on the AWS VPC side, it looks like i should use the gateway. i could theoretically run a wireguard kernel configuration daemonset on linux nodes, and then do a netclient daemonset on each AWS node.