Database / BetterDB Interview questions
Which is better for VPC-only instances: SSH tunnel or the BetterDB agent?
It depends on the topology. An SSH tunnel through a bastion works well for single-node or primary monitoring, but it has a documented limitation with clusters: only the one connection you configure is tunnelled, while Valkey Cluster and Sentinel nodes are contacted directly using the addresses they themselves advertise, bypassing the tunnel entirely. If those other nodes are only reachable via the bastion, their per-node views simply won't load.
@betterdb/agent takes a different approach for VPC-only instances like ElastiCache or MemoryDB: it reaches them over an outbound WebSocket, so there's no need to open inbound access through a bastion, and it handles the multi-node fan-out that a single SSH tunnel can't.
In short: SSH tunnel for a single primary behind a bastion; the agent when you need full cluster visibility into a private subnet.
More Related questions...