An internal HTTPS Application Load Balancer via the GKE Gateway controller provides a scalable, highly available Layer 7 ingress for internal applications, supports HTTP cookie-based session affinity, and is not exposed to the public internet. Using an internal VIP allows controlled access from on-premises over private connectivity and from selected internal VPC networks.

Using Network Connectivity Center (NCC) with Private NAT allows overlapping IP address spaces across business units while ensuring communication between VPC spokes. Private NAT translates overlapping IP ranges to non-conflicting ranges, enabling seamless inter-VPC communication. Additionally, a Routing VPC centralizes dynamic route exchanges with the on- premises environment through Cloud Router, ensuring scalable and efficient hybrid connectivity.

Using the VPC spoke's include export ranges filter to specify 10.10.1.0/24 precisely controls which subnet prefixes are exported to the Network Connectivity Center hub. This approach ensures that only the intended production range is advertised, and any newly created subnets in the VPC are not exported unless explicitly added to the include list.

Request path and Response: For HTTP, HTTPS, and HTTP2 protocols, you can optionally provide a URL path for the health check probe systems to contact.
https://cloud.google.com/load-balancing/docs/health-checks#optional-flags-hc-protocol-http
https://cloud.google.com/load-balancing/docs/health-checks

Global Dynamic Routing Mode:
- Enables seamless routing across regions within the VPC, ensuring that the routes from both
"region 1" (HA VPN) and "region 2" (Dedicated Interconnect) are propagated globally to all VPC subnets.
- This is necessary to support the traffic flow between your corporate network and the VPC across multiple regions.
Priority for BGP Routes:
- Lower BGP priority (base priority value) indicates a preferred path.
- Assign priority 100 to the BGP sessions associated with the VLAN attachments in "region 2" (Dedicated Interconnect), making this the primary path for traffic.
- Assign priority 20000 to the BGP sessions associated with the HA VPN in "region 1," ensuring that this acts as the secondary path.
Multi-Exit Discriminator (MED):
- Configuring similar MED values on your on-premises routers ensures that the routing preferences are consistent and honored when selecting between the Dedicated Interconnect and HA VPN paths.