Fix shared SG issue for an existing cluster

[errordeveloper]

Description

This is a follow-up to #438, it adds new eksctl update-cluster-stack command that updates an existing cluster stack with new resources that are missing (append-only).

Closes #419.

A cluster was created using an old version (0.1.18):

 [0] >> eksctl create cluster --name=test-missing-node-sg
[ℹ]  using region us-west-2
[ℹ]  setting availability zones to [us-west-2c us-west-2a us-west-2b]
[ℹ]  subnets for us-west-2c - public:192.168.0.0/19 private:192.168.96.0/19
[ℹ]  subnets for us-west-2a - public:192.168.32.0/19 private:192.168.128.0/19
[ℹ]  subnets for us-west-2b - public:192.168.64.0/19 private:192.168.160.0/19
[ℹ]  nodegroup "ng-fba6638e" will use "ami-0a2abab4107669c1b" [AmazonLinux2/1.11]
[ℹ]  creating EKS cluster "test-missing-node-sg" in "us-west-2" region
[ℹ]  will create 2 separate CloudFormation stacks for cluster itself and the initial nodegroup
[ℹ]  if you encounter any issues, check CloudFormation console or try 'eksctl utils describe-stacks --region=us-west-2 --name=test-missing-node-sg'
[ℹ]  creating cluster stack "eksctl-test-missing-node-sg-cluster"
[ℹ]  creating nodegroup stack "eksctl-test-missing-node-sg-nodegroup-ng-fba6638e"
[✔]  all EKS cluster resource for "test-missing-node-sg" had been created
[✔]  saved kubeconfig as "/Users/ilya/.kube/config"
[ℹ]  nodegroup "ng-fba6638e" has 1 node(s)
[ℹ]  node "ip-192-168-36-245.us-west-2.compute.internal" is not ready
[ℹ]  waiting for at least 2 node(s) to become ready in "ng-fba6638e"
[ℹ]  nodegroup "ng-fba6638e" has 2 node(s)
[ℹ]  node "ip-192-168-36-245.us-west-2.compute.internal" is ready
[ℹ]  node "ip-192-168-90-139.us-west-2.compute.internal" is ready
[ℹ]  kubectl command should work with "/Users/ilya/.kube/config", try 'kubectl get nodes'
[✔]  EKS cluster "test-missing-node-sg" in "us-west-2" region is ready

Trying to add a nodegroup with the new version fails:

 [0] >> ./eksctl create nodegroup --cluster=test-missing-node-sg      
[ℹ]  using region us-west-2
[ℹ]  nodegroup "ng-318da8b7" will use "ami-0a2abab4107669c1b" [AmazonLinux2/1.11]
[✖]  cluster compatibility check failed: shared node security group missing, to fix this run 'eksctl utils update-cluster-stack --name=test-missing-node-sg --region=us-west-2'
 [1] >> 

Fix the problem:

 [0] >> ./eksctl utils update-cluster-stack --name=test-missing-node-sg --region=us-west-2
[ℹ]  creating cluster stack "eksctl-test-missing-node-sg-cluster"
[ℹ]  (dry-run) updating stack to add new resources [ClusterSharedNodeSecurityGroup IngressInterNodeGroupSG] and ouputs [SharedNodeSecurityGroup]
[ℹ]  checking security group configuration for all nodegroups
[✖]  found 1 nodegroup(s) (ng-fba6638e) without shared security group, cluster networking maybe be broken
[✖]  it's recommended to create new nodegroups, then delete old ones
[!]  no changes were applied, run again with '--dry-run=false' to apply the changes
 [0] >> ./eksctl utils update-cluster-stack --name=test-missing-node-sg --region=us-west-2 --dry-run=false
[ℹ]  creating cluster stack "eksctl-test-missing-node-sg-cluster"
[ℹ]  updating stack to add new resources [ClusterSharedNodeSecurityGroup IngressInterNodeGroupSG] and ouputs [SharedNodeSecurityGroup]
[ℹ]  checking security group configuration for all nodegroups
[✖]  found 1 nodegroup(s) (ng-fba6638e) without shared security group, cluster networking maybe be broken
[✖]  it's recommended to create new nodegroups, then delete old ones
 [0] >> ./eksctl utils update-cluster-stack --name=test-missing-node-sg --region=us-west-2 --dry-run=false
[ℹ]  creating cluster stack "eksctl-test-missing-node-sg-cluster"
[✔]  all resources in cluster stack "eksctl-test-missing-node-sg-cluster" are up-to-date
[ℹ]  checking security group configuration for all nodegroups
[✖]  found 1 nodegroup(s) (ng-fba6638e) without shared security group, cluster networking maybe be broken
[✖]  it's recommended to create new nodegroups, then delete old ones
[✖]  as a temporary fix, you can patch the configuration and add each of these nodegroup(s) to "sg-034c1a4f4b0bbea77"
 [0] >>

Create new nodegroup, delete old one:

 [0] >> ./eksctl create nodegroup --cluster=test-missing-node-sg 
[ℹ]  using region us-west-2
[ℹ]  nodegroup "ng-d6ae625f" will use "ami-0a2abab4107669c1b" [AmazonLinux2/1.11]
[ℹ]  will create a Cloudformation stack for nodegroup ng-d6ae625f in cluster test-missing-node-sg
[ℹ]  creating nodegroup stack "eksctl-test-missing-node-sg-nodegroup-ng-d6ae625f"
[ℹ]  nodegroup "ng-d6ae625f" has 0 node(s)
[ℹ]  waiting for at least 2 node(s) to become ready in "ng-d6ae625f"
[ℹ]  nodegroup "ng-d6ae625f" has 2 node(s)
[ℹ]  node "ip-192-168-28-8.us-west-2.compute.internal" is ready
[ℹ]  node "ip-192-168-70-86.us-west-2.compute.internal" is ready
[✔]  created nodegroup "ng-d6ae625f" in cluster "test-missing-node-sg"
[ℹ]  checking security group configuration for all nodegroups
[✖]  found 1 nodegroup(s) (ng-fba6638e) without shared security group, cluster networking maybe be broken
[✖]  it's recommended to create new nodegroups, then delete old ones
[✖]  as a temporary fix, you can patch the configuration and add each of these nodegroup(s) to "sg-034c1a4f4b0bbea77"
 [0] >> ./eksctl delete nodegroup --cluster=test-missing-node-sg ng-fba6638e
[ℹ]  deleting nodegroup "ng-fba6638e" in cluster "test-missing-node-sg"
[ℹ]  will delete stack "eksctl-test-missing-node-sg-nodegroup-ng-fba6638e"
[✔]  nodegroup "ng-fba6638e" will be deleted
 [0] >> 

Checklist

• Code compiles correctly (i.e make build)
• All tests passing (i.e. make test)

[dlespiau]

\o/