Making the Kubernetes API accessible from the private network only is the most secure option (the default), but access will be limited to compute instances on the same private network or a VPN to that network.
Making the Kubernetes API accessible from anywhere on the public internet is convenient, but may represent a security risk. [When selecting this option, it is recommended to limit access to a trusted IP address range.]