Kubernetes Manifests 1.36

Use these rules for resources deployed to Kubernetes 1.36. Apply them alongside the prompt for every application and runtime in the Pod; cluster controls do not replace authentication, authorization, validation, or output safety inside the workload.

Namespaces and enforcement ownership

• Create dedicated namespaces for production applications, environments, and trust zones; the default namespace and descriptive labels are not isolation controls.
• Bootstrap every workload namespace with quotas, limit ranges, default-deny networking, and admission policy before granting deployment access.
• Enforce the Restricted profile with pod-security.kubernetes.io/enforce: restricted and pin pod-security.kubernetes.io/enforce-version: v1.36; pin audit and warn versions as well when using those modes.
• Preserve audit/warn evaluation of workload templates because enforce checks the resulting Pods, including directly created Pods, rather than controller templates.
• Minimize Pod Security Admission exemptions. An exempt username, RuntimeClass, or namespace bypasses enforce, audit, and warn, and exempting controller identities can transitively exempt users who create workloads.
• Deny application identities permission to create namespaces or patch namespace policy, quota, ownership, or network-selection labels.
• Reject workload creation at admission until the namespace's Pod Security labels, quota, default limits, and network baseline are present.

Service accounts and tokens

• Use a unique ServiceAccount per workload and leave the namespace default ServiceAccount