anchor.diff:  ifdef::openshift-origin[]
   1.2,
   endif::[]
  -and before where we had separate admission chains.
  -This means that the top-level `admissionConfig.pluginConfig` element can now contain
  -admission plug-in configuration which used to be contained in `kubernetesMasterConfig.admissionConfig.pluginConfig`.
  +and before where we had separate admission chains. This means that the top-level
  +`*admissionConfig.pluginConfig*` element can now contain the admission plug-in
  +configuration, which used to be contained in
  +`*kubernetesMasterConfig.admissionConfig.pluginConfig*`.
   
  -The `kubernetesMasterConfig.admissionConfig.pluginConfig` should be moved and merged into
  -`admissionConfig.pluginConfig`.  
  +The `*kubernetesMasterConfig.admissionConfig.pluginConfig*` should be moved and
  +merged into `*admissionConfig.pluginConfig*`.
   
  -Also starting in
  +Also, starting in
   ifdef::openshift-enterprise[]
   3.3,
   endif::[]
   ifdef::openshift-origin[]
   1.3,
   endif::[]
  -, all the supported admission plug-ins are ordered in the single chain
  -for you.  You should no longer set `admissionConfig.pluginOrderOverride` or 
  -The `kubernetesMasterConfig.admissionConfig.pluginOrderOverride`.  Instead, you should enable
  -plug-ins which are off by default by either adding their plug-in specific config or adding
  -a `DefaultAdmissionConfig` stanza like this:
  +all the supported admission plug-ins are ordered in the single chain for you.
  +You should no longer set `*admissionConfig.pluginOrderOverride*` or the
  +`*kubernetesMasterConfig.admissionConfig.pluginOrderOverride*`. Instead, you
  +should enable plug-ins that are off by default by either adding their
  +plug-in-specific configuration, or adding a `*DefaultAdmissionConfig*` stanza
  +like this:
   
   ====
   [source,yaml]
  
positive.code:         disable: false <2>
  ----
  <1> Admission plug-in name.
  <2> indicates that a plug-in should be enabled.  It is optional and shown here only for reference.
  ====
  
  Setting `disable` to `true` will disable an admission plug-in that defaults to on.
  
  [WARNING]
  ====
  Admission plug-ins are commonly used to help enforce security on the API server.  Be careful when disabling them.
  ====
  
  If you were using `admissionConfig` elements before that cannot be safely combined into a single
  admission chain, you will get a warning in your API server logs and your API server will start with
  two separate admission chains for legacy compatibility.  You should update your `admissionConfig` to resolve
  the warning. 
  
  [[admission-controllers-customizable-admission-plug-ins]]
  === Customizable Admission Plugins
  Cluster administrators can configure some admission control plug-ins to control
  certain behavior, such as:
  
  
negative.code: 
  [[admission-controllers-general-admission-rules]]
  === General Admission Rules
  Starting in
  ifdef::openshift-enterprise[]
  3.3,
  endif::[]
  