# What does adding K8s credentials to a playbook actually do? **URL:** \ **Category:** AWX Project\ **Tags:** awx, kubernetes\ **Created:** [October 20, 2020, 2:32pm UTC](https://forum.ansible.com/t/what-does-adding-k8s-credentials-to-a-playbook-actually-do/34062 "2020-10-20T14:32:32Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![howardjones](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/howardjones/32/4169_2.png) [@howardjones](https://forum.ansible.com/u/howardjones)\ **Post date:** [October 20, 2020, 2:32pm UTC](https://forum.ansible.com/t/what-does-adding-k8s-credentials-to-a-playbook-actually-do/34062/1 "2020-10-20T14:32:32Z")
I’ve been trying to use AWX 15 to deploy applications to kubernetes with a playbook including helm. This Works On My Machine ™ using ansible-playbook. Apart from actually getting the helm binary into the awx pods (I’ve stuffed it in the project repo for now), I am hitting issues with credentials. I have created a service-account for awx to use with this playbook, created a credential for that in awx, and attached it to the job template. However, when the helm task runs, it is reporting errors with permissions, but they are for the ‘awx’ SA, not my new ‘awx-deploy’ SA. I had a trawl through the awx code, to try and figure out what k8s credentials actually do, and there are no injectors (for environment vars, config files or whatever)… Do K8s credentials actually get passed to playbooks? The manual doesn’t explicitly say. Thanks in advance, Howie ---
**Author:** ![howardjones](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/howardjones/32/4169_2.png) [@howardjones](https://forum.ansible.com/u/howardjones)\ **Post date:** [October 23, 2020, 10:12pm UTC](https://forum.ansible.com/t/what-does-adding-k8s-credentials-to-a-playbook-actually-do/34062/2 "2020-10-23T22:12:02Z")
Answering my own question, for the sake of future searchers: it defines environment variables: K8S\_AUTH\_HOST - the URL for the K8S API endpoint K8S\_AUTH\_API\_KEY - the API token K8S\_AUTH\_SSL\_CA\_CERT - PATH to a temporary file with the CA cert K8S\_AUTH\_VERIFY\_SSL (True or False - if False, CA cert is not defined) This is fine for some of the collection.kubernetes.\* modules but not c.k.helm. That currently requires you to generate a kubeconfig file. ---
**Author:** ![Ananta\_Guha](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@Ananta\_Guha](https://forum.ansible.com/u/Ananta_Guha)\ **Post date:** [March 24, 2021, 7:49pm UTC](https://forum.ansible.com/t/what-does-adding-k8s-credentials-to-a-playbook-actually-do/34062/3 "2021-03-24T19:49:56Z")
@Howard , Thanks for the post . I am facing a similar issue trying to use the community.kubernetes.helm modules. Could you please share how you created a kubeconfig to use with this collection ? ---
**Author:** ![howardjones](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/howardjones/32/4169_2.png) [@howardjones](https://forum.ansible.com/u/howardjones)\ **Post date:** [March 25, 2021, 9:48am UTC](https://forum.ansible.com/t/what-does-adding-k8s-credentials-to-a-playbook-actually-do/34062/4 "2021-03-25T09:48:35Z")
I \*think\* the latest release of the modules addresses this, but I documented what I did in the github issue: [https://github.com/ansible-collections/community.kubernetes/issues/279#issuecomment-720742644](https://github.com/ansible-collections/community.kubernetes/issues/279#issuecomment-720742644) ---
**Author:** ![Nic\_H](https://avatars.discourse-cdn.com/v4/letter/n/d9b06d/32.png) [@Nic\_H](https://forum.ansible.com/u/Nic_H)\ **Post date:** [April 22, 2021, 10:06pm UTC](https://forum.ansible.com/t/what-does-adding-k8s-credentials-to-a-playbook-actually-do/34062/5 "2021-04-22T22:06:12Z")
Tower 3.6.0 user here, in this version there is an additional type of credential ( Openshift or Kubernetes api Bearer Token) . Is that the type of credential you are referring to here ? I am interested in using this credential with playbooks, however in the template , it it not available (even though I have created the credential already) . Any idea how to use this that way ? thanks ---
**Author:** ![Nic\_H](https://avatars.discourse-cdn.com/v4/letter/n/d9b06d/32.png) [@Nic\_H](https://forum.ansible.com/u/Nic_H)\ **Post date:** [April 22, 2021, 10:10pm UTC](https://forum.ansible.com/t/what-does-adding-k8s-credentials-to-a-playbook-actually-do/34062/6 "2021-04-22T22:10:32Z")
ok it seems to be available from tower 3.8 only . Not sure why red-hat added the credential capability in 3.6 then . Anyway, not AWX related ---
**Author:** ![howardjones](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/howardjones/32/4169_2.png) [@howardjones](https://forum.ansible.com/u/howardjones)\ **Post date:** [April 23, 2021, 10:12am UTC](https://forum.ansible.com/t/what-does-adding-k8s-credentials-to-a-playbook-actually-do/34062/7 "2021-04-23T10:12:37Z")
Yes, I believe it was originally added for something else (scaling for worker processes?), and then updated to actually set environment variables. On awx, that was in 14.0.0 if I recall from last year. I don't know what that translates to as far as Tower is concerned. There were also some recent changes in the kubernetes galaxy collection, so that the helm module would use secrets in the form that awx provides (previously the k8s module did, but helm didn't), without needing a generated .kubeconfig anymore.