it is calico that is intimidating. it's not clear how it should be configured for an environment where it has two kinds of networks to operate on. its cross-network solution, BGP, does not work in AWS VPC.