Kubernetes v1.36 Introduces Immutable Admission Policies via Static Manifests
Kubernetes version 1.36 introduces an alpha feature known as manifest-based admission control, designed to resolve critical security gaps in policy enforcement. Traditionally, admission policies exist as API objects, creating vulnerabilities during cluster bootstrap where policies are not yet active, and allowing privileged users to delete them due to circular dependency protections. This new feature enables administrators to define admission webhooks and CEL-based policies as static files on disk. These configurations are loaded by the API server at startup, before it begins serving any requests, ensuring policies are active immediately. To implement this, users specify a staticManifestsDir in the AdmissionConfiguration file. Policy manifests must use names ending with the reserved suffix .static.k8s.io to prevent collisions with API-based configurations and facilitate audit tracking. This enhancement, developed by the Kubernetes SIG API Machinery, ensures that essential security policies remain permanently enforced and protected from accidental or malicious deletion, significantly strengthening cluster security posture during initialization and recovery scenarios.
Wire timeline
Kubernetes v1.36 Introduces Immutable Admission Policies via Static Manifests
Kubernetes version 1.36 introduces an alpha feature known as manifest-based admission control, designed to resolve critical security gaps in policy enforcement. Traditionally, admission policies exist as API objects, creating vulnerabilities during cluster bootstrap where policies are not yet active, and allowing privileged users to delete them due to circular dependency protections. This new feature enables administrators to define admission webhooks and CEL-based policies as static files on disk. These configurations are loaded by the API server at startup, before it begins serving any requests, ensuring policies are active immediately. To implement this, users specify a staticManifestsDir in the AdmissionConfiguration file. Policy manifests must use names ending with the reserved suffix .static.k8s.io to prevent collisions with API-based configurations and facilitate audit tracking. This enhancement, developed by the Kubernetes SIG API Machinery, ensures that essential security policies remain permanently enforced and protected from accidental or malicious deletion, significantly strengthening cluster security posture during initialization and recovery scenarios.
Kubernetes Blog