create mutatingadmissionpolicies
Paired with a binding, a MutatingAdmissionPolicy's CEL expressions can inject privileged settings, strip security controls, or add hostPID/hostNetwork to new pods.
Stable in v1.36, enabled by default, and mutates API writes via CEL.
T0 with following verbs:
Every new pod cluster-wide mutated to run privileged
A MutatingAdmissionPolicy without a binding never runs, so both verbs are required.
Mutating admission completes before validating admission, so Pod Security Admission still rejects the mutated pod in a namespace enforcing baseline or restricted.
- API Group
- admissionregistration.k8s.io
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
Create a MutatingAdmissionPolicy whose CEL sets privileged and hostPID on every pod spec.
Create a MutatingAdmissionPolicyBinding for it.
A policy with no binding never runs.
Mutating admission completes before validating admission, so Pod Security Admission evaluates the mutated pod and rejects it in a namespace enforcing baseline or restricted.
Where no namespace enforces pod security, the mutation stands and every new pod there runs privileged with host access.
Additional rights needed:
· both; a policy without a binding is inert