i do really like a lot of the high availability features k8s provides. the rolling updates are funny

@astrid you could totally do edge nodes as a separate node group, control plane in different subnet should be fine so long as inbound access to api server is allowed. Depending on CNI you may need to allow kube-proxy or whatever through also, some need to access the kube api server via the internal service when bootstrapping