Hacker News Reader

Comment by api | Hacker News Reader

K8s networking is just typical networking. Networking always has to be made as complex and clunky as possible. Obvious solutions like unified IPv6 address space must be avoided as they would simplify the system and avoid the need for NAT.

I’m being snarky but it is a long time observation of mine. When I see a network config I am more often than not shocked by its needless complexity.

View on HN

Folks who say stuff like this aren’t taking into account the number of real world constraints on networking at a large scale. There are bandwidth, reliability, security, management, cost, and performance considerations behind the complexity, just as there are at other layers of the stack. Folks higher up the stack want a simpler abstraction, but you can’t short-circuit physical limitations with a unified IP space.

To take the first property you mention, as an example: How do you feel bandwidth is helped by the proxying / NAT approach compared to traditional IP routing and Internet addressing?

Caching proxies and traffic controlling NAT.

Why do you need NAT to have caching or traffic control?

"K8s networking is just typical networking."

K8 networking is far more complex than typical networking and with less visibility

That is not fair, kubernetes uses the same existing technology in a well integrated fashion, including firewalling. That is what Network Policy and Service objects gives you.

Communication between pods running across different computers gets encapsulated in another IP packet. This is pretty standard across the industry.

To your point, which “k8s networking”? My beef with k8s is that it punts on networking altogether and you have to cobble your own with some CNI or another, and depending on which you choose it will significantly impact upstack choices such as load balancing and ingress as well as downstack choices, such as whether you can use Tailscale to connect multiple nodes together (the CNI and load balancer must be compatible with). At least this has been my experience as someone who isn’t a network specialist.

Reply on news.ycombinator.com