easyMultiple Choice
CKS Practice Question: Which flag enables the NodeRestriction admission…
Which flag enables the NodeRestriction admission plugin on the API server?
⚠ Common exam trap
Many exam-takers confuse the deprecated `--admission-control` flag with the current `--enable-admission-plugins` flag, or they invent non-existent flags like `--kubelet-restriction` or `--node-restriction` that sound plausible but are not valid API server options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
--enable-admission-plugins=NodeRestriction
The `--enable-admission-plugins` flag is the correct parameter to activate admission controllers in the kube-apiserver. The NodeRestriction plugin limits the Node and Pod objects a kubelet can modify, enforcing the principle of least privilege. Option A correctly uses this flag with the plugin name.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
--enable-admission-plugins=NodeRestriction
Why this is correct
NodeRestriction is an admission plugin that ensures the kubelet can only modify its own Node object and its own Pods (and only those bound to it). On a modern kube-apiserver, the `--enable-admission-plugins` flag takes a comma-separated list of plugin names to turn on, so `--enable-admission-plugins=NodeRestriction` is the exact syntax. This flag is appended to the API server's startup parameters, either in a static pod manifest or systemd unit. Without this flag, NodeRestriction is not active by default, which is why it must be explicitly enabled.
- ✗
--admission-control=NodeRestriction
Why it's wrong here
The `--admission-control` flag is a legacy method from older Kubernetes versions; the CKS exam expects the current `--enable-admission-plugins` flag to activate NodeRestriction. This option tempts because `--admission-control` historically accepted plugin names like `NodeRestriction`, and in a deprecated cluster it would work, but the question specifically tests the modern API server startup flag.
- ✗
--kubelet-restriction=NodeRestriction
Why it's wrong here
`--kubelet-restriction` is not a recognized flag on either kube-apiserver or kubelet. The NodeRestriction admission plugin lives on the API server, not on the kubelet, so it must be registered through the API server's admission control flags. If such a flag existed, it would not take a plugin name in the form `NodeRestriction` because admission plugins are not boolean toggles. This option plausibly sounds like a kubelet-specific setting, but the admission plugin mechanism is exclusively configured on the API server.
- ✗
--node-restriction=true
Why it's wrong here
`--node-restriction=true` is not a valid flag; there is no boolean-style switch to enable NodeRestriction. NodeRestriction is implemented as an admission plugin, and admission plugins are enabled by listing them in `--enable-admission-plugins`, not by setting a feature flag. Passing an unknown flag like this actually causes the API server to fail to start, because kube-apiserver validates all command-line flags. Thus, even if the intent is correct, this syntax will not work.
Go deeper
Related to this question
Learn chapter
Cluster Hardening: Node and Container Security
Key term
Admission Controllers
Admission controllers are plugins that intercept and process requests to the Kubernetes API server after authentication and authorization, but before the request is persisted, allowing policies to be enforced on objects being created, modified, or deleted.
About these practice questions
Courseiva writes every CKS question from scratch — 845 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.