diff --git a/lib/puppet/provider/cinder_rootwrap_config/ini_setting.rb b/lib/puppet/provider/cinder_rootwrap_config/ini_setting.rb
new file mode 100644
index 00000000..ab98ba1c
--- /dev/null
+++ b/lib/puppet/provider/cinder_rootwrap_config/ini_setting.rb
@@ -0,0 +1,10 @@
+Puppet::Type.type(:cinder_rootwrap_config).provide(
+  :ini_setting,
+  :parent => Puppet::Type.type(:openstack_config).provider(:ini_setting)
+) do
+
+  def self.file_path
+    '/etc/cinder/rootwrap.conf'
+  end
+
+end
diff --git a/lib/puppet/type/cinder_rootwrap_config.rb b/lib/puppet/type/cinder_rootwrap_config.rb
new file mode 100644
index 00000000..3ecc0863
--- /dev/null
+++ b/lib/puppet/type/cinder_rootwrap_config.rb
@@ -0,0 +1,29 @@
+Puppet::Type.newtype(:cinder_rootwrap_config) do
+
+  ensurable
+
+  newparam(:name, :namevar => true) do
+    desc 'Section/setting name to manage from /etc/cinder/rootwrap.conf'
+    newvalues(/\S+\/\S+/)
+  end
+
+  newparam(:ensure_absent_val) do
+    desc 'A value that is specified as the value property will behave as if ensure => absent was specified'
+    defaultto('<SERVICE DEFAULT>')
+  end
+
+  newproperty(:value) do
+    desc 'The value of the setting to be defined.'
+    munge do |value|
+      value = value.to_s.strip
+      value.capitalize! if value =~ /^(true|false)$/i
+      value
+    end
+    newvalues(/^[\S ]*$/)
+  end
+
+  autorequire(:anchor) do
+    ['cinder::install::end']
+  end
+
+end
diff --git a/manifests/config.pp b/manifests/config.pp
index 7351fa8a..9129b2d1 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -23,21 +23,27 @@
 #   Defaults to empty hash'{}'
 #
 # [*api_paste_ini_config*]
-#   (optional) Allow configuration of /etc/cinder/api-paste.ini configurations.
+#   (optional) Allow configuration of api-paste.ini configurations.
+#
+# [*cinder_rootwrap_config*]
+#   (optional) Allow configuration of rootwrap.conf configurations.
 #
 #   NOTE: The configuration MUST NOT be already handled by this module
 #   or Puppet catalog compilation will fail with duplicate resources.
 #
 class cinder::config (
-  $cinder_config         = {},
-  $api_paste_ini_config  = {},
+  $cinder_config          = {},
+  $api_paste_ini_config   = {},
+  $cinder_rootwrap_config = {},
 ) {
 
   include cinder::deps
 
   validate_legacy(Hash, 'validate_hash', $cinder_config)
   validate_legacy(Hash, 'validate_hash', $api_paste_ini_config)
+  validate_legacy(Hash, 'validate_hash', $cinder_rootwrap_config)
 
   create_resources('cinder_config', $cinder_config)
   create_resources('cinder_api_paste_ini', $api_paste_ini_config)
+  create_resources('cinder_rootwrap_config', $cinder_rootwrap_config)
 }
diff --git a/manifests/deps.pp b/manifests/deps.pp
index d1614b80..e69bd27f 100644
--- a/manifests/deps.pp
+++ b/manifests/deps.pp
@@ -29,6 +29,11 @@ class cinder::deps {
   -> Cinder_api_paste_ini<||>
   ~> Anchor['cinder::config::end']
 
+  # rootwrap config should occur in the config block also.
+  Anchor['cinder::config::begin']
+  -> Cinder_rootwrap_config<||>
+  ~> Anchor['cinder::config::end']
+
   # all coordination settings should be applied and all packages should be
   # installed before service startup
   Oslo::Coordination<||> -> Anchor['cinder::service::begin']
diff --git a/releasenotes/notes/rootwrap-528e073dd00263cb.yaml b/releasenotes/notes/rootwrap-528e073dd00263cb.yaml
new file mode 100644
index 00000000..ded35f6d
--- /dev/null
+++ b/releasenotes/notes/rootwrap-528e073dd00263cb.yaml
@@ -0,0 +1,9 @@
+---
+features:
+  - |
+    The new ``cinder_rootwrap_config`` resource has been added. This resource
+    can be used to manage contents of ``rootwrap.conf``
+
+  - |
+    The new ``cinder::config::cinder_rootwrap_config`` parameter has been
+    added. This parameter accepts arbitrary configuration of ``rootwrap.conf``.
diff --git a/spec/classes/cinder_config_spec.rb b/spec/classes/cinder_config_spec.rb
index bab45faa..b672a96e 100644
--- a/spec/classes/cinder_config_spec.rb
+++ b/spec/classes/cinder_config_spec.rb
@@ -34,6 +34,18 @@ describe 'cinder::config' do
     end
   end
 
+  shared_examples 'cinder_rootwrap_config' do
+    let :params do
+      { :cinder_rootwrap_config => config_hash }
+    end
+
+    it 'configures arbitrary cinder-rootwrap-config configurations' do
+      is_expected.to contain_cinder_rootwrap_config('DEFAULT/foo').with_value('fooValue')
+      is_expected.to contain_cinder_rootwrap_config('DEFAULT/bar').with_value('barValue')
+      is_expected.to contain_cinder_rootwrap_config('DEFAULT/baz').with_ensure('absent')
+    end
+  end
+
   on_supported_os({
     :supported_os   => OSDefaults.get_supported_os
   }).each do |os,facts|
@@ -44,6 +56,7 @@ describe 'cinder::config' do
 
       it_behaves_like 'cinder_config'
       it_behaves_like 'cinder_api_paste_ini'
+      it_behaves_like 'cinder_rootwrap_config'
     end
   end
 end
diff --git a/spec/unit/provider/cinder_rootwrap_config/ini_setting_spec.rb b/spec/unit/provider/cinder_rootwrap_config/ini_setting_spec.rb
new file mode 100644
index 00000000..d14fb6ff
--- /dev/null
+++ b/spec/unit/provider/cinder_rootwrap_config/ini_setting_spec.rb
@@ -0,0 +1,42 @@
+require 'spec_helper'
+
+provider_class = Puppet::Type.type(:cinder_rootwrap_config).provider(:ini_setting)
+describe provider_class do
+
+  it 'should default to the default setting when no other one is specified' do
+    resource = Puppet::Type::Cinder_rootwrap_config.new(
+      {:name => 'DEFAULT/foo', :value => 'bar'}
+    )
+    provider = provider_class.new(resource)
+    expect(provider.section).to eq('DEFAULT')
+    expect(provider.setting).to eq('foo')
+  end
+
+  it 'should allow setting to be set explicitly' do
+    resource = Puppet::Type::Cinder_rootwrap_config.new(
+      {:name => 'dude/foo', :value => 'bar'}
+    )
+    provider = provider_class.new(resource)
+    expect(provider.section).to eq('dude')
+    expect(provider.setting).to eq('foo')
+  end
+
+  it 'should ensure absent when <SERVICE DEFAULT> is specified as a value' do
+    resource = Puppet::Type::Cinder_rootwrap_config.new(
+      {:name => 'dude/foo', :value => '<SERVICE DEFAULT>'}
+    )
+    provider = provider_class.new(resource)
+    provider.exists?
+    expect(resource[:ensure]).to eq :absent
+  end
+
+  it 'should ensure absent when value matches ensure_absent_val' do
+    resource = Puppet::Type::Cinder_rootwrap_config.new(
+      {:name => 'dude/foo', :value => 'foo', :ensure_absent_val => 'foo' }
+    )
+    provider = provider_class.new(resource)
+    provider.exists?
+    expect(resource[:ensure]).to eq :absent
+  end
+
+end
diff --git a/spec/unit/type/cinder_rootwrap_config_spec.rb b/spec/unit/type/cinder_rootwrap_config_spec.rb
new file mode 100644
index 00000000..fb479c65
--- /dev/null
+++ b/spec/unit/type/cinder_rootwrap_config_spec.rb
@@ -0,0 +1,64 @@
+require 'puppet'
+require 'puppet/type/cinder_rootwrap_config'
+
+describe 'Puppet::Type.type(:cinder_rootwrap_config)' do
+  before :each do
+    @cinder_rootwrap_config = Puppet::Type.type(:cinder_rootwrap_config).new(:name => 'DEFAULT/foo', :value => 'bar')
+  end
+
+ it 'should require a name' do
+    expect {
+      Puppet::Type.type(:cinder_rootwrap_config).new({})
+    }.to raise_error(Puppet::Error, 'Title or name must be provided')
+  end
+
+  it 'should not expect a name with whitespace' do
+    expect {
+      Puppet::Type.type(:cinder_rootwrap_config).new(:name => 'f oo')
+    }.to raise_error(Puppet::Error, /Parameter name failed/)
+  end
+
+  it 'should fail when there is no section' do
+    expect {
+      Puppet::Type.type(:cinder_rootwrap_config).new(:name => 'foo')
+    }.to raise_error(Puppet::Error, /Parameter name failed/)
+  end
+
+  it 'should not require a value when ensure is absent' do
+    Puppet::Type.type(:cinder_rootwrap_config).new(:name => 'DEFAULT/foo', :ensure => :absent)
+  end
+
+  it 'should accept a valid value' do
+    @cinder_rootwrap_config[:value] = 'bar'
+    expect(@cinder_rootwrap_config[:value]).to eq('bar')
+  end
+
+  it 'should not accept a value with whitespace' do
+    @cinder_rootwrap_config[:value] = 'b ar'
+    expect(@cinder_rootwrap_config[:value]).to eq('b ar')
+  end
+
+  it 'should accept valid ensure values' do
+    @cinder_rootwrap_config[:ensure] = :present
+    expect(@cinder_rootwrap_config[:ensure]).to eq(:present)
+    @cinder_rootwrap_config[:ensure] = :absent
+    expect(@cinder_rootwrap_config[:ensure]).to eq(:absent)
+  end
+
+  it 'should not accept invalid ensure values' do
+    expect {
+      @cinder_rootwrap_config[:ensure] = :latest
+    }.to raise_error(Puppet::Error, /Invalid value/)
+  end
+
+  it 'should autorequire the package that install the file' do
+    catalog = Puppet::Resource::Catalog.new
+    anchor = Puppet::Type.type(:anchor).new(:name => 'cinder::install::end')
+    catalog.add_resource anchor, @cinder_rootwrap_config
+    dependency = @cinder_rootwrap_config.autorequire
+    expect(dependency.size).to eq(1)
+    expect(dependency[0].target).to eq(@cinder_rootwrap_config)
+    expect(dependency[0].source).to eq(anchor)
+  end
+
+end