> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# 2025 Updates Lab Solution Admission Controllers
> Step-by-step solutions for a Kubernetes Admission Controllers lab explaining admission plugin configuration, enabling/disabling plugins, and verifying kube-apiserver settings.
This walkthrough provides concise solutions for the Admission Controllers lab. Each question is answered in sequence with the exact commands and explanations you can use to validate results on a running Kubernetes control plane.
Summary of correct answers
| Question | Correct answer |
| - | - |
| 1 | `authenticate users` |
| 2 | `NamespaceAutoProvision` |
| 3 | `NodeRestriction` |
| 4 | Creating a Pod in `blue` fails until the namespace exists |
| 5 | Enable `NamespaceAutoProvision` in the kube-apiserver manifest |
| 6 | Disable `DefaultStorageClass` using `--disable-admission-plugins` |
| 7 | Verify effective settings via process args or manifest files |
***
## Question 1 — Which of these is NOT a function of admission controllers?
Admission controllers run after authentication and authorization and act on the incoming API request to mutate or validate objects. They do not perform user authentication.
Correct answer: authenticate users
Explanation: Authentication is performed earlier in the request pipeline (by authentication modules). Admission controllers only see requests that have already been authenticated and authorized, and they can mutate or validate API objects.
***
## Question 2 — Which admission controller is NOT enabled by default?
To inspect the apiserver's help text and see the default-enabled admission plugins, check the `--enable-admission-plugins` flag from the running kube-apiserver binary inside the control plane pod:
```bash theme={null}
kubectl exec -n kube-system kube-apiserver-control-plane -- kube-apiserver -h | grep 'enable-admission-plugins'
```
Example (truncated) output lists default-enabled plugins:
```bash theme={null}
--enable-admission-plugins strings admission plugins that should be enabled in addition to default enabled ones (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, ...
```
From that list, `NamespaceAutoProvision` is not present.
Correct answer: NamespaceAutoProvision
***
## Question 3 — Which admission controller is enabled in this cluster that is normally disabled?
To see the cluster-specific enabled admission plugins, inspect the static kube-apiserver manifest on the control plane host:
```bash theme={null}
grep enable-admission-plugins /etc/kubernetes/manifests/kube-apiserver.yaml
```
Example output:
```bash theme={null}
- --enable-admission-plugins=NodeRestriction
```
Here, `NodeRestriction` is enabled in the cluster configuration. While `NodeRestriction` is commonly enabled for security hardening, it might not be present in every distribution by default.
Correct answer: NodeRestriction
***
## Question 4 — Create an nginx Pod in the `blue` namespace (without creating the namespace beforehand)
If you try to run a Pod against a non-existent namespace, the apiserver will reject the request when the admission controller responsible for namespace lifecycle checks is active.
Attempt to create the Pod:
```bash theme={null}
kubectl run nginx --image=nginx -n blue
```
You will see:
```bash theme={null}
Error from server (NotFound): namespaces "blue" not found
```
Explanation: The admission controller rejected the create request because the `blue` namespace does not exist. To allow automatic on-the-fly creation of namespaces for such requests, the `NamespaceAutoProvision` admission plugin would need to be enabled.
***
## Question 5 — Enable `NamespaceAutoProvision` so a namespace is created automatically
Enable `NamespaceAutoProvision` by editing the kube-apiserver static pod manifest and adding it to the `--enable-admission-plugins` comma-separated list.
Edit the manifest on the control plane host:
```bash theme={null}
vi /etc/kubernetes/manifests/kube-apiserver.yaml
```
Find the `- --enable-admission-plugins=...` line and add `NamespaceAutoProvision` to the list. Example snippet:
```yaml theme={null}
spec:
containers:
- command:
- kube-apiserver
...
- --enable-admission-plugins=NodeRestriction,NamespaceAutoProvision
...
```
Save the file. The kube-apiserver static pod will restart automatically when the manifest changes — wait a short time for the process to come back up.
After the apiserver restarts, re-run the Pod creation without creating the namespace manually:
```bash theme={null}
kubectl run nginx --image=nginx -n blue
kubectl get ns
```
Expected output:
```bash theme={null}
pod/nginx created
NAME STATUS AGE
blue Active 7s
default Active 50m
kube-node-lease Active 50m
kube-public Active 50m
kube-system Active 50m
```
The `blue` namespace was auto-created by the `NamespaceAutoProvision` admission controller.
NamespaceAutoProvision has been deprecated or removed in newer Kubernetes releases. Modern clusters often do not include this admission plugin; instead, create namespaces explicitly or use supported automation mechanisms such as controllers, operators, or CI/CD tooling.
***
## Question 6 — Disable the `DefaultStorageClass` admission controller
To disable `DefaultStorageClass`, add the `--disable-admission-plugins` flag to the kube-apiserver manifest and include `DefaultStorageClass` in the comma-separated list.
Edit the manifest:
```bash theme={null}
vi /etc/kubernetes/manifests/kube-apiserver.yaml
```
Add or update the disable flag like this (example):
```yaml theme={null}
spec:
containers:
- command:
- kube-apiserver
...
- --enable-admission-plugins=NodeRestriction,NamespaceAutoProvision
- --disable-admission-plugins=DefaultStorageClass
...
```
Save the manifest and wait for the kube-apiserver static pod to restart. Once restarted, `DefaultStorageClass` will be disabled for the running apiserver process.
***
## Question 7 — Verify which admission plugins are enabled and disabled on the running kube-apiserver
You can verify the effective enabled and disabled admission plugins by checking either the manifest file or the running kube-apiserver process command line.
1. Inspect the manifest (static configuration):
```bash theme={null}
grep -E "enable-admission-plugins|disable-admission-plugins" /etc/kubernetes/manifests/kube-apiserver.yaml
```
2. Check the running process arguments on the control plane host:
```bash theme={null}
ps -ef | grep kube-apiserver | grep -v grep
```
Look for `--enable-admission-plugins` and `--disable-admission-plugins` in the process command line. Example (truncated):
```bash theme={null}
root 1234 1 0 00:00 ? 00:00:00 /usr/local/bin/kube-apiserver --advertise-address=10.49.219.9 ... --enable-admission-plugins=NodeRestriction,NamespaceAutoProvision --disable-admission-plugins=DefaultStorageClass ...
```
This confirms both the enabled and disabled admission plugins that the running apiserver was started with.
***
## Quick verification checklist
* Inspect apiserver help to see default plugin options:
* `kubectl exec -n kube-system kube-apiserver-control-plane -- kube-apiserver -h | grep 'enable-admission-plugins'`
* View cluster-apiserver manifest to see cluster-specific settings:
* `grep -E "enable-admission-plugins|disable-admission-plugins" /etc/kubernetes/manifests/kube-apiserver.yaml`
* Confirm the running process arguments:
* `ps -ef | grep kube-apiserver | grep -v grep`
***
## Links and references
* Kubernetes admission controllers overview: [https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/)
* kube-apiserver command line flags: [https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/)
* Managing static pods and manifests: [https://kubernetes.io/docs/tasks/administer-cluster/static-pod/](https://kubernetes.io/docs/tasks/administer-cluster/static-pod/)
That completes the Admission Controllers lab solution walkthrough.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.