Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS is for people, not for IT infrastructure

louwrentius.com

Post reply on HN
Print view View original

51–60 of 102 posts

Re: DNS is for people, not for IT infrastructure

#51

Post by JackSlateur »

louwrentius wrote: post #30
necovek wrote: post #21

Earlier quoted context omitted.

The examples you cite (eg. 2021 Facebook outage) have nothing to do with DNS being used for internal infrastructure. In the other example (Amazon DynamoDB issue), the problem is with dynamically choosing from a large dynamic pool of IP addresses for a service — DNS is but one mechanism to do it. If it wasn't DNS, it could have been something else that did that job that was broken. Even /etc/hosts if it was updated wi…

I do state in the article that in the examples DNS isn't the root-cause, but the blast radius is very significant. Regardless of the topic of external/internal services, isn't it remarkable that a group of very smart and well-paid people create such circular dependancies? Yet, I'm not arguing for Facebook or similar size companies to ditch DNS internally. I'm making the argument for much smaller organisations to paus…

TTL caching

We are talking about 300sec (=5Min), this is never an issue

Re: DNS is for people, not for IT infrastructure

#53

Post by throw0101a »

bot403 wrote: post #13
Bratmon wrote: post #3

> Instead of configuring domain names that may not resolve, we can just directly inject the appropriate IP address(ess) into configuration files Because now you've replaced one single point of failure configuration system with caching and TTLs (DNS) with a higher maintenance and much less widely supported one.

Not to mention losing load balancing and failover.

Failover can be done with something like keepalived. VRRP/CARP are a thing.

For LB you'll need something in front of your service to bounce connections around, which is replacing one point of failure (DNS) for another (HAproxy, IPVS). Though I guess you can run the LB stack on your app service servers.

Re: DNS is for people, not for IT infrastructure

#54

Post by louwrentius »

JackSlateur wrote: post #49
louwrentius wrote: post #23

Earlier quoted context omitted.

Tell me please what the problem is exactly

Please describe how you plan to use ansible to deploy config in ~200k containers, with hundreds of data updates per day

I would not use containers in the first place as this adds added complexity and overhead in the first place.

Re: DNS is for people, not for IT infrastructure

#55

Post by mixdup »

louwrentius wrote: post #22
mixdup wrote: post #4

"just use /etc/hosts" is wild. That is effectively just going from one DNS server servicing all of your machines to having bespoke DNS servers individually running on every host. madness

Why is that madness and not amazing? Isn’t the simplicity beautiful? Managing /etc/hosts with a tool like Ansible?

Why not manage your one single DNS server with a tool like Ansible? Why fragment it and have to manage it on dozens/hundreds/thousands of endpoints instead?

Re: DNS is for people, not for IT infrastructure

#56

Post by JackSlateur »

louwrentius wrote: post #54
JackSlateur wrote: post #49

Earlier quoted context omitted.

Please describe how you plan to use ansible to deploy config in ~200k containers, with hundreds of data updates per day

I would not use containers in the first place as this adds added complexity and overhead in the first place.

Please share how to manage ~200k applications without containers

Re: DNS is for people, not for IT infrastructure

#58

Post by Bratmon »

louwrentius wrote: post #17
gfody wrote: post #10

> we'll just use /etc/hosts no DNS required! this is classic "easy vs. simple" folly, witness how someone too lazy to [learn how to] setup proper DNS for their infrastructure will do 10x the work hacking something "easy"

Serious response: how is templating out /etc/hosts with Ansible not 10x simpler than setting up an additional service that only introduces additional risk?

If you're worried about bad DNS changes causing problems, then you should be terrified about bad Ansible changes.
Post reply on HN