Not done yet and by far not tested BUT this SHOULD make a plausible init container to build the policy executor each time I change my config.