diff --git a/cmd/kube-apiserver/app/server.go b/cmd/kube-apiserver/app/server.go
index 76309fbca48..2a7b0364d09 100644
--- a/cmd/kube-apiserver/app/server.go
+++ b/cmd/kube-apiserver/app/server.go
@@ -310,7 +310,7 @@ func Run(s *options.APIServer) error {
 	genericConfig.EnableOpenAPISupport = true
 
 	config := &master.Config{
-		Config: genericConfig,
+		GenericConfig: genericConfig,
 
 		StorageFactory:          storageFactory,
 		EnableWatchCache:        s.EnableWatchCache,
@@ -330,7 +330,7 @@ func Run(s *options.APIServer) error {
 		cachesize.SetWatchCacheSizes(s.WatchCacheSizes)
 	}
 
-	m, err := master.New(config)
+	m, err := config.Complete().New()
 	if err != nil {
 		return err
 	}
diff --git a/examples/apiserver/apiserver.go b/examples/apiserver/apiserver.go
index 3be89254f32..fd8b174a957 100644
--- a/examples/apiserver/apiserver.go
+++ b/examples/apiserver/apiserver.go
@@ -70,7 +70,7 @@ func Run(serverOptions *genericoptions.ServerRunOptions) error {
 	config := genericapiserver.NewConfig(serverOptions)
 	config.Authorizer = authorizer.NewAlwaysAllowAuthorizer()
 	config.Serializer = api.Codecs
-	s, err := config.New()
+	s, err := config.Complete().New()
 	if err != nil {
 		return fmt.Errorf("Error in bringing up the server: %v", err)
 	}
diff --git a/federation/cmd/federation-apiserver/app/server.go b/federation/cmd/federation-apiserver/app/server.go
index 1565648c3ef..44d92d60d7d 100644
--- a/federation/cmd/federation-apiserver/app/server.go
+++ b/federation/cmd/federation-apiserver/app/server.go
@@ -219,7 +219,7 @@ func Run(s *options.ServerRunOptions) error {
 		cachesize.SetWatchCacheSizes(s.WatchCacheSizes)
 	}
 
-	m, err := genericConfig.New()
+	m, err := genericConfig.Complete().New()
 	if err != nil {
 		return err
 	}
diff --git a/pkg/genericapiserver/config.go b/pkg/genericapiserver/config.go
index 88b5ff7ef80..e236f4573f7 100644
--- a/pkg/genericapiserver/config.go
+++ b/pkg/genericapiserver/config.go
@@ -213,8 +213,12 @@ func NewConfig(options *options.ServerRunOptions) *Config {
 	}
 }
 
-// setDefaults fills in any fields not set that are required to have valid data.
-func (c *Config) setDefaults() {
+type completedConfig struct {
+	*Config
+}
+
+// Complete fills in any fields not set that are required to have valid data. It's mutating the receiver.
+func (c *Config) Complete() completedConfig {
 	if c.ServiceClusterIPRange == nil {
 		defaultNet := "10.0.0.0/24"
 		glog.Warningf("Network range for service cluster IPs is unspecified. Defaulting to %v.", defaultNet)
@@ -267,6 +271,12 @@ func (c *Config) setDefaults() {
 		}
 		c.ExternalHost = hostAndPort
 	}
+	return completedConfig{c}
+}
+
+// SkipComplete provides a way to construct a server instance without config completion.
+func (c *Config) SkipComplete() completedConfig {
+	return completedConfig{c}
 }
 
 // New returns a new instance of GenericAPIServer from the given config.
@@ -291,13 +301,11 @@ func (c *Config) setDefaults() {
 //   If the caller wants to add additional endpoints not using the GenericAPIServer's
 //   auth, then the caller should create a handler for those endpoints, which delegates the
 //   any unhandled paths to "Handler".
-func (c Config) New() (*GenericAPIServer, error) {
+func (c completedConfig) New() (*GenericAPIServer, error) {
 	if c.Serializer == nil {
 		return nil, fmt.Errorf("Genericapiserver.New() called with config.Serializer == nil")
 	}
 
-	c.setDefaults()
-
 	s := &GenericAPIServer{
 		ServiceClusterIPRange: c.ServiceClusterIPRange,
 		ServiceNodePortRange:  c.ServiceNodePortRange,
@@ -345,8 +353,8 @@ func (c Config) New() (*GenericAPIServer, error) {
 		})
 	}
 
-	s.installAPI(&c)
-	s.Handler, s.InsecureHandler = s.buildHandlerChains(&c, http.Handler(s.Mux.BaseMux().(*http.ServeMux)))
+	s.installAPI(c.Config)
+	s.Handler, s.InsecureHandler = s.buildHandlerChains(c.Config, http.Handler(s.Mux.BaseMux().(*http.ServeMux)))
 
 	return s, nil
 }
diff --git a/pkg/genericapiserver/genericapiserver_test.go b/pkg/genericapiserver/genericapiserver_test.go
index 5b1e4106f9d..c6f841c58a7 100644
--- a/pkg/genericapiserver/genericapiserver_test.go
+++ b/pkg/genericapiserver/genericapiserver_test.go
@@ -64,7 +64,7 @@ func setUp(t *testing.T) (*etcdtesting.EtcdTestServer, Config, *assert.Assertion
 func newMaster(t *testing.T) (*GenericAPIServer, *etcdtesting.EtcdTestServer, Config, *assert.Assertions) {
 	etcdserver, config, assert := setUp(t)
 
-	s, err := config.New()
+	s, err := config.Complete().New()
 	if err != nil {
 		t.Fatalf("Error in bringing up the server: %v", err)
 	}
@@ -109,7 +109,7 @@ func TestInstallAPIGroups(t *testing.T) {
 	config.APIPrefix = "/apiPrefix"
 	config.APIGroupPrefix = "/apiGroupPrefix"
 
-	s, err := config.New()
+	s, err := config.Complete().New()
 	if err != nil {
 		t.Fatalf("Error in bringing up the server: %v", err)
 	}
@@ -212,7 +212,7 @@ func TestNotRestRoutesHaveAuth(t *testing.T) {
 	config.EnableSwaggerSupport = true
 	config.EnableVersion = true
 
-	s, err := config.New()
+	s, err := config.Complete().New()
 	if err != nil {
 		t.Fatalf("Error in bringing up the server: %v", err)
 	}
diff --git a/pkg/master/master.go b/pkg/master/master.go
index 42463a30154..c9cf231dd11 100644
--- a/pkg/master/master.go
+++ b/pkg/master/master.go
@@ -116,7 +116,7 @@ const (
 )
 
 type Config struct {
-	*genericapiserver.Config
+	GenericConfig *genericapiserver.Config
 
 	StorageFactory           genericapiserver.StorageFactory
 	EnableWatchCache         bool
@@ -190,18 +190,35 @@ type RESTStorageProvider interface {
 	NewRESTStorage(apiResourceConfigSource genericapiserver.APIResourceConfigSource, restOptionsGetter RESTOptionsGetter) (groupInfo genericapiserver.APIGroupInfo, enabled bool)
 }
 
+type completedConfig struct {
+	*Config
+}
+
+// Complete fills in any fields not set that are required to have valid data. It's mutating the receiver.
+func (c *Config) Complete() completedConfig {
+	c.GenericConfig.Complete()
+
+	// enable swagger UI only if general UI support is on
+	c.GenericConfig.EnableSwaggerUI = c.GenericConfig.EnableSwaggerUI && c.EnableUISupport
+
+	return completedConfig{c}
+}
+
+// SkipComplete provides a way to construct a server instance without config completion.
+func (c *Config) SkipComplete() completedConfig {
+	return completedConfig{c}
+}
+
 // New returns a new instance of Master from the given config.
 // Certain config fields will be set to a default value if unset.
 // Certain config fields must be specified, including:
 //   KubeletClient
-func New(c *Config) (*Master, error) {
+func (c completedConfig) New() (*Master, error) {
 	if c.KubeletClient == nil {
 		return nil, fmt.Errorf("Master.New() called with config.KubeletClient == nil")
 	}
 
-	gc := *c.Config                                              // copy before mutations
-	gc.EnableSwaggerUI = gc.EnableSwaggerUI && c.EnableUISupport // disable swagger UI if general UI supports it
-	s, err := gc.New()
+	s, err := c.Config.GenericConfig.SkipComplete().New() // completion is done in Complete, no need for a second time
 	if err != nil {
 		return nil, err
 	}
@@ -223,7 +240,7 @@ func New(c *Config) (*Master, error) {
 
 		restOptionsFactory: restOptionsFactory{
 			deleteCollectionWorkers: c.DeleteCollectionWorkers,
-			enableGarbageCollection: c.EnableGarbageCollection,
+			enableGarbageCollection: c.GenericConfig.EnableGarbageCollection,
 			storageFactory:          c.StorageFactory,
 		},
 	}
@@ -239,8 +256,8 @@ func New(c *Config) (*Master, error) {
 		c.RESTStorageProviders = map[string]genericapiserver.RESTStorageProvider{}
 	}
 	c.RESTStorageProviders[appsapi.GroupName] = appsrest.RESTStorageProvider{}
-	c.RESTStorageProviders[authenticationv1beta1.GroupName] = authenticationrest.RESTStorageProvider{Authenticator: c.Authenticator}
-	c.RESTStorageProviders[authorization.GroupName] = authorizationrest.RESTStorageProvider{Authorizer: c.Authorizer}
+	c.RESTStorageProviders[authenticationv1beta1.GroupName] = authenticationrest.RESTStorageProvider{Authenticator: c.GenericConfig.Authenticator}
+	c.RESTStorageProviders[authorization.GroupName] = authorizationrest.RESTStorageProvider{Authorizer: c.GenericConfig.Authorizer}
 	c.RESTStorageProviders[autoscaling.GroupName] = autoscalingrest.RESTStorageProvider{}
 	c.RESTStorageProviders[batch.GroupName] = batchrest.RESTStorageProvider{}
 	c.RESTStorageProviders[certificates.GroupName] = certificatesrest.RESTStorageProvider{}
@@ -249,9 +266,9 @@ func New(c *Config) (*Master, error) {
 		DisableThirdPartyControllerForTesting: m.disableThirdPartyControllerForTesting,
 	}
 	c.RESTStorageProviders[policy.GroupName] = policyrest.RESTStorageProvider{}
-	c.RESTStorageProviders[rbac.GroupName] = &rbacrest.RESTStorageProvider{AuthorizerRBACSuperUser: c.AuthorizerRBACSuperUser}
+	c.RESTStorageProviders[rbac.GroupName] = &rbacrest.RESTStorageProvider{AuthorizerRBACSuperUser: c.GenericConfig.AuthorizerRBACSuperUser}
 	c.RESTStorageProviders[storage.GroupName] = storagerest.RESTStorageProvider{}
-	m.InstallAPIs(c)
+	m.InstallAPIs(c.Config)
 
 	// TODO: Attempt clean shutdown?
 	if m.enableCoreControllers {
@@ -265,7 +282,7 @@ func (m *Master) InstallAPIs(c *Config) {
 	apiGroupsInfo := []genericapiserver.APIGroupInfo{}
 
 	// Install v1 unless disabled.
-	if c.APIResourceConfigSource.AnyResourcesForVersionEnabled(apiv1.SchemeGroupVersion) {
+	if c.GenericConfig.APIResourceConfigSource.AnyResourcesForVersionEnabled(apiv1.SchemeGroupVersion) {
 		// Install v1 API.
 		m.initV1ResourcesStorage(c)
 		apiGroupInfo := genericapiserver.APIGroupInfo{
@@ -300,7 +317,7 @@ func (m *Master) InstallAPIs(c *Config) {
 	}
 	healthz.InstallHandler(m.Mux, healthzChecks...)
 
-	if c.EnableProfiling {
+	if c.GenericConfig.EnableProfiling {
 		routes.MetricsWithReset{}.Install(m.Mux, m.HandlerContainer)
 	} else {
 		routes.DefaultMetrics{}.Install(m.Mux, m.HandlerContainer)
@@ -308,7 +325,7 @@ func (m *Master) InstallAPIs(c *Config) {
 
 	// Install third party resource support if requested
 	// TODO seems like this bit ought to be unconditional and the REST API is controlled by the config
-	if c.APIResourceConfigSource.ResourceEnabled(extensionsapiv1beta1.SchemeGroupVersion.WithResource("thirdpartyresources")) {
+	if c.GenericConfig.APIResourceConfigSource.ResourceEnabled(extensionsapiv1beta1.SchemeGroupVersion.WithResource("thirdpartyresources")) {
 		var err error
 		m.thirdPartyStorageConfig, err = c.StorageFactory.NewConfig(extensions.Resource("thirdpartyresources"))
 		if err != nil {
@@ -324,12 +341,12 @@ func (m *Master) InstallAPIs(c *Config) {
 	// stabilize order.
 	// TODO find a better way to configure priority of groups
 	for _, group := range sets.StringKeySet(c.RESTStorageProviders).List() {
-		if !c.APIResourceConfigSource.AnyResourcesForGroupEnabled(group) {
+		if !c.GenericConfig.APIResourceConfigSource.AnyResourcesForGroupEnabled(group) {
 			glog.V(1).Infof("Skipping disabled API group %q.", group)
 			continue
 		}
 		restStorageBuilder := c.RESTStorageProviders[group]
-		apiGroupInfo, enabled := restStorageBuilder.NewRESTStorage(c.APIResourceConfigSource, restOptionsGetter)
+		apiGroupInfo, enabled := restStorageBuilder.NewRESTStorage(c.GenericConfig.APIResourceConfigSource, restOptionsGetter)
 		if !enabled {
 			glog.Warningf("Problem initializing API group %q, skipping.", group)
 			continue
diff --git a/pkg/master/master_test.go b/pkg/master/master_test.go
index 30ad0a7b5cb..13395199ccb 100644
--- a/pkg/master/master_test.go
+++ b/pkg/master/master_test.go
@@ -83,7 +83,7 @@ func setUp(t *testing.T) (*Master, *etcdtesting.EtcdTestServer, Config, *assert.
 		GenericAPIServer: &genericapiserver.GenericAPIServer{},
 	}
 	config := Config{
-		Config: &genericapiserver.Config{},
+		GenericConfig: &genericapiserver.Config{},
 	}
 
 	resourceEncoding := genericapiserver.NewDefaultResourceEncodingConfig()
@@ -97,17 +97,17 @@ func setUp(t *testing.T) (*Master, *etcdtesting.EtcdTestServer, Config, *assert.
 	storageFactory := genericapiserver.NewDefaultStorageFactory(*storageConfig, testapi.StorageMediaType(), api.Codecs, resourceEncoding, DefaultAPIResourceConfigSource())
 
 	config.StorageFactory = storageFactory
-	config.APIResourceConfigSource = DefaultAPIResourceConfigSource()
-	config.PublicAddress = net.ParseIP("192.168.10.4")
-	config.Serializer = api.Codecs
+	config.GenericConfig.APIResourceConfigSource = DefaultAPIResourceConfigSource()
+	config.GenericConfig.PublicAddress = net.ParseIP("192.168.10.4")
+	config.GenericConfig.Serializer = api.Codecs
 	config.KubeletClient = client.FakeKubeletClient{}
-	config.APIPrefix = "/api"
-	config.APIGroupPrefix = "/apis"
-	config.APIResourceConfigSource = DefaultAPIResourceConfigSource()
-	config.ProxyDialer = func(network, addr string) (net.Conn, error) { return nil, nil }
-	config.ProxyTLSClientConfig = &tls.Config{}
-	config.RequestContextMapper = api.NewRequestContextMapper()
-	config.Config.EnableVersion = true
+	config.GenericConfig.APIPrefix = "/api"
+	config.GenericConfig.APIGroupPrefix = "/apis"
+	config.GenericConfig.APIResourceConfigSource = DefaultAPIResourceConfigSource()
+	config.GenericConfig.ProxyDialer = func(network, addr string) (net.Conn, error) { return nil, nil }
+	config.GenericConfig.ProxyTLSClientConfig = &tls.Config{}
+	config.GenericConfig.RequestContextMapper = api.NewRequestContextMapper()
+	config.GenericConfig.EnableVersion = true
 
 	// TODO: this is kind of hacky.  The trouble is that the sync loop
 	// runs in a go-routine and there is no way to validate in the test
@@ -125,7 +125,7 @@ func setUp(t *testing.T) (*Master, *etcdtesting.EtcdTestServer, Config, *assert.
 func newMaster(t *testing.T) (*Master, *etcdtesting.EtcdTestServer, Config, *assert.Assertions) {
 	_, etcdserver, config, assert := setUp(t)
 
-	master, err := New(&config)
+	master, err := config.Complete().New()
 	if err != nil {
 		t.Fatalf("Error in bringing up the master: %v", err)
 	}
@@ -150,8 +150,8 @@ func limitedAPIResourceConfigSource() *genericapiserver.ResourceConfig {
 // newLimitedMaster only enables the core group, the extensions group, the batch group, and the autoscaling group.
 func newLimitedMaster(t *testing.T) (*Master, *etcdtesting.EtcdTestServer, Config, *assert.Assertions) {
 	_, etcdserver, config, assert := setUp(t)
-	config.APIResourceConfigSource = limitedAPIResourceConfigSource()
-	master, err := New(&config)
+	config.GenericConfig.APIResourceConfigSource = limitedAPIResourceConfigSource()
+	master, err := config.Complete().New()
 	if err != nil {
 		t.Fatalf("Error in bringing up the master: %v", err)
 	}
@@ -168,8 +168,8 @@ func TestNew(t *testing.T) {
 	// Verify many of the variables match their config counterparts
 	assert.Equal(master.enableCoreControllers, config.EnableCoreControllers)
 	assert.Equal(master.tunneler, config.Tunneler)
-	assert.Equal(master.RequestContextMapper(), config.RequestContextMapper)
-	assert.Equal(master.ClusterIP, config.PublicAddress)
+	assert.Equal(master.RequestContextMapper(), config.GenericConfig.RequestContextMapper)
+	assert.Equal(master.ClusterIP, config.GenericConfig.PublicAddress)
 
 	// these values get defaulted
 	_, serviceClusterIPRange, _ := net.ParseCIDR("10.0.0.0/24")
@@ -181,10 +181,10 @@ func TestNew(t *testing.T) {
 	// These functions should point to the same memory location
 	masterDialer, _ := utilnet.Dialer(master.ProxyTransport)
 	masterDialerFunc := fmt.Sprintf("%p", masterDialer)
-	configDialerFunc := fmt.Sprintf("%p", config.ProxyDialer)
+	configDialerFunc := fmt.Sprintf("%p", config.GenericConfig.ProxyDialer)
 	assert.Equal(masterDialerFunc, configDialerFunc)
 
-	assert.Equal(master.ProxyTransport.(*http.Transport).TLSClientConfig, config.ProxyTLSClientConfig)
+	assert.Equal(master.ProxyTransport.(*http.Transport).TLSClientConfig, config.GenericConfig.ProxyTLSClientConfig)
 }
 
 // TestNamespaceSubresources ensures the namespace subresource parsing in apiserver/handlers.go doesn't drift
@@ -1253,16 +1253,16 @@ func TestValidOpenAPISpec(t *testing.T) {
 	_, etcdserver, config, assert := setUp(t)
 	defer etcdserver.Terminate(t)
 
-	config.OpenAPIDefinitions = openapi.OpenAPIDefinitions
-	config.EnableOpenAPISupport = true
-	config.EnableIndex = true
-	config.OpenAPIInfo = spec.Info{
+	config.GenericConfig.OpenAPIDefinitions = openapi.OpenAPIDefinitions
+	config.GenericConfig.EnableOpenAPISupport = true
+	config.GenericConfig.EnableIndex = true
+	config.GenericConfig.OpenAPIInfo = spec.Info{
 		InfoProps: spec.InfoProps{
 			Title:   "Kubernetes",
 			Version: "unversioned",
 		},
 	}
-	master, err := New(&config)
+	master, err := config.Complete().New()
 	if err != nil {
 		t.Fatalf("Error in bringing up the master: %v", err)
 	}
diff --git a/test/integration/auth/accessreview_test.go b/test/integration/auth/accessreview_test.go
index a67bcfc9afd..14aded61ca6 100644
--- a/test/integration/auth/accessreview_test.go
+++ b/test/integration/auth/accessreview_test.go
@@ -64,10 +64,10 @@ func TestSubjectAccessReview(t *testing.T) {
 	defer s.Close()
 
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authenticator = authenticator.RequestFunc(alwaysAlice)
-	masterConfig.Authorizer = sarAuthorizer{}
-	masterConfig.AdmissionControl = admit.NewAlwaysAdmit()
-	m, err := master.New(masterConfig)
+	masterConfig.GenericConfig.Authenticator = authenticator.RequestFunc(alwaysAlice)
+	masterConfig.GenericConfig.Authorizer = sarAuthorizer{}
+	masterConfig.GenericConfig.AdmissionControl = admit.NewAlwaysAdmit()
+	m, err := masterConfig.Complete().New()
 	if err != nil {
 		t.Fatalf("error in bringing up the master: %v", err)
 	}
@@ -164,12 +164,12 @@ func TestSelfSubjectAccessReview(t *testing.T) {
 
 	username := "alice"
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authenticator = authenticator.RequestFunc(func(req *http.Request) (user.Info, bool, error) {
+	masterConfig.GenericConfig.Authenticator = authenticator.RequestFunc(func(req *http.Request) (user.Info, bool, error) {
 		return &user.DefaultInfo{Name: username}, true, nil
 	})
-	masterConfig.Authorizer = sarAuthorizer{}
-	masterConfig.AdmissionControl = admit.NewAlwaysAdmit()
-	m, err := master.New(masterConfig)
+	masterConfig.GenericConfig.Authorizer = sarAuthorizer{}
+	masterConfig.GenericConfig.AdmissionControl = admit.NewAlwaysAdmit()
+	m, err := masterConfig.Complete().New()
 	if err != nil {
 		t.Fatalf("error in bringing up the master: %v", err)
 	}
@@ -254,10 +254,10 @@ func TestLocalSubjectAccessReview(t *testing.T) {
 	defer s.Close()
 
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authenticator = authenticator.RequestFunc(alwaysAlice)
-	masterConfig.Authorizer = sarAuthorizer{}
-	masterConfig.AdmissionControl = admit.NewAlwaysAdmit()
-	m, err := master.New(masterConfig)
+	masterConfig.GenericConfig.Authenticator = authenticator.RequestFunc(alwaysAlice)
+	masterConfig.GenericConfig.Authorizer = sarAuthorizer{}
+	masterConfig.GenericConfig.AdmissionControl = admit.NewAlwaysAdmit()
+	m, err := masterConfig.Complete().New()
 	if err != nil {
 		t.Fatalf("error in bringing up the master: %v", err)
 	}
diff --git a/test/integration/auth/auth_test.go b/test/integration/auth/auth_test.go
index 8cf6a9a9de9..23fbda1b15b 100644
--- a/test/integration/auth/auth_test.go
+++ b/test/integration/auth/auth_test.go
@@ -500,7 +500,7 @@ func getPreviousResourceVersionKey(url, id string) string {
 func TestAuthModeAlwaysDeny(t *testing.T) {
 	// Set up a master
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authorizer = apiserverauthorizer.NewAlwaysDenyAuthorizer()
+	masterConfig.GenericConfig.Authorizer = apiserverauthorizer.NewAlwaysDenyAuthorizer()
 	_, s := framework.RunAMaster(masterConfig)
 	defer s.Close()
 
@@ -549,9 +549,9 @@ func TestAliceNotForbiddenOrUnauthorized(t *testing.T) {
 
 	// Set up a master
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authenticator = getTestTokenAuth()
-	masterConfig.Authorizer = allowAliceAuthorizer{}
-	masterConfig.AdmissionControl = admit.NewAlwaysAdmit()
+	masterConfig.GenericConfig.Authenticator = getTestTokenAuth()
+	masterConfig.GenericConfig.Authorizer = allowAliceAuthorizer{}
+	masterConfig.GenericConfig.AdmissionControl = admit.NewAlwaysAdmit()
 	_, s := framework.RunAMaster(masterConfig)
 	defer s.Close()
 
@@ -619,8 +619,8 @@ func TestAliceNotForbiddenOrUnauthorized(t *testing.T) {
 func TestBobIsForbidden(t *testing.T) {
 	// This file has alice and bob in it.
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authenticator = getTestTokenAuth()
-	masterConfig.Authorizer = allowAliceAuthorizer{}
+	masterConfig.GenericConfig.Authenticator = getTestTokenAuth()
+	masterConfig.GenericConfig.Authorizer = allowAliceAuthorizer{}
 	_, s := framework.RunAMaster(masterConfig)
 	defer s.Close()
 
@@ -663,8 +663,8 @@ func TestUnknownUserIsUnauthorized(t *testing.T) {
 
 	// Set up a master
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authenticator = getTestTokenAuth()
-	masterConfig.Authorizer = allowAliceAuthorizer{}
+	masterConfig.GenericConfig.Authenticator = getTestTokenAuth()
+	masterConfig.GenericConfig.Authorizer = allowAliceAuthorizer{}
 	_, s := framework.RunAMaster(masterConfig)
 	defer s.Close()
 
@@ -725,8 +725,8 @@ func (impersonateAuthorizer) Authorize(a authorizer.Attributes) (bool, string, e
 func TestImpersonateIsForbidden(t *testing.T) {
 	// Set up a master
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authenticator = getTestTokenAuth()
-	masterConfig.Authorizer = impersonateAuthorizer{}
+	masterConfig.GenericConfig.Authenticator = getTestTokenAuth()
+	masterConfig.GenericConfig.Authorizer = impersonateAuthorizer{}
 	_, s := framework.RunAMaster(masterConfig)
 	defer s.Close()
 
@@ -872,8 +872,8 @@ func TestAuthorizationAttributeDetermination(t *testing.T) {
 
 	// Set up a master
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authenticator = getTestTokenAuth()
-	masterConfig.Authorizer = trackingAuthorizer
+	masterConfig.GenericConfig.Authenticator = getTestTokenAuth()
+	masterConfig.GenericConfig.Authorizer = trackingAuthorizer
 	_, s := framework.RunAMaster(masterConfig)
 	defer s.Close()
 
@@ -938,8 +938,8 @@ func TestNamespaceAuthorization(t *testing.T) {
 
 	// Set up a master
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authenticator = getTestTokenAuth()
-	masterConfig.Authorizer = a
+	masterConfig.GenericConfig.Authenticator = getTestTokenAuth()
+	masterConfig.GenericConfig.Authorizer = a
 	_, s := framework.RunAMaster(masterConfig)
 	defer s.Close()
 
@@ -1036,8 +1036,8 @@ func TestKindAuthorization(t *testing.T) {
 
 	// Set up a master
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authenticator = getTestTokenAuth()
-	masterConfig.Authorizer = a
+	masterConfig.GenericConfig.Authenticator = getTestTokenAuth()
+	masterConfig.GenericConfig.Authorizer = a
 	_, s := framework.RunAMaster(masterConfig)
 	defer s.Close()
 
@@ -1120,8 +1120,8 @@ func TestReadOnlyAuthorization(t *testing.T) {
 
 	// Set up a master
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authenticator = getTestTokenAuth()
-	masterConfig.Authorizer = a
+	masterConfig.GenericConfig.Authenticator = getTestTokenAuth()
+	masterConfig.GenericConfig.Authorizer = a
 	_, s := framework.RunAMaster(masterConfig)
 	defer s.Close()
 
@@ -1179,8 +1179,8 @@ func TestWebhookTokenAuthenticator(t *testing.T) {
 
 	// Set up a master
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authenticator = authenticator
-	masterConfig.Authorizer = allowAliceAuthorizer{}
+	masterConfig.GenericConfig.Authenticator = authenticator
+	masterConfig.GenericConfig.Authorizer = allowAliceAuthorizer{}
 	_, s := framework.RunAMaster(masterConfig)
 	defer s.Close()
 
diff --git a/test/integration/auth/rbac_test.go b/test/integration/auth/rbac_test.go
index 6c12d28d2c6..1c95bfb3e17 100644
--- a/test/integration/auth/rbac_test.go
+++ b/test/integration/auth/rbac_test.go
@@ -338,9 +338,9 @@ func TestRBAC(t *testing.T) {
 	for i, tc := range tests {
 		// Create an API Server.
 		masterConfig := framework.NewIntegrationTestMasterConfig()
-		masterConfig.Authorizer = newRBACAuthorizer(t, superUser, masterConfig)
-		masterConfig.Authenticator = newFakeAuthenticator()
-		masterConfig.AuthorizerRBACSuperUser = superUser
+		masterConfig.GenericConfig.Authorizer = newRBACAuthorizer(t, superUser, masterConfig)
+		masterConfig.GenericConfig.Authenticator = newFakeAuthenticator()
+		masterConfig.GenericConfig.AuthorizerRBACSuperUser = superUser
 		_, s := framework.RunAMaster(masterConfig)
 		defer s.Close()
 
@@ -437,9 +437,9 @@ func TestBootstrapping(t *testing.T) {
 	superUser := "admin"
 
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.Authorizer = newRBACAuthorizer(t, superUser, masterConfig)
-	masterConfig.Authenticator = newFakeAuthenticator()
-	masterConfig.AuthorizerRBACSuperUser = superUser
+	masterConfig.GenericConfig.Authorizer = newRBACAuthorizer(t, superUser, masterConfig)
+	masterConfig.GenericConfig.Authenticator = newFakeAuthenticator()
+	masterConfig.GenericConfig.AuthorizerRBACSuperUser = superUser
 	_, s := framework.RunAMaster(masterConfig)
 	defer s.Close()
 
diff --git a/test/integration/framework/master_utils.go b/test/integration/framework/master_utils.go
index 29422ff5169..ca7fea5f944 100644
--- a/test/integration/framework/master_utils.go
+++ b/test/integration/framework/master_utils.go
@@ -134,22 +134,22 @@ func startMasterOrDie(masterConfig *master.Config) (*master.Master, *httptest.Se
 
 	if masterConfig == nil {
 		masterConfig = NewMasterConfig()
-		masterConfig.EnableProfiling = true
-		masterConfig.EnableSwaggerSupport = true
-		masterConfig.EnableOpenAPISupport = true
-		masterConfig.OpenAPIInfo = spec.Info{
+		masterConfig.GenericConfig.EnableProfiling = true
+		masterConfig.GenericConfig.EnableSwaggerSupport = true
+		masterConfig.GenericConfig.EnableOpenAPISupport = true
+		masterConfig.GenericConfig.OpenAPIInfo = spec.Info{
 			InfoProps: spec.InfoProps{
 				Title:   "Kubernetes",
 				Version: "unversioned",
 			},
 		}
-		masterConfig.OpenAPIDefaultResponse = spec.Response{
+		masterConfig.GenericConfig.OpenAPIDefaultResponse = spec.Response{
 			ResponseProps: spec.ResponseProps{
 				Description: "Default Response.",
 			},
 		}
 	}
-	m, err := master.New(masterConfig)
+	m, err := masterConfig.Complete().New()
 	if err != nil {
 		glog.Fatalf("error in bringing up the master: %v", err)
 	}
@@ -221,7 +221,7 @@ func NewMasterConfig() *master.Config {
 		NewSingleContentTypeSerializer(api.Scheme, testapi.Storage.Codec(), runtime.ContentTypeJSON))
 
 	return &master.Config{
-		Config: &genericapiserver.Config{
+		GenericConfig: &genericapiserver.Config{
 			APIResourceConfigSource: master.DefaultAPIResourceConfigSource(),
 			APIPrefix:               "/api",
 			APIGroupPrefix:          "/apis",
@@ -245,10 +245,10 @@ func NewMasterConfig() *master.Config {
 func NewIntegrationTestMasterConfig() *master.Config {
 	masterConfig := NewMasterConfig()
 	masterConfig.EnableCoreControllers = true
-	masterConfig.EnableIndex = true
-	masterConfig.EnableVersion = true
-	masterConfig.PublicAddress = net.ParseIP("192.168.10.4")
-	masterConfig.APIResourceConfigSource = master.DefaultAPIResourceConfigSource()
+	masterConfig.GenericConfig.EnableIndex = true
+	masterConfig.GenericConfig.EnableVersion = true
+	masterConfig.GenericConfig.PublicAddress = net.ParseIP("192.168.10.4")
+	masterConfig.GenericConfig.APIResourceConfigSource = master.DefaultAPIResourceConfigSource()
 	return masterConfig
 }
 
@@ -332,7 +332,7 @@ func ScaleRC(name, ns string, replicas int32, clientset clientset.Interface) (*a
 func RunAMaster(masterConfig *master.Config) (*master.Master, *httptest.Server) {
 	if masterConfig == nil {
 		masterConfig = NewMasterConfig()
-		masterConfig.EnableProfiling = true
+		masterConfig.GenericConfig.EnableProfiling = true
 	}
 	return startMasterOrDie(masterConfig)
 }
diff --git a/test/integration/garbagecollector/garbage_collector_test.go b/test/integration/garbagecollector/garbage_collector_test.go
index 7830d17cafe..bc95697208d 100644
--- a/test/integration/garbagecollector/garbage_collector_test.go
+++ b/test/integration/garbagecollector/garbage_collector_test.go
@@ -121,7 +121,7 @@ func newOwnerRC(name, namespace string) *v1.ReplicationController {
 func setup(t *testing.T) (*httptest.Server, *garbagecollector.GarbageCollector, clientset.Interface) {
 	masterConfig := framework.NewIntegrationTestMasterConfig()
 	masterConfig.EnableCoreControllers = false
-	masterConfig.EnableGarbageCollection = true
+	masterConfig.GenericConfig.EnableGarbageCollection = true
 	_, s := framework.RunAMaster(masterConfig)
 
 	clientSet, err := clientset.NewForConfig(&restclient.Config{Host: s.URL})
diff --git a/test/integration/master/master_test.go b/test/integration/master/master_test.go
index 23bbadb3193..1674e632175 100644
--- a/test/integration/master/master_test.go
+++ b/test/integration/master/master_test.go
@@ -424,7 +424,7 @@ func TestServiceAlloc(t *testing.T) {
 	if err != nil {
 		t.Fatalf("bad cidr: %v", err)
 	}
-	cfg.ServiceClusterIPRange = cidr
+	cfg.GenericConfig.ServiceClusterIPRange = cidr
 	_, s := framework.RunAMaster(cfg)
 	defer s.Close()
 
diff --git a/test/integration/openshift/openshift_test.go b/test/integration/openshift/openshift_test.go
index e70a62fbbb7..e6452da4aed 100644
--- a/test/integration/openshift/openshift_test.go
+++ b/test/integration/openshift/openshift_test.go
@@ -27,7 +27,7 @@ import (
 // are not referenced directly by a master.
 func TestMasterExportsSymbols(t *testing.T) {
 	_ = &master.Config{
-		Config: &genericapiserver.Config{
+		GenericConfig: &genericapiserver.Config{
 			EnableSwaggerSupport: false,
 			RestfulContainer:     nil,
 		},
diff --git a/test/integration/quota/quota_test.go b/test/integration/quota/quota_test.go
index 27cd6959fc0..c999ddd4932 100644
--- a/test/integration/quota/quota_test.go
+++ b/test/integration/quota/quota_test.go
@@ -72,8 +72,8 @@ func TestQuota(t *testing.T) {
 	defer close(admissionCh)
 
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	masterConfig.AdmissionControl = admission
-	m, err = master.New(masterConfig)
+	masterConfig.GenericConfig.AdmissionControl = admission
+	m, err = masterConfig.Complete().New()
 	if err != nil {
 		t.Fatalf("Error in bringing up the master: %v", err)
 	}
diff --git a/test/integration/scheduler_perf/util.go b/test/integration/scheduler_perf/util.go
index c9370675eee..a7041b8b441 100644
--- a/test/integration/scheduler_perf/util.go
+++ b/test/integration/scheduler_perf/util.go
@@ -48,7 +48,7 @@ func mustSetupScheduler() (schedulerConfigFactory *factory.ConfigFactory, destro
 
 	var m *master.Master
 	masterConfig := framework.NewIntegrationTestMasterConfig()
-	m, err := master.New(masterConfig)
+	m, err := masterConfig.Complete().New()
 	if err != nil {
 		panic("error in brining up the master: " + err.Error())
 	}
diff --git a/test/integration/serviceaccount/service_account_test.go b/test/integration/serviceaccount/service_account_test.go
index 9121b976993..7ff934af802 100644
--- a/test/integration/serviceaccount/service_account_test.go
+++ b/test/integration/serviceaccount/service_account_test.go
@@ -406,13 +406,13 @@ func startServiceAccountTestServer(t *testing.T) (*clientset.Clientset, restclie
 	serviceAccountAdmission := serviceaccountadmission.NewServiceAccount(rootClientset)
 
 	masterConfig := framework.NewMasterConfig()
-	masterConfig.EnableIndex = true
-	masterConfig.Authenticator = authenticator
-	masterConfig.Authorizer = authorizer
-	masterConfig.AdmissionControl = serviceAccountAdmission
+	masterConfig.GenericConfig.EnableIndex = true
+	masterConfig.GenericConfig.Authenticator = authenticator
+	masterConfig.GenericConfig.Authorizer = authorizer
+	masterConfig.GenericConfig.AdmissionControl = serviceAccountAdmission
 
 	// Create a master and install handlers into mux.
-	m, err := master.New(masterConfig)
+	m, err := masterConfig.Complete().New()
 	if err != nil {
 		t.Fatalf("Error in bringing up the master: %v", err)
 	}