From 827d53e36394c3907f3ecabc8322d19c17b37955 Mon Sep 17 00:00:00 2001
From: "Charlie R.C" <chenr.fnst@cn.fujitsu.com>
Date: Wed, 31 May 2017 06:56:27 +0800
Subject: [PATCH] add NodeRestriction to admission-controllers (#3842)

---
 docs/admin/admission-controllers.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/docs/admin/admission-controllers.md b/docs/admin/admission-controllers.md
index 34c945655c..e5f9baf1e3 100644
--- a/docs/admin/admission-controllers.md
+++ b/docs/admin/admission-controllers.md
@@ -268,6 +268,11 @@ extensions group (`--runtime-config=extensions/v1beta1/podsecuritypolicy=true`).
 See also [Pod Security Policy documentation](/docs/concepts/policy/pod-security-policy/)
 for more information.
 
+### NodeRestriction
+
+This plug-in limits the `Node` and `Pod` objects a kubelet can modify. In order to be limited by this admission plugin, kubelets must use credentials in the `system:nodes` group, with a username in the form `system:node:<nodeName>`. 
+Such kubelets will only be allowed to modify their own `Node` API object, and only modify `Pod` API objects that are bound to their node.
+
 ## Is there a recommended set of plug-ins to use?
 
 Yes.