diff --git a/roles/ssh-install-maas/defaults/main.yml b/roles/ssh-install-maas/defaults/main.yml
new file mode 100644
index 0000000..15abf98
--- /dev/null
+++ b/roles/ssh-install-maas/defaults/main.yml
@@ -0,0 +1,11 @@
+---
+# ssh-install-maas/defaults/main.yml
+
+ssh_pki_dir: "{{ playbook_dir }}/ssh_pki"
+
+ssh_keytype: rsa
+
+# name of master ssh key for this pod
+pod_sshkey_name: "headnode"
+
+on_maas: False
diff --git a/roles/ssh-install-maas/tasks/main.yml b/roles/ssh-install-maas/tasks/main.yml
new file mode 100644
index 0000000..96d952d
--- /dev/null
+++ b/roles/ssh-install-maas/tasks/main.yml
@@ -0,0 +1,35 @@
+---
+# ssh-install-maas/tasks/main.yml
+
+# the following replicates the functionality of the maas repo `prep` role
+# users/perms may seem off, but is identical to that role
+
+- name: Create ssh key directory for MaaS
+  when: on_maas
+  file:
+    dest: "/etc/maas/.ssh/"
+    mode: 0755
+    owner: "root"
+    group: "root"
+    state: directory
+
+- name: Copy ssh private key for MaaS
+  when: on_maas
+  copy:
+    src: "{{ ssh_pki_dir }}/client_certs/{{ pod_sshkey_name }}_sshkey"
+    dest: "/etc/maas/.ssh/cord_rsa"
+    mode: 0644
+    owner: "root"
+    group: "root"
+    backup: true
+
+- name: Copy ssh public key for MaaS
+  when: on_maas
+  copy:
+    src: "{{ ssh_pki_dir }}/client_certs/{{ pod_sshkey_name }}_sshkey.pub"
+    dest: "/etc/maas/.ssh/cord_rsa.pub"
+    mode: 0644
+    owner: "root"
+    group: "root"
+    backup: true
+