Restrict public access to Kubernetes API Server on EC2 kubernetes clusters

[anindya4g]

/kind feature

Describe the solution you'd like
There should be a way to restrict public access to the Kubernetes API server on EC2 kubernetes clusters to specific Whitelisted IP's while using NLB's.

Currently the auto-generated security group attached to the control plane load balancer always allows public access. This is a security risk for sensitive clusters.

Anything else you would like to add:
The internet suggests using the SecurityGroupOverrides feature to replace the default security group with your own security group thats more private but this does not work well outside a Bring Your Own AWS Infrastructure scenario.

Environment:

• Cluster-api-provider-aws version: v2.7.1
• Kubernetes version: (use kubectl version): v1.32.0
• OS (e.g. from /etc/os-release): Ubuntu 24.04

[k8s-ci-robot]

This issue is currently awaiting triage.

If CAPA/CAPI contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.