Kubernetes v1.36: Admission Policies That Can't Be Deleted

If you've ever tried to enforce a security policy across a fleet of Kubernetes clusters, you've probably run into a frustrating chicken-and-egg problem. Your admission policies are API objects, which means they don't exist until someone creates them, and they can be deleted by anyone with the right permissions. There's always a window during cluster bootstrap where your policies aren't active yet, and there's no way to prevent a privileged user from removing them. Kubernetes v1.36 introduces an alpha feature that addresses this: manifest-based admission control. It lets you define admission webhooks and CEL-based policies as files on disk, loaded by the API server at startup, before it serves any requests. The gap we're closingMost Kubernetes policy enforcement today works through the API.

This Coalition transmission preserves metadata, trust context, and source routing for a Developer Signal item from Kubernetes. The complete article remains with the original publisher.

Content handling is marked as Metadata Only. Use the source article link for the full report, updates, corrections, and publisher-controlled context.