Fix behaviour for `kops export kubeconfig --internal`

pkg/kubeconfig/create_kubecfg.go

@@ -45,7 +45,6 @@ func BuildKubecfg(ctx context.Context, cluster *kops.Cluster, keyStore fi.Keysto
 		} else {
 			server = "https://api." + clusterName
 		}
-	}
 
 		// If a load balancer exists we use it, except for when an SSL certificate is set.
 		// This should avoid a lot of pain with DNS pre-creation.
@@ -75,6 +74,7 @@ func BuildKubecfg(ctx context.Context, cluster *kops.Cluster, keyStore fi.Keysto
 				server = "https://" + targets[0]
 			}
 		}
+	}
 
 	b := NewKubeconfigBuilder()
 

pkg/kubeconfig/create_kubecfg_test.go

@@ -343,6 +343,38 @@ func TestBuildKubecfg(t *testing.T) {
 			},
 			wantClientCert: true,
 		},
+		{
+			name: "Test Kube Config Data for Public cluster with admin and internal option",
+			args: args{
+				cluster:  publicCluster,
+				status:   fakeStatus,
+				admin:    DefaultKubecfgAdminLifetime,
+				internal: true,
+			},
+			want: &KubeconfigBuilder{
+				Context: "testcluster",
+				Server:  "https://api.internal.testcluster",
+				CACerts: []byte(nextCertificate + certData),
+				User:    "testcluster",
+			},
+			wantClientCert: true,
+		},
+		{
+			name: "Test Kube Config Data for Public cluster without admin and with internal option",
+			args: args{
+				cluster:  publicCluster,
+				status:   fakeStatus,
+				admin:    0,
+				internal: true,
+			},
+			want: &KubeconfigBuilder{
+				Context: "testcluster",
+				Server:  "https://api.internal.testcluster",
+				CACerts: []byte(nextCertificate + certData),
+				User:    "testcluster",
+			},
+			wantClientCert: false,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {