Question

Your team runs a private GKE cluster where nodes have only internal IP addresses. Developers connect from the corporate office (public egress IP 203.0.113.10/32) using kubectl, and a CI/CD pipeline runs on a Compute Engine VM in the same VPC (internal IP 10.20.0.5). Security requires that the Kubernetes API server (control plane) reject connections from any source except these two. Which configuration meets the requirement with the least operational overhead?

Accepted Answer

Enable control plane authorized networks and add 203.0.113.10/32; enable the option to allow access from Google Cloud internal IP addresses (or add the VM's range), and keep the private endpoint enabled.

Answer

Create a VPC firewall rule denying ingress on port 443 to the control plane except from 203.0.113.10/32 and 10.20.0.5/32.

Answer

Add both 203.0.113.10/32 and 10.20.0.5/32 to a Cloud Armor security policy attached to the cluster's external load balancer.

Answer

Disable the public endpoint entirely and route all developer kubectl traffic through Cloud NAT to reach the private endpoint.