adds example for creating vpc endpoints

[jaxesn]

Issue #, if available:

Description of changes:

When creating a cluster and connecting worker nodes from on-prem, some customers may want to limit traffic to and through only their VPC from these on-prem nodes. This adds an example for creating the neccessary VPC Interface/Gateway endpoints to support the nodeadm init flow. nodeadm install would still require internet access to download packages from the distro package manager.

Most of the services we depend only require an Interface endpoint, which allows inbound traffic from onprem to these VPC private endpoints. S3 is a bit different and requires both Gateway and Interface endpoints. See more here and here

A Router 53 resolver is required, which is a set of DNS servers running in the VPC and the on-prem nodes need to point to these DNS IPs for resolution. This allows the service endpoints, as well as the Kubernetes cluster API endpoint, to resolve to the private IPs as if the on-prem nodes were in the VPC in the cloud.

@mimcdevitt is working on a user facing doc to lay all this out.

Todo:

• RemotePodCidr should also be a parameter and set on the SGs for some of the service endpoints

Testing (if applicable):

Documentation added/planned (if applicable):

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.