VMs in us-west1 and us-east1 must not have public IPs but must fetch updates from the internet. With default routing, how do you allow outbound internet access without assigning public IPs?

To allow VMs without public IPs to access the internet, you need a Cloud NAT gateway. Cloud NAT is a regional resource, meaning a gateway must be created in each region (us-west1 and us-east1) where VMs require outbound internet access. Cloud Router is also a regional resource and is automatically used by Cloud NAT to manage routes for private IP addresses. Creating a single global Cloud NAT gateway is incorrect because Cloud NAT is a regional service. Changing the instances’ network interface external IP to Ephemeral would assign public IPs, which the question explicitly states should not happen. A firewall rule allowing egress to 0.0.0.0/0 is necessary for outbound traffic, but it doesn't provide the NAT functionality required for private IPs to reach the internet.