refactor securityGroup handling to reuse existing securityGroup on worker nodes

[M00nF1sh]

1. PR to make migration to Ingress Group Feature Testing #914 happen :D
2. solves Only 5 SGs per ENI allowed #682
3. solves Deletion of ALB in shared subnets fails #986
4. more cleaner code for instance SG management
5. adding kubenet ip mode support should be pretty ez (will do it in following up PR)

The SecurityGroup management in ALB Ingress controller depends on whether external SecurityGroups
are provided via annotation alb.ingress.kubernetes.io/security-groups.

• external SecurityGroups specified:

  1. the external specified SecurityGroups will be applied to LoadBalancer.
  2. no changes will be done to worker node SecurityGroups, customer need to grant inbound permission
     from these external SecurityGroups to worker node SecurityGroups.

• external SecurityGroups unspecified:

  1. controller will automatically create an SecurityGroup, which will be applied to LoadBalancer.
  2. controller will modify the securityGroup on worker nodes to allow inbound traffic from the LB SecurityGroup.
     • under instance targeting mode:
       1. controller will modify the SecurityGroup on primary ENI of all worker nodes to allow traffic from LB SecurityGroup.
     • under ip targeting mode with amazon-vpc-cni-k8s:
       1. controller will modify the SecurityGroup on ENIs that supports these pod IPs.

  How SecurityGroups on ENI are identified follows process described below:
  1. if there are only single SecurityGroup on ENI, that SecurityGroup will be chosen.
  2. if there are multiple SecurityGroup on ENI, the single SecurityGroup with tag kubernetes.io/cluster/<cluster-name> will be chosen.
  3. otherwise, error will be raised.

  NOTE: older versions will try to create an standalone SecurityGroup which allows from traffic from LB SecurityGroup and attach to worker nodes ENI.
  This behavior is changed to above due to un-scalability caused by AWS limits of allow securityGroup per ENI.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: M00nF1sh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [M00nF1sh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[leakingtapan]

/lgtm