create mutatingadmissionpolicybindings

Activates an existing MutatingAdmissionPolicy for selected namespaces or cluster-wide scope.

Paired with policy creation, it enables CEL-based mutation with no external webhook infrastructure.

Alone, it can switch on a dormant policy.

T0 with following verbs:

Every new pod cluster-wide mutated to run privileged

Authoring the policy and binding it are separate verbs, and a policy without a binding never runs.

With both, the mutation applies cluster-wide.

Pod Security Admission still rejects the result in a namespace enforcing baseline or restricted, since mutating admission completes first.

Contextual upgrade to T0:

T0 where a dormant MutatingAdmissionPolicy already exists whose mutation adds host access, credentials, or a privileged securityContext.

The binding then applies it cluster-wide on the next pod CREATE.

Absent such a policy the verb activates nothing, which is why the base tier is not T0.

Escalation Paths

Create a MutatingAdmissionPolicy whose CEL sets privileged and hostPID on every pod spec.
Create a MutatingAdmissionPolicyBinding for it.
A policy with no binding never runs.
Mutating admission completes before validating admission, so Pod Security Admission evaluates the mutated pod and rejects it in a namespace enforcing baseline or restricted.
Where no namespace enforces pod security, the mutation stands and every new pod there runs privileged with host access.

Additional rights needed:

A MutatingAdmissionPolicy must already exist in the cluster with no binding, so it is dormant and not enforced.
Create a MutatingAdmissionPolicyBinding naming it, which matches cluster-wide unless matchResources narrows it.
The policy takes effect on the next CREATE.
What it does is whatever that policy already specifies, which may be harmless.

Additional rights needed:

none

Note:

Binding write is not a safe reduction from authoring.

Create on mutatingadmissionpolicybindings alone activates a dormant policy with no rights over the policy itself.

Severity is whatever the existing policy already does.