kOps doesn't tag API server NLBs

[oscarhtb]

/kind feature

The ENIs that AWS provisions for the API server NLB (description ELB net//...) are not tagged by kOps, unlike the rest of the cluster's networking resources. It would be great if kOps could apply tags to them.

[rifelpet]

Until AWS supports tagging these at creation-time through the NLB APIs (see aws-cloudformation/cloudformation-coverage-roadmap#2476) there isn't a straight forward solution to this in kops.

The best option today is to tag them out-of-band with something like Cloud Custodian or Lambda + EventBridge.