Right now I’m solving this by having two separate ingress controllers in one cluster - one for private stuff only available over a vpn, and one only available over public ips.

How’s this working out? What kinda alternatives are there with a single cluster?