Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@payload-manifests/crds/0000_10_config-operator_01_infrastructures-Default.crd.yaml`:
- Around line 1182-1184: Update the CRD OpenAPI v3 schema to enforce the
documented ClusterHosted DNS requirements: add a conditional "if/then" (or
oneOf/required) that when spec.dnsType == "ClusterHosted" then
spec.clusterHosted must be present, and within that clusterHosted require
non-empty arrays for apiIntLoadBalancerIPs and ingressLoadBalancerIPs while
leaving apiLoadBalancerIPs optional for private clusters; adjust the schema
blocks referencing dnsType, clusterHosted, apiIntLoadBalancerIPs,
ingressLoadBalancerIPs, and apiLoadBalancerIPs (and the PlatformDefault branch)
so the CRD rejects a ClusterHosted dnsType without the required clusterHosted
fields.

In
`@payload-manifests/crds/0000_10_config-operator_01_infrastructures-OKD.crd.yaml`:
- Around line 1187-1278: The current x-kubernetes-validations rule on the parent
object only forbids clusterHosted when dnsType != 'ClusterHosted' but does not
require clusterHosted (and its required subfields) when dnsType ==
'ClusterHosted'; update the validation logic to enforce presence of
clusterHosted when dnsType is 'ClusterHosted' and ensure required inner fields
(e.g., apiLoadBalancerIPs, apiIntLoadBalancerIPs, ingressLoadBalancerIPs) are
present/non-empty as appropriate. Specifically, modify the parent object's
x-kubernetes-validations rule referencing dnsType and clusterHosted to a
conditional that demands has(self.clusterHosted) when self.dnsType ==
'ClusterHosted', and add x-kubernetes-validations on the clusterHosted object
(or its properties) to require the specific arrays or keys (apiLoadBalancerIPs,
apiIntLoadBalancerIPs, ingressLoadBalancerIPs) to exist or be non-empty when
dnsType == 'ClusterHosted' using rules that reference self and oldSelf as
needed.

---

Nitpick comments:
In `@config/v1/tests/infrastructures.config.openshift.io/AAA_ungated.yaml`:
- Around line 1733-1734: Add targeted unit tests covering the new
cloudLoadBalancerConfig validation paths: (1) a test that asserts dnsType is
immutable on updates (ensure attempts to change cloudLoadBalancerConfig.dnsType
are rejected), and (2) tests exercising the conditional CEL rule between
clusterHosted and dnsType (e.g., when clusterHosted is true/false verify allowed
dnsType values and that invalid combinations are rejected). Locate and modify
tests referencing cloudLoadBalancerConfig and dnsType (and where clusterHosted
is set) around the existing defaulting assertions at the same test file and add
cases for both create and update flows so the new CEL validation is covered and
regression-safe.

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In
`@payload-manifests/crds/0000_10_config-operator_01_infrastructures-Default.crd.yaml`:
- Around line 1182-1278: The schema currently allows dnsType: ClusterHosted
without requiring the clusterHosted object or its LB IP lists; update the
validations so that when dnsType == "ClusterHosted" the clusterHosted object
must exist and must contain apiIntLoadBalancerIPs and ingressLoadBalancerIPs
with at least one IP each (minItems >= 1 / validation rule checking length > 0),
and ensure apiLoadBalancerIPs property is present (but may remain empty to allow
private clusters); implement this by adding an x-kubernetes-validations rule
referencing dnsType and clusterHosted (and per-field validations for
apiIntLoadBalancerIPs, ingressLoadBalancerIPs, and apiLoadBalancerIPs) to
enforce existence and non-empty requirements for the required lists when dnsType
is ClusterHosted.

In
`@payload-manifests/crds/0000_10_config-operator_01_infrastructures-OKD.crd.yaml`:
- Around line 1182-1278: The schema must require the clusterHosted object and
its IP lists when dnsType == "ClusterHosted": update the top-level
x-kubernetes-validations rule (the one currently preventing clusterHosted when
dnsType != ClusterHosted) to instead assert that when self.dnsType ==
'ClusterHosted' then has(self.clusterHosted) is true; inside the clusterHosted
object (properties clusterHosted -> apiIntLoadBalancerIPs, apiLoadBalancerIPs,
ingressLoadBalancerIPs) mark the three arrays as required properties and add
minItems: 1 for apiIntLoadBalancerIPs and ingressLoadBalancerIPs (keep
apiLoadBalancerIPs allowed to be empty to retain the private-cluster exception),
so the status cannot omit or provide empty required LB IP lists; reference the
clusterHosted property and the top-level x-kubernetes-validations rule when
making these changes.