Add Management Network For System Administration.

This change adds a system management network to all overcloud
nodes. The purpose of this network is for system administration,
for access to infrastructure services like DNS or NTP, or for
monitoring. This allows the management network to be placed on a
bond for redundancy, or for the system management network to be
an out-of-band network with no routing in or out. The management
network might also be configured as a default route instead of the
provisioning 'ctlplane' network.

This change does not enable the management network by default. An
environment file named network-management.yaml may be included to
enable the network and ports for each role. The included NIC config
templates have been updated with a block that may be uncommented
when the management network is enabled.

This change also contains some minor cleanup to the NIC templates,
particularly the multiple nic templates.

Change-Id: I0813a13f60a4f797be04b34258a2cffa9ea7e84f

26 files changed, 475 insertions, 17 deletions

diff --git a/network/config/bond-with-vlans/README.md b/network/config/bond-with-vlans/README.md
index 98879b4f..afe71776 100644
--- a/network/config/bond-with-vlans/README.md
+++ b/network/config/bond-with-vlans/README.md
@@ -3,10 +3,9 @@ Vlans on a bonded pair of NICs for each Overcloud role.
 
 There are two versions of the controller role template, one with
 an external network interface, and another without. If the
-external network interface is not configured the ctlplane address
+external network interface is not configured, the ctlplane address
 ranges will be used for external (public) network traffic.
 
-
 Configuration
 -------------
 
@@ -20,8 +19,31 @@ something like this:
     OS::TripleO::ObjectStorage::Net::SoftwareConfig: network/config/bond-with-vlans/swift-storage.yaml
     OS::TripleO::CephStorage::Net::SoftwareConfig: network/config/bond-with-vlans/ceph-storage.yaml
 
+Or use this Heat environment file:
+
+  environments/net-bond-with-vlans.yaml
+
 Configuration with no External Network
 --------------------------------------
+
 Same as above except set the following value for the controller role:
 
     OS::TripleO::Controller::Net::SoftwareConfig: network/config/bond-with-vlans/controller-no-external.yaml
+
+Configuration with System Management Network
+--------------------------------------------
+
+To enable the optional System Management network, create a Heat environment
+that looks something like this:
+
+  resource\_registry:
+    OS::TripleO::Network::Management: ../network/management.yaml
+    OS::TripleO::Controller::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::Compute::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::CephStorage::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::SwiftStorage::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::BlockStorage::Ports::ManagementPort: ../network/ports/management.yaml
+
+Or use this Heat environment file:
+
+  environments/network-management.yaml
diff --git a/network/config/bond-with-vlans/ceph-storage.yaml b/network/config/bond-with-vlans/ceph-storage.yaml
index 620d1f7a..93db8666 100644
--- a/network/config/bond-with-vlans/ceph-storage.yaml
+++ b/network/config/bond-with-vlans/ceph-storage.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   BondInterfaceOvsOptions:
     default: ''
     description: The ovs_options string for the bond interface. Set things like
@@ -42,6 +46,10 @@ parameters:
     default: 40
     description: Vlan ID for the storage mgmt network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
@@ -114,6 +122,14 @@ resources:
                   addresses:
                     -
                       ip_netmask: {get_param: StorageMgmtIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  device: bond1
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/bond-with-vlans/cinder-storage.yaml b/network/config/bond-with-vlans/cinder-storage.yaml
index f4c6de8f..bea98c19 100644
--- a/network/config/bond-with-vlans/cinder-storage.yaml
+++ b/network/config/bond-with-vlans/cinder-storage.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   BondInterfaceOvsOptions:
     default: ''
     description: The ovs_options string for the bond interface. Set things like
@@ -46,6 +50,10 @@ parameters:
     default: 40
     description: Vlan ID for the storage mgmt network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
@@ -125,6 +133,14 @@ resources:
                   addresses:
                     -
                       ip_netmask: {get_param: StorageMgmtIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  device: bond1
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/bond-with-vlans/compute.yaml b/network/config/bond-with-vlans/compute.yaml
index 8cb3705b..774bf02d 100644
--- a/network/config/bond-with-vlans/compute.yaml
+++ b/network/config/bond-with-vlans/compute.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   BondInterfaceOvsOptions:
     default: ''
     description: The ovs_options string for the bond interface. Set things like
@@ -46,6 +50,10 @@ parameters:
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
@@ -125,6 +133,14 @@ resources:
                   addresses:
                     -
                       ip_netmask: {get_param: TenantIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  device: bond1
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/bond-with-vlans/controller-no-external.yaml b/network/config/bond-with-vlans/controller-no-external.yaml
index 22579e8f..375d40be 100644
--- a/network/config/bond-with-vlans/controller-no-external.yaml
+++ b/network/config/bond-with-vlans/controller-no-external.yaml
@@ -25,6 +25,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   BondInterfaceOvsOptions:
     default: ''
     description: The ovs_options string for the bond interface. Set things like
@@ -50,6 +54,10 @@ parameters:
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
@@ -66,6 +74,7 @@ resources:
             -
               type: ovs_bridge
               name: {get_input: bridge_name}
+              use_dhcp: true
               members:
                 -
                   type: ovs_bond
@@ -107,6 +116,14 @@ resources:
                   addresses:
                   -
                     ip_netmask: {get_param: TenantIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  device: bond1
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/bond-with-vlans/controller.yaml b/network/config/bond-with-vlans/controller.yaml
index eb4399ea..d3627ead 100644
--- a/network/config/bond-with-vlans/controller.yaml
+++ b/network/config/bond-with-vlans/controller.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   BondInterfaceOvsOptions:
     default: 'bond_mode=active-backup'
     description: The ovs_options string for the bond interface. Set things like
@@ -54,6 +58,10 @@ parameters:
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
@@ -119,7 +127,7 @@ resources:
                       ip_netmask: {get_param: ExternalIpSubnet}
                   routes:
                     -
-                      ip_netmask: 0.0.0.0/0
+                      default: true
                       next_hop: {get_param: ExternalInterfaceDefaultRoute}
                 -
                   type: vlan
@@ -149,6 +157,14 @@ resources:
                   addresses:
                     -
                       ip_netmask: {get_param: TenantIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  device: bond1
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/bond-with-vlans/swift-storage.yaml b/network/config/bond-with-vlans/swift-storage.yaml
index f6b2a699..de9121e5 100644
--- a/network/config/bond-with-vlans/swift-storage.yaml
+++ b/network/config/bond-with-vlans/swift-storage.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   BondInterfaceOvsOptions:
     default: ''
     description: The ovs_options string for the bond interface. Set things like
@@ -46,6 +50,10 @@ parameters:
     default: 40
     description: Vlan ID for the storage mgmt network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
@@ -125,6 +133,14 @@ resources:
                   addresses:
                     -
                       ip_netmask: {get_param: StorageMgmtIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  device: bond1
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/multiple-nics/README.md b/network/config/multiple-nics/README.md
index 3d81f0be..0d8a0f03 100644
--- a/network/config/multiple-nics/README.md
+++ b/network/config/multiple-nics/README.md
@@ -19,3 +19,21 @@ something like this:
 Or use this Heat environment file:
 
   environments/net-multiple-nics.yaml
+
+Configuration with System Management Network
+--------------------------------------------
+
+To enable the optional System Management network, create a Heat environment
+that looks something like this:
+
+  resource\_registry:
+    OS::TripleO::Network::Management: ../network/management.yaml
+    OS::TripleO::Controller::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::Compute::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::CephStorage::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::SwiftStorage::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::BlockStorage::Ports::ManagementPort: ../network/ports/management.yaml
+
+Or use this Heat environment file:
+
+  environments/network-management.yaml
diff --git a/network/config/multiple-nics/ceph-storage.yaml b/network/config/multiple-nics/ceph-storage.yaml
index 7d650f4b..a2a6b40d 100644
--- a/network/config/multiple-nics/ceph-storage.yaml
+++ b/network/config/multiple-nics/ceph-storage.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -49,6 +53,10 @@ parameters:
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
@@ -58,12 +66,12 @@ parameters:
     description: The subnet CIDR of the control plane network.
     type: string
   ControlPlaneDefaultRoute: # Override this via parameter_defaults
-    description: The subnet CIDR of the control plane network.
+    description: The default route of the control plane network.
     type: string
   DnsServers: # Override this via parameter_defaults
     default: []
     description: A list of DNS servers (2 max for some implementations) that will be added to resolv.conf.
-    type: json
+    type: comma_delimited_list
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
@@ -109,6 +117,14 @@ resources:
               addresses:
                 -
                   ip_netmask: {get_param: StorageMgmtIpSubnet}
+            # Uncomment when including environments/network-management.yaml
+            #-
+            #  type: interface
+            #  name: nic7
+            #  use_dhcp: false
+            #  addresses:
+            #    -
+            #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/multiple-nics/cinder-storage.yaml b/network/config/multiple-nics/cinder-storage.yaml
index fdb6c9d8..06b4b83f 100644
--- a/network/config/multiple-nics/cinder-storage.yaml
+++ b/network/config/multiple-nics/cinder-storage.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -49,6 +53,10 @@ parameters:
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
@@ -58,12 +66,12 @@ parameters:
     description: The subnet CIDR of the control plane network.
     type: string
   ControlPlaneDefaultRoute: # Override this via parameter_defaults
-    description: The subnet CIDR of the control plane network.
+    description: The default route of the control plane network.
     type: string
   DnsServers: # Override this via parameter_defaults
     default: []
     description: A list of DNS servers (2 max for some implementations) that will be added to resolv.conf.
-    type: json
+    type: comma_delimited_list
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
@@ -116,6 +124,14 @@ resources:
               addresses:
                 -
                   ip_netmask: {get_param: InternalApiIpSubnet}
+            # Uncomment when including environments/network-management.yaml
+            #-
+            #  type: interface
+            #  name: nic7
+            #  use_dhcp: false
+            #  addresses:
+            #    -
+            #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/multiple-nics/compute.yaml b/network/config/multiple-nics/compute.yaml
index 0032a287..97eef52b 100644
--- a/network/config/multiple-nics/compute.yaml
+++ b/network/config/multiple-nics/compute.yaml
@@ -29,6 +29,14 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
+  ExternalNetworkVlanID:
+    default: 10
+    description: Vlan ID for the external network traffic.
+    type: number
   InternalApiNetworkVlanID:
     default: 20
     description: Vlan ID for the internal_api network traffic.
@@ -37,21 +45,33 @@ parameters:
     default: 30
     description: Vlan ID for the storage network traffic.
     type: number
+  StorageMgmtNetworkVlanID:
+    default: 40
+    description: Vlan ID for the storage mgmt network traffic.
+    type: number
   TenantNetworkVlanID:
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
+  ExternalInterfaceDefaultRoute:
+    default: '10.0.0.1'
+    description: default route for the external network
+    type: string
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
     type: string
   ControlPlaneDefaultRoute: # Override this via parameter_defaults
-    description: The subnet CIDR of the control plane network.
+    description: The default route of the control plane network.
     type: string
   DnsServers: # Override this via parameter_defaults
     default: []
     description: A list of DNS servers (2 max for some implementations) that will be added to resolv.conf.
-    type: json
+    type: comma_delimited_list
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
@@ -112,6 +132,14 @@ resources:
                   use_dhcp: false
                   # force the MAC address of the bridge to this interface
                   primary: true
+            # Uncomment when including environments/network-management.yaml
+            #-
+            #  type: interface
+            #  name: nic7
+            #  use_dhcp: false
+            #  addresses:
+            #    -
+            #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/multiple-nics/controller.yaml b/network/config/multiple-nics/controller.yaml
index 63f53a1f..32851cfb 100644
--- a/network/config/multiple-nics/controller.yaml
+++ b/network/config/multiple-nics/controller.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -49,6 +53,10 @@ parameters:
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
@@ -58,12 +66,12 @@ parameters:
     description: The subnet CIDR of the control plane network.
     type: string
   ControlPlaneDefaultRoute: # Override this via parameter_defaults
-    description: The subnet CIDR of the control plane network.
+    description: The default route of the control plane network.
     type: string
   DnsServers: # Override this via parameter_defaults
     default: []
     description: A list of DNS servers (2 max for some implementations) that will be added to resolv.conf.
-    type: json
+    type: comma_delimited_list
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
@@ -131,13 +139,14 @@ resources:
             -
               type: ovs_bridge
               name: {get_input: bridge_name}
+              dns_servers: {get_param: DnsServers}
               use_dhcp: false
               addresses:
                 -
                   ip_netmask: {get_param: ExternalIpSubnet}
               routes:
                 -
-                  ip_netmask: 0.0.0.0/0
+                  default: true
                   next_hop: {get_param: ExternalInterfaceDefaultRoute}
               members:
                 -
@@ -145,6 +154,14 @@ resources:
                   name: nic6
                   # force the MAC address of the bridge to this interface
                   primary: true
+            # Uncomment when including environments/network-management.yaml
+            #-
+            #  type: interface
+            #  name: nic7
+            #  use_dhcp: false
+            #  addresses:
+            #    -
+            #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/multiple-nics/swift-storage.yaml b/network/config/multiple-nics/swift-storage.yaml
index 00e4f353..4d5a7b99 100644
--- a/network/config/multiple-nics/swift-storage.yaml
+++ b/network/config/multiple-nics/swift-storage.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -49,6 +53,10 @@ parameters:
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
@@ -58,12 +66,12 @@ parameters:
     description: The subnet CIDR of the control plane network.
     type: string
   ControlPlaneDefaultRoute: # Override this via parameter_defaults
-    description: The subnet CIDR of the control plane network.
+    description: The default route of the control plane network.
     type: string
   DnsServers: # Override this via parameter_defaults
     default: []
     description: A list of DNS servers (2 max for some implementations) that will be added to resolv.conf.
-    type: json
+    type: comma_delimited_list
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
@@ -116,6 +124,14 @@ resources:
               addresses:
                 -
                   ip_netmask: {get_param: InternalApiIpSubnet}
+            # Uncomment when including environments/network-management.yaml
+            #-
+            #  type: interface
+            #  name: nic7
+            #  use_dhcp: false
+            #  addresses:
+            #    -
+            #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/single-nic-vlans/README.md b/network/config/single-nic-vlans/README.md
index 6f128650..f9c2e512 100644
--- a/network/config/single-nic-vlans/README.md
+++ b/network/config/single-nic-vlans/README.md
@@ -1,9 +1,9 @@
 This directory contains Heat templates to help configure
-Vlans on a single NICs for each Overcloud role.
+Vlans on a single NIC for each Overcloud role.
 
 There are two versions of the controller role template, one with
 an external network interface, and another without. If the
-external network interface is not configured the ctlplane address
+external network interface is not configured, the ctlplane address
 ranges will be used for external (public) network traffic.
 
 Configuration
@@ -23,9 +23,27 @@ Or use this Heat environment file:
 
   environments/net-single-nic-with-vlans.yaml
 
-
 Configuration with no External Network
 --------------------------------------
+
 Same as above except set the following value for the controller role:
 
     OS::TripleO::Controller::Net::SoftwareConfig: network/config/single-nic-vlans/controller-no-external.yaml
+
+Configuration with System Management Network
+--------------------------------------------
+
+To enable the optional System Management network, create a Heat environment
+that looks something like this:
+
+  resource\_registry:
+    OS::TripleO::Network::Management: ../network/management.yaml
+    OS::TripleO::Controller::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::Compute::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::CephStorage::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::SwiftStorage::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::BlockStorage::Ports::ManagementPort: ../network/ports/management.yaml
+
+Or use this Heat environment file:
+
+  environments/network-management.yaml
diff --git a/network/config/single-nic-vlans/ceph-storage.yaml b/network/config/single-nic-vlans/ceph-storage.yaml
index 5148c520..80bc32d3 100644
--- a/network/config/single-nic-vlans/ceph-storage.yaml
+++ b/network/config/single-nic-vlans/ceph-storage.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   StorageNetworkVlanID:
     default: 30
     description: Vlan ID for the storage network traffic.
@@ -37,6 +41,10 @@ parameters:
     default: 40
     description: Vlan ID for the storage mgmt network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
@@ -97,6 +105,13 @@ resources:
                   addresses:
                     -
                       ip_netmask: {get_param: StorageMgmtIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/single-nic-vlans/cinder-storage.yaml b/network/config/single-nic-vlans/cinder-storage.yaml
index e79a9f4b..e509443a 100644
--- a/network/config/single-nic-vlans/cinder-storage.yaml
+++ b/network/config/single-nic-vlans/cinder-storage.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   InternalApiNetworkVlanID:
     default: 20
     description: Vlan ID for the internal_api network traffic.
@@ -41,6 +45,10 @@ parameters:
     default: 40
     description: Vlan ID for the storage mgmt network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
@@ -107,6 +115,13 @@ resources:
                   addresses:
                     -
                       ip_netmask: {get_param: StorageMgmtIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/single-nic-vlans/compute.yaml b/network/config/single-nic-vlans/compute.yaml
index 4e93b31c..8cf6825d 100644
--- a/network/config/single-nic-vlans/compute.yaml
+++ b/network/config/single-nic-vlans/compute.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   InternalApiNetworkVlanID:
     default: 20
     description: Vlan ID for the internal_api network traffic.
@@ -41,6 +45,10 @@ parameters:
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
@@ -107,6 +115,13 @@ resources:
                   addresses:
                     -
                       ip_netmask: {get_param: TenantIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/single-nic-vlans/controller-no-external.yaml b/network/config/single-nic-vlans/controller-no-external.yaml
index faf9e9c2..eb5e1e5a 100644
--- a/network/config/single-nic-vlans/controller-no-external.yaml
+++ b/network/config/single-nic-vlans/controller-no-external.yaml
@@ -25,6 +25,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -45,6 +49,10 @@ parameters:
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
@@ -92,6 +100,13 @@ resources:
                   addresses:
                   -
                     ip_netmask: {get_param: TenantIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/single-nic-vlans/controller.yaml b/network/config/single-nic-vlans/controller.yaml
index 3c536d67..3b22b36b 100644
--- a/network/config/single-nic-vlans/controller.yaml
+++ b/network/config/single-nic-vlans/controller.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -49,6 +53,10 @@ parameters:
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
@@ -129,6 +137,12 @@ resources:
                   addresses:
                     -
                       ip_netmask: {get_param: TenantIpSubnet}
+                #-  # Uncomment when including environments/network-management.yaml
+                #  type: vlan
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/config/single-nic-vlans/swift-storage.yaml b/network/config/single-nic-vlans/swift-storage.yaml
index 83b3304f..efc03393 100644
--- a/network/config/single-nic-vlans/swift-storage.yaml
+++ b/network/config/single-nic-vlans/swift-storage.yaml
@@ -29,6 +29,10 @@ parameters:
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   InternalApiNetworkVlanID:
     default: 20
     description: Vlan ID for the internal_api network traffic.
@@ -41,6 +45,10 @@ parameters:
     default: 40
     description: Vlan ID for the storage mgmt network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
@@ -107,6 +115,13 @@ resources:
                   addresses:
                     -
                       ip_netmask: {get_param: StorageMgmtIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
diff --git a/network/management.yaml b/network/management.yaml
new file mode 100644
index 00000000..9bfaafa2
--- /dev/null
+++ b/network/management.yaml
@@ -0,0 +1,64 @@
+heat_template_version: 2015-04-30
+
+description: >
+  Management network. System administration, SSH, DNS, NTP, etc. This network
+  would usually be the default gateway for the non-controller nodes.
+
+parameters:
+  # the defaults here work for static IP assignment (IPAM) only
+  ManagementNetCidr:
+    default: '10.0.1.0/24'
+    description: Cidr for the management network.
+    type: string
+  ManagementNetValueSpecs:
+    default: {'provider:physical_network': 'management', 'provider:network_type': 'flat'}
+    description: Value specs for the management network.
+    type: string
+  ManagementNetAdminStateUp:
+    default: false
+    description: This admin state of of the network.
+    type: boolean
+  ManagementNetEnableDHCP:
+    default: false
+    description: Whether to enable DHCP on the associated subnet.
+    type: boolean
+  ManagementNetShared:
+    default: false
+    description: Whether this network is shared across all tenants.
+    type: boolean
+  ManagementNetName:
+    default: management
+    description: The name of the management network.
+    type: string
+  ManagementSubnetName:
+    default: management_subnet
+    description: The name of the management subnet in Neutron.
+    type: string
+  ManagementAllocationPools:
+    default: [{'start': '10.0.1.4', 'end': '10.0.1.250'}]
+    description: Ip allocation pool range for the management network.
+    type: json
+
+resources:
+  ManagementNetwork:
+    type: OS::Neutron::Net
+    properties:
+      admin_state_up: {get_param: ManagementNetAdminStateUp}
+      name: {get_param: ManagementNetName}
+      shared: {get_param: ManagementNetShared}
+      value_specs: {get_param: ManagementNetValueSpecs}
+
+  ManagementSubnet:
+    type: OS::Neutron::Subnet
+    properties:
+      cidr: {get_param: ManagementNetCidr}
+      enable_dhcp: {get_param: ManagementNetEnableDHCP}
+      name: {get_param: ManagementSubnetName}
+      network: {get_resource: ManagementNetwork}
+      allocation_pools: {get_param: ManagementAllocationPools}
+
+outputs:
+  OS::stack_id:
+    description: Neutron management network
+    value: {get_resource: ManagementNetwork}
+
diff --git a/network/networks.yaml b/network/networks.yaml
index 6618af38..ab50ae11 100644
--- a/network/networks.yaml
+++ b/network/networks.yaml
@@ -18,3 +18,6 @@ resources:
 
   TenantNetwork:
     type: OS::TripleO::Network::Tenant
+
+  ManagementNetwork:
+    type: OS::TripleO::Network::Management
diff --git a/network/ports/management.yaml b/network/ports/management.yaml
new file mode 100644
index 00000000..1d15ca60
--- /dev/null
+++ b/network/ports/management.yaml
@@ -0,0 +1,42 @@
+heat_template_version: 2015-04-30
+
+description: >
+  Creates a port on the management network. The IP address will be chosen
+  automatically if FixedIPs is empty.
+
+parameters:
+  ManagementNetName:
+    description: Name of the management neutron network
+    default: management
+    type: string
+  PortName:
+    description: Name of the port
+    default: ''
+    type: string
+  ControlPlaneIP: # Here for compatibility with noop.yaml
+    description: IP address on the control plane
+    type: string
+
+resources:
+
+  ManagementPort:
+    type: OS::Neutron::Port
+    properties:
+      network: {get_param: ManagementNetName}
+      name: {get_param: PortName}
+      replacement_policy: AUTO
+
+outputs:
+  ip_address:
+    description: management network IP
+    value: {get_attr: [ManagementPort, fixed_ips, 0, ip_address]}
+  ip_subnet:
+    # FIXME: this assumes a 2 digit subnet CIDR (need more heat functions?)
+    description: IP/Subnet CIDR for the management network IP
+    value:
+          list_join:
+            - ''
+            - - {get_attr: [ManagementPort, fixed_ips, 0, ip_address]}
+              - '/'
+              - {get_attr: [ManagementPort, subnets, 0, cidr, -2]}
+              - {get_attr: [ManagementPort, subnets, 0, cidr, -1]}
diff --git a/network/ports/net_ip_list_map.yaml b/network/ports/net_ip_list_map.yaml
index 257d3f9b..32272bd6 100644
--- a/network/ports/net_ip_list_map.yaml
+++ b/network/ports/net_ip_list_map.yaml
@@ -19,6 +19,9 @@ parameters:
   TenantIpList:
     default: []
     type: comma_delimited_list
+  ManagementIpList:
+    default: []
+    type: comma_delimited_list
 
 outputs:
   net_ip_map:
@@ -32,3 +35,4 @@ outputs:
       storage: {get_param: StorageIpList}
       storage_mgmt: {get_param: StorageMgmtIpList}
       tenant: {get_param: TenantIpList}
+      management: {get_param: ManagementIpList}
diff --git a/network/ports/net_ip_map.yaml b/network/ports/net_ip_map.yaml
index 7aaed160..c6386025 100644
--- a/network/ports/net_ip_map.yaml
+++ b/network/ports/net_ip_map.yaml
@@ -19,6 +19,9 @@ parameters:
   TenantIp:
     default: ''
     type: string
+  ManagementIp:
+    default: ''
+    type: string
 
 outputs:
   net_ip_map:
@@ -32,3 +35,4 @@ outputs:
       storage: {get_param: StorageIp}
       storage_mgmt: {get_param: StorageMgmtIp}
       tenant: {get_param: TenantIp}
+      management: {get_param: ManagementIp}
diff --git a/network/ports/net_ip_subnet_map.yaml b/network/ports/net_ip_subnet_map.yaml
index cf59adb3..2f933eaa 100644
--- a/network/ports/net_ip_subnet_map.yaml
+++ b/network/ports/net_ip_subnet_map.yaml
@@ -19,6 +19,9 @@ parameters:
   TenantIpSubnet:
     default: ''
     type: string
+  ManagementIpSubnet:
+    default: ''
+    type: string
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
@@ -41,3 +44,4 @@ outputs:
       storage: {get_param: StorageIpSubnet}
       storage_mgmt: {get_param: StorageMgmtIpSubnet}
       tenant: {get_param: TenantIpSubnet}
+      management: {get_param: ManagementIpSubnet}