diff --git a/staging/src/k8s.io/pod-security-admission/admission/admission.go b/staging/src/k8s.io/pod-security-admission/admission/admission.go index 242e67c2a9f..00f3b9beacb 100644 --- a/staging/src/k8s.io/pod-security-admission/admission/admission.go +++ b/staging/src/k8s.io/pod-security-admission/admission/admission.go @@ -446,7 +446,7 @@ func (a *Admission) EvaluatePod(ctx context.Context, nsPolicy api.Policy, nsPoli // TODO: reuse previous evaluation if audit level+version is the same as enforce level+version if result := policy.AggregateCheckResults(a.Evaluator.EvaluatePod(nsPolicy.Audit, podMetadata, podSpec)); !result.Allowed { - auditAnnotations["audit"] = fmt.Sprintf( + auditAnnotations[api.AuditViolationsAnnotationKey] = fmt.Sprintf( "would violate PodSecurity %q: %s", nsPolicy.Audit.String(), result.ForbiddenDetail(), diff --git a/staging/src/k8s.io/pod-security-admission/admission/admission_test.go b/staging/src/k8s.io/pod-security-admission/admission/admission_test.go index 56ee0bb617f..e3f652fcb63 100644 --- a/staging/src/k8s.io/pod-security-admission/admission/admission_test.go +++ b/staging/src/k8s.io/pod-security-admission/admission/admission_test.go @@ -650,7 +650,7 @@ func TestValidatePodController(t *testing.T) { newObject: &badDeploy, gvk: schema.GroupVersionKind{Group: "apps", Version: "v1", Kind: "Deployment"}, gvr: schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"}, - expectAuditAnnotations: map[string]string{"audit": "would violate PodSecurity \"baseline:latest\": forbidden sysctls (unknown)"}, + expectAuditAnnotations: map[string]string{"audit-violations": "would violate PodSecurity \"baseline:latest\": forbidden sysctls (unknown)"}, expectWarnings: []string{"would violate PodSecurity \"baseline:latest\": forbidden sysctls (unknown)"}, }, { @@ -659,7 +659,7 @@ func TestValidatePodController(t *testing.T) { oldObject: &goodDeploy, gvk: schema.GroupVersionKind{Group: "apps", Version: "v1", Kind: "Deployment"}, gvr: schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"}, - expectAuditAnnotations: map[string]string{"audit": "would violate PodSecurity \"baseline:latest\": forbidden sysctls (unknown)"}, + expectAuditAnnotations: map[string]string{"audit-violations": "would violate PodSecurity \"baseline:latest\": forbidden sysctls (unknown)"}, expectWarnings: []string{"would violate PodSecurity \"baseline:latest\": forbidden sysctls (unknown)"}, }, } diff --git a/staging/src/k8s.io/pod-security-admission/api/constants.go b/staging/src/k8s.io/pod-security-admission/api/constants.go index 1a194836229..efabfb7535b 100644 --- a/staging/src/k8s.io/pod-security-admission/api/constants.go +++ b/staging/src/k8s.io/pod-security-admission/api/constants.go @@ -45,4 +45,5 @@ const ( WarnVersionLabel = labelPrefix + "warn-version" ExemptionReasonAnnotationKey = "exempt" + AuditViolationsAnnotationKey = "audit-violations" )