Use private subnets

[llinder]

This changes a lot from your current structure but would you consider making all of the subnets private except mgmt and elb? I'm willing to contribute some changes to make this happen including provisioning of a bastion server if your open to that.

[xuwang]

Absolutely, it should be done for a production system. The code base, the k8s is changing so fast so that we never get around to actually make it happen. It's would be great if you'd like to chip in. Please make PRs and your efforts will be appreciated