diff --git a/bindata/cluster-network-operator/servicecidr-vap.yaml b/bindata/cluster-network-operator/servicecidr-vap.yaml
new file mode 100644
index 0000000000..debe9d3321
--- /dev/null
+++ b/bindata/cluster-network-operator/servicecidr-vap.yaml
@@ -0,0 +1,25 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "servicecidrs.openshift.io"
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:   ["networking.k8s.io"]
+      apiVersions: ["v1"]
+      operations:  ["CREATE", "UPDATE"]
+      resources:   ["servicecidrs"]
+  validations:
+    # Allow apiserver to change the 'kubernetes' ServiceCIDR (when doing single/dual-stack
+    # migration). Reject all other changes with the given message.
+    - expression: "request.userInfo.username == 'system:apiserver' && 'system:masters' in request.userInfo.groups"
+      message: "changing service CIDRs in a running cluster is not supported"
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: "servicecidrs-binding"
+spec:
+  policyName: "servicecidrs.openshift.io"
+  validationActions: [Deny]