Hacker News Reader

Comment by remram | Hacker News Reader

Having read that, I still don't get the point. Especially when running on Kubernetes, where coredns and kube-proxy provide service discovery, load-balancing, and dynamic configuration with no overhead (kube-proxy is not a proxy, it uses NAT). Especially with your own microservices, where you can put all the observability and TLS you want in the services.

Is this another of those things that has valid use cases for very specific applications but everyone is mistaking for a best practice somehow?

View on HN

Uniform error handling, smart retries, application independent tracing, load shedding, layer 7 based traffic splitting, etc. are benefits not included in the stock l4 based machinery.

If all your micro services use the same base libraries, then it is true you can implement these things there.

Also, the overhead of service meshes are rapidly reducing, with more happening in the net filter layer.

What kind of error handling are you talking about? What kind of tracing can you really do without either endpoint's cooperation? I am familiar with OpenTelemetry, which is all about carrying identifiers through multiple layers; you can't do that with "just" a smart transport.

I just don't get it. Maybe I haven't dealt with a messy enough mix of microservices.

In any case, if you want to add goodies to layer 4, you have to add overhead, by definition. Netfilter can't do any of that "layer 7 traffic splitting" or "smart retries" or even "error handling" since it operates (mostly) at layer 3.

Example error handling like retries, but only up to a certain budget so you don’t 2x traffic when there’s a downstream outage. Traffic aware routing within an AZ so you don’t pay cross-az traffic unless an error causes you for retry.

> coredns and kube-proxy provide service discovery

Is service discovery an anti-pattern? Is someone is already in your house, do you want to give the burglar directions to where the valuables are kept?

Service Discovery isn’t about exposing a directory of services, but mapping a name to an endpoint.

If you have pods going up and down, you need some way of discovering which ones are currently up and healthy and can be used vs which ones are not. That information has to exist somewhere.

Reply on news.ycombinator.com