<p>I'm struggling to deploy the playbook below (adding a namespace to Openshift 3.11 cluster):</p>
<pre><code>---
- hosts: kubernetesmastergfm
  gather_facts: false
  vars:
   name_namespace: testingnamespace
  tasks:
   - name: Create a k8s namespace
     k8s:
      host: &quot;https://{{ cluster.endpoint }}&quot;
      ca_cert: &quot;/etc/origin/master/ca.crt&quot; &lt;--WHERE IS THIS IN OPENSHIFT 3.11?
      api_key: &quot;/etc/origin/master/admin.key&quot;&lt;--WHERE IS THIS IN OPENSHIFT 3.11?
      validate_certs: no
      name: pippo
      api_version: v1
      kind: Namespace
      state: present
      
      
</code></pre>
<p>I'm getting the error:</p>
<pre><code>      ...
kubernetes.client.rest.ApiException: (401)
Reason: Unauthorized
HTTP response headers: HTTPHeaderDict({'Date': 'Tue, 16 Feb 2021 16:05:03 GMT', 'Content-Length': '129', 'Content-Type': 'application/json', 'Cache-Control': 'no-store'})
HTTP response body: {&quot;kind&quot;:&quot;Status&quot;,&quot;apiVersion&quot;:&quot;v1&quot;,&quot;metadata&quot;:{},&quot;status&quot;:&quot;Failure&quot;,&quot;message&quot;:&quot;Unauthorized&quot;,&quot;reason&quot;:&quot;Unauthorized&quot;,&quot;code&quot;:401}
</code></pre>
<p>I suspect that the certificates in the path below are wrong:
/etc/origin/master/ca.crt
/etc/origin/master/admin.key</p>
<p>Any suggestion is welcome.
Gian Filippo</p>

Gian Filippo Maniscalco
<p>The <code>api_key</code> parameter is the value of the <code>ServiceAccount</code> token.
I think you should paste this token directly as a <code>api_key</code> parameter value becuse providing the path to the file with token doesn't seem to work.</p>
<p>I will describe required steps on a simple example to illustrate you how it works.</p>
<p>To find the token name associated with a specific <code>ServiceAccount</code> you can use:</p>
<pre><code>###  kubectl describe sa &lt;SERVICE ACCOUNT NAME&gt; | grep &quot;Token&quot;

# kubectl describe sa namespace-creator | grep &quot;Token&quot;
Tokens:              namespace-creator-token-hs6zn
</code></pre>
<p>And then to display the value of this token:</p>
<pre><code>### kubectl describe secret &lt;TOKEN NAME&gt; | grep &quot;token:&quot; 

# kubectl describe secret namespace-creator-token-hs6zn | grep &quot;token:&quot;
token:      ey(...)3Q
</code></pre>
<p>Finally pass this token value as  the <code>api_key</code> parameter value:</p>
<pre><code>---
...
  tasks:
   - name: Create a k8s namespace
     community.kubernetes.k8s:
      ...
      api_key: &quot;ey(...)3Q&quot;
      validate_certs: no
      ...
</code></pre>
<p>To find out where the CA certificate is located, you may look at the <code>--client-ca-file</code> parameter of the API server e.g:</p>
<pre><code># kubectl describe pod kube-apiserver-master -n kube-system | grep &quot;client-ca-file&quot;
      --client-ca-file=/etc/kubernetes/ssl/ca.crt
  
</code></pre>
<p><strong>NOTE:</strong> If you are using <code>validate_certs: no</code>,  you don't need to provide <code>ca_cert</code> parameter.</p>
<p>Additionally, if you want instead of <a href="https://docs.ansible.com/ansible/latest/collections/community/kubernetes/k8s_module.html#parameter-api_key" rel="nofollow noreferrer">api_key</a>, you can use <a href="https://docs.ansible.com/ansible/latest/collections/community/kubernetes/k8s_module.html#parameter-kubeconfig" rel="nofollow noreferrer">kubeconfig</a> with path to an existing Kubernetes config file.</p>
