anchor.diff:  
   [[admission-controllers-general-admission-rules]]
   === General Admission Rules
  -Starting in 
  +Starting in
   ifdef::openshift-enterprise[]
   3.3,
   endif::[]
  
positive.code: ifdef::openshift-origin[]
  1.2,
  endif::[]
  and before where we had separate admission chains.
  This means that the top-level `admissionConfig.pluginConfig` element can now contain
  admission plug-in configuration which used to be contained in `kubernetesMasterConfig.admissionConfig.pluginConfig`.
  
  The `kubernetesMasterConfig.admissionConfig.pluginConfig` should be moved and merged into
  `admissionConfig.pluginConfig`.  
  
  Also starting in
  ifdef::openshift-enterprise[]
  3.3,
  endif::[]
  ifdef::openshift-origin[]
  1.3,
  endif::[]
  , all the supported admission plug-ins are ordered in the single chain
  for you.  You should no longer set `admissionConfig.pluginOrderOverride` or 
  The `kubernetesMasterConfig.admissionConfig.pluginOrderOverride`.  Instead, you should enable
  plug-ins which are off by default by either adding their plug-in specific config or adding
  a `DefaultAdmissionConfig` stanza like this:
  
  ====
  [source,yaml]
  
negative.code:         disable: false <2>
  ----
  <1> Admission plug-in name.
  <2> Indicates that a plug-in should be enabled. It is optional and shown here only for reference.
  ====
  
  Setting `*disable*` to *true* will disable an admission plug-in that defaults to on.
  
  [WARNING]
  ====
  Admission plug-ins are commonly used to help enforce security on the API server.
  Be careful when disabling them.
  ====
  
  [NOTE]
  ====
  If you were previously using `*admissionConfig*` elements that cannot be safely
  combined into a single admission chain, you will get a warning in your API
  server logs and your API server will start with two separate admission chains
  for legacy compatibility. Update your `*admissionConfig*` to resolve the
  warning.
  ====
  
  [[admission-controllers-customizable-admission-plug-ins]]
  === Customizable Admission Plug-ins
  Cluster administrators can configure some admission control plug-ins to control
  certain behavior, such as:
  
  