Create a MutatingWebhookConfiguration with clientConfig pointing at a server you control that the API server can reach.

Set rules to match CREATE on the resources you want, for example pods and secrets, across all namespaces.

Every matched object is sent to the webhook and comes back patched, so sidecars can be injected and securityContext stripped.

failurePolicy sets the trade.

Fail makes the mutation reliable but breaks admission whenever the endpoint is down, while Ignore is quieter and silently skips objects.

sideEffects and admissionReviewVersions must be declared or the API server rejects the configuration.