The layered-zero-trust pattern includes an azure-nat-gateway.yaml playbook that configures NAT gateway resources needed for peer-pods networking on Azure. Since CoCo on Azure requires this NAT gateway setup, and other CoCo-enabled patterns may need it too, it might make sense to move this to the VP ansible collection.
@butler54 flagged this during PR #80 review. The playbook would live in the ansible collection and be consumed by layered-zero-trust (and potentially coco-pattern) as a dependency instead of being maintained inline.