In a hub-and-spoke VPC peering design, a private GKE control plane in one spoke has authorized networks set to the node subnet, but control plane is unreachable from other spokes. How do you allow access from other spokes?

The GKE private control plane, by default, is only accessible from within its own VPC network or authorized networks. When authorized networks are set to only the node subnet, other spokes in a peered network cannot reach it directly. Deploying a proxy within the same spoke as the GKE cluster allows other spokes to route their control plane traffic through this proxy, which then has authorized access to the GKE control plane. Adding a firewall rule is insufficient because authorized networks restrict access at a deeper level than firewalls. Enabling Private Google Access is for VM instances to reach Google APIs and services, not for inter-VPC GKE control plane access. Configuring authorized networks for all spoke projects is a valid solution, but it requires updating the GKE cluster configuration for every new spoke, which can be less scalable than a proxy in complex hub-and-spoke designs.