diff --git a/docs/admin/admission-controllers.md b/docs/admin/admission-controllers.md index e5f9baf1e3..02c6cc399f 100644 --- a/docs/admin/admission-controllers.md +++ b/docs/admin/admission-controllers.md @@ -270,8 +270,10 @@ for more information. ### NodeRestriction -This plug-in limits the `Node` and `Pod` objects a kubelet can modify. In order to be limited by this admission plugin, kubelets must use credentials in the `system:nodes` group, with a username in the form `system:node:`. -Such kubelets will only be allowed to modify their own `Node` API object, and only modify `Pod` API objects that are bound to their node. +This plug-in limits the `Node` and `Pod` objects a kubelet can modify. In order to be limited by this admission plugin, +kubelets must use credentials in the `system:nodes` group, with a username in the form `system:node:`. Such +kubelets will only be allowed to modify their own `Node` API object, only modify `Pod` API objects that are bound to +their node and only create mirror pods for their own [static pods](/docs/tasks/administer-cluster/static-pod/). ## Is there a recommended set of plug-ins to use?