I'm trying to figure out what Egress rules must be allowed for the Google Container Engine to function properly.

I am currently using the following rules:

gcloud beta compute firewall-rules create "outbound-deny" \
    --action DENY --rules all --direction "EGRESS" --priority "65531" \
    --network "secure-vpc" --destination-ranges "0.0.0.0/0"
gcloud beta compute firewall-rules create "outbound-internal" \
    --allow all --direction "EGRESS" --priority "65530" \
    --network "secure-vpc" --destination-ranges "10.0.0.0/8"

With these rules in place, creating a cluster in this network will fail. It does create all the machines, network rules, etc. The kubernetes cluster still never reports the nodes as alive.