Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS is for people, not for IT infrastructure

louwrentius.com

Post reply on HN
Print view View original

61–70 of 102 posts

Re: DNS is for people, not for IT infrastructure

#61

Post by bravetraveler »

louwrentius wrote: post #17
gfody wrote: post #10

> we'll just use /etc/hosts no DNS required! this is classic "easy vs. simple" folly, witness how someone too lazy to [learn how to] setup proper DNS for their infrastructure will do 10x the work hacking something "easy"

Serious response: how is templating out /etc/hosts with Ansible not 10x simpler than setting up an additional service that only introduces additional risk?

Serious answer: I run [and must maintain] 100x fewer resolvers than hosts. If an endpoint changes or a host leaves/returns, I'm much better served (heh) by pointing templates at resolvers instead of the horde.

Re: DNS is for people, not for IT infrastructure

#63

Post by bigstrat2003 »

louwrentius wrote: post #22
mixdup wrote: post #4

"just use /etc/hosts" is wild. That is effectively just going from one DNS server servicing all of your machines to having bespoke DNS servers individually running on every host. madness

Why is that madness and not amazing? Isn’t the simplicity beautiful? Managing /etc/hosts with a tool like Ansible?

There is absolutely nothing simple about managing a hosts file across your fleet rather than DNS.

Re: DNS is for people, not for IT infrastructure

#64

Post by axus »

louwrentius wrote: post #17
gfody wrote: post #10

> we'll just use /etc/hosts no DNS required! this is classic "easy vs. simple" folly, witness how someone too lazy to [learn how to] setup proper DNS for their infrastructure will do 10x the work hacking something "easy"

Serious response: how is templating out /etc/hosts with Ansible not 10x simpler than setting up an additional service that only introduces additional risk?

As an /etc/hosts enjoyer, I wouldn't want Ansible overwriting my customized hosts file.

Re: DNS is for people, not for IT infrastructure

#65

Post by monkpit »

louwrentius wrote: post #30
necovek wrote: post #21

Earlier quoted context omitted.

The examples you cite (eg. 2021 Facebook outage) have nothing to do with DNS being used for internal infrastructure. In the other example (Amazon DynamoDB issue), the problem is with dynamically choosing from a large dynamic pool of IP addresses for a service — DNS is but one mechanism to do it. If it wasn't DNS, it could have been something else that did that job that was broken. Even /etc/hosts if it was updated wi…

I do state in the article that in the examples DNS isn't the root-cause, but the blast radius is very significant. Regardless of the topic of external/internal services, isn't it remarkable that a group of very smart and well-paid people create such circular dependancies? Yet, I'm not arguing for Facebook or similar size companies to ditch DNS internally. I'm making the argument for much smaller organisations to paus…

> even an broken update to /etc/hosts is probably easier and faster to recover from than a broken DNS service

I fail to see how, especially if you were to accidentally break your ability to push those updates out.

Re: DNS is for people, not for IT infrastructure

#66

Post by kube-system »

louwrentius wrote: post #17
gfody wrote: post #10

> we'll just use /etc/hosts no DNS required! this is classic "easy vs. simple" folly, witness how someone too lazy to [learn how to] setup proper DNS for their infrastructure will do 10x the work hacking something "easy"

Serious response: how is templating out /etc/hosts with Ansible not 10x simpler than setting up an additional service that only introduces additional risk?

Because managing one database using mature tooling that is purpose-built is easier than managing 10,000+ databases using a homegrown solution with exponentially more complicated software that wasn't built for that purpose.

Re: DNS is for people, not for IT infrastructure

#67

Post by kube-system »

louwrentius wrote: post #32
XYen0n wrote: post #28

DNS is merely one implementation of service discovery; even without DNS, some other form of service discovery would still be needed.

Why would some form of service discovery be required? No need to discover things if you can push said information in configuration updates using tools like Ansible, pyinfra, and so on?

You probably don't need service discovery if your entire infrastructure is small enough that the whole thing is deployed with Ansible.

Re: DNS is for people, not for IT infrastructure

#68

Post by throwway120385 »

louwrentius wrote: post #32
XYen0n wrote: post #28

DNS is merely one implementation of service discovery; even without DNS, some other form of service discovery would still be needed.

Why would some form of service discovery be required? No need to discover things if you can push said information in configuration updates using tools like Ansible, pyinfra, and so on?

What you're asking is akin to "why do people sometimes need a boat to get from point A to point B? All I've used are cars and I think that should be fine."

Re: DNS is for people, not for IT infrastructure

#69

Post by throwway120385 »

ryanshrott wrote: post #59

Everyone's dunking on /etc/hosts, but I've debugged enough production DNS loops to get the temptation. It's not the right answer, but the impulse isn't crazy either.

At the very least you can put it at the bottom of your /etc/resolv.conf prioritization and put some backup systems like an SSH bastion in /etc/hosts so that there's some system out there that you can reach with mutual-auth in the event that your DNS is REALLY messed up.

Re: DNS is for people, not for IT infrastructure

#70

Post by throwway120385 »

JackSlateur wrote: post #49
louwrentius wrote: post #23

Earlier quoted context omitted.

Tell me please what the problem is exactly

Please describe how you plan to use ansible to deploy config in ~200k containers, with hundreds of data updates per day

The real "fish out of water" question is "tell me how to use Ansible to configure 200k embedded appliances where the end customer doesn't always allow firmware updates through their firewall?"
Post reply on HN