By default, private clusters using this module have the network policy enabled. Google has documented some limitations this feature has, so if you don't need network policy after you provisioned the cluster and you want to disable it, you will get the following error:
│ Error: googleapi: Error 400: Network policy addon cannot be removed until network policy has been disabled on the nodes., badRequest
│
│ with module.gke_misc.google_container_cluster.primary,
│ on .terraform/modules/gke_misc/modules/beta-private-cluster-update-variant/cluster.tf line 22, in resource "google_container_cluster""primary":
│ 22:resource"google_container_cluster""primary" {
│
╵