Kubernetes Manifests 1.34

Apply these rules to Kubernetes 1.34 workload manifests, namespace policies, RBAC, storage, and cluster configuration. Linux and Windows workloads need their respective isolation settings; YAML does not have a host-language runtime baseline.

Release scope and rendered manifests

• Run the newest patch of a Kubernetes minor that still receives security fixes, using the distribution's update mechanism or maintained image automation to select it. Look up release and component-skew support rather than guessing versions; never relax an existing constraint to make deployment succeed.
• Audit manifests, images, and dependencies in CI. Check node operating systems, container runtimes, CNI/CSI plugins, and controllers separately because application dependency scans cannot inspect them.
• Render Helm/Kustomize output before review and validate it using kubectl apply --dry-run=server --validate=strict, with an explicit context and namespace. Review the admitted result as well as the input.

Images and registry authorization

• Specify complete image registry/repository names and reviewed immutable digests, with automation to refresh those digests.
• Set imagePullPolicy deliberately; changing an image tag does not recalculate an existing object's pull policy. Reject unapproved registries through admission, including images in init and ephemeral containers.
• For tenants sharing nodes, enforce AlwaysPullImages and give workloads only their own imagePullSecrets; cached private images must not become available merely because another workload fetched them.
• Do not assume