Don't put bastions in the utility subnets

[johngmyers]

There's no reason to put bastions in utility subnets as their securitygroup only allows incoming traffic from the load balancer.

[johngmyers]

/retest

[olemarkus]

/lgtm

[rifelpet]

This seems reasonable to me. Should we add a release note that mentions the change in behavior for new clusters?

/approve
/hold for release note if we decide to add it

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: johngmyers, rifelpet

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rifelpet]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[johngmyers]

I assessed it as being below the threshold for a relnote. Do others think this needs to be called out?

[olemarkus]

Since this is only for new clusters, I don't think this is very important to call out. Those who manage many clusters hopefully use templating and will also not be affected by this.

We should probably update https://kops.sigs.k8s.io/bastion/ too though.

[rifelpet]

I'm fine with not having a release note. feel free to cancel the hold when you're ready.

[johngmyers]

/hold cancel