diff --git a/puppet/services/designate-worker.yaml b/puppet/services/designate-worker.yaml
index 786936bdf0..e180ff2cfd 100644
--- a/puppet/services/designate-worker.yaml
+++ b/puppet/services/designate-worker.yaml
@@ -94,12 +94,10 @@ outputs:
               params:
                 $NETWORK: {get_param: [ServiceNetMap, DesignateApiNetwork]}
           tripleo::profile::base::designate::rndc_allowed_addresses:
-            # TODO(hjensas): Replace with get_param: [ServiceData, net_cidr_map, {get_param: [ServiceNetMap, DesignateApiNetwork]}
-            - str_replace:
-                template:
-                  "%{hiera('$NETWORK_subnet')}"
-                params:
-                  $NETWORK: {get_param: [ServiceNetMap, DesignateApiNetwork]}
+            get_param:
+              - ServiceData
+              - net_cidr_map
+              - {get_param: [ServiceNetMap, DesignateApiNetwork]}
           designate::backend::bind9::rndc_host:
             str_replace:
               template:
diff --git a/tools/yaml-validate.py b/tools/yaml-validate.py
index aadbd16e00..8a6d8e9cc4 100755
--- a/tools/yaml-validate.py
+++ b/tools/yaml-validate.py
@@ -907,6 +907,10 @@ def validate_service_hiera_interpol(f, tpl):
             # Omit apache remoteip proxy_ips
             if 'apache::mod::remoteip::proxy_ips' in path:
                 continue
+            # Omit Designate rndc_allowed_addressses
+            if ('tripleo::profile::base::designate::rndc_allowed_addresses' in
+                    path):
+                continue
 
             # Omit if not a part of {get_param: [ServiceNetMap ...
             if not enter_lists and path[-1] != 'get_param':