<p>As we can see in <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters" rel="nofollow noreferrer">this documentation</a>. A private cluster is accessible by the VMs (GCP compute instances) in the same subnet by default. Here is what is mentioned in the docs :</p>

<pre><code>From other VMs in the cluster's VPC network: 
Other VMs can use kubectl to communicate with the private endpoint
only if they are in the same region as the cluster 
and their internal IP addresses are included in 
the list of master authorized networks.
</code></pre>

<p>I have tested this: <br></p>

<ul>
<li>the cluster is accessible from VMs in the same subnetwork as the cluster</li>
<li>the cluster is not accessible from the VMs in different subnets.</li>
</ul>

<p>How does this private cluster figure out which VMs to give access and which VMs to reject?</p>

<p>It is not controlled by private cluster.</p>

<p>It is controlled by the routing and firewall rules configured for the vpc's subnets. Even within the same vpc, you can disable communication between them by adding a rule. </p>

<p><a href="https://cloud.google.com/vpc/docs/vpc#affiliated_resources" rel="nofollow noreferrer">https://cloud.google.com/vpc/docs/vpc#affiliated_resources</a></p>
