diff --git a/metropolis/node/kubernetes/apiserver.go b/metropolis/node/kubernetes/apiserver.go
index 45b2582..e4df4a9 100644
--- a/metropolis/node/kubernetes/apiserver.go
+++ b/metropolis/node/kubernetes/apiserver.go
@@ -185,6 +185,7 @@
 		args.FileOpt("--tls-private-key-file", "server-key.pem",
 			pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: s.serverKey})),
 		args.FileOpt("--admission-control-config-file", "admission-control.json", admissionConfigRaw),
+		"--allow-privileged=true",
 	)
 	if args.Error() != nil {
 		return err