diff --git a/tripleo_ansible/roles/tripleo_run_cephadm/tasks/enable_ceph_admin_user.yml b/tripleo_ansible/roles/tripleo_run_cephadm/tasks/enable_ceph_admin_user.yml
index 905de3ce9..4ad5f9fc1 100644
--- a/tripleo_ansible/roles/tripleo_run_cephadm/tasks/enable_ceph_admin_user.yml
+++ b/tripleo_ansible/roles/tripleo_run_cephadm/tasks/enable_ceph_admin_user.yml
@@ -24,9 +24,20 @@
       - '{{ inventory_file }}'
       - '{% if ansible_python_interpreter is defined %}-e ansible_python_interpreter={{ ansible_python_interpreter }}{% endif %}'
       - '/usr/share/ansible/tripleo-playbooks/ceph-admin-user-playbook.yml'
-      - '-e @{{ playbook_dir}}/cephadm/ceph-admin.yml'
+      - '-e tripleo_admin_user=ceph-admin'
+    cephadm_public_private_ssh_list:
+      - '-e distribute_private_key=true'
+      - '--limit undercloud,ceph_mon,ceph_mgr'
+    cephadm_public_ssh_list:
+      - '-e distribute_private_key=false'
+      - '--limit undercloud,ceph_osd,ceph_rgw,ceph_mds,ceph_nfs,ceph_rbdmirror'
 
-- name: Run ceph-admin-user-playbook
-  shell: "{{ cephadm_ssh_list|join(' ') }}"
+- name: Run ceph-admin-user-playbook for public and private keys
+  shell: "{{ (cephadm_ssh_list + cephadm_public_private_ssh_list)|join(' ') }}"
+  tags:
+    - run_cephadm
+
+- name: Run ceph-admin-user-playbook for public keys
+  shell: "{{ (cephadm_ssh_list + cephadm_public_ssh_list)|join(' ') }}"
   tags:
     - run_cephadm
diff --git a/tripleo_ansible/roles/tripleo_run_cephadm/tasks/prepare.yml b/tripleo_ansible/roles/tripleo_run_cephadm/tasks/prepare.yml
index a6fa0e76d..d92510f07 100644
--- a/tripleo_ansible/roles/tripleo_run_cephadm/tasks/prepare.yml
+++ b/tripleo_ansible/roles/tripleo_run_cephadm/tasks/prepare.yml
@@ -32,11 +32,6 @@
   tags:
     - run_cephadm
 
-- name: generate ceph-admin.yml extra vars for user creation
-  copy:
-    dest: "{{ playbook_dir }}/cephadm/ceph-admin.yml"
-    content: "{{ ceph_admin_extra_vars | to_nice_yaml }}"
-
 - name: get the list of enabled services on the overcloud
   set_fact:
     tripleo_enabled_services: "{{ enabled_services | default([]) }}"