Move os-apply-config templates into a directory

This patch moves all of the os-apply-config (tripleo-image-elements)
specific templates into a common directory. This matches what
we do for puppet and should help new users more easily
understand the project layout.

Change-Id: I7dce2a770d56795f3ea22c8a464595c4a0c60832

14 files changed, 2683 insertions, 0 deletions

diff --git a/os-apply-config/all-nodes-config.yaml b/os-apply-config/all-nodes-config.yaml
new file mode 100644
index 00000000..3f0bd61c
--- /dev/null
+++ b/os-apply-config/all-nodes-config.yaml
@@ -0,0 +1,93 @@
+heat_template_version: 2015-04-30
+description: 'All Nodes Config'
+
+parameters:
+  compute_hosts:
+    type: comma_delimited_list
+  controller_hosts:
+    type: comma_delimited_list
+  controller_ips:
+    type: comma_delimited_list
+  block_storage_hosts:
+    type: comma_delimited_list
+  object_storage_hosts:
+    type: comma_delimited_list
+  ceph_storage_hosts:
+    type: comma_delimited_list
+  controller_names:
+    type: comma_delimited_list
+  rabbit_node_ips:
+    type: comma_delimited_list
+  mongo_node_ips:
+    type: comma_delimited_list
+  redis_node_ips:
+    type: comma_delimited_list
+  memcache_node_ips:
+    type: comma_delimited_list
+  mysql_node_ips:
+    type: comma_delimited_list
+  horizon_node_ips:
+    type: comma_delimited_list
+  heat_api_node_ips:
+    type: comma_delimited_list
+  swift_proxy_node_ips:
+    type: comma_delimited_list
+  ceilometer_api_node_ips:
+    type: comma_delimited_list
+  nova_api_node_ips:
+    type: comma_delimited_list
+  nova_metadata_node_ips:
+    type: comma_delimited_list
+  glance_api_node_ips:
+    type: comma_delimited_list
+  glance_registry_node_ips:
+    type: comma_delimited_list
+  cinder_api_node_ips:
+    type: comma_delimited_list
+  neutron_api_node_ips:
+    type: comma_delimited_list
+  keystone_public_api_node_ips:
+    type: comma_delimited_list
+  keystone_admin_api_node_ips:
+    type: comma_delimited_list
+
+resources:
+
+  allNodesConfigImpl:
+    type: OS::Heat::StructuredConfig
+    properties:
+      config:
+        completion-signal: {get_input: deploy_signal_id}
+        hosts:
+          list_join:
+          - "\n"
+          - - list_join:
+              - "\n"
+              - {get_param: compute_hosts}
+            - list_join:
+              - "\n"
+              - {get_param: controller_hosts}
+            - list_join:
+              - "\n"
+              - {get_param: block_storage_hosts}
+            - list_join:
+              - "\n"
+              - {get_param: object_storage_hosts}
+            - list_join:
+              - "\n"
+              - {get_param: ceph_storage_hosts}
+        rabbit:
+          nodes:
+            list_join:
+            - ','
+            - {get_param: controller_names}
+        sysctl:
+          net.ipv4.tcp_keepalive_time: 5
+          net.ipv4.tcp_keepalive_probes: 5
+          net.ipv4.tcp_keepalive_intvl: 1
+
+outputs:
+  config_id:
+    description: The ID of the allNodesConfigImpl resource.
+    value:
+      {get_resource: allNodesConfigImpl}
diff --git a/os-apply-config/ceph-cluster-config.yaml b/os-apply-config/ceph-cluster-config.yaml
new file mode 100644
index 00000000..c3cf8e8a
--- /dev/null
+++ b/os-apply-config/ceph-cluster-config.yaml
@@ -0,0 +1,57 @@
+heat_template_version: 2015-04-30
+description: 'Ceph Cluster config data'
+
+parameters:
+  ceph_storage_count:
+    default: 0
+    type: number
+    description: Number of Ceph storage nodes. Used to enable/disable managed Ceph installation.
+  ceph_external_mon_ips:
+    default: ''
+    type: string
+    description: List of external Ceph Mon host IPs.
+  ceph_client_key:
+    default: ''
+    type: string
+    description: Ceph key used to create the 'openstack' user keyring.
+  ceph_fsid:
+    default: ''
+    type: string
+  ceph_admin_key:
+    default: ''
+    type: string
+  ceph_mon_key:
+    default: ''
+    type: string
+  ceph_mon_names:
+    type: comma_delimited_list
+  ceph_mon_ips:
+    type: comma_delimited_list
+
+resources:
+  CephClusterConfigImpl:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config:
+        ceph_cluster:
+          mon_initial_members:
+            list_join:
+            - ','
+            - {get_param: ceph_mon_names}
+          mon_host:
+            list_join:
+            - ','
+            - {get_param: ceph_mon_ips}
+          fsid: {get_param: ceph_fsid}
+          admin_key: {get_param: ceph_admin_key}
+          mon_key: {get_param: ceph_mon_key}
+          # We would need a dedicated key for OSD bootstrap
+          bootstrap_osd_key: {get_param: ceph_mon_key}
+          osds: '{"/srv/data": {}}'
+
+outputs:
+  config_id:
+    description: The ID of the CephClusterConfigImpl resource.
+    value:
+      {get_resource: CephClusterConfigImpl}
diff --git a/os-apply-config/ceph-storage-post.yaml b/os-apply-config/ceph-storage-post.yaml
new file mode 100644
index 00000000..734f90bd
--- /dev/null
+++ b/os-apply-config/ceph-storage-post.yaml
@@ -0,0 +1,21 @@
+heat_template_version: 2015-04-30
+description: 'Ceph Storage Post Deployment'
+# NOTE: this is a noop for os-apply-config style deployments because
+# post deployment ordering is controlled by tripleo-image-elements
+
+parameters:
+  servers:
+    type: json
+  NodeConfigIdentifiers:
+     type: json
+     description: Value which changes if the node configuration may need to be re-applied
+
+resources:
+
+  # Note, this should come last, so use depends_on to ensure
+  # this is created after any other resources.
+  ExtraConfig:
+    type: OS::TripleO::NodeExtraConfigPost
+    properties:
+        servers: {get_param: servers}
+
diff --git a/os-apply-config/ceph-storage.yaml b/os-apply-config/ceph-storage.yaml
new file mode 100644
index 00000000..0dbcd3e7
--- /dev/null
+++ b/os-apply-config/ceph-storage.yaml
@@ -0,0 +1,170 @@
+heat_template_version: 2015-04-30
+description: 'Common Ceph Storage Configuration'
+parameters:
+  Image:
+    type: string
+    default: overcloud-ceph-storage
+  KeyName:
+    default: default
+    description: Name of an existing EC2 KeyPair to enable SSH access to the instances
+    type: string
+  Flavor:
+    default: baremetal
+    description: Flavor for block storage nodes to request when deploying.
+    type: string
+  CephClusterFSID:
+    default: ''
+    type: string
+    description: The Ceph cluster FSID. Must be a UUID.
+  CephMonKey:
+    default: ''
+    description: The Ceph monitors key. Can be created with ceph-authtool --gen-print-key.
+    type: string
+  CephAdminKey:
+    default: ''
+    description: The Ceph admin client key. Can be created with ceph-authtool --gen-print-key.
+    type: string
+  CephMonitors:
+    default: ''
+    description: The list of ip/names to use as Ceph monitors
+    type: json
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  UpdateIdentifier:
+    default: ''
+    type: string
+    description: >
+      Setting to a previously unused value during stack-update will trigger
+      package update on all nodes
+  Hostname:
+    type: string
+    default: '' # Defaults to Heat created hostname
+  ExtraConfig:
+    default: {}
+    description: |
+      Additional configuration to inject into the cluster. Note
+      that CephStorageExtraConfig takes precedence over ExtraConfig.
+    type: json
+  CephStorageExtraConfig:
+    default: {}
+    description: |
+      Role specific additional configuration to inject into the cluster.
+    type: json
+
+
+resources:
+  CephStorage:
+    type: OS::Nova::Server
+    properties:
+      image:
+        {get_param: Image}
+      flavor: {get_param: OvercloudCephStorageFlavor}
+      key_name: {get_param: KeyName}
+      networks:
+        - network: ctlplane
+      user_data_format: SOFTWARE_CONFIG
+      user_data: {get_resource: NodeUserData}
+      name: {get_param: Hostname}
+
+  NodeUserData:
+    type: OS::TripleO::NodeUserData
+
+  StoragePort:
+    type: OS::TripleO::CephStorage::Ports::StoragePort
+    properties:
+      ControlPlaneIP: {get_attr: [CephStorage, networks, ctlplane, 0]}
+
+  StorageMgmtPort:
+    type: OS::TripleO::CephStorage::Ports::StorageMgmtPort
+    properties:
+      ControlPlaneIP: {get_attr: [CephStorage, networks, ctlplane, 0]}
+
+  NetworkConfig:
+    type: OS::TripleO::CephStorage::Net::SoftwareConfig
+    properties:
+      ControlPlaneIp: {get_attr: [CephStorage, networks, ctlplane, 0]}
+      StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
+      StorageMgmtIpSubnet: {get_attr: [StorageMgmtPort, ip_subnet]}
+
+  NetworkDeployment:
+    type: OS::TripleO::SoftwareDeployment
+    properties:
+      config: {get_resource: NetworkConfig}
+      server: {get_resource: CephStorage}
+
+  CephStorageDeployment:
+    type: OS::Heat::StructuredDeployment
+    properties:
+      server: {get_resource: CephStorage}
+      config: {get_resource: CephStorageConfig}
+      signal_transport: NO_SIGNAL
+  CephStorageConfig:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config:
+        ceph:
+          fsid: {get_param: CephClusterFSID}
+          keyrings:
+            admin:
+              key: {get_param: CephAdminKey}
+          mon_nodes: {get_param: CephMonitors}
+  ControllerCephDeployment:
+    type: OS::Heat::StructuredDeployment
+    properties:
+      server: {get_resource: Controller}
+      config: {get_resource: ControllerCephConfig}
+      signal_transport: NO_SIGNAL
+  ControllerCephConfig:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config:
+        cinder:
+          include_ceph_backend: true
+        ceph:
+          fsid: {get_param: CephClusterFSID}
+          keyrings:
+            mon:
+              key: {get_param: CephMonKey}
+            admin:
+              key: {get_param: CephAdminKey}
+          mon_nodes: {get_param: CephMonitors}
+  NovaComputeCephDeployment:
+    depends_on: [ControllerCephDeployment]
+    type: OS::Heat::StructuredDeployment
+    properties:
+      server: {get_resource: NovaCompute}
+      config: {get_resource: NovaComputeCephConfig}
+      signal_transport: NO_SIGNAL
+  NovaComputeCephConfig:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config:
+        ceph:
+          fsid: {get_param: CephClusterFSID}
+          keyrings:
+            admin:
+              key: {get_param: CephAdminKey}
+          mon_nodes: {get_param: CephMonitors}
+outputs:
+  hosts_entry:
+    value:
+      str_replace:
+        template: "IP HOST"
+        params:
+          IP: {get_attr: [CephStorage, networks, ctlplane, 0]}
+          HOST: {get_attr: [CephStorage, name]}
+  storage_ip_address:
+    description: IP address of the server in the storage network
+    value: {get_attr: [StoragePort, ip_address]}
+  storage_mgmt_ip_address:
+    description: IP address of the server in the storage_mgmt network
+    value: {get_attr: [StorageMgmtPort, ip_address]}
+  config_identifier:
+    description: identifier which changes if the node configuration may need re-applying
+    value: "None - NO_SIGNAL"
diff --git a/os-apply-config/cinder-storage-post.yaml b/os-apply-config/cinder-storage-post.yaml
new file mode 100644
index 00000000..ad4e0460
--- /dev/null
+++ b/os-apply-config/cinder-storage-post.yaml
@@ -0,0 +1,21 @@
+heat_template_version: 2015-04-30
+description: 'Common Block Storage Post Deployment'
+# NOTE: this is a noop for os-apply-config style deployments because
+# post deployment ordering is controlled by tripleo-image-elements
+
+parameters:
+  servers:
+    type: json
+  NodeConfigIdentifiers:
+     type: json
+     description: Value which changes if the node configuration may need to be re-applied
+
+resources:
+
+  # Note, this should come last, so use depends_on to ensure
+  # this is created after any other resources.
+  ExtraConfig:
+    type: OS::TripleO::NodeExtraConfigPost
+    properties:
+        servers: {get_param: servers}
+
diff --git a/os-apply-config/cinder-storage.yaml b/os-apply-config/cinder-storage.yaml
new file mode 100644
index 00000000..7a686970
--- /dev/null
+++ b/os-apply-config/cinder-storage.yaml
@@ -0,0 +1,233 @@
+heat_template_version: 2015-04-30
+description: 'Common Block Storage Configuration'
+parameters:
+  Image:
+    default: overcloud-cinder-volume
+    type: string
+  CinderEnableIscsiBackend:
+    default: true
+    description: Whether to enable or not the Iscsi backend for Cinder
+    type: boolean
+  CinderISCSIHelper:
+    default: tgtadm
+    description: The iSCSI helper to use with cinder.
+    type: string
+  CinderLVMLoopDeviceSize:
+    default: 5000
+    description: The size of the loopback file used by the cinder LVM driver.
+    type: number
+  CinderPassword:
+    default: unset
+    description: The password for the cinder service and db account, used by cinder-api.
+    type: string
+    hidden: true
+  VirtualIP:
+    default: ''
+    type: string
+  ExtraConfig:
+    default: {}
+    description: |
+      Additional configuration to inject into the cluster. The JSON should have
+      the following structure:
+        {"FILEKEY":
+          {"config":
+            [{"section": "SECTIONNAME",
+              "values":
+                [{"option": "OPTIONNAME",
+                  "value": "VALUENAME"
+                 }
+                ]
+             }
+            ]
+          }
+        }
+      For instance:
+        {"nova":
+          {"config":
+            [{"section": "default",
+              "values":
+                [{"option": "force_config_drive",
+                  "value": "always"
+                 }
+                ]
+             },
+             {"section": "cells",
+              "values":
+                [{"option": "driver",
+                  "value": "nova.cells.rpc_driver.CellsRPCDriver"
+                 }
+                ]
+             }
+            ]
+          }
+        }
+    type: json
+  BlockStorageExtraConfig:
+    default: {}
+    description: |
+      Role specific additional configuration to inject into the cluster.
+    type: json
+  Flavor:
+    description: Flavor for block storage nodes to request when deploying.
+    type: string
+    constraints:
+      - custom_constraint: nova.flavor
+  GlancePort:
+    default: "9292"
+    description: Glance port.
+    type: string
+  GlanceProtocol:
+    default: http
+    description: Protocol to use when connecting to glance, set to https for SSL.
+    type: string
+  KeyName:
+    default: default
+    description: Name of an existing EC2 KeyPair to enable SSH access to the instances
+    type: string
+  RabbitPassword:
+    default: 'guest'
+    type: string
+  RabbitUserName:
+    default: 'guest'
+    type: string
+  RabbitClientUseSSL:
+    default: false
+    description: >
+        Rabbit client subscriber parameter to specify
+        an SSL connection to the RabbitMQ host.
+    type: string
+  RabbitClientPort:
+    default: 5672
+    description: Set rabbit subscriber port, change this if using SSL
+    type: number
+  SnmpdReadonlyUserName:
+    default: ro_snmp_user
+    description: The user name for SNMPd with readonly rights running on all Overcloud nodes
+    type: string
+  SnmpdReadonlyUserPassword:
+    default: unset
+    description: The user password for SNMPd with readonly rights running on all Overcloud nodes
+    type: string
+    hidden: true
+  UpdateIdentifier:
+    default: ''
+    type: string
+    description: >
+      Setting to a previously unused value during stack-update will trigger
+      package update on all nodes
+  Hostname:
+    type: string
+    default: '' # Defaults to Heat created hostname
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  GlanceApiVirtualIP:
+    type: string
+    default: ''
+  MysqlVirtualIP:
+    type: string
+    default: ''
+
+resources:
+  BlockStorage:
+    type: OS::Nova::Server
+    properties:
+      image:
+        {get_param: Image}
+      flavor: {get_param: Flavor}
+      key_name: {get_param: KeyName}
+      networks:
+        - network: ctlplane
+      user_data_format: SOFTWARE_CONFIG
+      user_data: {get_resource: NodeUserData}
+      name: {get_param: Hostname}
+
+  NodeUserData:
+    type: OS::TripleO::NodeUserData
+
+  InternalApiPort:
+    type: OS::TripleO::BlockStorage::Ports::InternalApiPort
+    properties:
+      ControlPlaneIP: {get_attr: [BlockStorage, networks, ctlplane, 0]}
+
+  StoragePort:
+    type: OS::TripleO::BlockStorage::Ports::StoragePort
+    properties:
+      ControlPlaneIP: {get_attr: [BlockStorage, networks, ctlplane, 0]}
+
+  StorageMgmtPort:
+    type: OS::TripleO::BlockStorage::Ports::StorageMgmtPort
+    properties:
+      ControlPlaneIP: {get_attr: [BlockStorage, networks, ctlplane, 0]}
+
+  NetworkConfig:
+    type: OS::TripleO::BlockStorage::Net::SoftwareConfig
+    properties:
+      ControlPlaneIp: {get_attr: [BlockStorage, networks, ctlplane, 0]}
+      InternalApiIpSubnet: {get_attr: [InternalApiPort, ip_subnet]}
+      StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
+      StorageMgmtIpSubnet: {get_attr: [StorageMgmtPort, ip_subnet]}
+
+  NetworkDeployment:
+    type: OS::TripleO::SoftwareDeployment
+    properties:
+      config: {get_resource: NetworkConfig}
+      server: {get_resource: BlockStorage}
+
+  BlockStorageDeployment:
+    type: OS::Heat::StructuredDeployment
+    properties:
+      server: {get_resource: BlockStorage}
+      config: {get_resource: BlockStorageConfig}
+      input_values:
+        controller_virtual_ip: {get_param: VirtualIP}
+        cinder_dsn: {list_join: ['', ['mysql://cinder:', {get_param: CinderPassword}, '@', {get_param: VirtualIP} , '/cinder']]}
+        snmpd_readonly_user_name: {get_param: SnmpdReadonlyUserName}
+        snmpd_readonly_user_password: {get_param: SnmpdReadonlyUserPassword}
+      signal_transport: NO_SIGNAL
+  BlockStorageConfig:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config:
+        keystone:
+          host: {get_input: controller_virtual_ip}
+        cinder:
+          db: {get_input: cinder_dsn}
+          volume_size_mb:
+            get_param: CinderLVMLoopDeviceSize
+          iscsi-helper:
+            get_param: CinderISCSIHelper
+        snmpd:
+          export_MIB: UCD-SNMP-MIB
+          readonly_user_name: {get_input: snmpd_readonly_user_name}
+          readonly_user_password: {get_input: snmpd_readonly_user_password}
+        rabbit:
+          host: {get_input: controller_virtual_ip}
+          username: {get_param: RabbitUserName}
+          password: {get_param: RabbitPassword}
+        glance:
+          host: {get_input: controller_virtual_ip}
+          port: {get_param: GlancePort}
+outputs:
+  hosts_entry:
+    value:
+      str_replace:
+        template: "IP HOST"
+        params:
+          IP: {get_attr: [BlockStorage, networks, ctlplane, 0]}
+          HOST: {get_attr: [BlockStorage, name]}
+  internal_api_ip_address:
+    description: IP address of the server in the internal_api network
+    value: {get_attr: [InternalApiPort, ip_address]}
+  storage_ip_address:
+    description: IP address of the server in the storage network
+    value: {get_attr: [StoragePort, ip_address]}
+  storage_mgmt_ip_address:
+    description: IP address of the server in the storage_mgmt network
+    value: {get_attr: [StorageMgmtPort, ip_address]}
+  config_identifier:
+    description: identifier which changes if the node configuration may need re-applying
+    value: "None - NO_SIGNAL"
diff --git a/os-apply-config/compute-post.yaml b/os-apply-config/compute-post.yaml
new file mode 100644
index 00000000..695690d4
--- /dev/null
+++ b/os-apply-config/compute-post.yaml
@@ -0,0 +1,22 @@
+heat_template_version: 2015-04-30
+description: 'Compute Post Deployment'
+# NOTE: this is a noop for os-apply-config style deployments because
+# post deployment ordering is controlled by tripleo-image-elements
+
+parameters:
+  servers:
+    type: json
+  NodeConfigIdentifiers:
+     type: json
+     description: Value which changes if the node configuration may need to be re-applied
+
+resources:
+
+
+  # Note, this should come last, so use depends_on to ensure
+  # this is created after any other resources.
+  ExtraConfig:
+    type: OS::TripleO::NodeExtraConfigPost
+    properties:
+        servers: {get_param: servers}
+
diff --git a/os-apply-config/compute.yaml b/os-apply-config/compute.yaml
new file mode 100644
index 00000000..88d4cb2b
--- /dev/null
+++ b/os-apply-config/compute.yaml
@@ -0,0 +1,557 @@
+heat_template_version: 2015-04-30
+
+description: >
+  OpenStack hypervisor node. Can be wrapped in a ResourceGroup for scaling.
+
+parameters:
+  AdminPassword:
+    default: unset
+    description: The password for the keystone admin account, used for monitoring, querying neutron etc.
+    type: string
+    hidden: true
+  CeilometerComputeAgent:
+    description: Indicates whether the Compute agent is present and expects nova-compute to be configured accordingly
+    type: string
+    default: ''
+    constraints:
+    - allowed_values: ['', Present]
+  CeilometerMeteringSecret:
+    default: unset
+    description: Secret shared by the ceilometer services.
+    type: string
+    hidden: true
+  CeilometerPassword:
+    default: unset
+    description: The password for the ceilometer service account.
+    type: string
+    hidden: true
+  CinderEnableNfsBackend:
+    default: false
+    description: Whether to enable or not the NFS backend for Cinder
+    type: boolean
+  Debug:
+    default: ''
+    description: Set to True to enable debugging on all services.
+    type: string
+  ExtraConfig:
+    default: {}
+    description: |
+      Additional configuration to inject into the cluster. The JSON should have
+      the following structure:
+        {"FILEKEY":
+          {"config":
+            [{"section": "SECTIONNAME",
+              "values":
+                [{"option": "OPTIONNAME",
+                  "value": "VALUENAME"
+                 }
+                ]
+             }
+            ]
+          }
+        }
+      For instance:
+        {"nova":
+          {"config":
+            [{"section": "default",
+              "values":
+                [{"option": "force_config_drive",
+                  "value": "always"
+                 }
+                ]
+             },
+             {"section": "cells",
+              "values":
+                [{"option": "driver",
+                  "value": "nova.cells.rpc_driver.CellsRPCDriver"
+                 }
+                ]
+             }
+            ]
+          }
+        }
+    type: json
+  Flavor:
+    description: Flavor for the nova compute node
+    type: string
+    constraints:
+      - custom_constraint: nova.flavor
+  GlanceHost:
+    type: string
+    default: ''  # Has to be here because of the ignored empty value bug
+  GlancePort:
+    default: "9292"
+    description: Glance port.
+    type: string
+  GlanceProtocol:
+    default: http
+    description: Protocol to use when connecting to glance, set to https for SSL.
+    type: string
+  Image:
+    type: string
+    default: overcloud-compute
+    constraints:
+      - custom_constraint: glance.image
+  ImageUpdatePolicy:
+    default: 'REBUILD_PRESERVE_EPHEMERAL'
+    description: What policy to use when reconstructing instances. REBUILD for rebuilds, REBUILD_PRESERVE_EPHEMERAL to preserve /mnt.
+    type: string
+  KeyName:
+    description: Name of an existing EC2 KeyPair to enable SSH access to the instances
+    type: string
+    default: default
+    constraints:
+      - custom_constraint: nova.keypair
+  KeystoneAdminApiVirtualIP:
+    type: string
+    default: ''
+  KeystonePublicApiVirtualIP:
+    type: string
+    default: ''
+  NeutronBridgeMappings:
+    description: >
+      The OVS logical->physical bridge mappings to use. See the Neutron
+      documentation for details. Defaults to mapping br-ex - the external
+      bridge on hosts - to a physical name 'datacentre' which can be used
+      to create provider networks (and we use this for the default floating
+      network) - if changing this either use different post-install network
+      scripts or be sure to keep 'datacentre' as a mapping network name.
+    type: string
+    default: "datacentre:br-ex"
+  NeutronEnableTunnelling:
+    type: string
+    default: "True"
+  NeutronFlatNetworks:
+    type: string
+    default: 'datacentre'
+    description: >
+      If set, flat networks to configure in neutron plugins.
+  NeutronHost:
+    type: string
+    default: ''  # Has to be here because of the ignored empty value bug
+  NeutronNetworkType:
+    type: string
+    description: The tenant network type for Neutron, either gre or vxlan.
+    default: 'vxlan'
+  NeutronNetworkVLANRanges:
+    default: 'datacentre'
+    description: >
+      The Neutron ML2 and OpenVSwitch vlan mapping range to support. See the
+      Neutron documentation for permitted values. Defaults to permitting any
+      VLAN on the 'datacentre' physical network (See NeutronBridgeMappings).
+    type: comma_delimited_list
+  NeutronPassword:
+    default: unset
+    description: The password for the neutron service account, used by neutron agents.
+    type: string
+    hidden: true
+  NeutronPhysicalBridge:
+    default: ''
+    description: An OVS bridge to create for accessing external networks.
+    type: string
+  NeutronPublicInterface:
+    default: nic1
+    description: A port to add to the NeutronPhysicalBridge.
+    type: string
+  NeutronTunnelTypes:
+    type: string
+    description: |
+        The tunnel types for the Neutron tenant network. To specify multiple
+        values, use a comma separated string, like so: 'gre,vxlan'
+    default: 'vxlan'
+  NeutronTunnelIdRanges:
+    description: |
+        Comma-separated list of <tun_min>:<tun_max> tuples enumerating ranges
+        of GRE tunnel IDs that are available for tenant network allocation
+    default: ["1:1000", ]
+    type: comma_delimited_list
+  NeutronVniRanges:
+    description: |
+        Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges
+        of VXLAN VNI IDs that are available for tenant network allocation
+    default: ["1:1000", ]
+    type: comma_delimited_list
+  NeutronPublicInterfaceRawDevice:
+    default: ''
+    type: string
+  NeutronDVR:
+    default: 'False'
+    type: string
+  NeutronMetadataProxySharedSecret:
+    default: 'unset'
+    description: Shared secret to prevent spoofing
+    type: string
+  NeutronCorePlugin:
+    default: "ml2"
+    description: |
+        The core plugin for Neutron. The value should be the entrypoint to be loaded
+        from neutron.core_plugins namespace.
+    type: string
+  NeutronServicePlugins:
+    default: "router"
+    description: |
+        Comma-separated list of service plugin entrypoints to be loaded from the
+        neutron.service_plugins namespace.
+    type: comma_delimited_list
+  NeutronTypeDrivers:
+    default: "vxlan,vlan,flat,gre"
+    description: |
+        Comma-separated list of network type driver entrypoints to be loaded.
+    type: comma_delimited_list
+  NeutronMechanismDrivers:
+    default: 'openvswitch'
+    description: |
+        The mechanism drivers for the Neutron tenant network. To specify multiple
+        values, use a comma separated string, like so: 'openvswitch,l2_population'
+    type: string
+  # Not relevant for Computes, should be removed
+  NeutronAllowL3AgentFailover:
+    default: 'True'
+    description: Allow automatic l3-agent failover
+    type: string
+  # Not relevant for Computes, should be removed
+  NeutronL3HA:
+    default: 'False'
+    description: Whether to enable l3-agent HA
+    type: string
+  NeutronAgentMode:
+    default: 'dvr_snat'
+    description: Agent mode for the neutron-l3-agent on the controller hosts
+    type: string
+  NovaApiHost:
+    type: string
+    default: ''  # Has to be here because of the ignored empty value bug
+  NovaComputeDriver:
+    type: string
+    default: libvirt.LibvirtDriver
+  NovaComputeExtraConfig:
+    default: {}
+    description: |
+      NovaCompute specific configuration to inject into the cluster. Same
+      structure as ExtraConfig.
+    type: json
+  NovaComputeLibvirtType:
+    type: string
+    default: ''
+  NovaEnableRbdBackend:
+    default: false
+    description: Whether to enable or not the Rbd backend for Nova
+    type: boolean
+  NovaPassword:
+    default: unset
+    description: The password for the nova service account, used by nova-api.
+    type: string
+    hidden: true
+  NovaPublicIP:
+    type: string
+    default: ''  # Has to be here because of the ignored empty value bug
+  NtpServer:
+    type: string
+    default: ''
+  RabbitHost:
+    type: string
+    default: ''  # Has to be here because of the ignored empty value bug
+  RabbitPassword:
+    default: guest
+    description: The password for RabbitMQ
+    type: string
+    hidden: true
+  RabbitUserName:
+    default: guest
+    description: The username for RabbitMQ
+    type: string
+  RabbitClientUseSSL:
+    default: false
+    description: >
+        Rabbit client subscriber parameter to specify
+        an SSL connection to the RabbitMQ host.
+    type: string
+  RabbitClientPort:
+    default: 5672
+    description: Set rabbit subscriber port, change this if using SSL
+    type: number
+  SnmpdReadonlyUserName:
+    default: ro_snmp_user
+    description: The user name for SNMPd with readonly rights running on all Overcloud nodes
+    type: string
+  SnmpdReadonlyUserPassword:
+    default: unset
+    description: The user password for SNMPd with readonly rights running on all Overcloud nodes
+    type: string
+    hidden: true
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  UpdateIdentifier:
+    default: ''
+    type: string
+    description: >
+      Setting to a previously unused value during stack-update will trigger
+      package update on all nodes
+  Hostname:
+    type: string
+    default: '' # Defaults to Heat created hostname
+
+resources:
+
+  NovaCompute:
+    type: OS::Nova::Server
+    properties:
+      image:
+        {get_param: Image}
+      image_update_policy:
+        get_param: ImageUpdatePolicy
+      flavor: {get_param: Flavor}
+      key_name: {get_param: KeyName}
+      networks:
+        - network: ctlplane
+      user_data_format: SOFTWARE_CONFIG
+      user_data: {get_resource: NodeUserData}
+      name: {get_param: Hostname}
+
+  NodeUserData:
+    type: OS::TripleO::NodeUserData
+
+  InternalApiPort:
+    type: OS::TripleO::Compute::Ports::InternalApiPort
+    properties:
+      ControlPlaneIP: {get_attr: [NovaCompute, networks, ctlplane, 0]}
+
+  StoragePort:
+    type: OS::TripleO::Compute::Ports::StoragePort
+    properties:
+      ControlPlaneIP: {get_attr: [NovaCompute, networks, ctlplane, 0]}
+
+  TenantPort:
+    type: OS::TripleO::Compute::Ports::TenantPort
+    properties:
+      ControlPlaneIP: {get_attr: [NovaCompute, networks, ctlplane, 0]}
+
+  NetworkConfig:
+    type: OS::TripleO::Compute::Net::SoftwareConfig
+    properties:
+      ControlPlaneIp: {get_attr: [NovaCompute, networks, ctlplane, 0]}
+      InternalApiIpSubnet: {get_attr: [InternalApiPort, ip_subnet]}
+      StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
+      TenantIpSubnet: {get_attr: [TenantPort, ip_subnet]}
+
+  NetworkDeployment:
+    type: OS::TripleO::SoftwareDeployment
+    properties:
+      signal_transport: NO_SIGNAL
+      config: {get_resource: NetworkConfig}
+      server: {get_resource: NovaCompute}
+      input_values:
+        bridge_name: {get_param: NeutronPhysicalBridge}
+        interface_name: {get_param: NeutronPublicInterface}
+
+  NovaComputeConfig:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config:
+        nova:
+          compute_driver: { get_input: nova_compute_driver }
+          compute_libvirt_type: { get_input: nova_compute_libvirt_type }
+          debug: {get_input: debug}
+          host: {get_input: nova_api_host}
+          public_ip: {get_input: nova_public_ip}
+          service-password: {get_input: nova_password}
+        ceilometer:
+          debug: {get_input: debug}
+          metering_secret: {get_input: ceilometer_metering_secret}
+          service-password: {get_input: ceilometer_password}
+          compute_agent: {get_input: ceilometer_compute_agent}
+        snmpd:
+          export_MIB: UCD-SNMP-MIB
+          readonly_user_name: {get_input: snmpd_readonly_user_name}
+          readonly_user_password: {get_input: snmpd_readonly_user_password}
+        glance:
+          debug: {get_input: debug}
+          host: {get_input: glance_host}
+          port: {get_input: glance_port}
+          protocol: {get_input: glance_protocol}
+        keystone:
+          debug: {get_input: debug}
+          host: {get_input: keystone_host}
+        neutron:
+          debug: {get_input: debug}
+          flat-networks: {get_input: neutron_flat_networks}
+          host: {get_input: neutron_host}
+          router_distributed: {get_input: neutron_router_distributed}
+          agent_mode: {get_input: neutron_agent_mode}
+          ovs_db: {get_input: neutron_dsn}
+          metadata_proxy_shared_secret: {get_input: neutron_metadata_proxy_shared_secret}
+          core_plugin: {get_input: neutron_core_plugin}
+          service_plugins: {get_input: neutron_service_plugins}
+          type_drivers: {get_input: neutron_type_drivers}
+          mechanism_drivers: {get_input: neutron_mechanism_drivers}
+          allow_automatic_l3agent_failover: {get_input: neutron_allow_l3agent_failover}
+          l3_ha: {get_input: neutron_l3_ha}
+          ovs:
+            local_ip: {get_input: neutron_local_ip}
+            tenant_network_type: {get_input: neutron_tenant_network_type}
+            tunnel_types: {get_input: neutron_tunnel_types}
+            network_vlan_ranges: {get_input: neutron_network_vlan_ranges}
+            tunnel_id_ranges: {get_input: neutron_tunnel_id_ranges}
+            vni_ranges: {get_input: neutron_vni_ranges}
+            bridge_mappings: {get_input: neutron_bridge_mappings}
+            enable_tunneling: {get_input: neutron_enable_tunneling}
+            physical_bridge: {get_input: neutron_physical_bridge}
+            public_interface: {get_input: neutron_public_interface}
+            public_interface_raw_device: {get_input: neutron_public_interface_raw_device}
+          service-password: {get_input: neutron_password}
+        admin-password: {get_input: admin_password}
+        rabbit:
+          host: {get_input: rabbit_host}
+          username: {get_input: rabbit_username}
+          password: {get_input: rabbit_password}
+        ntp:
+          servers:
+              - {server: {get_input: ntp_server}}
+
+  NovaComputeDeployment:
+    type: OS::TripleO::SoftwareDeployment
+    properties:
+      signal_transport: NO_SIGNAL
+      config: {get_resource: NovaComputeConfig}
+      server: {get_resource: NovaCompute}
+      input_values:
+        debug: {get_param: Debug}
+        nova_compute_driver: {get_param: NovaComputeDriver}
+        nova_compute_libvirt_type: {get_param: NovaComputeLibvirtType}
+        nova_public_ip: {get_param: NovaPublicIP}
+        nova_api_host: {get_param: NovaApiHost}
+        nova_password: {get_param: NovaPassword}
+        ceilometer_metering_secret: {get_param: CeilometerMeteringSecret}
+        ceilometer_password: {get_param: CeilometerPassword}
+        ceilometer_compute_agent: {get_param: CeilometerComputeAgent}
+        snmpd_readonly_user_name: {get_param: SnmpdReadonlyUserName}
+        snmpd_readonly_user_password: {get_param: SnmpdReadonlyUserPassword}
+        glance_host: {get_param: GlanceHost}
+        glance_port: {get_param: GlancePort}
+        glance_protocol: {get_param: GlanceProtocol}
+        keystone_host: {get_param: KeystonePublicApiVirtualIP}
+        neutron_flat_networks: {get_param: NeutronFlatNetworks}
+        neutron_host: {get_param: NeutronHost}
+        neutron_local_ip: {get_attr: [NovaCompute, networks, ctlplane, 0]}
+        neutron_tenant_network_type: {get_param: NeutronNetworkType}
+        neutron_tunnel_types: {get_param: NeutronTunnelTypes}
+        neutron_tunnel_id_ranges:
+          str_replace:
+            template: "['RANGES']"
+            params:
+              RANGES:
+                list_join:
+                - "','"
+                - {get_param: NeutronTunnelIdRanges}
+        neutron_vni_ranges:
+          str_replace:
+            template: "['RANGES']"
+            params:
+              RANGES:
+                list_join:
+                - "','"
+                - {get_param: NeutronVniRanges}
+        neutron_network_vlan_ranges: {get_param: NeutronNetworkVLANRanges}
+        neutron_bridge_mappings: {get_param: NeutronBridgeMappings}
+        neutron_enable_tunneling: {get_param: NeutronEnableTunnelling}
+        neutron_physical_bridge: {get_param: NeutronPhysicalBridge}
+        neutron_public_interface: {get_param: NeutronPublicInterface}
+        neutron_password: {get_param: NeutronPassword}
+        neutron_agent_mode: {get_param: NeutronAgentMode}
+        neutron_router_distributed: {get_param: NeutronDVR}
+        neutron_metadata_proxy_shared_secret: {get_param: NeutronMetadataProxySharedSecret}
+        neutron_core_plugin: {get_param: NeutronCorePlugin}
+        neutron_service_plugins:
+          str_replace:
+            template: "['PLUGINS']"
+            params:
+              PLUGINS:
+                list_join:
+                - "','"
+                - {get_param: NeutronServicePlugins}
+        neutron_type_drivers:
+          str_replace:
+            template: "['DRIVERS']"
+            params:
+              DRIVERS:
+                list_join:
+                - "','"
+                - {get_param: NeutronTypeDrivers}
+        neutron_mechanism_drivers: {get_param: NeutronMechanismDrivers}
+        neutron_allow_l3agent_failover: {get_param: NeutronAllowL3AgentFailover}
+        neutron_l3_ha: {get_param: NeutronL3HA}
+        neutron_public_interface_raw_device: {get_param: NeutronPublicInterfaceRawDevice}
+        admin_password: {get_param: AdminPassword}
+        rabbit_host: {get_param: RabbitHost}
+        rabbit_username: {get_param: RabbitUserName}
+        rabbit_password: {get_param: RabbitPassword}
+        ntp_server: {get_param: NtpServer}
+
+  NovaComputePassthrough:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config: {get_input: passthrough_config}
+
+  NovaComputePassthroughSpecific:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config: {get_input: passthrough_config_specific}
+
+  NovaComputePassthroughDeployment:
+    depends_on: [NovaComputeDeployment]
+    type: OS::Heat::StructuredDeployment
+    properties:
+      config: {get_resource: NovaComputePassthrough}
+      server: {get_resource: NovaCompute}
+      signal_transport: NO_SIGNAL
+      input_values:
+        passthrough_config: {get_param: ExtraConfig}
+
+  NovaComputePassthroughDeploymentSpecific:
+    depends_on: [NovaComputePassthroughDeployment]
+    type: OS::Heat::StructuredDeployment
+    properties:
+      config: {get_resource: NovaComputePassthroughSpecific}
+      server: {get_resource: NovaCompute}
+      signal_transport: NO_SIGNAL
+      input_values:
+        passthrough_config_specific: {get_param: NovaComputeExtraConfig}
+
+outputs:
+  ip_address:
+    description: IP address of the server in the ctlplane network
+    value: {get_attr: [NovaCompute, networks, ctlplane, 0]}
+  internal_api_ip_address:
+    description: IP address of the server in the internal_api network
+    value: {get_attr: [InternalApiPort, ip_address]}
+  storage_ip_address:
+    description: IP address of the server in the storage network
+    value: {get_attr: [StoragePort, ip_address]}
+  tenant_ip_address:
+    description: IP address of the server in the tenant network
+    value: {get_attr: [TenantPort, ip_address]}
+  hostname:
+    description: Hostname of the server
+    value: {get_attr: [NovaCompute, name]}
+  hosts_entry:
+    description: >
+      Server's IP address and hostname in the /etc/hosts format
+    value:
+      str_replace:
+        template: "IP HOST"
+        params:
+          IP: {get_attr: [NovaCompute, networks, ctlplane, 0]}
+          HOST: {get_attr: [NovaCompute, name]}
+  nova_server_resource:
+    description: Heat resource handle for the Nova compute server
+    value:
+      {get_resource: NovaCompute}
+  config_identifier:
+    description: identifier which changes if the node configuration may need re-applying
+    value: "None - NO_SIGNAL"
diff --git a/os-apply-config/controller-post.yaml b/os-apply-config/controller-post.yaml
new file mode 100644
index 00000000..aac96357
--- /dev/null
+++ b/os-apply-config/controller-post.yaml
@@ -0,0 +1,20 @@
+heat_template_version: 2015-04-30
+description: 'Controller Post Deployment'
+# NOTE: this is a noop for os-apply-config style deployments because
+# post deployment ordering is controlled by tripleo-image-elements
+
+parameters:
+  servers:
+    type: json
+  NodeConfigIdentifiers:
+     type: json
+     description: Value which changes if the node configuration may need to be re-applied
+
+resources:
+
+  # Note, this should come last, so use depends_on to ensure
+  # this is created after any other resources.
+  ExtraConfig:
+    type: OS::TripleO::NodeExtraConfigPost
+    properties:
+        servers: {get_param: servers}
diff --git a/os-apply-config/controller.yaml b/os-apply-config/controller.yaml
new file mode 100644
index 00000000..18dcc8eb
--- /dev/null
+++ b/os-apply-config/controller.yaml
@@ -0,0 +1,1205 @@
+heat_template_version: 2015-04-30
+
+description: >
+  OpenStack control plane node. Can be wrapped in a ResourceGroup for scaling.
+
+parameters:
+  AdminPassword:
+    default: unset
+    description: The password for the keystone admin account, used for monitoring, querying neutron etc.
+    type: string
+    hidden: true
+  AdminToken:
+    default: unset
+    description: The keystone auth secret and db password.
+    type: string
+    hidden: true
+  CeilometerBackend:
+    default: 'mongodb'
+    description: The ceilometer backend type.
+    type: string
+  CeilometerMeteringSecret:
+    default: unset
+    description: Secret shared by the ceilometer services.
+    type: string
+    hidden: true
+  CeilometerPassword:
+    default: unset
+    description: The password for the ceilometer service and db account.
+    type: string
+    hidden: true
+  CinderEnableNfsBackend:
+    default: false
+    description: Whether to enable or not the NFS backend for Cinder
+    type: boolean
+  CinderEnableIscsiBackend:
+    default: true
+    description: Whether to enable or not the Iscsi backend for Cinder
+    type: boolean
+  CinderEnableRbdBackend:
+    default: false
+    description: Whether to enable or not the Rbd backend for Cinder
+    type: boolean
+  CinderISCSIHelper:
+    default: tgtadm
+    description: The iSCSI helper to use with cinder.
+    type: string
+  CinderLVMLoopDeviceSize:
+    default: 5000
+    description: The size of the loopback file used by the cinder LVM driver.
+    type: number
+  CinderNfsMountOptions:
+    default: ''
+    description: >
+      Mount options for NFS mounts used by Cinder NFS backend. Effective
+      when CinderEnableNfsBackend is true.
+    type: string
+  CinderNfsServers:
+    default: ''
+    description: >
+      NFS servers used by Cinder NFS backend. Effective when
+      CinderEnableNfsBackend is true.
+    type: comma_delimited_list
+  CinderPassword:
+    default: unset
+    description: The password for the cinder service and db account, used by cinder-api.
+    type: string
+    hidden: true
+  CloudName:
+    default: ''
+    description: The DNS name of this cloud. E.g. ci-overcloud.tripleo.org
+    type: string
+  ControllerExtraConfig:
+    default: {}
+    description: |
+      Controller specific configuration to inject into the cluster. Same
+      structure as ExtraConfig.
+    type: json
+  ControlVirtualInterface:
+    default: 'br-ex'
+    description: Interface where virtual ip will be assigned.
+    type: string
+  Debug:
+    default: ''
+    description: Set to True to enable debugging on all services.
+    type: string
+  EnableFencing:
+    default: false
+    description: Whether to enable fencing in Pacemaker or not.
+    type: boolean
+  EnableGalera:
+    default: true
+    description: Whether to use Galera instead of regular MariaDB.
+    type: boolean
+  EnableCephStorage:
+    default: false
+    description: Whether to deploy Ceph Storage (OSD) on the Controller
+    type: boolean
+  EnableSwiftStorage:
+    default: true
+    description: Whether to enable Swift Storage on the Controller
+    type: boolean
+  ExtraConfig:
+    default: {}
+    description: |
+      Additional configuration to inject into the cluster. The JSON should have
+      the following structure:
+        {"FILEKEY":
+          {"config":
+            [{"section": "SECTIONNAME",
+              "values":
+                [{"option": "OPTIONNAME",
+                  "value": "VALUENAME"
+                 }
+                ]
+             }
+            ]
+          }
+        }
+      For instance:
+        {"nova":
+          {"config":
+            [{"section": "default",
+              "values":
+                [{"option": "compute_manager",
+                  "value": "ironic.nova.compute.manager.ClusterComputeManager"
+                 }
+                ]
+             },
+             {"section": "cells",
+              "values":
+                [{"option": "driver",
+                  "value": "nova.cells.rpc_driver.CellsRPCDriver"
+                 }
+                ]
+             }
+            ]
+          }
+        }
+    type: json
+  FencingConfig:
+    default: {}
+    description: |
+      Pacemaker fencing configuration. The JSON should have
+      the following structure:
+        {
+          "devices": [
+            {
+              "agent": "AGENT_NAME",
+              "host_mac": "HOST_MAC_ADDRESS",
+              "params": {"PARAM_NAME": "PARAM_VALUE"}
+            }
+          ]
+        }
+      For instance:
+        {
+          "devices": [
+            {
+              "agent": "fence_xvm",
+              "host_mac": "52:54:00:aa:bb:cc",
+              "params": {
+                "multicast_address": "225.0.0.12",
+                "port": "baremetal_0",
+                "manage_fw": true,
+                "manage_key_file": true,
+                "key_file": "/etc/fence_xvm.key",
+                "key_file_password": "abcdef"
+              }
+            }
+          ]
+        }
+    type: json
+  Flavor:
+    description: Flavor for control nodes to request when deploying.
+    type: string
+    constraints:
+      - custom_constraint: nova.flavor
+  GlanceNotifierStrategy:
+    description: Strategy to use for Glance notification queue
+    type: string
+    default: noop
+  GlanceLogFile:
+    description: The filepath of the file to use for logging messages from Glance.
+    type: string
+    default: ''
+  GlancePassword:
+    default: unset
+    description: The password for the glance service and db account, used by the glance services.
+    type: string
+    hidden: true
+  GlancePort:
+    default: "9292"
+    description: Glance port.
+    type: string
+  GlanceProtocol:
+    default: http
+    description: Protocol to use when connecting to glance, set to https for SSL.
+    type: string
+  GlanceBackend:
+    default: swift
+    description: The short name of the Glance backend to use. Should be one
+      of swift, rbd, or file
+    type: string
+    constraints:
+    - allowed_values: ['swift', 'file', 'rbd']
+  HeatPassword:
+    default: unset
+    description: The password for the Heat service and db account, used by the Heat services.
+    type: string
+    hidden: true
+  HeatStackDomainAdminPassword:
+    description: Password for heat_domain_admin user.
+    type: string
+    default: ''
+    hidden: true
+  HeatAuthEncryptionKey:
+    description: Auth encryption key for heat-engine
+    type: string
+  HorizonSecret:
+    description: Secret key for Django
+    type: string
+  Image:
+    type: string
+    default: overcloud-control
+    constraints:
+      - custom_constraint: glance.image
+  ImageUpdatePolicy:
+    default: 'REBUILD_PRESERVE_EPHEMERAL'
+    description: What policy to use when reconstructing instances. REBUILD for rebuilds, REBUILD_PRESERVE_EPHEMERAL to preserve /mnt.
+    type: string
+  KeyName:
+    default: default
+    description: Name of an existing EC2 KeyPair to enable SSH access to the instances
+    type: string
+    constraints:
+      - custom_constraint: nova.keypair
+  KeystoneCACertificate:
+    default: ''
+    description: Keystone self-signed certificate authority certificate.
+    type: string
+  KeystoneSigningCertificate:
+    default: ''
+    description: Keystone certificate for verifying token validity.
+    type: string
+  KeystoneSigningKey:
+    default: ''
+    description: Keystone key for signing tokens.
+    type: string
+    hidden: true
+  KeystoneSSLCertificate:
+    default: ''
+    description: Keystone certificate for verifying token validity.
+    type: string
+  KeystoneSSLCertificateKey:
+    default: ''
+    description: Keystone key for signing tokens.
+    type: string
+    hidden: true
+  KeystoneNotificationDriver:
+    description: Comma-separated list of Oslo notification drivers used by Keystone
+    default: ['messaging']
+    type: comma_delimited_list
+  KeystoneNotificationFormat:
+    description: The Keystone notification format
+    default: 'basic'
+    type: string
+    constraints:
+      - allowed_values: [ 'basic', 'cadf' ]
+  MysqlClusterUniquePart:
+    description: A unique identifier of the MySQL cluster the controller is in.
+    type: string
+    default: 'unset'  # Has to be here because of the ignored empty value bug
+    # Drop the validation: https://bugs.launchpad.net/tripleo/+bug/1405446
+    # constraints:
+    # - length: {min: 4, max: 10}
+  MysqlInnodbBufferPoolSize:
+    description: >
+        Specifies the size of the buffer pool in megabytes. Setting to
+        zero should be interpreted as "no value" and will defer to the
+        lower level default.
+    type: number
+    default: 0
+  MysqlMaxConnections:
+    description: Configures MySQL max_connections config setting
+    type: number
+    default: 4096
+  MysqlRootPassword:
+    type: string
+    hidden: true
+    default: ''  # Has to be here because of the ignored empty value bug
+  NeutronExternalNetworkBridge:
+    description: Name of bridge used for external network traffic.
+    type: string
+    default: 'br-ex'
+  NeutronBridgeMappings:
+    description: >
+      The OVS logical->physical bridge mappings to use. See the Neutron
+      documentation for details. Defaults to mapping br-ex - the external
+      bridge on hosts - to a physical name 'datacentre' which can be used
+      to create provider networks (and we use this for the default floating
+      network) - if changing this either use different post-install network
+      scripts or be sure to keep 'datacentre' as a mapping network name.
+    type: string
+    default: "datacentre:br-ex"
+  NeutronDnsmasqOptions:
+    default: 'dhcp-option-force=26,1400'
+    description: Dnsmasq options for neutron-dhcp-agent. The default value here forces MTU to be set to 1400 to account for the gre tunnel overhead.
+    type: string
+  NeutronAgentMode:
+    default: 'dvr_snat'
+    description: Agent mode for the neutron-l3-agent on the controller hosts
+    type: string
+  NeutronDVR:
+    default: 'False'
+    description: Whether to configure Neutron Distributed Virtual Routers
+    type: string
+  NeutronMetadataProxySharedSecret:
+    default: 'unset'
+    description: Shared secret to prevent spoofing
+    type: string
+  NeutronCorePlugin:
+    default: 'ml2'
+    description: |
+        The core plugin for Neutron. The value should be the entrypoint to be loaded
+        from neutron.core_plugins namespace.
+    type: string
+  NeutronServicePlugins:
+    default: "router"
+    description: |
+        Comma-separated list of service plugin entrypoints to be loaded from the
+        neutron.service_plugins namespace.
+    type: comma_delimited_list
+  NeutronTypeDrivers:
+    default: "vxlan,vlan,flat,gre"
+    description: |
+        Comma-separated list of network type driver entrypoints to be loaded.
+    type: comma_delimited_list
+  NeutronMechanismDrivers:
+    default: 'openvswitch'
+    description: |
+        The mechanism drivers for the Neutron tenant network. To specify multiple
+        values, use a comma separated string, like so: 'openvswitch,l2_population'
+    type: string
+  NeutronAllowL3AgentFailover:
+    default: 'True'
+    description: Allow automatic l3-agent failover
+    type: string
+  NeutronL3HA:
+    default: 'False'
+    description: Whether to enable l3-agent HA
+    type: string
+  NeutronDhcpAgentsPerNetwork:
+    type: number
+    default: 3
+    description: The number of neutron dhcp agents to schedule per network
+  NeutronEnableTunnelling:
+    type: string
+    default: "True"
+  NeutronFlatNetworks:
+    type: string
+    default: 'datacentre'
+    description: If set, flat networks to configure in neutron plugins.
+  NeutronNetworkType:
+    default: 'vxlan'
+    description: The tenant network type for Neutron, either gre or vxlan.
+    type: string
+  NeutronNetworkVLANRanges:
+    default: 'datacentre'
+    description: >
+      The Neutron ML2 and OpenVSwitch vlan mapping range to support. See the
+      Neutron documentation for permitted values. Defaults to permitting any
+      VLAN on the 'datacentre' physical network (See NeutronBridgeMappings).
+    type: comma_delimited_list
+  NeutronPassword:
+    default: unset
+    description: The password for the neutron service and db account, used by neutron agents.
+    type: string
+    hidden: true
+  NeutronPublicInterface:
+    default: nic1
+    description: What interface to bridge onto br-ex for network nodes.
+    type: string
+  NeutronPublicInterfaceTag:
+    default: ''
+    description: >
+      VLAN tag for creating a public VLAN. The tag will be used to
+      create an access port on the exterior bridge for each control plane node,
+      and that port will be given the IP address returned by neutron from the
+      public network. Set CONTROLEXTRA=overcloud-vlan-port.yaml when compiling
+      overcloud.yaml to include the deployment of VLAN ports to the control
+      plane.
+    type: string
+  NeutronPublicInterfaceDefaultRoute:
+    default: ''
+    description: A custom default route for the NeutronPublicInterface.
+    type: string
+  NeutronPublicInterfaceIP:
+    default: ''
+    description: A custom IP address to put onto the NeutronPublicInterface.
+    type: string
+  NeutronPublicInterfaceRawDevice:
+    default: ''
+    description: If set, the public interface is a vlan with this device as the raw device.
+    type: string
+  NeutronTunnelTypes:
+    default: 'vxlan'
+    description: |
+        The tunnel types for the Neutron tenant network. To specify multiple
+        values, use a comma separated string, like so: 'gre,vxlan'
+    type: string
+  NeutronTunnelIdRanges:
+    description: |
+        Comma-separated list of <tun_min>:<tun_max> tuples enumerating ranges
+        of GRE tunnel IDs that are available for tenant network allocation
+    default: ["1:1000", ]
+    type: comma_delimited_list
+  NeutronVniRanges:
+    description: |
+        Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges
+        of VXLAN VNI IDs that are available for tenant network allocation
+    default: ["1:1000", ]
+    type: comma_delimited_list
+  NovaPassword:
+    default: unset
+    description: The password for the nova service and db account, used by nova-api.
+    type: string
+    hidden: true
+  MongoDbNoJournal:
+    default: false
+    description: Should MongoDb journaling be disabled
+    type: boolean
+  NtpServer:
+    type: string
+    default: ''
+  PcsdPassword:
+    type: string
+    description: The password for the 'pcsd' user.
+  PublicVirtualInterface:
+    default: 'br-ex'
+    description: >
+        Specifies the interface where the public-facing virtual ip will be assigned.
+        This should be int_public when a VLAN is being used.
+    type: string
+  PublicVirtualIP:
+    type: string
+    default: ''  # Has to be here because of the ignored empty value bug
+  RabbitCookie:
+    type: string
+    default: ''  # Has to be here because of the ignored empty value bug
+    hidden: true
+  RabbitPassword:
+    default: guest
+    description: The password for RabbitMQ
+    type: string
+    hidden: true
+  RabbitUserName:
+    default: guest
+    description: The username for RabbitMQ
+    type: string
+  RabbitClientUseSSL:
+    default: false
+    description: >
+        Rabbit client subscriber parameter to specify
+        an SSL connection to the RabbitMQ host.
+    type: string
+  RabbitClientPort:
+    default: 5672
+    description: Set rabbit subscriber port, change this if using SSL
+    type: number
+  RedisVirtualIP:
+    type: string
+    default: ''  # Has to be here because of the ignored empty value bug
+  SnmpdReadonlyUserName:
+    default: ro_snmp_user
+    description: The user name for SNMPd with readonly rights running on all Overcloud nodes
+    type: string
+  SnmpdReadonlyUserPassword:
+    default: unset
+    description: The user password for SNMPd with readonly rights running on all Overcloud nodes
+    type: string
+    hidden: true
+  SSLCACertificate:
+    default: ''
+    description: If set, the contents of an SSL certificate authority file.
+    type: string
+  SSLCertificate:
+    default: ''
+    description: If set, the contents of an SSL certificate .crt file for encrypting SSL endpoints.
+    type: string
+    hidden: true
+  SSLKey:
+    default: ''
+    description: If set, the contents of an SSL certificate .key file for encrypting SSL endpoints.
+    type: string
+    hidden: true
+  SwiftHashSuffix:
+    default: unset
+    description: A random string to be used as a salt when hashing to determine mappings
+      in the ring.
+    hidden: true
+    type: string
+  SwiftMountCheck:
+    default: 'false'
+    description: Value of mount_check in Swift account/container/object -server.conf
+    type: boolean
+  SwiftMinPartHours:
+    type: number
+    default: 1
+    description: The minimum time (in hours) before a partition in a ring can be moved following a rebalance.
+  SwiftPartPower:
+    default: 10
+    description: Partition Power to use when building Swift rings
+    type: number
+  SwiftPassword:
+    default: unset
+    description: The password for the swift service account, used by the swift proxy
+      services.
+    hidden: true
+    type: string
+  SwiftReplicas:
+    type: number
+    default: 3
+    description: How many replicas to use in the swift rings.
+  VirtualIP:
+    type: string
+    default: ''  # Has to be here because of the ignored empty value bug
+  HeatApiVirtualIP:
+    type: string
+    default: ''
+  GlanceApiVirtualIP:
+    type: string
+    default: ''
+  MysqlVirtualIP:
+    type: string
+    default: ''
+  KeystoneAdminApiVirtualIP:
+    type: string
+    default: ''
+  KeystonePublicApiVirtualIP:
+    type: string
+    default: ''
+  NeutronApiVirtualIP:
+    type: string
+    default: ''
+  ServiceNetMap:
+    default: {}
+    description: Mapping of service_name -> network name. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  UpdateIdentifier:
+    default: ''
+    type: string
+    description: >
+      Setting to a previously unused value during stack-update will trigger
+      package update on all nodes
+  Hostname:
+    type: string
+    default: '' # Defaults to Heat created hostname
+
+resources:
+
+  Controller:
+    type: OS::Nova::Server
+    properties:
+      image: {get_param: Image}
+      image_update_policy: {get_param: ImageUpdatePolicy}
+      flavor: {get_param: Flavor}
+      key_name: {get_param: KeyName}
+      networks:
+        - network: ctlplane
+      user_data_format: SOFTWARE_CONFIG
+      user_data: {get_resource: NodeUserData}
+      name: {get_param: Hostname}
+
+  NodeUserData:
+    type: OS::TripleO::NodeUserData
+
+  ExternalPort:
+    type: OS::TripleO::Controller::Ports::ExternalPort
+    properties:
+      ControlPlaneIP: {get_attr: [Controller, networks, ctlplane, 0]}
+
+  InternalApiPort:
+    type: OS::TripleO::Controller::Ports::InternalApiPort
+    properties:
+      ControlPlaneIP: {get_attr: [Controller, networks, ctlplane, 0]}
+
+  StoragePort:
+    type: OS::TripleO::Controller::Ports::StoragePort
+    properties:
+      ControlPlaneIP: {get_attr: [Controller, networks, ctlplane, 0]}
+
+  StorageMgmtPort:
+    type: OS::TripleO::Controller::Ports::StorageMgmtPort
+    properties:
+      ControlPlaneIP: {get_attr: [Controller, networks, ctlplane, 0]}
+
+  TenantPort:
+    type: OS::TripleO::Controller::Ports::TenantPort
+    properties:
+      ControlPlaneIP: {get_attr: [Controller, networks, ctlplane, 0]}
+
+  NetworkConfig:
+    type: OS::TripleO::Controller::Net::SoftwareConfig
+    properties:
+      ControlPlaneIp: {get_attr: [Controller, networks, ctlplane, 0]}
+      ExternalIpSubnet: {get_attr: [ExternalPort, ip_subnet]}
+      InternalApiIpSubnet: {get_attr: [InternalApiPort, ip_subnet]}
+      StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
+      StorageMgmtIpSubnet: {get_attr: [StorageMgmtPort, ip_subnet]}
+      TenantIpSubnet: {get_attr: [TenantPort, ip_subnet]}
+
+  NetworkDeployment:
+    type: OS::TripleO::SoftwareDeployment
+    properties:
+      signal_transport: NO_SIGNAL
+      config: {get_resource: NetworkConfig}
+      server: {get_resource: Controller}
+      input_values:
+        bridge_name: br-ex
+        interface_name: {get_param: NeutronPublicInterface}
+
+  ControllerPassthroughConfig:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config: {get_input: passthrough_config}
+
+  ControllerPassthroughConfigSpecific:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config: {get_input: passthrough_config_specific}
+
+  ControllerConfig:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config:
+        admin-password: {get_input: admin_password}
+        admin-token: {get_input: admin_token}
+        bootstack:
+          public_interface_ip: {get_input: neutron_public_interface_ip}
+        bootstrap_host:
+          nodeid: {get_input: bootstack_nodeid}
+        cinder:
+          db: {get_input: cinder_dsn}
+          debug: {get_input: debug}
+          volume_size_mb: {get_input: cinder_lvm_loop_device_size}
+          service-password: {get_input: cinder_password}
+          iscsi-helper: {get_input: CinderISCSIHelper}
+        controller-address: {get_input: controller_host}
+        corosync:
+          bindnetaddr: {get_input: controller_host}
+          mcastport: 5577
+        pacemaker:
+          stonith_enabled : false
+          recheck_interval : 5
+          quorum_policy : ignore
+        db-password: unset
+        glance:
+          registry:
+            host: {get_input: controller_virtual_ip}
+          backend: swift
+          db: {get_input: glance_dsn}
+          debug: {get_input: debug}
+          host: {get_input: controller_virtual_ip}
+          port: {get_input: glance_port}
+          protocol: {get_input: glance_protocol}
+          service-password: {get_input: glance_password}
+          swift-store-user: service:glance
+          swift-store-key: {get_input: glance_password}
+          notifier-strategy: {get_input: glance_notifier_strategy}
+          log-file: {get_input: glance_log_file}
+        heat:
+          admin_password: {get_input: heat_password}
+          admin_tenant_name: service
+          admin_user: heat
+          auth_encryption_key: {get_input: heat_auth_encryption_key}
+          db: {get_input: heat_dsn}
+          debug: {get_input: debug}
+          stack_domain_admin_password: {get_input: heat_stack_domain_admin_password}
+          watch_server_url: {get_input: heat.watch_server_url}
+          metadata_server_url: {get_input: heat.metadata_server_url}
+          waitcondition_server_url: {get_input: heat.waitcondition_server_url}
+        keystone:
+          db: {get_input: keystone_dsn}
+          debug: {get_input: debug}
+          host: {get_input: controller_virtual_ip}
+          ca_certificate: {get_input: keystone_ca_certificate}
+          signing_key: {get_input: keystone_signing_key}
+          signing_certificate: {get_input: keystone_signing_certificate}
+          ssl:
+              certificate: {get_input: keystone_ssl_certificate}
+              certificate_key: {get_input: keystone_ssl_certificate_key}
+        mysql:
+          innodb_buffer_pool_size: {get_input: mysql_innodb_buffer_pool_size}
+          local_bind: true
+          root-password: {get_input: mysql_root_password}
+          cluster_name: {get_input: mysql_cluster_name}
+        neutron:
+          debug: {get_input: debug}
+          flat-networks: {get_input: neutron_flat_networks}
+          host: {get_input: controller_virtual_ip}
+          metadata_proxy_shared_secret: {get_input: neutron_metadata_proxy_shared_secret}
+          agent_mode: {get_input: neutron_agent_mode}
+          router_distributed: {get_input: neutron_router_distributed}
+          core_plugin: {get_input: neutron_core_plugin}
+          service_plugins: {get_input: neutron_service_plugins}
+          type_drivers: {get_input: neutron_type_drivers}
+          mechanism_drivers: {get_input: neutron_mechanism_drivers}
+          allow_automatic_l3agent_failover: {get_input: neutron_allow_l3agent_failover}
+          l3_ha: {get_input: neutron_l3_ha}
+          dhcp_agents_per_network: {get_input: neutron_dhcp_agents_per_network}
+          ovs:
+            enable_tunneling: {get_input: neutron_enable_tunneling}
+            local_ip: {get_input: controller_host}
+            network_vlan_ranges: {get_input: neutron_network_vlan_ranges}
+            bridge_mappings: {get_input: neutron_bridge_mappings}
+            public_interface: {get_input: neutron_public_interface}
+            public_interface_raw_device: {get_input: neutron_public_interface_raw_device}
+            public_interface_route: {get_input: neutron_public_interface_default_route}
+            public_interface_tag: {get_input: neutron_public_interface_tag}
+            physical_bridge: br-ex
+            tenant_network_type: {get_input: neutron_tenant_network_type}
+            tunnel_types: {get_input: neutron_tunnel_types}
+            tunnel_id_ranges: {get_input: neutron_tunnel_id_ranges}
+            vni_ranges: {get_input: neutron_vni_ranges}
+          ovs_db: {get_input: neutron_dsn}
+          service-password: {get_input: neutron_password}
+          dnsmasq-options: {get_input: neutron_dnsmasq_options}
+        ceilometer:
+          db: {get_input: ceilometer_dsn}
+          debug: {get_input: debug}
+          metering_secret: {get_input: ceilometer_metering_secret}
+          service-password: {get_input: ceilometer_password}
+        snmpd:
+          export_MIB: UCD-SNMP-MIB
+          readonly_user_name: {get_input: snmpd_readonly_user_name}
+          readonly_user_password: {get_input: snmpd_readonly_user_password}
+        nova:
+          compute_driver: libvirt.LibvirtDriver
+          db: {get_input: nova_dsn}
+          default_floating_pool:
+            ext-net
+          host: {get_input: controller_virtual_ip}
+          metadata-proxy: true
+          service-password: {get_input: nova_password}
+        mongodb:
+          nojournal: {get_input: mongodb_no_journal}
+        rabbit:
+          host: {get_input: controller_virtual_ip}
+          username: {get_input: rabbit_username}
+          password: {get_input: rabbit_password}
+          cookie: {get_input: rabbit_cookie}
+          rabbit_client_use_ssl: {get_input: rabbit_client_use_ssl}
+          rabbit_port: {get_input: rabbit_client_port}
+        ntp:
+          servers:
+              - {server: {get_input: ntp_server}}
+        virtual_interfaces:
+          instances:
+            - vrrp_instance_name: VI_CONTROL
+              virtual_router_id: 51
+              keepalive_interface: {get_input: control_virtual_interface}
+              priority: 101
+              virtual_ips:
+              - ip: {get_input: controller_virtual_ip}
+                interface: {get_input: control_virtual_interface}
+            - vrrp_instance_name: VI_PUBLIC
+              virtual_router_id: 52
+              keepalive_interface: {get_input: public_virtual_interface}
+              priority: 101
+              virtual_ips:
+              - ip: {get_input: public_virtual_ip}
+                interface: {get_input: public_virtual_interface}
+          vrrp_sync_groups:
+            - name: VG1
+              members:
+                - VI_CONTROL
+                - VI_PUBLIC
+        keepalived:
+          keepalive_interface: {get_input: public_virtual_interface}
+          priority: 101
+        virtual_ips:
+            -
+              ip: {get_input: controller_virtual_ip}
+              interface: {get_input: control_virtual_interface}
+            -
+              ip: {get_input: public_virtual_ip}
+              interface: {get_input: public_virtual_interface}
+        haproxy:
+          net_binds:
+            - ip: {get_input: controller_virtual_ip}
+          options:
+            - option httpchk GET /
+          services:
+            - name: keystone_admin
+              port: 35357
+              net_binds: &public_binds
+                - ip: {get_input: controller_virtual_ip}
+                - ip: {get_input: public_virtual_ip}
+            - name: keystone_public
+              port: 5000
+              net_binds: *public_binds
+            - name: horizon
+              port: 80
+              net_binds: *public_binds
+            - name: neutron
+              port: 9696
+              net_binds: *public_binds
+            - name: cinder
+              port: 8776
+              net_binds: *public_binds
+            - name: glance_api
+              port: 9292
+              net_binds: *public_binds
+            - name: glance_registry
+              port: 9191
+              net_binds: *public_binds
+              options: # overwrite options as glace_reg needs auth for http req
+            - name: heat_api
+              port: 8004
+              net_binds: *public_binds
+            - name: heat_cloudwatch
+              port: 8003
+              net_binds: *public_binds
+            - name: heat_cfn
+              port: 8000
+              net_binds: *public_binds
+            - name: mysql
+              port: 3306
+              extra_server_params:
+                - backup
+              options:
+                - timeout client 0
+                - timeout server 0
+            - name: nova_ec2
+              port: 8773
+            - name: nova_osapi
+              port: 8774
+              net_binds: *public_binds
+            - name: nova_metadata
+              port: 8775
+              net_binds: *public_binds
+            - name: nova_novncproxy
+              port: 6080
+              net_binds: *public_binds
+            - name: ceilometer
+              port: 8777
+              net_binds: *public_binds
+              options: # overwrite options as ceil needs auth for http req
+            - name: swift_proxy_server
+              port: 8080
+              net_binds: *public_binds
+              options:
+                - option httpchk GET /info
+            - name: rabbitmq
+              port: 5672
+              options:
+                - timeout client 0
+                - timeout server 0
+                - maxconn 1500
+
+  ControllerDeployment:
+    type: OS::TripleO::SoftwareDeployment
+    properties:
+      signal_transport: NO_SIGNAL
+      config: {get_resource: ControllerConfig}
+      server: {get_resource: Controller}
+      input_values:
+        bootstack_nodeid: {get_attr: [Controller, name]}
+        controller_host: {get_attr: [Controller, networks, ctlplane, 0]}
+        controller_virtual_ip: {get_param: VirtualIP}
+        neutron_enable_tunneling: {get_param: NeutronEnableTunnelling}
+        heat.watch_server_url:
+          list_join:
+            - ''
+            - - 'http://'
+              - {get_param: VirtualIP}
+              - ':8003'
+        heat.metadata_server_url:
+          list_join:
+            - ''
+            - - 'http://'
+              - {get_param: VirtualIP}
+              - ':8000'
+        heat.waitcondition_server_url:
+          list_join:
+            - ''
+            - - 'http://'
+              - {get_param: VirtualIP}
+              - ':8000/v1/waitcondition'
+        admin_password: {get_param: AdminPassword}
+        admin_token: {get_param: AdminToken}
+        neutron_public_interface_ip: {get_param: NeutronPublicInterfaceIP}
+        debug: {get_param: Debug}
+        cinder_lvm_loop_device_size: {get_param: CinderLVMLoopDeviceSize}
+        cinder_password: {get_param: CinderPassword}
+        cinder_iscsi_helper: {get_param: CinderISCSIHelper}
+        cinder_dsn:
+          list_join:
+            - ''
+            - - 'mysql://cinder:'
+              - {get_param: CinderPassword}
+              - '@'
+              - {get_param: VirtualIP}
+              - '/cinder'
+        glance_port: {get_param: GlancePort}
+        glance_protocol: {get_param: GlanceProtocol}
+        glance_password: {get_param: GlancePassword}
+        glance_notifier_strategy: {get_param: GlanceNotifierStrategy}
+        glance_log_file: {get_param: GlanceLogFile}
+        glance_dsn:
+          list_join:
+            - ''
+            - - 'mysql://glance:'
+              - {get_param: GlancePassword}
+              - '@'
+              - {get_param: VirtualIP}
+              - '/glance'
+        heat_password: {get_param: HeatPassword}
+        heat_stack_domain_admin_password: {get_param: HeatStackDomainAdminPassword}
+        heat_auth_encryption_key: {get_param: HeatAuthEncryptionKey}
+        heat_dsn:
+          list_join:
+            - ''
+            - - 'mysql://heat:'
+              - {get_param: HeatPassword}
+              - '@'
+              - {get_param: VirtualIP}
+              - '/heat'
+        keystone_ca_certificate: {get_param: KeystoneCACertificate}
+        keystone_signing_key: {get_param: KeystoneSigningKey}
+        keystone_signing_certificate: {get_param: KeystoneSigningCertificate}
+        keystone_ssl_certificate: {get_param: KeystoneSSLCertificate}
+        keystone_ssl_certificate_key: {get_param: KeystoneSSLCertificateKey}
+        keystone_dsn:
+          list_join:
+            - ''
+            - - 'mysql://keystone:'
+              - {get_param: AdminToken}
+              - '@'
+              - {get_param: VirtualIP}
+              - '/keystone'
+        mongodb_no_journal: {get_param: MongoDbNoJournal}
+        mysql_innodb_buffer_pool_size: {get_param: MysqlInnodbBufferPoolSize}
+        mysql_root_password: {get_param: MysqlRootPassword}
+        mysql_cluster_name:
+          str_replace:
+            template: tripleo-CLUSTER
+            params:
+              CLUSTER: {get_param: MysqlClusterUniquePart}
+        neutron_flat_networks: {get_param: NeutronFlatNetworks}
+        neutron_metadata_proxy_shared_secret: {get_param: NeutronMetadataProxySharedSecret}
+        neutron_agent_mode: {get_param: NeutronAgentMode}
+        neutron_router_distributed: {get_param: NeutronDVR}
+        neutron_core_plugin: {get_param: NeutronCorePlugin}
+        neutron_service_plugins:
+          str_replace:
+            template: "['PLUGINS']"
+            params:
+              PLUGINS:
+                list_join:
+                - "','"
+                - {get_param: NeutronServicePlugins}
+        neutron_type_drivers:
+          str_replace:
+            template: "['DRIVERS']"
+            params:
+              DRIVERS:
+                list_join:
+                - "','"
+                - {get_param: NeutronTypeDrivers}
+        neutron_mechanism_drivers: {get_param: NeutronMechanismDrivers}
+        neutron_allow_l3agent_failover: {get_param: NeutronAllowL3AgentFailover}
+        neutron_l3_ha: {get_param: NeutronL3HA}
+        neutron_dhcp_agents_per_network: {get_param: NeutronDhcpAgentsPerNetwork}
+        neutron_network_vlan_ranges: {get_param: NeutronNetworkVLANRanges}
+        neutron_bridge_mappings: {get_param: NeutronBridgeMappings}
+        neutron_public_interface: {get_param: NeutronPublicInterface}
+        neutron_public_interface_raw_device: {get_param: NeutronPublicInterfaceRawDevice}
+        neutron_public_interface_default_route: {get_param: NeutronPublicInterfaceDefaultRoute}
+        neutron_public_interface_tag: {get_param: NeutronPublicInterfaceTag}
+        neutron_tenant_network_type: {get_param: NeutronNetworkType}
+        neutron_tunnel_types: {get_param: NeutronTunnelTypes}
+        neutron_tunnel_id_ranges:
+          str_replace:
+            template: "['RANGES']"
+            params:
+              RANGES:
+                list_join:
+                - "','"
+                - {get_param: NeutronTunnelIdRanges}
+        neutron_vni_ranges:
+          str_replace:
+            template: "['RANGES']"
+            params:
+              RANGES:
+                list_join:
+                - "','"
+                - {get_param: NeutronVniRanges}
+        neutron_password: {get_param: NeutronPassword}
+        neutron_dnsmasq_options: {get_param: NeutronDnsmasqOptions}
+        neutron_dsn:
+          list_join:
+            - ''
+            - - 'mysql://neutron:'
+              - {get_param: NeutronPassword}
+              - '@'
+              - {get_param: VirtualIP}
+              - '/ovs_neutron?charset=utf8'
+        ceilometer_metering_secret: {get_param: CeilometerMeteringSecret}
+        ceilometer_password: {get_param: CeilometerPassword}
+        ceilometer_dsn:
+          list_join:
+            - ''
+            - - 'mysql://ceilometer:'
+              - {get_param: CeilometerPassword}
+              - '@'
+              - {get_param: VirtualIP}
+              - '/ceilometer'
+        snmpd_readonly_user_name: {get_param: SnmpdReadonlyUserName}
+        snmpd_readonly_user_password: {get_param: SnmpdReadonlyUserPassword}
+        nova_password: {get_param: NovaPassword}
+        nova_dsn:
+          list_join:
+            - ''
+            - - 'mysql://nova:'
+              - {get_param: NovaPassword}
+              - '@'
+              - {get_param: VirtualIP}
+              - '/nova'
+        rabbit_username: {get_param: RabbitUserName}
+        rabbit_password: {get_param: RabbitPassword}
+        rabbit_cookie: {get_param: RabbitCookie}
+        rabbit_client_use_ssl: {get_param: RabbitClientUseSSL}
+        rabbit_client_port: {get_param: RabbitClientPort}
+        ntp_server: {get_param: NtpServer}
+        control_virtual_interface: {get_param: ControlVirtualInterface}
+        public_virtual_interface: {get_param: PublicVirtualInterface}
+        public_virtual_ip: {get_param: PublicVirtualIP}
+
+  SSLConfig:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config:
+        ssl:
+          ca_certificate: {get_input: ssl_ca_certificate}
+        stunnel:
+          cert: {get_input: ssl_certificate}
+          key: {get_input: ssl_key}
+          cacert: {get_input: ssl_ca_certificate}
+          ports:
+           - name: 'ec2'
+             accept: 13773
+             connect: 8773
+             connect_host: {get_input: controller_host}
+           - name: 'image'
+             accept: 13292
+             connect: 9292
+             connect_host: {get_input: controller_host}
+           - name: 'identity'
+             accept: 13000
+             connect: 5000
+             connect_host: {get_input: controller_host}
+           - name: 'network'
+             accept: 13696
+             connect: 9696
+             connect_host: {get_input: controller_host}
+           - name: 'compute'
+             accept: 13774
+             connect: 8774
+             connect_host: {get_input: controller_host}
+           - name: 'swift-proxy'
+             accept: 13080
+             connect: 8080
+             connect_host: {get_input: controller_host}
+           - name: 'cinder'
+             accept: 13776
+             connect: 8776
+             connect_host: {get_input: controller_host}
+           - name: 'ceilometer'
+             accept: 13777
+             connect: 8777
+             connect_host: {get_input: controller_host}
+
+  ControllerSSLDeployment:
+    type: OS::Heat::StructuredDeployment
+    properties:
+      config: {get_resource: SSLConfig}
+      server: {get_resource: Controller}
+      signal_transport: NO_SIGNAL
+      input_values:
+        controller_host: {get_attr: [Controller, networks, ctlplane, 0]}
+        ssl_certificate: {get_param: SSLCertificate}
+        ssl_key: {get_param: SSLKey}
+        ssl_ca_certificate: {get_param: SSLCACertificate}
+
+  ControllerPassthroughDeployment:
+    type: OS::Heat::StructuredDeployment
+    properties:
+      config: {get_resource: ControllerPassthroughConfig}
+      server: {get_resource: Controller}
+      signal_transport: NO_SIGNAL
+      input_values:
+        passthrough_config: {get_param: ExtraConfig}
+
+  ControllerPassthroughSpecificDeployment:
+    depends_on: [ControllerPassthroughDeployment]
+    type: OS::Heat::StructuredDeployment
+    properties:
+      config: {get_resource: ControllerPassthroughConfigSpecific}
+      server: {get_resource: Controller}
+      signal_transport: NO_SIGNAL
+      input_values:
+        passthrough_config_specific: {get_param: ControllerExtraConfig}
+
+  SwiftConfig:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config:
+        swift:
+          hash: { get_input: swift_hash_suffix }
+          part-power: { get_input: swift_part_power }
+          mount-check: { get_input: swift_mount_check }
+          min-part-hours: { get_input: swift_min_part_hours }
+          replicas: {get_input: swift_replicas }
+          service-password: { get_input: swift_password }
+
+  SwiftStorageDeploy:
+    type: OS::Heat::StructuredDeployment
+    properties:
+      server: {get_resource: Controller}
+      config: {get_resource: SwiftConfig}
+      signal_transport: NO_SIGNAL
+      input_values:
+        swift_hash_suffix: {get_param: SwiftHashSuffix}
+        swift_mount_check: {get_param: SwiftMountCheck}
+        swift_password: {get_param: SwiftPassword}
+        swift_min_part_hours: {get_param: SwiftMinPartHours}
+        swift_part_power: {get_param: SwiftPartPower}
+        swift_replicas: { get_param: SwiftReplicas}
+
+outputs:
+  ip_address:
+    description: IP address of the server in the ctlplane network
+    value: {get_attr: [Controller, networks, ctlplane, 0]}
+  external_ip_address:
+    description: IP address of the server in the external network
+    value: {get_attr: [ExternalPort, ip_address]}
+  internal_api_ip_address:
+    description: IP address of the server in the internal_api network
+    value: {get_attr: [InternalApiPort, ip_address]}
+  storage_ip_address:
+    description: IP address of the server in the storage network
+    value: {get_attr: [StoragePort, ip_address]}
+  storage_mgmt_ip_address:
+    description: IP address of the server in the storage_mgmt network
+    value: {get_attr: [StorageMgmtPort, ip_address]}
+  tenant_ip_address:
+    description: IP address of the server in the tenant network
+    value: {get_attr: [TenantPort, ip_address]}
+  hostname:
+    description: Hostname of the server
+    value: {get_attr: [Controller, name]}
+  corosync_node:
+    description: >
+      Node object in the format {ip: ..., name: ...} format that the corosync
+      element expects
+    value:
+      ip: {get_attr: [Controller, networks, ctlplane, 0]}
+      name: {get_attr: [Controller, name]}
+  hosts_entry:
+    description: >
+      Server's IP address and hostname in the /etc/hosts format
+    value:
+      str_replace:
+        template: IP HOST CLOUDNAME
+        params:
+          IP: {get_attr: [Controller, networks, ctlplane, 0]}
+          HOST: {get_attr: [Controller, name]}
+          CLOUDNAME: {get_param: CloudName}
+  nova_server_resource:
+    description: Heat resource handle for the Nova compute server
+    value:
+      {get_resource: Controller}
+  swift_device:
+    description: Swift device formatted for swift-ring-builder
+    value:
+      str_replace:
+        template: 'r1z1-IP:%PORT%/d1'
+        params:
+          IP: {get_attr: [Controller, networks, ctlplane, 0]}
+  swift_proxy_memcache:
+    description: Swift proxy-memcache value
+    value:
+      str_replace:
+        template: "IP:11211"
+        params:
+          IP: {get_attr: [Controller, networks, ctlplane, 0]}
+  config_identifier:
+    description: identifier which changes if the node configuration may need re-applying
+    value: "None - NO_SIGNAL"
diff --git a/os-apply-config/swift-devices-and-proxy-config.yaml b/os-apply-config/swift-devices-and-proxy-config.yaml
new file mode 100644
index 00000000..4f01dbea
--- /dev/null
+++ b/os-apply-config/swift-devices-and-proxy-config.yaml
@@ -0,0 +1,38 @@
+heat_template_version: 2015-04-30
+description: 'Swift Devices and Proxy Config'
+
+parameters:
+  controller_swift_devices:
+    type: comma_delimited_list
+  object_store_swift_devices:
+    type: comma_delimited_list
+  controller_swift_proxy_memcaches:
+    type: comma_delimited_list
+
+resources:
+
+  SwiftDevicesAndProxyConfigImpl:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config:
+        swift:
+          devices:
+            list_join:
+            - ", "
+            - - list_join:
+                - ", "
+                - {get_param: controller_swift_devices}
+              - list_join:
+                - ", "
+                - {get_param: object_store_swift_devices}
+          proxy-memcache:
+            list_join:
+            - ","
+            - {get_param: controller_swift_proxy_memcaches}
+
+outputs:
+  config_id:
+    description: The ID of the SwiftDevicesAndProxyConfigImpl resource.
+    value:
+      {get_resource: SwiftDevicesAndProxyConfigImpl}
diff --git a/os-apply-config/swift-storage-post.yaml b/os-apply-config/swift-storage-post.yaml
new file mode 100644
index 00000000..1b1c406d
--- /dev/null
+++ b/os-apply-config/swift-storage-post.yaml
@@ -0,0 +1,21 @@
+heat_template_version: 2015-04-30
+description: 'Swift Storage Post Deployment'
+# NOTE: this is a noop for os-apply-config style deployments because
+# post deployment ordering is controlled by tripleo-image-elements
+
+parameters:
+  servers:
+    type: json
+  NodeConfigIdentifiers:
+     type: json
+     description: Value which changes if the node configuration may need to be re-applied
+
+resources:
+
+  # Note, this should come last, so use depends_on to ensure
+  # this is created after any other resources.
+  ExtraConfig:
+    type: OS::TripleO::NodeExtraConfigPost
+    properties:
+        servers: {get_param: servers}
+
diff --git a/os-apply-config/swift-storage.yaml b/os-apply-config/swift-storage.yaml
new file mode 100644
index 00000000..d62d7d1a
--- /dev/null
+++ b/os-apply-config/swift-storage.yaml
@@ -0,0 +1,209 @@
+heat_template_version: 2015-04-30
+description: 'Common Swift Storage Configuration'
+parameters:
+  ExtraConfig:
+    default: {}
+    description: |
+      Additional configuration to inject into the cluster. The JSON should have
+      the following structure:
+        {"FILEKEY":
+          {"config":
+            [{"section": "SECTIONNAME",
+              "values":
+                [{"option": "OPTIONNAME",
+                  "value": "VALUENAME"
+                 }
+                ]
+             }
+            ]
+          }
+        }
+      For instance:
+        {"nova":
+          {"config":
+            [{"section": "default",
+              "values":
+                [{"option": "force_config_drive",
+                  "value": "always"
+                 }
+                ]
+             },
+             {"section": "cells",
+              "values":
+                [{"option": "driver",
+                  "value": "nova.cells.rpc_driver.CellsRPCDriver"
+                 }
+                ]
+             }
+            ]
+          }
+        }
+    type: json
+  ObjectStorageExtraConfig:
+    default: {}
+    description: |
+      Role specific additional configuration to inject into the cluster.
+    type: json
+  Flavor:
+    description: Flavor for Swift storage nodes to request when deploying.
+    type: string
+    constraints:
+      - custom_constraint: nova.flavor
+  HashSuffix:
+    default: unset
+    description: A random string to be used as a salt when hashing to determine mappings
+      in the ring.
+    hidden: true
+    type: string
+  Image:
+    default: overcloud-swift-storage
+    type: string
+  KeyName:
+    default: default
+    description: Name of an existing EC2 KeyPair to enable SSH access to the instances
+    type: string
+  MountCheck:
+    default: 'false'
+    description: Value of mount_check in Swift account/container/object -server.conf
+    type: boolean
+  MinPartHours:
+    type: number
+    default: 1
+    description: The minimum time (in hours) before a partition in a ring can be moved following a rebalance.
+  PartPower:
+    default: 10
+    description: Partition Power to use when building Swift rings
+    type: number
+  Replicas:
+    type: number
+    default: 3
+    description: How many replicas to use in the swift rings.
+  SnmpdReadonlyUserName:
+    default: ro_snmp_user
+    description: The user name for SNMPd with readonly rights running on all Overcloud nodes
+    type: string
+  SnmpdReadonlyUserPassword:
+    default: unset
+    description: The user password for SNMPd with readonly rights running on all Overcloud nodes
+    type: string
+    hidden: true
+  UpdateIdentifier:
+    default: ''
+    type: string
+    description: >
+      Setting to a previously unused value during stack-update will trigger
+      package update on all nodes
+  Hostname:
+    type: string
+    default: '' # Defaults to Heat created hostname
+
+resources:
+  SwiftConfig:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      config:
+        snmpd:
+          export_MIB: UCD-SNMP-MIB
+          readonly_user_name: {get_input: snmpd_readonly_user_name}
+          readonly_user_password: {get_input: snmpd_readonly_user_password}
+        swift:
+          hash: { get_input: swift_hash_suffix }
+          part-power: { get_input: swift_part_power }
+          min-part-hours: { get_input: swift_min_part_hours }
+          mount-check: { get_input: swift_mount_check }
+          replicas: {get_input: swift_replicas }
+        neutron:
+          ovs:
+            local_ip: { get_input: neutron_local_ip }
+  SwiftStorage:
+    type: OS::Nova::Server
+    properties:
+      image: {get_param: Image}
+      flavor: {get_param: Flavor}
+      key_name: {get_param: KeyName}
+      networks:
+        - network: ctlplane
+      user_data_format: SOFTWARE_CONFIG
+      user_data: {get_resource: NodeUserData}
+      name: {get_param: Hostname}
+
+  NodeUserData:
+    type: OS::TripleO::NodeUserData
+
+  InternalApiPort:
+    type: OS::TripleO::SwiftStorage::Ports::InternalApiPort
+    properties:
+      ControlPlaneIP: {get_attr: [SwiftStorage, networks, ctlplane, 0]}
+
+  StoragePort:
+    type: OS::TripleO::SwiftStorage::Ports::StoragePort
+    properties:
+      ControlPlaneIP: {get_attr: [SwiftStorage, networks, ctlplane, 0]}
+
+  StorageMgmtPort:
+    type: OS::TripleO::SwiftStorage::Ports::StorageMgmtPort
+    properties:
+      ControlPlaneIP: {get_attr: [SwiftStorage, networks, ctlplane, 0]}
+
+  NetworkConfig:
+    type: OS::TripleO::ObjectStorage::Net::SoftwareConfig
+    properties:
+      ControlPlaneIp: {get_attr: [SwiftStorage, networks, ctlplane, 0]}
+      InternalApiIpSubnet: {get_attr: [InternalApiPort, ip_subnet]}
+      StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
+      StorageMgmtIpSubnet: {get_attr: [StorageMgmtPort, ip_subnet]}
+
+  NetworkDeployment:
+    type: OS::TripleO::SoftwareDeployment
+    properties:
+      config: {get_resource: NetworkConfig}
+      server: {get_resource: SwiftStorage}
+
+  SwiftStorageDeploy:
+    type: OS::Heat::StructuredDeployment
+    properties:
+      server: {get_resource: SwiftStorage}
+      config: {get_resource: SwiftConfig}
+      signal_transport: NO_SIGNAL
+      input_values:
+        neutron_local_ip: {get_attr: [SwiftStorage, networks, ctlplane, 0]}
+        snmpd_readonly_user_name: {get_param: SnmpdReadonlyUserName}
+        snmpd_readonly_user_password: {get_param: SnmpdReadonlyUserPassword}
+        swift_hash_suffix: {get_param: HashSuffix}
+        swift_mount_check: {get_param: MountCheck}
+        swift_min_part_hours: {get_param: MinPartHours}
+        swift_part_power: {get_param: PartPower}
+        swift_replicas: { get_param: Replicas}
+
+outputs:
+  hosts_entry:
+    value:
+      str_replace:
+        template: "IP HOST"
+        params:
+          IP: {get_attr: [SwiftStorage, networks, ctlplane, 0]}
+          HOST: {get_attr: [SwiftStorage, name]}
+  nova_server_resource:
+    description: Heat resource handle for the swift storage server
+    value:
+      {get_resource: SwiftStorage}
+  swift_device:
+    description: Swift device formatted for swift-ring-builder
+    value:
+      str_replace:
+        template: 'r1z1-IP:%PORT%/d1'
+        params:
+          IP: {get_attr: [SwiftStorage, networks, ctlplane, 0]}
+  internal_api_ip_address:
+    description: IP address of the server in the internal_api network
+    value: {get_attr: [InternalApiPort, ip_address]}
+  storage_ip_address:
+    description: IP address of the server in the storage network
+    value: {get_attr: [StoragePort, ip_address]}
+  storage_mgmt_ip_address:
+    description: IP address of the server in the storage_mgmt network
+    value: {get_attr: [StorageMgmtPort, ip_address]}
+  config_identifier:
+    description: identifier which changes if the node configuration may need re-applying
+    value: "None - NO_SIGNAL"
diff --git a/os-apply-config/vip-config.yaml b/os-apply-config/vip-config.yaml
new file mode 100644
index 00000000..8f984ab7
--- /dev/null
+++ b/os-apply-config/vip-config.yaml
@@ -0,0 +1,16 @@
+heat_template_version: 2015-04-30
+
+description: >
+  Configure hieradata for service -> virtual IP mappings.
+
+resources:
+  VipConfigImpl:
+    type: OS::Heat::StructuredConfig
+    properties:
+      group: os-apply-config
+      # by default does nothing
+
+outputs:
+  OS::stack_id:
+    description: The VipConfigImpl resource.
+    value: {get_resource: VipConfigImpl}