Haven't tried yet myself, but since the ingress resource is just an https load balancer, enable IAP on that. Like so: https://medium.com/@DazWilkin/google-cloud-iap-and-gke-c773d...

Edit more direct: https://cloud.google.com/iap/docs/container-engine-quickstar...