diff --git a/roles/undercloud-deploy/README.md b/roles/undercloud-deploy/README.md
new file mode 100644
index 000000000..ca4645fb6
--- /dev/null
+++ b/roles/undercloud-deploy/README.md
@@ -0,0 +1,73 @@
+undercloud-deploy
+==========================================
+
+An Ansible role to execute the deployment of the tripleo undercloud
+
+Requirements
+------------
+
+This requires a running host to deploy the undercloud.
+
+Role Variables
+--------------
+
+- `undercloud_config_file`: <'undercloud.conf.j2'> -- the name of the jinja template
+used as the base for the undercloud.conf
+- `undercloud_install_script`: <'undercloud-install.j2'> -- the name of the jinja template
+used as the base for the undercloud-install bash script
+- `undercloud_post_install_script`: <'undercloud-install-post.sh.j2'> -- the name of the
+jinja template used as the base for the undercloud-install-post bash script
+- `undercloud_install_log`: <'{{ working_dir }}/undercloud_install.log'> -- the full path
+to the undercloud install log file.
+- `undercloud_post_install.log`: <'{{ working_dir }}/undercloud_post_install.log'> -- the full
+path to the undercloud-post-install.sh log file.
+- `network_environment_file`: <'network-environment.yaml.j2'> -- the name of the jinja template
+used as the base for the network-environment for tripleo.
+- `undercloud_hieradata_override_file`: <'quickstart-hieradata-overrides.yaml.j2'> -- the name of
+jinja template used to override the undercloud's install hieradata
+- `step_introspect`: <'false'> -- boolean value to enable/disable ironic introspection
+- `bash_deploy_ramdisk`: <'false'> -- the variable allows older versions of tripleo to upload images
+properly with the option --old-deploy-image
+- `step_install_undercloud`: <'true'> -- turn on/off the undercloud deployment
+- `libvirt_uri`: <'qemu:///session'> -- the URI used by libvirt, by default tripleo-quickstart uses
+user sessions to provide greater flexixiblity to our users. ** additional documentation ** is at
+http://docs.openstack.org/developer/tripleo-quickstart/accessing-libvirt.html
+
+Role Network Variables
+----------------------
+- `undercloud_network_cidr`: <'192.168.24.0/24'> -- the network cidr for the undercloud, note this
+also currently the default cidr used in other CI environments for tripleo.
+
+The following variables are nested under network_environment_args.  The values are calculated at
+run time using ansible jinja filters.
+
+**Note:** See additional documentation at http://docs.ansible.com/ansible/playbooks_filters_ipaddr.html and
+the ansible code base ansible/plugins/filter/ipaddr.py
+
+```
+network_environment_args:
+  ExternalNetCidr: "{{ undercloud_external_network_cidr }}"
+  ExternalAllocationPools: >
+    [{'start': '{{ undercloud_external_network_cidr|nthhost(4) }}',
+    'end': '{{ undercloud_external_network_cidr|nthhost(250) }}'}]
+  NeutronExternalNetworkBridge: ""
+  ControlPlaneSubnetCidr: "{{ undercloud_network_cidr|ipaddr('prefix') }}"
+  ControlPlaneDefaultRoute: "{{ undercloud_network_cidr|nthhost(1) }}"
+  EC2MetadataIp: "{{ undercloud_network_cidr|nthhost(1) }}"
+  DnsServers: [ '{{ external_network_cidr|nthhost(1) }}' ]
+
+```
+
+Example Playbook
+----------------
+
+Sample playbook to call the role
+
+```yaml
+# Deploy the undercloud
+- name:  Install undercloud
+  hosts: undercloud
+  gather_facts: no
+  roles:
+    - undercloud-deploy
+```
\ No newline at end of file
diff --git a/roles/undercloud-deploy/defaults/main.yml b/roles/undercloud-deploy/defaults/main.yml
new file mode 100644
index 000000000..61c06a75f
--- /dev/null
+++ b/roles/undercloud-deploy/defaults/main.yml
@@ -0,0 +1,29 @@
+undercloud_config_file: undercloud.conf.j2
+undercloud_install_script: undercloud-install.sh.j2
+undercloud_post_install_script: undercloud-install-post.sh.j2
+undercloud_install_log: "{{ working_dir }}/undercloud_install.log"
+undercloud_post_install_log: "{{ working_dir }}/undercloud_post_install.log"
+network_environment_file: network-environment.yaml.j2
+undercloud_hieradata_override_file: quickstart-hieradata-overrides.yaml.j2
+
+undercloud_network_cidr: 192.168.24.0/24
+
+step_introspect: false
+bash_deploy_ramdisk: false
+step_install_undercloud: true
+
+network_environment_args:
+  ExternalNetCidr: "{{ undercloud_external_network_cidr }}"
+  ExternalAllocationPools: >
+    [{'start': '{{ undercloud_external_network_cidr|nthhost(4) }}',
+    'end': '{{ undercloud_external_network_cidr|nthhost(250) }}'}]
+  NeutronExternalNetworkBridge: ""
+  ControlPlaneSubnetCidr: "{{ undercloud_network_cidr|ipaddr('prefix') }}"
+  ControlPlaneDefaultRoute: "{{ undercloud_network_cidr|nthhost(1) }}"
+  EC2MetadataIp: "{{ undercloud_network_cidr|nthhost(1) }}"
+  DnsServers: [ '{{ external_network_cidr|nthhost(1) }}' ]
+
+# Which libvirt session should we use?  Using `qemu://session` does
+# not require privileged access (but does require the setup performed by the
+# `environment/setup` role).
+libvirt_uri: qemu:///session
diff --git a/roles/undercloud-deploy/meta/main.yml b/roles/undercloud-deploy/meta/main.yml
new file mode 100644
index 000000000..97b7a87bd
--- /dev/null
+++ b/roles/undercloud-deploy/meta/main.yml
@@ -0,0 +1,3 @@
+dependencies:
+  - libvirt
+  - tripleo
diff --git a/roles/undercloud-deploy/tasks/create-scripts.yml b/roles/undercloud-deploy/tasks/create-scripts.yml
new file mode 100644
index 000000000..2c67c49d4
--- /dev/null
+++ b/roles/undercloud-deploy/tasks/create-scripts.yml
@@ -0,0 +1,19 @@
+# Creat the scripts that will be used to deploy the undercloud
+# environment.
+- name: Create undercloud configuration
+  template:
+    src: "{{ undercloud_config_file }}"
+    dest: "./undercloud.conf"
+    mode: 0600
+
+- name: Create undercloud hieradata overrides
+  template:
+    src: "{{ undercloud_hieradata_override_file }}"
+    dest: "./quickstart-hieradata-overrides.yaml"
+    mode: 0600
+
+- name: Create undercloud install script
+  template:
+    src: "{{ undercloud_install_script }}"
+    dest: "{{ working_dir }}/undercloud-install.sh"
+    mode: 0755
diff --git a/roles/undercloud-deploy/tasks/install-undercloud.yml b/roles/undercloud-deploy/tasks/install-undercloud.yml
new file mode 100644
index 000000000..51f2781a7
--- /dev/null
+++ b/roles/undercloud-deploy/tasks/install-undercloud.yml
@@ -0,0 +1,19 @@
+- name: Prepare directory with extra logs
+  file: dest=/var/log/extra state=directory
+  become: true
+
+# No need to install dstat package here because it is part of the images
+- name: Run dstat for collecting metrics during 2 hours
+  command: >
+    dstat -tcmndrylpg --nocolor --output /var/log/extra/dstat-csv.log 1 7200 \
+    >/dev/null
+  async: 7200
+  poll: 0
+  become: true
+  when: step_install_undercloud
+
+- name: Install the undercloud
+  shell: |
+    {{ working_dir }}/undercloud-install.sh > \
+    {{ undercloud_install_log }} 2>&1
+  when: step_install_undercloud
diff --git a/roles/undercloud-deploy/tasks/main.yml b/roles/undercloud-deploy/tasks/main.yml
new file mode 100644
index 000000000..a908c0995
--- /dev/null
+++ b/roles/undercloud-deploy/tasks/main.yml
@@ -0,0 +1,37 @@
+- include: create-scripts.yml
+  tags:
+    - undercloud-scripts
+
+- include: install-undercloud.yml
+  tags:
+    - undercloud-install
+
+# Ironic defaults to using `qemu:///system`.  When running libvirtd
+# unprivileged we need to use `qemu:///session`.  This allows us to pass
+# the value of libvirt_uri into /etc/ironic/ironic.conf.
+- name: Configure Ironic pxe_ssh driver
+  when: release in ['mitaka', 'liberty']
+  delegate_to: undercloud
+  ini_file:
+    dest: /etc/ironic/ironic.conf
+    section: ssh
+    option: libvirt_uri
+    value: '{{ libvirt_uri }}'
+  become: true
+  tags:
+    - undercloud-install
+
+- name: restart ironic conductor after changing configuration
+  when: release in ['mitaka', 'liberty']
+  become: true
+  service:
+    name: openstack-ironic-conductor
+    enabled: yes
+    state: restarted
+  tags:
+    - undercloud-install
+
+- include: post-install.yml
+  tags:
+    - undercloud-post-install
+
diff --git a/roles/undercloud-deploy/tasks/post-install.yml b/roles/undercloud-deploy/tasks/post-install.yml
new file mode 100644
index 000000000..57f390822
--- /dev/null
+++ b/roles/undercloud-deploy/tasks/post-install.yml
@@ -0,0 +1,73 @@
+# Extract the undercloud admin password from
+# `undercloud-passwords.conf`.
+- name: Get undercloud admin password
+  command: >
+    awk -F= '$1 == "undercloud_admin_password" {print $2}'
+    {{ working_dir }}/undercloud-passwords.conf
+  register: undercloud_admin_password
+  changed_when: false
+
+- name: Copy stackrc to ansible host
+  tags:
+    - undercloud-post-install
+  fetch:
+    flat: true
+    src: stackrc
+    dest: "{{ local_working_dir }}/stackrc"
+
+# We need this (and the previous task) in order to replace the
+# `sudo hiera admin_password` with an actual password in the `stackrc`
+# file.
+- name: Update admin password in local credentials file
+  delegate_to: localhost
+  lineinfile:
+    dest: "{{ local_working_dir }}/stackrc"
+    line: "export OS_PASSWORD={{ undercloud_admin_password.stdout }}"
+    regexp: "OS_PASSWORD"
+
+- name: Install VirtualBMC package
+  when: release not in ['liberty', 'mitaka', 'newton']
+  package:
+    name: "python2-virtualbmc"
+    state: present
+    use: yum
+  become: true
+
+- name: Create the Virtual BMCs
+  when: release not in ['liberty', 'mitaka', 'newton']
+  command: >
+    vbmc add {{item.name}} --port {{item.virtualbmc_port}} --libvirt-uri "qemu+ssh://{{ non_root_user }}@{{ networks[0].address }}/session?socket=/run/user/{{ hostvars[groups['virthost'][0]].non_root_user_uid }}/libvirt/libvirt-sock&keyfile=/root/.ssh/id_rsa_virt_power&no_verify=1&no_tty=1"
+  with_items: "{{ overcloud_nodes }}"
+  become: true
+  become_user: root
+  changed_when: false
+
+# TODO(lucasagomes): The service file should be included in the
+#                    virtualbmc RPM package.
+- name: Create the VirtualBMC systemd service
+  when: release not in ['liberty', 'mitaka', 'newton']
+  copy:
+    mode: 0664
+    dest: "/usr/lib/systemd/system/virtualbmc.service"
+    content: |
+      [Unit]
+      Description=VirtualBMC service
+      After=network.target
+
+      [Service]
+      Type=oneshot
+      ExecStart=/bin/bash -c 'for bmc in $(ls /root/.vbmc/); do vbmc start $bmc; done'
+      ExecStop=/bin/bash -c 'for bmc in $(ls /root/.vbmc/); do vbmc stop $bmc; done'
+      RemainAfterExit=yes
+
+      [Install]
+      WantedBy=multi-user.target
+  become: true
+
+- name: Start the Virtual BMCs
+  when: release not in ['liberty', 'mitaka', 'newton']
+  service:
+    name: virtualbmc
+    state: started
+    enabled: true
+  become: true
diff --git a/roles/undercloud-deploy/templates/quickstart-hieradata-overrides.yaml.j2 b/roles/undercloud-deploy/templates/quickstart-hieradata-overrides.yaml.j2
new file mode 100644
index 000000000..08a68ff08
--- /dev/null
+++ b/roles/undercloud-deploy/templates/quickstart-hieradata-overrides.yaml.j2
@@ -0,0 +1,66 @@
+# Ironic defaults to using `qemu:///system`.  When running libvirtd
+# unprivileged we need to use `qemu:///session`.  This allows us to pass
+# the value of libvirt_uri into /etc/ironic/ironic.conf.
+ironic::drivers::ssh::libvirt_uri: '{{libvirt_uri}}'
+
+# The following are configurations for the different workers for the undercloud
+# services.
+{% if undercloud_workers is defined %}
+undercloud_workers: {{undercloud_workers}}
+{% endif %}
+
+{% if undercloud_glance_workers is defined %}
+glance::api::workers: {{undercloud_glance_workers}}
+glance::registry::workers: {{undercloud_glance_workers}}
+{% elif undercloud_workers is defined %}
+glance::api::workers: "%{hiera('undercloud_workers')}"
+glance::registry::workers: "%{hiera('undercloud_workers')}"
+{% endif %}
+
+{% if undercloud_heat_workers is defined %}
+heat::api::workers: {{undercloud_heat_workers}}
+heat::api_cfn::workers: {{undercloud_heat_workers}}
+heat::engine::num_engine_workers: {{undercloud_heat_workers}}
+{% elif undercloud_workers is defined %}
+heat::api::workers: "%{hiera('undercloud_workers')}"
+heat::api_cfn::workers: "%{hiera('undercloud_workers')}"
+heat::engine::num_engine_workers: "%{hiera('undercloud_workers')}"
+{% endif %}
+
+{% if undercloud_ironic_workers is defined %}
+ironic::api::workers: {{undercloud_ironic_workers}}
+ironic::wsgi::apache::workers: {{undercloud_ironic_workers}}
+{% elif undercloud_workers is defined %}
+ironic::api::workers: "%{hiera('undercloud_workers')}"
+ironic::wsgi::apache::workers: "%{hiera('undercloud_workers')}"
+{% endif %}
+
+{% if undercloud_keystone_workers is defined %}
+keystone::wsgi::apache::workers: {{undercloud_keystone_workers}}
+{% elif undercloud_workers is defined %}
+keystone::wsgi::apache::workers: "%{hiera('undercloud_workers')}"
+{% endif %}
+
+{% if undercloud_neutron_workers is defined %}
+neutron::agents::metadata::metadata_workers: {{undercloud_neutron_workers}}
+neutron::server::api_workers: {{undercloud_neutron_workers}}
+{% elif undercloud_workers is defined %}
+neutron::agents::metadata::metadata_workers: "%{hiera('undercloud_workers')}"
+neutron::server::api_workers: "%{hiera('undercloud_workers')}"
+{% endif %}
+
+{% if undercloud_nova_workers is defined %}
+nova::api::metadata_workers: {{undercloud_nova_workers}}
+nova::api::osapi_compute_workers: {{undercloud_nova_workers}}
+nova::conductor::workers: {{undercloud_nova_workers}}
+{% elif undercloud_workers is defined %}
+nova::api::metadata_workers: "%{hiera('undercloud_workers')}"
+nova::api::osapi_compute_workers: "%{hiera('undercloud_workers')}"
+nova::conductor::workers: "%{hiera('undercloud_workers')}"
+{% endif %}
+
+{% if undercloud_swift_workers is defined %}
+swift::proxy::workers: {{undercloud_swift_workers}}
+{% elif undercloud_workers is defined %}
+swift::proxy::workers: "%{hiera('undercloud_workers')}"
+{% endif %}
diff --git a/roles/undercloud-deploy/templates/undercloud-install.sh.j2 b/roles/undercloud-deploy/templates/undercloud-install.sh.j2
new file mode 100644
index 000000000..9300b3376
--- /dev/null
+++ b/roles/undercloud-deploy/templates/undercloud-install.sh.j2
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -eux
+
+### --start_docs
+## Installing the undercloud
+## =========================
+## ::
+
+{% for var in (undercloud_env_vars|default([])) %}
+export {{ var }}
+{% endfor %}
+
+openstack undercloud install
+### --stop_docs
diff --git a/roles/undercloud-deploy/templates/undercloud.conf.j2 b/roles/undercloud-deploy/templates/undercloud.conf.j2
new file mode 100644
index 000000000..a91309534
--- /dev/null
+++ b/roles/undercloud-deploy/templates/undercloud.conf.j2
@@ -0,0 +1,368 @@
+[DEFAULT]
+
+#
+# From instack-undercloud
+#
+
+# Local file path to the necessary images. The path should be a
+# directory readable by the current user that contains the full set of
+# images. (string value)
+{% if undercloud_image_path is defined %}
+image_path = {{undercloud_image_path}}
+{% else %}
+#image_path = .
+{% endif %}
+
+# Fully qualified hostname (including domain) to set on the
+# Undercloud. If left unset, the current hostname will be used, but
+# the user is responsible for configuring all system hostname settings
+# appropriately.  If set, the undercloud install will configure all
+# system hostname settings. (string value)
+{% if undercloud_undercloud_hostname is defined %}
+undercloud_hostname = {{undercloud_undercloud_hostname}}
+{% else %}
+#undercloud_hostname = <None>
+{% endif %}
+
+# Network CIDR for the Neutron-managed network for Overcloud
+# instances. This should be the subnet used for PXE booting. (string
+# value)
+network_cidr = {{undercloud_network_cidr}}
+
+# IP information for the interface on the Undercloud that will be
+# handling the PXE boots and DHCP for Overcloud instances.  The IP
+# portion of the value will be assigned to the network interface
+# defined by local_interface, with the netmask defined by the prefix
+# portion of the value. (string value)
+local_ip = {{undercloud_local_ip|default(
+    '%s/%s' % (undercloud_network_cidr|nthhost(1),
+    undercloud_network_cidr.split('/').1))}}
+
+# Network gateway for the Neutron-managed network for Overcloud
+# instances. This should match the local_ip above when using
+# masquerading. (string value)
+network_gateway = {{undercloud_network_gateway|default(
+    undercloud_network_cidr|nthhost(1))}}
+
+# Virtual IP address to use for the public endpoints of Undercloud
+# services.  Only used if undercloud_service_certficate is set.
+# (string value)
+undercloud_public_vip = {{undercloud_undercloud_public_vip|default(
+    undercloud_network_cidr|nthhost(2))}}
+
+# Virtual IP address to use for the admin endpoints of Undercloud
+# services.  Only used if undercloud_service_certficate is set.
+# (string value)
+undercloud_admin_vip = {{undercloud_undercloud_admin_vip|default(
+    undercloud_network_cidr|nthhost(3))}}
+
+# Nameserver for the Undercloud node.
+# (string value)
+{% if undercloud_undercloud_nameservers is string %}
+undercloud_nameservers = {{ undercloud_undercloud_nameservers }}
+{% elif undercloud_undercloud_nameservers is sequence %}
+undercloud_nameservers = {{ undercloud_undercloud_nameservers|join(',') }}
+{% else %}
+# undercloud_nameservers = <None>
+{% endif %}
+
+# Certificate file to use for OpenStack service SSL connections.
+# Setting this enables SSL for the OpenStack API endpoints, leaving it
+# unset disables SSL. (string value)
+#undercloud_service_certificate =
+
+# When set to True, an SSL certificate will be generated as part of
+# the undercloud install and this certificate will be used in place of
+# the value for undercloud_service_certificate.  The resulting
+# certificate will be written to
+# /etc/pki/tls/certs/undercloud-[undercloud_public_vip].pem.  This
+# certificate is signed by CA selected by the
+# "certificate_generation_ca" option. (boolean value)
+#generate_service_certificate = false
+{% if undercloud_generate_service_certificate is defined %}
+generate_service_certificate = {{undercloud_generate_service_certificate}}
+{% endif %}
+
+# The certmonger nickname of the CA from which the certificate will be
+# requested. This is used only if the generate_service_certificate
+# option is set. Note that if the "local" CA is selected the
+# certmonger's local CA certificate will be extracted to /etc/pki/ca-
+# trust/source/anchors/cm-local-ca.pem and subsequently added to the
+# trust chain. (string value)
+#certificate_generation_ca = local
+{% if undercloud_certificate_generation_ca is defined %}
+certificate_generation_ca = {{undercloud_certificate_generation_ca}}
+{% endif %}
+
+# Network interface on the Undercloud that will be handling the PXE
+# boots and DHCP for Overcloud instances. (string value)
+{% if undercloud_local_interface is defined %}
+local_interface = {{undercloud_local_interface}}
+{% else %}
+#local_interface = eth1
+{% endif %}
+
+# Network that will be masqueraded for external access, if required.
+# This should be the subnet used for PXE booting. (string value)
+masquerade_network = {{undercloud_masquerade_network|default(
+    undercloud_network_cidr)}}
+
+# Start of DHCP allocation range for PXE and DHCP of Overcloud
+# instances. (string value)
+dhcp_start = {{undercloud_dhcp_start|default(
+    undercloud_network_cidr|nthhost(5))}}
+
+# End of DHCP allocation range for PXE and DHCP of Overcloud
+# instances. (string value)
+dhcp_end = {{undercloud_dhcp_end|default(
+    undercloud_network_cidr|nthhost(30))}}
+
+# Path to hieradata override file. If set, the file will be copied
+# under /etc/puppet/hieradata and set as the first file in the hiera
+# hierarchy. This can be used to to custom configure services beyond
+# what undercloud.conf provides (string value)
+hieradata_override = quickstart-hieradata-overrides.yaml
+
+# Network interface on which inspection dnsmasq will listen.  If in
+# doubt, use the default value. (string value)
+# Deprecated group/name - [DEFAULT]/discovery_interface
+{% if undercloud_inspection_interface is defined %}
+inspection_interface = {{undercloud_inspection_interface}}
+{% else %}
+#inspection_interface = br-ctlplane
+{% endif %}
+
+# Temporary IP range that will be given to nodes during the inspection
+# process.  Should not overlap with the range defined by dhcp_start
+# and dhcp_end, but should be in the same network. (string value)
+# Deprecated group/name - [DEFAULT]/discovery_iprange
+inspection_iprange = {{undercloud_inspection_iprange|default(
+    '%s,%s' % (undercloud_network_cidr|nthhost(100),
+    undercloud_network_cidr|nthhost(120)))}}
+
+# Whether to run benchmarks when inspecting nodes. (boolean value)
+# Deprecated group/name - [DEFAULT]/discovery_runbench
+{% if undercloud_inspection_runbench is defined %}
+inspection_runbench = {{undercloud_inspection_runbench}}
+{% else %}
+#inspection_runbench = false
+{% endif %}
+
+# Whether to enable the debug log level for Undercloud OpenStack
+# services. (boolean value)
+{% if undercloud_undercloud_debug is defined %}
+undercloud_debug = {{undercloud_undercloud_debug}}
+{% else %}
+#undercloud_debug = true
+{% endif %}
+
+# Whether to install Tempest in the Undercloud. (boolean value)
+{% if undercloud_enable_tempest is defined %}
+enable_tempest = {{undercloud_enable_tempest}}
+{% else %}
+#enable_tempest = true
+{% endif %}
+
+# Whether to install Mistral in the Undercloud. (boolean value)
+{% if undercloud_enable_mistral is defined %}
+enable_mistral = {{undercloud_enable_mistral}}
+{% else %}
+#enable_mistral = false
+{% endif %}
+
+# Whether to use iPXE for deploy by default. (boolean value)
+{% if undercloud_ipxe_deploy is defined %}
+ipxe_deploy = {{undercloud_ipxe_deploy}}
+{% else %}
+#ipxe_deploy = true
+{% endif %}
+
+# Whether to install Monitoring services in the Undercloud. (boolean
+# value)
+{% if undercloud_enable_monitoring is defined %}
+enable_monitoring = {{undercloud_enable_monitoring}}
+{% else %}
+#enable_monitoring = false
+{% endif %}
+
+[auth]
+
+#
+# From instack-undercloud
+#
+
+# Password used for MySQL databases. If left unset, one will be
+# automatically generated. (string value)
+{% if undercloud_undercloud_db_password is defined %}
+undercloud_db_password = {{undercloud_undercloud_db_password}}
+{% else %}
+#undercloud_db_password = <None>
+{% endif %}
+
+# Keystone admin token. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_admin_token is defined %}
+undercloud_admin_token = {{undercloud_undercloud_admin_token}}
+{% else %}
+#undercloud_admin_token = <None>
+{% endif %}
+
+# Keystone admin password. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_admin_password is defined %}
+undercloud_admin_password = {{undercloud_undercloud_admin_password}}
+{% else %}
+#undercloud_admin_password = <None>
+{% endif %}
+
+# Glance service password. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_glance_password is defined %}
+undercloud_glance_password = {{undercloud_undercloud_glance_password}}
+{% else %}
+#undercloud_glance_password = <None>
+{% endif %}
+
+# Heat db encryption key(must be 16, 24, or 32 characters. If left
+# unset, one will be automatically generated. (string value)
+{% if undercloud_undercloud_heat_encryption_key is defined %}
+undercloud_heat_encryption_key = {{undercloud_undercloud_heat_encryption_key}}
+{% else %}
+#undercloud_heat_encryption_key = <None>
+{% endif %}
+
+# Heat service password. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_heat_password is defined %}
+undercloud_heat_password = {{undercloud_undercloud_heat_password}}
+{% else %}
+#undercloud_heat_password = <None>
+{% endif %}
+
+# Neutron service password. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_neutron_password is defined %}
+undercloud_neutron_password = {{undercloud_undercloud_neutron_password}}
+{% else %}
+#undercloud_neutron_password = <None>
+{% endif %}
+
+# Nova service password. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_nova_password is defined %}
+undercloud_nova_password = {{undercloud_undercloud_nova_password}}
+{% else %}
+#undercloud_nova_password = <None>
+{% endif %}
+
+# Ironic service password. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_ironic_password is defined %}
+undercloud_ironic_password = {{undercloud_undercloud_ironic_password}}
+{% else %}
+#undercloud_ironic_password = <None>
+{% endif %}
+
+# Ceilometer service password. If left unset, one will be
+# automatically generated. (string value)
+{% if undercloud_undercloud_ceilometer_password is defined %}
+undercloud_ceilometer_password = {{undercloud_undercloud_ceilometer_password}}
+{% else %}
+#undercloud_ceilometer_password = <None>
+{% endif %}
+
+# Aodh service password. If left unset, one will be
+# automatically generated. (string value)
+{% if undercloud_undercloud_aodh_password is defined %}
+undercloud_aodh_password = {{undercloud_undercloud_aodh_password}}
+{% else %}
+#undercloud_aodh_password = <None>
+{% endif %}
+
+# Sensu service password. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_sensu_password is defined %}
+undercloud_sensu_password = {{undercloud_undercloud_sensu_password}}
+{% else %}
+#undercloud_sensu_password = <None>
+{% endif %}
+
+# Ceilometer metering secret. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_ceilometer_metering_secret is defined %}
+undercloud_ceilometer_metering_secret = {{undercloud_undercloud_ceilometer_metering_secret}}
+{% else %}
+#undercloud_ceilometer_metering_secret = <None>
+{% endif %}
+
+# Ceilometer snmpd user. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_ceilometer_snmpd_user is defined %}
+undercloud_ceilometer_snmpd_user = {{undercloud_undercloud_ceilometer_snmpd_user}}
+{% else %}
+#undercloud_ceilometer_snmpd_user = <None>
+{% endif %}
+
+# Ceilometer snmpd password. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_ceilometer_snmpd_password is defined %}
+undercloud_ceilometer_snmpd_password = {{undercloud_undercloud_ceilometer_snmpd_password}}
+{% else %}
+#undercloud_ceilometer_snmpd_password = <None>
+{% endif %}
+
+# Swift service password. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_swift_password is defined %}
+undercloud_swift_password = {{undercloud_undercloud_swift_password}}
+{% else %}
+#undercloud_swift_password = <None>
+{% endif %}
+
+# Mistral service password. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_mistral_password is defined %}
+undercloud_mistral_password = {{undercloud_undercloud_mistral_password}}
+{% else %}
+#undercloud_mistral_password = <None>
+{% endif %}
+
+# Rabbitmq cookie. If left unset, one will be automatically generated.
+# (string value)
+{% if undercloud_undercloud_rabbit_cookie is defined %}
+undercloud_rabbit_cookie = {{undercloud_undercloud_rabbit_cookie}}
+{% else %}
+#undercloud_rabbit_cookie = <None>
+{% endif %}
+
+# Rabbitmq password. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_rabbit_password is defined %}
+undercloud_rabbit_password = {{undercloud_undercloud_rabbit_password}}
+{% else %}
+#undercloud_rabbit_password = <None>
+{% endif %}
+
+# Rabbitmq username. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_rabbit_username is defined %}
+undercloud_rabbit_username = {{undercloud_undercloud_rabbit_username}}
+{% else %}
+#undercloud_rabbit_username = <None>
+{% endif %}
+
+# Heat stack domain admin password. If left unset, one will be
+# automatically generated. (string value)
+{% if undercloud_undercloud_heat_stack_domain_admin_password is defined %}
+undercloud_heat_stack_domain_admin_password = {{undercloud_undercloud_heat_stack_domain_admin_password}}
+{% else %}
+#undercloud_heat_stack_domain_admin_password = <None>
+{% endif %}
+
+# Swift hash suffix. If left unset, one will be automatically
+# generated. (string value)
+{% if undercloud_undercloud_swift_hash_suffix is defined %}
+undercloud_swift_hash_suffix = {{undercloud_undercloud_swift_hash_suffix}}
+{% else %}
+#undercloud_swift_hash_suffix = <None>
+{% endif %}