🐛 fix: use cluster tag key to list managed egress-only internet gateway

[tthvo]

What type of PR is this?
/kind bug

What this PR does / why we need it:

The API for DescribeEgressOnlyInternetGateways does not support attachment.vpc-id filter. Thus, the call will return all available eigw. Consequences:

• CAPA incorrectly selects an unintended eigw for use. Leading to route creation failure since the eigw belongs to a different VPC.
• CAPA incorrectly destroys all eigw of all VPCs. This is very catastrophic as it can break other workloads.

This changes the filter to use cluster tag instead. Additional safeguard is also included to check if the eigw is truly attached the VPC.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #5683

Special notes for your reviewer:

This is a cherry-pick from c4dff2a as part of PR: #5603 (self-managed IPv6 cluster is in progress)

Checklist:

• squashed commits
• includes documentation
• includes emoji in title
• adds unit tests
• adds or updates e2e tests

Release note:

Ensure CAPA only manages cluster-owned egress only internet gateway

[k8s-ci-robot]

Hi @tthvo. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[tthvo]

/cc @nrb @damdo @mtulio

[mtulio]

one nit, overall looks good to me

/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 937d0731f74bddb1b97cd0b108f5b27d45da1255

[nrb]

/ok-to-test

[damdo]

Thanks for finding this. Looks potentially unpleasant.

/lgtm

/assign @richardcase @nrb @dlipovetsky @AndiDog

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 69ea166237b93d8c0b3b5664b38f7806c786372a

[AndiDog]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: AndiDog

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [AndiDog]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[damdo]

/cherry-pick release-2.9

[k8s-infra-cherrypick-robot]

@damdo: new pull request created: #5694

In response to this:

/cherry-pick release-2.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.