diff --git a/environments/undercloud.yaml b/environments/undercloud.yaml
index 18737aab23..0f840a1d1c 100644
--- a/environments/undercloud.yaml
+++ b/environments/undercloud.yaml
@@ -14,6 +14,7 @@ resource_registry:
   OS::TripleO::Network::Ports::ExternalVipPort: ../network/ports/external_from_pool.yaml
 
   OS::TripleO::Services::ComputeNeutronOvsAgent: ../deployment/neutron/neutron-ovs-agent-container-puppet.yaml
+  OS::TripleO::Services::NeutronMetadataAgent: ../deployment/neutron/neutron-metadata-container-puppet.yaml
   OS::TripleO::Services::NeutronOvsAgent: ../deployment/neutron/neutron-ovs-agent-container-puppet.yaml
   OS::TripleO::Services::NeutronDhcpAgent: ../deployment/neutron/neutron-dhcp-container-puppet.yaml
   OS::TripleO::Services::NeutronL3Agent: ../deployment/neutron/neutron-l3-container-puppet.yaml
@@ -38,8 +39,6 @@ resource_registry:
   OS::TripleO::Services::CinderApi: OS::Heat::None
   OS::TripleO::Services::CinderScheduler: OS::Heat::None
   OS::TripleO::Services::CinderVolume: OS::Heat::None
-  OS::TripleO::Services::NovaMetadata: OS::Heat::None
-  OS::TripleO::Services::NeutronMetadataAgent: OS::Heat::None
 
   # Services we don't ever want configured. See LP#1824030
   OS::TripleO::Services::Pacemaker: OS::Heat::None
@@ -188,7 +187,8 @@ parameter_defaults:
   MySQLServerOptions:
     mysqld:
       connect_timeout: 60
-  MetadataNATRule: false
+  NeutronMetadataProxySharedSecret: ''
+  MetadataNATRule: true
   # TODO(emilien) Remove when Keepalived 2.0.6 is out
   # https://bugs.launchpad.net/tripleo/+bug/1791238
   KeepalivedRestart: true
diff --git a/roles/Undercloud.yaml b/roles/Undercloud.yaml
index 5bbad2f7c0..113a83015f 100644
--- a/roles/Undercloud.yaml
+++ b/roles/Undercloud.yaml
@@ -70,6 +70,7 @@
     - OS::TripleO::Services::NovaApi
     - OS::TripleO::Services::NovaConductor
     - OS::TripleO::Services::NovaIronic
+    - OS::TripleO::Services::NovaMetadata
     - OS::TripleO::Services::NovaScheduler
     - OS::TripleO::Services::Novajoin
     - OS::TripleO::Services::OpenStackClients
diff --git a/roles_data_undercloud.yaml b/roles_data_undercloud.yaml
index 980e638cec..dd98d0eca0 100644
--- a/roles_data_undercloud.yaml
+++ b/roles_data_undercloud.yaml
@@ -73,6 +73,7 @@
     - OS::TripleO::Services::NovaApi
     - OS::TripleO::Services::NovaConductor
     - OS::TripleO::Services::NovaIronic
+    - OS::TripleO::Services::NovaMetadata
     - OS::TripleO::Services::NovaScheduler
     - OS::TripleO::Services::Novajoin
     - OS::TripleO::Services::OpenStackClients