diff --git a/cluster/gce/config-default.sh b/cluster/gce/config-default.sh
index 041ef3d2d57..2161fe73831 100755
--- a/cluster/gce/config-default.sh
+++ b/cluster/gce/config-default.sh
@@ -113,7 +113,7 @@ if [[ "${ENABLE_DAEMONSETS}" == "true" ]]; then
 fi
 
 # Admission Controllers to invoke prior to persisting objects in cluster
-ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota
+ADMISSION_CONTROL=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota
 
 # Optional: if set to true kube-up will automatically check for existing resources and clean them up.
 KUBE_UP_AUTOMATIC_CLEANUP=${KUBE_UP_AUTOMATIC_CLEANUP:-false}
diff --git a/cluster/gce/util.sh b/cluster/gce/util.sh
index f7a5bafe038..39f7d4acc72 100755
--- a/cluster/gce/util.sh
+++ b/cluster/gce/util.sh
@@ -713,7 +713,7 @@ function kube-up {
 
   # curl in mavericks is borked.
   secure=""
-  if which sw_vers > /dev/null; then
+  if which sw_vers >& /dev/null; then
     if [[ $(sw_vers | grep ProductVersion | awk '{print $2}') = "10.9."* ]]; then
       secure="--insecure"
     fi
diff --git a/pkg/kubectl/cmd/config/config.go b/pkg/kubectl/cmd/config/config.go
index d73ea26804e..9c8fd465ba3 100644
--- a/pkg/kubectl/cmd/config/config.go
+++ b/pkg/kubectl/cmd/config/config.go
@@ -225,6 +225,7 @@ func ModifyConfig(configAccess ConfigAccess, newConfig clientcmdapi.Config, rela
 
 			configToWrite := getConfigFromFileOrDie(destinationFile)
 			t := *cluster
+
 			configToWrite.Clusters[key] = &t
 			configToWrite.Clusters[key].LocationOfOrigin = destinationFile
 			if relativizePaths {
@@ -429,6 +430,10 @@ func getConfigFromFileOrDie(filename string) *clientcmdapi.Config {
 		return clientcmdapi.NewConfig()
 	}
 
+	if config.Clusters == nil {
+		config.Clusters = map[string]*clientcmdapi.Cluster{}
+	}
+
 	return config
 }