<p>Can I route requests to GKE private master from another VPC? I can’t seem to find any way to setup GCP router to achieve that:</p>

<ul>
<li>balancers can't use master ip as a backend in any way</li>
<li>routers can't have next-hop-ip from another network</li>
<li>I can't (on my own) peer different VPC network with master private network</li>
<li>when I peer GKE VPC with another VPC, those routes are not propagated</li>
</ul>

<p>Any solution here?</p>

<p>PS: Besides creating a standalone proxy or using third-party router...</p>

<blockquote>
  <p>I have multiple gcp projects, kube clusters are in separate project.</p>
</blockquote>

<p>This dramatically changes the context of your question as VPC from other projects aren't routeable by simply adding project-level network rules.</p>

<p>For cross-project VPC peering, you need to set up a <a href="https://cloud.google.com/vpc/docs/vpc-peering" rel="nofollow noreferrer">VPC Network Peering</a>.</p>

<blockquote>
  <p>I want my CI (which is in different project) to be able to access private kube master.</p>
</blockquote>

<p>For this, each GKE private cluster has <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/authorized-networks#overview" rel="nofollow noreferrer">Master Authorized Networks</a>, which are basically IP addresses/CIDRs that are allowed to authenticate with the master endpoint for administration.</p>

<p>If your CI has a unified address or if the administrators have fixed IPs, you can add them to these networks so that they can authenticate to the master.</p>

<p>If there are not unified addresses for these clients, then depending on your specific scenario, you might need some sort of SNATing to "<em>unify</em>" the source of your requests to match the authorized addresses.</p>

<p>Additionally, you can make a private cluster without a public address. This will allow access to the master endpoint to the nodes allocated in the cluster VPC. However:</p>

<blockquote>
  <p>There is still an external IP address used by Google for cluster management purposes, but the IP address is not accessible to anyone.</p>
</blockquote>
