Tink vs OVN-Kubernetes
OVN-Kubernetes is OpenShift's default CNI. It also exposes ovnkube-node, OVN northbound/southbound, and OVS datapath gauges for Prometheus. That is not a mechanic. Tink installs in one command, watches the Linux server, explains what is wrong, and helps you fix it.
OVN-Kubernetes scrapes OVS. Tink answers “why is this VPS sick?”
Accidental sysadmins land on OVN-Kubernetes because every OpenShift networking diagram includes ovnkube-node. Then the volume fills, nginx dies, and Grafana still shows Geneve tunnels — no PromQL matched host fill. A filling /var is a Tink warning; it is not an OVN-Kubernetes job unless the overlay itself is the failure.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep scraping OVN-Kubernetes if you already operate OpenShift and need CNI SLOs. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | OVN-Kubernetes |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Hours — ovnkube-master, ovnkube-node, OVN northbound/southbound DBs, Geneve, and prometheus.yml scrape |
| What you get | Working monitoring, diagnosis, and approved fixes | A CNI scrape target. Host disk fill, nginx, Postgres, and certs stay your problem until PromQL fires and you SSH in |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Open-source (Apache 2.0). You still pay OpenShift/OCP nodes, Prometheus, Grafana, and the engineer who owns Geneve and ACL retries |
| Hidden costs | None — fully managed | nbdb/sbdb raft, ovn-northd, a noisy OVS flow table, Geneve MTU traps, and a second tool to tell you the box is sick |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | ovnkube_resource_retry_failures and OVS datapath gauges. OVN-Kubernetes does not watch host fill or a quiet cert unless you added another exporter |
| Configuration | None after install — heuristics and AI | Gateway mode, hybrid overlay, NetworkPolicy ACLs, and which PromQL actually pages you |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | You graph ovn_controller_integration_bridge flows in Grafana, then SSH in to change the box |
| Fix execution | Proposes and executes approved commands with an audit trail | Metrics only — OVN-Kubernetes cannot free disk, restart nginx, or rotate a cert |
| Alerting | Built-in across 8 channels | Not an OVN-Kubernetes job — Prometheus rules and Alertmanager have to fire |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Not an OVN-Kubernetes job — a CNI scrape does not forecast a quiet volume filling up |
| SSH brute-force detection | Built-in — parses auth.log every scan | Never — OVN-Kubernetes does not read auth.log, journald, or host firewall state |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | Silence if the agent dies — unless you built an up{job="ovnkube-node"} deadman check |
| Public status page | Shareable URL with 90-day history | None — OVN-Kubernetes has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | None — an OVS scrape target is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire Alertmanager into PagerDuty or another incident tool |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | oc/ovn-nbctl and Grafana. No mechanic you text when /var filled and ovnkube-node still showed endpoints |
| Learning curve | None — works after install | Steep — OVN northd, SBDB raft, Geneve, OVS flows, PromQL, and which ACL retry actually pages |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Teams that already run OpenShift and need OVN/OVS scrapes, not a sick-VPS mechanic |
When OVN-Kubernetes metrics are the right choice
Keep scraping OVN-Kubernetes when you already want that exact job:
- OpenShift CNI SLOs — you need ovnkube-node retries, Geneve health, and OVS flow counts, not a mechanic.
- NetworkPolicy at cluster scale — northbound ACLs, sbdb raft, and hybrid overlay matter more than host nginx, certs, and SSH on a quiet VPS.
- An existing Prometheus + Grafana stack — ovnkube-node already clusters, OVS already scrapes, and someone owns the overlay.
- Hosts that only page on OVN — you already run exporters and PromQL, not a sick-box SSH loop.
The real cost of “just scrape OVN-Kubernetes”
OVN-Kubernetes is in every OpenShift networking diagram. A working ops loop for five Linux boxes is not:
- A healthy ovnkube-node still means you SSH in and change the box by hand
- Host fill, nginx, certs, and SSH brute-force never appear unless Prometheus scraped those signals and a rule fired
- A filling /var is a Tink disk warning on every scan — OVN-Kubernetes will stay quiet until the overlay itself is the failure
- A single VPS with a dead ovnkube-node still needs a mechanic, not another OVS scrape
For a 5-server team, Tink Mechanic at $45/month is cheaper than OVN-Kubernetes plus the engineer who keeps Prometheus scrapes and OVN northd rules alive, and every scan includes a diagnosis a quiet Grafana board will not type.
No Geneve homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs Calico · Tink vs Cilium · Tink vs Prometheus