diff --git a/doc/source/roles/role-tripleo_network_config.rst b/doc/source/roles/role-tripleo_network_config.rst
new file mode 100644
index 000000000..1aceebca3
--- /dev/null
+++ b/doc/source/roles/role-tripleo_network_config.rst
@@ -0,0 +1,6 @@
+=============================
+Role - tripleo_network_config
+=============================
+
+.. ansibleautoplugin::
+  :role: tripleo_ansible/roles/tripleo_network_config
diff --git a/tripleo_ansible/roles/tripleo_network_config/defaults/main.yml b/tripleo_ansible/roles/tripleo_network_config/defaults/main.yml
new file mode 100644
index 000000000..af024bdf7
--- /dev/null
+++ b/tripleo_ansible/roles/tripleo_network_config/defaults/main.yml
@@ -0,0 +1,29 @@
+---
+# Copyright 2020 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+# All variables intended for modification should be placed in this file.
+
+# All variables within this role should have a prefix of "tripleo_network_config"
+tripleo_network_config_action: CREATE
+tripleo_network_config_async_poll: 3
+tripleo_network_config_async_timeout: 300
+tripleo_network_config_bridge_name: br-ex
+tripleo_network_config_debug: "{{ (ansible_verbosity | int) >= 2 | bool }}"
+tripleo_network_config_hide_sensitive_logs: true
+tripleo_network_config_interface_name: nic1
+tripleo_network_config_manage_service: true
+tripleo_network_config_network_deployment_actions: []
diff --git a/tripleo_ansible/roles/tripleo_network_config/meta/main.yml b/tripleo_ansible/roles/tripleo_network_config/meta/main.yml
new file mode 100644
index 000000000..dd249b65b
--- /dev/null
+++ b/tripleo_ansible/roles/tripleo_network_config/meta/main.yml
@@ -0,0 +1,42 @@
+---
+# Copyright 2020 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+galaxy_info:
+  author: OpenStack
+  description: TripleO OpenStack Role -- tripleo_network_config
+  company: Red Hat
+  license: Apache-2.0
+  min_ansible_version: 2.7
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  platforms:
+    - name: CentOS
+      versions:
+        - 7
+        - 8
+
+  galaxy_tags:
+    - tripleo
+
+
+# List your role dependencies here, one per line. Be sure to remove the '[]' above,
+# if you add dependencies to this list.
+dependencies: []
diff --git a/tripleo_ansible/roles/tripleo_network_config/molecule/default/Dockerfile b/tripleo_ansible/roles/tripleo_network_config/molecule/default/Dockerfile
new file mode 100644
index 000000000..8fc73a838
--- /dev/null
+++ b/tripleo_ansible/roles/tripleo_network_config/molecule/default/Dockerfile
@@ -0,0 +1,37 @@
+# Molecule managed
+# Copyright 2020 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
+    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install sudo python*-devel python*-dnf bash {{ item.pkg_extras | default('') }} && dnf clean all; \
+    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl python-setuptools bash {{ item.pkg_extras | default('') }} && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml {{ item.pkg_extras | default('') }} && zypper clean -a; \
+    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates {{ item.pkg_extras | default('') }}; \
+    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates {{ item.pkg_extras | default('') }} && xbps-remove -O; fi
+
+{% for pkg in item.easy_install | default([]) %}
+# install pip for centos where there is no python-pip rpm in default repos
+RUN easy_install {{ pkg }}
+{% endfor %}
+
+
+CMD ["sh", "-c", "while true; do sleep 10000; done"]
diff --git a/tripleo_ansible/roles/tripleo_network_config/molecule/default/converge.yml b/tripleo_ansible/roles/tripleo_network_config/molecule/default/converge.yml
new file mode 100644
index 000000000..69c7fd733
--- /dev/null
+++ b/tripleo_ansible/roles/tripleo_network_config/molecule/default/converge.yml
@@ -0,0 +1,59 @@
+---
+# Copyright 2020 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+- name: Converge
+  hosts: all
+  tasks:
+    - name: Success network script
+      block:
+        - name: Temp network script file
+          set_fact:
+            dummy_network_script: /var/tmp/dummy_network_script.sh
+
+        - name: Write out empty dummy network script
+          delegate_to: localhost
+          copy:
+            dest: "{{ dummy_network_script }}"
+            content: |
+              #/bin/bash
+              echo "stderr" >&2
+              exit 0
+            mode: '0755'
+
+        - import_role:
+            name: "tripleo_network_config"
+          vars:
+            tripleo_network_config_script_path: "{{ dummy_network_script }}"
+            # skip service management in a container
+            tripleo_network_config_manage_service: false
+        - name: Check returncode file
+          slurp:
+            path: /var/lib/tripleo-config/os-net-config.returncode
+          register: rc_file
+        - name: returncode file value is
+          debug:
+            msg: "{{ rc_file.content | b64decode }}"
+        - assert:
+            that:
+              - rc_file.content | b64decode | int == 0
+      always:
+        - name: Remove dummy script
+          become: true
+          file:
+            path: "{{ dummy_network_script }}"
+            state: absent
+          ignore_errors: true
diff --git a/tripleo_ansible/roles/tripleo_network_config/molecule/default/molecule.yml b/tripleo_ansible/roles/tripleo_network_config/molecule/default/molecule.yml
new file mode 100644
index 000000000..7e2b3b9e1
--- /dev/null
+++ b/tripleo_ansible/roles/tripleo_network_config/molecule/default/molecule.yml
@@ -0,0 +1,50 @@
+---
+driver:
+  name: podman
+
+log: true
+
+platforms:
+  - name: centos7
+    hostname: centos7
+    image: centos:7
+    dockerfile: Dockerfile
+    pkg_extras: python-setuptools
+    volumes:
+      - /etc/ci/mirror_info.sh:/etc/ci/mirror_info.sh:ro
+    easy_install:
+      - pip
+    environment: &env
+      http_proxy: "{{ lookup('env', 'http_proxy') }}"
+      https_proxy: "{{ lookup('env', 'https_proxy') }}"
+    ulimits: &ulimit
+      - host
+
+  - name: centos8
+    hostname: centos8
+    image: centos:8
+    dockerfile: Dockerfile
+    pkg_extras: python*-setuptools
+    volumes:
+      - /etc/ci/mirror_info.sh:/etc/ci/mirror_info.sh:ro
+    environment:
+      <<: *env
+    ulimits: *ulimit
+
+provisioner:
+  name: ansible
+  log: true
+  env:
+    ANSIBLE_STDOUT_CALLBACK: yaml
+
+scenario:
+  test_sequence:
+    - destroy
+    - create
+    - prepare
+    - converge
+    - check
+    - destroy
+
+verifier:
+  name: testinfra
diff --git a/tripleo_ansible/roles/tripleo_network_config/molecule/default/prepare.yml b/tripleo_ansible/roles/tripleo_network_config/molecule/default/prepare.yml
new file mode 100644
index 000000000..4f6b8383d
--- /dev/null
+++ b/tripleo_ansible/roles/tripleo_network_config/molecule/default/prepare.yml
@@ -0,0 +1,28 @@
+---
+# Copyright 2020 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+- name: Prepare
+  hosts: all
+  tasks:
+    - import_role:
+        name: test_deps
+    - name: Ensure legacy scripts installed
+      package:
+        name: network-scripts
+        state: present
+      when:
+        - ansible_distribution_major_version|int == 8
diff --git a/tripleo_ansible/roles/tripleo_network_config/tasks/main.yml b/tripleo_ansible/roles/tripleo_network_config/tasks/main.yml
new file mode 100644
index 000000000..da0400042
--- /dev/null
+++ b/tripleo_ansible/roles/tripleo_network_config/tasks/main.yml
@@ -0,0 +1,110 @@
+---
+# Copyright 2020 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- name: Ensure /var/lib/tripleo-config directory exists
+  become: true
+  file:
+    path: /var/lib/tripleo-config
+    state: directory
+    setype: container_file_t
+    selevel: s0
+
+- name: Check for previous run of NetworkConfig
+  become: true
+  stat:
+    path: /var/lib/tripleo-config/os-net-config.returncode
+  register: os_net_config_returncode_stat
+
+- name: Check result of previous run of NetworkConfig
+  become: true
+  slurp:
+    path: /var/lib/tripleo-config/os-net-config.returncode
+  when: os_net_config_returncode_stat.stat.exists
+  register: os_net_config_returncode_slurp
+
+- name: NetworkConfig
+  become: true
+  block:
+    - name: Create /var/lib/tripleo-config/scripts directory
+      file:
+        path: /var/lib/tripleo-config/scripts
+        state: directory
+        setype: container_file_t
+        selevel: s0
+        recurse: true
+
+    - name: Render NetworkConfig script
+      template:
+        dest: /var/lib/tripleo-config/scripts/run_os_net_config.sh
+        src: "{{ tripleo_network_config_script_path }}"
+        mode: 0755
+      when: not ansible_check_mode|bool
+
+    - name: Run NetworkConfig script
+      shell: /var/lib/tripleo-config/scripts/run_os_net_config.sh
+      async: "{{ tripleo_network_config_async_timeout }}"
+      poll: "{{ tripleo_network_config_async_poll }}"
+      environment:
+        bridge_name: "{{ tripleo_network_config_bridge_name }}"
+        interface_name: "{{ tripleo_network_config_interface_name }}"
+      register: NetworkConfig_result
+      when:
+        - not ansible_check_mode|bool
+      failed_when: NetworkConfig_result.rc is not defined
+
+    - name: Write rc of NetworkConfig script
+      copy:
+        content: "{{ NetworkConfig_result.rc }}"
+        dest: /var/lib/tripleo-config/os-net-config.returncode
+      when:
+        - NetworkConfig_result.rc is defined
+
+    - name: NetworkConfig stdout
+      debug:
+        var: NetworkConfig_result.stderr_lines
+      failed_when: NetworkConfig_result.rc != 0
+      when:
+        - NetworkConfig_result.rc is defined
+
+    # os-net-config currently relies on the legacy network
+    # so we need to ensure it's enabled on boot. This should
+    # be removed when we switch to NetworkManager or replaced
+    # with something that ensures NetworkManager is enabled.
+    - name: Ensure network service is enabled
+      systemd:
+        name: network
+        enabled: true
+        state: started
+      when:
+        - tripleo_network_config_manage_service
+        - not ansible_check_mode|bool
+
+  # The conditions here are when we want to apply the
+  # NetworkConfig. They are:
+  # - If the stack_action is CREATE
+  # - Or UPDATE is in the network_deployment_actions
+  # - Or the previous run of NetworkConfig failed.
+  # - Or it has never run
+  # This will match the prior behavior of when a Heat
+  # SoftwareDeployment was used.
+  # It also ensures the script does exist as a sine qua non
+  # condition
+  when:
+    - (tripleo_network_config_action == "CREATE") or
+      ("UPDATE" in tripleo_network_config_network_deployment_actions) or
+      (os_net_config_returncode_stat.stat.exists and
+      ((os_net_config_returncode_slurp.content | b64decode) != 0)) or
+       (not os_net_config_returncode_stat.stat.exists)
diff --git a/zuul.d/molecule.yaml b/zuul.d/molecule.yaml
index dd9753e43..1b0780f3e 100644
--- a/zuul.d/molecule.yaml
+++ b/zuul.d/molecule.yaml
@@ -30,6 +30,7 @@
       - tripleo-ansible-centos-8-molecule-tripleo_kernel
       - tripleo-ansible-centos-8-molecule-tripleo_keystone_resources
       - tripleo-ansible-centos-8-molecule-tripleo_module_load
+      - tripleo-ansible-centos-8-molecule-tripleo_network_config
       - tripleo-ansible-centos-8-molecule-tripleo_nova_image_cache
       - tripleo-ansible-centos-8-molecule-tripleo_nvdimm
       - tripleo-ansible-centos-8-molecule-tripleo_ovs_dpdk
@@ -78,6 +79,7 @@
       - tripleo-ansible-centos-8-molecule-tripleo_kernel
       - tripleo-ansible-centos-8-molecule-tripleo_keystone_resources
       - tripleo-ansible-centos-8-molecule-tripleo_module_load
+      - tripleo-ansible-centos-8-molecule-tripleo_network_config
       - tripleo-ansible-centos-8-molecule-tripleo_nova_image_cache
       - tripleo-ansible-centos-8-molecule-tripleo_nvdimm
       - tripleo-ansible-centos-8-molecule-tripleo_ovs_dpdk
@@ -106,6 +108,7 @@
       - tripleo-ansible-centos-8-molecule-login_defs
       - tripleo-ansible-centos-8-molecule-test_deps
       - tripleo-ansible-centos-8-molecule-test_package_action
+      - tripleo-ansible-centos-8-molecule-tripleo-modules
       - tripleo-ansible-centos-8-molecule-tripleo_bootstrap
       - tripleo-ansible-centos-8-molecule-tripleo_cellv2
       - tripleo-ansible-centos-8-molecule-tripleo_ceph_run_ansible
@@ -125,7 +128,7 @@
       - tripleo-ansible-centos-8-molecule-tripleo_kernel
       - tripleo-ansible-centos-8-molecule-tripleo_keystone_resources
       - tripleo-ansible-centos-8-molecule-tripleo_module_load
-      - tripleo-ansible-centos-8-molecule-tripleo-modules
+      - tripleo-ansible-centos-8-molecule-tripleo_network_config
       - tripleo-ansible-centos-8-molecule-tripleo_nova_image_cache
       - tripleo-ansible-centos-8-molecule-tripleo_nvdimm
       - tripleo-ansible-centos-8-molecule-tripleo_ovs_dpdk
@@ -341,6 +344,13 @@
     parent: tripleo-ansible-centos-8-base
     vars:
       tripleo_role_name: tripleo_module_load
+- job:
+    files:
+    - ^tripleo_ansible/roles/tripleo_network_config/.*
+    name: tripleo-ansible-centos-8-molecule-tripleo_network_config
+    parent: tripleo-ansible-centos-8-base
+    vars:
+      tripleo_role_name: tripleo_network_config
 - job:
     files:
     - ^tripleo_ansible/roles/tripleo_nova_image_cache/.*