added NonMasqueradeCidr validation

pkg/api/vlabs/validate.go

@@ -408,20 +408,19 @@ func (a *KubernetesConfig) Validate(k8sRelease string) error {
 		}
 	}
 
-	if a.NonMasqueradeCidr != "" {
-		_, _, err := net.ParseCIDR(a.NonMasqueradeCidr)
-		if err != nil {
-			return fmt.Errorf("OrchestratorProfile.KubernetesConfig.NonMasqueradeCidr '%s' is an invalid subnet", a.NonMasqueradeCidr)
-		}
-	}
-
 	if a.DockerBridgeSubnet != "" {
 		_, _, err := net.ParseCIDR(a.DockerBridgeSubnet)
 		if err != nil {
 			return fmt.Errorf("OrchestratorProfile.KubernetesConfig.DockerBridgeSubnet '%s' is an invalid subnet", a.DockerBridgeSubnet)
 		}
 	}
 
+	if a.NonMasqueradeCidr != "" {
+		if _, _, err := net.ParseCIDR(a.NonMasqueradeCidr); err != nil {
+			return fmt.Errorf("OrchestratorProfile.KubernetesConfig.NonMasqueradeCidr '%s' is an invalid CIDR string", a.NonMasqueradeCidr)
+		}
+	}
+
 	if a.MaxPods != 0 {
 		if a.MaxPods < KubernetesMinMaxPods {
 			return fmt.Errorf("OrchestratorProfile.KubernetesConfig.MaxPods '%v' must be at least %v", a.MaxPods, KubernetesMinMaxPods)

pkg/api/vlabs/validate_test.go

@@ -94,6 +94,20 @@ func Test_KubernetesConfig_Validate(t *testing.T) {
 			t.Error("should error on invalid DockerBridgeSubnet")
 		}
 
+		c = KubernetesConfig{
+			NonMasqueradeCidr: "10.120.1.0/24",
+		}
+		if err := c.Validate(k8sRelease); err != nil {
+			t.Error("should not error on valid NonMasqueradeCidr")
+		}
+
+		c = KubernetesConfig{
+			NonMasqueradeCidr: "10.120.1.0/invalid",
+		}
+		if err := c.Validate(k8sRelease); err == nil {
+			t.Error("should error on invalid NonMasqueradeCidr")
+		}
+
 		c = KubernetesConfig{
 			MaxPods: KubernetesMinMaxPods - 1,
 		}