cleanup

Author: tallclair

keps/sig-auth/2579-pod-isolation-policy/README.md

@@ -1,6 +1,7 @@
 # KEP-2579: Pod Isolation Policy
 
 <<[UNRESOLVED]>>
+
 The name of this feature / policy is open to discussion. Other options considered:
 - Pod Policy Check
 - Pod Security Standards
@@ -12,6 +13,7 @@ The name of this feature / policy is open to discussion. Other options considere
 - Namespace Security Labels
 - ~~Pod Security Defaults~~ (policy is non-mutating)
 - Pod Security Policy v2
+
 <<[/UNRESOLVED]>>
 
 <!-- toc -->
@@ -194,9 +196,9 @@ inconsistency with audit & warn less obvious, but doesn't help the user experien
 
 ### Validation
 
-The following restrictions are placed (by the admission plugin) on the pod security namespace labels:
+The following restrictions are placed (by the admission plugin) on the policy namespace labels:
 
-1. Unknown labels with the pod security prefix (TBD) are rejected, e.g. `prefix/foo-bar`
+1. Unknown labels with the pod security prefix (TBD) are rejected, e.g. `podisolationpolicy.kubernetes.io/foo-bar`
 2. Policy level must be one of: `privileged`, `baseline`, `restricted`
 3. Version values must be match `(latest|v[0-9]+\.[0-9]+`. That is, one of:
     1. `latest`
@@ -282,7 +284,7 @@ CRDs that wish to take advantage of this functionality should instead have an ob
 v1/PodTemplate resource. We will publish a guide (documentation and/or examples) that demonstrate
 this pattern.
 
-### Allow Update Warnings
+### Namespace policy update warnings
 
 When an allow policy (or version) label is added or changed, the admission plugin will test each pod
 in the namespace against the new policy. Violations are returned to the user as warnings. These
@@ -299,6 +301,13 @@ checking for breakages before updating a policy, for example:
 kubectl label --dry-run=server --overwrite ns --all podisolationpolicy.kubernetes.io/allow=baseline
 ```
 
+<<[UNRESOLVED]>>
+
+- What should the timout be for pod update warnings?
+- What should the pod limit be set to?
+
+<<[/UNRESOLVED]>>
+
 
 ### Admission Configuration
 
@@ -346,7 +355,7 @@ the admission controller (allow, audit and warn). Exemption dimensions include:
 
 - Usernames: requests from users with an exempt authenticated (or impersonated) username are ignored.
 - RuntimeClassNames: pods and [templated pods] with specifying an exempt runtime class name are ignored.
-- Namespace: pods and [templated pods] in an exempt namespace are ignored.
+- Namespaces: pods and [templated pods] in an exempt namespace are ignored.
 
 <<[UNRESOLVED]>>