terraform-example-foundation
terraform-example-foundation copied to clipboard
Default Cloud NAT setting change suggestion
Based on experience in the field, I'm finding that these default Cloud NAT settings are not the most resilient to production traffic:
https://github.com/terraform-google-modules/terraform-example-foundation/blob/2f3e2291ebfd93e66b54d763924f2201e8dbf023/3-networks/modules/base_shared_vpc/nat.tf#L76-L90
Specifically, see the following recommendations:
- line 82,
nat_ip_allocate_optionis set to"MANUAL_ONLY"by default. Changing this to AUTO_ONLY will allow Cloud NAT to grow the number of External IP addresses being used, which can prevent port exhaustion. - One additional setting that should be added is enable_dynamic_port_allocation. This will allow for more dynamic allocation of ports, especially during periods of bursty network activity.
Caveat: Cloud NAT can have nuanced recommendations based on customers exact requirements. I believe that making changes to these default settings offers more resilience for a majority of the users that wish to build from this example foundation.