OCPBUGS-70147: skip HCP router LB when routes use apps domain

[celebdor]

What this PR does / why we need it:

Fix regression in 4.19 where HCP router LoadBalancer service was created unexpectedly for configurations using Route hostnames under the management cluster's apps domain.

After upgrading HCP clusters from 4.18 to 4.19, a router service of type LoadBalancer is created unexpectedly. On platforms with limited LoadBalancer IPs (e.g., BareMetal with exhausted MetalLB IPAddressPool), the service stays in <pending> state and blocks the upgrade.

The fix for OCPBUGS-56914 (PR #6780) changed the condition for creating the public router service from checking only if KAS uses Route to checking if ANY service uses Route with hostname. This caused the router service to be created for configurations that previously didn't need it.

This PR adds IsPublicWithExternalDNS() function that checks if any service uses a Route with a hostname that is external to the management cluster's default ingress domain. When hostnames are subdomains of the apps domain (e.g., oauth.apps.mgmt-cluster.example.com), the management cluster's default router can serve them via wildcard DNS, so no dedicated HCP router LoadBalancer service is needed.

This preserves the OCPBUGS-56914 fix for external DNS users while preventing unnecessary router service creation for apps-domain routes.

Which issue(s) this PR fixes:
Fixes OCPBUGS-70147

Checklist

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

🤖 Generated with Claude Code via /jira:solve OCPBUGS-70147 celebdor

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@celebdor: This pull request references Jira Issue OCPBUGS-70147, which is invalid:

• release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
• expected Jira Issue OCPBUGS-70147 to depend on a bug targeting a version in 4.21.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

When a HostedControlPlane uses Route publishing strategy with hostnames that are subdomains of the management cluster's default ingress domain (e.g., oauth.apps.example.com under apps.example.com), the HCP router LoadBalancer service should not be created. The management cluster's ingress controller can directly handle these routes.

This fix introduces DNS label-based subdomain checking via IsSubdomain() to properly detect when route hostnames fall within the apps domain. The UseHCPRouter() function is now exported from the router component and checks:

1. Shared ingress mode (always skip router)
2. IBMCloud platform (always skip router)
3. Private/PublicAndPrivate HCPs (need router for internal routes)
4. Public HCPs with external DNS hostnames (need router)
5. Public HCPs with apps domain hostnames (skip router)

The fix also adds DefaultIngressDomain to ControlPlaneContext and WorkloadContext structs to make the domain available to component predicates.

Which issue(s) this PR fixes:
Fixes https://issues.redhat.com/browse/OCPBUGS-70147

Checklist

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

🤖 Generated with Claude Code via /jira:solve OCPBUGS-70147 celebdor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

• do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[celebdor]

/area hypershift/control-plane-operator

[openshift-ci]

@celebdor: The label(s) area/hypershift/control-plane-operator cannot be applied, because the repository doesn't have them.

Details

In response to this:

/area hypershift/control-plane-operator

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@celebdor: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[devguyio]

/lgtm

[muraee]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: celebdor, muraee

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [muraee]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[heliubj18]

/verified by @heliubj18

[openshift-ci-robot]

@heliubj18: This PR has been marked as verified by @heliubj18.

Details

In response to this:

/verified by @heliubj18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.