GKE autopilot, manual load balancer and firewall rules

I have this GKE autopilot cluster and I'm trying to setup a Load Balancer for it's services. The caveat is: Instead of defining an Ingress for the cluster, which would create the LB and all the related configs, I have to manually define an LB.

GKE creates all the NEGs I need and I'm just pointing existing cluster to them as backends, and it works fine.

The problem: I can't manually create a firewall rule allowing the health check networks to reach the pods because the rule expects to receive a TAG as its target, but autopilot GKE hides all info ref. its nodes, e.g. the tags automatically created.

This is an example of firewall rule created by the GKE ingress controller:

Name: gke-autopilot-gke-cluster-XXXXX-xxxxx-egress
Target: gke-autopilot-gke-cluster-XXXXXX-node

I could create a firewall rule targeting the entire VPC/subnet, but how to achieve the node granularity within an autopilot cluster if I don't know the TAG the nodes will get?

The automatically created firewall rule can be viewed by the following command:

gcloud compute firewall-rules list --filter="name=gke-autopilot" --format=json

Though the below command can be used to update the firewall rules and add the desired target tags:

gcloud compute firewall-rules update firewall-rule-name \ --target-tags=tag-name

Because tags are maintained by Google, it is not feasible to set them in any autopilot node; instead, you must configure your cluster as a Standard one.