feat: Enable CUSTOMER_ROUTED control plane egress by default on workshop clusters

[allamand]

Summary

Enable EKS Control Plane Egress through customer VPC (CUSTOMER_ROUTED mode) by default on all PeEKS clusters (hub and spokes).

Motivation

CUSTOMER_ROUTED is a security best practice for production EKS platforms:

• All admission webhook traffic (Kyverno) routes through the customer VPC — auditable via VPC Flow Logs
• Enables private OIDC providers (no internet exposure for auth traffic)
• Allows applying security groups, Network Firewall, and VPC endpoint policies to control plane egress
• Organization-wide enforcement via SCP (eks:controlPlaneEgressMode condition key)
• Production-ready by default — customers reusing PeEKS blueprints get this security posture out of the box

Reference

• Blog: https://aws.amazon.com/blogs/containers/amazon-eks-now-supports-control-plane-egress-through-your-vpc/
• Docs: https://docs.aws.amazon.com/eks/latest/userguide/control-plane-egress.html
• Launch date: June 22, 2026

Implementation

One-liner in cluster creation config:

controlPlaneEgressConfig:
  egressMode: CUSTOMER_ROUTED

Apply to both hub and spoke cluster templates.

Notes

• EKS Capabilities (ArgoCD, ACK, kro) traffic does NOT flow through customer VPC (runs on AWS infra) — no impact on Capabilities functionality
• Available in all commercial regions