diff --git a/roles/compute-node-enable-maas/defaults/main.yml b/roles/compute-node-enable-maas/defaults/main.yml
index b84e46d..de6b9a3 100644
--- a/roles/compute-node-enable-maas/defaults/main.yml
+++ b/roles/compute-node-enable-maas/defaults/main.yml
@@ -1,9 +1,10 @@
 ---
 # compute-node-enable-maas/defaults/main.yml
 
-cord_profile_dir: "{{ ansible_user_dir + '/cord_profile' }}"
+credentials_dir: "{{ playbook_dir }}/credentials"
+cord_profile_dir: "{{ ansible_user_dir ~ '/cord_profile' }}"
 
 xos_admin_user: "xosadmin@opencord.org"
-xos_admin_pass: "{{ lookup('password', 'credentials/xosadmin@opencord.org chars=ascii_letters,digits') }}"
+xos_admin_pass: "{{ lookup('password', credentials_dir ~ '/xosadmin@opencord.org chars=ascii_letters,digits') }}"
 
 xos_ui_port: 9000
diff --git a/roles/cord-profile/defaults/main.yml b/roles/cord-profile/defaults/main.yml
index 00ac764..98734ec 100644
--- a/roles/cord-profile/defaults/main.yml
+++ b/roles/cord-profile/defaults/main.yml
@@ -3,7 +3,8 @@
 
 cord_dir: "{{ ansible_user_dir + '/cord' }}"
 cord_profile_dir: "{{ ansible_user_dir + '/cord_profile' }}"
-pki_dir: "/opt/pki"
+pki_dir: "{{ playbook_dir }}/pki"
+credentials_dir: "{{ playbook_dir }}/credentials"
 
 deploy_docker_registry: ""
 deploy_docker_tag: "candidate"
@@ -77,7 +78,7 @@
 
 # used in deployment.yaml.j2
 xos_admin_user: "xosadmin@opencord.org"
-xos_admin_pass: "{{ lookup('password', 'credentials/xosadmin@opencord.org chars=ascii_letters,digits') }}"
+xos_admin_pass: "{{ lookup('password', credentials_dir ~ '/xosadmin@opencord.org chars=ascii_letters,digits') }}"
 xos_admin_first: XOS
 xos_admin_last: Admin
 
diff --git a/roles/cord-profile/tasks/main.yml b/roles/cord-profile/tasks/main.yml
index 9b39107..d33765e 100644
--- a/roles/cord-profile/tasks/main.yml
+++ b/roles/cord-profile/tasks/main.yml
@@ -16,7 +16,7 @@
     owner: "{{ ansible_user_id }}"
     group: "{{ ansible_user_gid }}"
 
-- name: Create cord_profile/profile_name with the name of the profile
+- name: Create cord_profile/profile_name, containing profile name
   copy:
     dest: "{{ cord_profile_dir }}/profile_name"
     content: "{{ cord_profile }}"
@@ -55,14 +55,16 @@
 
 - name: Copy cert chain and core api key and cert
   copy:
-    src: "{{ pki_dir }}/{{ item }}"
-    dest: "{{ cord_profile_dir }}/{{ item }}"
+    src: "{{ pki_dir }}/{{ item.src }}"
+    dest: "{{ cord_profile_dir }}/{{ item.dest }}"
     mode: 0600
-    remote_src: True
   with_items:
-    - core_api_key.pem
-    - core_api_cert.pem
-    - im_cert_chain.pem
+    - src: "{{ site_name }}_im_ca/private/xos-core.{{ site_suffix }}_key.pem"
+      dest: "core_api_key.pem"
+    - src: "{{ site_name }}_im_ca/certs/xos-core.{{ site_suffix }}_cert_chain.pem"
+      dest: "core_api_cert.pem"
+    - src: "{{ site_name }}_im_ca/certs/im_cert_chain.pem"
+      dest: "im_cert_chain.pem"
 
 - name: Get localhost facts (to get local uid and gid)
   setup:
diff --git a/roles/create-lxd/tasks/main.yml b/roles/create-lxd/tasks/main.yml
index fd3ace2..1b1dd7a 100644
--- a/roles/create-lxd/tasks/main.yml
+++ b/roles/create-lxd/tasks/main.yml
@@ -24,9 +24,10 @@
     default_release: trusty-backports
 
 # For lxd_profile, has to be run as normal user
-- name: Get user's SSH public key into lxd_ssh_pubkey to create LXD profile
-  set_fact:
-    lxd_ssh_pubkey: "{{ lookup('file', '{{ ansible_user_dir }}/.ssh/id_rsa.pub') }}"
+- name: slurp user's SSH public key on remote machine to create LXD profile
+  slurp:
+    src: "{{ ansible_user_dir }}/.ssh/id_rsa.pub"
+  register: slurped_pubkey
 
 - name: Create openstack LXD profile
   become: yes
@@ -37,7 +38,7 @@
       user.user-data: |
         #cloud-config
         ssh_authorized_keys:
-          - "{{ lxd_ssh_pubkey }}"
+          - "{{ slurped_pubkey['content'] | b64decode }}"
     description: 'OpenStack services on CORD'
     devices:
       eth0:
diff --git a/roles/create-lxd/templates/ansible_hosts.j2 b/roles/create-lxd/templates/ansible_hosts.j2
index e2e58de..21f5c8a 100644
--- a/roles/create-lxd/templates/ansible_hosts.j2
+++ b/roles/create-lxd/templates/ansible_hosts.j2
@@ -3,20 +3,27 @@
 
 # VMs will go away shortly in favor of containers
 [vms]
+{% if head_vm_list is defined -%}
 {% for vm in head_vm_list -%}
 {{ vm.name }}
 {% endfor -%}
+{% endif -%}
 
 [containers]
+{% if head_lxd_list is defined -%}
 {% for lxd in head_lxd_list -%}
 {{ lxd.name }}
 {% endfor -%}
+{% endif -%}
 
 [services:children]
 vms
 containers
 
 [docker]
+{% if head_vm_list is defined -%}
 {% for vm in head_vm_list | selectattr('docker_path', 'defined') -%}
 {{ vm.name }}
 {% endfor -%}
+{% endif -%}
+
diff --git a/roles/juju-setup/defaults/main.yml b/roles/juju-setup/defaults/main.yml
index 840f49d..3024e0e 100644
--- a/roles/juju-setup/defaults/main.yml
+++ b/roles/juju-setup/defaults/main.yml
@@ -1,12 +1,10 @@
 ---
 # juju-setup/defaults/main.yml
 
-juju_config_name: opencloud
-
 # note: juju_config_path and charm_versions are also set in
 # `juju-compute-setup/defaults/main.yml`.  Keep these in sync.
 
 juju_config_path: /usr/local/src/juju_config.yml
 charm_versions: {}
 
-pki_dir: "/opt/pki"
+pki_dir: "{{ playbook_dir }}/pki"
diff --git a/roles/juju-setup/tasks/main.yml b/roles/juju-setup/tasks/main.yml
index 159bd1b..d1607b8 100644
--- a/roles/juju-setup/tasks/main.yml
+++ b/roles/juju-setup/tasks/main.yml
@@ -28,7 +28,7 @@
 - name: Copy over juju-config.yml for configuring Juju services
   become: yes
   template:
-    src={{ juju_config_name }}_juju_config.yml.j2
+    src=juju_config.yml.j2
     dest={{ juju_config_path }}
 
 # check that containers are ready to be accessed, juju add-machine may error
diff --git a/roles/juju-setup/templates/cord_juju_config.yml.j2 b/roles/juju-setup/templates/juju_config.yml.j2
similarity index 74%
rename from roles/juju-setup/templates/cord_juju_config.yml.j2
rename to roles/juju-setup/templates/juju_config.yml.j2
index e640289..bf157ea 100644
--- a/roles/juju-setup/templates/cord_juju_config.yml.j2
+++ b/roles/juju-setup/templates/juju_config.yml.j2
@@ -11,40 +11,40 @@
   ha-mcastport: 5402
 
 keystone:
+  openstack-origin: "cloud:trusty-kilo"
   admin-password: "{{ keystone_admin_password }}"
   os-public-hostname: "keystone.{{ site_suffix }}"
   ha-mcastport: 5403
-  openstack-origin: "cloud:trusty-kilo"
   use-https: "yes"
-  ssl_key: {{ lookup('file', '{{ pki_dir }}/keystone.{{ site_suffix }}_key.pem') | b64encode }}
-  ssl_cert: {{ lookup('file', '{{ pki_dir }}/keystone.{{ site_suffix }}_cert.pem') | b64encode }}
-  ssl_ca: {{ lookup('file', '{{ pki_dir }}/im_cert_chain.pem') | b64encode }}
+  ssl_key: {{ lookup('file', '{{ pki_dir }}/{{ site_name }}_im_ca/private/keystone.{{ site_suffix }}_key.pem') | b64encode }}
+  ssl_cert: {{ lookup('file', '{{ pki_dir }}/{{ site_name }}_im_ca/certs/keystone.{{ site_suffix }}_cert.pem') | b64encode }}
+  ssl_ca: {{ lookup('file', '{{ pki_dir }}//{{ site_name }}_im_ca/certs/im_cert_chain.pem') | b64encode }}
 
 mongodb: {}
 
 nagios: {}
 
 neutron-api:
+  openstack-origin: "cloud:trusty-kilo"
   neutron-plugin: onosvtn
   onos-vtn-ip: onos-cord
   onos-vtn-port: 8182
   neutron-security-groups: "True"
-  openstack-origin: "cloud:trusty-kilo"
   overlay-network-type: vxlan
 
 neutron-openvswitch: {}
 
 nova-cloud-controller:
+  openstack-origin: "cloud:trusty-kilo"
   config-flags: "force_config_drive=always"
   console-access-protocol: novnc
   network-manager: Neutron
-  openstack-origin: "cloud:trusty-kilo"
 
 nova-compute:
+  openstack-origin: "cloud:trusty-kilo"
   virt-type: kvm
   config-flags: "firewall_driver=nova.virt.firewall.NoopFirewallDriver"
   disable-neutron-security-groups: "True"
-  openstack-origin: "cloud:trusty-kilo"
 
 nrpe: {}
 
@@ -54,7 +54,7 @@
   openstack-origin: "cloud:trusty-kilo"
 
 percona-cluster:
-   max-connections: 20000
+  max-connections: 20000
 
 rabbitmq-server:
   ssl: "on"
diff --git a/roles/juju-setup/templates/opencloud_juju_config.yml.j2 b/roles/juju-setup/templates/opencloud_juju_config.yml.j2
deleted file mode 100644
index b0d3e88..0000000
--- a/roles/juju-setup/templates/opencloud_juju_config.yml.j2
+++ /dev/null
@@ -1,59 +0,0 @@
----
-# juju configuration file for OpenCloud deployments
-
-ceilometer: {}
-
-ceilometer-agent: {}
-
-glance:
-  openstack-origin: "cloud:trusty-kilo"
-
-keystone:
-  admin-password: "{{ keystone_admin_password }}"
-  os-public-hostname: "keystone.{{ site_suffix }}"
-  use-https: "yes"
-  openstack-origin: "cloud:trusty-kilo"
-  ssl_key: {{ lookup('file', '{{ pki_dir }}/keystone.{{ site_suffix }}_key.pem') | b64encode }}
-  ssl_cert: {{ lookup('file', '{{ pki_dir }}/keystone.{{ site_suffix }}_cert_chain.pem') | b64encode }}
-  ssl_ca: {{ lookup('file', '{{ pki_dir }}/im_cert_chain.pem') | b64encode }}
-
-mongodb: {}
-
-neutron-api:
-  flat-network-providers: "*"
-  openstack-origin: "cloud:trusty-kilo"
-  vlan-ranges: "physnet1:1000:2000 nat"
-
-neutron-gateway:
-  bridge-mappings: "physnet1:br-data nat:br-nat"
-  flat-network-providers: "*"
-  instance-mtu: "1400"
-  openstack-origin: "cloud:trusty-kilo"
-  vlan-ranges: "physnet1:1000:2000 nat"
-
-neutron-openvswitch:
-  bridge-mappings: "physnet1:br-data nat:br-nat"
-  disable-security-groups: "True"
-  flat-network-providers: "*"
-  vlan-ranges: "physnet1:1000:2000 nat"
-
-nova-cloud-controller:
-  console-access-protocol: "novnc"
-  network-manager: "Neutron"
-  openstack-origin: "cloud:trusty-kilo"
-
-nova-compute:
-  virt-type: kvm
-  config-flags: "firewall_driver=nova.virt.firewall.NoopFirewallDriver"
-  openstack-origin: "cloud:trusty-kilo"
-
-ntp:
-  source: "0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org 2.ubuntu.pool.ntp.org 3.ubuntu.pool.ntp.org"
-
-openstack-dashboard:
-  openstack-origin: "cloud:trusty-kilo"
-
-percona-cluster: {}
-
-rabbitmq-server:
-  ssl: "on"
diff --git a/roles/pki-cert/defaults/main.yml b/roles/pki-cert/defaults/main.yml
index 4d55149..6c3de79 100644
--- a/roles/pki-cert/defaults/main.yml
+++ b/roles/pki-cert/defaults/main.yml
@@ -1,9 +1,12 @@
 ---
 # pki-cert/defaults/main.yml
 
+pki_dir: "{{ playbook_dir }}/pki"
+
+# client/server cert parameters
 cert_size: 2048
 cert_digest: "sha256"
-cert_days: 180
+cert_days: 365
 
 # lists of certificates to create
 server_certs: []
diff --git a/roles/pki-cert/tasks/main.yml b/roles/pki-cert/tasks/main.yml
index b7cbdd3..c62f522 100644
--- a/roles/pki-cert/tasks/main.yml
+++ b/roles/pki-cert/tasks/main.yml
@@ -4,33 +4,33 @@
 - name: Generate server private key (no pw)
   command: >
     openssl genrsa
-      -out {{ pki_dir }}/intermediate_ca/private/{{ item.cn }}_key.pem
+      -out {{ pki_dir }}/{{ site_name }}_im_ca/private/{{ item.cn }}_key.pem
   args:
-    creates: "{{ pki_dir }}/intermediate_ca/private/{{ item.cn }}_key.pem"
+    creates: "{{ pki_dir }}/{{ site_name }}_im_ca/private/{{ item.cn }}_key.pem"
   with_items: "{{ server_certs }}"
 
 - name: Generate server CSR
   command: >
-    openssl req -config {{ pki_dir }}/intermediate_ca/openssl.cnf
-      -key {{ pki_dir }}/intermediate_ca/private/{{ item.cn }}_key.pem
+    openssl req -config {{ pki_dir }}/{{ site_name }}_im_ca/openssl.cnf
+      -key {{ pki_dir }}/{{ site_name }}_im_ca/private/{{ item.cn }}_key.pem
       -new -sha256 -subj "{{ item.subj }}"
-      -out {{ pki_dir }}/intermediate_ca/csr/{{ item.cn }}_csr.pem
+      -out {{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ item.cn }}_csr.pem
   args:
-    creates: "{{ pki_dir }}/intermediate_ca/csr/{{ item.cn }}_csr.pem"
+    creates: "{{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ item.cn }}_csr.pem"
   environment:
     KEY_ALTNAMES: "{{ item.altnames | join(', ') }}"
   with_items: "{{ server_certs }}"
 
 - name: Sign server cert
   command: >
-    openssl ca -config {{ pki_dir }}/intermediate_ca/openssl.cnf -batch
-      -passin file:{{ pki_dir }}/intermediate_ca/private/ca_im_phrase
+    openssl ca -config {{ pki_dir }}/{{ site_name }}_im_ca/openssl.cnf -batch
+      -passin file:{{ pki_dir }}/{{ site_name }}_im_ca/private/ca_im_phrase
       -extensions server_cert
       -days {{ cert_days }} -md {{ cert_digest }}
-      -in {{ pki_dir }}/intermediate_ca/csr/{{ item.cn }}_csr.pem
-      -out {{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem
+      -in {{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ item.cn }}_csr.pem
+      -out {{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem
   args:
-    creates: "{{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem"
+    creates: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem"
   environment:
     KEY_ALTNAMES: "{{ item.altnames | join(', ') }}"
   with_items: "{{ server_certs }}"
@@ -38,8 +38,8 @@
 - name: Verify cert against root + im chain
   command: >
     openssl verify -purpose sslserver
-      -CAfile {{ pki_dir }}/intermediate_ca/certs/im_cert_chain.pem
-      {{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem
+      -CAfile {{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert_chain.pem
+      {{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem
   with_items: "{{ server_certs }}"
   tags:
      - skip_ansible_lint # diagnostic command
@@ -52,14 +52,14 @@
 
 - name: Get the intermediate cert into im_cert var
   command: >
-    openssl x509 -in {{ pki_dir }}/intermediate_ca/certs/im_cert.pem
+    openssl x509 -in {{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert.pem
   register: im_cert
   tags:
      - skip_ansible_lint # concat of files
 
 - name: Get the certs into server_certs var
   command: >
-    openssl x509 -in {{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem
+    openssl x509 -in {{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem
   with_items: "{{ server_certs }}"
   tags:
      - skip_ansible_lint # concat of files
@@ -67,40 +67,40 @@
 
 - name: Create chained server certs
   copy:
-    dest: "{{ pki_dir }}/intermediate_ca/certs/{{ item.item.cn }}_cert_chain.pem"
+    dest: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.item.cn }}_cert_chain.pem"
     content: "{{ item.stdout }}\n{{ im_cert.stdout }}"
   with_items: "{{ server_certs_raw.results }}"
 
 - name: Generate client private key (no pw)
   command: >
     openssl genrsa
-      -out {{ pki_dir }}/intermediate_ca/private/{{ item.cn }}_key.pem
+      -out {{ pki_dir }}/{{ site_name }}_im_ca/private/{{ item.cn }}_key.pem
   args:
-    creates: "{{ pki_dir }}/intermediate_ca/private/{{ item.cn }}_key.pem"
+    creates: "{{ pki_dir }}/{{ site_name }}_im_ca/private/{{ item.cn }}_key.pem"
   with_items: "{{ client_certs }}"
 
 - name: Generate client CSR
   command: >
-    openssl req -config {{ pki_dir }}/intermediate_ca/openssl.cnf
-      -key {{ pki_dir }}/intermediate_ca/private/{{ item.cn }}_key.pem
+    openssl req -config {{ pki_dir }}/{{ site_name }}_im_ca/openssl.cnf
+      -key {{ pki_dir }}/{{ site_name }}_im_ca/private/{{ item.cn }}_key.pem
       -new -sha256 -subj "{{ item.subj }}"
-      -out {{ pki_dir }}/intermediate_ca/csr/{{ item.cn }}_csr.pem
+      -out {{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ item.cn }}_csr.pem
   args:
-    creates: "{{ pki_dir }}/intermediate_ca/csr/{{ item.cn }}_csr.pem"
+    creates: "{{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ item.cn }}_csr.pem"
   environment:
     KEY_ALTNAMES: "{{ item.altnames | join(', ') }}"
   with_items: "{{ client_certs }}"
 
 - name: Sign client cert
   command: >
-    openssl ca -config {{ pki_dir }}/intermediate_ca/openssl.cnf -batch
-      -passin file:{{ pki_dir }}/intermediate_ca/private/ca_im_phrase
+    openssl ca -config {{ pki_dir }}/{{ site_name }}_im_ca/openssl.cnf -batch
+      -passin file:{{ pki_dir }}/{{ site_name }}_im_ca/private/ca_im_phrase
       -extensions user_cert
       -days {{ cert_days }} -md {{ cert_digest }}
-      -in {{ pki_dir }}/intermediate_ca/csr/{{ item.cn }}_csr.pem
-      -out {{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem
+      -in {{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ item.cn }}_csr.pem
+      -out {{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem
   args:
-    creates: "{{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem"
+    creates: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem"
   environment:
     KEY_ALTNAMES: "{{ item.altnames | join(', ') }}"
   with_items: "{{ client_certs }}"
@@ -108,8 +108,8 @@
 - name: Verify cert against root + im chain
   command: >
     openssl verify -purpose sslclient
-      -CAfile {{ pki_dir }}/intermediate_ca/certs/im_cert_chain.pem
-      {{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem
+      -CAfile {{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert_chain.pem
+      {{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem
   with_items: "{{ client_certs }}"
   tags:
      - skip_ansible_lint # diagnostic command
@@ -122,7 +122,7 @@
 
 - name: Get the certs into client_certs var
   command: >
-    openssl x509 -in {{ pki_dir }}/intermediate_ca/certs/{{ item.cn }}_cert.pem
+    openssl x509 -in {{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.cn }}_cert.pem
   with_items: "{{ client_certs }}"
   tags:
      - skip_ansible_lint # concat of files
@@ -130,7 +130,7 @@
 
 - name: Create chained client cert
   copy:
-    dest: "{{ pki_dir }}/intermediate_ca/certs/{{ item.item.cn }}_cert_chain.pem"
+    dest: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ item.item.cn }}_cert_chain.pem"
     content: "{{ item.stdout }}\n{{ im_cert.stdout }}"
   with_items: "{{ client_certs_raw.results }}"
 
diff --git a/roles/pki-install/defaults/main.yml b/roles/pki-install/defaults/main.yml
index 86c15ae..3221add 100644
--- a/roles/pki-install/defaults/main.yml
+++ b/roles/pki-install/defaults/main.yml
@@ -1,4 +1,4 @@
 # pki-install/defaults/main.yml
 
-pki_dir: "/opt/pki"
+pki_dir: "{{ playbook_dir }}/pki"
 use_openstack: True
diff --git a/roles/pki-install/handlers/main.yml b/roles/pki-install/handlers/main.yml
index 70b0e2c..4b5cc54 100644
--- a/roles/pki-install/handlers/main.yml
+++ b/roles/pki-install/handlers/main.yml
@@ -1,6 +1,5 @@
 ---
 # pki-install/handlers/main.yml
 
-- name: Run update-ca-certificates on head node
-  become: yes
+- name: update-ca-certificates
   command: update-ca-certificates
diff --git a/roles/pki-install/tasks/main.yml b/roles/pki-install/tasks/main.yml
index a49d88d..77c8806 100644
--- a/roles/pki-install/tasks/main.yml
+++ b/roles/pki-install/tasks/main.yml
@@ -1,46 +1,15 @@
 ---
 # pki-install/tasks/main.yml
 
-- name: Copy CA certificates to head node
-  become: yes
+- name: Copy CA certificates
   copy:
     src: "{{ pki_dir }}/{{ item.src }}"
     dest: "/usr/local/share/ca-certificates/{{ item.dest }}"
   with_items:
     - src: "root_ca/certs/ca_cert.pem"
       dest: "cord_root_ca.crt"
-    - src: "intermediate_ca/certs/im_cert.pem"
+    - src: "{{ site_name }}_im_ca/certs/im_cert.pem"
       dest: "cord_intermediate_ca.crt"
   notify:
-    - Run update-ca-certificates on head node
+    - update-ca-certificates
 
-- name: Ensure PKI directory
-  become: yes
-  file:
-    path: "{{ pki_dir }}"
-    state: directory
-
-- name: Copy certs needed by XOS
-  become: yes
-  copy:
-    src: "{{ pki_dir }}/{{ item.src }}"
-    dest: "{{ pki_dir }}/{{ item.dest }}"
-  with_items:
-    - src: "intermediate_ca/certs/im_cert_chain.pem"
-      dest: "im_cert_chain.pem"
-    - src: "intermediate_ca/private/xos-core.{{ site_suffix }}_key.pem"
-      dest: "core_api_key.pem"
-    - src: "intermediate_ca/certs/xos-core.{{ site_suffix }}_cert_chain.pem"
-      dest: "core_api_cert.pem"
-
-- name: Copy certs needed by OpenStack
-  become: yes
-  when: use_openstack
-  copy:
-    src: "{{ pki_dir }}/{{ item.src }}"
-    dest: "{{ pki_dir }}/{{ item.dest }}"
-  with_items:
-    - src: "intermediate_ca/private/keystone.{{ site_suffix }}_key.pem"
-      dest: "keystone.{{ site_suffix }}_key.pem"
-    - src: "intermediate_ca/certs/keystone.{{ site_suffix }}_cert.pem"
-      dest: "keystone.{{ site_suffix }}_cert.pem"
diff --git a/roles/pki-intermediate-ca/defaults/main.yml b/roles/pki-intermediate-ca/defaults/main.yml
index c8ec9c9..3a5b545 100644
--- a/roles/pki-intermediate-ca/defaults/main.yml
+++ b/roles/pki-intermediate-ca/defaults/main.yml
@@ -1,8 +1,13 @@
 ---
 # pki-intermediate-ca/defaults/main.yml
 
-pki_dir: "/opt/pki"
-credentials_dir: "/opt/credentials"
+pki_dir: "{{ playbook_dir }}/pki"
+credentials_dir: "{{ playbook_dir }}/credentials"
+
+# used to name the intermediate CA
+site_name: sitename
+site_humanname: "Site HumanName"
+site_suffix: sitename.test
 
 # crypto parameters
 ca_digest: "sha256"
@@ -13,4 +18,4 @@
 ca_im_phrase: "{{ lookup('password', credentials_dir ~ '/ca_im_phrase length=64') }}"
 
 # noninteractive csr subject
-ca_im_subj: "/C=US/ST=California/L=Menlo Park/O=ON.Lab/OU=Test Deployment/CN=CORD Test Deployment Intermediate CA"
+ca_im_subj: "/C=US/ST=California/L=Menlo Park/O=ON.Lab/OU=Test Deployment/CN={{ site_humanname }} Intermediate CA"
diff --git a/roles/pki-intermediate-ca/tasks/main.yml b/roles/pki-intermediate-ca/tasks/main.yml
index fe8aeea..56a8219 100644
--- a/roles/pki-intermediate-ca/tasks/main.yml
+++ b/roles/pki-intermediate-ca/tasks/main.yml
@@ -1,5 +1,5 @@
 ---
-# pki-ca/tasks/main.yml
+# pki-intermediate-ca/tasks/main.yml
 
 - name: Create PKI directory
   become: yes
@@ -12,7 +12,7 @@
 - name: Create intermediate CA directory
   become: yes
   file:
-    dest: "{{ pki_dir }}/intermediate_ca"
+    dest: "{{ pki_dir }}/{{ site_name }}_im_ca"
     state: directory
     owner: "{{ ansible_user_id }}"
     mode: 0755
@@ -20,12 +20,12 @@
 - name: Create intermediate CA openssl.cnf from template
   template:
     src: openssl_im.cnf.j2
-    dest: "{{ pki_dir }}/intermediate_ca/openssl.cnf"
+    dest: "{{ pki_dir }}/{{ site_name }}_im_ca/openssl.cnf"
     force: no
 
 - name: Create subdirs for intermediate CA
   file:
-    dest: "{{ pki_dir }}/intermediate_ca/{{ item }}"
+    dest: "{{ pki_dir }}/{{ site_name }}_im_ca/{{ item }}"
     state: directory
   with_items:
     - certs
@@ -35,51 +35,51 @@
 
 - name: Create private CA directory
   file:
-    dest: "{{ pki_dir }}/intermediate_ca/private"
+    dest: "{{ pki_dir }}/{{ site_name }}_im_ca/private"
     state: directory
     mode: 0700
 
 - name: Create serial file
   copy:
-    dest: "{{ pki_dir }}/intermediate_ca/serial"
+    dest: "{{ pki_dir }}/{{ site_name }}_im_ca/serial"
     content: "01"
     force: no
 
 - name: Create empty index file if it doesn't exist
   copy:
-    dest: "{{ pki_dir }}/intermediate_ca/index.txt"
+    dest: "{{ pki_dir }}/{{ site_name }}_im_ca/index.txt"
     content: ""
     force: no
 
-- name: Save intermediate passphrase to intermediate_ca/private/ca_im_phrase
+- name: Save intermediate passphrase to sitename_im_ca/private/ca_im_phrase
   copy:
-    dest: "{{ pki_dir }}/intermediate_ca/private/ca_im_phrase"
+    dest: "{{ pki_dir }}/{{ site_name }}_im_ca/private/ca_im_phrase"
     content: "{{ ca_im_phrase }}"
     mode: 0400
 
 - name: Generate intermediate key
   command: >
     openssl genrsa -aes256
-      -out {{ pki_dir }}/intermediate_ca/private/im_key.pem
-      -passout file:{{ pki_dir }}/intermediate_ca/private/ca_im_phrase
+      -out {{ pki_dir }}/{{ site_name }}_im_ca/private/im_key.pem
+      -passout file:{{ pki_dir }}/{{ site_name }}_im_ca/private/ca_im_phrase
       {{ ca_size }}
   args:
-    creates: "{{ pki_dir }}/intermediate_ca/private/im_key.pem"
+    creates: "{{ pki_dir }}/{{ site_name }}_im_ca/private/im_key.pem"
 
 - name: Set permissions on intermediate key
   file:
-    dest: "{{ pki_dir }}/intermediate_ca/private/im_key.pem"
+    dest: "{{ pki_dir }}/{{ site_name }}_im_ca/private/im_key.pem"
     mode: 0400
 
 - name: Create intermediate CSR
   command: >
-    openssl req -config {{ pki_dir }}/intermediate_ca/openssl.cnf
-      -key {{ pki_dir }}/intermediate_ca/private/im_key.pem
-      -passin file:{{ pki_dir }}/intermediate_ca/private/ca_im_phrase
+    openssl req -config {{ pki_dir }}/{{ site_name }}_im_ca/openssl.cnf
+      -key {{ pki_dir }}/{{ site_name }}_im_ca/private/im_key.pem
+      -passin file:{{ pki_dir }}/{{ site_name }}_im_ca/private/ca_im_phrase
       -new -sha256 -subj "{{ ca_im_subj }}"
-      -out {{ pki_dir }}/intermediate_ca/csr/intermediate_ca_csr.pem
+      -out {{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ site_name }}_im_ca_csr.pem
   args:
-    creates: "{{ pki_dir }}/intermediate_ca/certs/intermediate_ca_csr.pem"
+    creates: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/{{ site_name }}_im_ca_csr.pem"
   environment:
     KEY_ALTNAMES: ""
 
@@ -89,16 +89,16 @@
       -extensions v3_intermediate_ca
       -passin file:{{ pki_dir }}/root_ca/private/ca_root_phrase
       -days {{ ca_im_days }} -md {{ ca_digest }}
-      -in {{ pki_dir }}/intermediate_ca/csr/intermediate_ca_csr.pem
-      -out {{ pki_dir }}/intermediate_ca/certs/im_cert.pem
+      -in {{ pki_dir }}/{{ site_name }}_im_ca/csr/{{ site_name }}_im_ca_csr.pem
+      -out {{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert.pem
   args:
-    creates: "{{ pki_dir }}/intermediate_ca/certs/im_cert.pem"
+    creates: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert.pem"
 
 - name: Verify intemediate cert
   command: >
     openssl verify
       -CAfile {{ pki_dir }}/root_ca/certs/ca_cert.pem
-      {{ pki_dir }}/intermediate_ca/certs/im_cert.pem
+      {{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert.pem
   register: im_verify
   tags:
      - skip_ansible_lint # diagnostic command
@@ -116,12 +116,13 @@
 
 - name: Get the intermediate cert into im_cert var
   command: >
-    openssl x509 -in {{ pki_dir }}/intermediate_ca/certs/im_cert.pem
+    openssl x509 -in {{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert.pem
   register: im_cert
   tags:
      - skip_ansible_lint # concat of files
 
 - name: Create intermediate cert chain
   copy:
-    dest: "{{ pki_dir }}/intermediate_ca/certs/im_cert_chain.pem"
+    dest: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/im_cert_chain.pem"
     content: "{{ im_cert.stdout }}\n{{ ca_cert.stdout }}"
+
diff --git a/roles/pki-intermediate-ca/templates/openssl_im.cnf.j2 b/roles/pki-intermediate-ca/templates/openssl_im.cnf.j2
index 6647d83..9ae1504 100644
--- a/roles/pki-intermediate-ca/templates/openssl_im.cnf.j2
+++ b/roles/pki-intermediate-ca/templates/openssl_im.cnf.j2
@@ -4,7 +4,7 @@
 default_ca  = CA_default
 
 [ CA_default ]
-dir               = {{ pki_dir }}/intermediate_ca
+dir               = {{ pki_dir }}/{{ site_name }}_im_ca
 certs             = $dir/certs
 crl_dir           = $dir/crl
 new_certs_dir     = $dir/newcerts
@@ -66,7 +66,7 @@
 stateOrProvinceName_default     = California
 localityName_default            = Menlo Park
 0.organizationName_default      = ON.Lab
-organizationalUnitName_default  = Test Deployment
+organizationalUnitName_default  = {{ site_humanname }}
 emailAddress_default            = privateca@opencord.org
 
 [ v3_intermediate_ca ]
diff --git a/roles/pki-root-ca/defaults/main.yml b/roles/pki-root-ca/defaults/main.yml
index 9fc4952..6875f07 100644
--- a/roles/pki-root-ca/defaults/main.yml
+++ b/roles/pki-root-ca/defaults/main.yml
@@ -1,10 +1,10 @@
 ---
 # pki-root-ca/defaults/main.yml
 
-pki_dir: "/opt/pki"
-credentials_dir: "/opt/credentials"
+pki_dir: "{{ playbook_dir }}/pki"
+credentials_dir: "{{ playbook_dir }}/credentials"
 
-# ca parameters
+# ca cert parameters
 ca_digest: "sha256"
 ca_size: 4096
 ca_root_days: 3650
diff --git a/roles/ssh-pki/defaults/main.yml b/roles/ssh-pki/defaults/main.yml
index 1e8574e..c7e6125 100644
--- a/roles/ssh-pki/defaults/main.yml
+++ b/roles/ssh-pki/defaults/main.yml
@@ -1,9 +1,8 @@
 ---
 # ssh-pki/tasks/main.yml
 
-pki_dir: "/opt/pki"
-ssh_pki_dir: "/opt/ssh_pki"
-credentials_dir: "/opt/credentials"
+ssh_pki_dir: "{{ playbook_dir }}/ssh_pki"
+credentials_dir: "{{ playbook_dir }}/credentials"
 
 # password on SSH CA
 ssh_ca_phrase: "{{ lookup('password', credentials_dir ~ '/ssh_ca_phrase length=64') }}"
diff --git a/roles/vtn-refresh/defaults/main.yml b/roles/vtn-refresh/defaults/main.yml
index 9243db9..07ee055 100644
--- a/roles/vtn-refresh/defaults/main.yml
+++ b/roles/vtn-refresh/defaults/main.yml
@@ -1,8 +1,10 @@
 ---
 # vtn-refresh/defaults/main.yml
 
-xos_admin_user: xosadmin@opencord.org
-xos_admin_pass: "{{ lookup('password', 'credentials/xosadmin@opencord.org chars=ascii_letters,digits') }}"
+credentials_dir: "{{ playbook_dir }}/credentials"
 
-keystone_admin_password: "{{ lookup('password', 'credentials/cord_keystone_admin chars=ascii_letters,digits') }}"
+xos_admin_user: xosadmin@opencord.org
+xos_admin_pass: "{{ lookup('password', credentials_dir ~ '/xosadmin@opencord.org chars=ascii_letters,digits') }}"
+
+keystone_admin_password: "{{ lookup('password', credentials_dir ~ '/cord_keystone_admin chars=ascii_letters,digits') }}"