Background 

Some use-cases have a need for private cluster connectivity. That means, that traffic is route through a private network not accessible from the outside. 

Goal

For private API endpoint access, we think it makes sense to have a dedicated ELB whose traffic is restricted to the customer cluster VPC.  we will likely need a dedicated ingress controller in the first PoC per customer guest cluster that requires private access, but longer term we will see what we could do to optimize that further.  so hosted cluster spec will likely need public API endpoint (bool), private API endpoint (bool), and public API Allowable CIDRs (range).