delete mutatingwebhookconfigurations
Silently removes the mutations a MutatingWebhookConfiguration applies, e.g. a policy engine or sidecar injector that defaults securityContext or enforces image controls.
Once gone, objects admit unmodified, without those security-relevant defaults.
T1 with following verbs:
A privileged workload that third-party admission would have rejected
Deleting the configuration removes third-party enforcement but creates nothing.
Pod Security Admission is unaffected, so a namespace enforcing baseline or restricted still rejects a privileged pod.
- API Group
- admissionregistration.k8s.io
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
Delete the ValidatingWebhookConfiguration or MutatingWebhookConfiguration objects that back a policy engine.
Third-party enforcement such as Gatekeeper, Kyverno, or image signature verification stops rejecting anything.
Pod Security Admission is unaffected.
It is a built-in API server controller rather than a webhook, so namespace enforce labels still apply.
On its own this only removes a guard.
It becomes privilege only alongside a verb that creates the workload the webhook was rejecting.
Additional rights needed: