diff --git a/magnum/drivers/common/templates/kubernetes/fragments/configure-kubernetes-minion.sh b/magnum/drivers/common/templates/kubernetes/fragments/configure-kubernetes-minion.sh
index 04a29ebf86..d366215b15 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/configure-kubernetes-minion.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/configure-kubernetes-minion.sh
@@ -145,7 +145,7 @@ KUBELET_ARGS="${KUBELET_ARGS} --cluster_dns=${DNS_SERVICE_IP} --cluster_domain=$
 KUBELET_ARGS="${KUBELET_ARGS} --volume-plugin-dir=/var/lib/kubelet/volumeplugins"
 KUBELET_ARGS="${KUBELET_ARGS} ${KUBELET_OPTIONS}"
 
-if [ "$(echo "${CLOUD_PROVIDER_ENABLED}" | tr '[:upper:]' '[:lower:]')" = "true" ]; then
+if [ -n "$TRUST_ID" ] && [ "$(echo "${CLOUD_PROVIDER_ENABLED}" | tr '[:upper:]' '[:lower:]')" = "true" ]; then
     KUBELET_ARGS="${KUBELET_ARGS} --cloud-provider=external"
 fi
 
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/write-kube-os-config.sh b/magnum/drivers/common/templates/kubernetes/fragments/write-kube-os-config.sh
index 7f279d4fd7..39b91ac4f8 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/write-kube-os-config.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/write-kube-os-config.sh
@@ -5,17 +5,14 @@ set +x
 set -x
 
 $ssh_cmd mkdir -p /etc/kubernetes/
-
-if [ -z "${TRUST_ID}" ]; then
-    exit 0
-fi
-
-KUBE_OS_CLOUD_CONFIG=/etc/kubernetes/cloud-config
 $ssh_cmd cp /etc/pki/tls/certs/ca-bundle.crt /etc/kubernetes/ca-bundle.crt
 
-# Generate a the configuration for Kubernetes services
-# to talk to OpenStack Neutron and Cinder
-CLOUD_CONFIG=$(cat <<EOF
+if [ -n "${TRUST_ID}" ]; then
+    KUBE_OS_CLOUD_CONFIG=/etc/kubernetes/cloud-config
+
+    # Generate a the configuration for Kubernetes services
+    # to talk to OpenStack Neutron and Cinder
+    cat > ${KUBE_OS_CLOUD_CONFIG} <<EOF
 [Global]
 auth-url=$AUTH_URL
 user-id=$TRUSTEE_USER_ID
@@ -33,24 +30,20 @@ monitor-max-retries=3
 [BlockStorage]
 bs-version=v2
 EOF
-)
 
-cat > ${KUBE_OS_CLOUD_CONFIG} <<EOF
-$CLOUD_CONFIG
-EOF
+    # Provide optional region parameter if it's set.
+    if [ -n "${REGION_NAME}" ]; then
+        sed -i '/ca-file/a region='${REGION_NAME}'' $KUBE_OS_CLOUD_CONFIG
+    fi
 
-# Provide optional region parameter if it's set.
-if [ -n "${REGION_NAME}" ]; then
-    sed -i '/ca-file/a region='${REGION_NAME}'' $KUBE_OS_CLOUD_CONFIG
-fi
+    # backwards compatibility, some apps may expect this file from previous magnum versions.
+    $ssh_cmd cp ${KUBE_OS_CLOUD_CONFIG} /etc/kubernetes/kube_openstack_config
 
-# backwards compatibility, some apps may expect this file from previous magnum versions.
-$ssh_cmd cp ${KUBE_OS_CLOUD_CONFIG} /etc/kubernetes/kube_openstack_config
-
-# Append additional networking config to config file provided to openstack
-# cloud controller manager (not supported by in-tree Cinder).
-cat > ${KUBE_OS_CLOUD_CONFIG}-occm <<EOF
-$CLOUD_CONFIG
+    # Append additional networking config to config file provided to openstack
+    # cloud controller manager (not supported by in-tree Cinder).
+    $ssh_cmd cp ${KUBE_OS_CLOUD_CONFIG} ${KUBE_OS_CLOUD_CONFIG}-occm
+    cat >> ${KUBE_OS_CLOUD_CONFIG}-occm <<EOF
 [Networking]
 internal-network-name=$CLUSTER_NETWORK_NAME
 EOF
+fi
diff --git a/magnum/drivers/heat/k8s_fedora_template_def.py b/magnum/drivers/heat/k8s_fedora_template_def.py
index 427149a598..3c281ea1aa 100644
--- a/magnum/drivers/heat/k8s_fedora_template_def.py
+++ b/magnum/drivers/heat/k8s_fedora_template_def.py
@@ -109,8 +109,14 @@ class K8sFedoraTemplateDefinition(k8s_template_def.K8sTemplateDefinition):
 
         # check cloud provider and cinder options. If cinder is selected,
         # the cloud provider needs to be enabled.
-        cloud_provider_enabled = cluster.labels.get(
-            'cloud_provider_enabled', 'true').lower()
+	cloud_provider_enabled = cluster.labels.get(
+            'cloud_provider_enabled',
+            'true' if CONF.trust.cluster_user_trust else 'false').lower()
+	if (not CONF.trust.cluster_user_trust
+                and cloud_provider_enabled == 'true'):
+            raise exception.InvalidParameterValue(_(
+		'"cluster_user_trust" must be set to True in magnum.conf when '
+                '"cloud_provider_enabled" label is set to true.'))
         if (cluster_template.volume_driver == 'cinder'
                 and cloud_provider_enabled == 'false'):
             raise exception.InvalidParameterValue(_(