diff --git a/manifests/function/workload-config/kustomization.yaml b/manifests/function/workload-config/kustomization.yaml
new file mode 100644
index 000000000..c6c7bf241
--- /dev/null
+++ b/manifests/function/workload-config/kustomization.yaml
@@ -0,0 +1,3 @@
+resources:
+  - vino-cr.yaml
+  - network-template-secret.yaml
diff --git a/manifests/function/workload-config/network-template-secret.yaml b/manifests/function/workload-config/network-template-secret.yaml
new file mode 100644
index 000000000..384de242c
--- /dev/null
+++ b/manifests/function/workload-config/network-template-secret.yaml
@@ -0,0 +1,50 @@
+# This template creates a cloud-init network configuration,
+# based upon these input values:
+#
+# .Node: the Node from a ViNO CR
+# .Networks: the list of Networks from a ViNO CR
+# .Generated: host-specific info generated/calculated by ViNO itself
+apiVersion: v1
+kind: Secret
+metadata:
+  name: test-template
+  namespace: default
+type: Opaque
+stringData:
+  template: |
+    {{ $netToIface := dict }}
+    links:
+      {{- range .Node.NetworkInterfaces }}
+      - id: {{ .Name }}
+        name: {{ .Name }}
+        type: {{ .Type }}
+        mtu: {{ .MTU }}
+        ethernet_mac_address: {{ index $.Generated.MACAddresses .Name }}
+        {{- if .Options -}}
+        {{ range $key, $val := .Options }}
+        {{ $key }}: {{ $val }}
+        {{- end }}
+        {{- end }}
+        {{- /* Save the network->interface mapping, needed below */ -}}
+        {{- $_ := set $netToIface .NetworkName .Name }}
+      {{- end }}
+    networks:
+      {{- range .Networks }}
+      - id: {{ .Name }}
+        type: {{ .Type }}
+        link: {{ index $netToIface .Name }}
+        ip_address: {{ index $.Generated.IPAddresses .Name }}
+        #netmask: "TODO - see if needed when ip has CIDR range"
+        dns_nameservers: {{ .DNSServers }}
+        {{- if .Routes }}
+        routes:
+        {{- range .Routes }}
+          - network: {{ .Network }}
+            {{ if .Netmask }}netmask: {{ .Netmask }}{{ end }}
+            gateway: {{ .Gateway }}
+        {{- end }}
+        {{- end }}
+      {{- end }}
+    #services:
+    # TODO: confirm dns_nameservers above does the trick here
+
diff --git a/manifests/function/workload-config/vino-cr.yaml b/manifests/function/workload-config/vino-cr.yaml
new file mode 100644
index 000000000..b93e18a6e
--- /dev/null
+++ b/manifests/function/workload-config/vino-cr.yaml
@@ -0,0 +1,62 @@
+apiVersion: airship.airshipit.org/v1
+kind: Vino
+metadata:
+  name: vino-test-cr
+  #  labels: ...
+spec:
+  nodeSelector:
+    matchLabels:
+      beta.kubernetes.io/os: linux
+  configuration:
+      cpuExclude: 0-4,54-60
+      redfishCredentialSecret:
+        name: redfishSecret
+  networks:
+    - name: management
+      subnet: 192.168.2.0/20
+      type: ipv4
+      allocationStart: 192.168.2.10
+      allocationStop: 192.168.2.14 # docs should specify that the range should = number of vms (to permit future expansion over multiple vino crs etc)
+      routes:
+        - network: 10.0.0.0
+          netmask: 255.255.255.0
+          gateway: $vino.nodebridgegw # vino will need to populate this from the nodelabel value `airshipit.org/vino.nodebridgegw`
+      dns_servers: ["135.188.34.124"]
+    - name: external
+      subnet: 169.0.0.0/24
+      type: ipv4
+      routes:
+        - network: 0.0.0.0
+          netmask: 0.0.0.0
+          gateway: 169.0.0.1
+      allocationStart: 169.0.0.10
+      allocationStop: 169.0.0.254
+
+  vmBridge: lo
+  nodes:
+    - name: "worker"
+      count: 3
+      networkDataTemplate:
+        name: "test-template"
+        namespace: "default"
+      networkInterfaces:
+        - name: management
+          type: bridge
+          network: management
+          mtu: 1500
+          options:
+            bridgeName: vminfra-bridge
+        - name: external
+          type: sriov-bond
+          network: external
+          mtu: 9100
+          options:
+            # this is an 'open-ended' set of k/v pairs, validation is perfomed by vino rather than crd schema.
+            pf: "[enp29s0f0,enp219s1f1]"
+            vlan: "100"
+            bond_mode: 802.3ad
+            bond_xmit_hash_policy: layer3+4
+            bond_miimon: "100"
+  bmcCredentials:
+    username: "admin"
+    password: "passw0rd"
diff --git a/manifests/site/virtual-network-cloud/target/workload-config/kustomization.yaml b/manifests/site/virtual-network-cloud/target/workload-config/kustomization.yaml
new file mode 100644
index 000000000..d2eeb7c50
--- /dev/null
+++ b/manifests/site/virtual-network-cloud/target/workload-config/kustomization.yaml
@@ -0,0 +1,2 @@
+resources:
+  - ../../../../type/multi-tenant/target/workload-config
diff --git a/manifests/type/multi-tenant/phases/kustomization.yaml b/manifests/type/multi-tenant/phases/kustomization.yaml
index 5c1765c62..bea634ee6 100644
--- a/manifests/type/multi-tenant/phases/kustomization.yaml
+++ b/manifests/type/multi-tenant/phases/kustomization.yaml
@@ -1,5 +1,6 @@
 resources:
   - ../../airship-core/phases
   - ../sub-clusters/wordpress/phases
+  - workload-config.yaml
 patchesStrategicMerge:
   - cluster_map_patch.yaml
diff --git a/manifests/type/multi-tenant/phases/workload-config.yaml b/manifests/type/multi-tenant/phases/workload-config.yaml
new file mode 100644
index 000000000..583435e15
--- /dev/null
+++ b/manifests/type/multi-tenant/phases/workload-config.yaml
@@ -0,0 +1,11 @@
+apiVersion: airshipit.org/v1alpha1
+kind: Phase
+metadata:
+  name: workload-config
+  clusterName: target-cluster
+config:
+  executorRef:
+    apiVersion: airshipit.org/v1alpha1
+    kind: KubernetesApply
+    name: kubernetes-apply
+  documentEntryPoint: target/workload-config
diff --git a/manifests/type/multi-tenant/target/workload-config/kustomization.yaml b/manifests/type/multi-tenant/target/workload-config/kustomization.yaml
new file mode 100644
index 000000000..fb58236b5
--- /dev/null
+++ b/manifests/type/multi-tenant/target/workload-config/kustomization.yaml
@@ -0,0 +1,2 @@
+resources:
+  - ../../../../function/workload-config