Kubetier
  1. A MutatingAdmissionPolicy must already exist in the cluster with no binding, so it is dormant and not enforced.

  2. Create a MutatingAdmissionPolicyBinding naming it, which matches cluster-wide unless matchResources narrows it.

  3. The policy takes effect on the next CREATE.

    What it does is whatever that policy already specifies, which may be harmless.

Note:

Binding write is not a safe reduction from authoring.

Create on mutatingadmissionpolicybindings alone activates a dormant policy with no rights over the policy itself.

Severity is whatever the existing policy already does.

K8s docs ↗