If no hostname is specified for the kube-apiserver ingress strategy of a public AWS HostedCluster, the cluster uses the DNS name of the AWS loadbalancer as its public endpoint. This creates a dependence on that specific LoadBalancer for clients and serving certs. If a cluster is destroyed and later restored using a different LoadBalancer, the serving cert created for the kube-apiserver and any kubeconfigs used by the nodes are no longer valid because they use the dns name of the previous load balancer.

    All

    Always

    1. Create an AWS Public HostedCluster
    2. Backup the cluster and destroy it
    3. Restore the cluster
    

    The cluster nodes fail to come up because they can no longer talk to the kube apiserver.

    The cluster comes back up successfully 

This is not an issue with PublicAndPrivate and Private clusters because they rely on internal names for the Kube API server endpoint.