Dataproc nodes cannot access the Internet; you must install additional startup dependencies via an existing init action. How do you provide those dependencies securely?

The correct approach is to copy all dependencies to a Cloud Storage bucket inside your VPC security perimeter. Dataproc clusters can be configured with Private Google Access, allowing them to reach Google APIs and services, including Cloud Storage, without traversing the public internet. This ensures secure access to your dependencies. Deploying the Cloud SQL Proxy is for connecting to Cloud SQL instances, not for providing general internet access or dependencies. Creating an SSH tunnel to give the Dataproc cluster internet access is insecure and bypasses the intended network isolation. Using Resource Manager to give the Dataproc service account the Network User role primarily grants permissions for network-related operations, not direct internet access or dependency provision.