delete validatingwebhookconfigurations
Privileged pod creation goes unrestricted once these webhooks are gone.
OPA Gatekeeper, Kyverno, and PSP enforcer all rely on ValidatingWebhookConfiguration for policy enforcement.
T1 with following verbs:
A privileged workload that third-party admission would have rejected
Deleting the configuration removes third-party enforcement but creates nothing.
Pod Security Admission is unaffected, so a namespace enforcing baseline or restricted still rejects a privileged pod.
- API Group
- admissionregistration.k8s.io
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
Delete the ValidatingWebhookConfiguration or MutatingWebhookConfiguration objects that back a policy engine.
Third-party enforcement such as Gatekeeper, Kyverno, or image signature verification stops rejecting anything.
Pod Security Admission is unaffected.
It is a built-in API server controller rather than a webhook, so namespace enforce labels still apply.
On its own this only removes a guard.
It becomes privilege only alongside a verb that creates the workload the webhook was rejecting.
Additional rights needed: