Finding enabled admission plugins on the Kubernetes API server

Edward Cooke

15 Sep 2026 • 3 min read

I needed to verify the enabled admission plugins on the Kubernetes api server.

While working on Ansible-Kubernetes which is an installer for a kubeadm based cluster that hardens it based on the CIS benchmark and DoD Stigs, I needed to verify the enabled plugins.

Originally, we included all enabled plugins in the enable-admission-plugins command line argument. This was a pain to maintain through all of the different versions of Kubernetes. I wanted to find out if I needed to. Long story short, I didn't. None of the documentation I could find showed how to figure out what was actually enabled, even if you disabled one, or maybe the distribution you are using disabled it automatically, whatever. There was nothing other than people saying the docs show the default enabled plugins. I needed the final set of what was enabled or not.

It is not that difficult. Once I started digging, I found it in the logs of the Kubernetes API server. This won't work on cloud hosted instances where they hide the API server from you. But, in a kubeadm cluster and likely other self-hosted instances like kind, just check the logs of the API server. If it is a kubeadm or kind cluster, you will find them in the kube-system namespace. I don't know about any other CKEs.

What you are looking for is logged from the plugins.go module. So, if you pipe the logs through less or grep or some other paging and searching tool and search for plugins.go from the beginning of the logs when the kube-apiserver starts then you will see them. It is the only 2 log entries from plugins.go that I found at default log levels.

Example of what you are looking for:

I0915 22:10:20.602375       1 plugins.go:157] Loaded 16 mutating admission controller(s) successfully in the following order: NamespaceLifecycle,LimitRanger,ServiceAccount,NodeRestriction,TaintNodesByCondition,AlwaysPullImages,Priority,DefaultTolerationSeconds,DefaultStorageClass,StorageObjectInUseProtection,PodGroupProtection,RuntimeClass,DefaultIngressClass,PodTopologyLabels,MutatingAdmissionPolicy,MutatingAdmissionWebhook.
I0915 22:10:20.602385       1 plugins.go:160] Loaded 16 validating admission controller(s) successfully in the following order: LimitRanger,ServiceAccount,AlwaysPullImages,PodSecurity,Priority,PersistentVolumeClaimResize,RuntimeClass,CertificateApproval,CertificateSigning,ClusterTrustBundleAttest,CertificateSubjectRestriction,NodeDeclaredFeatureValidator,PodResizeValidator,ValidatingAdmissionPolicy,ValidatingAdmissionWebhook,ResourceQuota.

Unfortunately, it breaks them up by type, mutating and validating some are duplicated since they are both, but you do get the final enabled admission plugin list.

Conclusion

I finish this post with; it would be nice if there was an API call that you can make to get the final list. Or at least if the logs de-duped them. But, until those exist, this will work for me and hopefully others.

Below are some links to relevant sources.