diff --git a/ansible/roles/finish-kubespray/defaults/main.yml b/ansible/roles/finish-kubespray/defaults/main.yml
new file mode 100644
index 0000000..437d960
--- /dev/null
+++ b/ansible/roles/finish-kubespray/defaults/main.yml
@@ -0,0 +1,23 @@
+---
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# finish-kubespray/defaults/main.yml
+
+kubespray_dir: "../kubespray"
+
+management_net_cidr: "10.1.0.0/24"
+
+head_vm_ip: "192.168.46.100"
+
diff --git a/ansible/roles/finish-kubespray/tasks/main.yml b/ansible/roles/finish-kubespray/tasks/main.yml
new file mode 100644
index 0000000..258c0ac
--- /dev/null
+++ b/ansible/roles/finish-kubespray/tasks/main.yml
@@ -0,0 +1,44 @@
+---
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# finish-kubespray/tasks/main.yml
+
+- name: Create ~/.kube directory
+  file:
+    state: directory
+    dest: "~/.kube"
+
+- name: Move kubespray admin.conf to ~/.kube/config
+  copy:
+    remote_src: true
+    src: "{{ kubespray_dir }}/artifacts/admin.conf"
+    dest: "~/.kube/config"
+
+- name: Find Vagrant head VM IP address
+  shell: "vagrant ssh-config | grep -m 1 HostName | awk '{print $2}'"
+  args:
+    chdir: "{{ config_cord_dir }}/build"
+  environment:
+    VAGRANT_CWD: "{{ config_cord_dir }}/build/scenarios/{{ cord_scenario }}"
+  register: vagrant_head_vm_ip
+  tags:
+    - skip_ansible_lint # there isn't a module for this, info retrieval
+
+- name: Fix config URL to match Vagrant head VM IP
+  lineinfile:
+    path: "~/.kube/config"
+    regexp: "^    server: https://{{ management_net_cidr | ipaddr(1) |  ipaddr('address') }}:6443"
+    line: "    server: https://{{ vagrant_head_vm_ip.stdout }}:6443"
+