From wanting to have the internal.console domains behind the vpn, Keith, Jay, and I have come up:

• moving internal.console.redhat.com/public routes to the external gateway
• adding a new hostname vpn.console.redhat.com that is only accessible... behind the vpn. Apps can then move to it as they please.
• This will leave the internal domain for service-to-service communication (because of internal auth).

hostnames:

• vpn.console(.dev|.stage|).redhat.com
• mtls.vpn.console(.dev|.stage|).redhat.com