You can choose to create a new network for this cluster, or use an existing network. If you use an existing, it needs to have a subnet and router with a gateway on the external network. You may also need to take care not to conflict with CIDRs in use by the Kubernetes pod and service network.
Making the Kubernetes API accessible from your private network only is the most secure option (the default), but access will be limited to compute instances on the same private network or a VPN to that network.
Making the Kubernetes API accessible from the public internet with a floating IP is convenient, but may represent a security risk. When selecting this option, it is recommended to set Allowed CIDRs to limit access to a trusted IP address range.
If this field is left empty, the API Loadbalancer will accept connections from any address. When set to one or more CIDR then only those, plus the internal network, are permitted access to the Kubernetes API Loadbalancer.