<p>AFAIK, the admission controller is the last pass before the submission to the database.</p>

<p>However I cannot know which one is enabled, Is there a way to know which one is taking effect?</p>

<p>Thanks.</p>

<p>The kube-apiserver is running in your kube-apiserver-&lt; example.com > container.
The application does not have a get method at the moment to obtain the enabled admission plugins, but you can get the startup parameters from its command line.</p>

<pre><code>kubectl -n kube-system describe po kube-apiserver-example.com
</code></pre>

<p>Another way, to see what is in the container: unfortunately there is no "ps" command in the container, but you can get the initial process command parameters from /proc , something like that:</p>

<pre><code>kubectl -n kube-system exec kube-apiserver-example.com -- sed 's/--/\n/g' /proc/1/cmdline
</code></pre>

<p>It will be probably like :</p>

<blockquote>
  <p>enable-admission-plugins=NodeRestriction</p>
</blockquote>
