Separate subnets for control plane nodes

[alex-dabija]

Story

-As a cluster admin, I want the control plane nodes to be on separate subnets (one per availability zone) in order to have clear network boundaries.

Towards epic.

Background

Cluster API for AWS (CAPA) in its default configuration puts all the (control plane & worker) nodes to the same subnet (there is one per availability zone).

Some customers want a clear separation between control plane nodes and worker nodes because they use a transit gateway which filters traffic based on its source (CIDR).

The aws-vpc-operator is able to create all the required subnets with CIDRs configured.

Requirements

• separate subnets for the control plane nodes (one per availability zone);
• each subnet CIDR needs to be configurable;
• CAPA needs to be able to choose the right subnet for each availability zone where control plane nodes are running.

TODOs

• check if it's possible to have the control plane nodes runnig on separate subnets with specific tags;
• expose configuration settings via values.yaml in cluster-aws to configure the control plane subnets.

[alex-dabija]

Implemented and released as part of cluster-aws v0.21.0.