Use LB seclist from LB subnet

Is this a BUG REPORT or FEATURE REQUEST?

BUG REPORT

Versions

CCM Version: (whichever version OKE uses today)

Environment:

• Kubernetes version (use kubectl version):

  Server Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.8", 
  GitCommit:"50317190d44dbdb51ae7ff430917b32ba96188b5", GitTreeState:"clean", BuildDate:"2021-06-30T14:20:31Z", GoVersion:"go1.15.13 BoringCrypto", Compiler:"gc", Platform:"linux/amd64"}
  

• OS (e.g. from /etc/os-release): N/A
• Kernel (e.g. uname -a): N/A
• Others: N/A

What happened?

1. Followed this guide:
   https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengnetworkconfigexample.htm#example-privatek8sapi-privateworkers-privatelb
   • Private VCN
   • Separate subnet for private LBs (with it's own seclist)
   • Private OKE cluster, configured to use private LB subnet
2. Create "internal LB" (using annotation)
3. OCI CCM created seclist rules in the default VCN seclist, instead of the LB subnet seclist.

What you expected to happen?

3. OCI CCM creating rules in the seclist attached to the LB subnet.

How to reproduce it (as minimally and precisely as possible)?

Steps are in the guide above.

Anything else we need to know?

We'd love not having to manually set OCIDs in our kube services (i.e. which seclist to update, or which subnet to use for LBs).

Start by reproducing the private VCN, separate private LB subnet, and internal LB setup from the linked OCI guide, then trace how OCI CCM selects the subnet and security list for the load balancer. Done means CCM creates the required rules in the security list attached to the LB subnet without requiring manually supplied OCIDs.