The provider adds a 0.0.0.0/0 SG rule to Control Plane LB in unmanaged mode.

[sl1pm4t]

/kind bug

What steps did you take and what happened:

• Create a cluster in an unmanaged VPC mode (i.e. the VPC is created by some other tool).
• Review the Control Plane load balancer security group rules and see the provider has added a rule allowing all IPv4 addresses (0.0.0.0/0).

What did you expect to happen:

• I would expect the LB security group rules to only include the external IPs of the pre-existing NAT GW, and any specified in the AWSCluster spec.controlPlaneLoadBalancer.ingressRules field.

Anything else you would like to add:

In my test, the provider was configured to create a public NLB for the apiserver, and I had specified additional allowed sources addresses via the AWSCluster spec.controlPlaneLoadBalancer.ingressRules field

I did some digging through the code, and CAPA adds the 0.0.0.0/0 rule if there are no NAT GW IPs available:
https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/main/pkg/cloud/services/securitygroup/securitygroups.go#L951-L952

The NAT GW IPs are set on the AWSCluster status in reconcileNatGateways() but, this short circuits in unmanaged mode, and doesn't attempt to detect the IPs associated with the pre-existing NAT Gateways:
https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/main/pkg/cloud/services/network/natgateways.go#L41-L44

Environment:

• Cluster-api-provider-aws version: v2.6.1
• Kubernetes version: (use kubectl version): v1.29.8
• OS (e.g. from /etc/os-release):

[AndiDog]

/triage accepted
/priority important-soon