[Feature]: Support air gap clusters

[alistarle]

Problem to Solve

To enhance security of the Kubernetes Cluster provisioned by the provider we should be able to remove internet dependency. Indeed, by the book, cluster-api doesn't require an internet connexion by itself, he only need a L2 connexion between management cluster and workload cluster.

Currently the provider enforce usage of the InternetService, NatGateway and public network.

Proposed Solution

Allow disabling of InternetService and NatGateway in the provider to create airgap services. It also allow more granular configuration for workload clusters

Additional Context

No response

Environment Details

- Kubernetes version (`kubectl version`):
- OS (`/etc/os-release`):
- Kernel (`uname -a`):
- cluster-api-provider-outscale version:
- cluster-api version:
- Install tools:
- Kubernetes distribution:
- Kubernetes distribution version:

[jfbus]

Allowing the user to disable internetService & natGateways should not be very complicated in itself. Setting-up the CI to be able to build air-gapped clusters will be much harder...

Let's list what is needed to build such a cluster (apart from properly configuring Linux on the nodes):

• configure the image so as not to have to download runc at boot
• have an accessible image repository
• configure routing to the image repository (& other services required by Linux or the app)
• configure the load-balancer as internal, ensure that worker nodes can talk to it

[Joseph94m]

Will also need to add the RemoveDefaultOutboundRule in

https://github.com/outscale/cluster-api-provider-outscale/blob/main/api/v1beta1/types.go#L353

This is already implemented in the terraform provider https://registry.terraform.io/providers/outscale/outscale/latest/docs/resources/security_group#remove_default_outbound_rule-2

[jfbus]

The default outbound rule can already be removed in 1.0 by using the authoritative security group flag.
When authoritative is set, CAPOSC will remove all rules that are not specified in the spec (including the default rules).

When setting allowToIPRanges/allowFromIPRanges, the automatic config of the security group rules should be (nearly ?) ok.

[jfbus]

Follow-up:

• as the LBU for the kube API is internal and as CAPI must be able to talk to it, there must be a NetPeering between the management VPC and the workload VPC
• as there is no internet, there must be a NetAccessPoint configured to query the Outscale API (required for CCM and CSI)