diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4cfefcb1..700e7a21 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,8 +4,8 @@ This file is used to list changes made in each version of cookbook-openstack-com
 
 ## 10.2.0
 * Separate endpoints for vncserver_listen and vncserver_proxyclient_address
-
 * Bump Chef gem to 11.16
+* Fix openstack_command with correct arguments order
 
 ## 10.1.0
 * Adding identity admin bind host endpoint to allow flexibility and consistency
diff --git a/libraries/cli.rb b/libraries/cli.rb
index ede2d6e7..74689880 100755
--- a/libraries/cli.rb
+++ b/libraries/cli.rb
@@ -54,10 +54,11 @@ module ::Openstack # rubocop:disable Documentation
     #       array into [cmd].  This is done to accomdate cmd + options like:
     #       keystone user-list
     #       glance   image-show <id|name>
-    openstackcmd = [cmd].concat(options.split)
+    openstackcmd = [cmd]
     args.each do |key, val|
       openstackcmd << "--#{key}" << val.to_s
     end
+    openstackcmd = openstackcmd.concat(options.split)
     Chef::Log.debug("Running openstack command: #{openstackcmd} with environment: #{env}")
     result = shell_out(openstackcmd, env: env)
     fail "#{result.stderr} (#{result.exitstatus})" if result.exitstatus != 0
diff --git a/spec/cli_spec.rb b/spec/cli_spec.rb
index 41eebd92..d6526877 100755
--- a/spec/cli_spec.rb
+++ b/spec/cli_spec.rb
@@ -57,7 +57,7 @@ describe 'openstack-common::default' do
             'OS_AUTH_URL' => 'http://127.0.0.1:35357/v2.0'
           }
         allow(subject).to receive(:shell_out).with(
-          %w(keystone user-list --key1 value1 --key2 value2),
+          %w(keystone --key1 value1 --key2 value2 user-list),
           env: env
           ).and_return double('shell_out', exitstatus: 0, stdout: 'good', stderr: '')