When installing a GCP cluster with the CAPI based method, the kube-api firewall rule that is created always uses a source range of 0.0.0.0/0. In the prior terraform based method, internal published clusters were limited to the network_cidr. This change opens up the API to additional sources, which could be problematic such as in situations where traffic is being routed from a non-cluster subnet.

    4.17

    Always

    1. Install a cluster in GCP with publish: internal
    2.
    3.
    

    Kube-api firewall rule has source of 0.0.0.0/0

    Kube-api firewall rule has a more limited source of network_cidr