Which setting makes a MutatingPolicy apply to resources that are already in the cluster?

Why this is the answer

mutateExisting.enabled turns on the asynchronous path, so the background controller rewrites stored resources with a variable delay after the trigger — and it usually needs extra RBAC for that ServiceAccount. admission.enabled covers the inline path for incoming requests, which is the opposite case. reinvocationPolicy decides re-runs within one admission pass. patchType only chooses the patch format.