[EKS] More control and visibility of EKS Kubernetes pods egress traffic

We have had a certain number of requests from EKS customers to have more control over egress traffic coming from pods. This issue is meant to track this request and collect additional feedbacks in the open to stimulate a healthy discussion around use cases.

Many (typically Enterprise) customers have a hybrid setup with EKS clusters running in the cloud and legacy services running on-prem. These customers have applications running on EKS that need to connect to services on-prem that are often protected by traditional firewall. These firewall do not typically understand logical constructs beyond simple IP addresses and subnets when configuring security rules.

These customers still require granular control of the traffic coming from specific applications (read pods) running in the EKS cluster. With EKS and the VPC CNI plugin, pods can communicate outbound via a [NAT mechanism](https://docs.aws.amazon.com/eks/latest/userguide/external-snat.html) that can be configured to leverage either the worker node primary IP or the VPC NAT Gateway.

This, for example, leaves customers that require crafting ingress rules on on-prem firewalls with the option of having to "allow" communication in an all-or-nothing manner. That is: allowing all communication originating from either all worker nodes or from the VPC NAT GW. These customers would rather be able to create firewall rules to scope down this configuration to specific pods (or a specific small set of IP addresses that more explicitly identify an application that needs to be blessed).

Some add-on products (mesh or third party add-ons) provide these functionalities but these customers have been vocal in that they would rather have a basic implementation of this functionality baked into the core VPC CNI plugin. The feedback we typically receive is that, while they are not against using add-on tools, they do not want to implement and manage yet another software layer for what they consider a basic egress control functionality.

We are eager to hear more where your bar is for an MVP feature in this context.

Start with the EKS external SNAT documentation linked in the issue and review how the VPC CNI plugin currently handles pod egress through worker-node or VPC NAT Gateway IPs. Use the described on-premises firewall use cases and discussion feedback to define an MVP for pod-specific egress control. Done means the MVP scope and its acceptance criteria are agreed; no implementation files or tests are identified in the issue.

Written by the indexing model from the issue text.