Right now I'm solving this by having two separate ingress controllers in one cluster - one for private stuff only available over a vpn, and one only available over public ips.
How's this working out? What kinda alternatives are there with a single cluster?
When installing an encrypted Arch system, I couldn't figure out how to change the keymap in GRUB stage 1, which asks for the passphrase and then decrypts /boot. I just entered my passphrase with the default en-us keymap without really knowing what characters it outputs.
While those are valid concerns, it's not really hard to see why people use VPNs. Just look at how companied and countries abuse the internet, abuse us.
Why?