anchor.diff:          disable: false <2>
   ----
   <1> Admission plug-in name.
  -<2> indicates that a plug-in should be enabled.  It is optional and shown here only for reference.
  +<2> Indicates that a plug-in should be enabled. It is optional and shown here only for reference.
   ====
   
  -Setting `disable` to `true` will disable an admission plug-in that defaults to on.
  +Setting `*disable*` to *true* will disable an admission plug-in that defaults to on.
   
   [WARNING]
   ====
  -Admission plug-ins are commonly used to help enforce security on the API server.  Be careful when disabling them.
  +Admission plug-ins are commonly used to help enforce security on the API server.
  +Be careful when disabling them.
   ====
   
  -If you were using `admissionConfig` elements before that cannot be safely combined into a single
  -admission chain, you will get a warning in your API server logs and your API server will start with
  -two separate admission chains for legacy compatibility.  You should update your `admissionConfig` to resolve
  -the warning. 
  +[NOTE]
  +====
  +If you were previously using `*admissionConfig*` elements that cannot be safely
  +combined into a single admission chain, you will get a warning in your API
  +server logs and your API server will start with two separate admission chains
  +for legacy compatibility. Update your `*admissionConfig*` to resolve the
  +warning.
  +====
   
   [[admission-controllers-customizable-admission-plug-ins]]
  -=== Customizable Admission Plugins
  +=== Customizable Admission Plug-ins
   Cluster administrators can configure some admission control plug-ins to control
   certain behavior, such as:
   
  
positive.code: 
  [[admission-controllers-general-admission-rules]]
  === General Admission Rules
  Starting in 
  ifdef::openshift-enterprise[]
  3.3,
  endif::[]
  
negative.code: ifdef::openshift-origin[]
  1.2,
  endif::[]
  and before where we had separate admission chains. This means that the top-level
  `*admissionConfig.pluginConfig*` element can now contain the admission plug-in
  configuration, which used to be contained in
  `*kubernetesMasterConfig.admissionConfig.pluginConfig*`.
  
  The `*kubernetesMasterConfig.admissionConfig.pluginConfig*` should be moved and
  merged into `*admissionConfig.pluginConfig*`.
  
  Also, starting in
  ifdef::openshift-enterprise[]
  3.3,
  endif::[]
  ifdef::openshift-origin[]
  1.3,
  endif::[]
  all the supported admission plug-ins are ordered in the single chain for you.
  You should no longer set `*admissionConfig.pluginOrderOverride*` or the
  `*kubernetesMasterConfig.admissionConfig.pluginOrderOverride*`. Instead, you
  should enable plug-ins that are off by default by either adding their
  plug-in-specific configuration, or adding a `*DefaultAdmissionConfig*` stanza
  like this:
  
  ====
  [source,yaml]
  