Using a Shared VPC host project lets you keep a single VPC while creating a dedicated subnet for the new division's workloads, enabling native communication without added interconnectivity costs. Granting limited network usage permissions scoped to the subnet avoids giving the new division unnecessary administrative control over the broader network infrastructure.

Separation Between Production and Non-Production Environments:
By creating separate Shared VPC host projects for production and non-production environments, you ensure complete isolation between the two environments, meeting the requirement of no communication between them.
Application Communication Within an Environment:
Within each Shared VPC, applications can communicate as needed using VPC-level routing and firewall rules.
Centralized Network Management:
Shared VPC allows network administrators to centrally manage networking resources, such as subnets, routes, and firewall rules, while developers retain control over their compute resources within their service projects.
Separate Billing for Applications:
Each application is associated with a separate service project, enabling separate billing and resource allocation.
Developer Autonomy with Networking Restrictions:
Developers in service projects can manage their compute resources but cannot create or modify networking resources, aligning with organizational control and autonomy requirements.
Scalability:
Shared VPC can scale to support multiple service projects, making it suitable for the expected
1000 applications per environment.

Configure your VPC network to export its custom routes in the peering relationship to the control plane's VPC network. The control plane's VPC network is already configured to import custom routes. This provides a path for the control plane to send packets back to on-premises resources.
https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters?hl=en#cp-on-prem-routing

When using a shared VPC architecture in Google Cloud, GKE clusters in service projects depend on permissions in the host project for networking and other resources. The GKE service account requires specific permissions in the host project to successfully create nodes for the cluster.
- compute.securityAdmin: Allows the GKE service account to manage security-related configurations, such as creating firewall rules in the host project's VPC.
- container.hostServiceAgentUser: Grants the GKE service account access to the GKE-managed service account, enabling cluster management in the shared VPC setup.
- compute.networkUser: Allows the GKE service account to use subnets in the host project's VPC for creating cluster nodes.
These permissions must be assigned in the host project because the shared VPC resides there, and the GKE cluster in the service project interacts with the host project's network resources.
Without these permissions, node creation will fail, even if Compute Engine instances are being successfully created.

Cloud Armour is applied at load balancers
Configuring Google Cloud Armor through Ingress.
https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features Security policy features Google Cloud Armor security policies have the following core features:
You can optionally use the QUIC protocol with load balancers that use Google Cloud Armor.
You can use Google Cloud Armor with external HTTP(S) load balancers that are in either Premium Tier or Standard Tier.
You can use security policies with GKE and the default Ingress controller.