Gardener Seed and Shoot Cluster: API Server Endpoint Transition Behavior

API Server Connectivity Transition

Gardener manages shoot cluster API server exposure through the apiServerPublicEndpoint configuration within the shoot specification. This setting determines whether the API server is reachable via the public internet or restricted to internal network routing and Gardener VPNs.

A design uncertainty exists regarding the reconciliation process when modifying this field on an existing shoot cluster. Specifically, the interaction between the Seed cluster's controller and the cloud provider's load balancer configuration during a transition from enabled to disabled requires clarification to prevent connectivity loss.

What is the expected behavior of the Seed cluster when reconciling load balancer rules during a public-to-private endpoint transition? Does the system ensure internal routing is fully operational before the public endpoint is decommissioned?