AWSManagedControlPlane: ValidateUpdate webhook blocks deletion when IPv6 is enabled

[SanchitBansal]

Bug Description

When an AWSManagedControlPlane is deleted where the underlying VPC has IPv6 enabled at the AWS VPC level (not configured via AWSManagedControlPlane spec), the controller gets stuck and cannot remove its finalizer.

CAPA's network deletion flow attempts to patch the object during cleanup. During this patch, CAPA discovers the VPC's IPv6 configuration and reflects it back onto the object. This triggers the admission webhook ValidateUpdate, which then rejects the patch with IPv6-related validation errors — even though IPv6 was never explicitly configured through AWSManagedControlPlane.

Important Context

• IPv6 is NOT enabled via spec.network.vpc.enableIPv6 in the AWSManagedControlPlane manifest
• IPv6 is enabled at the AWS VPC level directly
• CAPA discovers this during reconcile/teardown and attempts to reflect enableIPv6: true back onto the object
• This reflection patch triggers ValidateUpdate, which then enforces IPv6 addon requirements and immutability checks — neither of which are relevant during deletion
• The live object's spec.network.vpc has no enableIPv6 field:

Environment

• CAPA version: v2.10.3
• Kubernetes version: 1.33.13

Steps To Reproduce

1. Create an EKS cluster via AWSManagedControlPlane with IPv6 enabled at the VPC level
2. Delete the cluster (kubectl delete cluster <name>)
3. Observe CAPA controller logs

Error Logs

E0730 13:25:35 controller.go:353] "Reconciler error" err="failed to patch AWSManagedControlPlane: admission webhook "validation.awsmanagedcontrolplanes.controlplane.cluster.x-k8s.io" denied the request: AWSManagedControlPlane is invalid: [spec.addons: Invalid value: "": addons are required to be set explicitly if IPv6 is enabled, spec.network.vpc.enableIPv6: Invalid value: true: changing IP family is not allowed after it has been set]"

Root Cause

ValidateUpdate() in awsmanagedcontrolplane_webhook.go does not check DeletionTimestamp before running IPv6 validations. When CAPA patches the object during network teardown, the webhook fires and rejects the patch — even though the object is already terminating and validation is irrelevant.

This pattern has already been fixed for AWSCluster and AWSMachine webhooks but was never applied to AWSManagedControlPlane.

Expected Behavior

Webhook should skip validation (or at minimum skip immutability checks) when DeletionTimestamp is already set on the object.

Actual Behavior

Cluster is permanently stuck in Deleting phase. Finalizer awsmanagedcontrolplane.controlplane.cluster.x-k8s.io is never removed.

Proposed Fix

In awsmanagedcontrolplane_webhook.go, add a DeletionTimestamp guard at the top of ValidateUpdate()

[kubernetes-prow]

This issue is currently awaiting triage.

If CAPA/CAPI contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.