When HostedCluster is configured with external DNS domains (triggering Route publishing strategy for kube-apiserver), the `allowedCIDRBlocks` configuration in `spec.networking.apiServer.allowedCIDRBlocks` does not restrict external access to the kube-apiserver. The CIDR restrictions are incorrectly applied only to the kube-apiserver ClusterIP service, while external traffic flows through the unrestricted router LoadBalancer service.

    HyperShift 4.21

    Always

1. Create a HostedCluster with External DNS Domain on AWS platform
2. Set `spec.platform.aws.endpointAccess` to `PublicAndPrivate`
3. Configure `spec.networking.apiServer.allowedCIDRBlocks` with restricted CIDR ranges:
   ```yaml
   spec:
     networking:
       apiServer:
         allowedCIDRBlocks:
           - "10.0.0.0/8"
           - "192.168.1.0/24"
   ```
4. Deploy the cluster and wait for external router service to be created
5. Verify the external router service does not have `LoadBalancerSourceRanges` configured
6. Attempt to access the kube-apiserver from an IP outside the allowed ranges via the external endpoint   

- External router LoadBalancer service does not have `LoadBalancerSourceRanges` field configured
- External clients can access the kube-apiserver from any IP address through the router service
- The allowedCIDRBlocks configuration is completely ignored for external access

- External router LoadBalancer service should have `LoadBalancerSourceRanges` configured with the allowedCIDRBlocks values
- External access should be restricted to only the specified CIDR ranges
- Access attempts from outside allowed ranges should be blocked at the load balancer level

Traffic Flow:
```
External Client → External Router LoadBalancer → Router Pod → kube-apiserver (ClusterIP)
```

Current Implementation Problem:
- `allowedCIDRBlocks` are applied to kube-apiserver service's `LoadBalancerSourceRanges`
- With Router strategy and External DNs, kube-apiserver service is `ClusterIP` type (not externally accessible)
- External router service is `LoadBalancer` type but does NOT have `LoadBalancerSourceRanges` configured
- Result: CIDR restrictions are bypassed entirely