# How does Kyverno change resources that already exist in the cluster, rather than only new admission requests?

Kyverno, Hard (Expert), Mutation. https://k8wiz.com/uquiz/how-does-kyverno-change-resources-that-already-exist-in-the-cluster-rather-than-only-new-admission-requests

- A. A validate rule in Audit mode that rewrites failing resources
- B. A generate rule with synchronize: true pointing at the resources
- C. Running 'kyverno apply --mutate' against the live cluster
- D. A mutate rule with 'targets', run by the background controller

**Answer:** A mutate rule with 'targets', run by the background controller

**Explanation:** Mutate-existing rules name the resources to change under 'targets'. A trigger event, or a policy event when mutateExistingOnPolicyUpdate is set on the rule, makes the background controller patch those targets. Kyverno needs RBAC permission to update those kinds, granted to the background controller's service account.