Allow AWS Prefix Lists for sshAccess and kubernetesApiAccess

[mcbanderson]

/kind feature

1. Describe IN DETAIL the feature/behavior/change you would like to see.

AWS provides prefix lists as a mechanism for managing security group rules and route tables. These prefix lists can be used in security group rules in place of a CIDR and AWS will automatically handle all CIDRs in the list with only one security group rule.

We would like to be able to utilize these prefix lists for sshAccess and kubernetesApiAccess in our cluster spec to simplify security group management and avoid hitting AWS' hard limit on the number of security group rules.

2. Feel free to provide a design supporting your feature request.

From a user interface standpoint we would simply like to see kops allow the prefix list id (name would also be acceptable, but that might be more complicated to implement) in the pertinent parts of the cluster spec and then create the inbound security group rules with the prefix list instead of the CIDR.

spec:
  kubernetesApiAccess:
    - 12.34.56.78/32
    - pl-abc123

[rifelpet]

This sounds reasonable and should be pretty straight forward. If anyone wants to implement this, it should just involve:

• Adding a PrefixList field to the SecurityGroupRule task here, adding similar logic throughout that file as the existing CIDR and IPv6CIDR fields.
• Update references to KubernetesAPIAccess (1, 2, 3, and similar for SSHAccess and AdminAccess) to check for a pl- prefix on the list element, conditionally using the field in the SecurityGroupRule task's PrefixList field.
• Add example prefix lists to the cluster specs in the in-*.yaml files in the integration test here and run ./hack/update-expected.sh to confirm the generated terraform and cloudformation outputs change.

[hierynomus]

I'll pick this up, expect a PR somewhere next week.

[hierynomus]

With the merge of #13113, this issue can be closed I think @hakman

[hakman]

With the merge of #13113, this issue can be closed I think @hakman

I think so. Should be available in kOps 1.23. Thanks again @hierynomus!