diff --git a/puppet/controller.yaml b/puppet/controller.yaml
index c2075e63f9..816ce71d72 100644
--- a/puppet/controller.yaml
+++ b/puppet/controller.yaml
@@ -539,9 +539,6 @@ resources:
         nova_password: {get_param: NovaPassword}
         upgrade_level_nova_compute: {get_param: UpgradeLevelNovaCompute}
         instance_name_template: {get_param: InstanceNameTemplate}
-        nova_public_url: {get_param: [EndpointMap, NovaPublic, uri]}
-        nova_internal_url: {get_param: [EndpointMap, NovaInternal, uri]}
-        nova_admin_url: {get_param: [EndpointMap, NovaAdmin, uri]}
         fencing_config: {get_param: FencingConfig}
         pcsd_password: {get_param: PcsdPassword}
         rabbit_username: {get_param: RabbitUserName}
@@ -750,11 +747,6 @@ resources:
                 nova::network::neutron::neutron_auth_url: {get_input: neutron_auth_url}
                 nova::vncproxy::host: {get_input: nova_api_network}
                 nova_enable_db_purge: {get_input: nova_enable_db_purge}
-                nova::keystone::auth::public_url: {get_input: nova_public_url}
-                nova::keystone::auth::internal_url: {get_input: nova_internal_url}
-                nova::keystone::auth::admin_url: {get_input: nova_admin_url}
-                nova::keystone::auth::password: {get_input: nova_password }
-                nova::keystone::auth::region: {get_input: keystone_region}
 
                 # Horizon
                 apache::mod::remoteip::proxy_ips: {get_input: horizon_subnet}
diff --git a/puppet/services/nova-api.yaml b/puppet/services/nova-api.yaml
index 045a861437..d560edb4b9 100644
--- a/puppet/services/nova-api.yaml
+++ b/puppet/services/nova-api.yaml
@@ -13,6 +13,14 @@ parameters:
     default: 0
     description: Number of workers for Nova API service.
     type: number
+  NovaPassword:
+    description: The password for the nova service and db account, used by nova-api.
+    type: string
+    hidden: true
+  KeystoneRegion:
+    type: string
+    default: 'regionOne'
+    description: Keystone region for endpoint
 
 resources:
   NovaBase:
@@ -47,5 +55,11 @@ outputs:
             nova::api::default_floating_pool: 'public'
             nova::api::sync_db_api: true
             nova::api::enable_proxy_headers_parsing: true
+            nova::keystone::auth::tenant: 'service'
+            nova::keystone::auth::public_url: {get_param: [EndpointMap, NovaPublic, uri]}
+            nova::keystone::auth::internal_url: {get_param: [EndpointMap, NovaInternal, uri]}
+            nova::keystone::auth::admin_url: {get_param: [EndpointMap, NovaAdmin, uri]}
+            nova::keystone::auth::password: {get_param: NovaPassword}
+            nova::keystone::auth::region: {get_param: KeystoneRegion}
       step_config: |
         include tripleo::profile::base::nova::api
diff --git a/puppet/services/nova-base.yaml b/puppet/services/nova-base.yaml
index e3379821e0..868b76cf8f 100644
--- a/puppet/services/nova-base.yaml
+++ b/puppet/services/nova-base.yaml
@@ -88,7 +88,6 @@ outputs:
         nova::notify_on_state_change: 'vm_and_task_state'
         nova::notification_driver: messagingv2
         nova::network::neutron::neutron_auth_type: 'v3password'
-        nova::keystone::auth::tenant: 'service'
         nova::db::mysql::user: nova
         nova::db::mysql::host: {get_param: [EndpointMap, MysqlNoBracketsInternal, host]}
         nova::db::mysql::dbname: nova