diff --git a/manifests/proxy/keymaster.pp b/manifests/proxy/keymaster.pp
new file mode 100644
index 00000000..c20d7726
--- /dev/null
+++ b/manifests/proxy/keymaster.pp
@@ -0,0 +1,24 @@
+#
+# Configure Swift Keymaster middleware.
+#
+# == Examples
+#
+#  include swift::proxy::keymaster
+#
+# == Parameters
+#
+# [*encryption_root_secret*]
+# Encryption root secret value.
+#
+class swift::proxy::keymaster (
+  $encryption_root_secret,
+) {
+
+  include swift::deps
+
+  swift_proxy_config {
+    'filter:keymaster/use':                    value => 'egg:swift#keymaster';
+    'filter:keymaster/encryption_root_secret': value => $encryption_root_secret, secret => true;
+  }
+
+}
diff --git a/releasenotes/notes/swift-proxy-keymaster-32b86ec03556762d.yaml b/releasenotes/notes/swift-proxy-keymaster-32b86ec03556762d.yaml
new file mode 100644
index 00000000..ae6101f2
--- /dev/null
+++ b/releasenotes/notes/swift-proxy-keymaster-32b86ec03556762d.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    A new class ``swift::proxy::keymaster`` has been added. This supports the
+    configuration of swift-proxy keymaster middleware.
diff --git a/spec/classes/swift_proxy_keymaster_spec.rb b/spec/classes/swift_proxy_keymaster_spec.rb
new file mode 100644
index 00000000..e98cfd33
--- /dev/null
+++ b/spec/classes/swift_proxy_keymaster_spec.rb
@@ -0,0 +1,28 @@
+require 'spec_helper'
+
+describe 'swift::proxy::keymaster' do
+  shared_examples 'swift::proxy::keymaster' do
+    let :params do
+      {
+        :encryption_root_secret => 'secret',
+      }
+    end
+
+    context "when using default parameters" do
+      it { is_expected.to contain_swift_proxy_config('filter:keymaster/use').with_value('egg:swift#keymaster') }
+      it { is_expected.to contain_swift_proxy_config('filter:keymaster/encryption_root_secret').with_value('secret').with_secret(true) }
+    end
+  end
+
+  on_supported_os({
+    :supported_os => OSDefaults.get_supported_os
+  }).each do |os,facts|
+    context "on #{os}" do
+      let (:facts) do
+        facts.merge(OSDefaults.get_facts())
+      end
+
+      it_configures 'swift::proxy::keymaster'
+    end
+  end
+end