[realshuting]

What this PR does

Adds AuditAnnotations []admissionregistrationv1.AuditAnnotation to MutatingPolicySpec (v1alpha1, exposed through the v1beta1/v1 aliases).

The field carries CEL expressions that Kyverno evaluates after mutations are applied successfully; the results are surfaced as properties in policy report results (results[].properties). It is intentionally not projected into generated Kubernetes MutatingAdmissionPolicy resources, since native MAP has no equivalent.

spec:
  mutations:
  - patchType: ApplyConfiguration
    applyConfiguration:
      expression: >-
        Object{metadata: Object.metadata{labels: {"env": "test"}}}
  auditAnnotations:
  - key: resource-name
    valueExpression: "'cm/' + string(object.metadata.name)"

Why

Migration parity for the legacy ClusterPolicy spec.rules[].reportProperties field (cpol mutate → mpol migration, kyverno/kyverno#16504). This mirrors the field already present on ValidatingPolicySpec, ImageValidatingPolicySpec and — as of #108/kyverno/kyverno#16505 — GeneratingPolicySpec.

Related

• Consumer implementation: kyverno/kyverno PR (linked from [Feature] Add auditAnnotations support to MutatingPolicy (reportProperties parity) kyverno#16719)
• Parent tracking issue: [Feature] ClusterPolicy / Policy (mutate) → MutatingPolicy / NamespacedMutatingPolicy kyverno#16504
• GeneratingPolicy precedent: [Feature] Support report properties (auditAnnotations) in GeneratingPolicy kyverno#16503 / feat(gpol): add auditAnnotations support to GeneratingPolicy kyverno#16505

Changes

• api/policies.kyverno.io/v1alpha1/mutating_policy.go: new optional AuditAnnotations field on MutatingPolicySpec
• api/policies.kyverno.io/v1alpha1/zz_generated.deepcopy.go: regenerated (make deepcopy-gen)

[Copilot]

Pull request overview

Adds spec.auditAnnotations support to MutatingPolicySpec so Kyverno can evaluate CEL expressions after successful mutations and surface the evaluated values as policy report result properties, aligning mutate policies with other CEL-based policy types.

Changes:

• Add optional AuditAnnotations []admissionregistrationv1.AuditAnnotation to MutatingPolicySpec (v1alpha1; aliased through v1beta1/v1).
• Regenerate deepcopy code to copy the new AuditAnnotations slice.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
api/policies.kyverno.io/v1alpha1/mutating_policy.go	Introduces the new AuditAnnotations field on MutatingPolicySpec with documentation.
api/policies.kyverno.io/v1alpha1/zz_generated.deepcopy.go	Updates autogenerated deepcopy logic to copy AuditAnnotations.

Files not reviewed (1)

• api/policies.kyverno.io/v1alpha1/zz_generated.deepcopy.go: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.