A project was blocked last quarter for a reason that sounded almost quaint when I had to explain it upward. We could not create the network for a new environment because we had no private address space left to give it.
The original plan was written six years ago by someone sensible. A single large private range, carved into subnets of two hundred and fifty four addresses each, allocated one per environment per application, on the reasonable assumption that no application would ever need more than a couple of hundred addresses. That assumption was correct for virtual machines. It stopped being correct the moment we ran container platforms that assign an address per pod, load balancers that consume a block each, and managed database services that quietly reserve a subnet of their own.
Then we acquired a company that had made the same sensible decision with the same obvious range, and half their network overlapped half of ours. The pragmatic fix was address translation at the boundary, which worked, and which also meant that every log entry from their side of the estate arrived showing the translation device as the source. Investigating anything that crossed the boundary became an exercise in correlating timestamps.
What makes this expensive is that address space is one of the few things in an estate you cannot renegotiate cheaply. Compute is elastic, storage is elastic, and a subnet that is too small must be rebuilt along with everything attached to it, during an outage, by people who have to touch firewall rules and routing at the same time.
We now run an address plan the way we run any other capacity: a registry with a named owner, allocations by region and environment rather than by application, generous reservations that assume growth we cannot currently justify, and utilisation trended so that exhaustion is a forecast rather than a surprise on a Tuesday. Anything that touches a partner or a possible acquisition comes out of a deliberately unfashionable range.
Almost every constraint in modern infrastructure is soft and can be bought your way out of within the hour. Addressing is not one of them, and it tends to be planned exactly once, early, by whoever happened to be standing up the first environment.
– Serguey Shinder
