Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DigitalOcean VPC

blog.digitalocean.com

Post reply on HN
Print view View original

31–40 of 169 posts

Re: DigitalOcean VPC

#31

Post by rantwasp »

t3rabytes wrote: post #7
nerdbaggy wrote: post #3

I find some of the limits weird https://www.digitalocean.com/docs/networking/vpc/ - VPC network ranges cannot overlap with the ranges of other networks in the same account. (Edit: Does this mean each VPC in the account has to have a non overlapping subnet?) -Resources do not currently support multiple private network interfaces and cannot be placed in multiple VPC networks. - Not being able to change the VPC connecte…

Pretty standard? Taking AWS for example: - You can do this, but it's highly discouraged since it means no VPC peering if you ever need that. - Can't do this at all with network interfaces, it all is via VPC peering. - Can't change the VPC after an instance has been created, you have to take a snapshot and relaunch it.

you cannot peer 2 vpcs that have an overlap but you can have multiple vpcs that have overlaps. it only matters for the 2 vpcs you want to peer

Re: DigitalOcean VPC

#32

Post by caymanjim »

jrockway wrote: post #29
JonathonW wrote: post #26

Earlier quoted context omitted.

DO has IPv6 on the public side of their network. Couldn't tell you why they've chosen not to use IPv6 for VPC networks, though. Probably just for management simplicity.

DO sort of has IPv6. Their load balancers don't do IPv6, and you can't use IPv6 in their managed k8s offering. (My guess, honestly, is that nobody asks for it. IPv6 is a problem for Some Other Day.)

They also only give you 16 addresses. 16! Most providers give you an entire /64 or sometimes even a /48.

Re: DigitalOcean VPC

#33

Post by riffic »

kitotik wrote: post #17
SteveNuts wrote: post #10

Earlier quoted context omitted.

Does this mean that previously to this change, without a software firewall running you'd be vulnerable to attacks on the private network from other customers? (I've never used DO).

Yes. They also will automatically enable a private network interface for you if you use their Floating IP feature. This caught me by surprise when I found out the hard way :)

That suspiciously sounds like an anchor IP address and not an actual private network interface:

https://www.digitalocean.com/docs/networking/floating-ips/

Re: DigitalOcean VPC

#34

Post by KingOfCoders »

t3rabytes wrote: post #7
nerdbaggy wrote: post #3

I find some of the limits weird https://www.digitalocean.com/docs/networking/vpc/ - VPC network ranges cannot overlap with the ranges of other networks in the same account. (Edit: Does this mean each VPC in the account has to have a non overlapping subnet?) -Resources do not currently support multiple private network interfaces and cannot be placed in multiple VPC networks. - Not being able to change the VPC connecte…

Pretty standard? Taking AWS for example: - You can do this, but it's highly discouraged since it means no VPC peering if you ever need that. - Can't do this at all with network interfaces, it all is via VPC peering. - Can't change the VPC after an instance has been created, you have to take a snapshot and relaunch it.

I basically have no clue.

I thought one would have a node two VPC, e.g. app and database, so it can speak to both, but the load balancers can't.

With peering one would have an app VPC and a database VPC and peer them?

Re: DigitalOcean VPC

#35

Post by Legogris »

nerdbaggy wrote: post #3

I find some of the limits weird https://www.digitalocean.com/docs/networking/vpc/ - VPC network ranges cannot overlap with the ranges of other networks in the same account. (Edit: Does this mean each VPC in the account has to have a non overlapping subnet?) -Resources do not currently support multiple private network interfaces and cannot be placed in multiple VPC networks. - Not being able to change the VPC connecte…

> - VPC network ranges cannot overlap with the ranges of other networks in the same account. (Edit: Does this mean each VPC in the account has to have a non overlapping subnet?)

Overlapping subnets tend to be a mistake and will bite you in the behind whenever you want to peer them. What'd be your reason to want overlapping subnets in the first place?

Re: DigitalOcean VPC

#36

Post by vorpalhex »

KingOfCoders wrote: post #34
t3rabytes wrote: post #7

Earlier quoted context omitted.

Pretty standard? Taking AWS for example: - You can do this, but it's highly discouraged since it means no VPC peering if you ever need that. - Can't do this at all with network interfaces, it all is via VPC peering. - Can't change the VPC after an instance has been created, you have to take a snapshot and relaunch it.

I basically have no clue. I thought one would have a node two VPC, e.g. app and database, so it can speak to both, but the load balancers can't. With peering one would have an app VPC and a database VPC and peer them?

In AWS you use a mix of private and public subnets within a single VPC.

Not sure best practice for DO since I haven't tried their VPC setup but it doesn't appear to have a way to let two VPCs interact yet.

Re: DigitalOcean VPC

#37

Post by Legogris »

troutwine wrote: post #21
nerdbaggy wrote: post #8

Earlier quoted context omitted.

Interesting, didn’t know that about AWS. In more familiar with the Google cloud version of VPC. Seems the DO implementation is more like the AWS version

For what it's worth VPC ranges are allowed to overlap in GCP -- and do by default -- but then you aren't able to peer them. I kind of prefer the DO/AWS constraint.

No such constraint in AWS.

Re: DigitalOcean VPC

#38

Post by vorpalhex »

rantwasp wrote: post #31
t3rabytes wrote: post #7

Earlier quoted context omitted.

Pretty standard? Taking AWS for example: - You can do this, but it's highly discouraged since it means no VPC peering if you ever need that. - Can't do this at all with network interfaces, it all is via VPC peering. - Can't change the VPC after an instance has been created, you have to take a snapshot and relaunch it.

you cannot peer 2 vpcs that have an overlap but you can have multiple vpcs that have overlaps. it only matters for the 2 vpcs you want to peer

But AWS tells you to not overlap them, and likely keeps that behavior for legacy reasons.

Re: DigitalOcean VPC

#39

Post by RaitoBezarius »

caymanjim wrote: post #32
jrockway wrote: post #29

Earlier quoted context omitted.

DO sort of has IPv6. Their load balancers don't do IPv6, and you can't use IPv6 in their managed k8s offering. (My guess, honestly, is that nobody asks for it. IPv6 is a problem for Some Other Day.)

They also only give you 16 addresses. 16! Most providers give you an entire /64 or sometimes even a /48.

Wow. In France, home ISP give you a /64 generally (Free for example, known for Online/Scaleway). I think 80 % of their fiber deployments comes with IPv6 enabled now. And in few years, it should be 100 %.

Re: DigitalOcean VPC

#40

Post by tedk-42 »

dilyevsky wrote: post #23
tedk-42 wrote: post #12

Earlier quoted context omitted.

Wow the ignorance. The AWS CNI which comes with EKS attaches ENIs (think of a NIC) to the instance. The number of these you can attach is dependent on the instance type. Pods get an IP in the CIDR range of the subnet the instance is in. There's no additional network overlay which does any NAT when traffic leaves the instance. If you want you can use your own CNI, but things can break.

Thanks I’m aware that aws hacked the shit out of their inflexible legacy design to support this (as well as hid docs on github and continue to charge you for those ENIs). What else is new?

Umm you're not charged for using ENIs. You're thinking of elastic IPs.

Please check your facts before making these claims.

Post reply on HN