tripleo-heat-templates/environments/inject-trust-anchor.yaml

parameter_defaults:
  SSLRootCertificate: |
    The contents of your root CA certificate go here    

resource_registry:
  OS::TripleO::NodeTLSCAData: ../puppet/extraconfig/tls/ca-inject.yaml