Admission Controller Validation

Since v1.10.0 the --admission-control is being deprecated in favour or --enable-admission-plugin, we should enforce the behaviour in the validation code

I did a fix for this a [moment ago](kubernetes#5248), but yes, enforcement is a better option than trying to support both

pkg/apis/kops/validation/legacy.go

@@ -382,6 +382,17 @@ func ValidateCluster(c *kops.Cluster, strict bool) *field.Error {
 		}
 	}
 
+	// KubeAPIServer
+	if c.Spec.KubeAPIServer != nil {
+		if kubernetesRelease.GTE(semver.MustParse("1.10.0")) {
+			if len(c.Spec.KubeAPIServer.AdmissionControl) > 0 {
+				return field.Invalid(fieldSpec.Child("KubeAPIServer").Child("AdmissionControl"),
+					strings.Join(c.Spec.KubeAPIServer.AdmissionControl, ","),
+					"AdmissionControl is being deprecated from 1.10.0, please use EnableAdmissionPlugins instead")
+			}
+		}
+	}
+
 	// Kubelet
 	if c.Spec.Kubelet != nil {
 		kubeletPath := fieldSpec.Child("Kubelet")