[roshan8]

IMO, lot of services are not matured enough. For eg: Changing roles or even a security group from GKE/Nodepool requires nodepool replacement. We need to take care of the complete node draining and adding the new nodepool. I too agree that GCP doesn't take customer feedbacks like AWS do.

[gbrindisi]

I missed this, can you elaborate?

I see that hot swapping the identity of a node pool may be difficult, but it's weird that you can't change the firewall rules.

[roshan8]

We can add new rules to existing network tags(security groups). However, Adding new network tags to node pool require node-pool replacement at this time. That's pretty wierd.