diff --git a/controller.yaml b/controller.yaml
index f63ebbcabc..d7ba1a1062 100644
--- a/controller.yaml
+++ b/controller.yaml
@@ -168,6 +168,9 @@ parameters:
   HeatAuthEncryptionKey:
     description: Auth encryption key for heat-engine
     type: string
+  HorizonSecret:
+    description: Secret key for Django
+    type: string
   Image:
     type: string
     default: overcloud-control
diff --git a/overcloud-without-mergepy.yaml b/overcloud-without-mergepy.yaml
index 8235416990..70e197d21f 100644
--- a/overcloud-without-mergepy.yaml
+++ b/overcloud-without-mergepy.yaml
@@ -545,6 +545,11 @@ resources:
     properties:
       length: 16
 
+  HorizonSecret:
+    type: OS::Heat::RandomString
+    properties:
+      length: 10
+
   Controller:
     type: OS::Heat::ResourceGroup
     properties:
@@ -581,6 +586,7 @@ resources:
           HeatPassword: {get_param: HeatPassword}
           HeatStackDomainAdminPassword: {get_param: HeatStackDomainAdminPassword}
           HeatAuthEncryptionKey: {get_resource: HeatAuthEncryptionKey}
+          HorizonSecret: {get_resource: HorizonSecret}
           Image: {get_param: controllerImage}
           ImageUpdatePolicy: {get_param: ImageUpdatePolicy}
           KeyName: {get_param: KeyName}
diff --git a/puppet/all-nodes-config.yaml b/puppet/all-nodes-config.yaml
index 9345e5c5d9..35bd4196f8 100644
--- a/puppet/all-nodes-config.yaml
+++ b/puppet/all-nodes-config.yaml
@@ -66,6 +66,10 @@ resources:
                   list_join:
                   - ','
                   - {get_param: controller_ips}
+                memcache_node_ips:
+                  list_join:
+                  - ','
+                  - {get_param: controller_ips}
 
 outputs:
   config_id:
diff --git a/puppet/controller-puppet.yaml b/puppet/controller-puppet.yaml
index 7c7d0f6447..64e7fc7245 100644
--- a/puppet/controller-puppet.yaml
+++ b/puppet/controller-puppet.yaml
@@ -168,6 +168,9 @@ parameters:
   HeatAuthEncryptionKey:
     description: Auth encryption key for heat-engine
     type: string
+  HorizonSecret:
+    description: Secret key for Django
+    type: string
   Image:
     type: string
     default: overcloud-control
@@ -484,6 +487,7 @@ resources:
               - {get_param: VirtualIP}
               - ':8000/v1/waitcondition'
         heat_auth_encryption_key: {get_param: HeatAuthEncryptionKey}
+        horizon_secret: {get_param: HorizonSecret}
         admin_password: {get_param: AdminPassword}
         admin_token: {get_param: AdminToken}
         neutron_public_interface_ip: {get_param: NeutronPublicInterfaceIP}
@@ -842,6 +846,12 @@ resources:
                 nova::network::neutron::neutron_url: {get_input: neutron_url}
                 nova::network::neutron::neutron_admin_auth_url: {get_input: neutron_admin_auth_url}
 
+                # Horizon
+                horizon::django_debug: {get_input: debug}
+                horizon::secret_key: {get_input: horizon_secret}
+                horizon::bind_address: {get_input: controller_host}
+                horizon::keystone_url: {get_input: keystone_auth_uri}
+
                 # Rabbit
                 rabbitmq::node_ip_address: {get_input: controller_host}
                 rabbitmq::erlang_cookie: {get_input: rabbit_cookie}
diff --git a/puppet/hieradata/controller.yaml b/puppet/hieradata/controller.yaml
index 0256cbc9da..76488457db 100644
--- a/puppet/hieradata/controller.yaml
+++ b/puppet/hieradata/controller.yaml
@@ -79,6 +79,9 @@ heat::engine::trusts_delegated_roles: []
 pacemaker::corosync::cluster_name: 'tripleo_cluster'
 pacemaker::corosync::manage_fw: false
 
+# horizon
+horizon::allowed_hosts: '*'
+
 mysql::server::manage_config_file: true
 
 tripleo::loadbalancer::keystone_admin: true
diff --git a/puppet/manifests/overcloud_controller.pp b/puppet/manifests/overcloud_controller.pp
index d78f2d07a0..7628f0a649 100644
--- a/puppet/manifests/overcloud_controller.pp
+++ b/puppet/manifests/overcloud_controller.pp
@@ -472,6 +472,13 @@ if hiera('step') >= 3 {
   include ::heat::api_cloudwatch
   include ::heat::engine
 
+  # Horizon
+  $vhost_params = { add_listen => false }
+  class { 'horizon':
+    cache_server_ip    => split(hiera('memcache_node_ips', '127.0.0.1'), ','),
+    vhost_extra_params => $vhost_params,
+  }
+
   $snmpd_user = hiera('snmpd_readonly_user_name')
   snmp::snmpv3_user { $snmpd_user:
     authtype => 'MD5',