GKE deployment must be accessible only from the same VPC and on‑prem subnets. The GKE control plane must be exposed to a predefined list of on‑prem subnets via private connectivity only. What should you do?

To meet the requirements, a GKE private cluster with a private endpoint for the control plane is essential. This ensures the control plane is not exposed to the public internet. VPC Network Peering, along with export/import routes and custom route advertisements on Cloud Routers, enables connectivity between the GKE VPC and on-premises subnets, allowing the on-premises network to reach the private control plane. Authorized networks further restrict access to the control plane, allowing only the specified on-premises subnets. Incorrect options: A public endpoint for the control plane violates the "private connectivity only" requirement. Omitting VPC Network Peering and custom route advertisements would prevent on-premises subnets from reaching the private control plane. A GKE public cluster exposes the control plane to the internet, failing to meet the private connectivity requirement.