A developer on a laptop needs kubectl access to a private GKE cluster control plane that has no public master endpoint. Which approach provides secure access without exposing the control plane publicly?

A bastion host within the cluster's Virtual Private Cloud (VPC) is the most secure and common method for accessing a private GKE control plane. The bastion VM acts as a jump server, allowing secure SSH connections from your laptop and then proxying kubectl commands to the private control plane endpoint. This keeps the control plane isolated from the public internet. Configuring Cloud NAT would not make the control plane reachable from the internet; Cloud NAT provides outbound internet access for private VMs, not inbound access to private endpoints. Adding a VPC firewall rule for your laptop IP to directly reach the private master IP from the internet is impossible because the private master IP is not routable from the internet. Assigning a public IP to a node for control plane proxying is insecure and bypasses the intended private control plane isolation.