Just a follow up:
Currently have this working (Juju kubernetes cluster on MAAS). I was not able to get packet forwarding to work properly or allow internet to pass through the rack/region controller. Some parts work work sometimes but not other times, during this process I tried all different networking configurations and this was not without collateral damage. Anything that was a ubuntu machine, unrelated to the cluster, got their DNS scrambled and I cannot get them to function on the local network for shared mounts, I get an unknown error in name resolution. Somewhere along the line MAAS brought these machines into it's domain, this is no longer the case but I still haven't figured out how to fix it. If anyone knows whats going on here any advice, besides reinstalling, would be helpful.
To get this working I had to use a rack/region controller, on 18.10, no extra packages at the time of install. I disconnected all but one physical network interface from every server and used a physical interface from pfsense, to a unique switch on it's own domain. The pfsense has DHCP enabled, can't get it working without it on, and so dose the rack/region. I created a reserved range in the dhcp space for both, non-overlapping. Rack/region has a static assignment in pfsense, TFTP server is named (RACK/REGION IP), and domain is named in pfsense. I had some trouble initially getting PXE to work after pfsense assigned an address, I'm not sure if enabling and disabling ignore BOOTP had any effect or if it was uninstalling the TFTP server package from Pfsense but it definitely didn't just work. Pfsense assigned the first IPs and would not forward them to the rack/region.
I'm still not pleased with this setup, the networking does not seem to make much sense, not that pfsense is any better. I'm not sure what exactly can be done here other than finding a detailed description of lower level networking. I would like a better path to network isolation for this type of setup, using only one nic seemed to be the key but that is not how I gathered it from documentation. One NIC on the MAAS controller I definitely did not see mentioned anywhere but this seemed to be the key. I'll keep this open until I figure out what fuckery happened to the rest of the network.