Google now recommends DNS-based access to the GKE control plane, and some teams are turning off IP-based access completely for security reasons

Right now the Harness GCP connector doesn't handle clusters that only have the DNS endpoint. Deployments to them fail with a TLS validation error, because the connector seems to check against the cluster's own CA certificate while the DNS endpoint presents a Google-managed one. A narrow fix exists for clusters with IP access fully disabled, but it's a stopgap, not a supported option.

It would be great to have proper DNS endpoint support in the GKE infrastructure options, ideally as an opt-in setting so nothing changes for people who rely on an IP endpoint today, for example for proxy configuration. This matters most for teams moving to Workload Identity Federation so they don't have stored keys or tokens. For them, going back to an IP endpoint or a manually managed service account credential defeats the point of the migration