On a GKE private cluster an instance cannot reach the control plane; the cluster exists but kubectl to the master fails. What should you do to allow that instance to communicate with the master?

For a GKE private cluster, the control plane (master) is not publicly accessible. To allow specific instances or networks to communicate with the master, you must configure Master Authorized Networks. This feature restricts access to the control plane endpoint to specified CIDR blocks. Without these entries, even instances within the same VPC cannot reach the master. Assigning a public IP to the instance is unnecessary and doesn't solve the master access issue for a private cluster. Creating a route to the default internet gateway is incorrect because the master is not accessed via the public internet for private clusters. Firewall policies control traffic to the instance, not from the instance to the master's private endpoint.