You don't have to tell us, internal LB was a long time coming. As for hosted VPN, do you mean something different than our Cloud VPN offering? (
https://cloud.google.com/compute/docs/vpn/overview)
We ended up setting up OpenVPN, which shouldn't be necessary. SSH is great and all, but when you add Kubernetes and other sensitive things like dashboards, you really want to virtualize everything and hide every internal service behind a proper, solid VPN gateway.
That's feasible but only things that do certificate exchange (https etc is easy enough). For what it's worth, part of the reason for Cloud Shell (the little shell within the web console) is so that you can interact with your infrastructure from inside the GCP network. That doesn't solve all your needs (like dashboards or deploying code from your laptop) but is often quite handy.
Generally individual users connecting to a VPN are called road warriors, even if they're not on the road and always connect from the same place.