k8s/dcos packaging should offer configurable admission control

[jdef]

for example, to support resource-quotas per namespace: http://kubernetes.io/v1.0/docs/admin/resource-quota.html

[jdef]

ResourceQuota has already landed in the admission control config for k8s/dcos

it would be nice to give users control over which admission control policies are loaded at runtime. perhaps we could create a sub-category for configuring admission, e.g:

• kubernetes.admission.resourceQuota
• kubernetes.admission.limitRanger
• kubernetes.admission.securityContextDeny
• ...

these would be boolean flags, and we'd provide sensible defaults. the bootstrap script would evaluate these options and compose an admission-control flag value accordingly.