Restrict public access to Kubernetes API Server on EC2 kubernetes clusters

[anindya4g]

/kind feature

Describe the solution you'd like
There should be a way to restrict public access to the Kubernetes API server on EC2 kubernetes clusters to specific Whitelisted IP's while using NLB's.

Currently the auto-generated security group attached to the control plane load balancer always allows public access. This is a security risk for sensitive clusters.

Anything else you would like to add:
The internet suggests using the SecurityGroupOverrides feature to replace the default security group with your own security group thats more private but this does not work well outside a Bring Your Own AWS Infrastructure scenario.

Environment:

• Cluster-api-provider-aws version: v2.7.1
• Kubernetes version: (use kubectl version): v1.32.0
• OS (e.g. from /etc/os-release): Ubuntu 24.04

[k8s-ci-robot]

This issue is currently awaiting triage.

If CAPA/CAPI contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale