What steps did you take and what happened?

• We updated CAPI v1.7.9 -> v1.9.5
• A few MD was unexpectedly rolled out (ones with .spec.rolloutAfter == MS.metadata.creationTimestamp)

What did you expect to happen?

No MD should had been rolled out

Cluster API version

v1.9.5 (still relevant for the main branch and 1.10.x releases)

Kubernetes version

1.29

Anything else you would like to add?

MD controller, looking for a new MS, finds one that is created AFTER MD's .spec.rolloutAfter. The Time fileds are serialized with seconds accuracy (RFC3339), so, if a new MS was created at the same second as .spec.rolloutAfter, the controller will create a new.

Code examples:

• main (after):

  cluster-api/internal/controllers/machinedeployment/mdutil/util.go

  Line 504 in a8e4187

  if ms.CreationTimestamp.After(deployment.Spec.RolloutAfter.Time) {

• v1.7.9 (not before):

  cluster-api/internal/controllers/machinedeployment/mdutil/util.go

  Line 422 in a1c7c76

  !shouldRolloutAfter(msList[i], reconciliationTime, deployment.Spec.RolloutAfter) {

Label(s) to be applied

/kind bug
/area machinedeployment

One or more /area label. See https://github.com/kubernetes-sigs/cluster-api/labels?q=area for the list of labels.