@ArizonaDOT will the new SR-24 extension due to complete this year open in phases (e.g. just to Williams field rd) or will it only open once the path all of the way to Iron Wood is ready?
@bradfitz Yeah… an OUTPUT packet has to match a route first to even make it to the mangle table where you could mark it and use an ip rule to give it the real route you want to steer it. There is something slightly off in that packet pipeline design that makes it hard to internalize
@thockin I came across a mega bug thread re: k8s Deployments only supporting “Always” for restartPolicy. That linked to a feature request where you said people are doing it wrong.
What is the right way to deal with a pod where one container crashing breaks all of them?
@netpeeker @Ben_Pfaff So a new VM coming online would notify every compute node with a VM in the same sec group and all of those nodes would then have to re-pull the security group. N^2 during a launch of 1k VMs in the same group generates some good hate mail.
@netpeeker @Ben_Pfaff Including the full state was a big improvement that wasn’t originally there. When everyone was feeling the pain and hating on rabbitmq it was just basically like “UUID X changed”, then all of the agents would then have to hammer the server with a query to grab X.
@Ben_Pfaff Nah, if a new one came up it wouldn’t get old stuff. It would start the subscription for new events and then do a query for the state of the world.
@Ben_Pfaff Additionally, our patterns were very inefficient early on (notify every SG member something changed and then all need full refresh which was also done over msg queues).
@Ben_Pfaff I don’t think there were fundamental issues. The primary issue was that there wasn’t clarity on the durability requirements of the various queues so to be safe all queues had to be persisted to disk and that was a scaling nightmare because of msg volume.
@mikal Yeah, I think if you’ve already properly committed to managing instances as cattle you would have the scaffolding in place to fan out events to all of your instances to update the iptables rules on membership changes. That wasn’t the case for many customers early on though.
@mikal Openstack security groups can also refer to a group ID in the source/dest so rules are dynamically updated as instances in a reference group come and go.
@distroguy@mikal Yeah, that qbr in the compute node side serves yet another purpose (security groups filtering with iptables). Later versions of openstack have a native OVS security groups option (enforcement in OF rules with conntrack actions) that get rid of that intermediary Linux bridge.