Question

Your organization runs an on-premises data center and a Google Cloud environment. The platform team must bootstrap a CI/CD architecture where Cloud Build pipelines deploy artifacts to both GKE clusters on Google Cloud and Kubernetes clusters running in the on-premises data center. The on-premises clusters are not reachable over the public internet, and security policy forbids exposing them with public endpoints. Which approach lets the same Cloud Build pipeline reliably deploy to both environments?

Accepted Answer

Use Cloud Build private pools connected to your VPC, and reach the on-premises clusters over an existing Cloud VPN or Cloud Interconnect through that VPC.

Answer

Grant the Cloud Build default service account the Owner role and let the default worker pool call the on-premises cluster API over the public internet.

Answer

Deploy to GKE from Cloud Build, then manually copy the manifests to a USB drive and apply them on-premises to satisfy the no-public-endpoint policy.

Answer

Expose the on-premises Kubernetes API server through a public load balancer protected only by an IP allowlist of Google's published egress ranges.