Full AWS network customization for Shoot cluster

[mvladev]

How to categorize this issue?

/area networking /kind enhancement /platform aws /priority 3

What would you like to be added:

The ability to provision Shoot cluster in already existing VPC with pre-existing routing tables, subnets, nat gateways and internetgateways.

Why is this needed:

In some cases, due to security, a AWS network layout would require having all egress/ingress traffic pass through another VPC (with existing NAT gateways and internet gateways). In such cases, end-user might want to provison and configure all subnets, routing tables in advance, while Gardener should be able to provsion machines in those subnets. Those subnets should be specified by the end-user when creating the cluster and used by the MCM.

The infra controller should also tag (and untag) subnets with "kubernetes.io/cluster/{{ clusterName }}" = "1" to allow cloud-controller-manager to automatically detect its subnets.

Something like:

apiVersion: aws.provider.extensions.gardener.cloud/v1alpha1
kind: InfrastructureConfig
enableECRAccess: true
networks:
  vpc:
    id: my-id
  zones:
  - name: eu-west-1a
    internalID: subnet-id
    publicID: subnet-id
    workersID: subnet-id