there some kind of implementation issue with it, or just that you don’t need it.
When you're using a private network v4 address exhaustion doesn't matter much and the simplicity of only 4 octets helps with IP memorability and simplicity. I would still prefer a v6 option though, as keeping private networks on v4 might be contributing to the slow adoption of v6.
Re: DigitalOcean VPC
#17They must be great, my servers are constantly receiving hack attempts from Digital Ocean IPs.
Does this mean that previously to this change, without a software firewall running you'd be vulnerable to attacks on the private network from other customers? (I've never used DO).
Yes.
They also will automatically enable a private network interface for you if you use their Floating IP feature. This caught me by surprise when I found out the hard way :)
Re: DigitalOcean VPC
#18Do they talk at all about what they're using to provide the VPC overlay? I have a DO k8s cluster and it uses Cilium for the CNI, which turns out to be quite useful, so I guess I'm wondering if they're also using Cilium for this. (Over in AWS land, they wrote a CNI for their own VPC networking. It turns out to have many strange limitations. For example, you can only run 17 pods on a certain type of node, because that…
It looks like each physical server in EC2 can have 750 IPs so if your VM is 1/Nth of the server you also get 1/Nth of the IPs.
Re: DigitalOcean VPC
#19Why don’t most VPC providers offer IPv6? Is there some kind of implementation issue with it, or just that you don’t need it.
When you're using a private network v4 address exhaustion doesn't matter much and the simplicity of only 4 octets helps with IP memorability and simplicity. I would still prefer a v6 option though, as keeping private networks on v4 might be contributing to the slow adoption of v6.
Life sure would be easier if "cloud native" meant IPv6-only (except the load balancer) with non-overlapping unique addresses everywhere. 10/8 doesn't go far if you give each VM a /24 and each k8s cluster a /16.
Re: DigitalOcean VPC
#20When are you going to have a datacenter in Brazil? We don't mind if we have to pay more than your listed prices for other locations. We know Brazil is more expensive. Just do it already.
[deleted]