Description of problem:
Configure limited resources on master-config file, if there isn't a corresponding quota that covers resources usage, the resource is still created. I attempted many configuration ways and still not sure the admission plug-in was inserted correctly while master service didn't throw errors.


Version-Release number of selected component (if applicable):
openshift v3.6.71
kubernetes v1.6.1+5115d708d7
etcd 3.1.0


How reproducible:
Always

Steps to Reproduce:
1. Insert into master-config.yaml and restart master service.
# cat master-config.yaml
admissionConfig:
  pluginConfig:
    ResourceQuota:
      configuration:
        apiVersion: resourcequota.admission.k8s.io/v1alpha1
        kind: Configuration
        limitedResources:
        - resource: pods
          matchContains:
          - pods
          - requests.cpu
        - resource: persistentvolumeclaims
          matchContains:
        - .storageclass.storage.k8s.io/requests.storage
<------------------------------------------------------->

# service atomic-openshift-master restart
# service atomic-openshift-master status

2. Make sure there is no quota in the namespace or default limited resources (requests.cpu, requests.storage)are not specified in the quota in this namespace.

3. Create a dynamic PVC which has requests.storage in its spec
# cat pvc-storage-class.json
{
  "kind": "PersistentVolumeClaim",
  "apiVersion": "v1",
  "metadata": {
    "name": "pvc-storage-class",
    "labels": {
         "name": "pvc-storage-class"
     },
    "annotations": {
        "volume.beta.kubernetes.io/storage-class": "gold"
    }
  },
  "spec": {
    "accessModes": [
      "ReadWriteOnce"
    ],
    "resources": {
      "requests": {
        "storage": "2Gi"
      }
    }
  }
}

# oc create -f pvc-storage-class.json

4. Change annotations as "volume.beta.kubernetes.io/storage-class": "bronze" and create the pvc


Actual results:
3. The default limited resource is created. 
# oc create -f  pvc-storage-class.json -n qwang1
persistentvolumeclaim "pvc-storage-class" created

4. # oc create -f pvc-storage-class-bronze.json -n qwang1
persistentvolumeclaim "pvc-storage-class-bronze" created

Expected results:
3. The pvc creation request should be rejected as follows.  
# /data/src/kubernetes/_output/local/bin/linux/amd64/kubectl create -f pvc-storage-class.json -n default
Error from server: error when creating "pvc-storage-class.json": insufficient quota to consume: gold.storageclass.storage.k8s.io/requests.storage

4. # /data/src/kubernetes/_output/local/bin/linux/amd64/kubectl create -f pvc-storage-class-bronze.json -n default
Error from server: error when creating "1.json": insufficient quota to consume: bronze.storageclass.storage.k8s.io/requests.storage



Additional info: