● Covered by 1 source · 1 reportMedium impact
Kubernetes v1.36 Introduces Immutable Admission Policies Feature
Kubernetes v1.36 introduces an alpha feature for manifest-based admission control that allows admission policies to load from disk at startup, preventing deletion during critical phases. This update addresses the limitations of existing admission control practices, particularly during cluster bootstrap and recovery scenarios.
Key points
- Kubernetes v1.36 features manifest-based admission control.
- Policies can be defined in manifest files on disk.
- Addresses gaps in policy enforcement during bootstrap.
Introduction of Manifest-Based Admission Control
Kubernetes v1.36 has introduced an alpha feature called manifest-based admission control. This feature enables the definition of admission webhooks and CEL-based policies as files stored on disk, which can be loaded by the API server before it serves any requests.
Addressing Current Limitations
Existing Kubernetes enforcement mechanisms allow policies to be created as API objects. This poses challenges particularly during cluster bootstrap as policies may not be active immediately. The new feature aims to eliminate that window where policies can be vulnerable to deletion by privileged users.
How It Works
To utilize this feature, users must add a `staticManifestsDir` field to the AdmissionConfiguration file. This points to a directory containing policy YAML files that get loaded before the API server begins processing requests. Each object must end with the suffix .static.k8s.io to be recognized.
Significance and Use Cases
This change significantly enhances the security and reliability of Kubernetes admission policies, particularly during recovery from failures or initial cluster setups. It ensures that critical policies are always in effect, thereby strengthening the overall security posture of Kubernetes environments.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub kubernetes/community GitHub kubernetes/website GitHub kubernetes/kubernetes CVE CVE-2025-19749.8 CRITICAL CVE CVE-2019-57368.6 HIGHReporting from
Kubernetes v1.36 introduces an alpha feature for manifest-based admission control that allows admission policies to load from disk at startup, preventing deletion during critical phases. This update addresses the limitations of existing admission control practices, particularly during cluster bootstrap and recovery scenarios.