I am trying deny all egress on firewall rule then, test create a container finally I expect this operation will fail But... my question is "how to recover the nodes to become registered"? Has some command like gcloud container cluster repair [NAME]?
simply put, this is not possible. Kubelet needs perpetual connection to kubernetes api server, and it is the kubelet that initiates this connection in the first place. When the node registers it self you're not done with the connectivity requirement, as kubelet will watch resources on API to ie. notice and act when a new pod is scheduled for this node.
Mind that you also need the connectivity from API server to kubelet for example for functionalities like kubectl exec, proxy or port-forward. Your monitoring will probably need to connect to kubelet exposed metrics as well as maybe something like prometheus-node-exporter.
The bottom line is, that you can not isolate the node completely. Pods are a different story though. To get detailed control over pod traffic you might want to look into Network Policies and service mesh solutions like Istio