A cloud security team must harden the management plane for a Kubernetes cluster running on Google Kubernetes Engine. They want to limit who can reach the control plane endpoint and ensure that any administrative action taken against the cluster is attributable to a named identity. (Choose two.)