create mutatingwebhookconfigurations
Register a webhook that intercepts every API write before etcd.
It can inject sidecars into every pod, strip security contexts, mount service account tokens, and exfiltrate every Secret.
Persistent, cluster-wide backdoor.
- API Group
- admissionregistration.k8s.io
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
Create a MutatingWebhookConfiguration with clientConfig pointing at a server you control that the API server can reach.
Set rules to match CREATE on the resources you want, for example pods and secrets, across all namespaces.
Every matched object is sent to the webhook and comes back patched, so sidecars can be injected and securityContext stripped.
failurePolicy sets the trade.
Fail makes the mutation reliable but breaks admission whenever the endpoint is down, while Ignore is quieter and silently skips objects.
sideEffects and admissionReviewVersions must be declared or the API server rejects the configuration.
Additional rights needed: