Unless they are k8s controller nodes, workers should have private IPs. xref: https://github.com/galaxyproject/cloudman/issues/100