Create a HostedCluster where you have the following configuration:
The oauth route should be externally accessible, however it's not exposed.

  services:
  - service: APIServer
    servicePublishingStrategy:
      loadBalancer:
        hostname: api.custom.example.com
      type: LoadBalancer
  - service: OAuthServer
    servicePublishingStrategy:
      route:
        hostname: oauth.custom.example.com
      type: Route
  - service: Konnectivity
    servicePublishingStrategy:
      type: Route
  - service: Ignition
    servicePublishingStrategy:
      type: Route
  - service: OVNSbDb
    servicePublishingStrategy:
      type: Route