Merge "Hiera optimization: use a new hiera hook"

20 files changed, 90 insertions, 131 deletions

diff --git a/puppet/services/aodh-api.yaml b/puppet/services/aodh-api.yaml
index daed1665..347a8c13 100644
--- a/puppet/services/aodh-api.yaml
+++ b/puppet/services/aodh-api.yaml
@@ -55,7 +55,7 @@ outputs:
             aodh::wsgi::apache::servername:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, AodhApiNetwork]}
             aodh::api::service_name: 'httpd'
@@ -68,7 +68,7 @@ outputs:
             aodh::api::host:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, AodhApiNetwork]}
             # NOTE: bind IP is found in Heat replacing the network name with the
diff --git a/puppet/services/barbican-api.yaml b/puppet/services/barbican-api.yaml
index b266674f..1a5e9134 100644
--- a/puppet/services/barbican-api.yaml
+++ b/puppet/services/barbican-api.yaml
@@ -24,7 +24,7 @@ parameters:
     hidden: true
   BarbicanWorkers:
     description: Set the number of workers for barbican::wsgi::apache
-    default: '"%{::processorcount}"'
+    default: '%{::processorcount}'
     type: string
   Debug:
     default: ''
@@ -93,7 +93,7 @@ outputs:
             barbican::wsgi::apache::servername:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, BarbicanApiNetwork]}
             barbican::db::database_connection:
diff --git a/puppet/services/ceilometer-api.yaml b/puppet/services/ceilometer-api.yaml
index 97b255a9..2f34f248 100644
--- a/puppet/services/ceilometer-api.yaml
+++ b/puppet/services/ceilometer-api.yaml
@@ -75,7 +75,7 @@ outputs:
             ceilometer::api::host:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, CeilometerApiNetwork]}
             ceilometer::wsgi::apache::bind_host: {get_param: [ServiceNetMap, CeilometerApiNetwork]}
@@ -83,7 +83,7 @@ outputs:
             ceilometer::wsgi::apache::servername:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, CeilometerApiNetwork]}
       service_config_settings:
diff --git a/puppet/services/ceph-base.yaml b/puppet/services/ceph-base.yaml
index 786e9ddd..8faf5640 100644
--- a/puppet/services/ceph-base.yaml
+++ b/puppet/services/ceph-base.yaml
@@ -119,36 +119,33 @@ outputs:
               NETWORK: {get_param: [ServiceNetMap, CephMonNetwork]}
         ceph::profile::params::public_addr: {get_param: [ServiceNetMap, CephMonNetwork]}
         ceph::profile::params::client_keys:
-          str_replace:
-            template: "{
-              client.admin: {
-                secret: 'ADMIN_KEY',
-                mode: '0600',
-                cap_mon: 'allow *',
-                cap_osd: 'allow *',
+          map_replace:
+            - client.admin:
+                secret: {get_param: CephAdminKey}
+                mode: '0600'
+                cap_mon: 'allow *'
+                cap_osd: 'allow *'
                 cap_mds: 'allow *'
-              },
-              client.bootstrap-osd: {
-                secret: 'ADMIN_KEY',
-                keyring_path: '/var/lib/ceph/bootstrap-osd/ceph.keyring',
+              client.bootstrap-osd:
+                secret: {get_param: CephAdminKey}
+                keyring_path: '/var/lib/ceph/bootstrap-osd/ceph.keyring'
                 cap_mon: 'allow profile bootstrap-osd'
-              },
-              client.CLIENT_USER: {
-                secret: 'CLIENT_KEY',
-                mode: '0644',
-                cap_mon: 'allow r',
-                cap_osd: 'allow class-read object_prefix rbd_children, allow rwx pool=CINDER_POOL, allow rwx pool=CINDERBACKUP_POOL, allow rwx pool=NOVA_POOL, allow rwx pool=GLANCE_POOL, allow rwx pool=GNOCCHI_POOL'
-              }
-            }"
-            params:
-              CLIENT_USER: {get_param: CephClientUserName}
-              CLIENT_KEY: {get_param: CephClientKey}
-              ADMIN_KEY: {get_param: CephAdminKey}
-              NOVA_POOL: {get_param: NovaRbdPoolName}
-              CINDER_POOL: {get_param: CinderRbdPoolName}
-              CINDERBACKUP_POOL: {get_param: CinderBackupRbdPoolName}
-              GLANCE_POOL: {get_param: GlanceRbdPoolName}
-              GNOCCHI_POOL: {get_param: GnocchiRbdPoolName}
+              CEPH_CLIENT_KEY:
+                secret: {get_param: CephClientKey}
+                mode: '0644'
+                cap_mon: 'allow r'
+                cap_osd:
+                  str_replace:
+                    template: 'allow class-read object_prefix rbd_children, allow rwx pool=CINDER_POOL, allow rwx pool=CINDERBACKUP_POOL, allow rwx pool=NOVA_POOL, allow rwx pool=GLANCE_POOL, allow rwx pool=GNOCCHI_POOL'
+                    params:
+                      NOVA_POOL: {get_param: NovaRbdPoolName}
+                      CINDER_POOL: {get_param: CinderRbdPoolName}
+                      CINDERBACKUP_POOL: {get_param: CinderBackupRbdPoolName}
+                      GLANCE_POOL: {get_param: GlanceRbdPoolName}
+                      GNOCCHI_POOL: {get_param: GnocchiRbdPoolName}
+            - keys:
+                CEPH_CLIENT_KEY:
+                  list_join: ['.', ['client', {get_param: CephClientUserName}]]
       service_config_settings:
         glance_api:
           glance::api::show_multiple_locations: {if: [glance_multiple_locations, true, false]}
diff --git a/puppet/services/cinder-api.yaml b/puppet/services/cinder-api.yaml
index 803d8b83..8d57418e 100644
--- a/puppet/services/cinder-api.yaml
+++ b/puppet/services/cinder-api.yaml
@@ -42,7 +42,7 @@ parameters:
   CinderWorkers:
     type: string
     description: Set the number of workers for cinder::wsgi::apache
-    default: '"%{::os_workers}"'
+    default: '%{::os_workers}'
   EnableInternalTLS:
     type: boolean
     default: false
@@ -101,7 +101,7 @@ outputs:
             cinder::api::bind_host:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, CinderApiNetwork]}
             cinder::wsgi::apache::ssl: {get_param: EnableInternalTLS}
@@ -115,7 +115,7 @@ outputs:
             cinder::wsgi::apache::servername:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, CinderApiNetwork]}
           -
diff --git a/puppet/services/database/mysql.yaml b/puppet/services/database/mysql.yaml
index 651bf4b1..bed8f7d3 100644
--- a/puppet/services/database/mysql.yaml
+++ b/puppet/services/database/mysql.yaml
@@ -87,7 +87,7 @@ outputs:
             tripleo::profile::base::database::mysql::bind_address:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]}
       step_config: |
diff --git a/puppet/services/database/redis-base.yaml b/puppet/services/database/redis-base.yaml
index 4ed3c007..2fab0eb6 100644
--- a/puppet/services/database/redis-base.yaml
+++ b/puppet/services/database/redis-base.yaml
@@ -39,6 +39,6 @@ outputs:
         # internal_api_subnet - > IP/CIDR
         redis::bind: {get_param: [ServiceNetMap, RedisNetwork]}
         redis::port: 6379
-        redis::sentinel::master_name: '"%{hiera(\"bootstrap_nodeid\")}"'
-        redis::sentinel::redis_host: '"%{hiera(\"bootstrap_nodeid_ip\")}"'
+        redis::sentinel::master_name: "%{hiera('bootstrap_nodeid')}"
+        redis::sentinel::redis_host: "%{hiera('bootstrap_nodeid_ip')}"
         redis::sentinel::notification_script: '/usr/local/bin/redis-notifications.sh'
diff --git a/puppet/services/gnocchi-api.yaml b/puppet/services/gnocchi-api.yaml
index ac15de4f..d5f8e62d 100644
--- a/puppet/services/gnocchi-api.yaml
+++ b/puppet/services/gnocchi-api.yaml
@@ -91,7 +91,7 @@ outputs:
             gnocchi::wsgi::apache::servername:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, GnocchiApiNetwork]}
             tripleo::profile::base::gnocchi::api::gnocchi_backend: {get_param: GnocchiBackend}
@@ -105,7 +105,7 @@ outputs:
             gnocchi::api::host:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, GnocchiApiNetwork]}
 
diff --git a/puppet/services/ironic-conductor.yaml b/puppet/services/ironic-conductor.yaml
index 4ac9fc30..f173aa63 100644
--- a/puppet/services/ironic-conductor.yaml
+++ b/puppet/services/ironic-conductor.yaml
@@ -68,7 +68,7 @@ outputs:
               list_join:
                 - ''
                 - - 'http://'
-                  - '%{hiera("ironic_conductor_http_host")}:'
+                  - "%{hiera('ironic_conductor_http_host')}:"
                   - {get_param: IronicIPXEPort}
             ironic::drivers::pxe::ipxe_enabled: {get_param: IronicIPXEEnabled}
             ironic::glance_api_servers: {get_param: [EndpointMap, GlanceInternal, uri]}
diff --git a/puppet/services/keepalived.yaml b/puppet/services/keepalived.yaml
index fb0d32b6..6f2c44ec 100644
--- a/puppet/services/keepalived.yaml
+++ b/puppet/services/keepalived.yaml
@@ -1,4 +1,4 @@
-heat_template_version: 2016-04-08
+heat_template_version: 2016-10-14
 
 description: >
   Keepalived service configured with Puppet
@@ -36,6 +36,11 @@ parameters:
     default: 'overcloud-keepalived'
     type: string
 
+conditions:
+
+  control_iface_empty: {equals : [{get_param: ControlVirtualInterface}, '']}
+  public_iface_empty: {equals : [{get_param: PublicVirtualInterface}, '']}
+
 outputs:
   role_data:
     description: Role data for the Keepalived role.
@@ -43,10 +48,19 @@ outputs:
       service_name: keepalived
       monitoring_subscription: {get_param: MonitoringSubscriptionKeepalived}
       config_settings:
-        tripleo::keepalived::control_virtual_interface: {get_param: ControlVirtualInterface}
-        tripleo::keepalived::public_virtual_interface: {get_param: PublicVirtualInterface}
-        tripleo.keepalived.firewall_rules:
-          '106 keepalived vrrp':
-            proto: vrrp
+        map_merge:
+        - tripleo.keepalived.firewall_rules:
+            '106 keepalived vrrp':
+              proto: vrrp
+        - 
+          if:
+          - control_iface_empty
+          - {}
+          - tripleo::keepalived::control_virtual_interface: {get_param: ControlVirtualInterface}
+        - 
+          if:
+          - public_iface_empty
+          - {}
+          - tripleo::keepalived::public_virtual_interface: {get_param: PublicVirtualInterface}
       step_config: |
         include ::tripleo::profile::base::keepalived
diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index fe023a6a..c2a282d4 100644
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -89,7 +89,7 @@ parameters:
   KeystoneWorkers:
     type: string
     description: Set the number of workers for keystone::wsgi::apache
-    default: '"%{::os_workers}"'
+    default: '%{::os_workers}'
   MonitoringSubscriptionKeystone:
     default: 'overcloud-keystone'
     type: string
@@ -195,13 +195,13 @@ outputs:
             keystone::wsgi::apache::servername:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}
             keystone::wsgi::apache::servername_admin:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}
             keystone::wsgi::apache::workers: {get_param: KeystoneWorkers}
@@ -219,13 +219,13 @@ outputs:
             keystone::admin_bind_host:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}
             keystone::public_bind_host:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}
             # NOTE: bind IP is found in Heat replacing the network name with the
diff --git a/puppet/services/neutron-base.yaml b/puppet/services/neutron-base.yaml
index 0b2cef07..3d03c313 100644
--- a/puppet/services/neutron-base.yaml
+++ b/puppet/services/neutron-base.yaml
@@ -84,16 +84,12 @@ outputs:
         neutron::rabbit_port: {get_param: RabbitClientPort}
         neutron::dhcp_agents_per_network: {get_param: NeutronDhcpAgentsPerNetwork}
         neutron::core_plugin: {get_param: NeutronCorePlugin}
-        neutron::service_plugins:
-          str_replace:
-            template: PLUGINS
-            params:
-              PLUGINS: {get_param: NeutronServicePlugins}
+        neutron::service_plugins: {get_param: NeutronServicePlugins}
         neutron::debug: {get_param: Debug}
         neutron::purge_config: {get_param: EnableConfigPurge}
         neutron::allow_overlapping_ips: true
         neutron::rabbit_heartbeat_timeout_threshold: 60
-        neutron::host: '"%{::fqdn}"'    #NOTE: extra quoting is needed
+        neutron::host: '%{::fqdn}'
         neutron::db::database_db_max_retries: -1
         neutron::db::database_max_retries: -1
         neutron::global_physnet_mtu: {get_param: NeutronGlobalPhysnetMtu}
diff --git a/puppet/services/neutron-metadata.yaml b/puppet/services/neutron-metadata.yaml
index 8be4c6d6..c87de285 100644
--- a/puppet/services/neutron-metadata.yaml
+++ b/puppet/services/neutron-metadata.yaml
@@ -72,6 +72,6 @@ outputs:
             neutron::agents::metadata::auth_password: {get_param: NeutronPassword}
             neutron::agents::metadata::auth_url: { get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix] }
             neutron::agents::metadata::auth_tenant: 'service'
-            neutron::agents::metadata::metadata_ip: '"%{hiera(\"nova_metadata_vip\")}"'
+            neutron::agents::metadata::metadata_ip: "%{hiera('nova_metadata_vip')}"
       step_config: |
         include tripleo::profile::base::neutron::metadata
diff --git a/puppet/services/neutron-ovs-agent.yaml b/puppet/services/neutron-ovs-agent.yaml
index cca0deee..e2b90b7b 100644
--- a/puppet/services/neutron-ovs-agent.yaml
+++ b/puppet/services/neutron-ovs-agent.yaml
@@ -94,21 +94,9 @@ outputs:
           - neutron::agents::ml2::ovs::l2_population: {get_param: NeutronEnableL2Pop}
             neutron::agents::ml2::ovs::enable_distributed_routing: {get_param: NeutronEnableDVR}
             neutron::agents::ml2::ovs::arp_responder: {get_param: NeutronEnableARPResponder}
-            neutron::agents::ml2::ovs::bridge_mappings:
-              str_replace:
-                template: MAPPINGS
-                params:
-                  MAPPINGS: {get_param: NeutronBridgeMappings}
-            neutron::agents::ml2::ovs::tunnel_types:
-              str_replace:
-                template: TYPES
-                params:
-                  TYPES: {get_param: NeutronTunnelTypes}
-            neutron::agents::ml2::ovs::extensions:
-              str_replace:
-                template: AGENT_EXTENSIONS
-                params:
-                  AGENT_EXTENSIONS: {get_param: NeutronAgentExtensions}
+            neutron::agents::ml2::ovs::bridge_mappings: {get_param: NeutronBridgeMappings}
+            neutron::agents::ml2::ovs::tunnel_types: {get_param: NeutronTunnelTypes}
+            neutron::agents::ml2::ovs::extensions: {get_param: NeutronAgentExtensions}
             # NOTE: bind IP is found in Heat replacing the network name with the
             # local node IP for the given network; replacement examples
             # (eg. for internal_api):
diff --git a/puppet/services/neutron-plugin-ml2.yaml b/puppet/services/neutron-plugin-ml2.yaml
index 5dbae3dc..88b5064c 100644
--- a/puppet/services/neutron-plugin-ml2.yaml
+++ b/puppet/services/neutron-plugin-ml2.yaml
@@ -83,46 +83,14 @@ outputs:
       config_settings:
         map_merge:
           - get_attr: [NeutronBase, role_data, config_settings]
-          - neutron::plugins::ml2::mechanism_drivers:
-              str_replace:
-                template: MECHANISMS
-                params:
-                  MECHANISMS: {get_param: NeutronMechanismDrivers}
-            neutron::plugins::ml2::type_drivers:
-              str_replace:
-                template: DRIVERS
-                params:
-                  DRIVERS: {get_param: NeutronTypeDrivers}
-            neutron::plugins::ml2::flat_networks:
-              str_replace:
-                template: NETWORKS
-                params:
-                  NETWORKS: {get_param: NeutronFlatNetworks}
-            neutron::plugins::ml2::extension_drivers:
-              str_replace:
-                template: PLUGIN_EXTENSIONS
-                params:
-                  PLUGIN_EXTENSIONS: {get_param: NeutronPluginExtensions}
-            neutron::plugins::ml2::network_vlan_ranges:
-              str_replace:
-                template: RANGES
-                params:
-                  RANGES: {get_param: NeutronNetworkVLANRanges}
-            neutron::plugins::ml2::tunnel_id_ranges:
-              str_replace:
-                template: RANGES
-                params:
-                  RANGES: {get_param: NeutronTunnelIdRanges}
-            neutron::plugins::ml2::vni_ranges:
-              str_replace:
-                template: RANGES
-                params:
-                  RANGES: {get_param: NeutronVniRanges}
-            neutron::plugins::ml2::tenant_network_types:
-              str_replace:
-                template: TYPES
-                params:
-                  TYPES: {get_param: NeutronNetworkType}
+          - neutron::plugins::ml2::mechanism_drivers: {get_param: NeutronMechanismDrivers}
+            neutron::plugins::ml2::type_drivers: {get_param: NeutronTypeDrivers}
+            neutron::plugins::ml2::flat_networks: {get_param: NeutronFlatNetworks}
+            neutron::plugins::ml2::extension_drivers: {get_param: NeutronPluginExtensions}
+            neutron::plugins::ml2::network_vlan_ranges: {get_param: NeutronNetworkVLANRanges}
+            neutron::plugins::ml2::tunnel_id_ranges: {get_param: NeutronTunnelIdRanges}
+            neutron::plugins::ml2::vni_ranges: {get_param: NeutronVniRanges}
+            neutron::plugins::ml2::tenant_network_types: {get_param: NeutronNetworkType}
             neutron::plugins::ml2::supported_pci_vendor_devs: {get_param: NeutronSupportedPCIVendorDevs}
 
       step_config: |
diff --git a/puppet/services/nova-api.yaml b/puppet/services/nova-api.yaml
index 49bd84bc..c4d5c6bb 100644
--- a/puppet/services/nova-api.yaml
+++ b/puppet/services/nova-api.yaml
@@ -87,8 +87,8 @@ outputs:
         map_merge:
         - get_attr: [NovaBase, role_data, config_settings]
         - get_attr: [ApacheServiceBase, role_data, config_settings]
-        - nova::cron::archive_deleted_rows::hour: '"*/12"'
-          nova::cron::archive_deleted_rows::destination: '"/dev/null"'
+        - nova::cron::archive_deleted_rows::hour: '*/12'
+          nova::cron::archive_deleted_rows::destination: '/dev/null'
           tripleo.nova_api.firewall_rules:
             '113 nova_api':
               dport:
@@ -108,7 +108,7 @@ outputs:
           nova::api::api_bind_address:
             str_replace:
               template:
-                '"%{::fqdn_$NETWORK}"'
+                '%{::fqdn_$NETWORK}'
               params:
                 $NETWORK: {get_param: [ServiceNetMap, NovaApiNetwork]}
           nova::api::service_name: 'httpd'
@@ -122,7 +122,7 @@ outputs:
           nova::wsgi::apache::servername:
             str_replace:
               template:
-                '"%{::fqdn_$NETWORK}"'
+                '%{::fqdn_$NETWORK}'
               params:
                 $NETWORK: {get_param: [ServiceNetMap, NovaApiNetwork]}
           nova::api::neutron_metadata_proxy_shared_secret: {get_param: NeutronMetadataProxySharedSecret}
diff --git a/puppet/services/nova-base.yaml b/puppet/services/nova-base.yaml
index 74a95d20..20bf2e42 100644
--- a/puppet/services/nova-base.yaml
+++ b/puppet/services/nova-base.yaml
@@ -109,7 +109,7 @@ outputs:
           nova::network::neutron::neutron_auth_url: {get_param: [EndpointMap, KeystoneV3Admin, uri]}
           nova::rabbit_heartbeat_timeout_threshold: 60
           nova::cinder_catalog_info: 'volumev2:cinderv2:internalURL'
-          nova::host: '"%{::fqdn}"'    # NOTE: extra quoting is needed.
+          nova::host: '%{::fqdn}'
           nova::notify_on_state_change: 'vm_and_task_state'
           nova::notification_driver: messagingv2
           nova::network::neutron::neutron_auth_type: 'v3password'
diff --git a/puppet/services/nova-compute.yaml b/puppet/services/nova-compute.yaml
index f7f2510e..908b676e 100644
--- a/puppet/services/nova-compute.yaml
+++ b/puppet/services/nova-compute.yaml
@@ -52,7 +52,7 @@ parameters:
       For different formats, refer to the nova.conf documentation for
       pci_passthrough_whitelist configuration
     type: json
-    default: ''
+    default: {}
   NovaVcpuPinSet:
     description: >
       A list or range of physical CPU cores to reserve for virtual machine
@@ -97,11 +97,7 @@ outputs:
         map_merge:
           - get_attr: [NovaBase, role_data, config_settings]
           - nova::compute::libvirt::manage_libvirt_services: false
-            nova::compute::pci_passthrough:
-              str_replace:
-                template: "'JSON_PARAM'"
-                params:
-                  JSON_PARAM: {get_param: NovaPCIPassthrough}
+            nova::compute::pci_passthrough: {get_param: NovaPCIPassthrough}
             nova::compute::vcpu_pin_set: {get_param: NovaVcpuPinSet}
             nova::compute::reserved_host_memory: {get_param: NovaReservedHostMemory}
             # we manage migration in nova common puppet profile
@@ -117,7 +113,7 @@ outputs:
               - '.'
               - - 'client'
                 - {get_param: CephClientUserName}
-            nova::compute::rbd::libvirt_rbd_secret_uuid: '"%{hiera(\"ceph::profile::params::fsid\")}"'
+            nova::compute::rbd::libvirt_rbd_secret_uuid: "%{hiera('ceph::profile::params::fsid')}"
             nova::compute::instance_usage_audit: true
             nova::compute::instance_usage_audit_period: 'hour'
             nova::compute::rbd::ephemeral_storage: {get_param: NovaEnableRbdBackend}
diff --git a/puppet/services/pacemaker/database/mysql.yaml b/puppet/services/pacemaker/database/mysql.yaml
index 7deaf0ca..ea3d8abd 100644
--- a/puppet/services/pacemaker/database/mysql.yaml
+++ b/puppet/services/pacemaker/database/mysql.yaml
@@ -40,7 +40,7 @@ outputs:
           - tripleo::profile::pacemaker::database::mysql::bind_address:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, MysqlNetwork]}
             # NOTE: bind IP is found in Heat replacing the network name with the
diff --git a/puppet/services/panko-api.yaml b/puppet/services/panko-api.yaml
index 63f631a0..700edc7f 100644
--- a/puppet/services/panko-api.yaml
+++ b/puppet/services/panko-api.yaml
@@ -55,7 +55,7 @@ outputs:
             panko::wsgi::apache::servername:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, PankoApiNetwork]}
             panko::api::service_name: 'httpd'
@@ -68,7 +68,7 @@ outputs:
             panko::api::host:
               str_replace:
                 template:
-                  '"%{::fqdn_$NETWORK}"'
+                  '%{::fqdn_$NETWORK}'
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, PankoApiNetwork]}
             # NOTE: bind IP is found in Heat replacing the network name with the