Background

Today, HyperShift exposes a public endpoint for cluster access which is accessible through a dedicated route. This can induce additional costs. 

Goal

Have all public traffic for a given mgmt cluster to go through a common router.  for public API endpoint access, we will want to prototype proxy_pass rewriting with our existing haproxy cfg and see what we learn so kubernetes.default.svc traffic works (needs proof of concept).

For public API endpoint access, we will want to restrict the set of allowable cidrs and we think network policy per cluster namespace should be an option to facilitate that.