Description of problem:

We need to have admin-ack in 4.15 so that admins can check the deprecated APIs and approve when they move to 4.16. As planned we want to add the admin-ack shortly after 4.16 forks off, which just happened last week.

Version-Release number of selected component (if applicable)

The guard should land in 4.15 because it's the 4.15 CVO warning about possible compat issues resulting from updates into 4.16.

How reproducible

Every time.

Steps to Reproduce:

1. Install a cluster in 4.15.
2. Run an application which uses the deprecated API. See kcs#7031404 for more information.
3. Upgrade to 4.16.

Actual results

The upgrade happens without asking the admin to confirm that the workloads do not use the deprecated APIs.

Expected results

Upgrade should wait for the admin-ack.

Additional info