diff --git a/examples/gke-serverless/multitenant-fleet/README.md b/examples/gke-serverless/multitenant-fleet/README.md
index c1ae7476f..a4d6382c4 100644
--- a/examples/gke-serverless/multitenant-fleet/README.md
+++ b/examples/gke-serverless/multitenant-fleet/README.md
@@ -140,9 +140,9 @@ fleet_features = {
 | [clusters](variables.tf#L61) |  | <code title="map&#40;object&#40;&#123;&#10;  cluster_autoscaling &#61; object&#40;&#123;&#10;    cpu_min    &#61; number&#10;    cpu_max    &#61; number&#10;    memory_min &#61; number&#10;    memory_max &#61; number&#10;  &#125;&#41;&#10;  description &#61; string&#10;  dns_domain  &#61; string&#10;  labels      &#61; map&#40;string&#41;&#10;  location    &#61; string&#10;  net &#61; object&#40;&#123;&#10;    master_range &#61; string&#10;    pods         &#61; string&#10;    services     &#61; string&#10;    subnet       &#61; string&#10;  &#125;&#41;&#10;  overrides &#61; object&#40;&#123;&#10;    cloudrun_config         &#61; bool&#10;    database_encryption_key &#61; string&#10;    master_authorized_ranges        &#61; map&#40;string&#41;&#10;    max_pods_per_node               &#61; number&#10;    pod_security_policy             &#61; bool&#10;    release_channel                 &#61; string&#10;    vertical_pod_autoscaling        &#61; bool&#10;    gcp_filestore_csi_driver_config &#61; bool&#10;  &#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | ✓ |  |  |
 | [folder_id](variables.tf#L163) | Folder used for the GKE project in folders/nnnnnnnnnnn format. | <code>string</code> | ✓ |  |  |
 | [nodepools](variables.tf#L206) |  | <code title="map&#40;map&#40;object&#40;&#123;&#10;  node_count         &#61; number&#10;  node_type          &#61; string&#10;  initial_node_count &#61; number&#10;  overrides &#61; object&#40;&#123;&#10;    image_type        &#61; string&#10;    max_pods_per_node &#61; number&#10;    node_locations    &#61; list&#40;string&#41;&#10;    node_tags         &#61; list&#40;string&#41;&#10;    node_taints       &#61; list&#40;string&#41;&#10;  &#125;&#41;&#10;  spot &#61; bool&#10;&#125;&#41;&#41;&#41;">map&#40;map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;&#41;</code> | ✓ |  |  |
-| [prefix](variables.tf#L223) | Prefix used for resources that need unique names. | <code>string</code> | ✓ |  |  |
-| [project_id](variables.tf#L228) | ID of the project that will contain all the clusters. | <code>string</code> | ✓ |  |  |
-| [vpc_config](variables.tf#L240) | Shared VPC project and VPC details. | <code title="object&#40;&#123;&#10;  host_project_id &#61; string&#10;  vpc_self_link   &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | ✓ |  |  |
+| [prefix](variables.tf#L236) | Prefix used for resources that need unique names. | <code>string</code> | ✓ |  |  |
+| [project_id](variables.tf#L241) | ID of the project that will contain all the clusters. | <code>string</code> | ✓ |  |  |
+| [vpc_config](variables.tf#L253) | Shared VPC project and VPC details. | <code title="object&#40;&#123;&#10;  host_project_id &#61; string&#10;  vpc_self_link   &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | ✓ |  |  |
 | [authenticator_security_group](variables.tf#L21) | Optional group used for Groups for GKE. | <code>string</code> |  | <code>null</code> |  |
 | [cluster_defaults](variables.tf#L32) | Default values for optional cluster configurations. | <code title="object&#40;&#123;&#10;  cloudrun_config                 &#61; bool&#10;  database_encryption_key         &#61; string&#10;  master_authorized_ranges        &#61; map&#40;string&#41;&#10;  max_pods_per_node               &#61; number&#10;  pod_security_policy             &#61; bool&#10;  release_channel                 &#61; string&#10;  vertical_pod_autoscaling        &#61; bool&#10;  gcp_filestore_csi_driver_config &#61; bool&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  cloudrun_config         &#61; false&#10;  database_encryption_key &#61; null&#10;  master_authorized_ranges &#61; &#123;&#10;    rfc1918_1 &#61; &#34;10.0.0.0&#47;8&#34;&#10;    rfc1918_2 &#61; &#34;172.16.0.0&#47;12&#34;&#10;    rfc1918_3 &#61; &#34;192.168.0.0&#47;16&#34;&#10;  &#125;&#10;  max_pods_per_node               &#61; 110&#10;  pod_security_policy             &#61; false&#10;  release_channel                 &#61; &#34;STABLE&#34;&#10;  vertical_pod_autoscaling        &#61; false&#10;  gcp_filestore_csi_driver_config &#61; false&#10;&#125;">&#123;&#8230;&#125;</code> |  |
 | [dns_domain](variables.tf#L94) | Domain name used for clusters, prefixed by each cluster name. Leave null to disable Cloud DNS for GKE. | <code>string</code> |  | <code>null</code> |  |
@@ -154,7 +154,8 @@ fleet_features = {
 | [iam](variables.tf#L175) | Project-level authoritative IAM bindings for users and service accounts in  {ROLE => [MEMBERS]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [labels](variables.tf#L182) | Project-level labels. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [nodepool_defaults](variables.tf#L188) |  | <code title="object&#40;&#123;&#10;  image_type        &#61; string&#10;  max_pods_per_node &#61; number&#10;  node_locations    &#61; list&#40;string&#41;&#10;  node_tags         &#61; list&#40;string&#41;&#10;  node_taints       &#61; list&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  image_type        &#61; &#34;COS_CONTAINERD&#34;&#10;  max_pods_per_node &#61; 110&#10;  node_locations    &#61; null&#10;  node_tags         &#61; null&#10;  node_taints       &#61; &#91;&#93;&#10;&#125;">&#123;&#8230;&#125;</code> |  |
-| [project_services](variables.tf#L233) | Additional project services to enable. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |  |
+| [peering_config](variables.tf#L223) | Configure peering with the control plane VPC. Requires compute.networks.updatePeering. Set to null if you don't want to update the default peering configuration. | <code title="object&#40;&#123;&#10;  export_routes &#61; bool&#10;  import_routes &#61; bool&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  export_routes &#61; true&#10;  &#47;&#47; TODO&#40;jccb&#41; is there any situation where the control plane VPC would export any routes&#63;&#10;  import_routes &#61; false&#10;&#125;">&#123;&#8230;&#125;</code> |  |
+| [project_services](variables.tf#L246) | Additional project services to enable. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |  |
 
 ## Outputs
 
diff --git a/examples/gke-serverless/multitenant-fleet/gke-clusters.tf b/examples/gke-serverless/multitenant-fleet/gke-clusters.tf
index f94039dc5..8e04d780b 100644
--- a/examples/gke-serverless/multitenant-fleet/gke-clusters.tf
+++ b/examples/gke-serverless/multitenant-fleet/gke-clusters.tf
@@ -73,12 +73,9 @@ module "gke-cluster" {
   logging_config    = ["SYSTEM_COMPONENTS", "WORKLOADS"]
   monitoring_config = ["SYSTEM_COMPONENTS", "WORKLOADS"]
 
-  # if you don't have compute.networks.updatePeering in the host
-  # project, comment the next lines and ask your network admin to
-  # create the peering for you
-  peering_config = {
-    export_routes = true
-    import_routes = false
+  peering_config = var.peering_config == null ? null : {
+    export_routes = var.peering_config.export_routes
+    import_routes = var.peering_config.import_routes
     project_id    = var.vpc_config.host_project_id
   }
   resource_usage_export_config = {
@@ -116,5 +113,4 @@ module "gke-cluster" {
   #     memory_max = each.value.cluster_autoscaling.memory_max
   #   }
   # }
-
 }
diff --git a/examples/gke-serverless/multitenant-fleet/variables.tf b/examples/gke-serverless/multitenant-fleet/variables.tf
index 2354b136d..37138c379 100644
--- a/examples/gke-serverless/multitenant-fleet/variables.tf
+++ b/examples/gke-serverless/multitenant-fleet/variables.tf
@@ -220,6 +220,19 @@ variable "nodepools" {
   })))
 }
 
+variable "peering_config" {
+  description = "Configure peering with the control plane VPC. Requires compute.networks.updatePeering. Set to null if you don't want to update the default peering configuration."
+  type = object({
+    export_routes = bool
+    import_routes = bool
+  })
+  default = {
+    export_routes = true
+    // TODO(jccb) is there any situation where the control plane VPC would export any routes?
+    import_routes = false
+  }
+}
+
 variable "prefix" {
   description = "Prefix used for resources that need unique names."
   type        = string
diff --git a/fast/stages/03-gke-multitenant/dev/README.md b/fast/stages/03-gke-multitenant/dev/README.md
index f7eea314d..969828616 100644
--- a/fast/stages/03-gke-multitenant/dev/README.md
+++ b/fast/stages/03-gke-multitenant/dev/README.md
@@ -92,7 +92,7 @@ Leave all these variables unset (or set to `null`) to disable fleet management.
 
 ## Running Terraform
 
-Once the [providers](#providers-configuration) and [variable](#variable-configuration) configuration is complete, you can apply this stage:
+Once the [provider](#providers-configuration) and [variable](#variable-configuration) configuration is complete, you can apply this stage:
 
 ```bash
 terraform init