feat: add private nodes support via networkConfig

[pedro-tamandua]

Add NetworkConfig to GCENodeClass spec to control external IP allocation and subnet selection for provisioned nodes.

Features:

• Add NetworkConfig struct with enableExternalIPAccess and subnetwork fields
• Implement resolveAccessConfigs() to conditionally disable external IPs
• Implement resolveSubnetwork() to allow custom subnet configuration
• Update CRD with new networkConfig fields
• Simplify CRD validation rules to meet Kubernetes cost limits
• Add unit tests for network configuration resolution
• Add example manifests for private nodes and custom subnets

When enableExternalIPAccess is false, nodes are provisioned without external IP addresses (private nodes), improving security posture.

Usage Example

apiVersion: karpenter.k8s.gcp/v1alpha1
kind: GCENodeClass
metadata:
name: private-nodes
spec:
networkConfig:
enableExternalIPAccess: false
imageSelectorTerms:
- alias: ContainerOptimizedOS@latest## Testing

• Unit tests added for resolveAccessConfigs and resolveSubnetwork
• All tests passing (5/5)
• Manually tested in GKE cluster - nodes provisioned without external IPs

Backward Compatibility

Fully backward compatible. When networkConfig is not specified, behavior remains unchanged (nodes get external IPs by default).

[gitautomator]

Thanks to your contribution, the maintainers will review it as soon as they can!

[gitautomator]

The release note is either empty or incomplete, please consider: Add support for private nodes via networkConfig in GCENodeClass to improve security by allowing nodes to be provisioned without external IP addresses. Users can now configure enableExternalIPAccess and subnetwork fields to control network settings.

[jwcesign]

Hi, @pedro-tamandua thanks for your contribution, can you help fix the DCO workflow?

[pedro-tamandua]

DCO workflow fixed.

[jwcesign]

Thanks @pedro-tamandua
Other lgtm

[jwcesign]

Based on GCE pages:

1. Put NetworkTags into NetworkConfig field
2. It could have multiple network interface, so, EnableExternalIPAccess and Subnetwork should be array list. Something like:

type xxx struct {
..
  NetworkConfig NetworkConfig
}

type NetworkConfig {
  Tags []string
   NetworkInterfaces []NetworkInterface
}

type NetworkInterface {
  EnableExternalIPAccess bool
  Subnetwork string
}