diff --git a/defaults/main.yml b/defaults/main.yml
index 8fac8dc..d48302e 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -116,6 +116,8 @@ magnum_pip_packages:
   - magnum
   - python-memcached
   - osprofiler
+  - kubernetes==2.0.0
+  - certifi==2017.4.17
 
 # This variable is used by the repo_build process to determine
 # which host group to check for members of before building the
diff --git a/releasenotes/notes/kubernetes-pin-56768037d47ebc73.yaml b/releasenotes/notes/kubernetes-pin-56768037d47ebc73.yaml
new file mode 100644
index 0000000..2b2dba5
--- /dev/null
+++ b/releasenotes/notes/kubernetes-pin-56768037d47ebc73.yaml
@@ -0,0 +1,13 @@
+---
+issues:
+  - |
+    For all ocata releases prior to OpenStack-Ansible 15.1.16,
+    several of the magnum requirements were not constrained.
+    This resulted in the kubernetes version changing over time
+    unexpectedly, rather than by intention. Most recently this
+    lack of constraint causes the repo build to fail when trying
+    to build the magnum venv due to incompatible requirements.
+
+    The kubernetes version deployed with ocata is now constrained
+    to version 2.0.0, matching the same version as deployed in
+    all pike releases.