2025 Updates Lab Solution Admission Controllers

This walkthrough provides concise solutions for the Admission Controllers lab. Each question is answered in sequence with the exact commands and explanations you can use to validate results on a running Kubernetes control plane. Summary of correct answers

Question	Correct answer
1	`authenticate users`
2	`NamespaceAutoProvision`
3	`NodeRestriction`
4	Creating a Pod in `blue` fails until the namespace exists
5	Enable `NamespaceAutoProvision` in the kube-apiserver manifest
6	Disable `DefaultStorageClass` using `--disable-admission-plugins`
7	Verify effective settings via process args or manifest files

Question 1 — Which of these is NOT a function of admission controllers?

Admission controllers run after authentication and authorization and act on the incoming API request to mutate or validate objects. They do not perform user authentication. Correct answer: authenticate users Explanation: Authentication is performed earlier in the request pipeline (by authentication modules). Admission controllers only see requests that have already been authenticated and authorized, and they can mutate or validate API objects.

Question 2 — Which admission controller is NOT enabled by default?

To inspect the apiserver’s help text and see the default-enabled admission plugins, check the --enable-admission-plugins flag from the running kube-apiserver binary inside the control plane pod:

kubectl exec -n kube-system kube-apiserver-control-plane -- kube-apiserver -h | grep 'enable-admission-plugins'

Example (truncated) output lists default-enabled plugins:

--enable-admission-plugins strings    admission plugins that should be enabled in addition to default enabled ones (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, ...

From that list, NamespaceAutoProvision is not present. Correct answer: NamespaceAutoProvision

Question 3 — Which admission controller is enabled in this cluster that is normally disabled?

To see the cluster-specific enabled admission plugins, inspect the static kube-apiserver manifest on the control plane host:

grep enable-admission-plugins /etc/kubernetes/manifests/kube-apiserver.yaml

Example output:

- --enable-admission-plugins=NodeRestriction

Here, NodeRestriction is enabled in the cluster configuration. While NodeRestriction is commonly enabled for security hardening, it might not be present in every distribution by default. Correct answer: NodeRestriction

Question 4 — Create an nginx Pod in the `blue` namespace (without creating the namespace beforehand)

If you try to run a Pod against a non-existent namespace, the apiserver will reject the request when the admission controller responsible for namespace lifecycle checks is active. Attempt to create the Pod:

kubectl run nginx --image=nginx -n blue

You will see:

Error from server (NotFound): namespaces "blue" not found

Explanation: The admission controller rejected the create request because the blue namespace does not exist. To allow automatic on-the-fly creation of namespaces for such requests, the NamespaceAutoProvision admission plugin would need to be enabled.

Question 5 — Enable `NamespaceAutoProvision` so a namespace is created automatically

Enable NamespaceAutoProvision by editing the kube-apiserver static pod manifest and adding it to the --enable-admission-plugins comma-separated list. Edit the manifest on the control plane host:

vi /etc/kubernetes/manifests/kube-apiserver.yaml

Find the - --enable-admission-plugins=... line and add NamespaceAutoProvision to the list. Example snippet:

spec:
  containers:
  - command:
    - kube-apiserver
    ...
    - --enable-admission-plugins=NodeRestriction,NamespaceAutoProvision
    ...

Save the file. The kube-apiserver static pod will restart automatically when the manifest changes — wait a short time for the process to come back up. After the apiserver restarts, re-run the Pod creation without creating the namespace manually:

kubectl run nginx --image=nginx -n blue
kubectl get ns

Expected output:

pod/nginx created

NAME                 STATUS    AGE
blue                 Active    7s
default              Active    50m
kube-node-lease      Active    50m
kube-public          Active    50m
kube-system          Active    50m

The blue namespace was auto-created by the NamespaceAutoProvision admission controller.

NamespaceAutoProvision has been deprecated or removed in newer Kubernetes releases. Modern clusters often do not include this admission plugin; instead, create namespaces explicitly or use supported automation mechanisms such as controllers, operators, or CI/CD tooling.

Question 6 — Disable the `DefaultStorageClass` admission controller

To disable DefaultStorageClass, add the --disable-admission-plugins flag to the kube-apiserver manifest and include DefaultStorageClass in the comma-separated list. Edit the manifest:

vi /etc/kubernetes/manifests/kube-apiserver.yaml

Add or update the disable flag like this (example):

spec:
  containers:
  - command:
    - kube-apiserver
    ...
    - --enable-admission-plugins=NodeRestriction,NamespaceAutoProvision
    - --disable-admission-plugins=DefaultStorageClass
    ...

Save the manifest and wait for the kube-apiserver static pod to restart. Once restarted, DefaultStorageClass will be disabled for the running apiserver process.

Question 7 — Verify which admission plugins are enabled and disabled on the running kube-apiserver

You can verify the effective enabled and disabled admission plugins by checking either the manifest file or the running kube-apiserver process command line.

Inspect the manifest (static configuration):

grep -E "enable-admission-plugins|disable-admission-plugins" /etc/kubernetes/manifests/kube-apiserver.yaml

Check the running process arguments on the control plane host:

ps -ef | grep kube-apiserver | grep -v grep

Look for --enable-admission-plugins and --disable-admission-plugins in the process command line. Example (truncated):

root      1234  1  0 00:00 ?        00:00:00 /usr/local/bin/kube-apiserver --advertise-address=10.49.219.9 ... --enable-admission-plugins=NodeRestriction,NamespaceAutoProvision --disable-admission-plugins=DefaultStorageClass ...

This confirms both the enabled and disabled admission plugins that the running apiserver was started with.

Quick verification checklist

Inspect apiserver help to see default plugin options:
- kubectl exec -n kube-system kube-apiserver-control-plane -- kube-apiserver -h | grep 'enable-admission-plugins'
View cluster-apiserver manifest to see cluster-specific settings:
- grep -E "enable-admission-plugins|disable-admission-plugins" /etc/kubernetes/manifests/kube-apiserver.yaml
Confirm the running process arguments:
- ps -ef | grep kube-apiserver | grep -v grep

Links and references

Kubernetes admission controllers overview: https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/
kube-apiserver command line flags: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
Managing static pods and manifests: https://kubernetes.io/docs/tasks/administer-cluster/static-pod/

That completes the Admission Controllers lab solution walkthrough.

Introduction

Core Concepts

Scheduling

Logging & Monitoring

Application Lifecycle Management

Cluster Maintenance

Security

Storage

Networking

Design and Install a Kubernetes Cluster

Install "Kubernetes the kubeadm way"

Troubleshooting

Helm Basics (2025 Updates)

Kustomize Basics (2025 Updates)

Other Topics

Mock Exams

2025 Updates Lab Solution Admission Controllers

Question 1 — Which of these is NOT a function of admission controllers?

Question 2 — Which admission controller is NOT enabled by default?

Question 3 — Which admission controller is enabled in this cluster that is normally disabled?

Question 4 — Create an nginx Pod in the `blue` namespace (without creating the namespace beforehand)

Question 5 — Enable `NamespaceAutoProvision` so a namespace is created automatically

Question 6 — Disable the `DefaultStorageClass` admission controller

Question 7 — Verify which admission plugins are enabled and disabled on the running kube-apiserver

Quick verification checklist

Links and references

Watch Video

​Question 1 — Which of these is NOT a function of admission controllers?

​Question 2 — Which admission controller is NOT enabled by default?

​Question 3 — Which admission controller is enabled in this cluster that is normally disabled?

​Question 4 — Create an nginx Pod in the blue namespace (without creating the namespace beforehand)

​Question 5 — Enable NamespaceAutoProvision so a namespace is created automatically

​Question 6 — Disable the DefaultStorageClass admission controller

​Question 7 — Verify which admission plugins are enabled and disabled on the running kube-apiserver

​Quick verification checklist

​Links and references

Watch Video

Question 1 — Which of these is NOT a function of admission controllers?

Question 2 — Which admission controller is NOT enabled by default?

Question 3 — Which admission controller is enabled in this cluster that is normally disabled?

Question 4 — Create an nginx Pod in the `blue` namespace (without creating the namespace beforehand)

Question 5 — Enable `NamespaceAutoProvision` so a namespace is created automatically

Question 6 — Disable the `DefaultStorageClass` admission controller

Question 7 — Verify which admission plugins are enabled and disabled on the running kube-apiserver

Quick verification checklist

Links and references