diff --git a/lib/puppet/provider/designate_rootwrap_config/ini_setting.rb b/lib/puppet/provider/designate_rootwrap_config/ini_setting.rb
new file mode 100644
index 00000000..64e732ec
--- /dev/null
+++ b/lib/puppet/provider/designate_rootwrap_config/ini_setting.rb
@@ -0,0 +1,22 @@
+Puppet::Type.type(:designate_rootwrap_config).provide(
+  :ini_setting,
+  :parent => Puppet::Type.type(:ini_setting).provider(:ruby)
+) do
+
+  def section
+    resource[:name].split('/', 2).first
+  end
+
+  def setting
+    resource[:name].split('/', 2).last
+  end
+
+  def separator
+    '='
+  end
+
+  def file_path
+    '/etc/designate/rootwrap.conf'
+  end
+
+end
diff --git a/lib/puppet/type/designate_rootwrap_config.rb b/lib/puppet/type/designate_rootwrap_config.rb
new file mode 100644
index 00000000..2e4382d5
--- /dev/null
+++ b/lib/puppet/type/designate_rootwrap_config.rb
@@ -0,0 +1,21 @@
+Puppet::Type.newtype(:designate_rootwrap_config) do
+
+  ensurable
+
+  newparam(:name, :namevar => true) do
+    desc 'Section/setting name to manage from rootwrap.conf'
+    newvalues(/\S+\/\S+/)
+  end
+
+  newproperty(:value) do
+    desc 'The value of the setting to be defined.'
+    munge do |value|
+      value = value.to_s.strip
+      value.capitalize! if value =~ /^(true|false)$/i
+      value
+    end
+    newvalues(/^[\S ]*$/)
+
+  end
+
+end
diff --git a/manifests/config.pp b/manifests/config.pp
index 05324e7e..385d45ec 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -27,13 +27,19 @@
 #   NOTE: The configuration MUST NOT be already handled by this module
 #   or Puppet catalog compilation will fail with duplicate resources.
 #
+# [*rootwrap_config*]
+#   (optional) Allow configuration of /etc/designate/rootwrap.conf.
+#
 class designate::config (
   $designate_config      = {},
   $api_paste_ini_config  = {},
+  $rootwrap_config       = {},
 ) {
   validate_hash($designate_config)
   validate_hash($api_paste_ini_config)
+  validate_hash($rootwrap_config)
 
   create_resources('designate_config', $designate_config)
   create_resources('designate_api_paste_ini', $api_paste_ini_config)
+  create_resources('designate_rootwrap_config', $rootwrap_config)
 }
diff --git a/spec/classes/designate_config_spec.rb b/spec/classes/designate_config_spec.rb
index d9585d9e..849f6a1b 100644
--- a/spec/classes/designate_config_spec.rb
+++ b/spec/classes/designate_config_spec.rb
@@ -6,13 +6,20 @@ describe 'designate::config' do
     { :designate_config => {
         'DEFAULT/foo' => { 'value'  => 'fooValue' },
         'DEFAULT/bar' => { 'value'  => 'barValue' },
-        'DEFAULT/baz' => { 'ensure' => 'absent' }
+        'DEFAULT/baz' => { 'ensure' => 'absent' },
       },
       :api_paste_ini_config => {
         'DEFAULT/foo2' => { 'value'  => 'fooValue' },
         'DEFAULT/bar2' => { 'value'  => 'barValue' },
-        'DEFAULT/baz2' => { 'ensure' => 'absent' }
-      }
+        'DEFAULT/baz2' => { 'ensure' => 'absent' },
+      },
+      :rootwrap_config => {
+        'DEFAULT/filters_path'        => { 'value' => '/etc/designate/rootwrap.d,/usr/share/designate/rootwrap' },
+        'DEFAULT/exec_dirs'           => { 'value' => '/sbin,/usr/sbin,/bin,/usr/bin' },
+        'DEFAULT/use_syslog'          => { 'value' => 'False' },
+        'DEFAULT/syslog_log_facility' => { 'value' => 'syslog' },
+        'DEFAULT/syslog_log_level'    => { 'value' => 'ERROR' },
+    },
     }
   end
 
@@ -27,4 +34,12 @@ describe 'designate::config' do
     is_expected.to contain_designate_api_paste_ini('DEFAULT/bar2').with_value('barValue')
     is_expected.to contain_designate_api_paste_ini('DEFAULT/baz2').with_ensure('absent')
   end
+
+  it 'configures arbitrary designate rootwrap configurations' do
+    is_expected.to contain_designate_rootwrap_config('DEFAULT/filters_path').with_value('/etc/designate/rootwrap.d,/usr/share/designate/rootwrap')
+    is_expected.to contain_designate_rootwrap_config('DEFAULT/exec_dirs').with_value('/sbin,/usr/sbin,/bin,/usr/bin')
+    is_expected.to contain_designate_rootwrap_config('DEFAULT/use_syslog').with_value('False')
+    is_expected.to contain_designate_rootwrap_config('DEFAULT/syslog_log_facility').with_value('syslog')
+    is_expected.to contain_designate_rootwrap_config('DEFAULT/syslog_log_level').with_value('ERROR')
+  end
 end