diff --git a/Dockerfile b/Dockerfile
index 492dd54..c8fa2ae 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@ FROM alpine/helm
 MAINTAINER Erin Call <erin@liffft.com>
 
 COPY build/drone-helm /bin/drone-helm
-COPY kubeconfig /root/.kube/config.tpl
+COPY assets/kubeconfig.tpl /root/.kube/config.tpl
 
 LABEL description="Helm 3 plugin for Drone 3"
 LABEL base="alpine/helm"
diff --git a/kubeconfig b/assets/kubeconfig.tpl
similarity index 100%
rename from kubeconfig
rename to assets/kubeconfig.tpl
diff --git a/go.mod b/go.mod
index 4f4371b..c34f191 100644
--- a/go.mod
+++ b/go.mod
@@ -8,4 +8,5 @@ require (
 	github.com/stretchr/testify v1.4.0
 	golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f // indirect
 	golang.org/x/tools v0.0.0-20191209225234-22774f7dae43 // indirect
+	gopkg.in/yaml.v2 v2.2.2
 )
diff --git a/internal/helm/plan.go b/internal/helm/plan.go
index a82ffea..8ad0745 100644
--- a/internal/helm/plan.go
+++ b/internal/helm/plan.go
@@ -88,7 +88,7 @@ func (p *Plan) Execute() error {
 		}
 
 		if err := step.Execute(p.runCfg); err != nil {
-			return fmt.Errorf("in execution step %d: %w", i, err)
+			return fmt.Errorf("while executing %T step: %w", step, err)
 		}
 	}
 
diff --git a/internal/helm/plan_test.go b/internal/helm/plan_test.go
index ce5311a..4808aef 100644
--- a/internal/helm/plan_test.go
+++ b/internal/helm/plan_test.go
@@ -20,6 +20,7 @@ func TestPlanTestSuite(t *testing.T) {
 
 func (suite *PlanTestSuite) TestNewPlan() {
 	ctrl := gomock.NewController(suite.T())
+	defer ctrl.Finish()
 	stepOne := NewMockStep(ctrl)
 	stepTwo := NewMockStep(ctrl)
 
@@ -65,6 +66,7 @@ func (suite *PlanTestSuite) TestNewPlan() {
 
 func (suite *PlanTestSuite) TestNewPlanAbortsOnError() {
 	ctrl := gomock.NewController(suite.T())
+	defer ctrl.Finish()
 	stepOne := NewMockStep(ctrl)
 	stepTwo := NewMockStep(ctrl)
 
@@ -87,6 +89,51 @@ func (suite *PlanTestSuite) TestNewPlanAbortsOnError() {
 	suite.EqualError(err, "while preparing *helm.MockStep step: I'm starry Dave, aye, cat blew that")
 }
 
+func (suite *PlanTestSuite) TestExecute() {
+	ctrl := gomock.NewController(suite.T())
+	defer ctrl.Finish()
+	stepOne := NewMockStep(ctrl)
+	stepTwo := NewMockStep(ctrl)
+
+	runCfg := run.Config{}
+
+	plan := Plan{
+		steps:  []Step{stepOne, stepTwo},
+		runCfg: runCfg,
+	}
+
+	stepOne.EXPECT().
+		Execute(runCfg).
+		Times(1)
+	stepTwo.EXPECT().
+		Execute(runCfg).
+		Times(1)
+
+	suite.NoError(plan.Execute())
+}
+
+func (suite *PlanTestSuite) TestExecuteAbortsOnError() {
+	ctrl := gomock.NewController(suite.T())
+	defer ctrl.Finish()
+	stepOne := NewMockStep(ctrl)
+	stepTwo := NewMockStep(ctrl)
+
+	runCfg := run.Config{}
+
+	plan := Plan{
+		steps:  []Step{stepOne, stepTwo},
+		runCfg: runCfg,
+	}
+
+	stepOne.EXPECT().
+		Execute(runCfg).
+		Times(1).
+		Return(fmt.Errorf("oh, he'll gnaw"))
+
+	err := plan.Execute()
+	suite.EqualError(err, "while executing *helm.MockStep step: oh, he'll gnaw")
+}
+
 func (suite *PlanTestSuite) TestUpgrade() {
 	cfg := Config{
 		ChartVersion: "seventeen",
diff --git a/internal/run/initkube_test.go b/internal/run/initkube_test.go
index 92b9b15..72452a8 100644
--- a/internal/run/initkube_test.go
+++ b/internal/run/initkube_test.go
@@ -1,12 +1,12 @@
 package run
 
 import (
+	"github.com/stretchr/testify/suite"
+	yaml "gopkg.in/yaml.v2"
 	"io/ioutil"
 	"os"
-	"text/template"
-	// "github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/suite"
 	"testing"
+	"text/template"
 )
 
 type InitKubeTestSuite struct {
@@ -58,6 +58,59 @@ namespace: Cisco
 	suite.Equal(want, string(conf))
 }
 
+func (suite *InitKubeTestSuite) TestExecuteGeneratesConfig() {
+	configFile, err := tempfile("kubeconfig********.yml", "")
+	defer os.Remove(configFile.Name())
+	suite.Require().NoError(err)
+
+	cfg := Config{
+		Namespace: "marshmallow",
+	}
+	init := InitKube{
+		ConfigFile:     configFile.Name(),
+		TemplateFile:   "../../assets/kubeconfig.tpl", // the actual kubeconfig template
+		APIServer:      "https://kube.cluster/peanut",
+		ServiceAccount: "chef",
+		Token:          "eWVhaCB3ZSB0b2tpbic=",
+		Certificate:    "d293LCB5b3UgYXJlIHNvIGNvb2wgZm9yIHNtb2tpbmcgd2VlZCDwn5mE",
+	}
+	suite.Require().NoError(init.Prepare(cfg))
+	suite.Require().NoError(init.Execute(cfg))
+
+	contents, err := ioutil.ReadFile(configFile.Name())
+	suite.Require().NoError(err)
+
+	// each setting should be reflected in the generated file
+	expectations := []string{
+		"namespace: marshmallow",
+		"server: https://kube.cluster/peanut",
+		"user: chef",
+		"name: chef",
+		"token: eWVhaCB3ZSB0b2tpbic",
+		"certificate-authority-data: d293LCB5b3UgYXJlIHNvIGNvb2wgZm9yIHNtb2tpbmcgd2VlZCDwn5mE",
+	}
+	for _, expected := range expectations {
+		suite.Contains(string(contents), expected)
+	}
+
+	// the generated config should be valid yaml, with no repeated keys
+	conf := map[string]interface{}{}
+	suite.NoError(yaml.UnmarshalStrict(contents, &conf))
+
+	// test the other branch of the certificate/SkipTLSVerify conditional
+	init.SkipTLSVerify = true
+	init.Certificate = ""
+
+	suite.Require().NoError(init.Prepare(cfg))
+	suite.Require().NoError(init.Execute(cfg))
+	contents, err = ioutil.ReadFile(configFile.Name())
+	suite.Require().NoError(err)
+	suite.Contains(string(contents), "insecure-skip-tls-verify: true")
+
+	conf = map[string]interface{}{}
+	suite.NoError(yaml.UnmarshalStrict(contents, &conf))
+}
+
 func (suite *InitKubeTestSuite) TestPrepareParseError() {
 	templateFile, err := tempfile("kubeconfig********.yml.tpl", `{{ NonexistentFunction }}`)
 	defer os.Remove(templateFile.Name())