Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DigitalOcean VPC

blog.digitalocean.com

Post reply on HN
Print view View original

21–30 of 169 posts

Re: DigitalOcean VPC

#21

Post by troutwine »

nerdbaggy wrote: post #8
t3rabytes wrote: post #7

Earlier quoted context omitted.

Pretty standard? Taking AWS for example: - You can do this, but it's highly discouraged since it means no VPC peering if you ever need that. - Can't do this at all with network interfaces, it all is via VPC peering. - Can't change the VPC after an instance has been created, you have to take a snapshot and relaunch it.

Interesting, didn’t know that about AWS. In more familiar with the Google cloud version of VPC. Seems the DO implementation is more like the AWS version

For what it's worth VPC ranges are allowed to overlap in GCP -- and do by default -- but then you aren't able to peer them. I kind of prefer the DO/AWS constraint.

Re: DigitalOcean VPC

#22

Post by api »

judge2020 wrote: post #16
nerdbaggy wrote: post #11

Why don’t most VPC providers offer IPv6? Is there some kind of implementation issue with it, or just that you don’t need it.

When you're using a private network v4 address exhaustion doesn't matter much and the simplicity of only 4 octets helps with IP memorability and simplicity. I would still prefer a v6 option though, as keeping private networks on v4 might be contributing to the slow adoption of v6.

> When you're using a private network v4 address exhaustion doesn't matter much

Until you start trying to connect to enterprise networks...

This is seriously ridiculous. It's 2020, and Google and now DO have no IPv6 in their cloud networks.

Re: DigitalOcean VPC

#23

Post by dilyevsky »

tedk-42 wrote: post #12
dilyevsky wrote: post #9

Earlier quoted context omitted.

Better way of doing natively addressable pods is assign whole subnets (like /25) as secondary interface and distribute that to pods via cni. I think gke pod network works that way. Not sure why eks decided 17 pods is ok lol

Wow the ignorance. The AWS CNI which comes with EKS attaches ENIs (think of a NIC) to the instance. The number of these you can attach is dependent on the instance type. Pods get an IP in the CIDR range of the subnet the instance is in. There's no additional network overlay which does any NAT when traffic leaves the instance. If you want you can use your own CNI, but things can break.

Thanks I’m aware that aws hacked the shit out of their inflexible legacy design to support this (as well as hid docs on github and continue to charge you for those ENIs). What else is new?

Re: DigitalOcean VPC

#24

Post by dghughes »

JakeAl wrote: post #5

They must be great, my servers are constantly receiving hack attempts from Digital Ocean IPs.

Texts too with phishing urls in them trace the IPs you find they are digital ocean VMs.

The worst part is here in Canada we have to pay for incoming texts.

Re: DigitalOcean VPC

#25

Post by cbetti »

troutwine wrote: post #21
nerdbaggy wrote: post #8

Earlier quoted context omitted.

Interesting, didn’t know that about AWS. In more familiar with the Google cloud version of VPC. Seems the DO implementation is more like the AWS version

For what it's worth VPC ranges are allowed to overlap in GCP -- and do by default -- but then you aren't able to peer them. I kind of prefer the DO/AWS constraint.

Agreed, having paid the cost of a few VPC moves to separate ranges on AWS in order to gain peering.

Re: DigitalOcean VPC

#26

Post by JonathonW »

api wrote: post #22
judge2020 wrote: post #16

Earlier quoted context omitted.

When you're using a private network v4 address exhaustion doesn't matter much and the simplicity of only 4 octets helps with IP memorability and simplicity. I would still prefer a v6 option though, as keeping private networks on v4 might be contributing to the slow adoption of v6.

> When you're using a private network v4 address exhaustion doesn't matter much Until you start trying to connect to enterprise networks... This is seriously ridiculous. It's 2020, and Google and now DO have no IPv6 in their cloud networks.

DO has IPv6 on the public side of their network.

Couldn't tell you why they've chosen not to use IPv6 for VPC networks, though. Probably just for management simplicity.

Re: DigitalOcean VPC

#27

Post by jkarneges »

SteveNuts wrote: post #10
JakeAl wrote: post #5

They must be great, my servers are constantly receiving hack attempts from Digital Ocean IPs.

Does this mean that previously to this change, without a software firewall running you'd be vulnerable to attacks on the private network from other customers? (I've never used DO).

No. The private network was originally shared across all accounts, but later on they changed it to be isolated per account. It's been that way for a couple of years.

The introduction of VPC just means you can isolate within the same account.

Re: DigitalOcean VPC

#28

Post by res0nat0r »

wmf wrote: post #18
jrockway wrote: post #2

Do they talk at all about what they're using to provide the VPC overlay? I have a DO k8s cluster and it uses Cilium for the CNI, which turns out to be quite useful, so I guess I'm wondering if they're also using Cilium for this. (Over in AWS land, they wrote a CNI for their own VPC networking. It turns out to have many strange limitations. For example, you can only run 17 pods on a certain type of node, because that…

It looks like each physical server in EC2 can have 750 IPs so if your VM is 1/Nth of the server you also get 1/Nth of the IPs.

It is actually based on the ec2 instance type you decide to boot, and generally the bigger the instance the more ENI's you can attach. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-en...

The EC2 k8s network driver they wrote essentially will attach/detach extra ENI's on the fly and pre-allocate IP addresses to your EC2 host to allow for fast pod spin up/down.

I found this article pretty helpful to explain some of the AWS differences: https://www.contino.io/insights/kubernetes-is-hard-why-eks-m...

Re: DigitalOcean VPC

#29

Post by jrockway »

JonathonW wrote: post #26
api wrote: post #22

Earlier quoted context omitted.

> When you're using a private network v4 address exhaustion doesn't matter much Until you start trying to connect to enterprise networks... This is seriously ridiculous. It's 2020, and Google and now DO have no IPv6 in their cloud networks.

DO has IPv6 on the public side of their network. Couldn't tell you why they've chosen not to use IPv6 for VPC networks, though. Probably just for management simplicity.

DO sort of has IPv6. Their load balancers don't do IPv6, and you can't use IPv6 in their managed k8s offering.

(My guess, honestly, is that nobody asks for it. IPv6 is a problem for Some Other Day.)

Re: DigitalOcean VPC

#30

Post by riffic »

flyinprogrammer wrote: post #15

Not being able to reassign, delete, or change the cidr of the default VPC is going to be a problem for most folks. Looking forward to the next release where this is fixed, and the fact that we have day 1 support for Terraform is awesome!

> day 1 support for Terraform

VPC support on DigitalOcean was soft-launched almost a month ago:

https://www.digitalocean.com/docs/networking/vpc/quickstart/

https://www.reddit.com/r/digital_ocean/comments/g1hkhu/digit...

Post reply on HN