@@ -94,12 +94,13 @@ func (o *ValidateMasterConfigOptions) Run() (bool, error) {

 }

 const (

-	minColumnWidth          = 4

-	tabWidth                = 4

-	padding                 = 2

-	padchar                 = byte(' ')

-	flags                   = 0

-	validationErrorHeadings = "ERROR\tFIELD\tVALUE\tDETAILS\n"

+	minColumnWidth            = 4

+	tabWidth                  = 4

+	padding                   = 2

+	padchar                   = byte(' ')

+	flags                     = 0

+	validationErrorHeadings   = "ERROR\tFIELD\tVALUE\tDETAILS\n"

+	validationWarningHeadings = "WARNING\tFIELD\tVALUE\tDETAILS\n"

 )

 // prettyPrintValidationResults prints the contents of the ValidationResults into the buffer of a tabwriter.Writer.

@@ -107,14 +108,14 @@ const (

 func prettyPrintValidationResults(results validation.ValidationResults, writer *tabwriter.Writer) error {

 	if len(results.Errors) > 0 {

 		fmt.Fprintf(writer, "VALIDATION ERRORS:\t\t\t\n")

-		err := prettyPrintValidationErrorList(results.Errors, writer)

+		err := prettyPrintValidationErrorList(validationErrorHeadings, results.Errors, writer)

 		if err != nil {

 			return err

 		}

 	}

 	if len(results.Warnings) > 0 {

 		fmt.Fprintf(writer, "VALIDATION WARNINGS:\t\t\t\n")

-		err := prettyPrintValidationErrorList(results.Errors, writer)

+		err := prettyPrintValidationErrorList(validationWarningHeadings, results.Warnings, writer)

 		if err != nil {

 			return err

 		}

@@ -124,9 +125,9 @@ func prettyPrintValidationResults(results validation.ValidationResults, writer *

 // prettyPrintValidationErrorList prints the contents of the ValidationErrorList into the buffer of a tabwriter.Writer.

 // The writer must be Flush()ed after calling this to write the buffered data.

-func prettyPrintValidationErrorList(validationErrors fielderrors.ValidationErrorList, writer *tabwriter.Writer) error {

+func prettyPrintValidationErrorList(headings string, validationErrors fielderrors.ValidationErrorList, writer *tabwriter.Writer) error {

 	if len(validationErrors) > 0 {

-		fmt.Fprintf(writer, validationErrorHeadings)

+		fmt.Fprintf(writer, headings)

 		for _, err := range validationErrors {

 			switch validationError := err.(type) {

 			case (*fielderrors.ValidationError):

@@ -84,10 +84,10 @@ func (o *ValidateNodeConfigOptions) Run() (ok bool, err error) {

 	results := validation.ValidateNodeConfig(nodeConfig)

 	writer := tabwriter.NewWriter(o.Out, minColumnWidth, tabWidth, padding, padchar, flags)

-	err = prettyPrintValidationErrorList(results, writer)

+	err = prettyPrintValidationResults(results, writer)

 	if err != nil {

-		return len(results) == 0, fmt.Errorf("could not print results: %v", err)

+		return len(results.Errors) == 0, fmt.Errorf("could not print results: %v", err)

 	}

 	writer.Flush()

-	return len(results) == 0, nil

+	return len(results.Errors) == 0, nil

 }

@@ -1,6 +1,7 @@

 package api

 import (

+	"crypto/tls"

 	"crypto/x509"

 	"fmt"

 	"net"

@@ -120,6 +121,10 @@ func GetMasterFileReferences(config *MasterConfig) []*string {

 	refs = append(refs, &config.ServingInfo.ServerCert.CertFile)

 	refs = append(refs, &config.ServingInfo.ServerCert.KeyFile)

 	refs = append(refs, &config.ServingInfo.ClientCA)

+	for i := range config.ServingInfo.NamedCertificates {

+		refs = append(refs, &config.ServingInfo.NamedCertificates[i].CertFile)

+		refs = append(refs, &config.ServingInfo.NamedCertificates[i].KeyFile)

+	}

 	refs = append(refs, &config.EtcdClientInfo.ClientCert.CertFile)

 	refs = append(refs, &config.EtcdClientInfo.ClientCert.KeyFile)

@@ -133,10 +138,18 @@ func GetMasterFileReferences(config *MasterConfig) []*string {

 		refs = append(refs, &config.EtcdConfig.ServingInfo.ServerCert.CertFile)

 		refs = append(refs, &config.EtcdConfig.ServingInfo.ServerCert.KeyFile)

 		refs = append(refs, &config.EtcdConfig.ServingInfo.ClientCA)

+		for i := range config.EtcdConfig.ServingInfo.NamedCertificates {

+			refs = append(refs, &config.EtcdConfig.ServingInfo.NamedCertificates[i].CertFile)

+			refs = append(refs, &config.EtcdConfig.ServingInfo.NamedCertificates[i].KeyFile)

+		}

 		refs = append(refs, &config.EtcdConfig.PeerServingInfo.ServerCert.CertFile)

 		refs = append(refs, &config.EtcdConfig.PeerServingInfo.ServerCert.KeyFile)

 		refs = append(refs, &config.EtcdConfig.PeerServingInfo.ClientCA)

+		for i := range config.EtcdConfig.PeerServingInfo.NamedCertificates {

+			refs = append(refs, &config.EtcdConfig.PeerServingInfo.NamedCertificates[i].CertFile)

+			refs = append(refs, &config.EtcdConfig.PeerServingInfo.NamedCertificates[i].KeyFile)

+		}

 		refs = append(refs, &config.EtcdConfig.StorageDir)

 	}

@@ -182,6 +195,11 @@ func GetMasterFileReferences(config *MasterConfig) []*string {

 		refs = append(refs, &config.AssetConfig.ServingInfo.ServerCert.CertFile)

 		refs = append(refs, &config.AssetConfig.ServingInfo.ServerCert.KeyFile)

 		refs = append(refs, &config.AssetConfig.ServingInfo.ClientCA)

+		for i := range config.AssetConfig.ServingInfo.NamedCertificates {

+			refs = append(refs, &config.AssetConfig.ServingInfo.NamedCertificates[i].CertFile)

+			refs = append(refs, &config.AssetConfig.ServingInfo.NamedCertificates[i].KeyFile)

+		}

+

 		for i := range config.AssetConfig.ExtensionScripts {

 			refs = append(refs, &config.AssetConfig.ExtensionScripts[i])

 		}

@@ -228,6 +246,10 @@ func GetNodeFileReferences(config *NodeConfig) []*string {

 	refs = append(refs, &config.ServingInfo.ServerCert.CertFile)

 	refs = append(refs, &config.ServingInfo.ServerCert.KeyFile)

 	refs = append(refs, &config.ServingInfo.ClientCA)

+	for i := range config.ServingInfo.NamedCertificates {

+		refs = append(refs, &config.ServingInfo.NamedCertificates[i].CertFile)

+		refs = append(refs, &config.ServingInfo.NamedCertificates[i].KeyFile)

+	}

 	refs = append(refs, &config.MasterKubeConfig)

@@ -317,6 +339,26 @@ func GetAPIClientCertCAPool(options MasterConfig) (*x509.CertPool, error) {

 	return cmdutil.CertPoolFromFile(options.ServingInfo.ClientCA)

 }

+// GetNamedCertificateMap returns a map of strings to *tls.Certificate, suitable for use in tls.Config#NamedCertificates

+// Returns an error if any of the certs cannot be loaded, or do not match the configured name

+// Returns nil if len(namedCertificates) == 0

+func GetNamedCertificateMap(namedCertificates []NamedCertificate) (map[string]*tls.Certificate, error) {

+	if len(namedCertificates) == 0 {

+		return nil, nil

+	}

+	namedCerts := map[string]*tls.Certificate{}

+	for _, namedCertificate := range namedCertificates {

+		cert, err := tls.LoadX509KeyPair(namedCertificate.CertFile, namedCertificate.KeyFile)

+		if err != nil {

+			return nil, err

+		}

+		for _, name := range namedCertificate.Names {

+			namedCerts[name] = &cert

+		}

+	}

+	return namedCerts, nil

+}

+

 // GetClientCertCAPool returns a cert pool containing all client CAs that could be presented (union of API and OAuth)

 func GetClientCertCAPool(options MasterConfig) (*x509.CertPool, error) {

 	roots := x509.NewCertPool()

@@ -339,6 +339,17 @@ type ServingInfo struct {

 	ServerCert CertInfo

 	// ClientCA is the certificate bundle for all the signers that you'll recognize for incoming client certificates

 	ClientCA string

+	// NamedCertificates is a list of certificates to use to secure requests to specific hostnames

+	NamedCertificates []NamedCertificate

+}

+

+// NamedCertificate specifies a certificate/key, and the names it should be served for

+type NamedCertificate struct {

+	// Names is a list of DNS names this certificate should be used to secure

+	// A name can be a normal DNS name, or can contain leading wildcard segments.

+	Names []string

+	// CertInfo is the TLS cert info for serving secure traffic

+	CertInfo

 }

 type HTTPServingInfo struct {

@@ -141,17 +141,17 @@ func init() {

 			return s.DefaultConvert(in, out, conversion.IgnoreMissingFields)

 		},

 		func(in *ServingInfo, out *newer.ServingInfo, s conversion.Scope) error {

-			out.BindAddress = in.BindAddress

-			out.BindNetwork = in.BindNetwork

-			out.ClientCA = in.ClientCA

+			if err := s.DefaultConvert(in, out, conversion.IgnoreMissingFields); err != nil {

+				return err

+			}

 			out.ServerCert.CertFile = in.CertFile

 			out.ServerCert.KeyFile = in.KeyFile

 			return nil

 		},

 		func(in *newer.ServingInfo, out *ServingInfo, s conversion.Scope) error {

-			out.BindAddress = in.BindAddress

-			out.BindNetwork = in.BindNetwork

-			out.ClientCA = in.ClientCA

+			if err := s.DefaultConvert(in, out, conversion.IgnoreMissingFields); err != nil {

+				return err

+			}

 			out.CertFile = in.ServerCert.CertFile

 			out.KeyFile = in.ServerCert.KeyFile

 			return nil

@@ -319,6 +319,17 @@ type ServingInfo struct {

 	CertInfo `json:",inline"`

 	// ClientCA is the certificate bundle for all the signers that you'll recognize for incoming client certificates

 	ClientCA string `json:"clientCA"`

+	// NamedCertificates is a list of certificates to use to secure requests to specific hostnames

+	NamedCertificates []NamedCertificate `json:"namedCertificates"`

+}

+

+// NamedCertificate specifies a certificate/key, and the names it should be served for

+type NamedCertificate struct {

+	// Names is a list of DNS names this certificate should be used to secure

+	// A name can be a normal DNS name, or can contain leading wildcard segments.

+	Names []string `json:"names"`

+	// CertInfo is the TLS cert info for serving secure traffic

+	CertInfo `json:",inline"`

 }

 type HTTPServingInfo struct {

@@ -46,6 +46,7 @@ servingInfo:

   certFile: ""

   clientCA: ""

   keyFile: ""

+  namedCertificates: null

 volumeDirectory: ""

 `

@@ -76,6 +77,7 @@ assetConfig:

     clientCA: ""

     keyFile: ""

     maxRequestsInFlight: 0

+    namedCertificates: null

     requestTimeoutSeconds: 0

 controllerLeaseTTL: 0

 controllers: ""

@@ -98,12 +100,14 @@ etcdConfig:

     certFile: ""

     clientCA: ""

     keyFile: ""

+    namedCertificates: null

   servingInfo:

     bindAddress: ""

     bindNetwork: ""

     certFile: ""

     clientCA: ""

     keyFile: ""

+    namedCertificates: null

   storageDirectory: ""

 etcdStorageConfig:

   kubernetesStoragePrefix: ""

@@ -276,6 +280,10 @@ servingInfo:

   clientCA: ""

   keyFile: ""

   maxRequestsInFlight: 0

+  namedCertificates:

+  - certFile: ""

+    keyFile: ""

+    names: null

   requestTimeoutSeconds: 0

 `

 )

@@ -295,6 +303,11 @@ func TestNodeConfig(t *testing.T) {

 func TestMasterConfig(t *testing.T) {

 	config := &internal.MasterConfig{

+		ServingInfo: internal.HTTPServingInfo{

+			ServingInfo: internal.ServingInfo{

+				NamedCertificates: []internal.NamedCertificate{{}},

+			},

+		},

 		KubernetesMasterConfig: &internal.KubernetesMasterConfig{},

 		EtcdConfig:             &internal.EtcdConfig{},

 		OAuthConfig: &internal.OAuthConfig{

@@ -9,7 +9,7 @@ func ValidateAllInOneConfig(master *api.MasterConfig, node *api.NodeConfig) Vali

 	validationResults.Append(ValidateMasterConfig(master).Prefix("masterConfig"))

-	validationResults.AddErrors(ValidateNodeConfig(node).Prefix("nodeConfig")...)

+	validationResults.Append(ValidateNodeConfig(node).Prefix("nodeConfig"))

 	// Validation between the configs

@@ -56,24 +56,31 @@ func ValidateEtcdConnectionInfo(config api.EtcdConnectionInfo, server *api.EtcdC

 	return allErrs

 }

-func ValidateEtcdConfig(config *api.EtcdConfig) fielderrors.ValidationErrorList {

-	allErrs := fielderrors.ValidationErrorList{}

+func ValidateEtcdConfig(config *api.EtcdConfig) ValidationResults {

+	validationResults := ValidationResults{}

-	allErrs = append(allErrs, ValidateServingInfo(config.ServingInfo).Prefix("servingInfo")...)

+	validationResults.Append(ValidateServingInfo(config.ServingInfo).Prefix("servingInfo"))

 	if config.ServingInfo.BindNetwork == "tcp6" {

-		allErrs = append(allErrs, fielderrors.NewFieldInvalid("servingInfo.bindNetwork", config.ServingInfo.BindNetwork, "tcp6 is not a valid bindNetwork for etcd, must be tcp or tcp4"))

+		validationResults.AddErrors(fielderrors.NewFieldInvalid("servingInfo.bindNetwork", config.ServingInfo.BindNetwork, "tcp6 is not a valid bindNetwork for etcd, must be tcp or tcp4"))

+	}

+	if len(config.ServingInfo.NamedCertificates) > 0 {

+		validationResults.AddErrors(fielderrors.NewFieldInvalid("servingInfo.namedCertificates", "<not shown>", "namedCertificates are not supported for etcd"))

 	}

-	allErrs = append(allErrs, ValidateServingInfo(config.PeerServingInfo).Prefix("peerServingInfo")...)

+

+	validationResults.Append(ValidateServingInfo(config.PeerServingInfo).Prefix("peerServingInfo"))

 	if config.ServingInfo.BindNetwork == "tcp6" {

-		allErrs = append(allErrs, fielderrors.NewFieldInvalid("peerServingInfo.bindNetwork", config.ServingInfo.BindNetwork, "tcp6 is not a valid bindNetwork for etcd peers, must be tcp or tcp4"))

+		validationResults.AddErrors(fielderrors.NewFieldInvalid("peerServingInfo.bindNetwork", config.ServingInfo.BindNetwork, "tcp6 is not a valid bindNetwork for etcd peers, must be tcp or tcp4"))

+	}

+	if len(config.ServingInfo.NamedCertificates) > 0 {

+		validationResults.AddErrors(fielderrors.NewFieldInvalid("peerServingInfo.namedCertificates", "<not shown>", "namedCertificates are not supported for etcd"))

 	}

-	allErrs = append(allErrs, ValidateHostPort(config.Address, "address")...)

-	allErrs = append(allErrs, ValidateHostPort(config.PeerAddress, "peerAddress")...)

+	validationResults.AddErrors(ValidateHostPort(config.Address, "address")...)

+	validationResults.AddErrors(ValidateHostPort(config.PeerAddress, "peerAddress")...)

 	if len(config.StorageDir) == 0 {

-		allErrs = append(allErrs, fielderrors.NewFieldRequired("storageDirectory"))

+		validationResults.AddErrors(fielderrors.NewFieldRequired("storageDirectory"))

 	}

-	return allErrs

+	return validationResults

 }

@@ -4,6 +4,7 @@ import (

 	"fmt"

 	"net"

 	"net/url"

+	"reflect"

 	"regexp"

 	"strings"

 	"time"

@@ -57,8 +58,6 @@ func (r ValidationResults) Prefix(prefix string) ValidationResults {

 func ValidateMasterConfig(config *api.MasterConfig) ValidationResults {

 	validationResults := ValidationResults{}

-	validationResults.AddErrors(ValidateHTTPServingInfo(config.ServingInfo).Prefix("servingInfo")...)

-

 	if _, urlErrs := ValidateURL(config.MasterPublicURL, "masterPublicURL"); len(urlErrs) > 0 {

 		validationResults.AddErrors(urlErrs...)

 	}

@@ -73,13 +72,16 @@ func ValidateMasterConfig(config *api.MasterConfig) ValidationResults {

 	validationResults.AddErrors(ValidateDisabledFeatures(config.DisabledFeatures, "disabledFeatures")...)

 	if config.AssetConfig != nil {

-		validationResults.AddErrors(ValidateAssetConfig(config.AssetConfig).Prefix("assetConfig")...)

+		validationResults.Append(ValidateAssetConfig(config.AssetConfig).Prefix("assetConfig"))

 		colocated := config.AssetConfig.ServingInfo.BindAddress == config.ServingInfo.BindAddress

 		if colocated {

 			publicURL, _ := url.Parse(config.AssetConfig.PublicURL)

 			if publicURL.Path == "/" {

 				validationResults.AddErrors(fielderrors.NewFieldInvalid("assetConfig.publicURL", config.AssetConfig.PublicURL, "path can not be / when colocated with master API"))

 			}

+			if !reflect.DeepEqual(config.AssetConfig.ServingInfo, config.ServingInfo) {

+				validationResults.AddWarnings(fielderrors.NewFieldInvalid("assetConfig.servingInfo", "<not displayed>", "assetConfig.servingInfo is ignored when colocated with master API"))

+			}

 		}

 		if config.OAuthConfig != nil {

@@ -106,9 +108,9 @@ func ValidateMasterConfig(config *api.MasterConfig) ValidationResults {

 	if config.EtcdConfig != nil {

 		etcdConfigErrs := ValidateEtcdConfig(config.EtcdConfig).Prefix("etcdConfig")

-		validationResults.AddErrors(etcdConfigErrs...)

+		validationResults.Append(etcdConfigErrs)

-		if len(etcdConfigErrs) == 0 {

+		if len(etcdConfigErrs.Errors) == 0 {

 			// Validate the etcdClientInfo with the internal etcdConfig

 			validationResults.AddErrors(ValidateEtcdConnectionInfo(config.EtcdClientInfo, config.EtcdConfig).Prefix("etcdClientInfo")...)

 		} else {

@@ -157,7 +159,7 @@ func ValidateMasterConfig(config *api.MasterConfig) ValidationResults {

 	validationResults.Append(ValidateServiceAccountConfig(config.ServiceAccountConfig, builtInKubernetes).Prefix("serviceAccountConfig"))

-	validationResults.AddErrors(ValidateHTTPServingInfo(config.ServingInfo).Prefix("servingInfo")...)

+	validationResults.Append(ValidateHTTPServingInfo(config.ServingInfo).Prefix("servingInfo"))

 	validationResults.Append(ValidateProjectConfig(config.ProjectConfig).Prefix("projectConfig"))

@@ -261,65 +263,65 @@ func ValidateServiceAccountConfig(config api.ServiceAccountConfig, builtInKubern

 	return validationResults

 }

-func ValidateAssetConfig(config *api.AssetConfig) fielderrors.ValidationErrorList {

-	allErrs := fielderrors.ValidationErrorList{}

+func ValidateAssetConfig(config *api.AssetConfig) ValidationResults {

+	validationResults := ValidationResults{}

-	allErrs = append(allErrs, ValidateHTTPServingInfo(config.ServingInfo).Prefix("servingInfo")...)

+	validationResults.Append(ValidateHTTPServingInfo(config.ServingInfo).Prefix("servingInfo"))

 	if len(config.LogoutURL) > 0 {

 		_, urlErrs := ValidateURL(config.LogoutURL, "logoutURL")

 		if len(urlErrs) > 0 {

-			allErrs = append(allErrs, urlErrs...)

+			validationResults.AddErrors(urlErrs...)

 		}

 	}

 	urlObj, urlErrs := ValidateURL(config.PublicURL, "publicURL")

 	if len(urlErrs) > 0 {

-		allErrs = append(allErrs, urlErrs...)

+		validationResults.AddErrors(urlErrs...)

 	}

 	if urlObj != nil {

 		if !strings.HasSuffix(urlObj.Path, "/") {

-			allErrs = append(allErrs, fielderrors.NewFieldInvalid("publicURL", config.PublicURL, "must have a trailing slash in path"))

+			validationResults.AddErrors(fielderrors.NewFieldInvalid("publicURL", config.PublicURL, "must have a trailing slash in path"))

 		}

 	}

 	if _, urlErrs := ValidateURL(config.MasterPublicURL, "masterPublicURL"); len(urlErrs) > 0 {

-		allErrs = append(allErrs, urlErrs...)

+		validationResults.AddErrors(urlErrs...)

 	}

 	if len(config.LoggingPublicURL) > 0 {

 		if _, loggingURLErrs := ValidateSecureURL(config.LoggingPublicURL, "loggingPublicURL"); len(loggingURLErrs) > 0 {

-			allErrs = append(allErrs, loggingURLErrs...)

+			validationResults.AddErrors(loggingURLErrs...)

 		}

 	}

 	if len(config.MetricsPublicURL) > 0 {

 		if _, metricsURLErrs := ValidateSecureURL(config.MetricsPublicURL, "metricsPublicURL"); len(metricsURLErrs) > 0 {

-			allErrs = append(allErrs, metricsURLErrs...)

+			validationResults.AddErrors(metricsURLErrs...)

 		}

 	}

 	for i, scriptFile := range config.ExtensionScripts {

-		allErrs = append(allErrs, ValidateFile(scriptFile, fmt.Sprintf("extensionScripts[%d]", i))...)

+		validationResults.AddErrors(ValidateFile(scriptFile, fmt.Sprintf("extensionScripts[%d]", i))...)

 	}

 	for i, stylesheetFile := range config.ExtensionStylesheets {

-		allErrs = append(allErrs, ValidateFile(stylesheetFile, fmt.Sprintf("extensionStylesheets[%d]", i))...)

+		validationResults.AddErrors(ValidateFile(stylesheetFile, fmt.Sprintf("extensionStylesheets[%d]", i))...)

 	}

 	nameTaken := map[string]bool{}

 	for i, extConfig := range config.Extensions {

 		extConfigErrors := ValidateAssetExtensionsConfig(extConfig).Prefix(fmt.Sprintf("extensions[%d]", i))

-		allErrs = append(allErrs, extConfigErrors...)

+		validationResults.AddErrors(extConfigErrors...)

 		if nameTaken[extConfig.Name] {

 			dupError := fielderrors.NewFieldInvalid(fmt.Sprintf("extensions[%d].name", i), extConfig.Name, "duplicate extension name")

-			allErrs = append(allErrs, dupError)

+			validationResults.AddErrors(dupError)

 		} else {

 			nameTaken[extConfig.Name] = true

 		}

 	}

-	return allErrs

+	return validationResults

 }

 var extNameExp = regexp.MustCompile(`^[A-Za-z0-9_]+$`)

@@ -11,45 +11,45 @@ import (

 	"github.com/openshift/origin/pkg/cmd/server/api"

 )

-func ValidateNodeConfig(config *api.NodeConfig) fielderrors.ValidationErrorList {

-	allErrs := fielderrors.ValidationErrorList{}

+func ValidateNodeConfig(config *api.NodeConfig) ValidationResults {

+	validationResults := ValidationResults{}

 	if len(config.NodeName) == 0 {

-		allErrs = append(allErrs, fielderrors.NewFieldRequired("nodeName"))

+		validationResults.AddErrors(fielderrors.NewFieldRequired("nodeName"))

 	}

 	if len(config.NodeIP) > 0 {

-		allErrs = append(allErrs, ValidateSpecifiedIP(config.NodeIP, "nodeIP")...)

+		validationResults.AddErrors(ValidateSpecifiedIP(config.NodeIP, "nodeIP")...)

 	}

-	allErrs = append(allErrs, ValidateServingInfo(config.ServingInfo).Prefix("servingInfo")...)

+	validationResults.Append(ValidateServingInfo(config.ServingInfo).Prefix("servingInfo"))

 	if config.ServingInfo.BindNetwork == "tcp6" {

-		allErrs = append(allErrs, fielderrors.NewFieldInvalid("servingInfo.bindNetwork", config.ServingInfo.BindNetwork, "tcp6 is not a valid bindNetwork for nodes, must be tcp or tcp4"))

+		validationResults.AddErrors(fielderrors.NewFieldInvalid("servingInfo.bindNetwork", config.ServingInfo.BindNetwork, "tcp6 is not a valid bindNetwork for nodes, must be tcp or tcp4"))

 	}

-	allErrs = append(allErrs, ValidateKubeConfig(config.MasterKubeConfig, "masterKubeConfig")...)

+	validationResults.AddErrors(ValidateKubeConfig(config.MasterKubeConfig, "masterKubeConfig")...)

 	if len(config.DNSIP) > 0 {

-		allErrs = append(allErrs, ValidateSpecifiedIP(config.DNSIP, "dnsIP")...)

+		validationResults.AddErrors(ValidateSpecifiedIP(config.DNSIP, "dnsIP")...)

 	}

-	allErrs = append(allErrs, ValidateImageConfig(config.ImageConfig).Prefix("imageConfig")...)

+	validationResults.AddErrors(ValidateImageConfig(config.ImageConfig).Prefix("imageConfig")...)

 	if config.PodManifestConfig != nil {

-		allErrs = append(allErrs, ValidatePodManifestConfig(config.PodManifestConfig).Prefix("podManifestConfig")...)

+		validationResults.AddErrors(ValidatePodManifestConfig(config.PodManifestConfig).Prefix("podManifestConfig")...)

 	}

-	allErrs = append(allErrs, ValidateNetworkConfig(config.NetworkConfig).Prefix("networkConfig")...)

+	validationResults.AddErrors(ValidateNetworkConfig(config.NetworkConfig).Prefix("networkConfig")...)

-	allErrs = append(allErrs, ValidateDockerConfig(config.DockerConfig).Prefix("dockerConfig")...)

+	validationResults.AddErrors(ValidateDockerConfig(config.DockerConfig).Prefix("dockerConfig")...)

-	allErrs = append(allErrs, ValidateNodeAuthConfig(config.AuthConfig).Prefix("authConfig")...)

+	validationResults.AddErrors(ValidateNodeAuthConfig(config.AuthConfig).Prefix("authConfig")...)

-	allErrs = append(allErrs, ValidateKubeletExtendedArguments(config.KubeletArguments).Prefix("kubeletArguments")...)

+	validationResults.AddErrors(ValidateKubeletExtendedArguments(config.KubeletArguments).Prefix("kubeletArguments")...)

 	if _, err := time.ParseDuration(config.IPTablesSyncPeriod); err != nil {

-		allErrs = append(allErrs, fielderrors.NewFieldInvalid("iptablesSyncPeriod", config.IPTablesSyncPeriod, fmt.Sprintf("unable to parse iptablesSyncPeriod: %v. Examples with correct format: '5s', '1m', '2h22m'", err)))

+		validationResults.AddErrors(fielderrors.NewFieldInvalid("iptablesSyncPeriod", config.IPTablesSyncPeriod, fmt.Sprintf("unable to parse iptablesSyncPeriod: %v. Examples with correct format: '5s', '1m', '2h22m'", err)))

 	}

-	return allErrs

+	return validationResults

 }

 func ValidateNodeAuthConfig(config api.NodeAuthConfig) fielderrors.ValidationErrorList {

@@ -1,6 +1,8 @@

 package validation

 import (

+	"crypto/tls"

+	"crypto/x509"

 	"fmt"

 	"net"

 	"net/url"

@@ -10,9 +12,12 @@ import (

 	"github.com/spf13/pflag"

 	kvalidation "k8s.io/kubernetes/pkg/api/validation"

+	kutil "k8s.io/kubernetes/pkg/util"

 	"k8s.io/kubernetes/pkg/util/fielderrors"

+	"k8s.io/kubernetes/pkg/util/sets"

 	"github.com/openshift/origin/pkg/cmd/server/api"

+	cmdutil "github.com/openshift/origin/pkg/cmd/util"

 	cmdflags "github.com/openshift/origin/pkg/cmd/util/flags"

 )

@@ -48,46 +53,124 @@ func ValidateCertInfo(certInfo api.CertInfo, required bool) fielderrors.Validati

 		allErrs = append(allErrs, ValidateFile(certInfo.KeyFile, "keyFile")...)

 	}

+	// validate certfile/keyfile load/parse?

+

 	return allErrs

 }

-func ValidateServingInfo(info api.ServingInfo) fielderrors.ValidationErrorList {

-	allErrs := fielderrors.ValidationErrorList{}

+func ValidateServingInfo(info api.ServingInfo) ValidationResults {

+	validationResults := ValidationResults{}

+

+	validationResults.AddErrors(ValidateHostPort(info.BindAddress, "bindAddress")...)

+	validationResults.AddErrors(ValidateCertInfo(info.ServerCert, false)...)

+

+	if len(info.NamedCertificates) > 0 && len(info.ServerCert.CertFile) == 0 {

+		validationResults.AddErrors(fielderrors.NewFieldInvalid("namedCertificates", "", "a default certificate and key is required in certFile/keyFile in order to use namedCertificates"))

+	}

-	allErrs = append(allErrs, ValidateHostPort(info.BindAddress, "bindAddress")...)

-	allErrs = append(allErrs, ValidateCertInfo(info.ServerCert, false)...)

+	validationResults.Append(ValidateNamedCertificates("namedCertificates", info.NamedCertificates))

 	switch info.BindNetwork {

 	case "tcp", "tcp4", "tcp6":

 	default:

-		allErrs = append(allErrs, fielderrors.NewFieldInvalid("bindNetwork", info.BindNetwork, "must be 'tcp', 'tcp4', or 'tcp6'"))

+		validationResults.AddErrors(fielderrors.NewFieldInvalid("bindNetwork", info.BindNetwork, "must be 'tcp', 'tcp4', or 'tcp6'"))

 	}

 	if len(info.ServerCert.CertFile) > 0 {

 		if len(info.ClientCA) > 0 {

-			allErrs = append(allErrs, ValidateFile(info.ClientCA, "clientCA")...)

+			validationResults.AddErrors(ValidateFile(info.ClientCA, "clientCA")...)

 		}

 	} else {

 		if len(info.ClientCA) > 0 {

-			allErrs = append(allErrs, fielderrors.NewFieldInvalid("clientCA", info.ClientCA, "cannot specify a clientCA without a certFile"))

+			validationResults.AddErrors(fielderrors.NewFieldInvalid("clientCA", info.ClientCA, "cannot specify a clientCA without a certFile"))

 		}

 	}

-	return allErrs

+	return validationResults

+}

+

+func ValidateNamedCertificates(fieldName string, namedCertificates []api.NamedCertificate) ValidationResults {

+	validationResults := ValidationResults{}

+

+	takenNames := sets.NewString()

+	for i, namedCertificate := range namedCertificates {

+		fieldName := fmt.Sprintf("%s[%d]", fieldName, i)

+

+		certDNSNames := []string{}

+		if len(namedCertificate.CertFile) == 0 {

+			validationResults.AddErrors(fielderrors.NewFieldRequired(fieldName + ".certInfo"))

+		} else if certInfoErrors := ValidateCertInfo(namedCertificate.CertInfo, false); len(certInfoErrors) > 0 {

+			validationResults.AddErrors(certInfoErrors.Prefix(fieldName)...)

+		} else if cert, err := tls.LoadX509KeyPair(namedCertificate.CertFile, namedCertificate.KeyFile); err != nil {

+			validationResults.AddErrors(fielderrors.NewFieldInvalid(fieldName+".certInfo", namedCertificate.CertInfo, fmt.Sprintf("error loading certificate/key: %v", err)))

+		} else {

+			leaf, _ := x509.ParseCertificate(cert.Certificate[0])

+			certDNSNames = append(certDNSNames, leaf.Subject.CommonName)

+			certDNSNames = append(certDNSNames, leaf.DNSNames...)

+		}

+

+		if len(namedCertificate.Names) == 0 {

+			validationResults.AddErrors(fielderrors.NewFieldRequired(fieldName + ".names"))

+		}

+		for j, name := range namedCertificate.Names {

+			nameFieldName := fieldName + fmt.Sprintf(".names[%d]", j)

+			if len(name) == 0 {

+				validationResults.AddErrors(fielderrors.NewFieldRequired(nameFieldName))

+				continue

+			}

+

+			if takenNames.Has(name) {

+				validationResults.AddErrors(fielderrors.NewFieldInvalid(nameFieldName, name, "this name is already used in another named certificate"))

+				continue

+			}

+

+			// validate names as domain names or *.*.foo.com domain names

+			validDNSName := true

+			for _, s := range strings.Split(name, ".") {

+				if s != "*" && !kutil.IsDNS1123Label(s) {

+					validDNSName = false

+				}

+			}

+			if !validDNSName {

+				validationResults.AddErrors(fielderrors.NewFieldInvalid(nameFieldName, name, "must be a valid DNS name"))

+				continue

+			}

+

+			takenNames.Insert(name)

+

+			// validate certificate has common name or subject alt names that match

+			if len(certDNSNames) > 0 {

+				foundMatch := false

+				for _, dnsName := range certDNSNames {

+					if cmdutil.HostnameMatches(dnsName, name) {

+						foundMatch = true

+						break

+					}

+				}

+				if !foundMatch {

+					validationResults.AddWarnings(fielderrors.NewFieldInvalid(nameFieldName, name, "the specified certificate does not have a CommonName or DNS subjectAltName that matches this name"))

+				}

+			}

+		}

+	}

+

+	return validationResults

 }

-func ValidateHTTPServingInfo(info api.HTTPServingInfo) fielderrors.ValidationErrorList {

-	allErrs := ValidateServingInfo(info.ServingInfo)

+func ValidateHTTPServingInfo(info api.HTTPServingInfo) ValidationResults {

+	validationResults := ValidationResults{}

+

+	validationResults.Append(ValidateServingInfo(info.ServingInfo))

 	if info.MaxRequestsInFlight < 0 {

-		allErrs = append(allErrs, fielderrors.NewFieldInvalid("maxRequestsInFlight", info.MaxRequestsInFlight, "must be zero (no limit) or greater"))

+		validationResults.AddErrors(fielderrors.NewFieldInvalid("maxRequestsInFlight", info.MaxRequestsInFlight, "must be zero (no limit) or greater"))

 	}

 	if info.RequestTimeoutSeconds < -1 {

-		allErrs = append(allErrs, fielderrors.NewFieldInvalid("requestTimeoutSeconds", info.RequestTimeoutSeconds, "must be -1 (no timeout), 0 (default timeout), or greater"))

+		validationResults.AddErrors(fielderrors.NewFieldInvalid("requestTimeoutSeconds", info.RequestTimeoutSeconds, "must be -1 (no timeout), 0 (default timeout), or greater"))

 	}

-	return allErrs

+	return validationResults

 }

 func ValidateDisabledFeatures(disabledFeatures []string, field string) fielderrors.ValidationErrorList {

new file mode 100644

@@ -0,0 +1,208 @@

+package validation

+

+import (

+	"io/ioutil"

+	"os"

+	"strings"

+	"testing"

+

+	"github.com/openshift/origin/pkg/cmd/server/api"

+)

+

+func TestValidateServingInfo(t *testing.T) {

+	certFile, err := ioutil.TempFile("", "cert.crt")

+	if err != nil {

+		t.Fatalf("unexpected error: %v", err)

+	}

+	defer os.Remove(certFile.Name())

+	certFileName := certFile.Name()

+	ioutil.WriteFile(certFile.Name(), localhostCert, os.FileMode(0755))

+

+	keyFile, err := ioutil.TempFile("", "cert.key")

+	if err != nil {

+		t.Fatalf("unexpected error: %v", err)

+	}

+	defer os.Remove(keyFile.Name())

+	keyFileName := keyFile.Name()

+	ioutil.WriteFile(keyFile.Name(), localhostKey, os.FileMode(0755))

+

+	testcases := map[string]struct {

+		ServingInfo      api.ServingInfo

+		ExpectedErrors   []string

+		ExpectedWarnings []string

+	}{

+		"basic": {

+			ServingInfo: api.ServingInfo{

+				BindAddress: "0.0.0.0:1234",

+				BindNetwork: "tcp",

+			},

+		},

+		"missing key": {

+			ServingInfo: api.ServingInfo{

+				BindAddress: "0.0.0.0:1234",

+				BindNetwork: "tcp",

+				ServerCert: api.CertInfo{

+					CertFile: certFileName,

+				},

+			},

+			ExpectedErrors: []string{"keyFile: required"},

+		},

+

+		"namedCertificates valid": {

+			ServingInfo: api.ServingInfo{

+				BindAddress: "0.0.0.0:1234",

+				BindNetwork: "tcp",

+				ServerCert:  api.CertInfo{CertFile: certFileName, KeyFile: keyFileName},

+				NamedCertificates: []api.NamedCertificate{

+					{Names: []string{"example.com"}, CertInfo: api.CertInfo{CertFile: certFileName, KeyFile: keyFileName}},

+				},

+			},

+		},

+

+		"namedCertificates without default cert": {

+			ServingInfo: api.ServingInfo{

+				BindAddress: "0.0.0.0:1234",

+				BindNetwork: "tcp",

+				//ServerCert:  api.CertInfo{CertFile: certFileName, KeyFile: keyFileName},

+				NamedCertificates: []api.NamedCertificate{

+					{Names: []string{"example.com"}, CertInfo: api.CertInfo{CertFile: certFileName, KeyFile: keyFileName}},

+				},

+			},

+			ExpectedErrors: []string{"namedCertificates: invalid"},

+		},

+

+		"namedCertificates with missing names": {

+			ServingInfo: api.ServingInfo{

+				BindAddress: "0.0.0.0:1234",

+				BindNetwork: "tcp",

+				ServerCert:  api.CertInfo{CertFile: certFileName, KeyFile: keyFileName},

+				NamedCertificates: []api.NamedCertificate{

+					{Names: []string{ /*"example.com"*/ }, CertInfo: api.CertInfo{CertFile: certFileName, KeyFile: keyFileName}},

+				},

+			},

+			ExpectedErrors: []string{"namedCertificates[0].names: required"},

+		},

+		"namedCertificates with missing key": {

+			ServingInfo: api.ServingInfo{

+				BindAddress: "0.0.0.0:1234",

+				BindNetwork: "tcp",

+				ServerCert:  api.CertInfo{CertFile: certFileName, KeyFile: keyFileName},

+				NamedCertificates: []api.NamedCertificate{

+					{Names: []string{"example.com"}, CertInfo: api.CertInfo{CertFile: certFileName /*, KeyFile: keyFileName*/}},

+				},

+			},

+			ExpectedErrors: []string{"namedCertificates[0].keyFile: required"},

+		},

+		"namedCertificates with duplicate names": {

+			ServingInfo: api.ServingInfo{

+				BindAddress: "0.0.0.0:1234",

+				BindNetwork: "tcp",

+				ServerCert:  api.CertInfo{CertFile: certFileName, KeyFile: keyFileName},

+				NamedCertificates: []api.NamedCertificate{

+					{Names: []string{"example.com"}, CertInfo: api.CertInfo{CertFile: certFileName, KeyFile: keyFileName}},

+					{Names: []string{"example.com"}, CertInfo: api.CertInfo{CertFile: certFileName, KeyFile: keyFileName}},

+				},

+			},

+			ExpectedErrors: []string{"namedCertificates[1].names[0]: invalid"},

+		},

+		"namedCertificates with empty name": {

+			ServingInfo: api.ServingInfo{

+				BindAddress: "0.0.0.0:1234",

+				BindNetwork: "tcp",

+				ServerCert:  api.CertInfo{CertFile: certFileName, KeyFile: keyFileName},

+				NamedCertificates: []api.NamedCertificate{

+					{Names: []string{""}, CertInfo: api.CertInfo{CertFile: certFileName, KeyFile: keyFileName}},

+				},

+			},

+			ExpectedErrors: []string{"namedCertificates[0].names[0]: required"},

+		},

+

+		"namedCertificates with unmatched DNS name": {

+			ServingInfo: api.ServingInfo{

+				BindAddress: "0.0.0.0:1234",

+				BindNetwork: "tcp",

+				ServerCert:  api.CertInfo{CertFile: certFileName, KeyFile: keyFileName},

+				NamedCertificates: []api.NamedCertificate{

+					{Names: []string{"badexample.com"}, CertInfo: api.CertInfo{CertFile: certFileName, KeyFile: keyFileName}},

+				},

+			},

+			ExpectedWarnings: []string{"namedCertificates[0].names[0]: invalid"},

+		},

+		"namedCertificates with non-DNS names": {

+			ServingInfo: api.ServingInfo{

+				BindAddress: "0.0.0.0:1234",

+				BindNetwork: "tcp",

+				ServerCert:  api.CertInfo{CertFile: certFileName, KeyFile: keyFileName},

+				NamedCertificates: []api.NamedCertificate{

+					{Names: []string{"foo bar.com"}, CertInfo: api.CertInfo{CertFile: certFileName, KeyFile: keyFileName}},

+				},

+			},

+			ExpectedErrors: []string{

+				"namedCertificates[0].names[0]: invalid value 'foo bar.com', Details: must be a valid DNS name",

+			},

+		},

+	}

+

+	for k, tc := range testcases {

+		result := ValidateServingInfo(tc.ServingInfo)

+

+		if len(tc.ExpectedErrors) != len(result.Errors) {

+			t.Errorf("%s: Expected %d errors, got %d", k, len(tc.ExpectedErrors), len(result.Errors))

+			for _, e := range tc.ExpectedErrors {

+				t.Logf("\tExpected error: %s", e)

+			}

+			for _, r := range result.Errors {

+				t.Logf("\tActual error: %s", r.Error())

+			}

+			continue

+		}

+		for i, r := range result.Errors {

+			if !strings.Contains(r.Error(), tc.ExpectedErrors[i]) {

+				t.Errorf("%s: Expected error containing %s, got %s", k, tc.ExpectedErrors[i], r.Error())

+			}

+		}

+

+		if len(tc.ExpectedWarnings) != len(result.Warnings) {

+			t.Errorf("%s: Expected %d warning, got %d", k, len(tc.ExpectedWarnings), len(result.Warnings))

+			for _, e := range tc.ExpectedErrors {

+				t.Logf("\tExpected warning: %s", e)

+			}

+			for _, r := range result.Warnings {

+				t.Logf("\tActual warning: %s", r.Error())

+			}

+			continue

+		}

+		for i, r := range result.Warnings {

+			if !strings.Contains(r.Error(), tc.ExpectedWarnings[i]) {

+				t.Errorf("%s: Expected warning containing %s, got %s", k, tc.ExpectedWarnings[i], r.Error())

+			}

+		}

+	}

+}

+

+// localhostCert is a PEM-encoded TLS cert with SAN IPs

+// "127.0.0.1" and "[::1]", expiring at the last second of 2049 (the end

+// of ASN.1 time).

+// generated from src/crypto/tls:

+// go run generate_cert.go  --rsa-bits 512 --host 127.0.0.1,::1,example.com --ca --start-date "Jan 1 00:00:00 1970" --duration=1000000h

+var localhostCert = []byte(`-----BEGIN CERTIFICATE-----

+MIIBdzCCASOgAwIBAgIBADALBgkqhkiG9w0BAQUwEjEQMA4GA1UEChMHQWNtZSBD

+bzAeFw03MDAxMDEwMDAwMDBaFw00OTEyMzEyMzU5NTlaMBIxEDAOBgNVBAoTB0Fj

+bWUgQ28wWjALBgkqhkiG9w0BAQEDSwAwSAJBAN55NcYKZeInyTuhcCwFMhDHCmwa

+IUSdtXdcbItRB/yfXGBhiex00IaLXQnSU+QZPRZWYqeTEbFSgihqi1PUDy8CAwEA

+AaNoMGYwDgYDVR0PAQH/BAQDAgCkMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1Ud