Changing machinedeployment.spec.template.metadata.annotations doesn't result in rotation

[cwrau]

What steps did you take and what happened?

I changed the machinedeployment.spec.template.metadata.annotations with the CA secret hash.

What did you expect to happen?

I expected the machines to rotate to load the new CA.

Cluster API version

1.13.2

Kubernetes version

1.34.1

Anything else you would like to add?

I understand that labels are being dropped for rotation, but as normal k8s deployments rotate on annotation change, I assumed this would work as well.

I assume the same thing applies to machinePools. I know I can use rollout.after for machinedeployment, but what to use for machinePools?

Another solution would be that CAPI would rotate machines when the CA changes.

Label(s) to be applied

/kind bug
One or more /area label. See https://github.com/kubernetes-sigs/cluster-api/labels?q=area for the list of labels.

[kubernetes-prow]

This issue is currently awaiting triage.

If CAPI contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[sbueringer]

For KCP/MD this is a feature: https://cluster-api.sigs.k8s.io/reference/api/metadata-propagation and rollouts can be triggered with rolloutAfter

I don't know how this works with MachinePools

[fabriziopandini]

cc @AndiDog @mboersma @richardcase for the MP part of the question