Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS is for people, not for IT infrastructure

louwrentius.com

Post reply on HN
Print view View original

41–50 of 102 posts

Re: DNS is for people, not for IT infrastructure

#41

Post by protocolture »

louwrentius wrote: post #36
irjustin wrote: post #20

Hard disagree - only because if you didn't have DNS you would have something else in its place. But, we understand DNS _very_ well. People, services, machines, etc need to "dial" canonical-somewhere. Whatever does the canonical management is the piece that when it breaks everything breaks. Doesn't matter if it's DNS, EIP rotation, some HA proxy, whatever. It'll break. It's actually that DNS is so well understood that…

> Whatever does the canonical management is the piece that when it breaks everything breaks. That is absolutely true. I believe that a solution where you provision a text file with an updated ip address or /etc/hosts file is inherently simpler, less risky and easier to recover from, although I admit I don't explicitly state this in the article.

>I believe that a solution where you provision a text file with an updated ip address or /etc/hosts file is inherently simpler, less risky and easier to recover from

You are wrong. Its possible that your confidence in being wrong is due to your inexperience. But you are still wrong.

Re: DNS is for people, not for IT infrastructure

#42

Post by louwrentius »

simonjgreen wrote: post #35

This author has clearly never operated internal infrastructure at scale. The measures proposed in this are home lab grade at best, and require ludicrous levels of precision and overhead for something that changes thousands to tens of thousands of times per day. And for very specific nit picks, and I can’t believe I’m entertaining this idea enough to ask, but tell me how the new device on the network bootstraps withou…

I wasn't talking about an office environment. I'm talking server-to-server communication. Like all the internal infrastructure to support a web application. Maybe I should have been more explicit about that.

How a new device bootstraps on the network without DNS? Depends, on the device, but a physical server doesn't need DNS, only PXE boot / TFTP / HTTP as usual and maybe a proxy to access an update server if you don't run one yourself.

Re: DNS is for people, not for IT infrastructure

#44

Post by frollogaston »

Why is DNS for people only? The article suggests rolling your own DNS with static config, which I could see myself doing in the right scenarios, but you can't always do that. Kinda reminds me of Kubernetes, though instead of /etc/hosts it runs an actual DNS server.

Re: DNS is for people, not for IT infrastructure

#45

Post by protocolture »

simonjgreen wrote: post #35

This author has clearly never operated internal infrastructure at scale. The measures proposed in this are home lab grade at best, and require ludicrous levels of precision and overhead for something that changes thousands to tens of thousands of times per day. And for very specific nit picks, and I can’t believe I’m entertaining this idea enough to ask, but tell me how the new device on the network bootstraps withou…

OP will just reinvent Netbios running over Ansible.

Re: DNS is for people, not for IT infrastructure

#46

Post by irjustin »

louwrentius wrote: post #36
irjustin wrote: post #20

Hard disagree - only because if you didn't have DNS you would have something else in its place. But, we understand DNS _very_ well. People, services, machines, etc need to "dial" canonical-somewhere. Whatever does the canonical management is the piece that when it breaks everything breaks. Doesn't matter if it's DNS, EIP rotation, some HA proxy, whatever. It'll break. It's actually that DNS is so well understood that…

> Whatever does the canonical management is the piece that when it breaks everything breaks. That is absolutely true. I believe that a solution where you provision a text file with an updated ip address or /etc/hosts file is inherently simpler, less risky and easier to recover from, although I admit I don't explicitly state this in the article.

I'm surprised at this and some of your other responses. It makes me believe you've never managed anything at scale, but then why have such a strong opinion about DNS for infra?

> I believe that a solution where you provision a text file with an updated ip address or /etc/hosts file is inherently simpler

So simple that it doesn't scale beyond a few machines nor outside your org.

Re: DNS is for people, not for IT infrastructure

#47

Post by davkan »

I’m not sure I’ve seen unanimous agreement in an HN comment section before so that’s nice I guess.

But to address the article in a simple environment dns _just_works_. I’ve never once had an issue with bind. It’s incredibly simple and stable and easy to understand when working with within a small environment without much churn and enables other technologies to operate in an expected way because it’s the standard. ACME, kerberos, sshfp, many more are enabled by DNS. Sure maybe you can kludge some of that back together with hosts but I’d rather not just to replace one of the most stable services that exist.

DNS does start to get more complicated in massive environments but that’s just a reflection of the environment. Using ansible to manage /etc/hosts across hundreds or thousands machines with churn will not be less complicated to manage than dns.

Re: DNS is for people, not for IT infrastructure

#48

Post by JackSlateur »

louwrentius wrote: post #42
simonjgreen wrote: post #35

This author has clearly never operated internal infrastructure at scale. The measures proposed in this are home lab grade at best, and require ludicrous levels of precision and overhead for something that changes thousands to tens of thousands of times per day. And for very specific nit picks, and I can’t believe I’m entertaining this idea enough to ask, but tell me how the new device on the network bootstraps withou…

I wasn't talking about an office environment. I'm talking server-to-server communication. Like all the internal infrastructure to support a web application. Maybe I should have been more explicit about that. How a new device bootstraps on the network without DNS? Depends, on the device, but a physical server doesn't need DNS, only PXE boot / TFTP / HTTP as usual and maybe a proxy to access an update server if you don…

"How a new device bootstraps on the network without DNS?"

DHCP

Re: DNS is for people, not for IT infrastructure

#49

Post by JackSlateur »

louwrentius wrote: post #23
jghefner wrote: post #12

> It's easy to configure systems with tools like Ansible or pyinfra at scale. Tell me that you've never used Ansible at scale without telling me that you've never used Ansible at scale.

Tell me please what the problem is exactly

Please describe how you plan to use ansible to deploy config in ~200k containers, with hundreds of data updates per day

Re: DNS is for people, not for IT infrastructure

#50

Post by necovek »

louwrentius wrote: post #30
necovek wrote: post #21

Earlier quoted context omitted.

The examples you cite (eg. 2021 Facebook outage) have nothing to do with DNS being used for internal infrastructure. In the other example (Amazon DynamoDB issue), the problem is with dynamically choosing from a large dynamic pool of IP addresses for a service — DNS is but one mechanism to do it. If it wasn't DNS, it could have been something else that did that job that was broken. Even /etc/hosts if it was updated wi…

I do state in the article that in the examples DNS isn't the root-cause, but the blast radius is very significant. Regardless of the topic of external/internal services, isn't it remarkable that a group of very smart and well-paid people create such circular dependancies? Yet, I'm not arguing for Facebook or similar size companies to ditch DNS internally. I'm making the argument for much smaller organisations to paus…

As said, I believe you are simplifying the problem significantly and thus making general claims which do not hold water.

Eg. even if you are DNS based but have direct SSH access to the system which has a query cached and root access on it (you need to manage all this too!), you can temporarily edit /etc/hosts or /etc/resolv.conf to workaround the cached value.

So my suggestion remains to keep working on a better argument and scenario by trying to understand exactly where your intuition applies — but be critical to yourself too, and think through if your alternative has any other cons too.

By doing so, you will likely find why everybody defaults to DNS for a named service registry in a sense.

Post reply on HN