To support both IPv6 and IPv4 for Pods and Services in GKE, you need a dual-stack VPC-native cluster. Google Cloud requires the cluster to be created in a dual-stack subnet and configured for dual-stack networking so nodes, Pods, and Services can receive both IPv4 and IPv6 connectivity for backward compatibility and future scalability.
Reference:
https://docs.cloud.google.com/kubernetes-engine/docs/concepts/alias-ips
https://docs.cloud.google.com/kubernetes-engine/docs/concepts/about-ip-addressing

Need "backend"_request_count for us to find data about how the request are being "distributed".
https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring

To meet the requirement for end-to-end encryption between the on-premises network and the VPC, use HA VPN over Cloud Interconnect rather than MACsec. Google documents that MACsec protects traffic only between your router and Google's edge, while HA VPN over Cloud Interconnect provides IPsec encryption for the traffic carried by the VLAN attachments. For a 10 Gbps encrypted design with failover across two Dedicated Interconnect attachments, Google recommends 4 tunnels per 10 Gbps attachment, or 8 tunnels total, and its 10 Gbps reference design uses four HA VPN gateways across the two encrypted attachments.

A Private Service Connect endpoint for Google APIs lets VMs reach Google services by using an internal IP address inside each VPC, and Google adds a special routing path to that endpoint so the VPC does not need a route whose next hop is the default internet gateway. This satisfies the security requirement while remaining scalable and manageable across multiple VPCs. Cloud NAT depends on internet-gateway routing, VPC Service Controls is a security boundary rather than a connectivity method, and Private Google Access with googleapis.com still requires routing that uses the default internet gateway next hop.

VPC Flow Logs records a sample of network flows sent from and received by VM instances, including instances used as GKE nodes.
These logs can be used for network monitoring, forensics, real-time security analysis, and expense optimization.
https://cloud.google.com/vpc/docs/using-flow-logs
Firewall Rules Logging allows you to audit, verify, and analyze the effects of your firewall rules.
For example, you can determine
if a firewall rule designed to deny traffic is functioning as intended. Firewall Rules Logging is also useful if you need to determine how many connections are affected by a given firewall rule.
You enable Firewall Rules Logging individually for each firewall rule whose connections you need to log. Firewall Rules Logging is an option for any firewall rule, regardless of the action (allow or deny) or direction (ingress or egress) of the rule.
https://cloud.google.com/vpc/docs/firewall-rules-logging