21 files changed, 142 insertions, 156 deletions
diff --git a/ci/environments/multinode-container-upgrade.yaml b/ci/environments/multinode-container-upgrade.yaml
deleted file mode 100644
index 24bb1f49..00000000
--- a/ci/environments/multinode-container-upgrade.yaml
+++ /dev/null
@@ -1,70 +0,0 @@
-# NOTE: This is an environment specific for containers CI. Mainly we
-# deploy non-pacemakerized overcloud. Once we are able to deploy and
-# upgrade pacemakerized and containerized overcloud, we should remove
-# this file and use normal CI multinode environments/scenarios.
-
-resource_registry:
-  OS::TripleO::Controller::Net::SoftwareConfig: ../common/net-config-multinode-os-net-config.yaml
-  OS::TripleO::Compute::Net::SoftwareConfig: ../common/net-config-multinode-os-net-config.yaml
-
-  # NOTE: This is needed because of upgrades from Ocata to Pike. We
-  # deploy the initial environment with Ocata templates, and
-  # overcloud-resource-registry.yaml there doesn't have this Docker
-  # mapping at all. After we stop CI'ing Ocata->Pike upgrade, we can
-  # remove this.
-  OS::TripleO::Services::Docker: OS::Heat::None
-
-parameter_defaults:
-  ControllerServices:
-    - OS::TripleO::Services::CephMon
-    - OS::TripleO::Services::CephOSD
-    - OS::TripleO::Services::CinderApi
-    - OS::TripleO::Services::CinderScheduler
-    - OS::TripleO::Services::CinderVolume
-    - OS::TripleO::Services::Docker
-    - OS::TripleO::Services::Kernel
-    - OS::TripleO::Services::Keystone
-    - OS::TripleO::Services::GlanceApi
-    - OS::TripleO::Services::HeatApi
-    - OS::TripleO::Services::HeatApiCfn
-    - OS::TripleO::Services::HeatApiCloudwatch
-    - OS::TripleO::Services::HeatEngine
-    - OS::TripleO::Services::MySQL
-    - OS::TripleO::Services::MySQLClient
-    - OS::TripleO::Services::NeutronDhcpAgent
-    - OS::TripleO::Services::NeutronL3Agent
-    - OS::TripleO::Services::NeutronMetadataAgent
-    - OS::TripleO::Services::NeutronServer
-    - OS::TripleO::Services::NeutronCorePlugin
-    - OS::TripleO::Services::NeutronOvsAgent
-    - OS::TripleO::Services::RabbitMQ
-    - OS::TripleO::Services::HAproxy
-    - OS::TripleO::Services::Keepalived
-    - OS::TripleO::Services::Memcached
-    - OS::TripleO::Services::Pacemaker
-    - OS::TripleO::Services::NovaConductor
-    - OS::TripleO::Services::NovaApi
-    - OS::TripleO::Services::NovaPlacement
-    - OS::TripleO::Services::NovaMetadata
-    - OS::TripleO::Services::NovaScheduler
-    - OS::TripleO::Services::Ntp
-    - OS::TripleO::Services::SwiftProxy
-    - OS::TripleO::Services::SwiftStorage
-    - OS::TripleO::Services::SwiftRingBuilder
-    - OS::TripleO::Services::Snmp
-    - OS::TripleO::Services::Timezone
-    - OS::TripleO::Services::TripleoPackages
-    - OS::TripleO::Services::NovaCompute
-    - OS::TripleO::Services::NovaLibvirt
-    - OS::TripleO::Services::Sshd
-  ControllerExtraConfig:
-    nova::compute::libvirt::services::libvirt_virt_type: qemu
-    nova::compute::libvirt::libvirt_virt_type: qemu
-    # Required for Centos 7.3 and Qemu 2.6.0
-    nova::compute::libvirt::libvirt_cpu_mode: 'none'
-    #NOTE(gfidente): not great but we need this to deploy on ext4
-    #http://docs.ceph.com/docs/jewel/rados/configuration/filesystem-recommendations/
-    ceph::profile::params::osd_max_object_name_len: 256
-    ceph::profile::params::osd_max_object_namespace_len: 64
-  SwiftCeilometerPipelineEnabled: False
-  Debug: True
diff --git a/docker/docker-steps.j2 b/docker/docker-steps.j2
index cf798e81..3dd963b9 100644
--- a/docker/docker-steps.j2
+++ b/docker/docker-steps.j2
@@ -216,26 +216,31 @@ resources:
   {% endfor %}
   # END CONFIG STEPS
 
-  {{role.name}}PostConfig:
-    type: OS::TripleO::Tasks::{{role.name}}PostConfig
+  # Note, this should be the last step to execute configuration changes.
+  # Ensure that all {{role.name}}ExtraConfigPost steps are executed
+  # after all the previous deployment steps.
+  {{role.name}}ExtraConfigPost:
     depends_on:
   {% for dep in roles %}
       - {{dep.name}}Deployment_Step5
   {% endfor %}
+    type: OS::TripleO::NodeExtraConfigPost
     properties:
-      servers:  {get_param: servers}
-      input_values:
-        update_identifier: {get_param: DeployIdentifier}
+        servers: {get_param: [servers, {{role.name}}]}
 
-  # Note, this should come last, so use depends_on to ensure
-  # this is created after any other resources.
-  {{role.name}}ExtraConfigPost:
+  # The {{role.name}}PostConfig steps are in charge of
+  # quiescing all services, i.e. in the Controller case,
+  # we should run a full service reload.
+  {{role.name}}PostConfig:
+    type: OS::TripleO::Tasks::{{role.name}}PostConfig
     depends_on:
   {% for dep in roles %}
-      - {{dep.name}}PostConfig
+      - {{dep.name}}ExtraConfigPost
   {% endfor %}
-    type: OS::TripleO::NodeExtraConfigPost
     properties:
-        servers: {get_param: [servers, {{role.name}}]}
+      servers:  {get_param: servers}
+      input_values:
+        update_identifier: {get_param: DeployIdentifier}
+
 
 {% endfor %}
diff --git a/docker/docker-toool b/docker/docker-toool
index 36aba4a7..0b87ea92 100755
--- a/docker/docker-toool
+++ b/docker/docker-toool
@@ -75,6 +75,9 @@ def parse_opts(argv):
 
 def docker_arg_map(key, value):
     value = str(value).encode('ascii', 'ignore')
+    if len(value) == 0:
+        return ''
+
     return {
         'environment': "--env=%s" % value,
         # 'image': value,
diff --git a/environments/docker.yaml b/environments/docker.yaml
index 28527945..b9f8cd75 100644
--- a/environments/docker.yaml
+++ b/environments/docker.yaml
@@ -27,7 +27,6 @@ resource_registry:
   OS::TripleO::Services::NeutronDhcpAgent: ../docker/services/neutron-dhcp.yaml
   OS::TripleO::Services::NeutronL3Agent: ../docker/services/neutron-l3.yaml
   OS::TripleO::Services::MySQL: ../docker/services/database/mysql.yaml
-  OS::TripleO::Services::HAProxy: ../docker/services/haproxy.yaml
   OS::TripleO::Services::RabbitMQ: ../docker/services/rabbitmq.yaml
   OS::TripleO::Services::MongoDb: ../docker/services/database/mongodb.yaml
   OS::TripleO::Services::Redis: ../docker/services/database/redis.yaml
diff --git a/environments/network-isolation.j2.yaml b/environments/network-isolation.j2.yaml
new file mode 100644
index 00000000..3ef9b275
--- /dev/null
+++ b/environments/network-isolation.j2.yaml
@@ -0,0 +1,37 @@
+{%- set primary_role = [roles[0]] -%}
+{%- for role in roles -%}
+  {%- if 'primary' in role.tags and 'controller' in role.tags -%}
+    {%- set _ = primary_role.pop() -%}
+    {%- set _ = primary_role.append(role) -%}
+  {%- endif -%}
+{%- endfor -%}
+{%- set primary_role_name = primary_role[0].name -%}
+# Enable the creation of Neutron networks for isolated Overcloud
+# traffic and configure each role to assign ports (related
+# to that role) on these networks.
+# primary role is: {{primary_role_name}}
+resource_registry:
+  # networks as defined in network_data.yaml
+  {%- for network in networks if network.enabled|default(true) %}
+  OS::TripleO::Network::{{network.name}}: ../network/{{network.name.lower()}}.yaml
+  {%- endfor %}
+
+  # Port assignments for the VIPs
+  {%- for network in networks if network.vip %}
+  OS::TripleO::Network::Ports::{{network.name}}VipPort: ../network/ports/{{network.name_lower|default(network.name.lower())}}.yaml
+  {%- endfor %}
+  OS::TripleO::Network::Ports::RedisVipPort: ../network/ports/vip.yaml
+
+
+  OS::TripleO::{{primary_role_name}}::Ports::RedisVipPort: ../network/ports/vip.yaml
+
+{%- for role in roles %}
+  # Port assignments for the {{role.name}}
+  {%- for network in networks %}
+    {%- if network.name in role.networks|default([]) and network.enabled|default(true) %}
+  OS::TripleO::{{role.name}}::Ports::{{network.name}}Port: ../network/ports/{{network.name_lower|default(network.name.lower())}}.yaml
+    {%- else %}
+  OS::TripleO::{{role.name}}::Ports::{{network.name}}Port: ../network/ports/noop.yaml
+    {%- endif %}
+  {%- endfor %}
+{%- endfor %}
diff --git a/environments/network-isolation.yaml b/environments/network-isolation.yaml
deleted file mode 100644
index a6b4b8ae..00000000
--- a/environments/network-isolation.yaml
+++ /dev/null
@@ -1,59 +0,0 @@
-# Enable the creation of Neutron networks for isolated Overcloud
-# traffic and configure each role to assign ports (related
-# to that role) on these networks.
-resource_registry:
-  OS::TripleO::Network::External: ../network/external.yaml
-  OS::TripleO::Network::InternalApi: ../network/internal_api.yaml
-  OS::TripleO::Network::StorageMgmt: ../network/storage_mgmt.yaml
-  OS::TripleO::Network::Storage: ../network/storage.yaml
-  OS::TripleO::Network::Tenant: ../network/tenant.yaml
-  # Management network is optional and disabled by default.
-  # To enable it, include environments/network-management.yaml
-  #OS::TripleO::Network::Management: ../network/management.yaml
-
-  # Port assignments for the VIPs
-  OS::TripleO::Network::Ports::ExternalVipPort: ../network/ports/external.yaml
-  OS::TripleO::Network::Ports::InternalApiVipPort: ../network/ports/internal_api.yaml
-  OS::TripleO::Network::Ports::StorageVipPort: ../network/ports/storage.yaml
-  OS::TripleO::Network::Ports::StorageMgmtVipPort: ../network/ports/storage_mgmt.yaml
-  OS::TripleO::Network::Ports::RedisVipPort: ../network/ports/vip.yaml
-
-  # Port assignments for the controller role
-  OS::TripleO::Controller::Ports::ExternalPort: ../network/ports/external.yaml
-  OS::TripleO::Controller::Ports::InternalApiPort: ../network/ports/internal_api.yaml
-  OS::TripleO::Controller::Ports::StoragePort: ../network/ports/storage.yaml
-  OS::TripleO::Controller::Ports::StorageMgmtPort: ../network/ports/storage_mgmt.yaml
-  OS::TripleO::Controller::Ports::TenantPort: ../network/ports/tenant.yaml
-  #OS::TripleO::Controller::Ports::ManagementPort: ../network/ports/management.yaml
-
-  # Port assignments for the compute role
-  OS::TripleO::Compute::Ports::ExternalPort: ../network/ports/noop.yaml
-  OS::TripleO::Compute::Ports::InternalApiPort: ../network/ports/internal_api.yaml
-  OS::TripleO::Compute::Ports::StoragePort: ../network/ports/storage.yaml
-  OS::TripleO::Compute::Ports::StorageMgmtPort: ../network/ports/noop.yaml
-  OS::TripleO::Compute::Ports::TenantPort: ../network/ports/tenant.yaml
-  #OS::TripleO::Compute::Ports::ManagementPort: ../network/ports/management.yaml
-
-  # Port assignments for the ceph storage role
-  OS::TripleO::CephStorage::Ports::ExternalPort: ../network/ports/noop.yaml
-  OS::TripleO::CephStorage::Ports::InternalApiPort: ../network/ports/noop.yaml
-  OS::TripleO::CephStorage::Ports::StoragePort: ../network/ports/storage.yaml
-  OS::TripleO::CephStorage::Ports::StorageMgmtPort: ../network/ports/storage_mgmt.yaml
-  OS::TripleO::CephStorage::Ports::TenantPort: ../network/ports/noop.yaml
-  #OS::TripleO::CephStorage::Ports::ManagementPort: ../network/ports/management.yaml
-
-  # Port assignments for the swift storage role
-  OS::TripleO::SwiftStorage::Ports::ExternalPort: ../network/ports/noop.yaml
-  OS::TripleO::SwiftStorage::Ports::InternalApiPort: ../network/ports/internal_api.yaml
-  OS::TripleO::SwiftStorage::Ports::StoragePort: ../network/ports/storage.yaml
-  OS::TripleO::SwiftStorage::Ports::StorageMgmtPort: ../network/ports/storage_mgmt.yaml
-  OS::TripleO::SwiftStorage::Ports::TenantPort: ../network/ports/noop.yaml
-  #OS::TripleO::SwiftStorage::Ports::ManagementPort: ../network/ports/management.yaml
-
-  # Port assignments for the block storage role
-  OS::TripleO::BlockStorage::Ports::ExternalPort: ../network/ports/noop.yaml
-  OS::TripleO::BlockStorage::Ports::InternalApiPort: ../network/ports/internal_api.yaml
-  OS::TripleO::BlockStorage::Ports::StoragePort: ../network/ports/storage.yaml
-  OS::TripleO::BlockStorage::Ports::StorageMgmtPort: ../network/ports/storage_mgmt.yaml
-  OS::TripleO::BlockStorage::Ports::TenantPort: ../network/ports/noop.yaml
-  #OS::TripleO::BlockStorage::Ports::ManagementPort: ../network/ports/management.yaml
diff --git a/extraconfig/tasks/post_puppet_pacemaker.j2.yaml b/extraconfig/tasks/post_puppet_pacemaker.j2.yaml
index 7fc258d6..6bf5afb0 100644
--- a/extraconfig/tasks/post_puppet_pacemaker.j2.yaml
+++ b/extraconfig/tasks/post_puppet_pacemaker.j2.yaml
@@ -10,8 +10,8 @@ parameters:
 
 resources:
 
-{%- for role in roles -%}
-{% if "controller" in role.tags %}
+{%- for role in roles %}
+  {%- if 'controller' in role.tags %}
   {{role.name}}PostPuppetMaintenanceModeConfig:
     type: OS::Heat::SoftwareConfig
     properties:
@@ -37,6 +37,6 @@ resources:
     properties:
       servers: {get_param: [servers, {{role.name}}]}
       input_values: {get_param: input_values}
-{%- endif -%}
-{% endfor %}
+  {%- endif %}
+{%- endfor %}
 
diff --git a/puppet/puppet-steps.j2 b/puppet/puppet-steps.j2
index 360c633a..5567d65d 100644
--- a/puppet/puppet-steps.j2
+++ b/puppet/puppet-steps.j2
@@ -44,26 +44,31 @@
         update_identifier: {get_param: DeployIdentifier}
 {% endfor %}
 
-  {{role.name}}PostConfig:
-    type: OS::TripleO::Tasks::{{role.name}}PostConfig
+  # Note, this should be the last step to execute configuration changes.
+  # Ensure that all {{role.name}}ExtraConfigPost steps are executed
+  # after all the previous deployment steps.
+  {{role.name}}ExtraConfigPost:
     depends_on:
   {% for dep in roles %}
       - {{dep.name}}Deployment_Step5
   {% endfor %}
+    type: OS::TripleO::NodeExtraConfigPost
     properties:
-      servers: {get_param: servers}
-      input_values:
-        update_identifier: {get_param: DeployIdentifier}
+        servers: {get_param: [servers, {{role.name}}]}
 
-  # Note, this should come last, so use depends_on to ensure
-  # this is created after any other resources.
-  {{role.name}}ExtraConfigPost:
+  # The {{role.name}}PostConfig steps are in charge of
+  # quiescing all services, i.e. in the Controller case,
+  # we should run a full service reload.
+  {{role.name}}PostConfig:
+    type: OS::TripleO::Tasks::{{role.name}}PostConfig
     depends_on:
   {% for dep in roles %}
-      - {{dep.name}}PostConfig
+      - {{dep.name}}ExtraConfigPost
   {% endfor %}
-    type: OS::TripleO::NodeExtraConfigPost
     properties:
-        servers: {get_param: [servers, {{role.name}}]}
+      servers: {get_param: servers}
+      input_values:
+        update_identifier: {get_param: DeployIdentifier}
+
 
 {% endfor %}
diff --git a/puppet/services/ironic-conductor.yaml b/puppet/services/ironic-conductor.yaml
index b1676715..0e8c8e12 100644
--- a/puppet/services/ironic-conductor.yaml
+++ b/puppet/services/ironic-conductor.yaml
@@ -164,6 +164,12 @@ outputs:
             ironic::my_ip: {get_param: [ServiceNetMap, IronicNetwork]}
             ironic::pxe::common::http_port: {get_param: IronicIPXEPort}
             # Credentials to access other services
+            ironic::cinder::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
+            ironic::cinder::username: 'ironic'
+            ironic::cinder::password: {get_param: IronicPassword}
+            ironic::cinder::project_name: 'service'
+            ironic::cinder::user_domain_name: 'Default'
+            ironic::cinder::project_domain_name: 'Default'
             ironic::glance::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
             ironic::glance::username: 'ironic'
             ironic::glance::password: {get_param: IronicPassword}
diff --git a/roles/BlockStorage.yaml b/roles/BlockStorage.yaml
index d242a5bb..16873fd1 100644
--- a/roles/BlockStorage.yaml
+++ b/roles/BlockStorage.yaml
@@ -4,6 +4,10 @@
 - name: BlockStorage
   description: |
     Cinder Block Storage node role
+  networks:
+    - InternalApi
+    - Storage
+    - StorageMgmt
   ServicesDefault:
     - OS::TripleO::Services::AuditD
     - OS::TripleO::Services::BlockStorageCinderVolume
diff --git a/roles/CephStorage.yaml b/roles/CephStorage.yaml
index d3de6bae..647c4d5a 100644
--- a/roles/CephStorage.yaml
+++ b/roles/CephStorage.yaml
@@ -4,6 +4,9 @@
 - name: CephStorage
   description: |
     Ceph OSD Storage node role
+  networks:
+    - Storage
+    - StorageMgmt
   ServicesDefault:
     - OS::TripleO::Services::AuditD
     - OS::TripleO::Services::CACerts
diff --git a/roles/Compute.yaml b/roles/Compute.yaml
index 73ec6595..d6bd1f3c 100644
--- a/roles/Compute.yaml
+++ b/roles/Compute.yaml
@@ -5,6 +5,10 @@
   description: |
     Basic Compute Node role
   CountDefault: 1
+  networks:
+    - InternalApi
+    - Tenant
+    - Storage
   HostnameFormatDefault: '%stackname%-novacompute-%index%'
   disable_upgrade_deployment: True
   ServicesDefault:
diff --git a/roles/Controller.yaml b/roles/Controller.yaml
index 7511d4c0..cccb75af 100644
--- a/roles/Controller.yaml
+++ b/roles/Controller.yaml
@@ -9,6 +9,12 @@
   tags:
     - primary
     - controller
+  networks:
+    - External
+    - InternalApi
+    - Storage
+    - StorageMgmt
+    - Tenant
   HostnameFormatDefault: '%stackname%-controller-%index%'
   ServicesDefault:
     - OS::TripleO::Services::AodhApi
diff --git a/roles/ControllerOpenstack.yaml b/roles/ControllerOpenstack.yaml
index 2d1702e8..6cf2120e 100644
--- a/roles/ControllerOpenstack.yaml
+++ b/roles/ControllerOpenstack.yaml
@@ -9,6 +9,12 @@
   tags:
     - primary
     - controller
+  networks:
+    - External
+    - InternalApi
+    - Storage
+    - StorageMgmt
+    - Tenant
   HostnameFormatDefault: '%stackname%-controller-%index%'
   ServicesDefault:
     - OS::TripleO::Services::AodhApi
diff --git a/roles/Database.yaml b/roles/Database.yaml
index 3ef751a7..75b26a8c 100644
--- a/roles/Database.yaml
+++ b/roles/Database.yaml
@@ -4,6 +4,8 @@
 - name: Database
   description: |
     Standalone database role with the database being managed via Pacemaker
+  networks:
+    - InternalApi
   HostnameFormatDefault: '%stackname%-database-%index%'
   ServicesDefault:
     - OS::TripleO::Services::AuditD
diff --git a/roles/Messaging.yaml b/roles/Messaging.yaml
index cbef61ab..5b06063f 100644
--- a/roles/Messaging.yaml
+++ b/roles/Messaging.yaml
@@ -4,6 +4,8 @@
 - name: Messaging
   description: |
     Standalone messaging role with RabbitMQ being managed via Pacemaker
+  networks:
+    - InternalApi
   HostnameFormatDefault: '%stackname%-messaging-%index%'
   ServicesDefault:
     - OS::TripleO::Services::AuditD
diff --git a/roles/Networker.yaml b/roles/Networker.yaml
index b393fa7b..a28eaa63 100644
--- a/roles/Networker.yaml
+++ b/roles/Networker.yaml
@@ -5,6 +5,8 @@
   description: |
     Standalone networking role to run Neutron services their own. Includes
     Pacemaker integration via PacemakerRemote
+  networks:
+    - InternalApi
   HostnameFormatDefault: '%stackname%-networker-%index%'
   ServicesDefault:
     - OS::TripleO::Services::AuditD
diff --git a/roles/ObjectStorage.yaml b/roles/ObjectStorage.yaml
index 3741ca66..27dc1233 100644
--- a/roles/ObjectStorage.yaml
+++ b/roles/ObjectStorage.yaml
@@ -4,6 +4,10 @@
 - name: ObjectStorage
   description: |
     Swift Object Storage node role
+  networks:
+    - InternalApi
+    - Storage
+    - StorageMgmt
   disable_upgrade_deployment: True
   ServicesDefault:
     - OS::TripleO::Services::AuditD
diff --git a/roles/README.rst b/roles/README.rst
index 6c742332..cd1fcb47 100644
--- a/roles/README.rst
+++ b/roles/README.rst
@@ -58,6 +58,10 @@ Role Options
 * description: (string) as few sentences describing the role and information
   pertaining to the usage of the role.
 
+ * networks: (list), optional list of networks which the role will have
+   access to when network isolation is enabled. The names should match
+   those defined in network_data.yaml.
+
 Working with Roles
 ==================
 The tripleoclient provides a series of commands that can be used to view
diff --git a/roles/Telemetry.yaml b/roles/Telemetry.yaml
index 0f60364b..d23ab6e3 100644
--- a/roles/Telemetry.yaml
+++ b/roles/Telemetry.yaml
@@ -4,6 +4,8 @@
 - name: Telemetry
   description: |
     Telemetry role that has all the telemetry services.
+  networks:
+    - InternalApi
   HostnameFormatDefault: '%stackname%-telemetry-%index%'
   ServicesDefault:
     - OS::TripleO::Services::AodhApi
diff --git a/roles_data.yaml b/roles_data.yaml
index c536e834..23f8d19a 100644
--- a/roles_data.yaml
+++ b/roles_data.yaml
@@ -12,6 +12,12 @@
   tags:
     - primary
     - controller
+  networks:
+    - External
+    - InternalApi
+    - Storage
+    - StorageMgmt
+    - Tenant
   HostnameFormatDefault: '%stackname%-controller-%index%'
   ServicesDefault:
     - OS::TripleO::Services::AodhApi
@@ -128,6 +134,10 @@
   description: |
     Basic Compute Node role
   CountDefault: 1
+  networks:
+    - InternalApi
+    - Tenant
+    - Storage
   HostnameFormatDefault: '%stackname%-novacompute-%index%'
   disable_upgrade_deployment: True
   ServicesDefault:
@@ -167,6 +177,10 @@
 - name: BlockStorage
   description: |
     Cinder Block Storage node role
+  networks:
+    - InternalApi
+    - Storage
+    - StorageMgmt
   ServicesDefault:
     - OS::TripleO::Services::AuditD
     - OS::TripleO::Services::BlockStorageCinderVolume
@@ -191,6 +205,10 @@
 - name: ObjectStorage
   description: |
     Swift Object Storage node role
+  networks:
+    - InternalApi
+    - Storage
+    - StorageMgmt
   disable_upgrade_deployment: True
   ServicesDefault:
     - OS::TripleO::Services::AuditD
@@ -217,6 +235,9 @@
 - name: CephStorage
   description: |
     Ceph OSD Storage node role
+  networks:
+    - Storage
+    - StorageMgmt
   ServicesDefault:
     - OS::TripleO::Services::AuditD
     - OS::TripleO::Services::CACerts