<p>Through Terraform, I am trying to create a VPC-Native GKE cluster in a single zone (europe-north1-b), with a separate node-pool, with the GKE cluster and node-pool in their own VPC Network.</p>
<p>My code looks like the following:</p>
<pre><code>resource &quot;google_container_cluster&quot; &quot;gke_cluster&quot; {
  description              = &quot;GKE Cluster for personal projects&quot;
  initial_node_count       = 1
  location                 = &quot;europe-north1-b&quot;
  name                     = &quot;prod&quot;
  network                  = google_compute_network.gke.self_link
  remove_default_node_pool = true
  subnetwork               = google_compute_subnetwork.gke.self_link

  ip_allocation_policy {
    cluster_secondary_range_name  = local.cluster_secondary_range_name
    services_secondary_range_name = local.services_secondary_range_name
  }
}

resource &quot;google_compute_network&quot; &quot;gke&quot; {
  auto_create_subnetworks         = false
  delete_default_routes_on_create = false
  description                     = &quot;Compute Network for GKE nodes&quot;
  name                            = &quot;${terraform.workspace}-gke&quot;
  routing_mode                    = &quot;GLOBAL&quot;
}

resource &quot;google_compute_subnetwork&quot; &quot;gke&quot; {
  name          = &quot;prod-gke-subnetwork&quot;
  ip_cidr_range = &quot;10.255.0.0/16&quot;
  region        = &quot;europe-north1&quot;
  network       = google_compute_network.gke.id

  secondary_ip_range {
    range_name    = local.cluster_secondary_range_name
    ip_cidr_range = &quot;10.0.0.0/10&quot;
  }

  secondary_ip_range {
    range_name    = local.services_secondary_range_name
    ip_cidr_range = &quot;10.64.0.0/10&quot;
  }
}

locals {
  cluster_secondary_range_name  = &quot;cluster-secondary-range&quot;
  services_secondary_range_name = &quot;services-secondary-range&quot;
}

resource &quot;google_container_node_pool&quot; &quot;gke_node_pool&quot; {
  cluster    = google_container_cluster.gke_cluster.name
  location   = &quot;europe-north1-b&quot;
  name       = terraform.workspace
  node_count = 1
  
  node_locations = [
    &quot;europe-north1-b&quot;
  ]

  node_config {
    disk_size_gb    = 100
    disk_type       = &quot;pd-standard&quot;
    image_type      = &quot;cos_containerd&quot;
    local_ssd_count = 0
    machine_type    = &quot;g1-small&quot;
    preemptible     = false
    service_account = google_service_account.gke_node_pool.email
  }
}

resource &quot;google_service_account&quot; &quot;gke_node_pool&quot; {
  account_id   = &quot;${terraform.workspace}-node-pool&quot;
  description  = &quot;The default service account for pods to use in ${terraform.workspace}&quot;
  display_name = &quot;GKE Node Pool ${terraform.workspace} Service Account&quot;
}

resource &quot;google_project_iam_member&quot; &quot;gke_node_pool&quot; {
  member = &quot;serviceAccount:${google_service_account.gke_node_pool.email}&quot;
  role   = &quot;roles/viewer&quot;
}
</code></pre>
<p>However, whenever I apply this Terraform code, I receive the following error:</p>
<pre><code>google_container_cluster.gke_cluster: Still creating... [24m30s elapsed]
google_container_cluster.gke_cluster: Still creating... [24m40s elapsed]
╷
│ Error: Error waiting for creating GKE cluster: All cluster resources were brought up, but: component &quot;kube-apiserver&quot; from endpoint &quot;gke-xxxxxxxxxxxxxxxxxxxx-yyyy&quot; is unhealthy.
│ 
│   with google_container_cluster.gke_cluster,
│   on gke.tf line 1, in resource &quot;google_container_cluster&quot; &quot;gke_cluster&quot;:
│    1: resource &quot;google_container_cluster&quot; &quot;gke_cluster&quot; {
│ 
╵
</code></pre>
<p>My cluster is then auto-deleted.</p>
<p>I can find no problem with my Terraform code/syntax, and have searched through Google Cloud Logging to find a more detailed error message with no luck.</p>
<p>So, how do I create a HEALTHY VPC-Native GKE cluster with Terraform?</p>

<p>Turns out the issue seemed to be with having the large subnetwork secondary ranges.</p>
<p>As shown in the question, I had ranges:</p>
<ul>
<li><code>10.0.0.0/10</code> for the <code>cluster_secondary_range</code>.</li>
<li><code>10.64.0.0/10</code> for the <code>services_secondary_range</code>.</li>
</ul>
<p>These <code>/10</code> CIDRs cover <code>4194304</code> IP addresses each, which I figured might be too large for Google/GKE to handle(?) - especially since all of the GKE documentation uses CIDRs covering much smaller ranges for the cluster &amp; services.</p>
<p>I decided to shrink these CIDR ranges to see if would help:</p>
<ul>
<li><code>10.0.0.0/12</code> for the <code>cluster_secondary_range</code>.</li>
<li><code>10.16.0.0/12</code> for the <code>services_secondary_range</code>.</li>
</ul>
<p>These <code>/12</code> CIDRs cover <code>1048576</code> IP addresses each.<br />
My cluster was created successfully after this change:</p>
<pre><code>google_container_cluster.gke_cluster: Creation complete after 5m40s
</code></pre>
<p>Not sure WHY Google / GKE can't handle larger CIDR ranges for the cluster &amp; services, but <code>/12</code> is good enough for me and allows for successful creation of the cluster.</p>
