[cern] K8S: Allows to specify admission control plugins to enable

Fixes #OS-3736.

Cherry-pick: https://review.openstack.org/#/c/405374/

If nothing is specified a set of recommended default plugins is used, which includes the ServiceAccount one.

Change-Id: I1383aae09ba68f8e83b07e3eaae40ab071f7be94 Closes-Bug: #1646489

Conflicts: doc/source/userguide.rst magnum/drivers/common/k8s_template_def.py magnum/drivers/common/templates/kubernetes/fragments/configure-kubernetes-master.sh magnum/drivers/k8s_coreos_v1/templates/kubecluster.yaml magnum/drivers/k8s_fedora_atomic_v1/templates/kubecluster.yaml magnum/drivers/k8s_fedora_atomic_v1/templates/kubemaster.yaml magnum/drivers/k8s_fedora_ironic_v1/templates/kubecluster.yaml magnum/drivers/k8s_fedora_ironic_v1/templates/kubemaster.yaml magnum/tests/functional/k8s/test_k8s_python_client.py magnum/tests/unit/conductor/handlers/test_k8s_cluster_conductor.py magnum/tests/unit/drivers/test_template_definition.py

Closes #3736

doc/source/userguide.rst

@@ -298,6 +298,8 @@ the table are linked to more details elsewhere in the user guide.
 +---------------------------------------+--------------------+---------------+
 | `mesos_slave_executor_env_variables`_ | (file name)        | ""            |
 +---------------------------------------+--------------------+---------------+
+| `admission_control_list`_             | see below          | see below     |
++---------------------------------------+--------------------+---------------+
 
 
 =======
@@ -900,6 +902,17 @@ Log into the servers
   You can log into the master servers using the login 'fedora' and the
   keypair specified in the ClusterTemplate.
 
+In addition to the common attributes in the ClusterTemplate, you can specify
+the following attributes that are specific to Kubernetes by using the
+labels attribute.
+
+_`admission_control_list`
+  This label corresponds to Kubernetes parameter for the API server '--admission-control'.
+  For more details, refer to the `Admission Controllers
+  <https://kubernetes.io/docs/admin/admission-controllers//>`_.
+  The default value corresponds to the one recommended in this doc
+  for our current Kubernetes version.
+
 External load balancer for services
 -----------------------------------