<p>I have the following conf</p>

<pre><code>cat kubeadm-conf.yaml 

apiVersion: kubeadm.k8s.io/v1beta1
kind: InitConfiguration
apiServerExtraArgs:
  enable-admission-plugins: NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook
networking:
  podSubnet: 192.168.0.0/16
</code></pre>

<p>but, when I do</p>

<pre><code>ps -aux | grep admission
root     20697  7.4  2.8 446916 336660 ?       Ssl  03:49   0:21 kube-apiserver --authorization-mode=Node,RBAC --advertise-address=10.0.2.15 --allow-privileged=true --client-ca-file=/etc/kubernetes/pki/ca.crt --enable-admission-plugins=NodeRestriction

I only see the NodeRestriction
</code></pre>

<p>Please, let me know if anyone can help me make sure that the admission-webhook is indeed running on my cluster.</p>

Invictus
<p>I assume that <code>MutatingAdmissionWebhook</code> and <code>ValidatingAdmissionWebhook</code> have not being properly propagated through api-server as per your provided outputs.</p>

<p>I suggest to proceed with the following steps to achieve your goal:</p>

<ol>
<li>Check and edit <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code> manifest file by adding required admission control plugins to <code>enable-admission-plugins</code> Kubernetes API server flag:</li>
</ol>

<blockquote>
  <p>--enable-admission-plugins=NodeRestriction,DefaultStorageClass,MutatingAdmissionWebhook,ValidatingAdmissionWebhook</p>
</blockquote>

<ol start="2">
<li>Delete current <code>kube-apiserver</code> Pod and wait until Kubernetes will respawn the new one with reflected changes:</li>
</ol>

<p><code>kubectl delete pod &lt;kube-apiserver-Pod&gt; -n kube-system</code></p>

<p>Hope it will help you, I've successfully checked these steps on my environment.</p>

<p>More information about Kubernetes Admission Controllers you can find in the official <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/" rel="nofollow noreferrer">documentation</a>.</p>
