Package alwayspullimages contains an admission controller that modifies every new Pod to force the image pull policy to Always.

LimitPodHardAntiAffinityTopology admission controller rejects any pod that specifies "hard" (RequiredDuringScheduling) anti-affinity with a TopologyKey other than unversioned.LabelHostname.

resourcequota enforces all incoming requests against any applied quota in the namespace context of the request.

security contains admission plugins specific to cluster security.

serviceaccount enforces all pods having an associated serviceaccount, and all containers mounting the API token for that serviceaccount at a known location.