diff --git a/.ansible-lint b/.ansible-lint
new file mode 100644
index 0000000000..4826ff3ccc
--- /dev/null
+++ b/.ansible-lint
@@ -0,0 +1,24 @@
+kinds:
+  - j2: "**/*.j2.yaml"
+  - playbook: "**/common/*.yml"
+  - yaml: "roles/*.yaml"
+mock_modules:
+  - tripleo_all_nodes_data
+skip_list:
+  # TODO(zbr): Address in follow-ups
+  - role-name
+  - unnamed-task
+  # yaml ones:
+  - braces
+  - colons
+  - commas
+  - comments
+  - comments-indentation
+  - empty-lines
+  - indentation
+  - line-length
+  - new-line-at-end-of-file
+  - trailing-spaces
+  - truthy
+  - brackets
+  - hyphens
diff --git a/ci/environments/scenario010-multinode-containers.yaml b/ci/environments/scenario010-multinode-containers.yaml
index 719486ea34..90de12f906 100644
--- a/ci/environments/scenario010-multinode-containers.yaml
+++ b/ci/environments/scenario010-multinode-containers.yaml
@@ -1,26 +1,24 @@
 resource_registry:
+  OS::TripleO::Services::CephClient: ../../deployment/ceph-ansible/ceph-client.yaml
   OS::TripleO::Services::CephMgr: ../../deployment/ceph-ansible/ceph-mgr.yaml
   OS::TripleO::Services::CephMon: ../../deployment/ceph-ansible/ceph-mon.yaml
   OS::TripleO::Services::CephOSD: ../../deployment/ceph-ansible/ceph-osd.yaml
-  OS::TripleO::Services::CephClient: ../../deployment/ceph-ansible/ceph-client.yaml
-  OS::TripleO::Services::HAproxy: ../../deployment/haproxy/haproxy-pacemaker-puppet.yaml
-  OS::TripleO::Services::Pacemaker: ../../deployment/pacemaker/pacemaker-baremetal-puppet.yaml
-  OS::TripleO::Services::PacemakerRemote: ../../deployment/pacemaker/pacemaker-remote-baremetal-puppet.yaml
-  OS::TripleO::Services::Clustercheck: ../../deployment/pacemaker/clustercheck-container-puppet.yaml
-  OS::TripleO::Services::MySQL: ../../deployment/database/mysql-pacemaker-puppet.yaml
-  OS::TripleO::Services::OctaviaApi: ../../deployment/octavia/octavia-api-container-puppet.yaml
-  OS::TripleO::Services::OctaviaHousekeeping: ../../deployment/octavia/octavia-housekeeping-container-puppet.yaml
-  OS::TripleO::Services::OctaviaHealthManager: ../../deployment/octavia/octavia-health-manager-container-puppet.yaml
-  OS::TripleO::Services::OctaviaWorker: ../../deployment/octavia/octavia-worker-container-puppet.yaml
-  OS::TripleO::Services::OctaviaDeploymentConfig: ../../deployment/octavia/octavia-deployment-config.yaml
   OS::TripleO::Services::CinderApi: OS::Heat::None
   OS::TripleO::Services::CinderBackup: OS::Heat::None
   OS::TripleO::Services::CinderScheduler: OS::Heat::None
   OS::TripleO::Services::CinderVolume: OS::Heat::None
-  OS::TripleO::Services::SwiftProxy: OS::Heat::None
+  OS::TripleO::Services::Clustercheck: ../../deployment/pacemaker/clustercheck-container-puppet.yaml
+  OS::TripleO::Services::HAproxy: ../../deployment/haproxy/haproxy-pacemaker-puppet.yaml
+  OS::TripleO::Services::MySQL: ../../deployment/database/mysql-pacemaker-puppet.yaml
+  OS::TripleO::Services::OctaviaApi: ../../deployment/octavia/octavia-api-container-puppet.yaml
+  OS::TripleO::Services::OctaviaDeploymentConfig: ../../deployment/octavia/octavia-deployment-config.yaml
+  OS::TripleO::Services::OctaviaHealthManager: ../../deployment/octavia/octavia-health-manager-container-puppet.yaml
+  OS::TripleO::Services::OctaviaHousekeeping: ../../deployment/octavia/octavia-housekeeping-container-puppet.yaml
+  OS::TripleO::Services::OctaviaWorker: ../../deployment/octavia/octavia-worker-container-puppet.yaml
+  OS::TripleO::Services::Pacemaker: ../../deployment/pacemaker/pacemaker-baremetal-puppet.yaml
+  OS::TripleO::Services::PacemakerRemote: ../../deployment/pacemaker/pacemaker-remote-baremetal-puppet.yaml
   OS::TripleO::Services::SwiftDispersion: OS::Heat::None
-  OS::TripleO::Services::SwiftRingBuilder: OS::Heat::None
-  OS::TripleO::Services::SwiftStorage: OS::Heat::None
+  OS::TripleO::Services::SwiftProxy: OS::Heat::None
   OS::TripleO::Services::SwiftRingBuilder: OS::Heat::None
   OS::TripleO::Services::SwiftStorage: OS::Heat::None
 
diff --git a/ci/environments/scenario010-standalone.yaml b/ci/environments/scenario010-standalone.yaml
index bd13545161..8db8b21d86 100644
--- a/ci/environments/scenario010-standalone.yaml
+++ b/ci/environments/scenario010-standalone.yaml
@@ -1,26 +1,24 @@
 resource_registry:
+  OS::TripleO::Services::CephClient: ../../deployment/ceph-ansible/ceph-client.yaml
   OS::TripleO::Services::CephMgr: ../../deployment/ceph-ansible/ceph-mgr.yaml
   OS::TripleO::Services::CephMon: ../../deployment/ceph-ansible/ceph-mon.yaml
   OS::TripleO::Services::CephOSD: ../../deployment/ceph-ansible/ceph-osd.yaml
-  OS::TripleO::Services::CephClient: ../../deployment/ceph-ansible/ceph-client.yaml
-  OS::TripleO::Services::OsloMessagingRpc: ../../deployment/rabbitmq/rabbitmq-messaging-rpc-pacemaker-puppet.yaml
-  OS::TripleO::Services::OsloMessagingNotify: ../../deployment/rabbitmq/rabbitmq-messaging-notify-shared-puppet.yaml
-  OS::TripleO::Services::OctaviaApi: ../../deployment/octavia/octavia-api-container-puppet.yaml
-  OS::TripleO::Services::OctaviaHousekeeping: ../../deployment/octavia/octavia-housekeeping-container-puppet.yaml
-  OS::TripleO::Services::OctaviaHealthManager: ../../deployment/octavia/octavia-health-manager-container-puppet.yaml
-  OS::TripleO::Services::OctaviaWorker: ../../deployment/octavia/octavia-worker-container-puppet.yaml
-  OS::TripleO::Services::OctaviaDeploymentConfig: ../../deployment/octavia/octavia-deployment-config.yaml
   OS::TripleO::Services::CinderApi: OS::Heat::None
   OS::TripleO::Services::CinderBackup: OS::Heat::None
   OS::TripleO::Services::CinderScheduler: OS::Heat::None
   OS::TripleO::Services::CinderVolume: OS::Heat::None
-  OS::TripleO::Services::SwiftProxy: OS::Heat::None
-  OS::TripleO::Services::SwiftDispersion: OS::Heat::None
-  OS::TripleO::Services::SwiftRingBuilder: OS::Heat::None
-  OS::TripleO::Services::SwiftStorage: OS::Heat::None
-  OS::TripleO::Services::SwiftRingBuilder: OS::Heat::None
-  OS::TripleO::Services::SwiftStorage: OS::Heat::None
   OS::TripleO::Services::Horizon: OS::Heat::None
+  OS::TripleO::Services::OctaviaApi: ../../deployment/octavia/octavia-api-container-puppet.yaml
+  OS::TripleO::Services::OctaviaDeploymentConfig: ../../deployment/octavia/octavia-deployment-config.yaml
+  OS::TripleO::Services::OctaviaHealthManager: ../../deployment/octavia/octavia-health-manager-container-puppet.yaml
+  OS::TripleO::Services::OctaviaHousekeeping: ../../deployment/octavia/octavia-housekeeping-container-puppet.yaml
+  OS::TripleO::Services::OctaviaWorker: ../../deployment/octavia/octavia-worker-container-puppet.yaml
+  OS::TripleO::Services::OsloMessagingNotify: ../../deployment/rabbitmq/rabbitmq-messaging-notify-shared-puppet.yaml
+  OS::TripleO::Services::OsloMessagingRpc: ../../deployment/rabbitmq/rabbitmq-messaging-rpc-pacemaker-puppet.yaml
+  OS::TripleO::Services::SwiftDispersion: OS::Heat::None
+  OS::TripleO::Services::SwiftProxy: OS::Heat::None
+  OS::TripleO::Services::SwiftRingBuilder: OS::Heat::None
+  OS::TripleO::Services::SwiftStorage: OS::Heat::None
 
 parameter_defaults:
   StandaloneExtraConfig:
diff --git a/ci/environments/scenario013-standalone.yaml b/ci/environments/scenario013-standalone.yaml
index 91fc111067..1d643249de 100644
--- a/ci/environments/scenario013-standalone.yaml
+++ b/ci/environments/scenario013-standalone.yaml
@@ -1,23 +1,21 @@
 # This scenario is same as scenario10 but without Ceph.
 resource_registry:
-  OS::TripleO::Services::Keepalived: OS::Heat::None
-  OS::TripleO::Services::OsloMessagingRpc: ../../deployment/rabbitmq/rabbitmq-messaging-rpc-container-puppet.yaml
-  OS::TripleO::Services::OctaviaApi: ../../deployment/octavia/octavia-api-container-puppet.yaml
-  OS::TripleO::Services::OctaviaHousekeeping: ../../deployment/octavia/octavia-housekeeping-container-puppet.yaml
-  OS::TripleO::Services::OctaviaHealthManager: ../../deployment/octavia/octavia-health-manager-container-puppet.yaml
-  OS::TripleO::Services::OctaviaWorker: ../../deployment/octavia/octavia-worker-container-puppet.yaml
-  OS::TripleO::Services::OctaviaDeploymentConfig: ../../deployment/octavia/octavia-deployment-config.yaml
   OS::TripleO::Services::CinderApi: OS::Heat::None
   OS::TripleO::Services::CinderBackup: OS::Heat::None
   OS::TripleO::Services::CinderScheduler: OS::Heat::None
   OS::TripleO::Services::CinderVolume: OS::Heat::None
-  OS::TripleO::Services::SwiftProxy: OS::Heat::None
-  OS::TripleO::Services::SwiftDispersion: OS::Heat::None
-  OS::TripleO::Services::SwiftRingBuilder: OS::Heat::None
-  OS::TripleO::Services::SwiftStorage: OS::Heat::None
-  OS::TripleO::Services::SwiftRingBuilder: OS::Heat::None
-  OS::TripleO::Services::SwiftStorage: OS::Heat::None
   OS::TripleO::Services::Horizon: OS::Heat::None
+  OS::TripleO::Services::Keepalived: OS::Heat::None
+  OS::TripleO::Services::OctaviaApi: ../../deployment/octavia/octavia-api-container-puppet.yaml
+  OS::TripleO::Services::OctaviaDeploymentConfig: ../../deployment/octavia/octavia-deployment-config.yaml
+  OS::TripleO::Services::OctaviaHealthManager: ../../deployment/octavia/octavia-health-manager-container-puppet.yaml
+  OS::TripleO::Services::OctaviaHousekeeping: ../../deployment/octavia/octavia-housekeeping-container-puppet.yaml
+  OS::TripleO::Services::OctaviaWorker: ../../deployment/octavia/octavia-worker-container-puppet.yaml
+  OS::TripleO::Services::OsloMessagingRpc: ../../deployment/rabbitmq/rabbitmq-messaging-rpc-container-puppet.yaml
+  OS::TripleO::Services::SwiftDispersion: OS::Heat::None
+  OS::TripleO::Services::SwiftProxy: OS::Heat::None
+  OS::TripleO::Services::SwiftRingBuilder: OS::Heat::None
+  OS::TripleO::Services::SwiftStorage: OS::Heat::None
 
 parameter_defaults:
   StandaloneExtraConfig:
diff --git a/deployment/barbican/barbican-api-container-puppet.yaml b/deployment/barbican/barbican-api-container-puppet.yaml
index ec9c8a39b5..233ff16c07 100644
--- a/deployment/barbican/barbican-api-container-puppet.yaml
+++ b/deployment/barbican/barbican-api-container-puppet.yaml
@@ -44,9 +44,6 @@ parameters:
     default: {}
     description: Parameters specific to the role
     type: json
-  EnableInternalTLS:
-    type: boolean
-    default: false
   BarbicanPkcs11CryptoATOSEnabled:
     type: boolean
     default: false
diff --git a/deployment/ceph-ansible/ceph-external.yaml b/deployment/ceph-ansible/ceph-external.yaml
index c152d64469..0a4a04af9e 100644
--- a/deployment/ceph-ansible/ceph-external.yaml
+++ b/deployment/ceph-ansible/ceph-external.yaml
@@ -81,4 +81,3 @@ outputs:
                   content: "{{ceph_ansible_group_vars_clients|to_nice_yaml}}"
       external_update_tasks: {get_attr: [CephBase, role_data, external_update_tasks]}
       external_upgrade_tasks: {get_attr: [CephBase, role_data, external_upgrade_tasks]}
-      config_settings: {}
diff --git a/deployment/cephadm/ceph-external.yaml b/deployment/cephadm/ceph-external.yaml
index 5c4a274764..abad3d5fc6 100644
--- a/deployment/cephadm/ceph-external.yaml
+++ b/deployment/cephadm/ceph-external.yaml
@@ -79,4 +79,3 @@ outputs:
                   ceph_ansible_group_vars_clients: {get_attr: [CephExternalAnsibleVars, value, vars]}
       external_update_tasks: []
       external_upgrade_tasks: []
-      config_settings: {}
diff --git a/deployment/gnocchi/gnocchi-api-container-puppet.yaml b/deployment/gnocchi/gnocchi-api-container-puppet.yaml
index 29b0156fe3..21b35067b0 100644
--- a/deployment/gnocchi/gnocchi-api-container-puppet.yaml
+++ b/deployment/gnocchi/gnocchi-api-container-puppet.yaml
@@ -105,9 +105,6 @@ parameters:
   MonitoringSubscriptionGnocchiApi:
     default: 'overcloud-gnocchi-api'
     type: string
-  EnableInternalTLS:
-    type: boolean
-    default: false
   GnocchiApiPolicies:
     description: |
       A hash of policies to configure for Gnocchi API.
diff --git a/deployment/haproxy/haproxy-pacemaker-puppet.yaml b/deployment/haproxy/haproxy-pacemaker-puppet.yaml
index 898e8829e4..885da96e6b 100644
--- a/deployment/haproxy/haproxy-pacemaker-puppet.yaml
+++ b/deployment/haproxy/haproxy-pacemaker-puppet.yaml
@@ -170,7 +170,6 @@ outputs:
             tripleo::haproxy::haproxy_log_address: {get_param: HAProxySyslogAddress}
             tripleo::haproxy::haproxy_log_facility: {get_param: HAProxySyslogFacility}
           - haproxy_docker: true
-            tripleo::profile::pacemaker::haproxy_bundle::haproxy_docker_image: &haproxy_image {get_param: ContainerHAProxyImage}
             tripleo::profile::pacemaker::haproxy_bundle::container_backend: {get_param: ContainerCli}
             # the list of directories that contain the certs to bind mount in the countainer
             # bind-mounting the directories rather than all the cert, key and pem files ensures
diff --git a/deployment/neutron/neutron-api-container-puppet.yaml b/deployment/neutron/neutron-api-container-puppet.yaml
index 7c376a31a3..181d73931f 100644
--- a/deployment/neutron/neutron-api-container-puppet.yaml
+++ b/deployment/neutron/neutron-api-container-puppet.yaml
@@ -102,9 +102,6 @@ parameters:
   MonitoringSubscriptionNeutronServer:
     default: 'overcloud-neutron-server'
     type: string
-  EnableInternalTLS:
-    type: boolean
-    default: false
   EnableSQLAlchemyCollectd:
     type: boolean
     description: >
@@ -307,7 +304,6 @@ outputs:
             neutron::keystone::authtoken::interface: 'internal'
             neutron::quota::quota_port: {get_param: NeutronPortQuota}
             neutron::quota::quota_security_group: {get_param: NeutronSecurityGroupQuota}
-            neutron::server::placement::region_name: {get_param: KeystoneRegion}
             neutron::server::placement::password: {get_param: NovaPassword}
             neutron::server::placement::www_authenticate_uri: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
             neutron::server::placement::project_domain_name: 'Default'
diff --git a/deployment/neutron/neutron-dhcp-container-puppet.yaml b/deployment/neutron/neutron-dhcp-container-puppet.yaml
index 86878a7fdb..10f3314eb7 100644
--- a/deployment/neutron/neutron-dhcp-container-puppet.yaml
+++ b/deployment/neutron/neutron-dhcp-container-puppet.yaml
@@ -494,7 +494,6 @@ outputs:
                 setfacl -R -m u:neutron:rw /var/lib/neutron
                 find /var/lib/neutron -type d -exec setfacl -m u:neutron:rwx '{}' \;
             - name: Provide access for domain sockets
-              failed_when: false
               become: true
               shell: |
                 umask 0002
diff --git a/deployment/neutron/neutron-l3-container-puppet.yaml b/deployment/neutron/neutron-l3-container-puppet.yaml
index b7b2f86538..a259b72590 100644
--- a/deployment/neutron/neutron-l3-container-puppet.yaml
+++ b/deployment/neutron/neutron-l3-container-puppet.yaml
@@ -209,12 +209,11 @@ outputs:
               - service_debug_unset
               - {get_param: Debug}
               - {get_param: NeutronL3AgentDebug}
-          -
           - if:
             - az_unset
             - {}
             - neutron::agents::l3::availability_zone: {get_param: NeutronL3AgentAvailabilityZone}
-            if:
+          - if:
             - l3_agent_extensions_empty
             - {}
             - neutron::agents::l3::extensions: {get_param: NeutronL3AgentExtensions}
diff --git a/deployment/ovn/ovn-metadata-container-puppet.yaml b/deployment/ovn/ovn-metadata-container-puppet.yaml
index 3f528ed8d1..7b3ca023af 100644
--- a/deployment/ovn/ovn-metadata-container-puppet.yaml
+++ b/deployment/ovn/ovn-metadata-container-puppet.yaml
@@ -92,10 +92,6 @@ parameters:
   MonitoringSubscriptionOvnMetadata:
     default: 'overcloud-ovn-metadata'
     type: string
-  Debug:
-    type: boolean
-    default: false
-    description: Set to True to enable debugging on all services.
   OvnMetadataAgentDebug:
     default: ''
     description: Set to True to enable debugging for OVN Metadata agent.
diff --git a/sample-env-generator/ssl.yaml b/sample-env-generator/ssl.yaml
index d687c3a29b..68482bc1a2 100644
--- a/sample-env-generator/ssl.yaml
+++ b/sample-env-generator/ssl.yaml
@@ -406,9 +406,6 @@ environments:
       deployment/haproxy/haproxy-pacemaker-puppet.yaml:
         parameters:
           - EnablePublicTLS
-      deployment/haproxy/haproxy-container-puppet.yaml:
-        parameters:
-          - EnablePublicTLS
     sample_values:
       EnablePublicTLS: false
       # NOTE(bnemec): This is a bit odd, but it's the only way I've found that
diff --git a/sample-env-generator/standalone.yaml b/sample-env-generator/standalone.yaml
index f95de55dbc..0d64a5f8d5 100644
--- a/sample-env-generator/standalone.yaml
+++ b/sample-env-generator/standalone.yaml
@@ -77,7 +77,6 @@ environments:
       # Aodh
       OS::TripleO::Services::AodhApi: OS::Heat::None
       OS::TripleO::Services::AodhEvaluator: OS::Heat::None
-      OS::TripleO::Services::AodhEvaluator: OS::Heat::None
       OS::TripleO::Services::AodhListener: OS::Heat::None
       OS::TripleO::Services::AodhNotifier: OS::Heat::None
       # Barbican
@@ -194,7 +193,6 @@ environments:
       # Aodh
       OS::TripleO::Services::AodhApi: OS::Heat::None
       OS::TripleO::Services::AodhEvaluator: OS::Heat::None
-      OS::TripleO::Services::AodhEvaluator: OS::Heat::None
       OS::TripleO::Services::AodhListener: OS::Heat::None
       OS::TripleO::Services::AodhNotifier: OS::Heat::None
       # Barbican
diff --git a/tools/tests/nic_config_convert_samples/heat_templates/complex.yaml b/tools/tests/nic_config_convert_samples/heat_templates/complex.yaml
index 5d8ca1ae5e..d1ef447b00 100644
--- a/tools/tests/nic_config_convert_samples/heat_templates/complex.yaml
+++ b/tools/tests/nic_config_convert_samples/heat_templates/complex.yaml
@@ -179,8 +179,6 @@ resources:
                     - /
                     - - get_param: ControlPlaneIp
                       - get_param: ControlPlaneEdge1SubnetCidr
-                routes:
-
                 routes:
                   list_concat_unique:
                     - default: true