Solution 1:

Instead of adding each node's pod-CIDR to the VPN config, you could add the entire cluster-CIDR (where any new/recreated nodes will have their pod-CIDRs pulled from).

To find the cluster-cidr:

gcloud container clusters describe your-cluster | grep clusterIpv4Cidr