feat(aws.ci.jenkins.io) create the first VM for controller

[dduportal]

Ref. jenkins-infra/helpdesk#4315

Tested with Puppet conf at jenkins-infra/jenkins-infra#3725 with success (if we copy the Let's Encrypt /etc/letsencrypt directory from the current VM).

A few notes:

• Fixes the updatecli checks: We were tracking (since chore(updatecli):Track and update azure outbound ips #34) a few outbound IPs introduced in chore(ips): provides outbound ips in locals.tf to avoid module usage #23. But we some of these: trusted.ci machine and privatek8s pods do not need a direct access to ci.jio. Only (private) VPN and infra.ci agents.
• We have a stable public IPv4 (an Elastic IP). But for IPv6 it is not the case: the IPv6 is stable over VM restarts (unlike public IPv4 in EC2) as per https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#working-with-ipv6-addresses. But destroying the VM will de-allocate the IPv6. => that's why we specify custom DNS records no matter what
  • DNS zone was introduced in feat: set up foundations for the VPC network #36 and is delegated from our top-level Azure DNS (ref. feat(dns) Update NS records for aws.ci.jenkins.io azure-net#324 and chore(updatecli/dns) track NS for aws.ci.jenkins.io azure-net#319)
• Instance termination protection is enabled to prevent any human or automated (GC scripts/terrraform destroy due to a badly review terraform PR, etc.) mistake.
  • Any "real" destroy + re-create operation on the VM need a manual operation prior in AWS console (or with the AWS CLI / terraform PR) to disable protection
• Same idea for the EBS volume. Since we only use 1 disk for both system and ci.jio data disk, the EBS volume will survive the instance deletion.
  • Need a few manual cleanups when during experimentation or major upgrades, but worth the cost.
• Reminder: This instance runs on arm64 CPU (Graviton).
• Both public IPv4 and IPv6 are exported in the report: the LDAP must allow these IP once the PR is merged and VM created, otherwise we'll have a few issues...

[dduportal]

Plan: 7 to add, 0 to change, 1 to destroy.

• 1 destroy + 1 add is the local report file (due to content change) => expected
• 6 to add:
  • 1 EIP
  • 1 SSH public key (private key is in our SOPS "chart-secrets vault")
  • 1 EC2 VM instance (includes it EBS disk)
  • 1 EIP/instance associations
  • 2 DNS records (A and AAAA)