The point is to limit the attack surface, following zero trust and least privilege principles. This particular rule follows also GKE product networking best practices [1]. However we understand that not all rules apply to all environments. That is why it is possible to exclude selected rules in a tool or provide set of own, custom policies. If Security Command Center is used, it is also possible to mute findings there.

References: [1] https://cloud.google.com/kubernetes-engine/docs/best-practic...