When in doubt, encapsulate it.

 Solved with Aviatrix Google Compute instances with DNS Forwarding Zones Aviatrix   is the leading vendor of Secure Multicloud Networking. From the website:  The Aviatrix cloud network platform delivers a single, common platform for multi-cloud networking, regardless of public cloud providers used. Aviatrix delivers the simplicity and automation enterprises expect in the cloud with the operational visibility and control they require. Environment and DNS Structure In the interest of simplicity, the customer has a single region Aviatrix-based deployment in GCP, using Firewall Insertion. They connect to their datacenter using Cloud Interconnect and Aviatrix Edge. They also have Apigee-X, deployed using a single region version of this  article. DNS is deployed on the same servers as the Active Directory Domain Controller role. The DCs/DNS Servers are on-prem at this time. GCP Domain Controllers will eventually be deployed as well. So what's the problem? When VM instances are deployed i

  How To: Securely bring Google-managed Apigee-X to another Cloud or Datacenter Product Focus Google Apigee is one of the most popular tools to expose APIs to the wider world. From the Apigee documentation:  Apigee is a platform for developing and managing APIs. By fronting services with a proxy layer, Apigee provides an abstraction or facade for your backend service APIs and provides security, rate limiting, quotas, analytics, and more. This blog is focused on Apigee-X , which is hosted in Google Cloud. Aviatrix   is the leading vendor of Secure Multicloud Networking. From the website:  The Aviatrix cloud network platform delivers a single, common platform for multi-cloud networking, regardless of public cloud providers used. Aviatrix delivers the simplicity and automation enterprises expect in the cloud with the operational visibility and control they require. Aviatrix can easily connect Google Apigee-X to AWS, Azure, and on-prem backends with full encryption and visibility. Backgro