title: Can a private on-premise network access GAE Flex via Cloud VPN?
body: <p>I was wondering if a site-to-site VPN setup like the one in this diagram is possible:</p>
  
  <p><a href="https://i.stack.imgur.com/o4I5B.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/o4I5B.png" alt="enter image description here"></a></p>
  
  <p>From the diagram, I could access the GAE Flex instance's internal IP that are launched in the VPC from the on-premise server, but I don't think I could invoke a *.appspot.com URL without needing to go outside of the tunnel, correct? </p>
  
  <p>The on-premise network can only whitelist IP ranges for external HTTPS access but it seems like GAE can't support such a configuration?</p>
  
  <p>Is this kind of setup only possible by setting up a GCE reverse proxy? If that's the case, would I just be better off deploying my application as a Kubernetes cluster?  </p>