A hosted cluster exposes four services: APIServer, OAuthServer, Konnectivity, and Ignition. For the last three, official HyperShift documentation states: 'The Route strategy allows you to expose the HostedControlPlane services using the ingress of the Management OpenShift cluster. This strategy is supported by all services but kubeapi-server.' In other words: OAuthServer/Konnectivity/Ignition run on the single existing Ingress route (*.apps.<cluster-domain>) — distinguished by hostname, exactly like any other OpenShift Route. Only the API server is the exception: it uses mutual TLS at the protocol layer, which cannot be multiplexed like an HTTP request by hostname. Therefore it needs its own IP (LoadBalancer/MetalLB) or its own port (NodePort).
- OAuth/Konnectivity/Ignition do not need additional IP capacity per hosted cluster — does not scale linearly with cluster count
- Fewer MetalLB pools/additional IPs needed than you might assume at first
- Route-based services use the Ingress infrastructure you already have
- The API server remains the exception — each additional hosted cluster still needs its own external IP or NodePort for it
- 'Shared Ingress' (one LB IP for ALL API servers via PROXY protocol instead of SNI) exists as a HyperShift feature, but is documented primarily for managed Azure architectures — not the standard path for KubeVirt/on-prem
- Observed in practice: if the API server is not bound to the correct pool, MetalLB silently falls back to another autoAssign pool (e.g. internal-pool instead of external-pool) — no error, but the IP is then not externally reachable
Directly relevant for TC-HCP-002: in this environment there is only ONE Hetzner additional IP (external-pool). It is required exclusively for the API server of each hosted cluster — for further hosted clusters you need one more additional IP per cluster, but NOT for OAuth/Konnectivity/Ignition, which all share the same Ingress route.