create validatingadmissionpolicies
A CEL expression in a ValidatingAdmissionPolicy can deny all pod or workload creation cluster-wide.
GA since v1.30, it requires a ValidatingAdmissionPolicyBinding to activate.
Operational DoS only, since VAP can deny but never mutate.
- API Group
- admissionregistration.k8s.io
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
Create a ValidatingAdmissionPolicy with a CEL expression that denies creation of pods or another critical resource.
Create a ValidatingAdmissionPolicyBinding targeting all namespaces.
A policy without a binding is not enforced.
Every matching create is rejected cluster-wide, so deployments, scaling, and recovery all stall until the policy is found and removed.
This denies and never grants.
It is a persistent control-plane denial of service, not a route to any additional identity or credential.
Additional rights needed:
· both; an unbound policy is not enforced