Hacker News new | ask | show | jobs
by catern 3624 days ago
Or you could just give every container a real IPv6 address, no need for any magic...
1 comments

Nothing against that either but some people can't do it due to hybrid deployments, providers that don't give you a /64, or providers that don't offer V6 at all.

Currently Amazon, Google, and Azure have no native IPv6 support.

Also many are allergic to the security implications. You have to be rigorous with ip6tables and making sure everything speaks SSL or another encrypted protocol using authentication in both directions. Many things do not support SSL or don't support bidirectional auth.

Personally I doubt overlay networks are going away. Most backplane software like databases, distributed caches and event servers, etc. offers literally no security because it's all built with the assumption that it will run on a secure backplane. I have personally railed against this for years but I've found that it's a total waste of breath.

Which provider won't give you a /64 (that supports IPv6 at all)?

Even my residential cable provider gives me a /60. Anything less seems absurd.

I've seen smaller ones do /128. Probably just cluelessness.

The bigger issue is the need for a secure backplane, which will remain until all server software authenticates all sockets in a strong way.

I agree re: the secure backplane (though I would prefer to see it done outside server software in a more comprehensive manner).

I'm surprised that the bar isn't set a bit higher inside the cloud provider infrastructure for tenant separation at the network level. I suppose it boils down to the lack of assurance at an even lower level (who trusts Xen these days?) that seems unlikely to be fixed in the short term.