diff --git a/pkg/master/master.go b/pkg/master/master.go
index 62b67830b57..d4cc6a50740 100644
--- a/pkg/master/master.go
+++ b/pkg/master/master.go
@@ -66,17 +66,21 @@ import (
 
 // Config is a structure used to configure a Master.
 type Config struct {
-	Client                 *client.Client
-	Cloud                  cloudprovider.Interface
-	EtcdHelper             tools.EtcdHelper
-	EventTTL               time.Duration
-	MinionRegexp           string
-	KubeletClient          client.KubeletClient
-	PortalNet              *net.IPNet
-	EnableLogsSupport      bool
-	EnableUISupport        bool
-	EnableSwaggerSupport   bool
-	EnableV1Beta3          bool
+	Client            *client.Client
+	Cloud             cloudprovider.Interface
+	EtcdHelper        tools.EtcdHelper
+	EventTTL          time.Duration
+	MinionRegexp      string
+	KubeletClient     client.KubeletClient
+	PortalNet         *net.IPNet
+	EnableLogsSupport bool
+	EnableUISupport   bool
+	// allow downstream consumers to disable swagger
+	EnableSwaggerSupport bool
+	// allow v1beta3 to be conditionally enabled
+	EnableV1Beta3 bool
+	// allow downstream consumers to disable the index route
+	EnableIndex            bool
 	APIPrefix              string
 	CorsAllowedOriginList  util.StringList
 	Authenticator          authenticator.Request
@@ -418,7 +422,10 @@ func (m *Master) init(c *Config) {
 
 	// Register root handler.
 	// We do not register this using restful Webservice since we do not want to surface this in api docs.
-	m.mux.HandleFunc("/", apiserver.IndexHandler(m.handlerContainer, m.muxHelper))
+	// Allow master to be embedded in contexts which already have something registered at the root
+	if c.EnableIndex {
+		m.mux.HandleFunc("/", apiserver.IndexHandler(m.handlerContainer, m.muxHelper))
+	}
 
 	// TODO: use go-restful
 	apiserver.InstallValidator(m.muxHelper, func() map[string]apiserver.Server { return m.getServersToValidate(c) })
diff --git a/pkg/master/server/server.go b/pkg/master/server/server.go
index 34366097e42..c7a0529b23c 100644
--- a/pkg/master/server/server.go
+++ b/pkg/master/server/server.go
@@ -247,6 +247,7 @@ func (s *APIServer) Run(_ []string) error {
 		EnableLogsSupport:      s.EnableLogsSupport,
 		EnableUISupport:        true,
 		EnableSwaggerSupport:   true,
+		EnableIndex:            true,
 		APIPrefix:              s.APIPrefix,
 		CorsAllowedOriginList:  s.CorsAllowedOriginList,
 		ReadOnlyPort:           s.ReadOnlyPort,
diff --git a/pkg/standalone/standalone.go b/pkg/standalone/standalone.go
index cb1280dd06b..1074a36f3bd 100644
--- a/pkg/standalone/standalone.go
+++ b/pkg/standalone/standalone.go
@@ -107,6 +107,7 @@ func RunApiServer(cl *client.Client, etcdClient tools.EtcdClient, addr net.IP, p
 		},
 		EnableLogsSupport:    false,
 		EnableSwaggerSupport: true,
+		EnableIndex:          true,
 		APIPrefix:            "/api",
 		Authorizer:           apiserver.NewAlwaysAllowAuthorizer(),
 
diff --git a/test/integration/auth_test.go b/test/integration/auth_test.go
index 156602fb4dc..838d24dd617 100644
--- a/test/integration/auth_test.go
+++ b/test/integration/auth_test.go
@@ -302,6 +302,7 @@ func TestAuthModeAlwaysAllow(t *testing.T) {
 		KubeletClient:     client.FakeKubeletClient{},
 		EnableLogsSupport: false,
 		EnableUISupport:   false,
+		EnableIndex:       true,
 		APIPrefix:         "/api",
 		Authorizer:        apiserver.NewAlwaysAllowAuthorizer(),
 		AdmissionControl:  admit.NewAlwaysAdmit(),
@@ -353,6 +354,7 @@ func TestAuthModeAlwaysDeny(t *testing.T) {
 		KubeletClient:     client.FakeKubeletClient{},
 		EnableLogsSupport: false,
 		EnableUISupport:   false,
+		EnableIndex:       true,
 		APIPrefix:         "/api",
 		Authorizer:        apiserver.NewAlwaysDenyAuthorizer(),
 		AdmissionControl:  admit.NewAlwaysAdmit(),
@@ -418,6 +420,7 @@ func TestAliceNotForbiddenOrUnauthorized(t *testing.T) {
 		KubeletClient:     client.FakeKubeletClient{},
 		EnableLogsSupport: false,
 		EnableUISupport:   false,
+		EnableIndex:       true,
 		APIPrefix:         "/api",
 		Authenticator:     getTestTokenAuth(),
 		Authorizer:        allowAliceAuthorizer{},
@@ -478,6 +481,7 @@ func TestBobIsForbidden(t *testing.T) {
 		KubeletClient:     client.FakeKubeletClient{},
 		EnableLogsSupport: false,
 		EnableUISupport:   false,
+		EnableIndex:       true,
 		APIPrefix:         "/api",
 		Authenticator:     getTestTokenAuth(),
 		Authorizer:        allowAliceAuthorizer{},
@@ -538,6 +542,7 @@ func TestUnknownUserIsUnauthorized(t *testing.T) {
 		KubeletClient:     client.FakeKubeletClient{},
 		EnableLogsSupport: false,
 		EnableUISupport:   false,
+		EnableIndex:       true,
 		APIPrefix:         "/api",
 		Authenticator:     getTestTokenAuth(),
 		Authorizer:        allowAliceAuthorizer{},
@@ -617,6 +622,7 @@ func TestNamespaceAuthorization(t *testing.T) {
 		KubeletClient:     client.FakeKubeletClient{},
 		EnableLogsSupport: false,
 		EnableUISupport:   false,
+		EnableIndex:       true,
 		APIPrefix:         "/api",
 		Authenticator:     getTestTokenAuth(),
 		Authorizer:        a,
@@ -701,6 +707,7 @@ func TestKindAuthorization(t *testing.T) {
 		KubeletClient:     client.FakeKubeletClient{},
 		EnableLogsSupport: false,
 		EnableUISupport:   false,
+		EnableIndex:       true,
 		APIPrefix:         "/api",
 		Authenticator:     getTestTokenAuth(),
 		Authorizer:        a,
@@ -779,6 +786,7 @@ func TestReadOnlyAuthorization(t *testing.T) {
 		KubeletClient:     client.FakeKubeletClient{},
 		EnableLogsSupport: false,
 		EnableUISupport:   false,
+		EnableIndex:       true,
 		APIPrefix:         "/api",
 		Authenticator:     getTestTokenAuth(),
 		Authorizer:        a,