@astrid our managed kubernetes service works like that - we have the control-planes of customer clusters running on our shared infrastructure clusters and only the worker nodes for customer clusters are their own VMs ^^

So, works fine - but that control-plane is not really a control-plane node, so everything that needs to be reached by workload containers (e.g. CoreDNS) needs to be on normal worker nodes