diff --git a/cmd/kubeadm/app/phases/controlplane/manifests.go b/cmd/kubeadm/app/phases/controlplane/manifests.go
index e914879d829..3f1fce4196e 100644
--- a/cmd/kubeadm/app/phases/controlplane/manifests.go
+++ b/cmd/kubeadm/app/phases/controlplane/manifests.go
@@ -139,14 +139,9 @@ func createStaticPodFiles(manifestDir string, cfg *kubeadmapi.MasterConfiguratio
 // getAPIServerCommand builds the right API server command from the given config object and version
 func getAPIServerCommand(cfg *kubeadmapi.MasterConfiguration) []string {
 	defaultArguments := map[string]string{
-		"advertise-address":        cfg.API.AdvertiseAddress,
-		"insecure-port":            "0",
-		"enable-admission-plugins": "NodeRestriction",
-		// TODO: remove `PersistentVolumeLabel` in kubeadm v1.11, as it's automatically disabled in v1.11.
-		// ref: https://github.com/kubernetes/kubernetes/pull/64326
-		// we can't skip it now as we support v1.10 clusters still.
-		// remove it from the unit tests too.
-		"disable-admission-plugins":       "PersistentVolumeLabel",
+		"advertise-address":               cfg.API.AdvertiseAddress,
+		"insecure-port":                   "0",
+		"enable-admission-plugins":        "NodeRestriction",
 		"service-cluster-ip-range":        cfg.Networking.ServiceSubnet,
 		"service-account-key-file":        filepath.Join(cfg.CertificatesDir, kubeadmconstants.ServiceAccountPublicKeyName),
 		"client-ca-file":                  filepath.Join(cfg.CertificatesDir, kubeadmconstants.CACertName),
diff --git a/cmd/kubeadm/app/phases/controlplane/manifests_test.go b/cmd/kubeadm/app/phases/controlplane/manifests_test.go
index 58b81636874..c7bab62fc0b 100644
--- a/cmd/kubeadm/app/phases/controlplane/manifests_test.go
+++ b/cmd/kubeadm/app/phases/controlplane/manifests_test.go
@@ -155,7 +155,6 @@ func TestGetAPIServerCommand(t *testing.T) {
 				"kube-apiserver",
 				"--insecure-port=0",
 				"--enable-admission-plugins=NodeRestriction",
-				"--disable-admission-plugins=PersistentVolumeLabel",
 				"--service-cluster-ip-range=bar",
 				"--service-account-key-file=" + testCertsDir + "/sa.pub",
 				"--client-ca-file=" + testCertsDir + "/ca.crt",
@@ -198,7 +197,6 @@ func TestGetAPIServerCommand(t *testing.T) {
 				"kube-apiserver",
 				"--insecure-port=0",
 				"--enable-admission-plugins=NodeRestriction",
-				"--disable-admission-plugins=PersistentVolumeLabel",
 				"--service-cluster-ip-range=bar",
 				"--service-account-key-file=" + testCertsDir + "/sa.pub",
 				"--client-ca-file=" + testCertsDir + "/ca.crt",
@@ -236,7 +234,6 @@ func TestGetAPIServerCommand(t *testing.T) {
 				"kube-apiserver",
 				"--insecure-port=0",
 				"--enable-admission-plugins=NodeRestriction",
-				"--disable-admission-plugins=PersistentVolumeLabel",
 				"--service-cluster-ip-range=bar",
 				"--service-account-key-file=" + testCertsDir + "/sa.pub",
 				"--client-ca-file=" + testCertsDir + "/ca.crt",
@@ -283,7 +280,6 @@ func TestGetAPIServerCommand(t *testing.T) {
 				"kube-apiserver",
 				"--insecure-port=0",
 				"--enable-admission-plugins=NodeRestriction",
-				"--disable-admission-plugins=PersistentVolumeLabel",
 				"--service-cluster-ip-range=bar",
 				"--service-account-key-file=" + testCertsDir + "/sa.pub",
 				"--client-ca-file=" + testCertsDir + "/ca.crt",
@@ -327,7 +323,6 @@ func TestGetAPIServerCommand(t *testing.T) {
 				"kube-apiserver",
 				"--insecure-port=0",
 				"--enable-admission-plugins=NodeRestriction",
-				"--disable-admission-plugins=PersistentVolumeLabel",
 				"--service-cluster-ip-range=bar",
 				"--service-account-key-file=" + testCertsDir + "/sa.pub",
 				"--client-ca-file=" + testCertsDir + "/ca.crt",
@@ -366,7 +361,6 @@ func TestGetAPIServerCommand(t *testing.T) {
 				"kube-apiserver",
 				"--insecure-port=0",
 				"--enable-admission-plugins=NodeRestriction",
-				"--disable-admission-plugins=PersistentVolumeLabel",
 				"--service-cluster-ip-range=bar",
 				"--service-account-key-file=" + testCertsDir + "/sa.pub",
 				"--client-ca-file=" + testCertsDir + "/ca.crt",
@@ -409,7 +403,6 @@ func TestGetAPIServerCommand(t *testing.T) {
 				"kube-apiserver",
 				"--insecure-port=0",
 				"--enable-admission-plugins=NodeRestriction",
-				"--disable-admission-plugins=PersistentVolumeLabel",
 				"--service-cluster-ip-range=bar",
 				"--service-account-key-file=" + testCertsDir + "/sa.pub",
 				"--client-ca-file=" + testCertsDir + "/ca.crt",
@@ -455,7 +448,6 @@ func TestGetAPIServerCommand(t *testing.T) {
 				"kube-apiserver",
 				"--insecure-port=0",
 				"--enable-admission-plugins=NodeRestriction",
-				"--disable-admission-plugins=PersistentVolumeLabel",
 				"--service-cluster-ip-range=baz",
 				"--service-account-key-file=" + testCertsDir + "/sa.pub",
 				"--client-ca-file=" + testCertsDir + "/ca.crt",
@@ -500,7 +492,6 @@ func TestGetAPIServerCommand(t *testing.T) {
 				"kube-apiserver",
 				"--insecure-port=0",
 				"--enable-admission-plugins=NodeRestriction",
-				"--disable-admission-plugins=PersistentVolumeLabel",
 				"--service-cluster-ip-range=bar",
 				"--service-account-key-file=" + testCertsDir + "/sa.pub",
 				"--client-ca-file=" + testCertsDir + "/ca.crt",
@@ -541,7 +532,6 @@ func TestGetAPIServerCommand(t *testing.T) {
 				"kube-apiserver",
 				"--insecure-port=1234",
 				"--enable-admission-plugins=NodeRestriction",
-				"--disable-admission-plugins=PersistentVolumeLabel",
 				"--service-cluster-ip-range=bar",
 				"--service-account-key-file=" + testCertsDir + "/sa.pub",
 				"--client-ca-file=" + testCertsDir + "/ca.crt",
@@ -582,7 +572,6 @@ func TestGetAPIServerCommand(t *testing.T) {
 				"kube-apiserver",
 				"--insecure-port=0",
 				"--enable-admission-plugins=NodeRestriction",
-				"--disable-admission-plugins=PersistentVolumeLabel",
 				"--service-cluster-ip-range=bar",
 				"--service-account-key-file=" + testCertsDir + "/sa.pub",
 				"--client-ca-file=" + testCertsDir + "/ca.crt",