create validatingadmissionpolicybindings

Binds a ValidatingAdmissionPolicy to namespaces or cluster-wide scope.

Combined with policy creation, enforces denial rules cluster-wide with no external webhook infrastructure.

Escalation Paths

Create a ValidatingAdmissionPolicy with a CEL expression that denies creation of pods or another critical resource.
Create a ValidatingAdmissionPolicyBinding targeting all namespaces.
A policy without a binding is not enforced.
Every matching create is rejected cluster-wide, so deployments, scaling, and recovery all stall until the policy is found and removed.
This denies and never grants.
It is a persistent control-plane denial of service, not a route to any additional identity or credential.

Additional rights needed: