<p>There are some great <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/" rel="nofollow noreferrer">admission controllers</a> such as <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#defaultstorageclass" rel="nofollow noreferrer">DefaultStorageClass</a>, StorageObjectInUseProtection, PersistentVolumeClaimResize that enfoce some k8s best practices to your
cluster.</p>
<p>In order to enable admission controller you must have admin access to the k8s api-server, but on GKE you don't have.</p>
<p>So how we can enable these admission controller in GKE?</p>
<p>Note: I saw few related questions raised in the past but with no answers like <a href="https://stackoverflow.com/questions/59103316/how-to-enable-admission-controller-on-a-gke-cluster">question3</a> and <a href="https://stackoverflow.com/questions/62696739/how-to-enable-podnodeselector-admission-controller-plugin-in-gke">question4</a>.</p>

Shay Berman
<p>It's not possible to modify enabled admission controllers, as that would require modifying the <code>--enable-admission-plugins</code> API server configuration option, and that is not possible on GKE, nor are there any alternative ways to set this option at the moment.</p>
<p>Now, looking at each of the individual controllers mentioned:</p>
<ul>
<li><p><strong>DefaultStorageClass</strong> - this admission controller is enabled in GKE. You can check that the standard pre-created storage class has the <code>storageclass.kubernetes.io/is-default-class: &quot;true&quot;</code> annotation. In order to use different SC as default, remove this annotation from the standard  storage class, and add it to the SC of your choice.</p>
</li>
<li><p><strong>StorageObjectInUseProtection</strong> -  this admission controller is enabled in GKE, you can observe that that <code>kubernetes.io/pv-protection</code> and <code>kubernetes.io/pvc-protectionfinalizers</code> are added to PVs, resp. PVCs, in use, preventing their deletion.</p>
</li>
<li><p><strong>PersistentVolumeClaimResize</strong> - this admission controller is also enabled in GKE. You can verify this by creating a storage class with <code>allowVolumeExpansion: false</code> annotation <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/persistent-volumes/volume-expansion" rel="nofollow noreferrer">1</a> (note the standard SC does allow expansion), create a PVC and try to increase it's size. You'll receive an error such as:</p>
<pre><code>error: persistentvolumeclaims &quot;my-pvc&quot; could not be patched: persistentvolumeclaims &quot;my-pvc&quot; is forbidden: only dynamically provisioned pvc can be resized and the storageclass that provisions the pvc must support resize
</code></pre>
</li>
</ul>
<p>At last, if you would want to enable a controller that is actually not enabled on GKE, you would need to reimplement and deploy this as a standalone service into your cluster and use K8s' <em>ValidatingWebhookConfiguration</em> or <em>MutatingWebhookConfiguration</em> to connect K8s API your service via webhook <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/" rel="nofollow noreferrer">2</a>. Apart from implementing this from scratch, there are many projects that can help, OPA Gatekeeper <a href="https://github.com/open-policy-agent/gatekeeper" rel="nofollow noreferrer">3</a> and Metacontroller <a href="https://metacontroller.app/" rel="nofollow noreferrer">4</a> to list some examples.</p>
