diff --git a/facts.d/os_immutable.txt b/facts.d/os_immutable.txt
new file mode 100644
index 00000000..ad34a017
--- /dev/null
+++ b/facts.d/os_immutable.txt
@@ -0,0 +1 @@
+os_immutable=<_IMMUTABLE_>
diff --git a/lib/puppet/provider/openstack_config/ini_setting.rb b/lib/puppet/provider/openstack_config/ini_setting.rb
index c96546dd..da925a44 100644
--- a/lib/puppet/provider/openstack_config/ini_setting.rb
+++ b/lib/puppet/provider/openstack_config/ini_setting.rb
@@ -1,11 +1,20 @@
+require 'facter'
+
 Puppet::Type.type(:openstack_config).provide(
   :ini_setting,
   :parent => Puppet::Type.type(:ini_setting).provider(:ruby)
 ) do
 
   def exists?
+    immutable_string = Facter.value(:os_immutable) || '<_IMMUTABLE_>'
     if resource[:value] == ensure_absent_val
       resource[:ensure] = :absent
+    elsif resource[:value] == immutable_string or resource[:value] == [immutable_string]
+      resource[:value] = value
+      # when the value is undefined, we keep it that way.
+      if value.nil? or (value.kind_of?(Array) and value[0].nil?)
+        resource[:ensure] = :absent
+      end
     end
     super
   end
diff --git a/lib/puppet/provider/openstack_config/ruby.rb b/lib/puppet/provider/openstack_config/ruby.rb
index 6decd00c..d6677cf8 100644
--- a/lib/puppet/provider/openstack_config/ruby.rb
+++ b/lib/puppet/provider/openstack_config/ruby.rb
@@ -1,3 +1,4 @@
+require 'facter'
 
 require File.expand_path('../../../util/openstackconfig', __FILE__)
 
@@ -33,8 +34,15 @@ Puppet::Type.type(:openstack_config).provide(:ruby) do
   end
 
   def exists?
+    immutable_string = Facter.value(:os_immutable) || '<_IMMUTABLE_>'
     if resource[:value] == ensure_absent_val
       resource[:ensure] = :absent
+    elsif resource[:value] == immutable_string or resource[:value] == [immutable_string]
+      resource[:value] = value
+      # when the value is undefined, we keep it that way.
+      if value.nil? or (value.kind_of?(Array) and value[0].nil?)
+        resource[:ensure] = :absent
+      end
     end
     !config.get_value(section, setting).nil?
   end
diff --git a/releasenotes/notes/support_for_setting_a_value_immutable-27e52b14f61ff6c3.yaml b/releasenotes/notes/support_for_setting_a_value_immutable-27e52b14f61ff6c3.yaml
new file mode 100644
index 00000000..084b54d5
--- /dev/null
+++ b/releasenotes/notes/support_for_setting_a_value_immutable-27e52b14f61ff6c3.yaml
@@ -0,0 +1,8 @@
+---
+features:
+  - |
+    This add `os_immutable` fact that can be used in the puppet
+    openstack module as value for all types that inherit
+    openstack_config.  Using ::os_immutable as a value of the
+    configuration parameter will tell puppet to not change the current
+    value, whatever it is.
diff --git a/spec/unit/provider/openstack_config/ini_setting_spec.rb b/spec/unit/provider/openstack_config/ini_setting_spec.rb
index 33a9645e..8b3d4490 100644
--- a/spec/unit/provider/openstack_config/ini_setting_spec.rb
+++ b/spec/unit/provider/openstack_config/ini_setting_spec.rb
@@ -37,6 +37,14 @@ describe provider_class do
     }
   end
 
+  let(:immutable_properties) do
+    {
+      :name              => 'DEFAULT/foo',
+      :value             => '<_IMMUTABLE_>',
+      :ensure            => :present,
+    }
+  end
+
   let(:type) do
     Puppet::Type.newtype(:test_config) do
       newparam(:name, :namevar => true)
@@ -56,6 +64,15 @@ describe provider_class do
     end
   end
 
+  let(:immutable_type) do
+    Puppet::Type.newtype(:test_config) do
+      newparam(:name, :namevar => true)
+      newparam(:ensure)
+      newproperty(:value)
+      newparam(:ensure_absent_val)
+    end
+  end
+
   let(:resource) do
     resource = type.new(properties)
     resource
@@ -66,6 +83,11 @@ describe provider_class do
     resource
   end
 
+  let(:immutable_resource) do
+    resource = immutable_type.new(immutable_properties)
+    resource
+  end
+
   context '#exists?' do
     it 'ensure to present' do
       child_conf = Class.new(provider_class) do
@@ -108,6 +130,42 @@ describe provider_class do
       expect(transform_resource[:value]).to eq 'BAR'
     end
 
+  context 'immutable' do
+    # could not set fact using the classic let(:facts) idiom.
+    it 'ensure to no change when value set' do
+      child_conf = Class.new(provider_class) do
+          def self.file_path
+            '/some/file/path'
+          end
+          # current value
+          def value
+            'foo'
+          end
+      end
+      provider = child_conf.new(immutable_resource)
+      provider.exists?
+      expect(immutable_resource[:value]).to eq 'foo'
+      expect(immutable_resource[:ensure]).to eq :present
+    end
+
+    it 'ensure to no change when value unset' do
+      child_conf = Class.new(provider_class) do
+          def self.file_path
+            '/some/file/path'
+          end
+          # current value
+          def value
+            [nil]
+          end
+      end
+      provider = child_conf.new(immutable_resource)
+
+      provider.exists?
+      expect(immutable_resource[:value]).to eq nil
+      expect(immutable_resource[:ensure]).to eq :absent
+    end
+  end
+
   end
 
 end