diff --git a/modules/asm/README.md b/modules/asm/README.md
index fbe60ef6f8..4710eb1bb6 100644
--- a/modules/asm/README.md
+++ b/modules/asm/README.md
@@ -50,6 +50,7 @@ To deploy this config:
 | enable\_mesh\_feature | Determines whether the module enables the mesh feature on the fleet. | `bool` | `false` | no |
 | enable\_vpc\_sc | Determines whether to enable VPC-SC for this ASM installation. For more information read https://cloud.google.com/service-mesh/docs/managed/vpc-sc | `bool` | `false` | no |
 | fleet\_id | The fleet to use for this ASM installation. | `string` | `""` | no |
+| internal\_ip | Use internal ip for the cluster endpoint when running kubectl commands. | `bool` | `false` | no |
 | multicluster\_mode | [Preview] Determines whether remote secrets should be autogenerated across fleet cluster. | `string` | `"manual"` | no |
 | project\_id | The project in which the resource belongs. | `string` | n/a | yes |
 
diff --git a/modules/asm/main.tf b/modules/asm/main.tf
index eea1d4cb1e..0f88922a30 100644
--- a/modules/asm/main.tf
+++ b/modules/asm/main.tf
@@ -58,6 +58,7 @@ module "cpr" {
   project_id       = var.project_id
   cluster_name     = var.cluster_name
   cluster_location = var.cluster_location
+  internal_ip      = var.internal_ip
 
   kubectl_create_command  = "${path.module}/scripts/create_cpr.sh ${local.revision_name} ${local.channel} ${var.enable_cni} ${var.enable_vpc_sc}"
   kubectl_destroy_command = "${path.module}/scripts/destroy_cpr.sh ${local.revision_name}"
diff --git a/modules/asm/variables.tf b/modules/asm/variables.tf
index fff531514d..94560d8f9c 100644
--- a/modules/asm/variables.tf
+++ b/modules/asm/variables.tf
@@ -86,3 +86,9 @@ variable "enable_mesh_feature" {
   type        = bool
   default     = false
 }
+
+variable "internal_ip" {
+  description = "Use internal ip for the cluster endpoint when running kubectl commands."
+  type        = bool
+  default     = false
+}