Scenario 6: PublicAndPrivate Topology Regression

Objective: Verify no regression for PublicAndPrivate topology — endpoint access transitions work correctly, routes and services are created/deleted as expected, PLS CRs survive transitions, and API remains reachable.

Source: Prow CI job e2e-v2-azure-self-managed for PR #9171 — AzureEndpointAccessTransitionTest runs on the private cluster, transitioning Private → PublicAndPrivate → Private.

Job: pull-ci-openshift-hypershift-main-e2e-v2-azure-self-managed/2084680031447027712

Overall Scenario 6: PASS — 3/3 endpoint access transition tests passed (Private → PublicAndPrivate → Private round-trip verified in CI).

Step	Check	Result	Evidence
1	Private → PublicAndPrivate transition succeeds	PASS	KAS/OAuth public routes created, private routes deleted, router-public becomes LoadBalancer, PLS CRs survive, API reachable (3m24s)
2	PublicAndPrivate → Private transition succeeds	PASS	KAS/OAuth private routes recreated, public routes deleted, router-public deleted, PLS CRs survive, ExternalPrivateServices restored (3m26s)
3	Cluster remains Available and not Degraded after round-trip	PASS	HostedCluster Available=True, Degraded=False verified in 75ms after restore to Private

Commands & Outputs

Step 1: Private → PublicAndPrivate transition

Test: [Feature:AzureEndpointAccess] should transition from Private to PublicAndPrivate

Test: [It] [sig-hypershift][Jira:Hypershift] Hosted Cluster Azure
      [Feature:AzureEndpointAccess] Azure Endpoint Access Transition
      should transition from Private to PublicAndPrivate
Status: passed
Duration: 204.47s (3m24s)

Log output:
> Enter [BeforeAll] Azure Endpoint Access Transition
< Exit [BeforeAll] (0s)
> Enter [It] should transition from Private to PublicAndPrivate

Successfully waited for KAS ExternalPrivateService exists in Private topology in 25ms
Successfully waited for OAuth ExternalPrivateService exists in Private topology in 50ms

# Topology patched to PublicAndPrivate

Failed to get *v1.Route: routes.route.openshift.io "kube-apiserver" not found
Successfully waited for KAS external public route exists after transition to PublicAndPrivate in 3.05s
Successfully waited for OAuth external public route exists after transition to PublicAndPrivate in 50ms
Successfully waited for router-public Service is LoadBalancer after transition to PublicAndPrivate in 25ms
Successfully waited for PLS CRs still exist after transition to PublicAndPrivate in 25ms

"level"=0 "msg"="API reachability attempt"
    "phase"="after transition to PublicAndPrivate"
    "attempt"=1
    "host"="https://api-private-34e2d3bdb8.sm.hcp-sm-azure.azure.devcluster.openshift.com:443"
"level"=0 "msg"="DNS lookup succeeded"
    "host"="https://api-private-34e2d3bdb8.sm.hcp-sm-azure.azure.devcluster.openshift.com:443"
    "addrs"=["10.0.0.4"]
"level"=0 "msg"="external-private Route not found"
    "error"="routes.route.openshift.io \"kube-apiserver-private\" not found"

< Exit [It] should transition from Private to PublicAndPrivate (3m24.47s)

Step 2: PublicAndPrivate → Private transition

Test: [Feature:AzureEndpointAccess] should transition from PublicAndPrivate back to Private

Test: [It] [sig-hypershift][Jira:Hypershift] Hosted Cluster Azure
      [Feature:AzureEndpointAccess] Azure Endpoint Access Transition
      should transition from PublicAndPrivate back to Private
Status: passed
Duration: 206.53s (3m26s)

Log output:
> Enter [It] should transition from PublicAndPrivate back to Private

# Topology patched back to Private

Failed to get *v1.Route: routes.route.openshift.io "kube-apiserver-private" not found
Successfully waited for KAS external private route exists after restore to Private in 3.05s
Successfully waited for OAuth external private route exists after restore to Private in 50ms
Successfully waited for PLS CRs still exist after restore to Private in 50ms

Failed to get *v1.Service: services "kube-apiserver-private-external" not found
Successfully waited for KAS ExternalPrivateService recreated after restore to Private in 3m3.025s
Successfully waited for OAuth ExternalPrivateService recreated after restore to Private in 25ms

< Exit [It] should transition from PublicAndPrivate back to Private (3m26.529s)

Step 3: Post-transition health check

Test: [Feature:AzureEndpointAccess] should remain available after restoring Private topology

Test: [It] [sig-hypershift][Jira:Hypershift] Hosted Cluster Azure
      [Feature:AzureEndpointAccess] Azure Endpoint Access Transition
      should remain available after restoring Private topology
Status: passed
Duration: 0.16s

Log output:
> Enter [It] should remain available after restoring Private topology
Successfully waited for HostedCluster is Available and not Degraded after restore to Private in 75ms
< Exit [It] should remain available after restoring Private topology (68ms)

> Enter [DeferCleanup (All)] Azure Endpoint Access Transition
< Exit [DeferCleanup (All)] (95ms)

JUnit Summary (private cluster suite)

Suite: junit_self_managed_azure_private.xml
Tests: 968 total, 10 run, 958 skipped, 0 failures, 0 errors
Label filter: self-managed-azure-private || hosted-cluster-compliance || nodepool-osimagestream
Suite result: SuiteSucceeded = true

Endpoint Access Transition results:
  [PASS] should transition from Private to PublicAndPrivate          204.47s
  [PASS] should transition from PublicAndPrivate back to Private     206.53s
  [PASS] should remain available after restoring Private topology      0.16s

← Scenario 5 Scenario 7 →