[aws-eks] Support choosing public, private or CIDR whitelist endpoints

[abhishekjawali]

Enable choosing public or private endpoints at the time of cluster creation.

Use Case

EKS supports choosing public / private endpoints at the time of cluster creation - https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html

Proposed Solution

Add the properties 'publicEndpointEnabled: boolean' and 'privateEndpointEnabled: boolean' in @aws-cdk/aws-eks.ClusterProp

[dnascimento]

Requested to CloudFormation team as well: aws-cloudformation/cloudformation-coverage-roadmap#118

[arjanschaaf]

I thought I could work my way around it by creating the EKS cluster using CDK and then manually change the public endpoint to a private endpoint using the AWS web console. That step works off course but now I'm running into the next issue: I can't access the cluster properly through the CDK.
For example: I extended my CDK stack by adding an additional a kubernetes resource (in this example an additional cert-manager cluster issuer object):

cluster.addResource('production-cluster-issuer', {
            apiVersion: 'cert-manager.io/v1alpha2',
            kind: 'ClusterIssuer',
            metadata: { 
                name: 'letsencrypt-production',
                namespace: 'cert-manager'
            },
            spec: {
                acme: {
                    email: 'info@example.com',
                    server: 'https://acme-v02.api.letsencrypt.org/directory',
                    privateKeySecretRef: {
                        name: 'letsencrypt-production'
                    },
                    solvers: [{
                        http01: {
                            ingress: {
                                class: 'nginx'
                            }
                        }
                    }]
                }
            }
        })

But this results in kubectl timeouts in the underlying Lambda function. When I switch back to a public endpoint for my EKS cluster the code works. This should probably be fixed in the security group associated with the EKS cluster, but it is hard to figure out how to extend the security group in such a way that a private EKS cluster is accessible for the CDK lambda's...