kubectl from Cloud Shell times out when connecting to a GKE cluster with a public endpoint. What is the most likely cause?

When a GKE cluster has a public endpoint and authorized networks are configured, only IP addresses within those authorized ranges can access the cluster's control plane. Cloud Shell uses dynamic external IP addresses, which are unlikely to be pre-authorized. If the Cloud Shell's current external IP is not in the authorized networks list, kubectl commands will time out because the connection to the cluster's API server is blocked. Lack of user privileges would result in authorization errors, not timeouts. Cloud Shell does not need to be in the same VPC as the GKE cluster to connect to a public endpoint. While a VPC firewall could block access, the authorized networks feature is a more common and specific cause for public endpoint connection issues from external sources like Cloud Shell.