Question

Your company is deploying a new GKE cluster to host a microservices platform. Security requires that cluster nodes have no public IP addresses. The platform team expects the number of Pods to grow significantly over the next two years, and they want to avoid re-creating the cluster to accommodate more Pod IPs. The cluster will run in an existing Shared VPC subnet that already has a primary range and one secondary range reserved for Services. How should you design the cluster's IP addressing?

Accepted Answer

Create a VPC-native (alias IP) private cluster and assign a secondary range for Pods that you can later expand with additional non-contiguous secondary ranges (multi-Pod CIDR).

Answer

Create a routes-based private cluster and rely on custom static routes so more Pod IPs can be added without re-creating the cluster.

Answer

Create a VPC-native public cluster using the subnet primary range for Pods so the range can be resized in place at any time.

Answer

Create a VPC-native private cluster and place both Pods and Services in the single existing Services secondary range to conserve address space.