Ideally master authorized network would be the IP/subnet of a bastion host(s) but in the meantime and during initial setup our CI/CD agent needs to access the cluster. Any subsequent cluster changes that require talking to the master API would need to be in the authorized networks too. Thoughts or ideas?