Kubernetes 1.36 adds immutable manifest‑based admission policies
Kubernetes v1.36 introduces an alpha feature that loads admission webhook and CEL policies from static manifest files at API server startup, making them undeletable and eliminating the boot‑strapping security gap. Policies are stored in a directory with a .static.k8s.io suffix, ensuring they’re always enforced.