Skip to main content
In this article, we review the lab solutions related to admission controllers. We will analyze several questions, demonstrate validation techniques using command-line operations, and show manifest file edits to enforce specific configurations.

​
Question 1: Function of Admission Controllers

The first question asks which task admission controllers do not perform. The correct answer is that they do not handle user authentication. Admission controllers come into effect after authentication, enforcing policies by validating or mutating resources.

​
Question 2: Enabling the Default Admission Controllers

The next question examines which admission controller is not enabled by default. To determine this:
  1. List the control plane pods in the kube-system namespace:
  2. Inspect the kube-apiserver pod (e.g., kube-apiserver-controlplane). Execute a shell inside the pod and search for the enabled admission plugins:
    The output confirms that while plugins such as mutating and validating admission webhooks are present, the “namespace auto-provision” admission controller is absent. This controller is therefore not enabled by default.

​
Question 3: Admission Controller Enabled by Default (But Normally Disabled)

This question asks which admission controller is active in the cluster that is usually disabled by default. To answer:
  1. Open the kube-apiserver configuration file at /etc/kubernetes/manifests/kube-apiserver.yaml.
  2. Run the following command to locate the admission plugin configuration:
    You should see an output similar to:
    From this configuration, it is clear that the “NodeRestriction” plugin is enabled, even though it is not typically activated by default in standard configurations.

​
Question 4: Creating an NGINX Pod without Pre-Creating the Namespace

In this task, we create an NGINX pod in a non-existent namespace called “blue.” This operation will help us understand how Kubernetes responds when the specified namespace is missing. Execute the following command:
Since the “blue” namespace does not exist, the command returns an error:
This error occurs because the “namespace exists” admission controller (enabled by default) rejects requests for non-existent namespaces. To enable automatic creation of missing namespaces, the Namespace Auto-Provision admission controller must be activated.

​
Enabling the Namespace Auto-Provision Admission Controller

To enable automatic namespace creation, update the API server manifest at /etc/kubernetes/manifests/kube-apiserver.yaml as follows:
  1. Locate the line with --enable-admission-plugins.
  2. Add the NamespaceAutoProvision plugin, making the line appear as shown below:
After saving the changes, the API server pod will restart. Allow a few minutes for it to come back online.
Once the API server is up, create the NGINX pod again:
To verify that the blue namespace was auto-created, list all namespaces:
Expected output:
This confirms that the Namespace Auto-Provision admission controller is functioning correctly.

​
Question 5: Disabling the Default Storage Class Admission Controller

The final task involves disabling the default storage class admission controller. This is accomplished by modifying the API server manifest.
  1. Open the file /etc/kubernetes/manifests/kube-apiserver.yaml.
  2. Directly after the --enable-admission-plugins flag, add the disable flag for the DefaultStorageClass plugin (--disable-admission-plugins=DefaultStorageClass) as shown below:
Ensure you allow the API server sufficient time to restart after making these changes. Validate the changes by checking the status of pods and namespaces.
After the API server restarts, test the configuration with:
A successful pod creation and the updated namespace list confirm that the default storage class admission controller is disabled. Example command-line output:

​
Summary

To summarize, in this lab we:
  1. Identified the function of admission controllers and clarified that they do not manage user authentication.
  2. Determined which admission controllers are enabled by default.
  3. Enabled the Namespace Auto-Provision admission controller to automatically create namespaces.
  4. Disabled the default storage class admission controller through modifications to the API server manifest.
This concludes the Admission Controllers Lab for the 2025 updates. For additional Kubernetes configuration guides, please refer to the Kubernetes Documentation.

Watch Video