Scenario 3: CPO External Route Behavior for Private Clusters

Objective: Verify the CPO correctly handles the absence of a hostname for the KAS external route — only the internal route should exist when no external DNS domain is configured.

Implementation: The CPO's ReconcileInfrastructure checks whether a hostname is configured for the external KAS route. When the service publishing strategy is Route but no hostname is set, the CPO skips external route creation and uses k8sutil.DeleteIfNeeded to clean up any obsolete external routes.

Step	Check	Result	Evidence
1	kube-apiserver internal route exists	PASS	Route kube-apiserver-internal, host=api.brcox-100054-hc.hypershift.local
2	kube-apiserver-external-public does NOT exist	PASS	NotFound
3	kube-apiserver-external-private does NOT exist	PASS	NotFound

Commands & Outputs

Step 1: Verify internal route exists

$ oc get routes -n clusters-brcox-100054-hc | grep kube-apiserver
NAME                      HOST/PORT                                    SERVICES          PORT    TERMINATION        WILDCARD
kube-apiserver-internal   api.brcox-100054-hc.hypershift.local         kube-apiserver    <all>   passthrough/None   None

Step 2: Verify external-public route does NOT exist

$ oc get route kube-apiserver-external-public -n clusters-brcox-100054-hc
Error from server (NotFound): routes.route.openshift.io "kube-apiserver-external-public" not found

Step 3: Verify external-private route does NOT exist

$ oc get route kube-apiserver-external-private -n clusters-brcox-100054-hc
Error from server (NotFound): routes.route.openshift.io "kube-apiserver-external-private" not found