Fix ALB lockdown configurations

[jpl-btlunsfo]

Purpose

• Fixing issues introduced by Lock down Airflow and OGC API endpoints #201. Namely, adding a new internal ALB for unity services to connect to without leaving the private subnets.

Proposed Changes

• ADD Additional security group for internal connections
• ADD Additional k8s-driven ingress for internal-only/private-subnet connections
• CHANGE internal venue-services proxy and healthcheck SSM parameters to reference internal endpoints

Issues

• Implement shared services to dev proxy for SPS airflow endpoints unity-cs#429

Testing

• Tested on personal deployment: http://btl-d7-dev-httpd-alb-353487587.us-west-2.elb.amazonaws.com:8080/btl-d7/dev/sps/
  • non-venue-proxy endpoint: http://k8s-sps-airflowi-1c931ef118-1938076165.us-west-2.elb.amazonaws.com:5000/

[jpl-btlunsfo]

I note that, a couple times while testing this, the SSM parameter for the proxy-configuration can end up with the wrong/public ALB information encoded, even though the terraform config for that explicitly references the internal ALB ingress...

I'm unsure if there's a propagation/timing issue there (on retriggering the venue-proxy lambda everything is updated correctly)

[LucaCinquini]

Worked for me on a couple of installations.