@astrid oh and the worker nodes have to reach the apiserver of course and the apiserver (and maybe other control-plane components, not sure rn) need to reach the worker nodes - so the two connections we have is an IP:Port for apiserver and IP:Port for Konnectivity for the way back - but in your case you could probably just route from control-plane to worker network, but not allow the other way around

@astrid but .. since worker nodes really have to reach the apiserver (and many workloads need to, too) and the apiserver is the most critical part ... not sure if that network separation is worth it for security reasons?

@astrid I see the benefits and this should work :)