diff --git a/cluster/gke/util.sh b/cluster/gke/util.sh
index 607b8efdeeb..70ff52ffd43 100755
--- a/cluster/gke/util.sh
+++ b/cluster/gke/util.sh
@@ -206,6 +206,10 @@ function kube-up() {
     # other clusters as well. Extract the information about only this cluster
     # and then create a file with that.
     # For now, we use the whole kubeconfig file.
+    # Note: This is not as dangerous as it sounds because this code path is
+    # only expected to run during tests. Users are not expected to set
+    # FEDERATION=true while bringing up their kubernetes clusters.
+    # But there is nothing stopping them from doing so.
     cp $KUBECONFIG $DEST_KUBECONFIG >&2
   fi
 
diff --git a/federation/cluster/common.sh b/federation/cluster/common.sh
index a326543cab1..7955dd65817 100644
--- a/federation/cluster/common.sh
+++ b/federation/cluster/common.sh
@@ -159,10 +159,18 @@ function create-federation-api-objects {
     $host_kubectl create secret generic federation-apiserver-secret --from-file="${KUBECONFIG_DIR}/federation/federation-apiserver/kubeconfig" --namespace="${FEDERATION_NAMESPACE}"
 
     # Create secrets with all the kubernetes-apiserver's kubeconfigs.
+    # Note: This is used only by the test setup (where kubernetes clusters are
+    # brought up with FEDERATION=true). Users are expected to create this secret
+    # themselves.
     for dir in ${KUBECONFIG_DIR}/federation/kubernetes-apiserver/*; do
       # We create a secret with the same name as the directory name (which is
-      # same as cluster name in kubeconfig)
+      # same as cluster name in kubeconfig).
+      # Massage the name so that it is valid (should not contain "_" and max 253
+      # chars)
       name=$(basename $dir)
+      name=$(echo "$name" | sed -e "s/_/-/g")  # Replace "_" by "-"
+      name=${name:0:252}
+      echo "Creating secret with name: $name"
       $host_kubectl create secret generic ${name} --from-file="${dir}/kubeconfig" --namespace="${FEDERATION_NAMESPACE}"
     done
 
diff --git a/test/e2e/framework/federation_util.go b/test/e2e/framework/federation_util.go
new file mode 100644
index 00000000000..a018d2b6021
--- /dev/null
+++ b/test/e2e/framework/federation_util.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2016 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package framework
+
+import (
+	"fmt"
+	"regexp"
+
+	"k8s.io/kubernetes/pkg/api/validation"
+	validation_util "k8s.io/kubernetes/pkg/util/validation"
+)
+
+// GetValidDNSSubdomainName massages the given name to be a valid dns subdomain name.
+// Most resources (such as secrets, clusters) require the names to be valid dns subdomain.
+// This is a generic function (not specific to federation). Should be moved to a more generic location if others want to use it.
+func GetValidDNSSubdomainName(name string) (string, error) {
+	// "_" are not allowed. Replace them by "-".
+	name = regexp.MustCompile("_").ReplaceAllLiteralString(name, "-")
+	maxLength := validation_util.DNS1123SubdomainMaxLength
+	if len(name) > maxLength {
+		name = name[0 : maxLength-1]
+	}
+	// Verify that name now passes the validation.
+	if errors := validation.NameIsDNSSubdomain(name, false); len(errors) != 0 {
+		return "", fmt.Errorf("errors in converting name to a valid DNS subdomain %s", errors)
+	}
+	return name, nil
+}
diff --git a/test/e2e/framework/framework.go b/test/e2e/framework/framework.go
index c982b221915..cdc7e27a8cf 100644
--- a/test/e2e/framework/framework.go
+++ b/test/e2e/framework/framework.go
@@ -585,6 +585,9 @@ func (kc *KubeConfig) findCluster(name string) *KubeCluster {
 }
 
 type E2EContext struct {
+	// Raw context name,
+	RawName string `yaml:"rawName"`
+	// A valid dns subdomain which can be used as the name of kubernetes resources.
 	Name    string       `yaml:"name"`
 	Cluster *KubeCluster `yaml:"cluster"`
 	User    *KubeUser    `yaml:"user"`
@@ -615,8 +618,13 @@ func (f *Framework) GetUnderlyingFederatedContexts() []E2EContext {
 				Failf("Could not find cluster for context %+v", context)
 			}
 
+			dnsSubdomainName, err := GetValidDNSSubdomainName(context.Name)
+			if err != nil {
+				Failf("Could not convert context name %s to a valid dns subdomain name, error: %s", context.Name, err)
+			}
 			e2eContexts = append(e2eContexts, E2EContext{
-				Name:    context.Name,
+				RawName: context.Name,
+				Name:    dnsSubdomainName,
 				Cluster: cluster,
 				User:    user,
 			})