Introduce public and private endpoints for exposing TenantControlPlane

[bsctl]

Some of the Managed Kubernetes Services out there, e.g. AKS, IKS, provide a public Cluster Endpoint, e.g. https://35.41.67.241:443 to expose the Control Plane to the public Internet, used by kubectl from users, and a private Cluster Endpoint, e.g. https://10.10.100.12:6443 to expose the Control Plane in the private network where worker nodes are placed.

The Konnectivity-server Endpoint, port 8132, is also exposed to the Public Internet, if you want join worker nodes placed on a remote datacenter or another cloud or, most likely, it's only exposed to the private network.

For example, on IKS:

This proposal is to introduce the same concept in Kamaji and should be part of the refactoring work for the tcp.spec.networkProfile as stated in #48

[maxgio92]

I like the feature. I'm wondering who/which component should be responsible of the provisioning of the infrastructure needed to expose the Konnectivity server (i.e. public IP, NAT gateway, etc.).

[prometherion]

I think we don't need to add this feature since it can be easily achieved using an additional Ingress or Service, and using the provided hostname or IP added to the certSANs field.

@bsctl let me know if we can close this.

[bsctl]

yep