connections to chef time out from gstg

We have intermittent issues connecting to chef from gstg. slack thread (internal)

This seems to be caused by a Cloud NAT config that is scaled too small.

We have quite a low reserved port count per VM in gstg. We're starting to see network unreliability on chef runs, connecting to the same external chef LB address.

This is indicative of NAT port space exhaustion, so we're going to try scaling it up as a relatively cheap experiment.

We're multiplying the reserved port space per VM by 8 (32 to 512), so to keep the total port space the same, we're multiplying the IP count by 8 too.

Overall rundown:

  • identify where current gstg CloudNAT IPs are used for allowlisting
  • apply the TF MR
  • update identified allowlists with the new IPs
Edited by Hendrik Meyer (xLabber)