Private GKE nodes without external IPs cannot pull container images from Artifact Registry or Container Registry. What is the correct, secure fix?

Private GKE nodes lack external IP addresses, preventing direct internet access. To pull container images from Artifact Registry or Container Registry (which are public services), these nodes require a mechanism for outbound internet connectivity. A Cloud NAT gateway provides this by allowing instances in a private subnet to connect to the internet while keeping their internal IP addresses. Incorrect options: Enabling a VPC firewall rule for outbound port 443 is insufficient because the nodes still lack an external IP to route traffic to the internet. Firewall rules control traffic flow but don't provide the underlying connectivity. Deploying a regional internal load balancer in front of Artifact Registry is incorrect because Artifact Registry is a Google-managed service; you don't deploy load balancers in front of it. An internal load balancer is for distributing traffic to internal resources within your VPC. Attaching external IPs to the nodes defeats the purpose of having private nodes and introduces security risks by exposing them directly to the internet.