Gardener Seed and Shoot Cluster: API Server Endpoint Transition Behavior

Expected Behavior

The Seed cluster’s controller does not guarantee an atomic, zero-downtime swap. When apiServerPublicEndpoint is changed from enabled to disabled, Gardener issues updates to the cloud provider’s load balancer or related network resources. The controller waits for the provider to acknowledge the change, but it does not hold the public endpoint open until internal DNS, routing, and security-group rules are fully propagated and verified across the infrastructure.

Likely Explanation vs. Confirmed Facts

Likely mechanism: The reconciliation loop treats endpoint visibility as a desired state. It will remove or reconfigure the public listener and rely on the cloud provider to apply the new private configuration. Because providers implement load balancer APIs differently, the exact sequence—whether the public rule is deleted before or after the private path is ready—is provider-specific and not centrally orchestrated by Gardener.

Confirmed by design: Gardener uses eventual consistency. There is no built-in parallel infrastructure or traffic mirroring step that keeps the public endpoint alive while the private path is proven. If the provider deletes the public listener first, or if internal DNS has not propagated, clients may lose connectivity to the API server.

Practical Steps for This Transition

1. Before disabling the public endpoint, ensure the internal network path is reachable from the networks that need access. Confirm that security groups, firewall rules, and VPN routes allow traffic to the new private endpoint.
2. In the Seed cluster, watch the Shoot object’s status and events to see when the load balancer reconciliation starts and completes.

kubectl -n <seed-project-namespace> describe shoot <shoot-name>

1. If possible, test the private endpoint from a bastion or internal client before removing public access.
2. Perform the change in a non-production Shoot first to measure the actual connectivity gap for your cloud provider.

One Missing Diagnostic

Which cloud provider and load balancer type is the Shoot using? The answer changes the recommendation because AWS, Azure, and GCP differ in whether the public listener is removed immediately or drained, and whether DNS TTLs or health checks can be tuned to shorten the gap.