If it is only workload isolation, why not?

For secure isolation, we learned it's not sufficient. It's good for resource isolation though.

PTAL at https://www.youtube.com/watch?v=6rMGRvcjvKc

That guide looks nice. Have you guys thought about releasing a terraform module or even a cloud composer workflow that will set that up in a project?

Thanks! We actually do and shipped together with the best practices.

https://github.com/GoogleCloudPlatform/gke-enterprise-mt

Please give us feedback there in case you hit any issue!