Kubernetes v1.36: Admission Policies That Can't Be Deleted

Kubernetes v1.36 introduces manifest-based admission control, loading policies from disk at API server startup to ensure they can't be accidentally deleted.

• •Policies are loaded before the API server serves requests, eliminating security gaps during cluster bootstrap
• •Use staticManifestsDir in AdmissionConfiguration to specify YAML files that must end in .static.k8s.io
• •Manifest-based policies can intercept operations on admission resources themselves, preventing admin tampering
• •Policy file changes are detected at runtime and applied atomically without server restart
• •Self-contained policies work without API references, functioning even before etcd is available

This summary was automatically generated by AI based on the original article and may not be fully accurate.