How to configure/customise Kubectl-api --enable-admission-plugins

[ravichandra22]

HI,

Can you please help me how to customise kubeapi-server --enable-admission-plugins. By default few admission plugins are set to deny.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/157758561

The labels on this github issue will be updated when the story is started.

[tvs]

At the moment, the kube-apiserver job does not offer any mechanism for fine-grained control over the admission controls. The only things that are currently optional are SecurityContextDeny (through allow_privileged) and DenyEscalatingExec (through deny_escalating_exec).

I've been considering opening these up to be configured on a per-controller basis (with our manifest applying the current defaults), much the same way we do with feature gates. Hopefully that or some other mechanism will give you the flexibility you want.

[alex-slynko]

It is possible to do with 0.24