I.e.:
- undercloud runs on a vps machine
- zerotier connects it with your internal non-public network
- setup a small node with openvswitch to bridge the connections