So this was just an accident of some sort?

That someone was correct.

Right now I’m solving this by having two separate ingress controllers in one cluster - one for private stuff only available over a vpn, and one only available over public ips.

How’s this working out? What kinda alternatives are there with a single cluster?

They actually got better? Nice work

While those are valid concerns, it’s not really hard to see why people use VPNs. Just look at how companied and countries abuse the internet, abuse us.