Question

Your team deployed a private GKE cluster with a private control plane endpoint. The control plane runs in a Google-managed VPC that is connected to your cluster's VPC using VPC Network Peering. Developers connecting from an on-premises data center over an HA VPN tunnel to your VPC report they cannot reach the private control plane endpoint, even though nodes in the cluster communicate with it successfully. What is the most likely cause and how should you resolve it?

Accepted Answer

The VPC peering with the control plane's Google-managed VPC does not export custom routes by default; enable custom route export on the peering so the on-premises VPN routes are advertised to the control plane.

Answer

The on-premises CIDR must be added to the cluster's authorized networks list, but private endpoint access from on-premises additionally requires custom route exchange on the peering to be disabled.

Answer

Private control plane endpoints only accept traffic from within the cluster's VPC; on-premises access is impossible and you must enable the public endpoint instead.

Answer

The HA VPN tunnel is advertising the wrong MED value, so Cloud Router is deprioritizing the control plane route; raise the tunnel priority to fix reachability.