Remove DenyEscalatingExec admission controller from default list

[lachie83]

We are removing this plugin by default for the following reasons:

• It only impacts access via the Kubernetes API and without other measures enabled this can be easily circumvented.
• It breaks upstream conformance tests.

If it's needed it can be enabled as part of the cluster definition.

Associated issues
kubernetes/kubernetes#64387
kubernetes/kubernetes#65271

[jessfraz]

lgtm :)

[jackfrancis]

For folks paying attention: the practical implication after this PR lands is for clusters that need DenyEscalatingExec is to explicitly state it in the cluster config (api model) from now on. E.g.:

<...>
    "kubernetesConfig": {
        "apiServerConfig": {
            "--admission-control": "<other stuff you need>,DenyEscalatingExec,<other stuff you need>"
    }
<...>

[jackfrancis]

/lgtm

[acs-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jackfrancis, lachie83

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jackfrancis]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

Merging #3423 into master will not change coverage.
The diff coverage is 100%.

@@          Coverage Diff           @@
##           master   #3423   +/-   ##
======================================
  Coverage    55.9%   55.9%           
======================================
  Files         105     105           
  Lines       15855   15855           
======================================
  Hits         8864    8864           
  Misses       6249    6249           
  Partials      742     742