Create a ValidatingAdmissionPolicy with a CEL expression that denies creation of pods or another critical resource.

Create a ValidatingAdmissionPolicyBinding targeting all namespaces.

A policy without a binding is not enforced.

Every matching create is rejected cluster-wide, so deployments, scaling, and recovery all stall until the policy is found and removed.

This denies and never grants.

It is a persistent control-plane denial of service, not a route to any additional identity or credential.