diff --git a/playbooks/base.yaml b/playbooks/base.yaml
index 0be64f631c..57fd4fbcef 100644
--- a/playbooks/base.yaml
+++ b/playbooks/base.yaml
@@ -26,6 +26,7 @@
 - hosts: bridge.openstack.org:!disabled
   name: "Base: configure cloud credentials on bridge"
   roles:
+    - install-kubectl
     - configure-kubectl
   tasks:
     - include_role:
diff --git a/playbooks/roles/base-server/tasks/Debian.yaml b/playbooks/roles/base-server/tasks/Debian.yaml
index 2ef7053c70..8857e4211c 100644
--- a/playbooks/roles/base-server/tasks/Debian.yaml
+++ b/playbooks/roles/base-server/tasks/Debian.yaml
@@ -3,7 +3,6 @@
     name:
       - whoopsie
       - popularity-contest
-      - snapd
       - lxd
       - lxd-client
     state: absent
diff --git a/playbooks/roles/base-server/tasks/Ubuntu.xenial.aarch64.yaml b/playbooks/roles/base-server/tasks/Ubuntu.xenial.aarch64.yaml
index 51569ed10b..dbccb4cf57 100644
--- a/playbooks/roles/base-server/tasks/Ubuntu.xenial.aarch64.yaml
+++ b/playbooks/roles/base-server/tasks/Ubuntu.xenial.aarch64.yaml
@@ -15,7 +15,6 @@
     name:
       - whoopsie
       - popularity-contest
-      - snapd
       - lxd
       - lxd-client
     state: absent
diff --git a/playbooks/roles/install-kubectl/README.rst b/playbooks/roles/install-kubectl/README.rst
new file mode 100644
index 0000000000..09bb4b2020
--- /dev/null
+++ b/playbooks/roles/install-kubectl/README.rst
@@ -0,0 +1,5 @@
+Install kubectl
+
+**Role Variables**
+
+* None
diff --git a/playbooks/roles/install-kubectl/tasks/main.yaml b/playbooks/roles/install-kubectl/tasks/main.yaml
new file mode 100644
index 0000000000..b308a00fe3
--- /dev/null
+++ b/playbooks/roles/install-kubectl/tasks/main.yaml
@@ -0,0 +1,16 @@
+- name: Install snapd
+  package:
+    name: snapd
+    state: present
+
+- name: Install kubectl
+  command: snap install kubectl --classic
+
+# /snap/bin is often in the path, but not in a non-login shell, which
+# makes it difficult to use via ansible.  Add an extra symlink so we
+# can always find it.
+- name: Symlink snapd into /usr/local/bin
+  file:
+    src: /snap/bin/kubectl
+    dest: /usr/local/bin/kubectl
+    state: link
diff --git a/playbooks/zuul/templates/host_vars/bridge.openstack.org.yaml.j2 b/playbooks/zuul/templates/host_vars/bridge.openstack.org.yaml.j2
index e0ab731292..d464f38c65 100644
--- a/playbooks/zuul/templates/host_vars/bridge.openstack.org.yaml.j2
+++ b/playbooks/zuul/templates/host_vars/bridge.openstack.org.yaml.j2
@@ -58,4 +58,4 @@ clouds:
   openstackzuul_arm64ci_username: user
   openstackzuul_arm64ci_password: password
   openstackzuul_arm64ci_project_name: project
-gitea_kube_key: gitea_k8s_key
+gitea_kube_key: Z2l0ZWFfazhzX2tleQ==
diff --git a/testinfra/test_bridge.py b/testinfra/test_bridge.py
index d901a68e72..64e27fc0e7 100644
--- a/testinfra/test_bridge.py
+++ b/testinfra/test_bridge.py
@@ -71,4 +71,9 @@ def test_kube_config(host):
     kubeconfig = host.file('/root/.kube/config')
     assert kubeconfig.exists
 
-    assert b'gitea_k8s_key' in kubeconfig.content
+    assert b'Z2l0ZWFfazhzX2tleQ==' in kubeconfig.content
+
+
+def test_kubectl(host):
+    kube = host.run('kubectl help')
+    assert kube.rc == 0