shouldnt we be able to create a private API cluster endpoint with ec2 nodes in private subnets that will join the cluster from the VPCEs ?