Clarify that audit annotations are independent of validationActions

kubernetes · Feb 9, 2023 · e7fe237 · e7fe237
1 parent 6a22177
commit e7fe237
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/keps/sig-api-machinery/3488-cel-admission-control/README.md b/keps/sig-api-machinery/3488-cel-admission-control/README.md
@@ -1115,6 +1115,9 @@ spec:
 `auditAnnotations` are independent of `validations`. A `ValidatingAdmissionPolicy`
 may contain only `validations`, only `auditAnnotations` or both.
 
+Auudit annotations are recorded regardless of whether a
+ValidatingAdmissionPolicyBinding's `validationActions` include `Audit`.
+
 The published annotation key will be of the form `<ValidatingPolicyDefinition
 name>/<auditAnnotation key>` and will be validated as a
 [QualifiedName](https://github.com/kubernetes/kubernetes/blob/dfa4143086bf504c6c72d5eee8a2210b8ed41b9a/staging/src/k8s.io/apimachinery/pkg/util/validation/validation.go#L43).