diff --git a/puppet/controller.yaml b/puppet/controller.yaml
index 65e47b778c..e46e40629e 100644
--- a/puppet/controller.yaml
+++ b/puppet/controller.yaml
@@ -27,10 +27,6 @@ parameters:
         ...
       }
     type: json
-  ControlVirtualInterface:
-    default: 'br-ex'
-    description: Interface where virtual ip will be assigned.
-    type: string
   CorosyncIPv6:
     default: false
     description: Enable IPv6 in Corosync
@@ -91,17 +87,6 @@ parameters:
     type: string
     constraints:
       - custom_constraint: nova.flavor
-  HAProxyStatsPassword:
-    description: Password for HAProxy stats endpoint
-    type: string
-  HAProxyStatsUser:
-    description: User for HAProxy stats endpoint
-    default: admin
-    type: string
-  HAProxySyslogAddress:
-    default: /dev/log
-    description: Syslog address where HAproxy will send its log
-    type: string
   HeatAuthEncryptionKey:
     description: Auth encryption key for heat-engine
     type: string
@@ -170,12 +155,6 @@ parameters:
     type: string
     description: The password for the 'pcsd' user.
     hidden: true
-  PublicVirtualInterface:
-    default: 'br-ex'
-    description: >
-        Specifies the interface where the public-facing virtual ip will be assigned.
-        This should be int_public when a VLAN is being used.
-    type: string
   RedisPassword:
     description: The password for Redis
     type: string
@@ -422,9 +401,6 @@ resources:
       server: {get_resource: Controller}
       input_values:
         bootstack_nodeid: {get_attr: [Controller, name]}
-        haproxy_log_address: {get_param: HAProxySyslogAddress}
-        haproxy_stats_password: {get_param: HAProxyStatsPassword}
-        haproxy_stats_user: {get_param: HAProxyStatsUser}
         heat_auth_encryption_key: {get_param: HeatAuthEncryptionKey}
         horizon_secret: {get_param: HorizonSecret}
         debug: {get_param: Debug}
@@ -456,8 +432,6 @@ resources:
         instance_name_template: {get_param: InstanceNameTemplate}
         fencing_config: {get_param: FencingConfig}
         pcsd_password: {get_param: PcsdPassword}
-        control_virtual_interface: {get_param: ControlVirtualInterface}
-        public_virtual_interface: {get_param: PublicVirtualInterface}
         swift_hash_suffix: {get_param: SwiftHashSuffix}
         enable_package_upgrade: {get_attr: [UpdateDeployment, update_managed_packages]}
         swift_proxy_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, SwiftProxyNetwork]}]}
@@ -658,17 +632,7 @@ resources:
                 # Misc
                 memcached_ipv6: {get_input: memcached_ipv6}
                 memcached::listen_ip: {get_input: memcached_network}
-                control_virtual_interface: {get_input: control_virtual_interface}
-                public_virtual_interface: {get_input: public_virtual_interface}
-                tripleo::keepalived::control_virtual_interface: {get_input: control_virtual_interface}
-                tripleo::keepalived::public_virtual_interface: {get_input: public_virtual_interface}
-                tripleo::haproxy::control_virtual_interface: {get_input: control_virtual_interface}
-                tripleo::haproxy::public_virtual_interface: {get_input: public_virtual_interface}
-                tripleo::haproxy::haproxy_log_address: {get_input: haproxy_log_address}
                 tripleo::haproxy::service_certificate: {get_attr: [NodeTLSData, deployed_ssl_certificate_path]}
-                tripleo::haproxy::haproxy_stats_user: {get_input: haproxy_stats_user}
-                tripleo::haproxy::haproxy_stats_password: {get_input: haproxy_stats_password}
-                tripleo::haproxy::redis_password: {get_input: redis_password}
                 tripleo::packages::enable_upgrade: {get_input: enable_package_upgrade}
 
   # Hook for site-specific additional pre-deployment config, e.g extra hieradata
diff --git a/puppet/services/database/redis-base.yaml b/puppet/services/database/redis-base.yaml
index 301b2bb1f5..40711432d2 100644
--- a/puppet/services/database/redis-base.yaml
+++ b/puppet/services/database/redis-base.yaml
@@ -36,4 +36,3 @@ outputs:
         redis::sentinel::master_name: '"%{hiera(\"bootstrap_nodeid\")}"'
         redis::sentinel::redis_host: '"%{hiera(\"bootstrap_nodeid_ip\")}"'
         redis::sentinel::notification_script: '/usr/local/bin/redis-notifications.sh'
-        tripleo::loadbalancer::redis_password: {get_param: RedisPassword}
diff --git a/puppet/services/haproxy.yaml b/puppet/services/haproxy.yaml
index 00574c2fa1..8ac669a97b 100644
--- a/puppet/services/haproxy.yaml
+++ b/puppet/services/haproxy.yaml
@@ -18,6 +18,32 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  HAProxyStatsPassword:
+    description: Password for HAProxy stats endpoint
+    hidden: true
+    type: string
+  HAProxyStatsUser:
+    description: User for HAProxy stats endpoint
+    default: admin
+    type: string
+  HAProxySyslogAddress:
+    default: /dev/log
+    description: Syslog address where HAproxy will send its log
+    type: string
+  RedisPassword:
+    description: The password for Redis
+    type: string
+    hidden: true
+  ControlVirtualInterface:
+    default: 'br-ex'
+    description: Interface where virtual ip will be assigned.
+    type: string
+  PublicVirtualInterface:
+    default: 'br-ex'
+    description: >
+        Specifies the interface where the public-facing virtual ip will be assigned.
+        This should be int_public when a VLAN is being used.
+    type: string
 
 outputs:
   role_data:
@@ -49,5 +75,11 @@ outputs:
         tripleo::haproxy::heat_cloudwatch: true
         tripleo::haproxy::heat_cfn: true
         tripleo::haproxy::horizon: true
+        tripleo::haproxy::haproxy_log_address: {get_param: HAProxySyslogAddress}
+        tripleo::haproxy::haproxy_stats_user: {get_param: HAProxyStatsUser}
+        tripleo::haproxy::haproxy_stats_password: {get_param: HAProxyStatsPassword}
+        tripleo::haproxy::redis_password: {get_param: RedisPassword}
+        tripleo::haproxy::control_virtual_interface: {get_param: ControlVirtualInterface}
+        tripleo::haproxy::public_virtual_interface: {get_param: PublicVirtualInterface}
       step_config: |
         include ::tripleo::profile::base::haproxy
diff --git a/puppet/services/keepalived.yaml b/puppet/services/keepalived.yaml
index c8c977c6af..b783345b2d 100644
--- a/puppet/services/keepalived.yaml
+++ b/puppet/services/keepalived.yaml
@@ -18,11 +18,24 @@ parameters:
     description: Mapping of service endpoint -> protocol. Typically set
                  via parameter_defaults in the resource registry.
     type: json
+  ControlVirtualInterface:
+    default: 'br-ex'
+    description: Interface where virtual ip will be assigned.
+    type: string
+  PublicVirtualInterface:
+    default: 'br-ex'
+    description: >
+        Specifies the interface where the public-facing virtual ip will be assigned.
+        This should be int_public when a VLAN is being used.
+    type: string
 
 outputs:
   role_data:
     description: Role data for the Keepalived role.
     value:
       service_name: keepalived
+      config_settings:
+        tripleo::keepalived::control_virtual_interface: {get_param: ControlVirtualInterface}
+        tripleo::keepalived::public_virtual_interface: {get_param: PublicVirtualInterface}
       step_config: |
         include ::tripleo::profile::base::keepalived