You plan pod CIDR and service CIDR for a new GKE cluster but an existing subnet already overlaps one range. What is the correct design decision?

The correct design decision is to choose non-overlapping secondary ranges for pods and services and assign them to the subnet. GKE clusters require dedicated IP address ranges for pods and services that do not overlap with existing subnets or other networks. Secondary IP ranges within a subnet are designed precisely for this purpose, allowing you to allocate distinct CIDR blocks for GKE resources without conflict. Using VPC firewall rules to translate conflicting service CIDR is not a standard or practical solution for IP address range conflicts; firewalls control traffic, not IP address allocation. Manually adding static routes is cumbersome, error-prone, and doesn't resolve the underlying IP overlap issue, which can lead to routing problems and network instability. GKE will not automatically NAT service IPs to resolve overlapping ranges; overlapping ranges will cause cluster creation failures or network communication issues.