// scenario 2: use default off plugins and with RecommendedPluginOrder
		{
			expectedPluginNames:       []string{"pluginA", "pluginB", "pluginC", "pluginD"},
			setRecommendedPluginOrder: []string{"pluginA", "pluginB", "pluginC", "pluginD"},
			setDefaultOffPlugins:      sets.Set[string]{},
		},

		// scenario 3: use default off plugins and specified by enable-admission-plugins with RecommendedPluginOrder
		{

	}

	// Verify RecommendedPluginOrder.
	recommendPlugins := sets.NewString(a.RecommendedPluginOrder...)
	intersections := registeredPlugins.Intersection(recommendPlugins)
	if !intersections.Equal(recommendPlugins) {
		// Developer error, this should never run in.
		errs = append(errs, fmt.Errorf("plugins %v in RecommendedPluginOrder are not registered",

	// register all admission plugins
	RegisterAllAdmissionPlugins(options.Plugins)
	// set RecommendedPluginOrder
	options.RecommendedPluginOrder = AllOrderedPlugins
	// set DefaultOffPlugins
	options.DefaultOffPlugins = DefaultOffAdmissionPlugins()

	return &AdmissionOptions{
		GenericAdmission: options,
	}
}

// AddFlags adds flags related to admission for kube-apiserver to the specified FlagSet

			MaxRequestBodyBytes:         int64(3 * 1024 * 1024),
		},
		Admission: &kubeoptions.AdmissionOptions{
			GenericAdmission: &apiserveroptions.AdmissionOptions{
				RecommendedPluginOrder: s.Admission.GenericAdmission.RecommendedPluginOrder,
				DefaultOffPlugins:      s.Admission.GenericAdmission.DefaultOffPlugins,
				EnablePlugins:          []string{"AlwaysDeny"},
				ConfigFile:             "/admission-control-config",

				MaxRequestBodyBytes:         int64(3 * 1024 * 1024),
			},
			Admission: &kubeoptions.AdmissionOptions{
				GenericAdmission: &apiserveroptions.AdmissionOptions{
					RecommendedPluginOrder: s.Options.Admission.GenericAdmission.RecommendedPluginOrder,
					DefaultOffPlugins:      s.Options.Admission.GenericAdmission.DefaultOffPlugins,
					EnablePlugins:          []string{"AlwaysDeny"},