Answer 答案Each Kubernetes minor release contains a set of admission controllers that are enabled by default. These default admission controllers are enabled within the Kubernetes API automatically and do not need to be explicitly enabled via configuration parameters. This is why they are not visible in the configuration.每个 Kubernetes 次要版本都包含一套默认启用的准入控制器。这些默认准入控制器在 Kubernetes API 中会自动启用无需通过配置参数明确启用。这就是为什么在配置中它们看不到。The--admission-control-config-fileflag is used to explicitly enable additional admission controllers.该--admission-control-config-file标志用于明确启用额外的招生控制者 。See the Kubernetes documentation for more information: Admission control in Kubernetes.更多信息请参见 Kubernetes 文档Kubernetes 中的准入控制 。For example, as of Kubernetes v1.33, the DenyServiceExternalIPs and EventRateLimit Admission control plugins are disabled by default, so they need be enabled via the--admission-control-config-fileflag.例如从 Kubernetes v1.33 开始DenyServiceExternalIP 和 EventRateLimit Admission 控制插件默认被禁用因此需要通过--admission-control-config-file标志来启用。In an RKE2 cluster, you can review the set of API admission control plugins that are enabled by default, by executing the commandkube-apiserver -h | grep enable-admission-pluginswithin a kube-apiserver pod, as below:在 RKE2 集群中您可以通过在 kube-apiserver 模块内执行命令kube-apiserver -h | grep enable-admission-plugins查看默认启用的 API 准入控制插件集合 如下所示Identify running kube-apiserver pods:识别正在运行的 kube-apiserver podsspan stylecolor:#000000span stylebackground-color:#ffffffspan stylebackground-color:#efefefcode$ kubectl get pods -n kube-system -oname| grep -i kube-apiserver pod/kube-apiserver-controlplane-0/code/span/span/spanRunkube-apiserver -h | grep enable-admission-pluginin a kube-apiserver Pod:运行kube-apiserver -h | grep enable-admission-plugin在 kube-apiserver Pod 中span stylecolor:#000000span stylebackground-color:#ffffffspan stylebackground-color:#efefefcode$ kubectl -n kube-system exec -it kube-apiserver-controlplane-0 -- sh -c kube-apiserver -h | grep enable-admission-plugins --admission-control strings Admission is divided into two phases. In the first phase, only mutating admission plugins run. In the second phase, only validating admission plugins run. The names in the below list may represent a validating plugin, a mutating plugin, or both. The order of plugins in which they are passed to this flag does not matter. Comma-delimited list of: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, ClusterTrustBundleAttest, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionPolicy, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PodNodeSelector, PodSecurity, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook. (DEPRECATED: Use --enable-admission-plugins or --disable-admission-plugins instead. Will be removed in a future version.) --enable-admission-plugins strings admission plugins that should be enabled in addition to default enabled ones (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, PodSecurity, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, ClusterTrustBundleAttest, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionPolicy, MutatingAdmissionWebhook, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, ClusterTrustBundleAttest, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionPolicy, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PodNodeSelector, PodSecurity, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook. The order of plugins in this flag does not matter./code/span/span/spanEnvironment 环境A standalone or Rancher-provisioned RKE2 or K3s cluster一个独立或牧场配置的 RKE2 或 K3s 集群访问Rancher-K8S解决方案博主企业合作伙伴 https://blog.csdn.net/lidw2009