Validate CloudNAT and Woker configuration in shoot spec.

[DockToFuture]

How to categorize this issue?

/area networking /kind enhancement /platform gcp

What would you like to be added: Currently I can specify a CloudNat with min ports per VM and a list of manual NAT IP addresses. I can break the shoot if I specify more nodes in the worker group as are supported by the CloudNAT configuration. The calculation for the maximum number of allowed nodes with a specific port range per VM is described here: https://cloud.google.com/nat/docs/ports-and-addresses#port-reservation-examples

In the example below 6 nodes are supported by the CloudNAT configuration and up to 20 nodes are allowed. The 7th node joining the cluster would fail due to the lack of free ports on the manual nat IP address which could be assigned. 4 Nat IPs would be needed to cover the 20 nodes.

    infrastructureConfig:
      networks:
        cloudNAT:
          minPortsPerVM: 10000
          natIPNames:
            - name: manual-nat-01
        workers: 10.250.0.0/16
...
    workers:
      - cri:
          name: docker
        name: worker-group-1
        machine:
          type: n1-standard-2
          image:
            name: gardenlinux
            version: 576.3.0
        maximum: 20
        minimum: 1
...

Such upscaling failures could be covered by a proper validation.

[kon-angelo]

/remove lifecycle/rotten