Professional Cloud Network Engineer
Private control plane reachability is the ability to connect to a Google Kubernetes Engine (GKE) cluster's management interface from networks outside its main VPC, such as an on-premises data center or a peered VPC. This is essential for securing management traffic.
The GKE control plane's private endpoint is an internal IP address that is only reachable within its own VPC network. By default, it is not accessible from other networks connected via VPC Network Peering or from on-premises environments using Cloud VPN or Cloud Interconnect. This limitation exists because VPC peering is non-transitive, meaning traffic cannot flow from one peered network through the host VPC to another network. To enable direct access, you must advertise the route to the control plane's private IP address. You do this by configuring custom route advertisements on the Cloud Router for your hybrid connection, which uses BGP to tell your on-premises network how to reach the endpoint. For access from any Google Cloud region in a hybrid setup, you can enable the --enable-master-global-access flag when creating the cluster.
In a hub-and-spoke VPC architecture with peering, you cannot reach the private control plane directly from a spoke VPC or from on-premises via the hub. Since VPC peering is non-transitive, the spoke VPC can only talk to the hub VPC, not through it to the GKE cluster's network. To solve this, you must deploy a forward proxy, like a bastion host, inside the VPC that hosts the GKE cluster. All management traffic from the external network must flow first to this proxy, which then forwards it to the private control plane endpoint.
Access to the control plane is controlled by authorized networks, which are lists of allowed source IP ranges. For a private endpoint, you specify private IP address ranges that are routable to the cluster's VPC. When accessing from on-premises, the IP subnets you list must be the source IPs that appear after the traffic passes through the Cloud VPN or Interconnect connection. It is critical that these on-premises IP ranges do not overlap with any IP ranges used inside Google Cloud to prevent routing conflicts.
Control plane endpoints define how administrators and services connect to and manage components like GKE clusters, ingress controllers, and service meshes. Choosing between public and private endpoints involves balancing network reachability with security isolation.
In a Shared VPC setup, network resources are centralized in a host project while GKE clusters run in service projects. The Google Kubernetes Engine Service Agent in each service project needs the roles/container.hostServiceAgentUser role on the host project. This role allows the agent to manage network resources. Cluster creation also requires the Compute Network User role so node instances can attach to the host subnet, using its primary IP range for nodes and designated secondary ranges for Pods and Services.
Gateway and ingress controllers can be configured with private or public addresses. The gke-l7-rilb GatewayClass assigns a regional private IP address from the node's IP range, keeping all ingress traffic within the private VPC. The gke-l7-regional-external-managed or gke-l7-global-external-managed GatewayClasses assign regional or global public IP addresses from Google's pools. Administrators can also assign static named IP addresses to maintain a consistent endpoint address.
For multi-cluster service meshes, a managed Istio Control Plane delivers configuration to proxies. When connecting clusters across different VPCs, traffic flows through dedicated east-west gateways in each cluster. These gateways can have public internet endpoints, but the actual backend communication is secured because workloads must present trusted mutual TLS (mTLS) certificates and valid identities.
Master Authorized Networks is a GKE security feature that restricts access to the cluster's control plane by specifying a list of trusted source IP address ranges (CIDR blocks). This creates a zero-trust network boundary, allowing only traffic from approved networks.
GKE offers two endpoint types. The DNS-based endpoint is reachable from any network that can access Google Cloud APIs, with security managed through IAM. The IP-based endpoints use authorized networks for access control. You can enable a private endpoint with the --enable-private-endpoint flag, which assigns an internal IP and disables the external IP. Both public and private endpoints default to allowing all traffic between the cluster's own Pods and nodes.
When you configure authorized networks, you list the specific IP subnets allowed to reach the GKE control plane. For a private endpoint, these should be private IP ranges. For a public endpoint, you can allow public or internal ranges. To reach a private endpoint from on-premises, you use custom route advertisements. The --enable-master-global-access option makes the private endpoint reachable from all Google Cloud regions.
Choosing between a public or private control plane endpoint depends on your security needs. A private endpoint keeps the Kubernetes API server accessible only from within your VPC or authorized on-premises networks, removing it from the public internet and reducing the attack surface. Even if you disable the public endpoint for user access, Google still uses it for necessary cluster management like maintenance and upgrades. Using a private endpoint together with authorized networks provides defense-in-depth, requiring both network-level access and identity verification.
Authorized networks work with other GKE networking features. Since VPC peering is non-transitive, you may need a proxy for access from peered networks. VPC firewall rules control traffic at the VM level, and Kubernetes network policies control traffic at the Pod level. For clusters with private nodes, you can use Cloud NAT for outbound internet access while the control plane remains accessible only through authorized networks.
StudyCerts
StudyCerts--enable-master-global-access flag makes a GKE private control plane endpoint reachable from all Google Cloud regions, which is useful for hybrid connectivity.You make it reachable by configuring custom route advertisements on the Cloud Router for your Cloud VPN or Cloud Interconnect connection. This advertises the specific IP route of the private endpoint into your on-premises routing table via BGP, allowing traffic to flow from on-premises to the control plane.
You cannot access it directly because VPC Network Peering is non-transitive. Traffic from a peered VPC can reach the hub VPC, but it cannot flow through the hub to another network, like the VPC hosting the GKE cluster. A forward proxy in the host VPC is required to relay the traffic.
The main difference is network exposure. A public endpoint is accessible from the internet (though it can be restricted with authorized networks), while a private endpoint is only accessible from within your VPC and authorized on-premises networks, eliminating public internet exposure entirely.
Master Authorized Networks provides network-level security by restricting which IP addresses can connect to the control plane. IAM provides identity-level security by controlling which users or service accounts have permission to perform specific actions on the cluster. Used together, they enforce defense-in-depth.
Prepare and test your skills
Prepare and test your skills