diff --git a/cluster/openstack-heat/config-default.sh b/cluster/openstack-heat/config-default.sh
index 643fb5e0a49..480e6f43059 100644
--- a/cluster/openstack-heat/config-default.sh
+++ b/cluster/openstack-heat/config-default.sh
@@ -35,6 +35,7 @@ MINION_FLAVOR=${MINION_FLAVOR:-m1.medium}
 
 EXTERNAL_NETWORK=${EXTERNAL_NETWORK:-public}
 
+#FIXME This can get set by evaulating the output of `swift auth` and stripping the base URL from OS_STORAGE_URL, but will require a refactor. Till then...
 SWIFT_SERVER_URL=${SWIFT_SERVER_URL:-http://192.168.123.100:8080}
 
 # Flag indicates if new image must be created. If 'false' then image with IMAGE_ID will be used.
diff --git a/cluster/openstack-heat/kubernetes-heat/fragments/deploy-kube-auth-files-master.yaml b/cluster/openstack-heat/kubernetes-heat/fragments/deploy-kube-auth-files-master.yaml
index 10ba9ae8861..a7912927642 100644
--- a/cluster/openstack-heat/kubernetes-heat/fragments/deploy-kube-auth-files-master.yaml
+++ b/cluster/openstack-heat/kubernetes-heat/fragments/deploy-kube-auth-files-master.yaml
@@ -7,7 +7,7 @@ write_files:
   - path: /srv/salt-overlay/salt/kube-apiserver/basic_auth.csv
     permissions: "0600"
     content: |
-      $apiserver_user,$apiserver_password,admin
+      $apiserver_password,$apiserver_user,admin
   - path: /srv/salt-overlay/salt/kube-apiserver/known_tokens.csv
     permissions: "0600"
     content: |