Question

Your organization runs a mix of GKE clusters in Google Cloud and self-managed Kubernetes clusters in an on-premises data center. The platform team wants centralized, secure access to all clusters through a single control point so that developers can run kubectl commands against any cluster without opening inbound firewall ports to the on-premises environment or distributing static kubeconfig credentials. Which approach best meets these requirements?

Accepted Answer

Register all clusters to a fleet and use the Connect gateway with Google Cloud IAM to authenticate and route kubectl traffic outbound from each cluster.

Answer

Expose each on-premises cluster's API server through a public load balancer secured with a firewall allowlist of developer IP ranges.

Answer

Generate long-lived kubeconfig files with cluster admin certificates and distribute them to developers through a shared secret manager.

Answer

Set up a site-to-site VPN and give every developer direct network access to each on-premises cluster's private API endpoint.