diff --git a/overcloud.j2.yaml b/overcloud.j2.yaml
index 3d1f610621..d5f47301f0 100644
--- a/overcloud.j2.yaml
+++ b/overcloud.j2.yaml
@@ -225,6 +225,17 @@ parameters:
     type: json
     description: Optional Role Specific parameters to be provided to service
     default: {}
+
+  {{role.name}}ServiceNetMap:
+    default: {}
+    description: |
+      Role specific ServiceNetMap overrides, the map provided will be merged
+      with the global ServiceNetMap when passing the ServiceNetMap to the
+      {{role.name}}ServiceChain resource and the {{role.name}} resource group.
+      For example:
+      {{role.name}}ServiceNetMap:
+        NovaLibvirtNetwork: internal_api_leaf2
+    type: json
 {% endfor %}
 
   # Identifiers to trigger tasks on nodes
@@ -486,7 +497,10 @@ resources:
     properties:
       Services:
         get_param: {{role.name}}Services
-      ServiceNetMap: {get_attr: [ServiceNetMap, service_net_map]}
+      ServiceNetMap:
+        map_merge:
+          - {get_attr: [ServiceNetMap, service_net_map]}
+          - {get_param: {{role.name}}ServiceNetMap}
       ServiceData:
         net_cidr_map: {get_attr: [NetCidrMapValue, value]}
         net_vip_map: {get_attr: [VipMap, net_ip_map]}
@@ -669,7 +683,10 @@ resources:
         type: OS::TripleO::{{role.name}}
         properties:
           CloudDomain: {get_param: CloudDomain}
-          ServiceNetMap: {get_attr: [ServiceNetMap, service_net_map]}
+          ServiceNetMap:
+            map_merge:
+              - {get_attr: [ServiceNetMap, service_net_map]}
+              - {get_param: {{role.name}}ServiceNetMap}
           EndpointMap: {get_attr: [EndpointMapData, value]}
           Hostname:
             str_replace:
diff --git a/releasenotes/notes/bug-1904482-dbc5162c8245a9b3.yaml b/releasenotes/notes/bug-1904482-dbc5162c8245a9b3.yaml
new file mode 100644
index 0000000000..c7628695ff
--- /dev/null
+++ b/releasenotes/notes/bug-1904482-dbc5162c8245a9b3.yaml
@@ -0,0 +1,21 @@
+---
+fixes:
+  - |
+    When deploying a spine-and-leaf (L3 routed architecture) with TLS enabled
+    for internal endpoints the deployment would fail because some roles are
+    not connected to the network mapped to the service in ServiceNetMap. To
+    fix this issue a role specific parameter ``{{role.name}}ServiceNetMap`` is
+    introduced (defaults to: ``{}``). The role specific ServiceNetMap parameter
+    allow the operator to override one or more service network mappings
+    per-role. For example::
+
+      ComputeLeaf2ServiceNetMap:
+        NovaLibvirtNetwork: internal_api_leaf2
+
+    The role specific ``{{role.name}}ServiceNetMap`` override is merged with
+    the global ``ServiceNetMap`` when it's passed as a value to the
+    ``{{role.name}}ServiceChain`` resources, and the ``{{role.name}}``
+    resource groups so that the correct network for this role is mapped to
+    the service.
+
+    Closes bug: `1904482 <https://bugs.launchpad.net/tripleo/+bug/1904482>`_.