[WalBeh]

What

When spec.cluster.exposure is switched from loadbalancer to traefik, the operator patches the data service from type: LoadBalancer to type: ClusterIP in place. That same patch also nulled out every LB annotation — including service.beta.kubernetes.io/aws-load-balancer-type: nlb.

The in-tree service controller reads that annotation in EnsureLoadBalancerDeleted to distinguish an NLB from a Classic ELB. With it gone, the controller falls back to the Classic ELB API, can't find the NLB, removes the service.kubernetes.io/load-balancer-cleanup finalizer anyway, and the NLB is left orphaned on AWS.

Fix

Retain aws-load-balancer-type through the switch so the controller correctly identifies and deletes the NLB. The annotation is inert on a ClusterIP service (the controller only acts when type == LoadBalancer), so leaving it is safe. The remaining tuning annotations (connection draining, idle timeout, cross-zone) and the external-dns hostname are still removed.

This is also correct for legacy Classic-ELB clusters: with no annotation present the controller already uses the Classic ELB path, which deletes correctly.

Testing

• pre-commit (black, flake8, isort, mypy, yamllint) passes.
• Added TestServiceModels::test_lb_type_annotation_retained_when_switching_to_clusterip, pairing with the existing test_get_data_service which asserts the annotation is added on create.

Caveats for the reviewer

• Not verifiable on minikube. The actual NLB deletion is AWS in-tree-controller behavior; the test asserts the annotation contract, not the AWS-side delete. Worth a real EKS smoke test before release.
• Not retroactive. This prevents future orphans. NLBs already orphaned by the previous behavior need a one-time manual cleanup on AWS.

Refs: crate/cloud#2976, kubernetes/kubernetes#95042 #851