diff --git a/tripleoclient/tests/test_utils.py b/tripleoclient/tests/test_utils.py
index a65f11b61..4b3ac3c63 100644
--- a/tripleoclient/tests/test_utils.py
+++ b/tripleoclient/tests/test_utils.py
@@ -524,6 +524,13 @@ class TestCreateCephxKey(TestCase):
         self.assertEqual(len(key), 40)
 
 
+class TestCreateKeystoneCredential(TestCase):
+
+    def test_create_keystone_credential(self):
+        key = utils.create_keystone_credential()
+        self.assertEqual(len(key), 44)
+
+
 class TestNodeGetCapabilities(TestCase):
     def test_with_capabilities(self):
         node = mock.Mock(properties={'capabilities': 'x:y,foo:bar'})
diff --git a/tripleoclient/tests/v1/overcloud_deploy/test_overcloud_deploy.py b/tripleoclient/tests/v1/overcloud_deploy/test_overcloud_deploy.py
index e6873f435..365f2cc70 100644
--- a/tripleoclient/tests/v1/overcloud_deploy/test_overcloud_deploy.py
+++ b/tripleoclient/tests/v1/overcloud_deploy/test_overcloud_deploy.py
@@ -91,8 +91,10 @@ class TestDeployOvercloud(fakes.TestDeployOvercloud):
     @mock.patch('tripleoclient.utils.check_hypervisor_stats',
                 autospec=True)
     @mock.patch('uuid.uuid1', autospec=True)
+    @mock.patch('tripleoclient.utils.create_keystone_credential',
+                autospec=True)
     @mock.patch('time.time', autospec=True)
-    def test_tht_scale(self, mock_time, mock_uuid1,
+    def test_tht_scale(self, mock_time, mock_creds, mock_uuid1,
                        mock_check_hypervisor_stats, mock_get_key,
                        mock_create_env, generate_certs_mock,
                        mock_get_templte_contents, mock_process_multiple_env,
@@ -114,6 +116,7 @@ class TestDeployOvercloud(fakes.TestDeployOvercloud):
         ]
 
         mock_uuid1.return_value = "uuid"
+        mock_creds.return_value = "key"
         mock_time.return_value = 123456789
 
         mock_generate_overcloud_passwords.return_value = self._get_passwords()
@@ -173,6 +176,8 @@ class TestDeployOvercloud(fakes.TestDeployOvercloud):
             'HypervisorNeutronPhysicalBridge': 'br-ex',
             'HypervisorNeutronPublicInterface': 'nic1',
             'IronicPassword': 'password',
+            'KeystoneCredential0': 'key',
+            'KeystoneCredential1': 'key',
             'ManilaPassword': 'password',
             'MistralPassword': 'password',
             'MysqlClustercheckPassword': 'password',
@@ -259,8 +264,10 @@ class TestDeployOvercloud(fakes.TestDeployOvercloud):
     @mock.patch('tripleoclient.utils.check_hypervisor_stats',
                 autospec=True)
     @mock.patch('uuid.uuid1', autospec=True)
+    @mock.patch('tripleoclient.utils.create_keystone_credential',
+                autospec=True)
     @mock.patch('time.time', autospec=True)
-    def test_tht_deploy(self, mock_time, mock_uuid1,
+    def test_tht_deploy(self, mock_time, mock_creds, mock_uuid1,
                         mock_check_hypervisor_stats, mock_get_key,
                         mock_create_env, generate_certs_mock,
                         mock_get_templte_contents, mock_process_multiple_env,
@@ -282,6 +289,7 @@ class TestDeployOvercloud(fakes.TestDeployOvercloud):
         ]
 
         mock_uuid1.return_value = "uuid"
+        mock_creds.return_value = "key"
         mock_time.return_value = 123456789
 
         mock_generate_overcloud_passwords.return_value = self._get_passwords()
@@ -344,6 +352,8 @@ class TestDeployOvercloud(fakes.TestDeployOvercloud):
             'HypervisorNeutronPhysicalBridge': 'br-ex',
             'HypervisorNeutronPublicInterface': 'nic1',
             'IronicPassword': 'password',
+            'KeystoneCredential0': 'key',
+            'KeystoneCredential1': 'key',
             'ManilaPassword': 'password',
             'MistralPassword': 'password',
             'MysqlClustercheckPassword': 'password',
@@ -1196,8 +1206,10 @@ class TestDeployOvercloud(fakes.TestDeployOvercloud):
     @mock.patch('tripleoclient.utils.check_hypervisor_stats',
                 autospec=True)
     @mock.patch('uuid.uuid1', autospec=True)
+    @mock.patch('tripleoclient.utils.create_keystone_credential',
+                autospec=True)
     @mock.patch('time.time', autospec=True)
-    def test_tht_deploy_with_ntp(self, mock_time, mock_uuid1,
+    def test_tht_deploy_with_ntp(self, mock_time, mock_creds, mock_uuid1,
                                  mock_check_hypervisor_stats,
                                  mock_get_key, mock_create_env,
                                  generate_certs_mock,
@@ -1227,6 +1239,7 @@ class TestDeployOvercloud(fakes.TestDeployOvercloud):
         ]
 
         mock_uuid1.return_value = "uuid"
+        mock_creds.return_value = "key"
         mock_time.return_value = 123456789
 
         mock_generate_overcloud_passwords.return_value = self._get_passwords()
@@ -1294,6 +1307,8 @@ class TestDeployOvercloud(fakes.TestDeployOvercloud):
             'HypervisorNeutronPhysicalBridge': 'br-ex',
             'HypervisorNeutronPublicInterface': 'nic1',
             'IronicPassword': 'password',
+            'KeystoneCredential0': 'key',
+            'KeystoneCredential1': 'key',
             'ManilaPassword': 'password',
             'MistralPassword': 'password',
             'MysqlClustercheckPassword': 'password',
diff --git a/tripleoclient/utils.py b/tripleoclient/utils.py
index ab6484c37..b40e60903 100644
--- a/tripleoclient/utils.py
+++ b/tripleoclient/utils.py
@@ -552,6 +552,10 @@ def create_cephx_key():
     return base64.b64encode(header + key)
 
 
+def create_keystone_credential():
+    return base64.urlsafe_b64encode(os.urandom(32))
+
+
 def run_shell(cmd):
     return subprocess.call([cmd], shell=True)
 
diff --git a/tripleoclient/v1/overcloud_deploy.py b/tripleoclient/v1/overcloud_deploy.py
index 0f71759a3..84a792ab3 100644
--- a/tripleoclient/v1/overcloud_deploy.py
+++ b/tripleoclient/v1/overcloud_deploy.py
@@ -191,7 +191,9 @@ class DeployOvercloud(command.Command):
 
         if stack_is_new:
             parameters.update({
-                'CephClusterFSID': six.text_type(uuid.uuid1())})
+                'CephClusterFSID': six.text_type(uuid.uuid1()),
+                'KeystoneCredential0': utils.create_keystone_credential(),
+                'KeystoneCredential1': utils.create_keystone_credential()})
 
         return parameters