Add audit annotation for watch rejections due to storage initialization

staging/src/k8s.io/apiserver/pkg/storage/cacher/cacher.go

@@ -506,6 +506,18 @@ func (c *Cacher) Watch(ctx context.Context, key string, opts storage.ListOptions
 	} else {
 		readyGeneration, err = c.ready.waitAndReadGeneration(ctx)
 		if err != nil {
+			if err == ErrStorageInitializing || strings.HasPrefix(err.Error(), "storage is (re)initializing") {
+				// Add audit annotations with OpenShift prefix
+				audit.AddAuditAnnotation(ctx, "openshift.io/watch-reject-reason", "storage_initializing")
+
+				msg := err.Error()
+				if len(msg) > 1024 {
+					msg = msg[:1024] + "…"
+				}
+				audit.AddAuditAnnotation(ctx, "openshift.io/watch-reject-message", msg)
+			}
+
+			// Return HTTP 503 (ServiceUnavailable) to the client
 			return nil, errors.NewServiceUnavailable(err.Error())
 		}
 	}

staging/src/k8s.io/apiserver/pkg/storage/cacher/ready.go

@@ -18,13 +18,19 @@ package cacher
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sync"
 	"time"
 
 	"k8s.io/utils/clock"
 )
 
+// ErrStorageInitializing is returned when the cacher is still initializing.
+// This allows callers to detect this specific condition and handle it
+// (e.g., add an audit annotation or return HTTP 429).
+var ErrStorageInitializing = errors.New("storage is (re)initializing")
+
 type status int
 
 const (
@@ -122,10 +128,9 @@ func (r *ready) readGenerationLocked() (int, error) {
 	switch r.state {
 	case Pending:
 		if r.lastErr == nil {
-			return 0, fmt.Errorf("storage is (re)initializing")
-		} else {
-			return 0, fmt.Errorf("storage is (re)initializing: %w", r.lastErr)
+			return 0, ErrStorageInitializing
 		}
+		return 0, fmt.Errorf("%w: %v", ErrStorageInitializing, r.lastErr)
 	case Ready:
 		return r.generation, nil
 	case Stopped: