Authorized networks are a Google Kubernetes Engine (GKE) feature that controls which IP address ranges can access the cluster's control plane, which hosts the Kubernetes API server. When you enable a public endpoint, you can specify both public and private IP ranges. When you disable the public endpoint and use only a private endpoint, only private IP ranges can be used. Google manages firewall rules that enforce these restrictions, creating a network boundary that blocks traffic from untrusted IP addresses before it reaches the control plane.
GKE offers a DNS-based endpoint that can be accessed from any network that can reach Google Cloud APIs. This endpoint relies on Identity and Access Management (IAM) and VPC Service Controls for security rather than source IP addresses. You control access by granting the gkehub.gateway.get IAM permission to users or service accounts. This creates an identity-aware policy where access depends on who the user is, not where they are connecting from. The DNS endpoint simplifies configuration and integrates well with broader Google Cloud security frameworks.
VPC Service Controls create a service perimeter around projects that host GKE clusters, governing data flows at the service level. This perimeter provides ingress and egress controls that restrict which identities and clients can communicate with the Kubernetes API server and other Google Cloud services from inside or outside the perimeter. When combined with authorized networks, VPC-SC adds a service-layer security boundary on top of the network-layer IP filtering, helping to prevent data exfiltration even if network access is obtained.
The combined security approach uses authorized networks as the first line of defense by filtering traffic by IP address. IAM policies act as the identity gatekeeper, especially when using the DNS endpoint. VPC Service Controls enforce the final service perimeter. To configure this integration, you first define authorized networks for IP-based endpoints, then enable the DNS endpoint and configure IAM roles like roles/gkehub.gatewayReader for user access. Separately, you create a VPC-SC service perimeter that includes your GKE project and configure ingress and egress rules to control service-level communication.
GKE distinguishes between preset IP addresses that can always access the control plane and configurable addresses that require explicit allowlisting. Preset addresses include Google-reserved IPs used for internal operations and GKE cluster IP ranges that enable communication between cluster components. Configurable access includes allowlisted external IP addresses, allowlisted internal IP addresses, and Google Cloud external IP addresses. When only the internal endpoint is enabled, only internal IP addresses can be allowlisted, while enabling both endpoints allows configuration of both external and internal CIDR ranges.
Authorized networks can be configured through the Google Cloud console or the gcloud CLI using specific flags. The --enable-master-authorized-networks flag enables the feature, while --master-authorized-networks specifies the comma-delimited list of CIDR values. The --enable-authorized-networks-on-private-endpoint flag restricts access to the internal endpoint to only authorized IP ranges, and --no-enable-google-cloud-access denies access from Google Cloud external IP addresses. The --enable-master-global-access flag allows access from IP addresses in other Google Cloud regions, which is important for multi-region deployments. You can specify up to 100 authorized IP address ranges combining both external and internal addresses.
Changes to certain authorized network settings may take several hours for GKE to propagate and enforce the firewall rule changes. If you expand a subnet used by a cluster with authorized networks configured, you must manually update the authorized network configuration to include the expanded IP address range, otherwise the new portion of the subnet will be blocked from accessing the control plane. For clients with dynamic IP addresses like home networks, frequent updates to the authorized network list are necessary. When using authorized networks with private clusters across different subnets, the Pod IP CIDR ranges from the calling cluster must be added to the authorized networks of remote clusters to allow Cloud Service Mesh control plane communication.
IP-based endpoints with authorized networks do not directly integrate with VPC Service Controls, which operate at the service perimeter level. The documentation recommends using a DNS-based endpoint with VPC Service Controls for robust security rather than relying solely on IP-based authorization. Disabling access to the control plane's external endpoint prevents remote interaction, requiring a bastion host to forward client traffic. Using a DNS-based endpoint only requires setting up IAM permissions, simplifying access management. When allowing access from Google Cloud external IP addresses, this provides minimal security benefits, so restricting access to specific controlled ranges is recommended.
A public endpoint assigns an external IP address to the GKE control plane, while a private endpoint restricts the control plane API server to an internal IP address within the VPC network. When a cluster is created with the --enable-private-endpoint flag, external internet access to the control plane is disabled, requiring management traffic to originate from private networks. Even when public access is disabled, Google retains connectivity through the control plane's public interface for managed operational tasks like scheduled maintenance and automatic upgrades. Worker nodes and system Pods communicate with the API server through internal routes, which must not be blocked by custom VPC firewall rules.
Authorized networks configure firewall filtering rules that restrict administrative access to IP-based control plane endpoints to designated CIDR blocks. When enabled on a public endpoint, authorized networks block untrusted public internet traffic while permitting connections only from specified public or private IP ranges. Clusters without Private Service Connect support up to 50 authorized network CIDR blocks. If an administrator expands a subnet's primary IP range, the expanded range must be added to the authorized networks list, otherwise new nodes cannot register with the control plane and will cause continuous node replacement during node pool upgrades.
Control plane access across VPC Network Peering boundaries is non-transitive, meaning workloads in a peered VPC cannot directly reach a peered cluster's private control plane endpoint. To enable access from a peered VPC network or from an on-premises data center, administrators must deploy proxy instances to relay control plane traffic. For on-premises environments connected through Cloud VPN or Cloud Interconnect, administrators configure custom route advertisements on Cloud Routers to advertise the control plane private IP range. Enabling the --enable-master-global-access flag allows the private endpoint to be reached globally from any Google Cloud region.
A DNS-based endpoint resolves the control plane API endpoint using Cloud DNS infrastructure, enabling administrative access without managing direct IP whitelists. Enabling this feature with the --enable-dns-access flag allows clients to connect from any network reachable by Google Cloud APIs, including on-premises environments and external clouds, without requiring dedicated bastion hosts or proxies. Access through the DNS-based endpoint is secured using IAM policies and can be restricted at the perimeter using VPC Service Controls. This model simplifies multi-network administration by applying identity-aware security policies directly to control plane requests.
StudyCerts
StudyCertsgkehub.gateway.get rather than IP addresses, simplifying access management.IP-based endpoints use authorized networks to filter traffic by source IP address, while DNS-based endpoints use IAM policies to control access based on user identity. DNS endpoints can be accessed from any network that reaches Google Cloud APIs without IP allowlisting.
Use authorized networks when you need simple IP-based filtering for your control plane. Use VPC Service Controls when you need broader service-level security that protects against data exfiltration across your Google Cloud environment. For the strongest security, use both together in a layered approach.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills