Repository: kubernetes
Issue: ReplicaSet do not update latest failure condition into status
Labels: kind/bug,priority/awaiting-more-evidence,sig/apps,needs-triage

### What happened?

If I have 2 admissions to check before a POD can be create, the 2 admissions checks run one after one (not in parallel), with 2 different error messages.
I'll use the below admission check for POD creation as an example to reproduce the bug:
```
if currentTime.Minute() < 40 {
		admissionResponse.Allowed = false
		admissionResponse.Result = &metav1.Status{
			Reason:  metav1.StatusReasonForbidden,
			Message: "Pod creation is not allowed during the first 40 minutes of the hour.",
		}
	} else {
		admissionResponse.Allowed = false
		admissionResponse.Result = &metav1.Status{
			Reason:  metav1.StatusReasonForbidden,
			Message: "Pod creation is not allowed during the second 20 minutes of the hour.",
		}
	}
```
Which means, in the first 40 minutes of every hour, the error message will be "Pod creation is not allowed during the first 40 minutes of the hour.", while in the left 20 minutes of every hour, the error message will be "Pod creation is not allowed during the second 20 minutes of the hour".

If I create a deployment now, in the left 20 minutes (xx:40 - xx:59), the ReplicaSet will be:
Describe result:
```
Conditions:
  Type             Status  Reason
  ----             ------  ------
  ReplicaFailure   True    FailedCreate
Events:
  Type     Reason        Age                 From                   Message
  ----     ------        ----                ----                   -------
  Warning  FailedCreate  40m (x19 over 95m)  replicaset-controller  Error creating: admission webhook "pod-blocker-service.pod-blocker.com" denied the request: Pod creation is not allowed during the first 40 minutes of the hour.
  Warning  FailedCreate  7m2s (x4 over 84m)  replicaset-controller  Error creating: admission webhook "pod-blocker-service.pod-blocker.com" denied the request: Pod creation is not allowed during the second 20 minutes of the hour.
```
Status:
```
status:
  conditions:
  - lastTransitionTime: "2024-09-03T02:31:25Z"
    message: 'admission webhook "pod-blocker-service.pod-blocker.com" denied the request:
      Pod creation is not allowed during the first 40 minutes of the hour.'
    reason: FailedCreate
    status: "True"
    type: ReplicaFailure
  observedGeneration: 1
  replicas: 0
```
Apparently, the second error message "Pod creation is not allowed during the second 20 minutes of the hour." is not updated into the status condition.



### What did you expect to happen?

The status shows the up to date error condition:
```
status:
  conditions:
  - lastTransitionTime: "2024-09-03T02:31:25Z"
    message: 'admission webhook "pod-blocker-service.pod-blocker.com" denied the request:
      Pod creation is not allowed during the second 20 minutes of the hour.'
    reason: FailedCreate
    status: "True"
    type: ReplicaFailure
  observedGeneration: 1
  replicas: 0
```

### How can we reproduce it (as minimally and precisely as possible)?

Just create 2 admissions to block POD creation one by one, with different error message.
After a period of time, let the first admission pass, and the second admission continue to block.

Which should show the error message from the second admission in the ReplicaSet status condition.

### Anything else we need to know?

It appears this block of code introduced the above behavior: https://github.com/kubernetes/kubernetes/blob/e5bafe2bed13fe72e88a3597930bdfbab5267e9d/pkg/controller/replicaset/replica_set_utils.go#L110

It only set condition when failed condition is `nil`; if the failed condition is still there, it just won't set the up to date condition.

### Kubernetes version

<details>

```console
$ kubectl version
WARNING: This version information is deprecated and will be replaced with the output from kubectl version --short.  Use --output=yaml|json to get the full version.
Client Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.3", GitCommit:"aef86a93758dc3cb2c658dd9657ab4ad4afc21cb", GitTreeState:"clean", BuildDate:"2022-07-13T14:21:56Z", GoVersion:"go1.18.4", Compiler:"gc", Platform:"darwin/arm64"}
Kustomize Version: v4.5.4
Server Version: version.Info{Major:"1", Minor:"25", GitVersion:"v1.25.2", GitCommit:"5835544ca568b757a8ecae5c153f317e5736700e", GitTreeState:"clean", BuildDate:"2022-09-22T05:28:27Z", GoVersion:"go1.19.1", Compiler:"gc", Platform:"linux/arm64"}
```

But from the code, it seems still in the latest version

</details>


### Cloud provider

<details>
Reproduced on KinD
</details>


### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
```

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>

</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>

</details>