<p>How to change the existing GKE cluster to GKE private cluster? Will I be able to connect to the Kubectl API from internet based on firewall rules or should I have a bastion host? I don't want to implement <code>Cloud Nat</code> or <code>nat gateway</code>. I have a  squid proxy VM that can handle internet access for pods. I just need to be able to connect to Kubectl to apply or modify anything.</p>
<p>I'm unsure how to modify the existing module I wrote to make the nodes private and I'm not sure if the cluster will get deleted if I try and apply the new changes related to private gke cluster.</p>
<pre><code>resource &quot;google_container_cluster&quot; &quot;primary&quot; {
  name     = &quot;prod&quot;
  network  = &quot;prod&quot;
  subnetwork = &quot;private-subnet-a&quot;
  location               = &quot;us-west1-a&quot;
  remove_default_node_pool = true
  initial_node_count = 1

  depends_on = [var.depends_on_vpc]
}

resource &quot;google_container_node_pool&quot; &quot;primary_nodes&quot; {
  depends_on = [var.depends_on_vpc]

  name       = &quot;prod-node-pool&quot;
  location   = &quot;us-west1-a&quot;
  cluster    = google_container_cluster.primary.name
  node_count = 2

  node_config {
    preemptible  = false
    machine_type = &quot;n1-standard-2&quot;

    metadata = {
      disable-legacy-endpoints = &quot;true&quot;
    }

    oauth_scopes = [
      &quot;https://www.googleapis.com/auth/logging.write&quot;,
      &quot;https://www.googleapis.com/auth/monitoring&quot;,
      &quot;https://www.googleapis.com/auth/devstorage.read_only&quot;,
      &quot;https://www.googleapis.com/auth/compute&quot;,
    ]
  }
}
</code></pre>

user630702
<p>Answering the part of the question:</p>
<blockquote>
<p>How to change the existing GKE cluster to GKE private cluster?</p>
</blockquote>
<p><a href="https://i.stack.imgur.com/AfzeE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/AfzeE.png" alt="GKE Private cluster network settings" /></a></p>
<p><strong><code>GKE</code> setting: <code>Private cluster</code> is immutable.</strong> This setting can only be set during the <code>GKE</code> cluster provisioning.</p>
<p>To create your cluster as a private one you can either:</p>
<ul>
<li>Create a new <code>GKE</code> private cluster.</li>
<li>Duplicate existing cluster and set it to private:
<ul>
<li>This setting is available in <code>GCP Cloud Console</code> -&gt; <code>Kubernetes Engine</code> -&gt; <code>CLUSTER-NAME</code> -&gt; <code>Duplicate</code></li>
<li>This setting will clone the configuration of your infrastructure of your previous cluster but not the workload (<code>Pods</code>, <code>Deployments</code>, etc.)</li>
</ul>
</li>
</ul>
<blockquote>
<p>Will I be able to connect to the Kubectl API from internet based on firewall rules or should I have a bastion host?</p>
</blockquote>
<p>Yes, you could but it will heavily depend on the configuration that you've chosen during the <code>GKE</code> cluster creation process.</p>
<p>As for ability to connect to your <code>GKE</code> private cluster, there is a dedicated documentation about it:</p>
<ul>
<li><em><a href="https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters" rel="nofollow noreferrer">Cloud.google.com: Kubernetes Engine: Docs: How to: Private clusters</a></em></li>
</ul>
<hr />
<p>As for how you can create a private cluster with Terraform, there is the dedicated site with configuration options specific to <code>GKE</code>. There are also parameters responsible for provisioning a <code>private</code> cluster:</p>
<ul>
<li><em><a href="https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster" rel="nofollow noreferrer">Registry.terraform.io: Providers: Hashicorp: Google: Latest: Docs: Resources: Container cluster</a></em></li>
</ul>
<p>As for a basic example of creating a private <code>GKE</code> cluster with Terraform:</p>
<ul>
<li><code>main.tf</code></li>
</ul>
<pre><code>provider &quot;google&quot; {
  project = &quot;INSERT_PROJECT_HERE&quot; 
  region  = &quot;europe-west3&quot;
  zone    = &quot;europe-west3-c&quot;
}
</code></pre>
<ul>
<li><code>gke.tf</code></li>
</ul>
<pre><code>resource &quot;google_container_cluster&quot; &quot;primary-cluster&quot; {
  name               = &quot;gke-private&quot;
  location           = &quot;europe-west3-c&quot;
  initial_node_count = 1

  private_cluster_config {
    enable_private_nodes = &quot;true&quot;
    enable_private_endpoint = &quot;false&quot; # this option will make your cluster available through public endpoint 
    master_ipv4_cidr_block = &quot;172.16.0.0/28&quot;
  }

  ip_allocation_policy {
    cluster_secondary_range_name = &quot;&quot; 
    services_secondary_range_name = &quot;&quot;
  }

  
  node_config {
    machine_type = &quot;e2-medium&quot;
  }
}
</code></pre>
<blockquote>
<p>A side note!</p>
<p>I've created a public <code>GKE</code> cluster, modified the <code>.tf</code> responsible for it's creation to support private cluster. After running: <code>$ terraform plan</code> <strong>Terraform responded with the information that the cluster will be recreated</strong>.</p>
</blockquote>
