@@ -181,6 +181,10 @@ func ValidateMasterConfig(config *api.MasterConfig, fldPath *field.Path) Validat

 	if config.AdmissionConfig.PluginConfig != nil {

 		validationResults.AddErrors(ValidateAdmissionPluginConfig(config.AdmissionConfig.PluginConfig, fldPath.Child("admissionConfig", "pluginConfig"))...)

+		validationResults.Append(ValidateAdmissionPluginConfigConflicts(config))

+	}

+	if len(config.AdmissionConfig.PluginOrderOverride) != 0 {

+		validationResults.AddWarnings(field.Invalid(fldPath.Child("admissionConfig", "pluginOrderOverride"), config.AdmissionConfig.PluginOrderOverride, "specified admission ordering is being phased out.  Convert to DefaultAdmissionConfig in admissionConfig.pluginConfig."))

 	}

 	validationResults.Append(ValidateControllerConfig(config.ControllerConfig, fldPath.Child("controllerConfig")))

@@ -505,8 +509,11 @@ func ValidateKubernetesMasterConfig(config *api.KubernetesMasterConfig, fldPath

 	if config.AdmissionConfig.PluginConfig != nil {

 		validationResults.AddErrors(ValidateAdmissionPluginConfig(config.AdmissionConfig.PluginConfig, fldPath.Child("admissionConfig", "pluginConfig"))...)

 	}

+	if len(config.AdmissionConfig.PluginOrderOverride) != 0 {

+		validationResults.AddWarnings(field.Invalid(fldPath.Child("admissionConfig", "pluginOrderOverride"), config.AdmissionConfig.PluginOrderOverride, "specified admission ordering is being phased out.  Convert to DefaultAdmissionConfig in admissionConfig.pluginConfig."))

+	}

-	validationResults.AddErrors(ValidateAPIServerExtendedArguments(config.APIServerArguments, fldPath.Child("apiServerArguments"))...)

+	validationResults.Append(ValidateAPIServerExtendedArguments(config.APIServerArguments, fldPath.Child("apiServerArguments")))

 	validationResults.AddErrors(ValidateControllerExtendedArguments(config.ControllerArguments, fldPath.Child("controllerArguments"))...)

 	return validationResults

@@ -581,8 +588,19 @@ func ValidateRoutingConfig(config api.RoutingConfig, fldPath *field.Path) field.

 	return allErrs

 }

-func ValidateAPIServerExtendedArguments(config api.ExtendedArguments, fldPath *field.Path) field.ErrorList {

-	return ValidateExtendedArguments(config, apiserveroptions.NewAPIServer().AddFlags, fldPath)

+func ValidateAPIServerExtendedArguments(config api.ExtendedArguments, fldPath *field.Path) ValidationResults {

+	validationResults := ValidationResults{}

+

+	validationResults.AddErrors(ValidateExtendedArguments(config, apiserveroptions.NewAPIServer().AddFlags, fldPath)...)

+

+	if len(config["admission-control"]) > 0 {

+		validationResults.AddWarnings(field.Invalid(fldPath.Key("admission-control"), config["admission-control"], "specified admission ordering is being phased out.  Convert to DefaultAdmissionConfig in admissionConfig.pluginConfig."))

+	}

+	if len(config["admission-control-config-file"]) > 0 {

+		validationResults.AddWarnings(field.Invalid(fldPath.Key("admission-control-config-file"), config["admission-control-config-file"], "specify a single admission control config file is being phased out.  Convert to admissionConfig.pluginConfig, one file per plugin."))

+	}

+

+	return validationResults

 }

 func ValidateControllerExtendedArguments(config api.ExtendedArguments, fldPath *field.Path) field.ErrorList {

@@ -602,3 +620,18 @@ func ValidateAdmissionPluginConfig(pluginConfig map[string]api.AdmissionPluginCo

 	return allErrs

 }

+

+func ValidateAdmissionPluginConfigConflicts(masterConfig *api.MasterConfig) ValidationResults {

+	validationResults := ValidationResults{}

+

+	if masterConfig.KubernetesMasterConfig != nil {

+		// check for collisions between openshift and kube plugin config

+		for pluginName, kubeConfig := range masterConfig.KubernetesMasterConfig.AdmissionConfig.PluginConfig {

+			if openshiftConfig, exists := masterConfig.AdmissionConfig.PluginConfig[pluginName]; exists && !reflect.DeepEqual(kubeConfig, openshiftConfig) {

+				validationResults.AddWarnings(field.Invalid(field.NewPath("kubernetesMasterConfig", "admissionConfig", "pluginConfig").Key(pluginName), masterConfig.AdmissionConfig.PluginConfig[pluginName], "conflicts with kubernetesMasterConfig.admissionConfig.pluginConfig.  Separate admission chains are being phased out.  Convert to admissionConfig.pluginConfig."))

+			}

+		}

+	}

+

+	return validationResults

+}

@@ -5,6 +5,7 @@ import (

 	kapi "k8s.io/kubernetes/pkg/api"

 	"k8s.io/kubernetes/pkg/util/diff"

+	"k8s.io/kubernetes/pkg/util/sets"

 	"k8s.io/kubernetes/pkg/util/validation/field"

 	"github.com/openshift/origin/pkg/cmd/server/api"

@@ -18,7 +19,8 @@ func TestFailingAPIServerArgs(t *testing.T) {

 	// [port: invalid value '[invalid-value]': could not be set: strconv.ParseUint: parsing "invalid-value": invalid syntax flag: invalid value 'missing-key': is not a valid flag]

-	errs := ValidateAPIServerExtendedArguments(args, nil)

+	validationResults := ValidateAPIServerExtendedArguments(args, nil)

+	errs := validationResults.Errors

 	if len(errs) != 2 {

 		t.Fatalf("expected 2 errors, not %v", errs)

@@ -248,3 +250,174 @@ func TestValidateAdmissionPluginConfig(t *testing.T) {

 		}

 	}

 }

+

+func TestValidateAdmissionPluginConfigConflicts(t *testing.T) {

+	testCases := []struct {

+		name    string

+		options configapi.MasterConfig

+

+		warningFields []string

+	}{

+		{

+			name: "stock everything",

+		},

+		{

+			name: "specified kube admission order 01",

+			options: configapi.MasterConfig{

+				KubernetesMasterConfig: &configapi.KubernetesMasterConfig{

+					AdmissionConfig: configapi.AdmissionConfig{

+						PluginOrderOverride: []string{"foo"},

+					},

+				},

+			},

+			warningFields: []string{"kubernetesMasterConfig.admissionConfig.pluginOrderOverride"},

+		},

+		{

+			name: "specified kube admission order 02",

+			options: configapi.MasterConfig{

+				KubernetesMasterConfig: &configapi.KubernetesMasterConfig{

+					APIServerArguments: configapi.ExtendedArguments{

+						"admission-control": []string{"foo"},

+					},

+				},

+			},

+			warningFields: []string{"kubernetesMasterConfig.apiServerArguments[admission-control]"},

+		},

+		{

+			name: "specified origin admission order",

+			options: configapi.MasterConfig{

+				AdmissionConfig: configapi.AdmissionConfig{

+					PluginOrderOverride: []string{"foo"},

+				},

+			},

+			warningFields: []string{"admissionConfig.pluginOrderOverride"},

+		},

+		{

+			name: "specified kube admission config file",

+			options: configapi.MasterConfig{

+				KubernetesMasterConfig: &configapi.KubernetesMasterConfig{

+					APIServerArguments: configapi.ExtendedArguments{

+						"admission-control-config-file": []string{"foo"},

+					},

+				},

+			},

+			warningFields: []string{"kubernetesMasterConfig.apiServerArguments[admission-control-config-file]"},

+		},

+		{

+			name: "specified, non-conflicting plugin configs 01",

+			options: configapi.MasterConfig{

+				AdmissionConfig: configapi.AdmissionConfig{

+					PluginConfig: map[string]configapi.AdmissionPluginConfig{

+						"foo": {

+							Location: "bar",

+						},

+					},

+				},

+			},

+		},

+		{

+			name: "specified, non-conflicting plugin configs 02",

+			options: configapi.MasterConfig{

+				KubernetesMasterConfig: &configapi.KubernetesMasterConfig{

+					AdmissionConfig: configapi.AdmissionConfig{

+						PluginConfig: map[string]configapi.AdmissionPluginConfig{

+							"foo": {

+								Location: "bar",

+							},

+							"third": {

+								Location: "bar",

+							},

+						},

+					},

+				},

+				AdmissionConfig: configapi.AdmissionConfig{

+					PluginConfig: map[string]configapi.AdmissionPluginConfig{

+						"foo": {

+							Location: "bar",

+						},

+					},

+				},

+			},

+		},

+		{

+			name: "specified, non-conflicting plugin configs 03",

+			options: configapi.MasterConfig{

+				KubernetesMasterConfig: &configapi.KubernetesMasterConfig{

+					AdmissionConfig: configapi.AdmissionConfig{

+						PluginConfig: map[string]configapi.AdmissionPluginConfig{

+							"foo": {

+								Location: "bar",

+							},

+							"third": {

+								Location: "bar",

+							},

+						},

+					},

+				},

+			},

+		},

+		{

+			name: "specified conflicting plugin configs 01",

+			options: configapi.MasterConfig{

+				KubernetesMasterConfig: &configapi.KubernetesMasterConfig{

+					AdmissionConfig: configapi.AdmissionConfig{

+						PluginConfig: map[string]configapi.AdmissionPluginConfig{

+							"foo": {

+								Location: "different",

+							},

+						},

+					},

+				},

+				AdmissionConfig: configapi.AdmissionConfig{

+					PluginConfig: map[string]configapi.AdmissionPluginConfig{

+						"foo": {

+							Location: "bar",

+						},

+					},

+				},

+			},

+			warningFields: []string{"kubernetesMasterConfig.admissionConfig.pluginConfig[foo]"},

+		},

+	}

+

+	// these fields have warnings in the empty case

+	defaultWarningFields := sets.NewString(

+		"serviceAccountConfig.managedNames", "serviceAccountConfig.publicKeyFiles", "serviceAccountConfig.privateKeyFile", "serviceAccountConfig.masterCA",

+		"projectConfig.securityAllocator", "kubernetesMasterConfig.proxyClientInfo")

+

+	for _, tc := range testCases {

+		results := ValidateMasterConfig(&tc.options, nil)

+

+		for _, result := range results.Warnings {

+			if defaultWarningFields.Has(result.Field) {

+				continue

+			}

+

+			found := false

+			for _, expectedField := range tc.warningFields {

+				if result.Field == expectedField {

+					found = true

+					break

+				}

+			}

+

+			if !found {

+				t.Errorf("%s: didn't expect %q", tc.name, result.Field)

+			}

+		}

+

+		for _, expectedField := range tc.warningFields {

+			found := false

+			for _, result := range results.Warnings {

+				if result.Field == expectedField {

+					found = true

+					break

+				}

+			}

+

+			if !found {

+				t.Errorf("%s: didn't find %q", tc.name, expectedField)

+			}

+		}

+	}

+}