@@ -112,7 +112,7 @@ do

     SERVER_HOSTNAME_LIST="${SERVER_HOSTNAME_LIST},${IP_ADDRESS}"

 done <<< "${ALL_IP_ADDRESSES}"

-openshift admin create-master-certs \

+openshift admin ca create-master-certs \

   --overwrite=false \

   --cert-dir="${MASTER_CONFIG_DIR}" \

   --hostnames="${SERVER_HOSTNAME_LIST}" \

@@ -283,7 +283,15 @@ echo "templates: ok"

 [ "$(openshift kubectl 2>&1 | grep 'Kubernetes cluster')" ]

 [ "$(oadm 2>&1 | grep 'OpenShift Administrative Commands')" ]

 [ "$(openshift admin 2>&1 | grep 'OpenShift Administrative Commands')" ]

+[ "$(oadm | grep 'Basic Commands:')" ]

+[ "$(oadm | grep 'Install Commands:')" ]

+[ "$(oadm ca | grep 'Manage certificates')" ]

 [ "$(openshift start kubernetes 2>&1 | grep 'Kubernetes server components')" ]

+# check deprecated admin cmds for backward compatibility

+[ "$(oadm create-master-certs -h 2>&1 | grep 'Create keys and certificates')" ]

+[ "$(oadm create-key-pair -h 2>&1 | grep 'Create a 2048-bit RSA key pair')" ]

+[ "$(oadm create-server-cert -h 2>&1 | grep 'Create a key and server certificate')" ]

+[ "$(oadm create-signer-cert -h 2>&1 | grep 'Create a self-signed CA')" ]

 # help for root commands with --help flag must be consistent

 [ "$(openshift --help 2>&1 | grep 'OpenShift Application Platform')" ]

@@ -197,7 +197,7 @@ do

 	SERVER_HOSTNAME_LIST="${SERVER_HOSTNAME_LIST},${IP_ADDRESS}"

 done <<< "${ALL_IP_ADDRESSES}"

-openshift admin create-master-certs \

+openshift admin ca create-master-certs \

 	--overwrite=false \

 	--cert-dir="${MASTER_CONFIG_DIR}" \

 	--hostnames="${SERVER_HOSTNAME_LIST}" \

@@ -60,7 +60,7 @@ start_server() {

   done <<< "${ALL_IP_ADDRESSES}"

   echo "[INFO] Create certificates for the OpenShift master"

-  env "PATH=${PATH}" openshift admin create-master-certs \

+  env "PATH=${PATH}" openshift admin ca create-master-certs \

     --overwrite=false \

     --cert-dir="${MASTER_CONFIG_DIR}" \

     --hostnames="${SERVER_HOSTNAME_LIST}" \

@@ -6,6 +6,7 @@ import (

 	"github.com/spf13/cobra"

+	"github.com/openshift/origin/pkg/cmd/admin/cert"

 	"github.com/openshift/origin/pkg/cmd/admin/node"

 	"github.com/openshift/origin/pkg/cmd/admin/policy"

 	"github.com/openshift/origin/pkg/cmd/admin/project"

@@ -38,31 +39,68 @@ func NewCommandAdmin(name, fullName string, out io.Writer) *cobra.Command {

 	f := clientcmd.New(cmds.PersistentFlags())

-	cmds.AddCommand(project.NewCmdNewProject(project.NewProjectRecommendedName, fullName+" "+project.NewProjectRecommendedName, f, out))

-	cmds.AddCommand(policy.NewCmdPolicy(policy.PolicyRecommendedName, fullName+" "+policy.PolicyRecommendedName, f, out))

-	cmds.AddCommand(exipfailover.NewCmdIPFailoverConfig(f, fullName, "ipfailover", out))

-	cmds.AddCommand(router.NewCmdRouter(f, fullName, "router", out))

-	cmds.AddCommand(registry.NewCmdRegistry(f, fullName, "registry", out))

-	cmds.AddCommand(buildchain.NewCmdBuildChain(f, fullName, "build-chain"))

-	cmds.AddCommand(node.NewCommandManageNode(f, node.ManageNodeCommandName, fullName+" "+node.ManageNodeCommandName, out))

-	cmds.AddCommand(cmd.NewCmdConfig(fullName, "config"))

-	cmds.AddCommand(prune.NewCommandPrune(prune.PruneRecommendedName, fullName+" "+prune.PruneRecommendedName, f, out))

+	groups := templates.CommandGroups{

+		{

+			Message: "Basic Commands:",

+			Commands: []*cobra.Command{

+				project.NewCmdNewProject(project.NewProjectRecommendedName, fullName+" "+project.NewProjectRecommendedName, f, out),

+				policy.NewCmdPolicy(policy.PolicyRecommendedName, fullName+" "+policy.PolicyRecommendedName, f, out),

+			},

+		},

+		{

+			Message: "Install Commands:",

+			Commands: []*cobra.Command{

+				router.NewCmdRouter(f, fullName, "router", out),

+				exipfailover.NewCmdIPFailoverConfig(f, fullName, "ipfailover", out),

+				registry.NewCmdRegistry(f, fullName, "registry", out),

+			},

+		},

+		{

+			Message: "Maintenance Commands:",

+			Commands: []*cobra.Command{

+				buildchain.NewCmdBuildChain(f, fullName, "build-chain"),

+				node.NewCommandManageNode(f, node.ManageNodeCommandName, fullName+" "+node.ManageNodeCommandName, out),

+				prune.NewCommandPrune(prune.PruneRecommendedName, fullName+" "+prune.PruneRecommendedName, f, out),

+			},

+		},

+		{

+			Message: "Settings Commands:",

+			Commands: []*cobra.Command{

+				cmd.NewCmdConfig(fullName, "config"),

-	// TODO: these probably belong in a sub command

-	cmds.AddCommand(admin.NewCommandCreateKubeConfig(admin.CreateKubeConfigCommandName, fullName+" "+admin.CreateKubeConfigCommandName, out))

-	cmds.AddCommand(admin.NewCommandCreateBootstrapPolicyFile(admin.CreateBootstrapPolicyFileCommand, fullName+" "+admin.CreateBootstrapPolicyFileCommand, out))

-	cmds.AddCommand(admin.NewCommandCreateBootstrapProjectTemplate(f, admin.CreateBootstrapProjectTemplateCommand, fullName+" "+admin.CreateBootstrapProjectTemplateCommand, out))

-	cmds.AddCommand(admin.NewCommandOverwriteBootstrapPolicy(admin.OverwriteBootstrapPolicyCommandName, fullName+" "+admin.OverwriteBootstrapPolicyCommandName, fullName+" "+admin.CreateBootstrapPolicyFileCommand, out))

-	cmds.AddCommand(admin.NewCommandNodeConfig(admin.NodeConfigCommandName, fullName+" "+admin.NodeConfigCommandName, out))

-	// TODO: these should be rolled up together

-	cmds.AddCommand(admin.NewCommandCreateMasterCerts(admin.CreateMasterCertsCommandName, fullName+" "+admin.CreateMasterCertsCommandName, out))

-	cmds.AddCommand(admin.NewCommandCreateClient(admin.CreateClientCommandName, fullName+" "+admin.CreateClientCommandName, out))

-	cmds.AddCommand(admin.NewCommandCreateKeyPair(admin.CreateKeyPairCommandName, fullName+" "+admin.CreateKeyPairCommandName, out))

-	cmds.AddCommand(admin.NewCommandCreateServerCert(admin.CreateServerCertCommandName, fullName+" "+admin.CreateServerCertCommandName, out))

-	cmds.AddCommand(admin.NewCommandCreateSignerCert(admin.CreateSignerCertCommandName, fullName+" "+admin.CreateSignerCertCommandName, out))

+				// TODO: these probably belong in a sub command

+				admin.NewCommandCreateKubeConfig(admin.CreateKubeConfigCommandName, fullName+" "+admin.CreateKubeConfigCommandName, out),

+				admin.NewCommandCreateClient(admin.CreateClientCommandName, fullName+" "+admin.CreateClientCommandName, out),

+			},

+		},

+		{

+			Message: "Advanced Commands:",

+			Commands: []*cobra.Command{

+				admin.NewCommandCreateBootstrapProjectTemplate(f, admin.CreateBootstrapProjectTemplateCommand, fullName+" "+admin.CreateBootstrapProjectTemplateCommand, out),

+				admin.NewCommandCreateBootstrapPolicyFile(admin.CreateBootstrapPolicyFileCommand, fullName+" "+admin.CreateBootstrapPolicyFileCommand, out),

+				admin.NewCommandOverwriteBootstrapPolicy(admin.OverwriteBootstrapPolicyCommandName, fullName+" "+admin.OverwriteBootstrapPolicyCommandName, fullName+" "+admin.CreateBootstrapPolicyFileCommand, out),

+				admin.NewCommandNodeConfig(admin.NodeConfigCommandName, fullName+" "+admin.NodeConfigCommandName, out),

+				cert.NewCmdCert(cert.CertRecommendedName, fullName+" "+cert.CertRecommendedName, out),

+			},

+		},

+	}

+

+	groups.Add(cmds)

+	templates.ActsAsRootCommand(cmds, groups...)

-	// TODO: use groups

-	templates.ActsAsRootCommand(cmds)

+	// Deprecated commands that are bundled with the binary but not displayed to end users directly

+	deprecatedCommands := []*cobra.Command{

+		admin.NewCommandCreateMasterCerts(admin.CreateMasterCertsCommandName, fullName+" "+admin.CreateMasterCertsCommandName, out),

+		admin.NewCommandCreateKeyPair(admin.CreateKeyPairCommandName, fullName+" "+admin.CreateKeyPairCommandName, out),

+		admin.NewCommandCreateServerCert(admin.CreateServerCertCommandName, fullName+" "+admin.CreateServerCertCommandName, out),

+		admin.NewCommandCreateSignerCert(admin.CreateSignerCertCommandName, fullName+" "+admin.CreateSignerCertCommandName, out),

+	}

+	for _, cmd := range deprecatedCommands {

+		// Unsetting Short description will not show this command in help

+		cmd.Short = ""

+		cmd.Deprecated = fmt.Sprintf("Use '%s ca' instead.", fullName)

+		cmds.AddCommand(cmd)

+	}

 	if name == fullName {

 		cmds.AddCommand(version.NewVersionCommand(fullName))

new file mode 100644

@@ -0,0 +1,30 @@

+package cert

+

+import (

+	"io"

+

+	"github.com/spf13/cobra"

+

+	"github.com/openshift/origin/pkg/cmd/server/admin"

+	"github.com/openshift/origin/pkg/cmd/util"

+)

+

+const CertRecommendedName = "ca"

+

+// NewCmdCert implements the OpenShift cli ca command

+func NewCmdCert(name, fullName string, out io.Writer) *cobra.Command {

+	// Parent command to which all subcommands are added.

+	cmds := &cobra.Command{

+		Use:   name,

+		Short: "Manage certificates and keys",

+		Long:  `Manage certificates and keys`,

+		Run:   util.DefaultSubCommandRun(out),

+	}

+

+	cmds.AddCommand(admin.NewCommandCreateMasterCerts(admin.CreateMasterCertsCommandName, fullName+" "+admin.CreateMasterCertsCommandName, out))

+	cmds.AddCommand(admin.NewCommandCreateKeyPair(admin.CreateKeyPairCommandName, fullName+" "+admin.CreateKeyPairCommandName, out))

+	cmds.AddCommand(admin.NewCommandCreateServerCert(admin.CreateServerCertCommandName, fullName+" "+admin.CreateServerCertCommandName, out))

+	cmds.AddCommand(admin.NewCommandCreateSignerCert(admin.CreateSignerCertCommandName, fullName+" "+admin.CreateSignerCertCommandName, out))

+

+	return cmds

+}

@@ -52,7 +52,7 @@ server cert and run the command to fill it in:

             --public-master=https://external.master.fqdn:8443 \

             --hostnames=external.master.fqdn,internal.master.fqdn,localhost,127.0.0.1,172.17.42.1,kubernetes.default.local

-Alternatively, use the related "create-server-cert" command to explicitly

+Alternatively, use the related "ca create-server-cert" command to explicitly

 create a certificate.

 Regardless of --overwrite, the master server key/cert will be updated 

@@ -81,7 +81,7 @@ func NewCommandCreateMasterCerts(commandName string, fullName string, out io.Wri

 	cmd := &cobra.Command{

 		Use:   commandName,

-		Short: "Create certificates for an OpenShift master",

+		Short: "Create certificates and keys for an OpenShift master",

 		Long:  fmt.Sprintf(masterCertLong, fullName),

 		Run: func(cmd *cobra.Command, args []string) {

 			if err := options.Validate(args); err != nil {

@@ -52,7 +52,7 @@ func NewCommandCreateSignerCert(commandName string, fullName string, out io.Writ

 	cmd := &cobra.Command{

 		Use:   commandName,

-		Short: "Create a signer (certificate authority/CA) certificate",

+		Short: "Create a signer (certificate authority/CA) certificate and key",

 		Long:  createSignerLong,

 		Run: func(cmd *cobra.Command, args []string) {

 			if err := options.Validate(args); err != nil {

@@ -40,7 +40,8 @@ func (g CommandGroups) Has(c *cobra.Command) bool {

 func AddAdditionalCommands(g CommandGroups, message string, cmds []*cobra.Command) CommandGroups {

 	group := CommandGroup{Message: message}

 	for _, c := range cmds {

-		if !g.Has(c) {

+		// Don't show commands that has no short description

+		if !g.Has(c) && len(c.Short) != 0 {

 			group.Commands = append(group.Commands, c)

 		}

 	}

@@ -398,9 +398,9 @@ _oadm_policy()

     must_have_one_noun=()

 }

-_oadm_ipfailover()

+_oadm_router()

 {

-    last_command="oadm_ipfailover"

+    last_command="oadm_router"

     commands=()

     flags=()

@@ -412,35 +412,35 @@ _oadm_ipfailover()

     flags+=("--credentials=")

     flags_with_completion+=("--credentials")

     flags_completion+=("__handle_filename_extension_flag kubeconfig")

+    flags+=("--default-cert=")

+    flags+=("--dry-run")

     flags+=("--help")

     flags+=("-h")

     flags+=("--images=")

-    flags+=("--interface=")

-    two_word_flags+=("-i")

+    flags+=("--labels=")

     flags+=("--latest-images")

     flags+=("--no-headers")

     flags+=("--output=")

     two_word_flags+=("-o")

     flags+=("--output-version=")

+    flags+=("--ports=")

     flags+=("--replicas=")

-    two_word_flags+=("-r")

     flags+=("--selector=")

-    two_word_flags+=("-l")

     flags+=("--service-account=")

+    flags+=("--stats-password=")

+    flags+=("--stats-port=")

+    flags+=("--stats-user=")

     flags+=("--template=")

     two_word_flags+=("-t")

     flags+=("--type=")

-    flags+=("--virtual-ips=")

-    flags+=("--watch-port=")

-    two_word_flags+=("-w")

     must_have_one_flag=()

     must_have_one_noun=()

 }

-_oadm_router()

+_oadm_ipfailover()

 {

-    last_command="oadm_router"

+    last_command="oadm_ipfailover"

     commands=()

     flags=()

@@ -452,27 +452,27 @@ _oadm_router()

     flags+=("--credentials=")

     flags_with_completion+=("--credentials")

     flags_completion+=("__handle_filename_extension_flag kubeconfig")

-    flags+=("--default-cert=")

-    flags+=("--dry-run")

     flags+=("--help")

     flags+=("-h")

     flags+=("--images=")

-    flags+=("--labels=")

+    flags+=("--interface=")

+    two_word_flags+=("-i")

     flags+=("--latest-images")

     flags+=("--no-headers")

     flags+=("--output=")

     two_word_flags+=("-o")

     flags+=("--output-version=")

-    flags+=("--ports=")

     flags+=("--replicas=")

+    two_word_flags+=("-r")

     flags+=("--selector=")

+    two_word_flags+=("-l")

     flags+=("--service-account=")

-    flags+=("--stats-password=")

-    flags+=("--stats-port=")

-    flags+=("--stats-user=")

     flags+=("--template=")

     two_word_flags+=("-t")

     flags+=("--type=")

+    flags+=("--virtual-ips=")

+    flags+=("--watch-port=")

+    two_word_flags+=("-w")

     must_have_one_flag=()

     must_have_one_noun=()

@@ -567,9 +567,9 @@ _oadm_manage-node()

     must_have_one_noun=()

 }

-_oadm_config_view()

+_oadm_prune_builds()

 {

-    last_command="oadm_config_view"

+    last_command="oadm_prune_builds"

     commands=()

     flags=()

@@ -577,26 +577,21 @@ _oadm_config_view()

     flags_with_completion=()

     flags_completion=()

-    flags+=("--flatten")

+    flags+=("--confirm")

     flags+=("--help")

     flags+=("-h")

-    flags+=("--merge")

-    flags+=("--minify")

-    flags+=("--no-headers")

-    flags+=("--output=")

-    two_word_flags+=("-o")

-    flags+=("--output-version=")

-    flags+=("--raw")

-    flags+=("--template=")

-    two_word_flags+=("-t")

+    flags+=("--keep-complete=")

+    flags+=("--keep-failed=")

+    flags+=("--keep-younger-than=")

+    flags+=("--orphans")

     must_have_one_flag=()

     must_have_one_noun=()

 }

-_oadm_config_set-cluster()

+_oadm_prune_deployments()

 {

-    last_command="oadm_config_set-cluster"

+    last_command="oadm_prune_deployments"

     commands=()

     flags=()

@@ -604,21 +599,21 @@ _oadm_config_set-cluster()

     flags_with_completion=()

     flags_completion=()

-    flags+=("--api-version=")

-    flags+=("--certificate-authority=")

-    flags+=("--embed-certs")

+    flags+=("--confirm")

     flags+=("--help")

     flags+=("-h")

-    flags+=("--insecure-skip-tls-verify")

-    flags+=("--server=")

+    flags+=("--keep-complete=")

+    flags+=("--keep-failed=")

+    flags+=("--keep-younger-than=")

+    flags+=("--orphans")

     must_have_one_flag=()

     must_have_one_noun=()

 }

-_oadm_config_set-credentials()

+_oadm_prune_images()

 {

-    last_command="oadm_config_set-credentials"

+    last_command="oadm_prune_images"

     commands=()

     flags=()

@@ -626,42 +621,41 @@ _oadm_config_set-credentials()

     flags_with_completion=()

     flags_completion=()

-    flags+=("--client-certificate=")

-    flags+=("--client-key=")

-    flags+=("--embed-certs")

+    flags+=("--certificate-authority=")

+    flags+=("--confirm")

     flags+=("--help")

     flags+=("-h")

-    flags+=("--password=")

-    flags+=("--token=")

-    flags+=("--username=")

+    flags+=("--keep-tag-revisions=")

+    flags+=("--keep-younger-than=")

+    flags+=("--registry-url=")

     must_have_one_flag=()

     must_have_one_noun=()

 }

-_oadm_config_set-context()

+_oadm_prune()

 {

-    last_command="oadm_config_set-context"

+    last_command="oadm_prune"

     commands=()

+    commands+=("builds")

+    commands+=("deployments")

+    commands+=("images")

     flags=()

     two_word_flags=()

     flags_with_completion=()

     flags_completion=()

-    flags+=("--cluster=")

     flags+=("--help")

     flags+=("-h")

-    flags+=("--namespace=")

-    flags+=("--user=")

     must_have_one_flag=()

     must_have_one_noun=()

 }

-_oadm_config_set()

+_oadm_config_view()

 {

-    last_command="oadm_config_set"

+    last_command="oadm_config_view"

     commands=()

     flags=()

@@ -669,16 +663,26 @@ _oadm_config_set()

     flags_with_completion=()

     flags_completion=()

+    flags+=("--flatten")

     flags+=("--help")

     flags+=("-h")

+    flags+=("--merge")

+    flags+=("--minify")

+    flags+=("--no-headers")

+    flags+=("--output=")

+    two_word_flags+=("-o")

+    flags+=("--output-version=")

+    flags+=("--raw")

+    flags+=("--template=")

+    two_word_flags+=("-t")

     must_have_one_flag=()

     must_have_one_noun=()

 }

-_oadm_config_unset()

+_oadm_config_set-cluster()

 {

-    last_command="oadm_config_unset"

+    last_command="oadm_config_set-cluster"

     commands=()

     flags=()

@@ -686,16 +690,21 @@ _oadm_config_unset()

     flags_with_completion=()

     flags_completion=()

+    flags+=("--api-version=")

+    flags+=("--certificate-authority=")

+    flags+=("--embed-certs")

     flags+=("--help")

     flags+=("-h")

+    flags+=("--insecure-skip-tls-verify")

+    flags+=("--server=")

     must_have_one_flag=()

     must_have_one_noun=()

 }

-_oadm_config_use-context()

+_oadm_config_set-credentials()

 {

-    last_command="oadm_config_use-context"

+    last_command="oadm_config_set-credentials"

     commands=()

     flags=()

@@ -703,41 +712,42 @@ _oadm_config_use-context()

     flags_with_completion=()

     flags_completion=()

+    flags+=("--client-certificate=")

+    flags+=("--client-key=")

+    flags+=("--embed-certs")

     flags+=("--help")

     flags+=("-h")

+    flags+=("--password=")

+    flags+=("--token=")

+    flags+=("--username=")

     must_have_one_flag=()

     must_have_one_noun=()

 }

-_oadm_config()

+_oadm_config_set-context()

 {

-    last_command="oadm_config"

+    last_command="oadm_config_set-context"

     commands=()

-    commands+=("view")

-    commands+=("set-cluster")

-    commands+=("set-credentials")

-    commands+=("set-context")

-    commands+=("set")

-    commands+=("unset")

-    commands+=("use-context")

     flags=()

     two_word_flags=()

     flags_with_completion=()

     flags_completion=()

-    flags+=("--config=")

+    flags+=("--cluster=")

     flags+=("--help")

     flags+=("-h")

+    flags+=("--namespace=")

+    flags+=("--user=")

     must_have_one_flag=()

     must_have_one_noun=()

 }

-_oadm_prune_builds()

+_oadm_config_set()

 {

-    last_command="oadm_prune_builds"

+    last_command="oadm_config_set"

     commands=()

     flags=()

@@ -745,21 +755,16 @@ _oadm_prune_builds()

     flags_with_completion=()

     flags_completion=()

-    flags+=("--confirm")

     flags+=("--help")

     flags+=("-h")

-    flags+=("--keep-complete=")

-    flags+=("--keep-failed=")

-    flags+=("--keep-younger-than=")

-    flags+=("--orphans")

     must_have_one_flag=()

     must_have_one_noun=()

 }

-_oadm_prune_deployments()

+_oadm_config_unset()

 {

-    last_command="oadm_prune_deployments"

+    last_command="oadm_config_unset"

     commands=()

     flags=()

@@ -767,21 +772,16 @@ _oadm_prune_deployments()

     flags_with_completion=()

     flags_completion=()

-    flags+=("--confirm")

     flags+=("--help")

     flags+=("-h")

-    flags+=("--keep-complete=")

-    flags+=("--keep-failed=")

-    flags+=("--keep-younger-than=")

-    flags+=("--orphans")

     must_have_one_flag=()

     must_have_one_noun=()

 }

-_oadm_prune_images()

+_oadm_config_use-context()

 {

-    last_command="oadm_prune_images"

+    last_command="oadm_config_use-context"

     commands=()

     flags=()

@@ -789,31 +789,31 @@ _oadm_prune_images()

     flags_with_completion=()

     flags_completion=()

-    flags+=("--certificate-authority=")

-    flags+=("--confirm")

     flags+=("--help")

     flags+=("-h")

-    flags+=("--keep-tag-revisions=")

-    flags+=("--keep-younger-than=")

-    flags+=("--registry-url=")

     must_have_one_flag=()

     must_have_one_noun=()

 }

-_oadm_prune()

+_oadm_config()

 {

-    last_command="oadm_prune"

+    last_command="oadm_config"

     commands=()

-    commands+=("builds")

-    commands+=("deployments")

-    commands+=("images")

+    commands+=("view")

+    commands+=("set-cluster")

+    commands+=("set-credentials")

+    commands+=("set-context")

+    commands+=("set")

+    commands+=("unset")

+    commands+=("use-context")

     flags=()

     two_word_flags=()

     flags_with_completion=()

     flags_completion=()

+    flags+=("--config=")

     flags+=("--help")

     flags+=("-h")

@@ -853,9 +853,9 @@ _oadm_create-kubeconfig()

     must_have_one_noun=()

 }

-_oadm_create-bootstrap-policy-file()

+_oadm_create-api-client-config()

 {

-    last_command="oadm_create-bootstrap-policy-file"

+    last_command="oadm_create-api-client-config"

     commands=()

     flags=()

@@ -863,12 +863,28 @@ _oadm_create-bootstrap-policy-file()

     flags_with_completion=()

     flags_completion=()

-    flags+=("--filename=")

-    flags_with_completion+=("--filename")

+    flags+=("--basename=")

+    flags+=("--certificate-authority=")

+    flags_with_completion+=("--certificate-authority")

     flags_completion+=("_filedir")

+    flags+=("--client-dir=")

+    flags_with_completion+=("--client-dir")

+    flags_completion+=("_filedir")

+    flags+=("--groups=")

     flags+=("--help")

     flags+=("-h")

-    flags+=("--openshift-namespace=")

+    flags+=("--master=")

+    flags+=("--public-master=")

+    flags+=("--signer-cert=")

+    flags_with_completion+=("--signer-cert")

+    flags_completion+=("_filedir")

+    flags+=("--signer-key=")

+    flags_with_completion+=("--signer-key")

+    flags_completion+=("_filedir")

+    flags+=("--signer-serial=")

+    flags_with_completion+=("--signer-serial")

+    flags_completion+=("_filedir")

+    flags+=("--user=")

     must_have_one_flag=()

     must_have_one_noun=()

@@ -898,6 +914,27 @@ _oadm_create-bootstrap-project-template()

     must_have_one_noun=()

 }

+_oadm_create-bootstrap-policy-file()

+{

+    last_command="oadm_create-bootstrap-policy-file"

+    commands=()

+

+    flags=()

+    two_word_flags=()

+    flags_with_completion=()

+    flags_completion=()

+

+    flags+=("--filename=")

+    flags_with_completion+=("--filename")

+    flags_completion+=("_filedir")

+    flags+=("--help")

+    flags+=("-h")

+    flags+=("--openshift-namespace=")

+

+    must_have_one_flag=()

+    must_have_one_noun=()

+}

+

 _oadm_overwrite-policy()

 {

     last_command="oadm_overwrite-policy"

@@ -983,9 +1020,9 @@ _oadm_create-node-config()

     must_have_one_noun=()

 }

-_oadm_create-master-certs()

+_oadm_ca_create-master-certs()

 {

-    last_command="oadm_create-master-certs"

+    last_command="oadm_ca_create-master-certs"

     commands=()

     flags=()

@@ -1008,46 +1045,9 @@ _oadm_create-master-certs()

     must_have_one_noun=()

 }

-_oadm_create-api-client-config()

-{

-    last_command="oadm_create-api-client-config"

-    commands=()

-

-    flags=()

-    two_word_flags=()

-    flags_with_completion=()

-    flags_completion=()

-

-    flags+=("--basename=")

-    flags+=("--certificate-authority=")

-    flags_with_completion+=("--certificate-authority")

-    flags_completion+=("_filedir")

-    flags+=("--client-dir=")

-    flags_with_completion+=("--client-dir")

-    flags_completion+=("_filedir")

-    flags+=("--groups=")

-    flags+=("--help")

-    flags+=("-h")

-    flags+=("--master=")

-    flags+=("--public-master=")

-    flags+=("--signer-cert=")

-    flags_with_completion+=("--signer-cert")

-    flags_completion+=("_filedir")

-    flags+=("--signer-key=")

-    flags_with_completion+=("--signer-key")

-    flags_completion+=("_filedir")

-    flags+=("--signer-serial=")

-    flags_with_completion+=("--signer-serial")

-    flags_completion+=("_filedir")

-    flags+=("--user=")

-

-    must_have_one_flag=()

-    must_have_one_noun=()

-}

-

-_oadm_create-key-pair()

+_oadm_ca_create-key-pair()

 {

-    last_command="oadm_create-key-pair"

+    last_command="oadm_ca_create-key-pair"

     commands=()

     flags=()

@@ -1069,9 +1069,9 @@ _oadm_create-key-pair()

     must_have_one_noun=()

 }

-_oadm_create-server-cert()

+_oadm_ca_create-server-cert()

 {

-    last_command="oadm_create-server-cert"

+    last_command="oadm_ca_create-server-cert"

     commands=()

     flags=()

@@ -1103,9 +1103,9 @@ _oadm_create-server-cert()

     must_have_one_noun=()

 }

-_oadm_create-signer-cert()

+_oadm_ca_create-signer-cert()

 {

-    last_command="oadm_create-signer-cert"

+    last_command="oadm_ca_create-signer-cert"

     commands=()

     flags=()

@@ -1131,6 +1131,27 @@ _oadm_create-signer-cert()

     must_have_one_noun=()

 }

+_oadm_ca()

+{

+    last_command="oadm_ca"

+    commands=()

+    commands+=("create-master-certs")

+    commands+=("create-key-pair")

+    commands+=("create-server-cert")

+    commands+=("create-signer-cert")

+

+    flags=()

+    two_word_flags=()

+    flags_with_completion=()

+    flags_completion=()

+

+    flags+=("--help")

+    flags+=("-h")

+

+    must_have_one_flag=()

+    must_have_one_noun=()

+}

+

 _oadm_options()

 {

     last_command="oadm_options"

@@ -1154,23 +1175,20 @@ _oadm()

     commands=()

     commands+=("new-project")

     commands+=("policy")

-    commands+=("ipfailover")

     commands+=("router")

+    commands+=("ipfailover")

     commands+=("registry")

     commands+=("build-chain")

     commands+=("manage-node")

-    commands+=("config")

     commands+=("prune")

+    commands+=("config")

     commands+=("create-kubeconfig")

-    commands+=("create-bootstrap-policy-file")

+    commands+=("create-api-client-config")

     commands+=("create-bootstrap-project-template")

+    commands+=("create-bootstrap-policy-file")

     commands+=("overwrite-policy")

     commands+=("create-node-config")

-    commands+=("create-master-certs")

-    commands+=("create-api-client-config")

-    commands+=("create-key-pair")

-    commands+=("create-server-cert")

-    commands+=("create-signer-cert")

+    commands+=("ca")

     commands+=("options")

     flags=()

@@ -775,9 +775,9 @@ _openshift_admin_policy()

     must_have_one_noun=()

 }

-_openshift_admin_ipfailover()

+_openshift_admin_router()

 {

-    last_command="openshift_admin_ipfailover"

+    last_command="openshift_admin_router"

     commands=()

     flags=()

@@ -789,35 +789,35 @@ _openshift_admin_ipfailover()

     flags+=("--credentials=")

     flags_with_completion+=("--credentials")

     flags_completion+=("__handle_filename_extension_flag kubeconfig")

+    flags+=("--default-cert=")

+    flags+=("--dry-run")

     flags+=("--help")

     flags+=("-h")

     flags+=("--images=")

-    flags+=("--interface=")

-    two_word_flags+=("-i")

+    flags+=("--labels=")

     flags+=("--latest-images")

     flags+=("--no-headers")

     flags+=("--output=")

     two_word_flags+=("-o")

     flags+=("--output-version=")

+    flags+=("--ports=")

     flags+=("--replicas=")

-    two_word_flags+=("-r")

     flags+=("--selector=")

-    two_word_flags+=("-l")