For Cloud CDN to cache content effectively, the backend application must include appropriate HTTP caching headers, such as Cache-Control or Expires, in its responses. By configuring the USE_ORIGIN_HEADERS caching mode, Cloud CDN will honor these headers, ensuring that the defined content is cached and served correctly.
If the backend has already defined the caching behavior through headers, this configuration ensures that the CDN respects the backend's caching rules, avoiding unnecessary caching or bypassing the application's control over cache behavior. This resolves the issue while aligning with the application's defined behavior.

https://cloud.google.com/network-connectivity/docs/vpn/concepts/choosing-networks-routing#ts-tun-routing

https://cloud.google.com/network-connectivity/docs/vpn/how-to/viewing-logs-metrics To create alerting policies for the bytes per second (bps) and packets per second (pps) limits described in Network bandwidth, use Monitoring Query Language (MQL).

A Shared VPC Admin can define a Security Admin by granting an IAM member the Security Admin (compute.securityAdmin) role to the host project. Security Admins manage firewall rules and SSL certificates.
https://cloud.google.com/vpc/docs/shared-vpc#net_and_security_admins

Provision a VPC subnet with a primary range large enough for your nodes (a /25 gives you 128 IPs, covering your planned 100-node cluster) and define two secondary alias-IP ranges sized for pods and services at full scale:
- Pods: a /17 (32,766 addresses) easily accommodates 100 nodes × 200 pods = 20,000 Pods
- Services: a /21 (2,046 addresses) covers 1,500 Services
Then create your VPC-native GKE cluster with --enable-ip-alias, pointing at those two secondary ranges. This setup minimizes wasted space while supporting both today's needs and two-year growth.