code: func DefaultOffAdmissionPlugins() sets.String {
  	defaultOnPlugins := sets.NewString(
  		lifecycle.PluginName,                    //NamespaceLifecycle
  		limitranger.PluginName,                  //LimitRanger
  		serviceaccount.PluginName,               //ServiceAccount
  		setdefault.PluginName,                   //DefaultStorageClass
  		resize.PluginName,                       //PersistentVolumeClaimResize
  		defaulttolerationseconds.PluginName,     //DefaultTolerationSeconds
  		mutatingwebhook.PluginName,              //MutatingAdmissionWebhook
  		validatingwebhook.PluginName,            //ValidatingAdmissionWebhook
  		resourcequota.PluginName,                //ResourceQuota
  		storageobjectinuseprotection.PluginName, //StorageObjectInUseProtection
  	)
  
  	if utilfeature.DefaultFeatureGate.Enabled(features.PodPriority) {
  		defaultOnPlugins.Insert(podpriority.PluginName) //PodPriority
  	}
  
  	if utilfeature.DefaultFeatureGate.Enabled(features.TaintNodesByCondition) {
  		defaultOnPlugins.Insert(nodetaint.PluginName) //TaintNodesByCondition
  	}
  
  	return sets.NewString(AllOrderedPlugins...).Difference(defaultOnPlugins)
  }
docs: // DefaultOffAdmissionPlugins get admission plugins off by default for kube-apiserver.