Drop unwanted SGs when calling attachSecurityGroupsToNetworkInterface

[enxebre]

Before this, attachSecurityGroupsToNetworkInterface was re-applying existing SGs not specified in user intent. It's up to the caller to choose the right list of SG ids as in

cluster-api-provider-aws/controllers/awsmachine_security_groups.go

Lines 57 to 64 in 3ebf018

	changed, ids := r.securityGroupsChanged(annotation, core, additionalSecurityGroupsIDs, existing)
	if !changed {
	return false, nil
	}
	if err := ec2svc.UpdateInstanceSecurityGroups(*scope.GetInstanceID(), ids); err != nil {
	return false, err
	}

so then attachSecurityGroupsToNetworkInterface just applies what is given.

What type of PR is this?

/kind bug

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #4361

Special notes for your reviewer:

Checklist:

• squashed commits
• includes documentation
• adds unit tests
• adds or updates e2e tests

Release note:

attachSecurityGroupsToNetworkInterface do not re-apply existing security groups which are not specified by the user intent

[richardcase]

/test ?

[k8s-ci-robot]

@richardcase: The following commands are available to trigger required jobs:

• /test pull-cluster-api-provider-aws-build
• /test pull-cluster-api-provider-aws-test
• /test pull-cluster-api-provider-aws-verify

The following commands are available to trigger optional jobs:

• /test pull-cluster-api-provider-aws-apidiff-main
• /test pull-cluster-api-provider-aws-e2e
• /test pull-cluster-api-provider-aws-e2e-blocking
• /test pull-cluster-api-provider-aws-e2e-clusterclass
• /test pull-cluster-api-provider-aws-e2e-conformance
• /test pull-cluster-api-provider-aws-e2e-conformance-with-ci-artifacts
• /test pull-cluster-api-provider-aws-e2e-eks
• /test pull-cluster-api-provider-aws-e2e-eks-gc
• /test pull-cluster-api-provider-aws-e2e-eks-testing

Use /test all to run the following jobs that were automatically triggered:

• pull-cluster-api-provider-aws-apidiff-main
• pull-cluster-api-provider-aws-build
• pull-cluster-api-provider-aws-test
• pull-cluster-api-provider-aws-verify

In response to this:

/test ?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[richardcase]

/test pull-cluster-api-provider-aws-e2e
/test pull-cluster-api-provider-aws-e2e-eks

[enxebre]

/test pull-cluster-api-provider-aws-e2e

[enxebre]

#7 [internal] load metadata for docker.io/library/golang:1.19.5
#7 ERROR: failed to copy: httpReadSeeker: failed open: content at https://mirror.gcr.io/v2/library/golang/manifests/sha256:572f68065ea605e0bd7ab42aa036462318e680a15db0f41a0cadcd06affdabdb?ns=docker.io not found: not found

[enxebre]

/test pull-cluster-api-provider-aws-e2e

[richardcase]

@enxebre - this probably needs a rebase so that it picks up the change to the Dockerfile that uses a public ECR registry for the golang image.

[enxebre]

thanks Richard! rebased.

[richardcase]

/test pull-cluster-api-provider-aws-e2e

[richardcase]

/milestone v2.2.0

[richardcase]

/test pull-cluster-api-provider-aws-e2e-eks

[richardcase]

All the tests passed, so:

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: richardcase

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [richardcase]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment