@astrid our managed kubernetes service works like that - we have the control-planes of customer clusters running on our shared infrastructure clusters and only the worker nodes for customer clusters are their own VMs ^^

So, works fine - but that control-plane is not really a control-plane node, so everything that needs to be reached by workload containers (e.g. CoreDNS) needs to be on normal worker nodes

@astrid oh and the worker nodes have to reach the apiserver of course and the apiserver (and maybe other control-plane components, not sure rn) need to reach the worker nodes - so the two connections we have is an IP:Port for apiserver and IP:Port for Konnectivity for the way back - but in your case you could probably just route from control-plane to worker network, but not allow the other way around

@astrid I see the benefits and this should work :)