Apply os-net-config with a script instead of element

Wire in os-net-config via a normal script heat deployment, which has the
following advantages:

1. Improved error path, currently o-a-c deployments don't report any
errors, thus hang and eventually the deployment times out

2. It's far more hackable from a deployer perspective, e.g it's
much easier to change the os-net-config options or include a
mapping file

3. Reduces our dependencies on o-a-c (it's only os-net-config and hiera
which requires it), although the script does currently still use oac to
get the metadata IP.

4. May enable passing os-net-config yaml via a json parameter in future,
reducing the need for resource_registry mappings (although we'll have to
support that for backwards compatibility)

The script used is based directly on 20-os-net-config (from t-i-e
at cf94c5e, we can probably improve this now that we have an error path,
but for this initial commit it's a straight copy other than the changes to
replace o-a-c for rendering the json config file.

Co-Authored-By: Steven Hardy <shardy@redhat.com>

Change-Id: I0ed08332cfc49a579de2e83960f0d8047690b97a

28 files changed, 1742 insertions, 1664 deletions

diff --git a/network/config/bond-with-vlans/ceph-storage.yaml b/network/config/bond-with-vlans/ceph-storage.yaml
index 9f537c02..2f92f4b5 100644
--- a/network/config/bond-with-vlans/ceph-storage.yaml
+++ b/network/config/bond-with-vlans/ceph-storage.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config with 2 bonded nics on a bridge
-  with VLANs attached for the ceph storage role.
-
+  Software Config to drive os-net-config with 2 bonded nics on a bridge with VLANs attached for the ceph storage role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -35,14 +32,16 @@ parameters:
     type: string
   BondInterfaceOvsOptions:
     default: ''
-    description: The ovs_options string for the bond interface. Set things like
-                 lacp=active and/or bond_mode=balance-slb using this option.
+    description: The ovs_options string for the bond interface. Set things like lacp=active and/or bond_mode=balance-slb using
+      this option.
     type: string
     constraints:
-      - allowed_pattern: "^((?!balance.tcp).)*$"
-        description: |
-          The balance-tcp bond mode is known to cause packet loss and
-          should not be used in BondInterfaceOvsOptions.
+    - allowed_pattern: ^((?!balance.tcp).)*$
+      description: 'The balance-tcp bond mode is known to cause packet loss and
+
+        should not be used in BondInterfaceOvsOptions.
+
+        '
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -75,7 +74,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -89,64 +88,63 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-            -
-              type: ovs_bridge
-              name: br-bond
-              members:
-                -
-                  type: ovs_bond
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+              - type: ovs_bridge
+                name: br-bond
+                members:
+                - type: ovs_bond
                   name: bond1
-                  ovs_options: {get_param: BondInterfaceOvsOptions}
+                  ovs_options:
+                    get_param: BondInterfaceOvsOptions
                   members:
-                    -
-                      type: interface
-                      name: nic2
-                      primary: true
-                    -
-                      type: interface
-                      name: nic3
-                -
-                  type: vlan
+                  - type: interface
+                    name: nic2
+                    primary: true
+                  - type: interface
+                    name: nic3
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageMgmtNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageMgmtNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageMgmtIpSubnet}
+                  - ip_netmask:
+                      get_param: StorageMgmtIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the Control Plane.
@@ -161,8 +159,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/bond-with-vlans/cinder-storage.yaml b/network/config/bond-with-vlans/cinder-storage.yaml
index b4d71fa3..0e53e202 100644
--- a/network/config/bond-with-vlans/cinder-storage.yaml
+++ b/network/config/bond-with-vlans/cinder-storage.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config with 2 bonded nics on a bridge
-  with VLANs attached for the cinder storage role.
-
+  Software Config to drive os-net-config with 2 bonded nics on a bridge with VLANs attached for the cinder storage role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -35,14 +32,16 @@ parameters:
     type: string
   BondInterfaceOvsOptions:
     default: ''
-    description: The ovs_options string for the bond interface. Set things like
-                 lacp=active and/or bond_mode=balance-slb using this option.
+    description: The ovs_options string for the bond interface. Set things like lacp=active and/or bond_mode=balance-slb using
+      this option.
     type: string
     constraints:
-      - allowed_pattern: "^((?!balance.tcp).)*$"
-        description: |
-          The balance-tcp bond mode is known to cause packet loss and
-          should not be used in BondInterfaceOvsOptions.
+    - allowed_pattern: ^((?!balance.tcp).)*$
+      description: 'The balance-tcp bond mode is known to cause packet loss and
+
+        should not be used in BondInterfaceOvsOptions.
+
+        '
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -75,7 +74,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -89,71 +88,70 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-            -
-              type: ovs_bridge
-              name: br-bond
-              members:
-                -
-                  type: ovs_bond
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+              - type: ovs_bridge
+                name: br-bond
+                members:
+                - type: ovs_bond
                   name: bond1
-                  ovs_options: {get_param: BondInterfaceOvsOptions}
+                  ovs_options:
+                    get_param: BondInterfaceOvsOptions
                   members:
-                    -
-                      type: interface
-                      name: nic2
-                      primary: true
-                    -
-                      type: interface
-                      name: nic3
-                -
-                  type: vlan
+                  - type: interface
+                    name: nic2
+                    primary: true
+                  - type: interface
+                    name: nic3
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageMgmtNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageMgmtNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageMgmtIpSubnet}
+                  - ip_netmask:
+                      get_param: StorageMgmtIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the Control Plane.
@@ -168,8 +166,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/bond-with-vlans/compute-dpdk.yaml b/network/config/bond-with-vlans/compute-dpdk.yaml
index 3fc764be..a9b314a4 100644
--- a/network/config/bond-with-vlans/compute-dpdk.yaml
+++ b/network/config/bond-with-vlans/compute-dpdk.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config with 2 bonded nics on a bridge
-  with VLANs attached for the compute role.
-
+  Software Config to drive os-net-config with 2 bonded nics on a bridge with VLANs attached for the compute role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -35,8 +32,8 @@ parameters:
     type: string
   BondInterfaceOvsOptions:
     default: ''
-    description: The ovs_options string for the bond interface. Set things like
-                 lacp=active and/or bond_mode=balance-slb using this option.
+    description: The ovs_options string for the bond interface. Set things like lacp=active and/or bond_mode=balance-slb using
+      this option.
     type: string
   ExternalNetworkVlanID:
     default: 10
@@ -70,7 +67,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -84,71 +81,70 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-            -
-              type: ovs_bridge
-              name: {get_input: bridge_name}
-              members:
-                -
-                  type: ovs_bond
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+              - type: ovs_bridge
+                name: bridge_name
+                members:
+                - type: ovs_bond
                   name: bond1
-                  ovs_options: {get_param: BondInterfaceOvsOptions}
+                  ovs_options:
+                    get_param: BondInterfaceOvsOptions
                   members:
-                    -
-                      type: interface
-                      name: nic2
-                      primary: true
-                    -
-                      type: interface
-                      name: nic3
-                -
-                  type: vlan
+                  - type: interface
+                    name: nic2
+                    primary: true
+                  - type: interface
+                    name: nic3
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: TenantNetworkVlanID}
+                  vlan_id:
+                    get_param: TenantNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: TenantIpSubnet}
+                  - ip_netmask:
+                      get_param: TenantIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the Control Plane.
@@ -163,30 +159,25 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-            -
-              type: ovs_user_bridge
-              name: br-link
-              members:
-                -
-                  type: ovs_dpdk_bond
+              - type: ovs_user_bridge
+                name: br-link
+                members:
+                - type: ovs_dpdk_bond
                   name: dpdkbond0
                   members:
-                    -
-                      type: ovs_dpdk_port
-                      name: dpdk0
-                      members:
-                        -
-                          type: interface
-                          name: nic4
-                    -
-                      type: ovs_dpdk_port
-                      name: dpdk1
-                      members:
-                        -
-                          type: interface
-                          name: nic5
-
+                  - type: ovs_dpdk_port
+                    name: dpdk0
+                    members:
+                    - type: interface
+                      name: nic4
+                  - type: ovs_dpdk_port
+                    name: dpdk1
+                    members:
+                    - type: interface
+                      name: nic5
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/bond-with-vlans/compute.yaml b/network/config/bond-with-vlans/compute.yaml
index b2cfb0a2..4cac448b 100644
--- a/network/config/bond-with-vlans/compute.yaml
+++ b/network/config/bond-with-vlans/compute.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config with 2 bonded nics on a bridge
-  with VLANs attached for the compute role.
-
+  Software Config to drive os-net-config with 2 bonded nics on a bridge with VLANs attached for the compute role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -35,14 +32,16 @@ parameters:
     type: string
   BondInterfaceOvsOptions:
     default: ''
-    description: The ovs_options string for the bond interface. Set things like
-                 lacp=active and/or bond_mode=balance-slb using this option.
+    description: The ovs_options string for the bond interface. Set things like lacp=active and/or bond_mode=balance-slb using
+      this option.
     type: string
     constraints:
-      - allowed_pattern: "^((?!balance.tcp).)*$"
-        description: |
-          The balance-tcp bond mode is known to cause packet loss and
-          should not be used in BondInterfaceOvsOptions.
+    - allowed_pattern: ^((?!balance.tcp).)*$
+      description: 'The balance-tcp bond mode is known to cause packet loss and
+
+        should not be used in BondInterfaceOvsOptions.
+
+        '
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -75,7 +74,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -89,71 +88,70 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-            -
-              type: ovs_bridge
-              name: {get_input: bridge_name}
-              members:
-                -
-                  type: ovs_bond
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+              - type: ovs_bridge
+                name: bridge_name
+                members:
+                - type: ovs_bond
                   name: bond1
-                  ovs_options: {get_param: BondInterfaceOvsOptions}
+                  ovs_options:
+                    get_param: BondInterfaceOvsOptions
                   members:
-                    -
-                      type: interface
-                      name: nic2
-                      primary: true
-                    -
-                      type: interface
-                      name: nic3
-                -
-                  type: vlan
+                  - type: interface
+                    name: nic2
+                    primary: true
+                  - type: interface
+                    name: nic3
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: TenantNetworkVlanID}
+                  vlan_id:
+                    get_param: TenantNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: TenantIpSubnet}
+                  - ip_netmask:
+                      get_param: TenantIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the Control Plane.
@@ -168,8 +166,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/bond-with-vlans/controller-no-external.yaml b/network/config/bond-with-vlans/controller-no-external.yaml
index 4c3e59fa..46090974 100644
--- a/network/config/bond-with-vlans/controller-no-external.yaml
+++ b/network/config/bond-with-vlans/controller-no-external.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config with 2 bonded nics on a bridge
-  with VLANs attached for the controller role.
-
+  Software Config to drive os-net-config with 2 bonded nics on a bridge with VLANs attached for the controller role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -35,14 +32,16 @@ parameters:
     type: string
   BondInterfaceOvsOptions:
     default: ''
-    description: The ovs_options string for the bond interface. Set things like
-                 lacp=active and/or bond_mode=balance-slb using this option.
+    description: The ovs_options string for the bond interface. Set things like lacp=active and/or bond_mode=balance-slb using
+      this option.
     type: string
     constraints:
-      - allowed_pattern: "^((?!balance.tcp).)*$"
-        description: |
-          The balance-tcp bond mode is known to cause packet loss and
-          should not be used in BondInterfaceOvsOptions.
+    - allowed_pattern: ^((?!balance.tcp).)*$
+      description: 'The balance-tcp bond mode is known to cause packet loss and
+
+        should not be used in BondInterfaceOvsOptions.
+
+        '
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -71,7 +70,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute:
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: default route for the external network
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -89,79 +88,76 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-            -
-              type: ovs_bridge
-              name: {get_input: bridge_name}
-              use_dhcp: true
-              members:
-                -
-                  type: ovs_bond
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+              - type: ovs_bridge
+                name: bridge_name
+                use_dhcp: true
+                members:
+                - type: ovs_bond
                   name: bond1
-                  ovs_options: {get_param: BondInterfaceOvsOptions}
+                  ovs_options:
+                    get_param: BondInterfaceOvsOptions
                   members:
-                    -
-                      type: interface
-                      name: nic2
-                      primary: true
-                    -
-                      type: interface
-                      name: nic3
-                -
-                  type: vlan
+                  - type: interface
+                    name: nic2
+                    primary: true
+                  - type: interface
+                    name: nic3
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                  -
-                    ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                  -
-                    ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageMgmtNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageMgmtNetworkVlanID
                   addresses:
-                  -
-                    ip_netmask: {get_param: StorageMgmtIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: StorageMgmtIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: TenantNetworkVlanID}
+                  vlan_id:
+                    get_param: TenantNetworkVlanID
                   addresses:
-                  -
-                    ip_netmask: {get_param: TenantIpSubnet}
+                  - ip_netmask:
+                      get_param: TenantIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the Control Plane.
@@ -176,8 +172,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/bond-with-vlans/controller-v6.yaml b/network/config/bond-with-vlans/controller-v6.yaml
index d45ab33c..d07a26ff 100644
--- a/network/config/bond-with-vlans/controller-v6.yaml
+++ b/network/config/bond-with-vlans/controller-v6.yaml
@@ -1,11 +1,8 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config with 2 bonded nics on a bridge
-  with VLANs attached for the controller role with IPv6 on the External
-  network. The IPv6 default route is on the External network, and the
-  IPv4 default route is on the Control Plane.
-
+  Software Config to drive os-net-config with 2 bonded nics on a bridge with VLANs attached for the controller role with IPv6
+  on the External network. The IPv6 default route is on the External network, and the IPv4 default route is on the Control
+  Plane.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -36,15 +33,17 @@ parameters:
     description: IP address/subnet on the management network
     type: string
   BondInterfaceOvsOptions:
-    default: 'bond_mode=active-backup'
-    description: The ovs_options string for the bond interface. Set things like
-                 lacp=active and/or bond_mode=balance-slb using this option.
+    default: bond_mode=active-backup
+    description: The ovs_options string for the bond interface. Set things like lacp=active and/or bond_mode=balance-slb using
+      this option.
     type: string
     constraints:
-      - allowed_pattern: "^((?!balance.tcp).)*$"
-        description: |
-          The balance-tcp bond mode is known to cause packet loss and
-          should not be used in BondInterfaceOvsOptions.
+    - allowed_pattern: ^((?!balance.tcp).)*$
+      description: 'The balance-tcp bond mode is known to cause packet loss and
+
+        should not be used in BondInterfaceOvsOptions.
+
+        '
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -77,7 +76,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute:
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: default route for the external network
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -91,89 +90,88 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-            -
-              type: ovs_bridge
-              name: {get_input: bridge_name}
-              dns_servers: {get_param: DnsServers}
-              members:
-                -
-                  type: ovs_bond
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+              - type: ovs_bridge
+                name: bridge_name
+                dns_servers:
+                  get_param: DnsServers
+                members:
+                - type: ovs_bond
                   name: bond1
-                  ovs_options: {get_param: BondInterfaceOvsOptions}
+                  ovs_options:
+                    get_param: BondInterfaceOvsOptions
                   members:
-                    -
-                      type: interface
-                      name: nic2
-                      primary: true
-                    -
-                      type: interface
-                      name: nic3
-                -
-                  type: vlan
+                  - type: interface
+                    name: nic2
+                    primary: true
+                  - type: interface
+                    name: nic3
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: ExternalNetworkVlanID}
+                  vlan_id:
+                    get_param: ExternalNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: ExternalIpSubnet}
+                  - ip_netmask:
+                      get_param: ExternalIpSubnet
                   routes:
-                    -
-                      default: true
-                      next_hop: {get_param: ExternalInterfaceDefaultRoute}
-                -
-                  type: vlan
+                  - default: true
+                    next_hop:
+                      get_param: ExternalInterfaceDefaultRoute
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageMgmtNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageMgmtNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageMgmtIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: StorageMgmtIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: TenantNetworkVlanID}
+                  vlan_id:
+                    get_param: TenantNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: TenantIpSubnet}
+                  - ip_netmask:
+                      get_param: TenantIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the External interface. This will
@@ -189,8 +187,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/bond-with-vlans/controller.yaml b/network/config/bond-with-vlans/controller.yaml
index 677c90c5..e2973a72 100644
--- a/network/config/bond-with-vlans/controller.yaml
+++ b/network/config/bond-with-vlans/controller.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config with 2 bonded nics on a bridge
-  with VLANs attached for the controller role.
-
+  Software Config to drive os-net-config with 2 bonded nics on a bridge with VLANs attached for the controller role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -34,15 +31,17 @@ parameters:
     description: IP address/subnet on the management network
     type: string
   BondInterfaceOvsOptions:
-    default: 'bond_mode=active-backup'
-    description: The ovs_options string for the bond interface. Set things like
-                 lacp=active and/or bond_mode=balance-slb using this option.
+    default: bond_mode=active-backup
+    description: The ovs_options string for the bond interface. Set things like lacp=active and/or bond_mode=balance-slb using
+      this option.
     type: string
     constraints:
-      - allowed_pattern: "^((?!balance.tcp).)*$"
-        description: |
-          The balance-tcp bond mode is known to cause packet loss and
-          should not be used in BondInterfaceOvsOptions.
+    - allowed_pattern: ^((?!balance.tcp).)*$
+      description: 'The balance-tcp bond mode is known to cause packet loss and
+
+        should not be used in BondInterfaceOvsOptions.
+
+        '
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -71,7 +70,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute:
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: default route for the external network
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -89,86 +88,85 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-            -
-              type: ovs_bridge
-              name: {get_input: bridge_name}
-              dns_servers: {get_param: DnsServers}
-              members:
-                -
-                  type: ovs_bond
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+              - type: ovs_bridge
+                name: bridge_name
+                dns_servers:
+                  get_param: DnsServers
+                members:
+                - type: ovs_bond
                   name: bond1
-                  ovs_options: {get_param: BondInterfaceOvsOptions}
+                  ovs_options:
+                    get_param: BondInterfaceOvsOptions
                   members:
-                    -
-                      type: interface
-                      name: nic2
-                      primary: true
-                    -
-                      type: interface
-                      name: nic3
-                -
-                  type: vlan
+                  - type: interface
+                    name: nic2
+                    primary: true
+                  - type: interface
+                    name: nic3
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: ExternalNetworkVlanID}
+                  vlan_id:
+                    get_param: ExternalNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: ExternalIpSubnet}
+                  - ip_netmask:
+                      get_param: ExternalIpSubnet
                   routes:
-                    -
-                      default: true
-                      next_hop: {get_param: ExternalInterfaceDefaultRoute}
-                -
-                  type: vlan
+                  - default: true
+                    next_hop:
+                      get_param: ExternalInterfaceDefaultRoute
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageMgmtNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageMgmtNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageMgmtIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: StorageMgmtIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: TenantNetworkVlanID}
+                  vlan_id:
+                    get_param: TenantNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: TenantIpSubnet}
+                  - ip_netmask:
+                      get_param: TenantIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the External interface. This will
@@ -184,8 +182,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/bond-with-vlans/swift-storage.yaml b/network/config/bond-with-vlans/swift-storage.yaml
index e16d6b6e..5bdba802 100644
--- a/network/config/bond-with-vlans/swift-storage.yaml
+++ b/network/config/bond-with-vlans/swift-storage.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config with 2 bonded nics on a bridge
-  with VLANs attached for the swift storage role.
-
+  Software Config to drive os-net-config with 2 bonded nics on a bridge with VLANs attached for the swift storage role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -35,14 +32,16 @@ parameters:
     type: string
   BondInterfaceOvsOptions:
     default: ''
-    description: The ovs_options string for the bond interface. Set things like
-                 lacp=active and/or bond_mode=balance-slb using this option.
+    description: The ovs_options string for the bond interface. Set things like lacp=active and/or bond_mode=balance-slb using
+      this option.
     type: string
     constraints:
-      - allowed_pattern: "^((?!balance.tcp).)*$"
-        description: |
-          The balance-tcp bond mode is known to cause packet loss and
-          should not be used in BondInterfaceOvsOptions.
+    - allowed_pattern: ^((?!balance.tcp).)*$
+      description: 'The balance-tcp bond mode is known to cause packet loss and
+
+        should not be used in BondInterfaceOvsOptions.
+
+        '
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
@@ -75,7 +74,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -89,71 +88,70 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-            -
-              type: ovs_bridge
-              name: br-bond
-              members:
-                -
-                  type: ovs_bond
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+              - type: ovs_bridge
+                name: br-bond
+                members:
+                - type: ovs_bond
                   name: bond1
-                  ovs_options: {get_param: BondInterfaceOvsOptions}
+                  ovs_options:
+                    get_param: BondInterfaceOvsOptions
                   members:
-                    -
-                      type: interface
-                      name: nic2
-                      primary: true
-                    -
-                      type: interface
-                      name: nic3
-                -
-                  type: vlan
+                  - type: interface
+                    name: nic2
+                    primary: true
+                  - type: interface
+                    name: nic3
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
                   device: bond1
-                  vlan_id: {get_param: StorageMgmtNetworkVlanID}
+                  vlan_id:
+                    get_param: StorageMgmtNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageMgmtIpSubnet}
+                  - ip_netmask:
+                      get_param: StorageMgmtIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the Control Plane.
@@ -168,8 +166,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/multiple-nics/ceph-storage.yaml b/network/config/multiple-nics/ceph-storage.yaml
index c31c6e65..e9c34213 100644
--- a/network/config/multiple-nics/ceph-storage.yaml
+++ b/network/config/multiple-nics/ceph-storage.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure multiple interfaces
-  for the ceph storage role.
-
+  Software Config to drive os-net-config to configure multiple interfaces for the ceph storage role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -65,7 +62,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -79,48 +76,48 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-            -
-              type: interface
-              name: nic2
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageIpSubnet}
-            -
-              type: interface
-              name: nic3
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageMgmtIpSubnet}
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+              - type: interface
+                name: nic2
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: StorageIpSubnet
+              - type: interface
+                name: nic3
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: StorageMgmtIpSubnet
             # Uncomment when including environments/network-management.yaml
             # If setting default route on the Management interface, comment
             # out the default route on the Control Plane.
@@ -135,8 +132,9 @@ resources:
             #    -
             #      default: true
             #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/multiple-nics/cinder-storage.yaml b/network/config/multiple-nics/cinder-storage.yaml
index 4f8b7f64..f58f1168 100644
--- a/network/config/multiple-nics/cinder-storage.yaml
+++ b/network/config/multiple-nics/cinder-storage.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure multiple interfaces
-  for the cinder storage role.
-
+  Software Config to drive os-net-config to configure multiple interfaces for the cinder storage role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -65,7 +62,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -79,55 +76,54 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-            -
-              type: interface
-              name: nic2
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageIpSubnet}
-            -
-              type: interface
-              name: nic3
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageMgmtIpSubnet}
-            -
-              type: interface
-              name: nic4
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: InternalApiIpSubnet}
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+              - type: interface
+                name: nic2
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: StorageIpSubnet
+              - type: interface
+                name: nic3
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: StorageMgmtIpSubnet
+              - type: interface
+                name: nic4
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: InternalApiIpSubnet
             # Uncomment when including environments/network-management.yaml
             # If setting default route on the Management interface, comment
             # out the default route on the Control Plane.
@@ -142,8 +138,9 @@ resources:
             #    -
             #      default: true
             #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/multiple-nics/compute.yaml b/network/config/multiple-nics/compute.yaml
index 2e07d45e..9b0c8c02 100644
--- a/network/config/multiple-nics/compute.yaml
+++ b/network/config/multiple-nics/compute.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure multiple interfaces
-  for the compute role.
-
+  Software Config to drive os-net-config to configure multiple interfaces for the compute role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -65,7 +62,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -79,58 +76,56 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-            -
-              type: interface
-              name: nic2
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageIpSubnet}
-            -
-              type: interface
-              name: nic4
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: InternalApiIpSubnet}
-            -
-              type: ovs_bridge
-              name: br-tenant
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: TenantIpSubnet}
-              members:
-                -
-                  type: interface
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+              - type: interface
+                name: nic2
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: StorageIpSubnet
+              - type: interface
+                name: nic4
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: InternalApiIpSubnet
+              - type: ovs_bridge
+                name: br-tenant
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: TenantIpSubnet
+                members:
+                - type: interface
                   name: nic5
                   use_dhcp: false
                   primary: true
@@ -148,8 +143,9 @@ resources:
             #    -
             #      default: true
             #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/multiple-nics/controller-v6.yaml b/network/config/multiple-nics/controller-v6.yaml
index bbc89ab6..a0ed9f78 100644
--- a/network/config/multiple-nics/controller-v6.yaml
+++ b/network/config/multiple-nics/controller-v6.yaml
@@ -1,11 +1,7 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure multiple interfaces
-  for the controller role with IPv6 on the External network. The IPv6
-  default route is on the External network, and the IPv4 default route
-  is on the Control Plane.
-
+  Software Config to drive os-net-config to configure multiple interfaces for the controller role with IPv6 on the External
+  network. The IPv6 default route is on the External network, and the IPv4 default route is on the Control Plane.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -67,7 +63,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute:
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: default route for the external network
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -81,84 +77,80 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
                 # IPv4 Default Route
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-            -
-              type: interface
-              name: nic2
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageIpSubnet}
-            -
-              type: interface
-              name: nic3
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageMgmtIpSubnet}
-            -
-              type: interface
-              name: nic4
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: InternalApiIpSubnet}
-            -
-              type: ovs_bridge
-              name: br-tenant
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: TenantIpSubnet}
-              members:
-                -
-                  type: interface
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+              - type: interface
+                name: nic2
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: StorageIpSubnet
+              - type: interface
+                name: nic3
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: StorageMgmtIpSubnet
+              - type: interface
+                name: nic4
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: InternalApiIpSubnet
+              - type: ovs_bridge
+                name: br-tenant
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: TenantIpSubnet
+                members:
+                - type: interface
                   name: nic5
                   use_dhcp: false
                   primary: true
-            -
-              type: ovs_bridge
-              name: {get_input: bridge_name}
-              dns_servers: {get_param: DnsServers}
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: ExternalIpSubnet}
-              routes:
-                -
-                  default: true
-                  next_hop: {get_param: ExternalInterfaceDefaultRoute}
-              members:
-                -
-                  type: interface
+              - type: ovs_bridge
+                name: bridge_name
+                dns_servers:
+                  get_param: DnsServers
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: ExternalIpSubnet
+                routes:
+                - default: true
+                  next_hop:
+                    get_param: ExternalInterfaceDefaultRoute
+                members:
+                - type: interface
                   name: nic6
                   primary: true
             # Uncomment when including environments/network-management.yaml
@@ -176,8 +168,9 @@ resources:
             #    -
             #      default: true
             #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/multiple-nics/controller.yaml b/network/config/multiple-nics/controller.yaml
index a0176b5b..e38c545c 100644
--- a/network/config/multiple-nics/controller.yaml
+++ b/network/config/multiple-nics/controller.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure multiple interfaces
-  for the controller role.
-
+  Software Config to drive os-net-config to configure multiple interfaces for the controller role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -65,7 +62,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute:
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: default route for the external network
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -79,80 +76,76 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-            -
-              type: interface
-              name: nic2
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageIpSubnet}
-            -
-              type: interface
-              name: nic3
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageMgmtIpSubnet}
-            -
-              type: interface
-              name: nic4
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: InternalApiIpSubnet}
-            -
-              type: ovs_bridge
-              name: br-tenant
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: TenantIpSubnet}
-              members:
-                -
-                  type: interface
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+              - type: interface
+                name: nic2
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: StorageIpSubnet
+              - type: interface
+                name: nic3
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: StorageMgmtIpSubnet
+              - type: interface
+                name: nic4
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: InternalApiIpSubnet
+              - type: ovs_bridge
+                name: br-tenant
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: TenantIpSubnet
+                members:
+                - type: interface
                   name: nic5
                   use_dhcp: false
                   primary: true
-            -
-              type: ovs_bridge
-              name: {get_input: bridge_name}
-              dns_servers: {get_param: DnsServers}
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: ExternalIpSubnet}
-              routes:
-                -
-                  default: true
-                  next_hop: {get_param: ExternalInterfaceDefaultRoute}
-              members:
-                -
-                  type: interface
+              - type: ovs_bridge
+                name: bridge_name
+                dns_servers:
+                  get_param: DnsServers
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: ExternalIpSubnet
+                routes:
+                - default: true
+                  next_hop:
+                    get_param: ExternalInterfaceDefaultRoute
+                members:
+                - type: interface
                   name: nic6
                   primary: true
             # Uncomment when including environments/network-management.yaml
@@ -170,8 +163,9 @@ resources:
             #    -
             #      default: true
             #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/multiple-nics/swift-storage.yaml b/network/config/multiple-nics/swift-storage.yaml
index 05083105..1ad503a7 100644
--- a/network/config/multiple-nics/swift-storage.yaml
+++ b/network/config/multiple-nics/swift-storage.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure multiple interfaces
-  for the swift storage role.
-
+  Software Config to drive os-net-config to configure multiple interfaces for the swift storage role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -65,7 +62,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -79,55 +76,54 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: interface
-              name: nic1
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: interface
+                name: nic1
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-            -
-              type: interface
-              name: nic2
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageIpSubnet}
-            -
-              type: interface
-              name: nic3
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageMgmtIpSubnet}
-            -
-              type: interface
-              name: nic4
-              use_dhcp: false
-              addresses:
-                -
-                  ip_netmask: {get_param: InternalApiIpSubnet}
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+              - type: interface
+                name: nic2
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: StorageIpSubnet
+              - type: interface
+                name: nic3
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: StorageMgmtIpSubnet
+              - type: interface
+                name: nic4
+                use_dhcp: false
+                addresses:
+                - ip_netmask:
+                    get_param: InternalApiIpSubnet
             # Uncomment when including environments/network-management.yaml
             # If setting default route on the Management interface, comment
             # out the default route on the Control Plane.
@@ -142,8 +138,9 @@ resources:
             #    -
             #      default: true
             #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-linux-bridge-vlans/ceph-storage.yaml b/network/config/single-nic-linux-bridge-vlans/ceph-storage.yaml
index fc8e8b6f..0a6faa79 100644
--- a/network/config/single-nic-linux-bridge-vlans/ceph-storage.yaml
+++ b/network/config/single-nic-linux-bridge-vlans/ceph-storage.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  ceph storage role.
-
+  Software Config to drive os-net-config to configure VLANs for the ceph storage role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -65,7 +62,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -79,54 +76,55 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: linux_bridge
-              name: br-storage
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: linux_bridge
+                name: br-storage
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-              members:
-                -
-                  type: interface
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+                members:
+                - type: interface
                   name: nic1
                   # force the MAC address of the bridge to this interface
                   primary: true
-            -
-              type: vlan
-              vlan_id: {get_param: StorageNetworkVlanID}
-              device: br-storage
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: StorageMgmtNetworkVlanID}
-              device: br-storage
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageMgmtIpSubnet}
+              - type: vlan
+                vlan_id:
+                  get_param: StorageNetworkVlanID
+                device: br-storage
+                addresses:
+                - ip_netmask:
+                    get_param: StorageIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: StorageMgmtNetworkVlanID
+                device: br-storage
+                addresses:
+                - ip_netmask:
+                    get_param: StorageMgmtIpSubnet
               # Uncomment when including environments/network-management.yaml
               # If setting default route on the Management interface, comment
               # out the default route on the Control Plane.
@@ -141,8 +139,9 @@ resources:
               #    -
               #      default: true
               #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-linux-bridge-vlans/cinder-storage.yaml b/network/config/single-nic-linux-bridge-vlans/cinder-storage.yaml
index 6fb247ed..5abaea66 100644
--- a/network/config/single-nic-linux-bridge-vlans/cinder-storage.yaml
+++ b/network/config/single-nic-linux-bridge-vlans/cinder-storage.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  cinder storage role.
-
+  Software Config to drive os-net-config to configure VLANs for the cinder storage role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -65,7 +62,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -79,61 +76,62 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: linux_bridge
-              name: br-storage
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: linux_bridge
+                name: br-storage
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-              members:
-                -
-                  type: interface
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+                members:
+                - type: interface
                   name: nic1
                   # force the MAC address of the bridge to this interface
                   primary: true
-            -
-              type: vlan
-              vlan_id: {get_param: InternalApiNetworkVlanID}
-              device: br-storage
-              addresses:
-                -
-                  ip_netmask: {get_param: InternalApiIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: StorageNetworkVlanID}
-              device: br-storage
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: StorageMgmtNetworkVlanID}
-              device: br-storage
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageMgmtIpSubnet}
+              - type: vlan
+                vlan_id:
+                  get_param: InternalApiNetworkVlanID
+                device: br-storage
+                addresses:
+                - ip_netmask:
+                    get_param: InternalApiIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: StorageNetworkVlanID
+                device: br-storage
+                addresses:
+                - ip_netmask:
+                    get_param: StorageIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: StorageMgmtNetworkVlanID
+                device: br-storage
+                addresses:
+                - ip_netmask:
+                    get_param: StorageMgmtIpSubnet
               # Uncomment when including environments/network-management.yaml
               # If setting default route on the Management interface, comment
               # out the default route on the Control Plane.
@@ -148,8 +146,9 @@ resources:
               #    -
               #      default: true
               #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-linux-bridge-vlans/compute.yaml b/network/config/single-nic-linux-bridge-vlans/compute.yaml
index e31720d8..aa63dd3a 100644
--- a/network/config/single-nic-linux-bridge-vlans/compute.yaml
+++ b/network/config/single-nic-linux-bridge-vlans/compute.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  compute role.
-
+  Software Config to drive os-net-config to configure VLANs for the compute role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -65,7 +62,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -79,68 +76,69 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: linux_bridge
-              name: {get_input: bridge_name}
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: linux_bridge
+                name: bridge_name
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-              members:
-                -
-                  type: interface
-                  name: {get_input: interface_name}
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+                members:
+                - type: interface
+                  name: interface_name
                   # force the MAC address of the bridge to this interface
                   primary: true
-            -
-              type: vlan
-              vlan_id: {get_param: InternalApiNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: InternalApiIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: StorageNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: TenantNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: TenantIpSubnet}
+              - type: vlan
+                vlan_id:
+                  get_param: InternalApiNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: InternalApiIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: StorageNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: StorageIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: TenantNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: TenantIpSubnet
               # Uncomment when including environments/network-management.yaml
               # If setting default route on the Management interface, comment
               # out the default route on the Control Plane.
               #-
               #  type: vlan
               #  vlan_id: {get_param: ManagementNetworkVlanID}
-              #  device: {get_input: bridge_name}
+              #  device: bridge_name
               #  addresses:
               #    -
               #      ip_netmask: {get_param: ManagementIpSubnet}
@@ -148,8 +146,9 @@ resources:
               #    -
               #      default: true
               #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-linux-bridge-vlans/controller-v6.yaml b/network/config/single-nic-linux-bridge-vlans/controller-v6.yaml
index a299d23e..28cf6ced 100644
--- a/network/config/single-nic-linux-bridge-vlans/controller-v6.yaml
+++ b/network/config/single-nic-linux-bridge-vlans/controller-v6.yaml
@@ -1,11 +1,7 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  controller role with IPv6 on the External network. The IPv6 default
-  route is on the External network, and the IPv4 default route is on
-  the Control Plane.
-
+  Software Config to drive os-net-config to configure VLANs for the controller role with IPv6 on the External network. The
+  IPv6 default route is on the External network, and the IPv4 default route is on the Control Plane.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -63,7 +59,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute:
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: default route for the external network
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -81,78 +77,79 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: linux_bridge
-              name: {get_input: bridge_name}
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: linux_bridge
+                name: bridge_name
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-              members:
-                -
-                  type: interface
-                  name: {get_input: interface_name}
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+                members:
+                - type: interface
+                  name: interface_name
                   primary: true
-            -
-              type: vlan
-              vlan_id: {get_param: ExternalNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: ExternalIpSubnet}
-              routes:
-                -
-                  default: true
-                  next_hop: {get_param: ExternalInterfaceDefaultRoute}
-            -
-              type: vlan
-              vlan_id: {get_param: InternalApiNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: InternalApiIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: StorageNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: StorageMgmtNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageMgmtIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: TenantNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: TenantIpSubnet}
+              - type: vlan
+                vlan_id:
+                  get_param: ExternalNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: ExternalIpSubnet
+                routes:
+                - default: true
+                  next_hop:
+                    get_param: ExternalInterfaceDefaultRoute
+              - type: vlan
+                vlan_id:
+                  get_param: InternalApiNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: InternalApiIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: StorageNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: StorageIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: StorageMgmtNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: StorageMgmtIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: TenantNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: TenantIpSubnet
               # Uncomment when including environments/network-management.yaml
               # If setting default route on the Management interface, comment
               # out the default route on the External interface. This will
@@ -160,7 +157,7 @@ resources:
               #-
               #  type: vlan
               #  vlan_id: {get_param: ManagementNetworkVlanID}
-              #  device: {get_input: bridge_name}
+              #  device: bridge_name
               #  addresses:
               #    -
               #      ip_netmask: {get_param: ManagementIpSubnet}
@@ -168,8 +165,9 @@ resources:
               #    -
               #      default: true
               #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-linux-bridge-vlans/controller.yaml b/network/config/single-nic-linux-bridge-vlans/controller.yaml
index bd97ccb0..566f1feb 100644
--- a/network/config/single-nic-linux-bridge-vlans/controller.yaml
+++ b/network/config/single-nic-linux-bridge-vlans/controller.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  controller role.
-
+  Software Config to drive os-net-config to configure VLANs for the controller role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -61,7 +58,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute:
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: default route for the external network
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -79,78 +76,79 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: linux_bridge
-              name: {get_input: bridge_name}
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: linux_bridge
+                name: bridge_name
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-              members:
-                -
-                  type: interface
-                  name: {get_input: interface_name}
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+                members:
+                - type: interface
+                  name: interface_name
                   primary: true
-            -
-              type: vlan
-              vlan_id: {get_param: ExternalNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: ExternalIpSubnet}
-              routes:
-                -
-                  default: true
-                  next_hop: {get_param: ExternalInterfaceDefaultRoute}
-            -
-              type: vlan
-              vlan_id: {get_param: InternalApiNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: InternalApiIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: StorageNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: StorageMgmtNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageMgmtIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: TenantNetworkVlanID}
-              device: {get_input: bridge_name}
-              addresses:
-                -
-                  ip_netmask: {get_param: TenantIpSubnet}
+              - type: vlan
+                vlan_id:
+                  get_param: ExternalNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: ExternalIpSubnet
+                routes:
+                - default: true
+                  next_hop:
+                    get_param: ExternalInterfaceDefaultRoute
+              - type: vlan
+                vlan_id:
+                  get_param: InternalApiNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: InternalApiIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: StorageNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: StorageIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: StorageMgmtNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: StorageMgmtIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: TenantNetworkVlanID
+                device: bridge_name
+                addresses:
+                - ip_netmask:
+                    get_param: TenantIpSubnet
               # Uncomment when including environments/network-management.yaml
               # If setting default route on the Management interface, comment
               # out the default route on the External interface. This will
@@ -158,7 +156,7 @@ resources:
               #-
               #  type: vlan
               #  vlan_id: {get_param: ManagementNetworkVlanID}
-              #  device: {get_input: bridge_name}
+              #  device: bridge_name
               #  addresses:
               #    -
               #      ip_netmask: {get_param: ManagementIpSubnet}
@@ -166,8 +164,9 @@ resources:
               #    -
               #      default: true
               #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-linux-bridge-vlans/swift-storage.yaml b/network/config/single-nic-linux-bridge-vlans/swift-storage.yaml
index a5d2f966..fe948ad1 100644
--- a/network/config/single-nic-linux-bridge-vlans/swift-storage.yaml
+++ b/network/config/single-nic-linux-bridge-vlans/swift-storage.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  swift storage role.
-
+  Software Config to drive os-net-config to configure VLANs for the swift storage role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -65,7 +62,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -79,61 +76,62 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: linux_bridge
-              name: br-storage
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: linux_bridge
+                name: br-storage
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-              members:
-                -
-                  type: interface
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+                members:
+                - type: interface
                   name: nic1
                   # force the MAC address of the bridge to this interface
                   primary: true
-            -
-              type: vlan
-              vlan_id: {get_param: InternalApiNetworkVlanID}
-              device: br-storage
-              addresses:
-                -
-                  ip_netmask: {get_param: InternalApiIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: StorageNetworkVlanID}
-              device: br-storage
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageIpSubnet}
-            -
-              type: vlan
-              vlan_id: {get_param: StorageMgmtNetworkVlanID}
-              device: br-storage
-              addresses:
-                -
-                  ip_netmask: {get_param: StorageMgmtIpSubnet}
+              - type: vlan
+                vlan_id:
+                  get_param: InternalApiNetworkVlanID
+                device: br-storage
+                addresses:
+                - ip_netmask:
+                    get_param: InternalApiIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: StorageNetworkVlanID
+                device: br-storage
+                addresses:
+                - ip_netmask:
+                    get_param: StorageIpSubnet
+              - type: vlan
+                vlan_id:
+                  get_param: StorageMgmtNetworkVlanID
+                device: br-storage
+                addresses:
+                - ip_netmask:
+                    get_param: StorageMgmtIpSubnet
               # Uncomment when including environments/network-management.yaml
               # If setting default route on the Management interface, comment
               # out the default route on the Control Plane.
@@ -148,8 +146,9 @@ resources:
               #    -
               #      default: true
               #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-vlans/ceph-storage.yaml b/network/config/single-nic-vlans/ceph-storage.yaml
index 6fa288af..6e0a97da 100644
--- a/network/config/single-nic-vlans/ceph-storage.yaml
+++ b/network/config/single-nic-vlans/ceph-storage.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  ceph storage role.
-
+  Software Config to drive os-net-config to configure VLANs for the ceph storage role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -53,7 +50,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -67,52 +64,53 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: ovs_bridge
-              name: br-storage
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: ovs_bridge
+                name: br-storage
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-              members:
-                -
-                  type: interface
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+                members:
+                - type: interface
                   name: nic1
                   # force the MAC address of the bridge to this interface
                   primary: true
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageMgmtNetworkVlanID}
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageMgmtNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageMgmtIpSubnet}
+                  - ip_netmask:
+                      get_param: StorageMgmtIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the Control Plane.
@@ -126,8 +124,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-vlans/cinder-storage.yaml b/network/config/single-nic-vlans/cinder-storage.yaml
index d1135776..f58665f7 100644
--- a/network/config/single-nic-vlans/cinder-storage.yaml
+++ b/network/config/single-nic-vlans/cinder-storage.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  cinder storage role.
-
+  Software Config to drive os-net-config to configure VLANs for the cinder storage role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -57,7 +54,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -71,58 +68,59 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: ovs_bridge
-              name: br-storage
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: ovs_bridge
+                name: br-storage
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-              members:
-                -
-                  type: interface
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+                members:
+                - type: interface
                   name: nic1
                   # force the MAC address of the bridge to this interface
                   primary: true
-                -
-                  type: vlan
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                - type: vlan
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageMgmtNetworkVlanID}
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageMgmtNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageMgmtIpSubnet}
+                  - ip_netmask:
+                      get_param: StorageMgmtIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the Control Plane.
@@ -136,8 +134,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-vlans/compute.yaml b/network/config/single-nic-vlans/compute.yaml
index bd3cef34..40264284 100644
--- a/network/config/single-nic-vlans/compute.yaml
+++ b/network/config/single-nic-vlans/compute.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  compute role.
-
+  Software Config to drive os-net-config to configure VLANs for the compute role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -57,7 +54,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -71,58 +68,59 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: ovs_bridge
-              name: {get_input: bridge_name}
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: ovs_bridge
+                name: bridge_name
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-              members:
-                -
-                  type: interface
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+                members:
+                - type: interface
                   name: nic1
                   # force the MAC address of the bridge to this interface
                   primary: true
-                -
-                  type: vlan
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                - type: vlan
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: TenantNetworkVlanID}
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: TenantNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: TenantIpSubnet}
+                  - ip_netmask:
+                      get_param: TenantIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the Control Plane.
@@ -136,8 +134,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-vlans/controller-no-external.yaml b/network/config/single-nic-vlans/controller-no-external.yaml
index 8e8b0f5d..b9aec1ea 100644
--- a/network/config/single-nic-vlans/controller-no-external.yaml
+++ b/network/config/single-nic-vlans/controller-no-external.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  controller role. No external IP is configured.
-
+  Software Config to drive os-net-config to configure VLANs for the controller role. No external IP is configured.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -61,7 +58,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute:
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: default route for the external network
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -79,64 +76,65 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: ovs_bridge
-              name: {get_input: bridge_name}
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: ovs_bridge
+                name: bridge_name
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-              members:
-                -
-                  type: interface
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+                members:
+                - type: interface
                   name: nic1
                   # force the MAC address of the bridge to this interface
                   primary: true
-                -
-                  type: vlan
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                - type: vlan
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                  -
-                    ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                  -
-                    ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageMgmtNetworkVlanID}
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageMgmtNetworkVlanID
                   addresses:
-                  -
-                    ip_netmask: {get_param: StorageMgmtIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: TenantNetworkVlanID}
+                  - ip_netmask:
+                      get_param: StorageMgmtIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: TenantNetworkVlanID
                   addresses:
-                  -
-                    ip_netmask: {get_param: TenantIpSubnet}
+                  - ip_netmask:
+                      get_param: TenantIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the Control Plane.
@@ -150,8 +148,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-vlans/controller-v6.yaml b/network/config/single-nic-vlans/controller-v6.yaml
index bf5656ed..4f065d1e 100644
--- a/network/config/single-nic-vlans/controller-v6.yaml
+++ b/network/config/single-nic-vlans/controller-v6.yaml
@@ -1,11 +1,7 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  controller role with IPv6 on the External network. The IPv6 default
-  route is on the External network, and the IPv4 default route is on
-  the Control Plane.
-
+  Software Config to drive os-net-config to configure VLANs for the controller role with IPv6 on the External network. The
+  IPv6 default route is on the External network, and the IPv4 default route is on the Control Plane.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -67,7 +63,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute:
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: default route for the external network
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -81,73 +77,74 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: ovs_bridge
-              name: {get_input: bridge_name}
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: ovs_bridge
+                name: bridge_name
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-              members:
-                -
-                  type: interface
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+                members:
+                - type: interface
                   name: nic1
                   primary: true
-                -
-                  type: vlan
-                  vlan_id: {get_param: ExternalNetworkVlanID}
+                - type: vlan
+                  vlan_id:
+                    get_param: ExternalNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: ExternalIpSubnet}
+                  - ip_netmask:
+                      get_param: ExternalIpSubnet
                   routes:
-                    -
-                      default: true
-                      next_hop: {get_param: ExternalInterfaceDefaultRoute}
-                -
-                  type: vlan
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                  - default: true
+                    next_hop:
+                      get_param: ExternalInterfaceDefaultRoute
+                - type: vlan
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageMgmtNetworkVlanID}
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageMgmtNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageMgmtIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: TenantNetworkVlanID}
+                  - ip_netmask:
+                      get_param: StorageMgmtIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: TenantNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: TenantIpSubnet}
+                  - ip_netmask:
+                      get_param: TenantIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the External interface. This will
@@ -162,8 +159,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-vlans/controller.yaml b/network/config/single-nic-vlans/controller.yaml
index c5979a89..4a615d91 100644
--- a/network/config/single-nic-vlans/controller.yaml
+++ b/network/config/single-nic-vlans/controller.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  controller role.
-
+  Software Config to drive os-net-config to configure VLANs for the controller role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -61,7 +58,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute:
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: default route for the external network
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -79,71 +76,72 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: ovs_bridge
-              name: {get_input: bridge_name}
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: ovs_bridge
+                name: bridge_name
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-              members:
-                -
-                  type: interface
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                members:
+                - type: interface
                   name: nic1
                   # force the MAC address of the bridge to this interface
                   primary: true
-                -
-                  type: vlan
-                  vlan_id: {get_param: ExternalNetworkVlanID}
+                - type: vlan
+                  vlan_id:
+                    get_param: ExternalNetworkVlanID
                   addresses:
-                  -
-                    ip_netmask: {get_param: ExternalIpSubnet}
+                  - ip_netmask:
+                      get_param: ExternalIpSubnet
                   routes:
-                    -
-                      default: true
-                      next_hop: {get_param: ExternalInterfaceDefaultRoute}
-                -
-                  type: vlan
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                  - default: true
+                    next_hop:
+                      get_param: ExternalInterfaceDefaultRoute
+                - type: vlan
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageMgmtNetworkVlanID}
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageMgmtNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageMgmtIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: TenantNetworkVlanID}
+                  - ip_netmask:
+                      get_param: StorageMgmtIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: TenantNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: TenantIpSubnet}
+                  - ip_netmask:
+                      get_param: TenantIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the External interface. This will
@@ -158,8 +156,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/config/single-nic-vlans/swift-storage.yaml b/network/config/single-nic-vlans/swift-storage.yaml
index 7b06580c..88f69b4d 100644
--- a/network/config/single-nic-vlans/swift-storage.yaml
+++ b/network/config/single-nic-vlans/swift-storage.yaml
@@ -1,9 +1,6 @@
-heat_template_version: 2015-04-30
-
+heat_template_version: '2016-10-14'
 description: >
-  Software Config to drive os-net-config to configure VLANs for the
-  swift storage role.
-
+  Software Config to drive os-net-config to configure VLANs for the swift storage role.
 parameters:
   ControlPlaneIp:
     default: ''
@@ -57,7 +54,7 @@ parameters:
     description: The default route of the control plane network.
     type: string
   ExternalInterfaceDefaultRoute: # Not used by default in this template
-    default: '10.0.0.1'
+    default: 10.0.0.1
     description: The default route of the external network.
     type: string
   ManagementInterfaceDefaultRoute: # Commented out by default in this template
@@ -71,58 +68,59 @@ parameters:
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
-
 resources:
   OsNetConfigImpl:
-    type: OS::Heat::StructuredConfig
+    type: OS::Heat::SoftwareConfig
     properties:
-      group: os-apply-config
+      group: script
       config:
-        os_net_config:
-          network_config:
-            -
-              type: ovs_bridge
-              name: br-storage
-              use_dhcp: false
-              dns_servers: {get_param: DnsServers}
-              addresses:
-                -
-                  ip_netmask:
+        str_replace:
+          template:
+            get_file: ../../scripts/run-os-net-config.sh
+          params:
+            $network_config:
+              network_config:
+              - type: ovs_bridge
+                name: br-storage
+                use_dhcp: false
+                dns_servers:
+                  get_param: DnsServers
+                addresses:
+                - ip_netmask:
                     list_join:
-                      - '/'
-                      - - {get_param: ControlPlaneIp}
-                        - {get_param: ControlPlaneSubnetCidr}
-              routes:
-                -
-                  ip_netmask: 169.254.169.254/32
-                  next_hop: {get_param: EC2MetadataIp}
-                -
-                  default: true
-                  next_hop: {get_param: ControlPlaneDefaultRoute}
-              members:
-                -
-                  type: interface
+                    - /
+                    - - get_param: ControlPlaneIp
+                      - get_param: ControlPlaneSubnetCidr
+                routes:
+                - ip_netmask: 169.254.169.254/32
+                  next_hop:
+                    get_param: EC2MetadataIp
+                - default: true
+                  next_hop:
+                    get_param: ControlPlaneDefaultRoute
+                members:
+                - type: interface
                   name: nic1
                   # force the MAC address of the bridge to this interface
                   primary: true
-                -
-                  type: vlan
-                  vlan_id: {get_param: InternalApiNetworkVlanID}
+                - type: vlan
+                  vlan_id:
+                    get_param: InternalApiNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: InternalApiIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageNetworkVlanID}
+                  - ip_netmask:
+                      get_param: InternalApiIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageIpSubnet}
-                -
-                  type: vlan
-                  vlan_id: {get_param: StorageMgmtNetworkVlanID}
+                  - ip_netmask:
+                      get_param: StorageIpSubnet
+                - type: vlan
+                  vlan_id:
+                    get_param: StorageMgmtNetworkVlanID
                   addresses:
-                    -
-                      ip_netmask: {get_param: StorageMgmtIpSubnet}
+                  - ip_netmask:
+                      get_param: StorageMgmtIpSubnet
                 # Uncomment when including environments/network-management.yaml
                 # If setting default route on the Management interface, comment
                 # out the default route on the Control Plane.
@@ -136,8 +134,9 @@ resources:
                 #    -
                 #      default: true
                 #      next_hop: {get_param: ManagementInterfaceDefaultRoute}
-
 outputs:
   OS::stack_id:
     description: The OsNetConfigImpl resource.
-    value: {get_resource: OsNetConfigImpl}
+    value:
+      get_resource: OsNetConfigImpl
+
diff --git a/network/scripts/run-os-net-config.sh b/network/scripts/run-os-net-config.sh
new file mode 100755
index 00000000..fc1e6d54
--- /dev/null
+++ b/network/scripts/run-os-net-config.sh
@@ -0,0 +1,136 @@
+#!/bin/bash
+# Note this script expects the following environment variables to be set
+# normally these are provided by the calling SoftwareConfig resource, but
+# they may also be set manually for testing
+# $bridge_name : The bridge device name to apply
+# $interface_name : The interface name to apply
+#
+# Also this token is replaced via a str_replace in the SoftwareConfig running
+# the script - in future we may extend this to also work with a variable, e.g
+# a deployment input via input_values
+# $network_config : the json serialized os-net-config config to apply
+#
+set -ux
+
+function get_metadata_ip() {
+
+  local METADATA_IP
+
+  # Look for a variety of Heat transports
+  # FIXME: Heat should provide a way to obtain this in a single place
+  for URL in os-collect-config.cfn.metadata_url os-collect-config.heat.auth_url os-collect-config.request.metadata_url os-collect-config.zaqar.auth_url; do
+    METADATA_IP=$(os-apply-config --key $URL --key-default '' --type raw 2>/dev/null | sed -e 's|http.*://\([^:]*\).*|\1|')
+    [ -n "$METADATA_IP" ] && break
+  done
+
+  echo $METADATA_IP
+
+}
+
+function is_local_ip() {
+  local IP_TO_CHECK=$1
+  if ip -o a | grep "inet6\? $IP_TO_CHECK/" &>/dev/null; then
+    return 0
+  else
+    return 1
+  fi
+}
+
+function ping_metadata_ip() {
+  local METADATA_IP=$(get_metadata_ip)
+
+  if [ -n "$METADATA_IP" ] && ! is_local_ip $METADATA_IP; then
+
+    echo -n "Trying to ping metadata IP ${METADATA_IP}..."
+
+    local COUNT=0
+    until ping -c 1 $METADATA_IP &> /dev/null; do
+      COUNT=$(( $COUNT + 1 ))
+      if [ $COUNT -eq 10 ]; then
+        echo "FAILURE"
+        echo "$METADATA_IP is not pingable." >&2
+        exit 1
+      fi
+    done
+    echo "SUCCESS"
+
+  else
+    echo "No metadata IP found. Skipping."
+  fi
+}
+
+function configure_safe_defaults() {
+
+[[ $? == 0 ]] && return 0
+
+cat > /etc/os-net-config/dhcp_all_interfaces.yaml <<EOF_CAT
+# This file is an autogenerated safe defaults file for os-net-config
+# which runs DHCP on all discovered interfaces to ensure connectivity
+# back to the undercloud for updates
+network_config:
+EOF_CAT
+
+    for iface in $(ls /sys/class/net | grep -v ^lo$); do
+        local mac_addr_type="$(cat /sys/class/net/${iface}/addr_assign_type)"
+        if [ "$mac_addr_type" != "0" ]; then
+            echo "Device has generated MAC, skipping."
+        else
+            ip link set dev $iface up &>/dev/null
+            HAS_LINK="$(cat /sys/class/net/${iface}/carrier)"
+
+            TRIES=10
+            while [ "$HAS_LINK" == "0" -a $TRIES -gt 0 ]; do
+                HAS_LINK="$(cat /sys/class/net/${iface}/carrier)"
+                if [ "$HAS_LINK" == "1" ]; then
+                    break
+                else
+                    sleep 1
+                fi
+                TRIES=$(( TRIES - 1 ))
+            done
+            if [ "$HAS_LINK" == "1" ] ; then
+cat >> /etc/os-net-config/dhcp_all_interfaces.yaml <<EOF_CAT
+  -
+    type: interface
+    name: $iface
+    use_dhcp: true
+EOF_CAT
+            fi
+        fi
+    done
+    os-net-config -c /etc/os-net-config/dhcp_all_interfaces.yaml -v --detailed-exit-codes --cleanup
+    RETVAL=$?
+    if [[ $RETVAL == 2 ]]; then
+        ping_metadata_ip
+    elif [[ $RETVAL != 0 ]]; then
+        echo "ERROR: configuration of safe defaults failed."
+    fi
+}
+
+if [ -n '$network_config' ]; then
+    trap configure_safe_defaults EXIT
+
+    mkdir -p /etc/os-net-config
+    # Note these variables come from the calling heat SoftwareConfig
+    echo '$network_config' > /etc/os-net-config/config.json
+    sed -i "s/bridge_name/$bridge_name/" /etc/os-net-config/config.json
+    sed -i "s/interface_name/$interface_name/" /etc/os-net-config/config.json
+
+    os-net-config -c /etc/os-net-config/config.json -v --detailed-exit-codes
+    RETVAL=$?
+    if [[ $RETVAL == 2 ]]; then
+        ping_metadata_ip
+
+        #NOTE: dprince this udev rule can apparently leak DHCP processes?
+        # https://bugs.launchpad.net/tripleo/+bug/1538259
+        # until we discover the root cause we can simply disable the
+        # rule because networking has already been configured at this point
+        if [ -f /etc/udev/rules.d/99-dhcp-all-interfaces.rules ]; then
+            rm /etc/udev/rules.d/99-dhcp-all-interfaces.rules
+        fi
+
+    elif [[ $RETVAL != 0 ]]; then
+        echo "ERROR: os-net-config configuration failed." >&2
+        exit 1
+    fi
+fi