Merge pull request #58517 from deads2k/admission-20-flags

Automatic merge from submit-queue (batch tested with PRs 58517, 57642). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 make kube-apiserver admission flag disable other plugins 98eb592

The old kube-apiserver flag for enabling admission plugins implicitly disabled ones that were unmentioned.  This restores that behavior.

followup to https://github.com/kubernetes/kubernetes/pull/58123

@hzxuzhonghu You're pretty deep into this now.  ptal

/assign hzxuzhonghu
/assign sttts

pkg/kubeapiserver/options/admission.go

@@ -116,8 +116,13 @@ func (a *AdmissionOptions) ApplyTo(
 
 	if a.PluginNames != nil {
 		// pass PluginNames to generic AdmissionOptions
-		a.GenericAdmission.EnablePlugins = a.PluginNames
+		a.GenericAdmission.EnablePlugins, a.GenericAdmission.DisablePlugins = computePluginNames(a.PluginNames, a.GenericAdmission.RecommendedPluginOrder)
 	}
 
 	return a.GenericAdmission.ApplyTo(c, informers, kubeAPIServerClientConfig, scheme, pluginInitializers...)
 }
+
+// explicitly disable all plugins that are not in the enabled list
+func computePluginNames(explicitlyEnabled []string, all []string) (enabled []string, disabled []string) {
+	return explicitlyEnabled, sets.NewString(all...).Difference(sets.NewString(explicitlyEnabled...)).List()
+}

pkg/kubeapiserver/options/admission_test.go

@@ -17,6 +17,7 @@ limitations under the License.
 package options
 
 import (
+	"reflect"
 	"testing"
 )
 
@@ -51,3 +52,37 @@ func TestValidate(t *testing.T) {
 		t.Errorf("Unexpected err: %v", errs)
 	}
 }
+
+func TestComputeEnabledAdmission(t *testing.T) {
+	tests := []struct {
+		name             string
+		all              []string
+		enabled          []string
+		expectedDisabled []string
+	}{
+		{
+			name:             "matches",
+			all:              []string{"one", "two"},
+			enabled:          []string{"one", "two"},
+			expectedDisabled: []string{},
+		},
+		{
+			name:             "choose one",
+			all:              []string{"one", "two"},
+			enabled:          []string{"one"},
+			expectedDisabled: []string{"two"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			actualEnabled, actualDisabled := computePluginNames(tc.enabled, tc.all)
+			if e, a := tc.enabled, actualEnabled; !reflect.DeepEqual(e, a) {
+				t.Errorf("expected %v, got %v", e, a)
+			}
+			if e, a := tc.expectedDisabled, actualDisabled; !reflect.DeepEqual(e, a) {
+				t.Errorf("expected %v, got %v", e, a)
+			}
+		})
+	}
+}