我自己找到了这个问题的答案，vendor/k8s.io/apiserver/pkg/server/options/admission.go中AdmissionOptions的“enablePluginNames”函数就是答案。

// enabledPluginNames makes use of RecommendedPluginOrder, DefaultOffPlugins,
// EnablePlugins, DisablePlugins fields
// to prepare a list of ordered plugin names that are enabled.
func (a *AdmissionOptions) enabledPluginNames() []string {
    allOffPlugins := append(a.DefaultOffPlugins.List(), a.DisablePlugins...)
    disabledPlugins := sets.NewString(allOffPlugins...)
    enabledPlugins := sets.NewString(a.EnablePlugins...)
    disabledPlugins = disabledPlugins.Difference(enabledPlugins)

    orderedPlugins := []string{}
    for _, plugin := range a.RecommendedPluginOrder {
        if !disabledPlugins.Has(plugin) {
            orderedPlugins = append(orderedPlugins, plugin)
        }
    }

    return orderedPlugins
}

字符串
RecommendedPluginOrder中的插件只要没有被禁用，就会默认启用。
RecommendedPlugionOrder在pkg/kubeapiserver/options/admission. go中的NewAdmissionOptions方法中初始化。

// NewAdmissionOptions creates a new instance of AdmissionOptions
// Note:
//
//  In addition it calls RegisterAllAdmissionPlugins to register
//  all kube-apiserver admission plugins.
//
//  Provides the list of RecommendedPluginOrder that holds sane values
//  that can be used by servers that don't care about admission chain.
//  Servers that do care can overwrite/append that field after creation.
func NewAdmissionOptions() *AdmissionOptions {
    options := genericoptions.NewAdmissionOptions()
    // register all admission plugins
    RegisterAllAdmissionPlugins(options.Plugins)
    // set RecommendedPluginOrder
    options.RecommendedPluginOrder = AllOrderedPlugins
    // set DefaultOffPlugins
    options.DefaultOffPlugins = DefaultOffAdmissionPlugins()

    return &AdmissionOptions{
        GenericAdmission: options,
    }
}

型
AllOrderedPlugins是这样声明的：

// AllOrderedPlugins is the list of all the plugins in order.
var AllOrderedPlugins = []string{
    admit.PluginName,                        // AlwaysAdmit
    autoprovision.PluginName,                // NamespaceAutoProvision
    lifecycle.PluginName,                    // NamespaceLifecycle
    exists.PluginName,                       // NamespaceExists
    scdeny.PluginName,                       // SecurityContextDeny
    antiaffinity.PluginName,                 // LimitPodHardAntiAffinityTopology
    limitranger.PluginName,                  // LimitRanger
    serviceaccount.PluginName,               // ServiceAccount
    noderestriction.PluginName,              // NodeRestriction
    nodetaint.PluginName,                    // TaintNodesByCondition
    alwayspullimages.PluginName,             // AlwaysPullImages
    imagepolicy.PluginName,                  // ImagePolicyWebhook
    podsecurity.PluginName,                  // PodSecurity
    podnodeselector.PluginName,              // PodNodeSelector
    podpriority.PluginName,                  // Priority
    defaulttolerationseconds.PluginName,     // DefaultTolerationSeconds
    podtolerationrestriction.PluginName,     // PodTolerationRestriction
    eventratelimit.PluginName,               // EventRateLimit
    extendedresourcetoleration.PluginName,   // ExtendedResourceToleration
    label.PluginName,                        // PersistentVolumeLabel
    setdefault.PluginName,                   // DefaultStorageClass
    storageobjectinuseprotection.PluginName, // StorageObjectInUseProtection
    gc.PluginName,                           // OwnerReferencesPermissionEnforcement
    resize.PluginName,                       // PersistentVolumeClaimResize
    runtimeclass.PluginName,                 // RuntimeClass
    certapproval.PluginName,                 // CertificateApproval
    certsigning.PluginName,                  // CertificateSigning
    ctbattest.PluginName,                    // ClusterTrustBundleAttest
    certsubjectrestriction.PluginName,       // CertificateSubjectRestriction
    defaultingressclass.PluginName,          // DefaultIngressClass
    denyserviceexternalips.PluginName,       // DenyServiceExternalIPs

    // new admission plugins should generally be inserted above here
    // webhook, resourcequota, and deny plugins must go at the end

    mutatingwebhook.PluginName,           // MutatingAdmissionWebhook
    validatingadmissionpolicy.PluginName, // ValidatingAdmissionPolicy
    validatingwebhook.PluginName,         // ValidatingAdmissionWebhook
    resourcequota.PluginName,             // ResourceQuota
    deny.PluginName,                      // AlwaysDeny
}

型
因此，默认情况下将启用ResourcesPlugin，事件不会在--enable-admission-plugins参数中声明。