Hacker News Reader

Comment by redwood | Hacker News Reader

Anyone wonder if k8s is about to enter its trough of disillusionment phase?

Sorry for the rant in advance.

I'm tired of k8s as a hammer tool where every project looks like a nail.

It's scary to imagine how many servers are idling with zero traffic load doing nothing. Even in-house systems without any scaling ambition deployed to k8s.

Of course, you have to reserve 1 cpu + 1 gb for k8s needs on each server (you have 3 minimum) sitting here reserved, doing nothing. You can't use it for rare spikes of load (compiling, some rare data upgrades) and you have to buy additional resource to cover you needs while default resource requirements just idling because zero traffic of the system.

I'm sure it wasting more resources than all crypto-fads combined.

I'm happy to see more companies realise that and using just bare servers or docker swarm / nomad if they want to dive into DevOps and CI/CD practices.

K8s is a great tool for particular problems (you have at least tens/hundreds of servers, DevOps team more than 2 employees, you are getting at least 1k RPS at low traffic part for the day, have several SRE and so on).

Most probably your system is overengineered and resume driven if you need static k8s cluster and don't have any consumer facing interfaces (i.e. general low traffic usage pattern).

If you have different opinion I'll be happy to hear your points.

I think there is a lot of value in just following the k8s workflow for everything rather than a different deployment solution for every random app.

Not that I disagree with your post, I really dislike Kube and would like to see something else take its place, but there are situations where I could see using it just to use the same tools and workflows across the entire org.

Our company has been trying to get production sites on Kube for 4 years. We have had so many problems with our development sites that it just isn’t ready. Maybe at the end of the year.

Indeed. I'm still holding off, in the hope it will go away (like Openstack), but it does seem like it has some more stamina as a project.

OpenStack didn't go away for large users who need to run IaaS/*aaS. OpenStack codebase is/was a giant, warm pile, but honestly k8s isn't all that either. I've heard and seen tons of k8s horror stories, I won't touch it. Give me Xen/KVM/ESXi to chop up a large box into a virtual lab and then Docker inside that on a custom Docker VM. These giant, support everything (poorly) "solutions" aren't all that helpful.

The problem of hype is that it's usually to evangelize marginal projects while better ones march along in obscurity.

Kubernetes is a nice choice for specific usecases (like, well, battle-tested container orchestrating & scheduling), but overhyping it with references like "Kubernetes is a data center operating system" is absolute mess, IMO. You can't put everything in Kubernetes.

And it's also applies to OpenStack which is more than alive. While its ecosystem consists of horde of different solutions, plain nova/neutron/cinder are matured and efficient solutions to roll your own private IaaS.

Sticking to Docker for local projects for now

No thanks. It's a huge security dumpster fire as well.

Well if you're uncomfortable with its priviged daemon, you can always switch to CRI-O with Red Hat tooling for it. But for all my years with Docker as the container runtime, all security related problems have occured within the backend code, not Docker, not Linux cgroups, not Linux itself.

I've worked with some big customers in the financial industry, and this is exactly what we do. Podman implements the same CLI as docker, so you can basically just `s/docker/podman/g` (as long as you don't use docker-compose).

It's also a lot easier to debug and see what's happening without that daemon sitting in the middle of all the traditional linux tools.

Could you elaborate please and what approach do you recommend?

containers in general are horrible wrt security because they are architecturally flawed - they pretend to have some sort of 'isolation' but that was crap docker marketing people just made up - there is no isolation - k8s pushes this agenda further by declaring that multi-tenant workloads are perfectly normal and ok for containers which they absolutely are not

just look at the CVEs from recent years:

* docker doomsday * escaping like a rkt * cryptojacking? - that didn't even exist until containers were here!

Reply on news.ycombinator.com