diff --git a/doc/source/user/index.rst b/doc/source/user/index.rst
index a2490ea3ff..7ad6f2847f 100644
--- a/doc/source/user/index.rst
+++ b/doc/source/user/index.rst
@@ -392,7 +392,7 @@ the table are linked to more details elsewhere in the user guide.
 | `service_cluster_ip_range`            | IPv4 CIDR for k8s  | 10.254.0.0/16 |
 |                                       | service portals    |               |
 +---------------------------------------+--------------------+---------------+
-| `keystone_auth_enabled`_              | see below          | false         |
+| `keystone_auth_enabled`_              | see below          | true          |
 +---------------------------------------+--------------------+---------------+
 | `k8s_keystone_auth_tag`_              | see below          | see below     |
 +---------------------------------------+--------------------+---------------+
@@ -1163,6 +1163,7 @@ _`container_infra_prefix`
   * docker.io/openstackmagnum/kubernetes-kubelet
   * docker.io/openstackmagnum/kubernetes-proxy
   * docker.io/openstackmagnum/kubernetes-scheduler
+  * docker.io/k8scloudprovider/k8s-keystone-auth
   * gcr.io/google_containers/pause:3.0
 
   Images that might be needed:
@@ -1302,7 +1303,9 @@ _`k8s_keystone_auth_tag`
   This label allows users to select `a specific k8s_keystone_auth
   version, based on its container tag
   <https://hub.docker.com/r/k8scloudprovider/k8s-keystone-auth/tags/>`_.
-  Stein-default: 1.13.0
+  Stein-default: v1.13.0
+  Train-default: v1.14.0
+  Ussuri-default: v1.15.0
 
 _`monitoring_enabled`
   Enable installation of cluster monitoring solution provided by the
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh b/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh
index 350c7cd707..72cdde5dc9 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh
@@ -6,7 +6,7 @@ step="enable-keystone-auth"
 printf "Starting to run ${step}\n"
 
 if [ "$(echo $KEYSTONE_AUTH_ENABLED | tr '[:upper:]' '[:lower:]')" != "false" ]; then
-    _prefix=${CONTAINER_INFRA_PREFIX:-docker.io/openstackmagnum/}
+    _prefix=${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}
     CERT_DIR=/etc/kubernetes/certs
 
     # Create policy configmap for keystone auth
diff --git a/magnum/drivers/k8s_fedora_atomic_v1/templates/kubecluster.yaml b/magnum/drivers/k8s_fedora_atomic_v1/templates/kubecluster.yaml
index fd575e74c7..ab23f44d8b 100644
--- a/magnum/drivers/k8s_fedora_atomic_v1/templates/kubecluster.yaml
+++ b/magnum/drivers/k8s_fedora_atomic_v1/templates/kubecluster.yaml
@@ -654,7 +654,7 @@ parameters:
   k8s_keystone_auth_tag:
     type: string
     description: tag of the k8s_keystone_auth container
-    default: v1.14.0
+    default: v1.15.0
 
   monitoring_enabled:
     type: boolean
diff --git a/magnum/drivers/k8s_fedora_coreos_v1/templates/kubecluster.yaml b/magnum/drivers/k8s_fedora_coreos_v1/templates/kubecluster.yaml
index 2aa94b31b2..c82bedac85 100644
--- a/magnum/drivers/k8s_fedora_coreos_v1/templates/kubecluster.yaml
+++ b/magnum/drivers/k8s_fedora_coreos_v1/templates/kubecluster.yaml
@@ -654,7 +654,7 @@ parameters:
   k8s_keystone_auth_tag:
     type: string
     description: tag of the k8s_keystone_auth container
-    default: v1.14.0
+    default: v1.15.0
 
   monitoring_enabled:
     type: boolean
diff --git a/releasenotes/notes/keystone-auth-repo-6970c05f44299326.yaml b/releasenotes/notes/keystone-auth-repo-6970c05f44299326.yaml
new file mode 100644
index 0000000000..aa23b42dd0
--- /dev/null
+++ b/releasenotes/notes/keystone-auth-repo-6970c05f44299326.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    k8s-keystone-auth now uses the upstream k8scloudprovider docker repo instead
+    of the openstackmagnum repo.