Given you are going to overcome risks of a whole cloud region going offline, you would implement some cross-site distribution mechanisms.
In terms of Kubernetes, cluster communication would happen across public network.
Therefore, probably, you need to setup end to end VPN connections?
Does this all make sense or how do you approach the problem?
First, etcd is a core component in Kubernetes clusters. It is based on the Raft Consensus Algorithm and a weaker point with it is when the latency between the members (e.g. in the distribued etcd database) in the cluster is larger and vary more. It might work to deploy it with longer latency between the nodes (e.g. regions as in cross-region) but it might not be the best idea, at least not out of the box.
But if you use cross-region deployments, one of the main reason to do it is probably to tolerate a full region outage - but then I think it is even a better idea to deploy independent (e.g. can work without the other) clusters.
What might be interesting in relation to this is Kubernetes Federation Evolution and kubefed.
I don't see VPN (e.g. a single network?) very related to this (this is more its own topic) - at least not when you want independent clusters. SSL/TLS might also be related. And if you do cross-regions, e.g. Software Defined Network or cloud VPC might be related as well. E.g. Amazon VPC is located on a single region, but Google Cloud VPC is global (multi-region).
