diff --git a/doc/source/user/k8s-keystone-authN-authZ.rst b/doc/source/user/k8s-keystone-authN-authZ.rst
index 0d9f1e1dc0..ef014deb47 100644
--- a/doc/source/user/k8s-keystone-authN-authZ.rst
+++ b/doc/source/user/k8s-keystone-authN-authZ.rst
@@ -176,10 +176,10 @@ user can update the default `keystone-sync-policy` configmap as follows.
     apiVersion: v1
     kind: ConfigMap
     metadata:
-    name: keystone-sync-policy
-    namespace: kube-system
+      name: keystone-sync-policy
+      namespace: kube-system
     data:
-    syncConfig: |
+      syncConfig: |
         role-mappings:
           - keystone-role: member
             groups: ["project-1"]
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh b/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh
index 70542becf3..73c108cb29 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh
@@ -73,8 +73,8 @@ metadata:
 data:
   syncConfig: |
     role-mappings:
-      keystone-role: member
-      groups: []
+      - keystone-role: member
+        groups: []
 EOF
     }