Optional managed outbound connectivity was added so private nodes can pull the pinned container image and access cloud APIs during bootstrap. It can be disabled for networks that already provide egress, and it was not deployed live.
- What worked
- Cloud NAT preserved the no-public-IP design while addressing a concrete image-pull and secret-access bootstrapping requirement.
