Improve internal firewall rules on Google Cloud

* Whitelist internal traffic between controllers and workers
* Switch to tag-based firewall policies rather than source IP

google-cloud/container-linux/kubernetes/controllers/controllers.tf

@@ -48,6 +48,7 @@ resource "google_compute_instance" "controllers" {
   }
 
   can_ip_forward = true
+  tags = ["${var.cluster_name}-controller"]
 }
 
 # Controller Container Linux Config