fix(aws): set aws-load-balancer-scheme on public HCP router service

The AWS Load Balancer Controller (used on EKS) defaults to
scheme=internal when the aws-load-balancer-scheme annotation is not
set, while the in-tree AWS cloud provider (used on OpenShift) defaults
to internet-facing. This causes the public HCP router NLB to be
created as internal on EKS, making KAS and OAuth unreachable from
outside the VPC for PublicAndPrivate clusters.

Set the annotation explicitly on the public router service so it works
on both OpenShift and EKS management clusters. Also clean up mutually
exclusive annotations (aws-load-balancer-internal vs
aws-load-balancer-scheme) when switching between internal and external.

Signed-off-by: Claudio Busse <cbusse@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)

Author: typeid

control-plane-operator/controllers/hostedcontrolplane/infra/infra_test.go

@@ -1471,7 +1471,8 @@ func TestReconcileHCPRouterServices(t *testing.T) {
 				Name:      "router",
 				Namespace: namespace,
 				Annotations: map[string]string{
-					"service.beta.kubernetes.io/aws-load-balancer-type": "nlb",
+					"service.beta.kubernetes.io/aws-load-balancer-type":   "nlb",
+					"service.beta.kubernetes.io/aws-load-balancer-scheme": "internet-facing",
 				},
 				Labels: map[string]string{"app": "private-router"},
 			},
@@ -1493,6 +1494,7 @@ func TestReconcileHCPRouterServices(t *testing.T) {
 		return publicService(append(m, func(s *corev1.Service) {
 			s.Name = "private-router"
 			s.Annotations["service.beta.kubernetes.io/aws-load-balancer-internal"] = "true"
+			delete(s.Annotations, "service.beta.kubernetes.io/aws-load-balancer-scheme")
 		})...)
 	}
 	withCrossZoneAnnotation := func(svc *corev1.Service) {

control-plane-operator/controllers/hostedcontrolplane/infra/testdata/zz_fixture_TestReconcileInfrastructure_AWS_PublicAndPrivate_Route.yaml

@@ -29,6 +29,11 @@ func ReconcileRouterService(svc *corev1.Service, internal, crossZoneLoadBalancin
 		svc.Annotations["service.beta.kubernetes.io/aws-load-balancer-type"] = "nlb"
 		if internal {
 			svc.Annotations["service.beta.kubernetes.io/aws-load-balancer-internal"] = "true"
+		} else {
+			// The AWS Load Balancer Controller (used on EKS) defaults to scheme=internal.
+			// The in-tree AWS cloud provider (used on OpenShift) defaults to internet-facing.
+			// Set the annotation explicitly so the public router works on both.
+			svc.Annotations["service.beta.kubernetes.io/aws-load-balancer-scheme"] = "internet-facing"
 		}
 		if crossZoneLoadBalancingEnabled {
 			// In-tree AWS cloud provider annotation for cross-zone load balancing (OpenShift management clusters).

control-plane-operator/controllers/hostedcontrolplane/infra/testdata/zz_fixture_TestReconcileInfrastructure_AWS_Public_Route.yaml

@@ -3,6 +3,8 @@ package ingress
 import (
 	"testing"
 
+	. "github.com/onsi/gomega"
+
 	hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1"
 	"github.com/openshift/hypershift/support/netutil"
 
@@ -56,6 +58,25 @@ func TestReconcileRouterServiceAnnotations(t *testing.T) {
 	}
 }
 
+// When reconciling an external (non-internal) AWS router service
+// it should set aws-load-balancer-scheme to internet-facing.
+func TestReconcileRouterService_WhenExternalAWS_ItShouldSetInternetFacingScheme(t *testing.T) {
+	g := NewGomegaWithT(t)
+
+	hcp := &hyperv1.HostedControlPlane{}
+	hcp.Spec.Platform.Type = hyperv1.AWSPlatform
+
+	svc := &corev1.Service{}
+
+	err := ReconcileRouterService(svc, false /* internal */, true /* cross-zone */, hcp)
+	g.Expect(err).ToNot(HaveOccurred())
+
+	g.Expect(svc.Annotations).To(HaveKeyWithValue(
+		"service.beta.kubernetes.io/aws-load-balancer-scheme", "internet-facing"))
+	g.Expect(svc.Annotations).ToNot(HaveKey(
+		"service.beta.kubernetes.io/aws-load-balancer-internal"))
+}
+
 // Test that LoadBalancerSourceRanges is applied for external router services with allowedCIDRBlocks
 func TestReconcileRouterService_AppliesLoadBalancerSourceRanges(t *testing.T) {
 	// Test case 1: External router service should have LoadBalancerSourceRanges set