When HostedCluster is configured with external DNS domains , the `allowedCIDRBlocks` configuration in `spec.networking.apiServer.allowedCIDRBlocks` removed. The CIDR restrictions are still applied to external traffic flows through the unrestricted router LoadBalancer service.

    HyperShift 4.21

    Always

1. Create a HostedCluster with External DNS Domain on AWS platform
2. Set `spec.platform.aws.endpointAccess` to `PublicAndPrivate`
3. Configure `spec.networking.apiServer.allowedCIDRBlocks` with restricted CIDR ranges:
   ```yaml
   spec:
     networking:
       apiServer:
         allowedCIDRBlocks:
           - "100.48.157.95/32"
           - "54.237.188.126/32"
...
   ```
4. Deploy the cluster and wait for external router service to be created
5. Remove the `spec.networking.apiServer.allowedCIDRBlocks`;

- External router LoadBalancer service still have `LoadBalancerSourceRanges` field configured : 


oc get hc 42bf4c7dc31c50417e48 -o=jsonpath={.spec.networking} |jq
{
  "clusterNetwork": [
    {
      "cidr": "10.132.0.0/14"
    }
  ],
  "machineNetwork": [
    {
      "cidr": "10.0.0.0/16"
    }
  ],
  "networkType": "OVNKubernetes",
  "serviceNetwork": [
    {
      "cidr": "172.31.0.0/16"
    }
  ]
}



oc get svc router -n clusters-42bf4c7dc31c50417e48 -o jsonpath='{.spec.loadBalancerSourceRanges}' |jq
[
  "100.48.157.95/32",
  "54.237.188.126/32",
  "100.49.106.204/32"
]
 

- External router LoadBalancer service should remove `LoadBalancerSourceRanges` configured