I've got a physical cluster with etcd/controlplane roles on some of the physical machines. I'd like to move these roles off to some VMs. What would be the proper steps to do this? Do I need to add the new VMs first, then remove the physical node(s)? Or the other way around?

AFAIK adding or removing masters from k8s is not an easy task to afford. Considering you´re moving from physicals to VMs, how about create a new controlplane on the virtual nodes, adding workers and perform a blue/green migration? Moving the core components of k8s should involve etcd data migration, controller and components along with losing both etcd/controlPlane quorum, not even talking about the certificates issues when you try to do something like move the components.

@little-autumn-44758 To not have downtime nor risk of corruption is safe to do it in two stages. You can start adding 2 VMS to the etcd/control plane, so you have temporarily 5 nodes. Then remove 2 physical nodes, so you still have a quorum over one physical and two virtual. Finally, add the thrid VM, temporarily, you won't have a quorum, but, once the third VM is added to the cluster, you can just remove the last physical node.