You have multiple services running in a GKE cluster, and you want to securely manage API calls between these services. What combination of GCP services and features should you use?

*Explanation:* To securely manage API calls between services running in a GKE cluster, the recommended choice is **Istio with mTLS**. Istio provides robust service-to-service communication security through mutual TLS (mTLS), ensuring that all communications between services are encrypted and authenticated. Other options like Cloud Endpoints with API Keys (primarily for external API access), Cloud Run with Cloud Identity Aware Proxy (more focused on user authentication), Apigee Edge with OAuth 2.0 (meant for API management, not intra-GKE communication), and VPC Service Controls with Private Google Access (designed for different purposes) are less suitable for this specific use case.