Hacker News Reader

Comment by umvi | Hacker News Reader

My problem with Kubernetes is my problem with with front-end web frameworks - they introduce too much complexity to the point of being esoteric for simple systems.

If you have a simple website built on boring technologies like HTML, CSS, and vanilla JS, then nearly anyone can read, understand, and make changes to it, even backend developers. If you instead wrote it in React/Webpack/etc. then suddenly only frontend experts can understand and contribute and debug.

Same with k8s. If you make a cloud backend using boring technologies like plain old programs calling APIs then nearly anyone can read, understand, and make changes to it. But if you instead make it use a big pile of configuration files with a million switches then suddenly only k8s experts can understand and contribute and debug.

I'm not saying don't use ReactJS or Kubernetes, I'm just saying make sure that the benefits you get from switching to it outweigh the new complexity and therefore expertise required to understand and debug it.

View on HN

In my opinion, the complexity is something that's entirely your own making.

k8s can be as simple or as complex as you like it to be and really isn't any more complex than setting up a VM (provided, you are using cloud provided k8s).

Want to run an application? Write a deployment file. Want to expose that application to other applications? Write a service file. Want to expose the application to people outside the k8s cluster? Write an ingress. Want some configuration? Write a config file.

With that, you've got the basics of k8s. None of this would be made easier without k8s. If you had just a VM, well, now you need to figure out how to get your deployable in the image. If you want to expose your app to others, you need to configure the routing. If you want it private, you need to configure the VPC correctly. If you want to configure the app, now you need to figure out how to set that up.

After the initial learning curve, k8s ends up being, frankly. What I've listed here is like 90% of what any dev needs to learn or use in k8s. Everything else can be learned on the fly based specific requirements.

How do you make Kubernetes as simple as you'd like it to be? Even trying to deploy simple apps is several times more complicated than any other similar system I've used.

Expired cert, but that is how simple it can be: https://k8syaml.com/

Fill out web form,and apply yaml to cluster via CLI. It is really that simple for simple apps.

It depends on your requirements, for basic development setup, you just need modern computer with installed Docker, k3d that runs in Docker containers and Tilt to build/deploy your docker image to local k3d docker registry and little k8s configuration.

You can just use basic concepts, so if all you need is container that exposes your application, you can just prepare Dockerfile, Tiltfile and k8s yaml file with deployment, service (LB) and use Tilt to automatically apply it to cluster, when you make any source code changes. Do you need to run some script once or periodically? Single k8s yaml file with Job/CronJob might be enough.

Often that's all that is needed, but maybe you need to additionally provide some env variables, use some secret values, create/mount volume to your container or deploy supporting infrastructure (databases/messages queues/authentication server/ci/cd/monitoring/tracing/alerting) or get into advanced use cases like chaos engineering, service mesh, serverless, workflow engine (CI/ML).

Kubernetes requires knowledge and experience to use all of its features and ecosystem, but you don't need to know it all from the start at expert level. However you need to actually learn Kubernetes, if you want to scale your solution, because eventually more people/teams might get involved, need for cooperation increases and non-functional requirements become more important and that's when you really start to appreciate Kubernetes.

> (provided, you are using cloud provided k8s).

Well, there you cheated ;)

K8s is easy if:

- you pay for cloud provided k8s

- you don't deviate from the happy paths

- you have someone who's going to fix your cluster when you deviate from the happy path

Infrastructure is hard. K8s is a black box wrapping such complexity, but the moment something goes wrong with, let's say, DNS, well, you have to know about DNS to fix the problem (and on top of that you have to know how to fix the problem the k8s way)

> you pay for cloud provided k8s

From what I've seen, the cloud provided k8s isn't much more expensive than the vms for the nodes themselves. Amazon's EKS, for example, is $0.10 per hour per cluster on top of the ec2 instance price for the nodes you select.

So why wouldn't you do that?

> you don't deviate from the happy paths

Agreed, but if you are deviating from happy paths, it is, IMO, valid to question if k8s is even the right choice. For example, I think k8s is a bad choice if you want to host stateful infrastructure like a DB.

Very large swaths of infrastructure are covered by stateless services.

> you have someone who's going to fix your cluster when you deviate from the happy path

This is pretty much axiomatic of any infrastructure. If someone screws up your vm, you need someone who's going to fix your vm when you deviate from the parameters given for allocating vms.

> Infrastructure is hard.

Agreed

> K8s is a black box wrapping such complexity, but the moment something goes wrong with, let's say, DNS, well, you have to know about DNS to fix the problem (and on top of that you have to know how to fix the problem the k8s way)

When DNS goes wrong anywhere, you have to know how to fix DNS the envoy way, the consul way, the coredns way, the pihole way, the ubuntu way, the freebsd way.

The happy path for k8s is really happy. The sad path is no worse than the sad path of any sort of deployment infrastructure. The default bells and whistles of k8s is something that solves way more problems than is created by needing to learn a new system (For example, liveliness and readiness checks, or cert handling).

But not only that, because k8s is becoming (rightfully) so popular, it means that issues you run into are almost always a google away. There are a ton of resources and patterns that are globally applicable to pretty much any k8s cluster.

> k8s is a bad choice if you want to host stateful infrastructure like a DB

You cheated again ;) Now we're only running the easy stateless stuff on k8s?

I thought k8s gives us simple abstractions that make running stateful services a breeze.

Why is that cheating?

I honestly don’t see why focusing on the strengths of a tech and avoiding the weaknesses is considered “cheating”. The whole point of my initial post was “k8s can be as simple or as complex as you want to make it”.

It’s not “cheating” to focus on the parts of k8s that make it simple. It’s not “cheating” to use a tech for it’s strengths and not it’s weaknesses.

You could technically use (and some people do use) redis as your primary data store. Is it “cheating” to suggest that’s not a good idea? Is it a bad idea to pull it in to your infrastructure even though it’s not a great at permanent storage?

K8s biggest value add is stateless applications. I’ve never suggested otherwise. You can get in the weeds of managing volumes and state if you like, but that adds a fair bit of complexity that, IMO, isn’t worth it vs something like a managed db instance from your cloud provider.

I honestly don’t get the “you are cheating by using and benefiting from the simplest features and setup of k8s like you said others should do!”

I'm running postgres inside k8s. It's very easy. I don't know why people think that k8s is for stateless.

I used to think of stateful applications on top of k8s as an anti-pattern until I learned a bit more about some databases uses and changed my entire opinion about what k8s is.

If you're coming from the container world, it makes sense to think of orchestration as a way to scale stateless services.

I'd be glad to hear those usecases. I'm still in the camp of thinking it's not a great idea.

I have a hard time thinking coordination between something like postgres and the volume wouldn't be an absolute nightmare to handle. What sorts of volume drivers do you use there? How do you get over the network latency? How does scaling end up working?

I've not used postgres-on-k8s in any real production workload so my opinion on the matter isn't worth glozing about. I'd rather recommend the blog posts and docs fly.io did on it[1]. They themselves rely on Stolon[2].

AFAIK the secret sauce is postgres' ability for streaming replication[3], ie. pass data across instances as it's ingressed. Add some glue and you've got a cluster.

As far as storage goes, k8s supports topology awareness[4] and enables collocating pods and PVs. There are CSI drivers for most file systems you'd encounter in the enterprise[5][6].

> How do you get over the network latency?

Ultimately there are incompressible limits you'll hit (CAP theorem and all that). So you do what everybody does in computing : you cheat by exploiting human perception and treating your reads and writes differently[7].

I'm by no means an expert on the subject, but I hope I've answered some of your questions.

---

[1]: https://fly.io/blog/globally-distributed-postgres/

[2]: https://github.com/sorintlab/stolon

[3]: https://wiki.postgresql.org/wiki/Streaming_Replication

[4]: https://kubernetes.io/blog/2018/10/11/topology-aware-volume-...

[5]: https://kubernetes.io/blog/2019/01/15/container-storage-inte...

[6]: https://kubernetes-csi.github.io/docs/drivers.html

[7]: https://fly.io/blog/globally-distributed-postgres/

You can run database on local volume and not deal with network at all if you don't like it. You can dedicate node for your postrgres instance. Or you can start simple until you hit performance wall and then gradually implement those things. Kubernetes is pretty flexible in that regard.

Maybe "cheating" isn't a good way to put it. It just seems like you're narrowing the scope of what k8s is often used for, and then calling it simple and easy. It'd be like someone saying: "<language> can be as simple or complex as you want it do be: it's actually really easy to write hello world. You should steer clear for anything more complex than that". Well sure, but that's not a great way to convey it's overall complexity.

But I actually agree with your underlying point. I don't see the benefit or running a db on k8s either. Seems like a lot of extra complexity for little to no benefit.

> It just seems like you're narrowing the scope of what k8s is often used for, and then calling it simple and easy.

I mean, to me, that's what it means to simplify.

Even in this post, I see people saying "Hey, it's not actually hard to run postgres in k8s" which, ok, maybe? IDK, seemed like not a great idea to me with the complexity of volume mounts and drivers along with adding extra networking in order to hook it all together.

> <language> can be as simple or complex as you want it do be: it's actually really easy to write hello world. You should steer clear for anything more complex than that

To some extent, that's exactly what I'm saying. I'd argue you can make things more featureful than "hello world" with stateless pods and you can get a lot of benefit out of those. Just like I'd tell a new Java dev "Hey, java is simple, so long as you don't use features like the LambdaMetaFactory, Reflection, or the annotation processor. Some people use those, but IMO they are mostly off limits"

Just because something HAS complex features doesn't mean you should use them (or that using them is a great idea)

> But I actually agree with your underlying point. I don't see the benefit or running a db on k8s either. Seems like a lot of extra complexity for little to no benefit.

And who knows, maybe this is my (our?) inexperience with k8s shining through. Maybe running postgres on k8s is actually highly beneficial. I've just not been convinced that's better than doing something like amazon's RDS or Aurora. The headache of setting up ceph or rook or whatever just seems like a pretty high burden for a pretty low payback.

To me, it's features like deployment rollouts, common logging infrastructure, autoscaling, certificate management/distribution, and recovery that are attractive to k8s and all come mostly out of the box.

Fair enough. I suppose if more people precisely qualified how & why they use k8s while advocating for it, I'd probably have a better overall view of it rather than assuming it's the blessed solution for every use case it targets.

> - you pay for cloud provided k8s

At this point, k8s is a cloud abstraction layer that is flexible enough that what's beneath it doesn't have to be a cloud, but in the vast majority of cases is a cloud. The various managed k8s flavors sit in between bare VMs (you control infrastructure) and any serverless offerings (what's infrastructure?), abstracting away a bunch of hard things while still offering a fair amount of flexibility and control, so you can layer other abstractions on top to make it look and function like serverless functions or a batch pipeline runner to your users or automate operations, governance and compliance tasks.

The primary value (at least as I see it) that k8s adds lies in its API and the built-in automation it layers on top of the cloud (or non-cloud) below, which I find is a surprisingly good fit for a very wide range of needs. That's what many orgs that run k8s on bare metal are really after: Providing infrastructure users with a single well-known, high-quality API and making use of the wealth of compatible tooling and third-party products written against that API.

Once you get to the point where you have a use for a fair amount of k8s features, I've found that home-grown setups tend to approximate a low-quality k8s clone anyway, so running k8s may end up the less painful route in some cases, but bare metal k8s clusters are a lot more rare than cloud-managed ones for a reason. Simpler setups can of course be run with less effort, and in a lot of cases, that's plenty good enough. A single VM with a monolithic app can go a long way, depending on the requirements.

K8s very much isn’t a black box, it’s observable on every level, and has no internal APIs.

> something goes wrong with, let's say, DNS

I ran into exactly this issue for the cert-manager to obtain a LetsEncrypt certificate for our cluster. (The ACME URL was failing inside the pod: no route to host). It took me quite a long time just to figure out it was a DNS related issue because K8s buries technology behind so many layers. How can I make a simple edit to /etc/hosts? Who knows? Ohh and you are not supposed to do it that way anyway. The solution ended up being forcing the cert-manger to run on a node with no DNS issues using such Byzantine terms as "tolerations". Its that bizarre vocabulary where they are obviously trying really hard to abstract something away from you that you would just rather be able to get your hands on. It reminds me of other absurdly complex technologies from the Java world like J2EE and whatnot.

> How can I make a simple edit to /etc/hosts? Who knows?

In case somebody else needs to do this, you actually can:

https://kubernetes.io/docs/tasks/network/customize-hosts-fil...

But as you said, you are "not supposed to". I'd say that if you need to do that, most of the time there's an underlaying issue that needs to be fixed instead and consider editing the hosts file a workaround.

K8s provides a cloud-agnostic solution for (mostly stateless) configuration management.

You have to record which ports your applications listen on, which subdomains are used for what, how to access that storage bucket with the data files in it etc. somewhere. The moment you have more than a couple of individual services managing this all by hand becomes a nightmare. You need a really strong culture of good practice to make sure that the exact production config actually ends up in source control.

You can be a k8s expert, or an expert in your own home-spun configuration management/git-ops workflow. But not having any workflow here just isn't an option in my opinion. You too easily end up with spaghetti infrastructure that everybody is too scared to touch. With k8s I can take my repo of yaml and change cloud providers in an afternoon.

The problem is kubernetes doesn't include any notions of obvious things I'd like to do like parameterizing my deployment - even though all the providers want to sell me kubernetes clusters as a service.

Out of curiosity, what kind of things are you looking for here? “Parametrising what” I guess is the question.

Off the top of my head? Namespaces, base images, configMaps (this should be pretty obvious), monitoring.

Now all of this can be done, but Kubernetes does this thing where it talks extensively about applications and then goes "oh so anyway, um, like, I guess just put that stuff in git?"

Which you can but with what separation? The way my configuration mounts to my applications is probably somewhat application determined, but "where" stuff runs is infrastructure.

None of it matters because K8S doesn't have an answer for any of it: no standard for emitting state from clusters to allow self-configuration, no system to define axes of freedom in configuration shape, no well defined system for say, plugging your applications network requirements into perhaps a clusters policy of what networking should be. No way to expose a set of permissions for reconfiguring my infrastructure to the cluster so RBAC can define a sensible ops model.

K8S is essentially a platform-for-platforms which is why it feels complicated: the moment you have it setup, you realize just how much is actually missing if you try to use it like it bills itself as.

The article makes a similar point in the section titled “A Dictionary Date” — There’s a lot of new concepts and resource types to learn with Kubernetes that force you of your application in a different way. It’s pretty powerful and logical once you learn it, but it does take a different mind set.

Fortunately, the API is programatic, so it’s possible to build abstractions on top to make dealing with those concepts easier. But that can also take a lot of work to build from scratch…

> My problem with Kubernetes is my problem with with front-end web frameworks - they introduce too much complexity to the point of being esoteric for simple systems.

Having seen all the ages of the web, I wouldnt support the attempt to shame frameworks like this. Fiddling the DOM is slow & causes bugs- the quasi-immediate mode version of the web we get so often now kicks ass.

But to the discussion at hand- the fact that you are comparing something as singular & without peer as Kubernetes to web frameworks of which there are many many many betrays the insolidity of your argument. Web frameworks have their own style & choices, many of which are indeed fairly arbitrary. Kubernetes is nothing more than a single control loop pattern, applied again & again & again. It's opionion is simpler than most critics dare to understand.

It's also a very very small pile of configuration to launch a webapp, typically. And this practice & understanding will scale not just "zero to one" but also "one to many". The time spent trying to avoid good useful tools & convince oneself to be selective & narrow in focus seems like a waste to me.

I am a full stack and I use React for the front-end and for me React is not hard. Why? Hear me out. All this talk about k8s being hard is real but not a bad thing. Why? Because our tech and our jobs are hard. Like you said to a non front-end person React from your POV is hard. As much as k8s is hard for a back-end or front-end guy. And that's how you have so many articles about X and Y being so complex and hard, and 90% of the time they are written by people that never really used it and it's not even their job. But then if you ask a front-end dev if he love React and if it's hard for him? At the beginning maybe but now? No. A back-end with Spring/Rails/Next.js... All the same maybe at the beginning but now? No. But try to cross the bridges without being already good at the other stack and this being your daily job; it's always hard.

As a side example I played fighter jet simulators (Falcon BMS, and DCS) and I stopped to play them for a year. Before I could fly and do a full cold start of the F14 [1], the F16, the KA-50, the SU-27 (ok this one is super easy), and I was learning the A10. Now I am looking at all these buttons and I am like: how was I able to do this?? Dang! But when I was into it, it was super easy. That's really the same here. You have the opposite of a honey moon period. At first it's (super) hard, and then it gets super easier and easier and it looks like you are a wizard to others.

And it was the same for me back in the day where people were doing crazy stuff with Mesos. They looked like wizard to me. Then I dived into Mesos, Raft, Peloton, etc... And now it no longer looks so crazy and scary.

I am sure you are doing stuff that look so easy to you but are super hard to others who work on a different part of the stack.

[1] https://www.youtube.com/watch?v=i7oC_Qwq0-w (because it's so cool)

> If you have a simple website built on boring technologies like HTML, CSS, and vanilla JS, then nearly anyone can read, understand, and make changes to it, even backend developers

Ehhhh, or it could be a pile of shit and be unmaintainable. The upside of the ubiquity of react is that once you learn it well, dropping into a react based project is much simpler.

How simple of a website are you talking about? Something so simple not to need a framework could also be equally simple in React, maybe more so because of the ecosystem, dev tools, testing, etc.

To use a concrete example - Swagger UI 2.0 was plain old html, css, and JS. I was able to easily navigate the code and customize it for my previous company with some extra features we wanted. Swagger UI 3.0+ was completely rewritten in React, and I had a super hard time navigating the new source code and trying to figure out how to achieve the same basic things I did with 2.0 with some minor JS tweaks. I'm sure if I invested a few days/weeks becoming a React expert I would be able to do it. But I wasn't willing to do that, so as a result, we are still on Swagger UI 2.0.

Judge for yourself:

Swagger UI 2.0: https://github.com/swagger-api/swagger-ui/tree/2.x

Swagger UI 4.0 https://github.com/swagger-api/swagger-ui

I finally got to look at the source code.

There's a lot going on, and it's pretty well organized into components and small files. The worst thing is the flat file structure.

Diving into a React codebase definitely requires some process and familiarity with dev tools, common patterns and React in general, but the upside is that the process is repeatable. Doesn't do you a lot of good for diving into a random codebase, but as a pro React dev, I can hit the ground running much faster than with a project of similar complexity.

If you're using docker, then your project is already complex enough to migrate to k8s. You can install kubernetes on a single node, without any clustering, just to get its API and run your workloads there. It'll cost you 2GB of RAM. It won't be HA, but it'll be much more sane than docker.

I'm saying it as a person who avoided k8s as much as I could, but in the end I loved it. Yes, it has some learning curve, but after that it's good.

See, I find the most compelling part of k8s being that it makes it a lot easier to integrate different systems. It provides a standard way to define your system/service, which allows easy interoperability.

Quite frankly, the only difference between a developer who can understand React and a developer who cannot: one read the doc and the other didn't.

> My problem with Kubernetes is my problem with with front-end web frameworks - they introduce too much complexity to the point of being esoteric for simple systems.

I used to think the exact same thing but came to the realization that the complexity doesn't come from the tools, it comes from the people who misuse them.

Having a set of basic config files for Kubernetes is very easy, there are a few concepts to understand but it's something anyone can learn in a matter of hours (images, containers/pods, deployments, services, volumes and ingress) and the power of abstracting your whole infrastructure in a bunch of reusable YAML lines is pretty damn cool.

The same goes for things like React, once you understand the basic semantic blocks (components, props, state and more recently effects) you're 80% of the way there.

Problems arise when the "I'm so smart and look what I can do!" kind of dev starts telling you that using basic boilerplate is not good enough and that you should specify all the optional values as well because "cOnTrOl", or that `create-react-app` is not good enough because "you don't really understand what happens behind the scene", but guess what? I don't care what happens behind the scenes, the same way I don't care what cc and ld do to compile and link my C code. `create-react-app` is more than enough for 99% of production grade apps.

Problems arise when frontend devs need (or feel the need) to become experts in the build systems (one of the reasons why bun has become popular so quickly, standardized, included build system) or to introduce unnecessarily verbose conventions.

There are two keywords in your comment that perfectly describe what I'm talking about: "Webpack" and "big pile of configuration files". Neither of those things are necessary when using K8s or React.

It's overzealous devs who think micro-optimizing 5 ms off of the build process is worth writing 15 more YAML files that contribute to this false sense of "complexity". But when you think about how much you need to write in K8s (for most SQL DB backed web APIs we're talking about 3/4 files of 10 lines each) vs what you get in return (you can spin up a 1:1 copy of your entire infrastructure in a few seconds on any K8s compatible cluster, without worrying about the underlying hardware, to an extent) the tradeoff is clearly in favor of using it.

As an example I'm working on a project where if I needed another worker I could just add a few lines to the K8s configuration, commit, push and magically have that worker up and running in the cluster in no time. Whereas traditionally you'd have to contact someone from the infra team, specify the characteristics of the machine, operating system, set it up, connect it to the network etc. with K8s everything is handled in those few files. IMO it's better than magic.

> If you have a simple website built on boring technologies like HTML, CSS, and vanilla JS, then nearly anyone can read, understand, and make changes to it, even backend developers. If you instead wrote it in React/Webpack/etc. then suddenly only frontend experts can understand and contribute and debug.

The problem with this thinking is you assume that the backend developers know HTML, CSS and vanilla JS, but don't make that assumption for React/Webpack/etc because then your argument wouldn't be valid.

Reply on news.ycombinator.com