diff --git a/base.yaml b/base.yaml
index 9c2e4e26b1..a1ba509f2a 100644
--- a/base.yaml
+++ b/base.yaml
@@ -1,13 +1,13 @@
 heat_template_version: 2013-05-23
 description: 'Tie OpenStack components together'
 parameters:
-  TemplateRoot:
-    description: URL Base where all of our templates are available
-    type: string
   KeystoneAdminToken:
     description: Admin Token needed for keystone
     type: string
     hidden: true
+  TemplateRoot:
+    description: URL Base where all of our templates are available
+    type: string
 resources:
   RabbitMQ:
     type: AWS::CloudFormation::Stack
diff --git a/controller.yaml b/controller.yaml
index 8aac819ff2..4123fc0791 100644
--- a/controller.yaml
+++ b/controller.yaml
@@ -27,6 +27,8 @@ parameters:
     default: ''
     description: User to use for replication from bootstrap host
     type: string
+  controllerImage:
+    type: string
   GlanceDBPassword:
     description: Password for connecting to glance database
     type: string
@@ -43,6 +45,11 @@ parameters:
     description: Password for accessing Heat database.
     type: string
     hidden: true
+  HeatStackDomainAdminPassword:
+    description: Password for heat_domain_admin user.
+    type: string
+    default: ''
+    hidden: true
   InstanceType:
     default: baremetal
     description: Use this flavor
@@ -55,13 +62,6 @@ parameters:
     description: Password for connecting to keystone
     type: string
     hidden: true
-  NovaDBPassword:
-    description: Password for connecting to nova database
-    type: string
-    hidden: true
-  NovaInterfaces:
-    default: eth0
-    type: string
   NeutronDBPassword:
     description: Password for connecting to neutron database
     type: string
@@ -69,26 +69,26 @@ parameters:
   NeutronInterfaces:
     default: eth0
     type: string
+  NovaDBPassword:
+    description: Password for connecting to nova database
+    type: string
+    hidden: true
+  NovaInterfaces:
+    default: eth0
+    type: string
   RabbitMQPassword:
     description: Password for RabbitMQ
     type: string
     hidden: true
-  RabbitUserName:
-    type: string
   RabbitPassword:
     type: string
     hidden: true
+  RabbitUserName:
+    type: string
   ServicePassword:
     description: admin_password for setting up auth in nova.
     type: string
     hidden: true
-  controllerImage:
-    type: string
-  HeatStackDomainAdminPassword:
-    description: Password for heat_domain_admin user.
-    type: string
-    default: ''
-    hidden: true
 resources:
   AccessPolicy:
     properties:
diff --git a/debian-mirror.yaml b/debian-mirror.yaml
index 7ae12c1b03..ddfff6a6b5 100644
--- a/debian-mirror.yaml
+++ b/debian-mirror.yaml
@@ -1,13 +1,5 @@
 description: 'Debian-mirror: A Debian or Ubuntu mirror in the cloud'
 parameters:
-  DebianMirrorMirror:
-    default: http://archive.ubuntu.com/ubuntu
-    description: The mirror that is to be used as the source
-    type: string
-  DebianMirrorSuites:
-    default: ["saucy", "saucy-updates", "saucy-security"]
-    description: The suites to be mirrored
-    type: JSON
   DebianMirrorArchitectures:
     default: [{"arch": "amd64"}]
     description: The architectures to be mirrored
@@ -16,6 +8,14 @@ parameters:
     default: ["main", "restricted", "universe", "multiverse"]
     description: The components to be mirrored
     type: JSON
+  DebianMirrorMirror:
+    default: http://archive.ubuntu.com/ubuntu
+    description: The mirror that is to be used as the source
+    type: string
+  DebianMirrorSuites:
+    default: ["saucy", "saucy-updates", "saucy-security"]
+    description: The suites to be mirrored
+    type: JSON
 resources:
   debianMirrorConfig:
     type: AWS::AutoScaling::LaunchConfiguration
diff --git a/nagios3.yaml b/nagios3.yaml
index 1e0a46156f..0db22b8bb9 100644
--- a/nagios3.yaml
+++ b/nagios3.yaml
@@ -19,6 +19,26 @@ parameters:
     type: string
     description: Password for initial admin user
     hidden: true
+  external_network:
+    type: string
+    description: Network to attach floating ips to.
+    default: ext-net
+  flavor:
+    type: string
+    description: What flavor to use for the nagios server.
+    default: m1.small
+  image:
+    type: string
+    description: Image for Nagios.
+    default: nagios
+  key_name:
+    type: string
+    description: What Nova SSH key to use for the nagios server.
+    default: default
+  monitor_networks:
+    type: json
+    description: Neutron networks to monitor.
+    default: []
   nova_os_auth_url:
     type: string
     default: ''
@@ -36,30 +56,10 @@ parameters:
     type: string
     description: tenant name to present to nova_host_ip.
     default: ''
-  monitor_networks:
-    type: json
-    description: Neutron networks to monitor.
-    default: []
-  image:
-    type: string
-    description: Image for Nagios.
-    default: nagios
   server_network:
     type: string
     description: Network id for server.
     default: default-net
-  external_network:
-    type: string
-    description: Network to attach floating ips to.
-    default: ext-net
-  flavor:
-    type: string
-    description: What flavor to use for the nagios server.
-    default: m1.small
-  key_name:
-    type: string
-    description: What Nova SSH key to use for the nagios server.
-    default: default
 resources:
   nagios_config:
     type: OS::Heat::StructuredConfig
diff --git a/nova-compute-instance.yaml b/nova-compute-instance.yaml
index 5b54a540ee..2fdf97b8f2 100644
--- a/nova-compute-instance.yaml
+++ b/nova-compute-instance.yaml
@@ -6,6 +6,33 @@ parameters:
     description: The password for the keystone admin account, used for monitoring, querying neutron etc.
     type: string
     hidden: true
+  AllNodesConfig:
+    type: string
+    description: OS::Heat::Config to use for all nodes deployment
+  CeilometerComputeAgent:
+    description: Indicates whether the Compute agent is present and expects nova-compute to be configured accordingly
+    type: string
+    default: ''
+    constraints:
+    - allowed_values: ['', Present]
+  CeilometerDSN:
+    type: string
+  CeilometerMeteringSecret:
+    default: unset
+    description: Secret shared by the ceilometer services.
+    type: string
+    hidden: true
+  CeilometerPassword:
+    default: unset
+    description: The password for the ceilometer service account.
+    type: string
+    hidden: true
+  DefaultSignalTransport:
+    default: CFN_SIGNAL
+    description: Transport to use for software-config signals.
+    type: string
+    constraints:
+      - allowed_values: [ CFN_SIGNAL, HEAT_SIGNAL, NO_SIGNAL ]
   ExtraConfig:
     default: {}
     description: |
@@ -44,31 +71,52 @@ parameters:
           }
         }
     type: json
-  NovaComputeExtraConfig:
-    default: {}
-    description: |
-      NovaCompute specific configuration to inject into the cluster. Same
-      structure as ExtraConfig.
-    type: json
-  KeyName:
-    description: Name of an existing EC2 KeyPair to enable SSH access to the instances
+  GlanceHost:
     type: string
-    default: default
-  OvercloudComputeFlavor:
-    description: Use this flavor
+  GlancePort:
+    default: 9292
+    description: Glance port.
+    type: string
+  GlanceProtocol:
+    default: http
+    description: Protocol to use when connecting to glance, set to https for SSL.
     type: string
-    default: baremetal
   ImageUpdatePolicy:
     default: 'REBUILD_PRESERVE_EPHEMERAL'
     description: What policy to use when reconstructing instances. REBUILD for rebuilds, REBUILD_PRESERVE_EPHEMERAL to preserve /mnt.
     type: string
-  NovaImage:
+  KeyName:
+    description: Name of an existing EC2 KeyPair to enable SSH access to the instances
     type: string
-    default: overcloud-compute
-  NtpServer:
+    default: default
+  KeystoneHost:
+    type: string
+  LiveUpdateComputeImage:
+    type: string
+    description: The image ID for live-updates to the overcloud compute nodes.
+    default: ''
+  LiveUpdateHost:
+    type: string
+    description: The IP address for the undercloud Glance API.
+    default: ''
+  LiveUpdatePassword:
     type: string
     default: ''
-  KeystoneHost:
+    description: The live-update password for the undercloud Glance API.
+    hidden: true
+  LiveUpdateTenantName:
+    type: string
+    description: The live-update tenant name for the undercloud Glance API.
+    default: ''
+  LiveUpdateUserName:
+    type: string
+    description: The live-update username for the undercloud Glance API.
+    default: ''
+  NeutronBridgeMappings:
+    type: string
+  NeutronDSN:
+    type: string
+  NeutronEnableTunnelling:
     type: string
   NeutronFlatNetworks:
     type: string
@@ -76,6 +124,12 @@ parameters:
     description: If set, flat networks to configure in neutron plugins.
   NeutronHost:
     type: string
+  NeutronNetworkType:
+    default: 'gre'
+    description: The tenant network type for Neutron, either gre or vxlan.
+    type: string
+  NeutronNetworkVLANRanges:
+    type: string
   NeutronPhysicalBridge:
     default: ''
     description: An OVS bridge to create for accessing external networks.
@@ -84,16 +138,45 @@ parameters:
     default: ''
     description: A port to add to the NeutronPhysicalBridge.
     type: string
-  NeutronNetworkType:
-    default: 'gre'
-    description: The tenant network type for Neutron, either gre or vxlan.
-    type: string
   NeutronTunnelTypes:
     default: 'gre'
     description: |
         The tunnel types for the Neutron tenant network. To specify multiple
         values, use a comma separated string, like so: 'gre,vxlan'
     type: string
+  NovaApiHost:
+    type: string
+  NovaComputeDriver:
+    type: string
+    default: libvirt.LibvirtDriver
+  NovaComputeExtraConfig:
+    default: {}
+    description: |
+      NovaCompute specific configuration to inject into the cluster. Same
+      structure as ExtraConfig.
+    type: json
+  NovaComputeLibvirtType:
+    type: string
+    default: ''
+  NovaDSN:
+    type: string
+  NovaImage:
+    type: string
+    default: overcloud-compute
+  NovaPassword:
+    default: unset
+    description: The password for the nova service account, used by nova-api.
+    type: string
+    hidden: true
+  NovaPublicIP:
+    type: string
+  NtpServer:
+    type: string
+    default: ''
+  OvercloudComputeFlavor:
+    description: Use this flavor
+    type: string
+    default: baremetal
   RabbitHost:
     type: string
   RabbitUserName:
@@ -101,22 +184,6 @@ parameters:
   RabbitPassword:
     type: string
     hidden: true
-  CeilometerComputeAgent:
-    description: Indicates whether the Compute agent is present and expects nova-compute to be configured accordingly
-    type: string
-    default: ''
-    constraints:
-    - allowed_values: ['', Present]
-  CeilometerMeteringSecret:
-    default: unset
-    description: Secret shared by the ceilometer services.
-    type: string
-    hidden: true
-  CeilometerPassword:
-    default: unset
-    description: The password for the ceilometer service account.
-    type: string
-    hidden: true
   SnmpdReadonlyUserName:
     default: ro_snmp_user
     description: The user name for SNMPd with readonly rights running on all Overcloud nodes
@@ -126,75 +193,6 @@ parameters:
     description: The user password for SNMPd with readonly rights running on all Overcloud nodes
     type: string
     hidden: true
-  NovaComputeDriver:
-    type: string
-    default: libvirt.LibvirtDriver
-  NovaComputeLibvirtType:
-    type: string
-    default: ''
-  NovaApiHost:
-    type: string
-  NovaPassword:
-    default: unset
-    description: The password for the nova service account, used by nova-api.
-    type: string
-    hidden: true
-  GlanceHost:
-    type: string
-  GlancePort:
-    default: 9292
-    description: Glance port.
-    type: string
-  GlanceProtocol:
-    default: http
-    description: Protocol to use when connecting to glance, set to https for SSL.
-    type: string
-  CeilometerDSN:
-    type: string
-  NovaDSN:
-    type: string
-  NovaPublicIP:
-    type: string
-  NeutronDSN:
-    type: string
-  NeutronBridgeMappings:
-    type: string
-  NeutronNetworkVLANRanges:
-    type: string
-  NeutronNetworkType:
-    type: string
-  NeutronEnableTunnelling:
-    type: string
-  AllNodesConfig:
-    type: string
-    description: OS::Heat::Config to use for all nodes deployment
-  LiveUpdateUserName:
-    type: string
-    description: The live-update username for the undercloud Glance API.
-    default: ''
-  LiveUpdateTenantName:
-    type: string
-    description: The live-update tenant name for the undercloud Glance API.
-    default: ''
-  LiveUpdateHost:
-    type: string
-    description: The IP address for the undercloud Glance API.
-    default: ''
-  LiveUpdatePassword:
-    type: string
-    default: ''
-    description: The live-update password for the undercloud Glance API.
-    hidden: true
-  LiveUpdateComputeImage:
-    type: string
-    description: The image ID for live-updates to the overcloud compute nodes.
-    default: ''
-  DefaultSignalTransport:
-    default: CFN_SIGNAL
-    description: Transport to use for software-config signals.
-    type: string
-    constraints:
-      - allowed_values: [ CFN_SIGNAL, HEAT_SIGNAL, NO_SIGNAL ]
 resources:
   NovaCompute0:
     type: OS::Nova::Server
diff --git a/overcloud-source.yaml b/overcloud-source.yaml
index 947becfbe0..b2042d004b 100644
--- a/overcloud-source.yaml
+++ b/overcloud-source.yaml
@@ -12,9 +12,20 @@ parameters:
     description: The keystone auth secret.
     type: string
     hidden: true
-  CinderPassword:
+  CeilometerComputeAgent:
+    description: Indicates whether the Compute agent is present and expects nova-compute to be configured accordingly
+    type: string
+    default: ''
+    constraints:
+    - allowed_values: ['', Present]
+  CeilometerMeteringSecret:
     default: unset
-    description: The password for the cinder service account, used by cinder-api.
+    description: Secret shared by the ceilometer services.
+    type: string
+    hidden: true
+  CeilometerPassword:
+    default: unset
+    description: The password for the ceilometer service account.
     type: string
     hidden: true
   CinderISCSIHelper:
@@ -25,10 +36,42 @@ parameters:
     default: 5000
     description: The size of the loopback file used by the cinder LVM driver.
     type: number
+  CinderPassword:
+    default: unset
+    description: The password for the cinder service account, used by cinder-api.
+    type: string
+    hidden: true
+  CloudName:
+    default: ''
+    description: The DNS name of this cloud. E.g. ci-overcloud.tripleo.org
+    type: string
+  ControlFixedIPs:
+    default: []
+    description: Should be used for arbitrary ips.
+    type: json
+  controllerExtraConfig:
+    default: {}
+    description: |
+      Controller specific configuration to inject into the cluster. Same
+      structure as ExtraConfig.
+    type: json
+  controllerImage:
+    type: string
+    default: overcloud-control
+  ControlVirtualInterface:
+    default: 'br-ex'
+    description: Interface where virtual ip will be assigned.
+    type: string
   Debug:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  DefaultSignalTransport:
+    default: CFN_SIGNAL
+    description: Transport to use for software-config signals.
+    type: string
+    constraints:
+      - allowed_values: [ CFN_SIGNAL, HEAT_SIGNAL, NO_SIGNAL ]
   ExtraConfig:
     default: {}
     description: |
@@ -67,26 +110,15 @@ parameters:
           }
         }
     type: json
-  controllerExtraConfig:
-    default: {}
-    description: |
-      Controller specific configuration to inject into the cluster. Same
-      structure as ExtraConfig.
-    type: json
-  NovaComputeExtraConfig:
-    default: {}
-    description: |
-      NovaCompute specific configuration to inject into the cluster. Same
-      structure as ExtraConfig.
-    type: json
-  OvercloudControlFlavor:
-    default: baremetal
-    description: Flavor for control nodes to request when deploying.
+  GlanceLogFile:
+    description: The filepath of the file to use for logging messages from Glance.
     type: string
-  OvercloudComputeFlavor:
-    default: baremetal
-    description: Flavor for compute nodes to request when deploying.
+    default: ''
+  GlancePassword:
+    default: unset
+    description: The password for the glance service account, used by the glance services.
     type: string
+    hidden: true
   GlancePort:
     default: 9292
     description: Glance port.
@@ -95,24 +127,31 @@ parameters:
     default: http
     description: Protocol to use when connecting to glance, set to https for SSL.
     type: string
-  GlancePassword:
-    default: unset
-    description: The password for the glance service account, used by the glance services.
-    type: string
-    hidden: true
   GlanceNotifierStrategy:
     description: Strategy to use for Glance notification queue
     type: string
     default: noop
-  GlanceLogFile:
-    description: The filepath of the file to use for logging messages from Glance.
-    type: string
-    default: ''
   HeatPassword:
     default: unset
     description: The password for the Heat service account, used by the Heat services.
     type: string
     hidden: true
+  HeatStackDomainAdminPassword:
+    description: Password for heat_domain_admin user.
+    type: string
+    default: ''
+    hidden: true
+  HypervisorNeutronPhysicalBridge:
+    default: 'br-ex'
+    description: >
+      An OVS bridge to create on each hypervisor. This defaults to br-ex the
+      same as the control plane nodes, as we have a uniform configuration of
+      the openvswitch agent. Typically should not need to be changed.
+    type: string
+  HypervisorNeutronPublicInterface:
+    default: 'eth0'
+    description: What interface to add to the HypervisorNeutronPhysicalBridge.
+    type: string
   ImageUpdatePolicy:
     default: 'REBUILD_PRESERVE_EPHEMERAL'
     description: What policy to use when reconstructing instances. REBUILD for rebuilds, REBUILD_PRESERVE_EPHEMERAL to preserve /mnt.
@@ -121,6 +160,47 @@ parameters:
     default: default
     description: Name of an existing EC2 KeyPair to enable SSH access to the instances
     type: string
+  KeystoneCACertificate:
+    default: ''
+    description: Keystone self-signed certificate authority certificate.
+    type: string
+  KeystoneSigningCertificate:
+    default: ''
+    description: Keystone certificate for verifying token validity.
+    type: string
+  KeystoneSigningKey:
+    default: ''
+    description: Keystone key for signing tokens.
+    type: string
+    hidden: true
+  LiveUpdateComputeImage:
+    type: string
+    description: The image ID for live-updates to the overcloud compute nodes.
+    default: ''
+  LiveUpdateHost:
+    type: string
+    description: The IP address for the undercloud Glance API.
+    default: ''
+  LiveUpdatePassword:
+    type: string
+    default: ''
+    description: The live-update password for the undercloud Glance API.
+    hidden: true
+  LiveUpdateTenantName:
+    type: string
+    description: The live-update tenant name for the undercloud Glance API.
+    default: ''
+  LiveUpdateUserName:
+    type: string
+    description: The live-update username for the undercloud Glance API.
+    default: ''
+  MysqlInnodbBufferPoolSize:
+    description: >
+        Specifies the size of the buffer pool in megabytes. Setting to
+        zero should be interpreted as "no value" and will defer to the
+        lower level default.
+    type: number
+    default: 0
   NeutronBridgeMappings:
     description: >
       The OVS logical->physical bridge mappings to use. See the Neutron
@@ -131,6 +211,24 @@ parameters:
       scripts or be sure to keep 'datacentre' as a mapping network name.
     type: string
     default: "datacentre:br-ex"
+  NeutronControlPlaneID:
+    default: ''
+    type: string
+    description: Neutron ID for ctlplane network.
+  NeutronDnsmasqOptions:
+    default: 'dhcp-option-force=26,1400'
+    description: Dnsmasq options for neutron-dhcp-agent. The default value here forces MTU to be set to 1400 to account for the tunnel overhead.
+    type: string
+  NeutronFlatNetworks:
+    type: string
+    default: 'datacentre'
+    description: >
+      If set, flat networks to configure in neutron plugins. Defaults to
+      'datacentre' to permit external network creation.
+  NeutronNetworkType:
+    default: 'gre'
+    description: The tenant network type for Neutron, either gre or vxlan.
+    type: string
   NeutronNetworkVLANRanges:
     default: 'datacentre'
     description: >
@@ -143,66 +241,6 @@ parameters:
     description: The password for the neutron service account, used by neutron agents.
     type: string
     hidden: true
-  CeilometerComputeAgent:
-    description: Indicates whether the Compute agent is present and expects nova-compute to be configured accordingly
-    type: string
-    default: ''
-    constraints:
-    - allowed_values: ['', Present]
-  CeilometerMeteringSecret:
-    default: unset
-    description: Secret shared by the ceilometer services.
-    type: string
-    hidden: true
-  CeilometerPassword:
-    default: unset
-    description: The password for the ceilometer service account.
-    type: string
-    hidden: true
-  SnmpdReadonlyUserName:
-    default: ro_snmp_user
-    description: The user name for SNMPd with readonly rights running on all Overcloud nodes
-    type: string
-  SnmpdReadonlyUserPassword:
-    default: unset
-    description: The user password for SNMPd with readonly rights running on all Overcloud nodes
-    type: string
-    hidden: true
-  CloudName:
-    default: ''
-    description: The DNS name of this cloud. E.g. ci-overcloud.tripleo.org
-    type: string
-  NovaComputeDriver:
-    default: libvirt.LibvirtDriver
-    type: string
-  NovaComputeLibvirtType:
-    default: ''
-    type: string
-  NovaImage:
-    type: string
-    default: overcloud-compute
-  NovaPassword:
-    default: unset
-    description: The password for the nova service account, used by nova-api.
-    type: string
-    hidden: true
-  NeutronFlatNetworks:
-    type: string
-    default: 'datacentre'
-    description: >
-      If set, flat networks to configure in neutron plugins. Defaults to
-      'datacentre' to permit external network creation.
-  HypervisorNeutronPhysicalBridge:
-    default: 'br-ex'
-    description: >
-      An OVS bridge to create on each hypervisor. This defaults to br-ex the
-      same as the control plane nodes, as we have a uniform configuration of
-      the openvswitch agent. Typically should not need to be changed.
-    type: string
-  HypervisorNeutronPublicInterface:
-    default: 'eth0'
-    description: What interface to add to the HypervisorNeutronPhysicalBridge.
-    type: string
   NeutronPublicInterface:
     default: eth0
     description: What interface to bridge onto br-ex for network nodes.
@@ -215,6 +253,10 @@ parameters:
     default: ''
     description: A custom IP address to put onto the NeutronPublicInterface.
     type: string
+  NeutronPublicInterfaceRawDevice:
+    default: ''
+    description: If set, the public interface is a vlan with this device as the raw device.
+    type: string
   NeutronPublicInterfaceTag:
     default: ''
     description: >
@@ -225,88 +267,43 @@ parameters:
       overcloud.yaml to include the deployment of VLAN ports to the control
       plane.
     type: string
-  NeutronPublicInterfaceRawDevice:
-    default: ''
-    description: If set, the public interface is a vlan with this device as the raw device.
-    type: string
-  NeutronControlPlaneID:
-    default: ''
-    type: string
-    description: Neutron ID for ctlplane network.
-  NeutronDnsmasqOptions:
-    default: 'dhcp-option-force=26,1400'
-    description: Dnsmasq options for neutron-dhcp-agent. The default value here forces MTU to be set to 1400 to account for the tunnel overhead.
-    type: string
-  NeutronNetworkType:
-    default: 'gre'
-    description: The tenant network type for Neutron, either gre or vxlan.
-    type: string
   NeutronTunnelTypes:
     default: 'gre'
     description: |
         The tunnel types for the Neutron tenant network. To specify multiple
         values, use a comma separated string, like so: 'gre,vxlan'
     type: string
-  controllerImage:
+  NovaComputeDriver:
+    default: libvirt.LibvirtDriver
     type: string
-    default: overcloud-control
+  NovaComputeExtraConfig:
+    default: {}
+    description: |
+      NovaCompute specific configuration to inject into the cluster. Same
+      structure as ExtraConfig.
+    type: json
+  NovaComputeLibvirtType:
+    default: ''
+    type: string
+  NovaImage:
+    type: string
+    default: overcloud-compute
+  NovaPassword:
+    default: unset
+    description: The password for the nova service account, used by nova-api.
+    type: string
+    hidden: true
   NtpServer:
     type: string
     default: ''
-  RabbitUserName:
-    default: guest
-    description: The username for RabbitMQ
+  OvercloudComputeFlavor:
+    default: baremetal
+    description: Flavor for compute nodes to request when deploying.
     type: string
-  RabbitPassword:
-    default: guest
-    description: The password for RabbitMQ
+  OvercloudControlFlavor:
+    default: baremetal
+    description: Flavor for control nodes to request when deploying.
     type: string
-    hidden: true
-  RabbitCookieSalt:
-    type: string
-    default: unset
-    description: Salt for the rabbit cookie, change this to force the randomly generated rabbit cookie to change.
-  HeatStackDomainAdminPassword:
-    description: Password for heat_domain_admin user.
-    type: string
-    default: ''
-    hidden: true
-  LiveUpdateUserName:
-    type: string
-    description: The live-update username for the undercloud Glance API.
-    default: ''
-  LiveUpdateTenantName:
-    type: string
-    description: The live-update tenant name for the undercloud Glance API.
-    default: ''
-  LiveUpdateHost:
-    type: string
-    description: The IP address for the undercloud Glance API.
-    default: ''
-  LiveUpdatePassword:
-    type: string
-    default: ''
-    description: The live-update password for the undercloud Glance API.
-    hidden: true
-  LiveUpdateComputeImage:
-    type: string
-    description: The image ID for live-updates to the overcloud compute nodes.
-    default: ''
-  MysqlInnodbBufferPoolSize:
-    description: >
-        Specifies the size of the buffer pool in megabytes. Setting to
-        zero should be interpreted as "no value" and will defer to the
-        lower level default.
-    type: number
-    default: 0
-  ControlVirtualInterface:
-    default: 'br-ex'
-    description: Interface where virtual ip will be assigned.
-    type: string
-  ControlFixedIPs:
-    default: []
-    description: Should be used for arbitrary ips.
-    type: json
   PublicVirtualFixedIPs:
     default: []
     description: >
@@ -324,25 +321,28 @@ parameters:
     type: string
     description: >
         Neutron network to allocate public virtual IP port on.
-  KeystoneCACertificate:
-    default: ''
-    description: Keystone self-signed certificate authority certificate.
+  RabbitCookieSalt:
     type: string
-  KeystoneSigningCertificate:
-    default: ''
-    description: Keystone certificate for verifying token validity.
-    type: string
-  KeystoneSigningKey:
-    default: ''
-    description: Keystone key for signing tokens.
+    default: unset
+    description: Salt for the rabbit cookie, change this to force the randomly generated rabbit cookie to change.
+  RabbitPassword:
+    default: guest
+    description: The password for RabbitMQ
     type: string
     hidden: true
-  DefaultSignalTransport:
-    default: CFN_SIGNAL
-    description: Transport to use for software-config signals.
+  RabbitUserName:
+    default: guest
+    description: The username for RabbitMQ
     type: string
-    constraints:
-      - allowed_values: [ CFN_SIGNAL, HEAT_SIGNAL, NO_SIGNAL ]
+  SnmpdReadonlyUserName:
+    default: ro_snmp_user
+    description: The user name for SNMPd with readonly rights running on all Overcloud nodes
+    type: string
+  SnmpdReadonlyUserPassword:
+    default: unset
+    description: The user password for SNMPd with readonly rights running on all Overcloud nodes
+    type: string
+    hidden: true
 resources:
   ControlVirtualIP:
     type: OS::Neutron::Port
diff --git a/ssl-source.yaml b/ssl-source.yaml
index ac1ef42d3a..a03aac37e3 100644
--- a/ssl-source.yaml
+++ b/ssl-source.yaml
@@ -1,5 +1,9 @@
 description: 'ssl-source: SSL endpoint metadata for openstack'
 parameters:
+  SSLCACertificate:
+    default: ''
+    description: If set, the contents of an SSL certificate authority file.
+    type: string
   SSLCertificate:
     default: ''
     description: If set, the contents of an SSL certificate .crt file for encrypting SSL endpoints.
@@ -10,10 +14,6 @@ parameters:
     description: If set, the contents of an SSL certificate .key file for encrypting SSL endpoints.
     type: string
     hidden: true
-  SSLCACertificate:
-    default: ''
-    description: If set, the contents of an SSL certificate authority file.
-    type: string
 resources:
   SSLConfig:
     type: OS::Heat::StructuredConfig
diff --git a/swift-deploy.yaml b/swift-deploy.yaml
index 803861ee65..9c42684a03 100644
--- a/swift-deploy.yaml
+++ b/swift-deploy.yaml
@@ -5,23 +5,23 @@ parameters:
     description: A random string to be used as a salt when hashing to determine mappings in the ring.
     type: string
     hidden: true
+  SwiftMinPartHours:
+    type: number
+    default: 1
+    description: The minimum time (in hours) before a partition in a ring can be moved following a rebalance.
+  SwiftPartPower:
+    default: 10
+    description: Partition Power to use when building Swift rings
+    type: number
   SwiftPassword:
     default: unset
     description: The password for the swift service account, used by the swift proxy services.
     type: string
     hidden: true
-  SwiftPartPower:
-    default: 10
-    description: Partition Power to use when building Swift rings
-    type: number
   SwiftReplicas:
     type: number
     default: 1
     description: How many replicas to use in the swift rings.
-  SwiftMinPartHours:
-    type: number
-    default: 1
-    description: The minimum time (in hours) before a partition in a ring can be moved following a rebalance.
 resources:
   controller0Swift:
     type: OS::Heat::StructuredDeployment
diff --git a/swift-storage-source.yaml b/swift-storage-source.yaml
index 31addaff9a..fabb55457b 100644
--- a/swift-storage-source.yaml
+++ b/swift-storage-source.yaml
@@ -1,17 +1,17 @@
 heat_template_version: 2013-05-23
 description: 'Common Swift Storage Configuration'
 parameters:
-  SwiftStorageImage:
-    type: string
-    default: overcloud-swift-storage
-  SwiftReplicas:
-    type: number
-    default: 1
-    description: How many replicas to use in the swift rings.
   OvercloudSwiftStorageFlavor:
     default: baremetal
     description: Flavor for Swift storage nodes to request when deploying.
     type: string
+  SwiftReplicas:
+    type: number
+    default: 1
+    description: How many replicas to use in the swift rings.
+  SwiftStorageImage:
+    type: string
+    default: overcloud-swift-storage
 resources:
   SwiftStorage0:
     type: OS::Nova::Server
diff --git a/undercloud-source.yaml b/undercloud-source.yaml
index 8f041f9890..5ddf51b596 100644
--- a/undercloud-source.yaml
+++ b/undercloud-source.yaml
@@ -29,15 +29,12 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
-  SnmpdReadonlyUserName:
-    default: ro_snmp_user
-    description: The user name for SNMPd with readonly rights running on all Overcloud nodes
+  DefaultSignalTransport:
+    default: CFN_SIGNAL
+    description: Transport to use for software-config signals.
     type: string
-  SnmpdReadonlyUserPassword:
-    default: unset
-    description: The user password for SNMPd with readonly rights running on all Overcloud nodes
-    type: string
-    hidden: true
+    constraints:
+      - allowed_values: [ CFN_SIGNAL, HEAT_SIGNAL, NO_SIGNAL ]
   ExtraConfig:
     default: {}
     description: |
@@ -80,6 +77,15 @@ parameters:
     default: baremetal
     description: Flavor to request when deploying.
     type: string
+  GlanceLogFile:
+    description: The filepath of the file to use for logging messages from Glance.
+    type: string
+    default: ''
+  GlancePassword:
+    default: unset
+    description: The password for the glance service account, used by the glance services.
+    type: string
+    hidden: true
   GlancePort:
    default: 9292
    description: Glance port.
@@ -88,46 +94,54 @@ parameters:
    default: http
    description: Protocol to use when connecting to glance, set to https for SSL.
    type: string
-  GlancePassword:
-    default: unset
-    description: The password for the glance service account, used by the glance services.
-    type: string
-    hidden: true
   GlanceNotifierStrategy:
     description: Strategy to use for Glance notification queue
     type: string
     default: noop
-  GlanceLogFile:
-    description: The filepath of the file to use for logging messages from Glance.
-    type: string
-    default: ''
   KeyName:
     default: default
     description: Name of an existing EC2 KeyPair to enable SSH access to the instances
     type: string
+  KeystoneCACertificate:
+    default: ''
+    description: Keystone self-signed certificate authority certificate.
+    type: string
+  KeystoneSigningCertificate:
+    default: ''
+    description: Keystone certificate for verifying token validity.
+    type: string
+  KeystoneSigningKey:
+    default: ''
+    description: Keystone key for signing tokens.
+    type: string
+    hidden: true
   HeatPassword:
     default: unset
     description: The password for the Heat service account, used by the Heat services.
     type: string
     hidden: true
+  HeatStackDomainAdminPassword:
+    description: Password for heat_domain_admin user.
+    type: string
+    default: ''
+    hidden: true
   ImageUpdatePolicy:
     default: REBUILD_PRESERVE_EPHEMERAL
     description: What policy to use when reconstructing instances. REBUILD for rebuilds,
       REBUILD_PRESERVE_EPHEMERAL to preserve /mnt.
     type: string
-  undercloudImage:
-    default: undercloud
-    type: string
+  MysqlInnodbBufferPoolSize:
+    description: >
+        Specifies the size of the buffer pool in megabytes. Setting to
+        zero should be interpreted as "no value" and will defer to the
+        lower level default.
+    type: number
+    default: 0
   NeutronPassword:
     default: unset
     description: The password for the neutron service account, used by neutron agents.
     type: string
     hidden: true
-  NovaPassword:
-    default: unset
-    description: The password for the nova service account, used by nova-api.
-    type: string
-    hidden: true
   NeutronPublicInterfaceDefaultRoute:
     default: ''
     description: A custom default route for the NeutronPublicInterface.
@@ -140,6 +154,10 @@ parameters:
       NeutronPublicInterfaceIP is deprecated in the context of deploying
       underclouds - its only needed for the seed bootstrap process.
     type: string
+  NeutronPublicInterfaceRawDevice:
+    default: ''
+    description: If set, the public interface is a vlan with this device as the raw device.
+    type: string
   NeutronPublicInterfaceTag:
     default: ''
     description: >
@@ -147,13 +165,18 @@ parameters:
       create an access port on the exterior bridge, and that port will be
       given the IP address returned by neutron from the public network.
     type: string
-  NeutronPublicInterfaceRawDevice:
-    default: ''
-    description: If set, the public interface is a vlan with this device as the raw device.
+  NovaPassword:
+    default: unset
+    description: The password for the nova service account, used by nova-api.
     type: string
+    hidden: true
   NtpServer:
     type: string
     default: ''
+  RabbitCookieSalt:
+    type: string
+    default: unset
+    description: Salt for the rabbit cookie, change this to force the randomly generated rabbit cookie to change.
   RabbitUserName:
     default: guest
     description: The username for RabbitMQ
@@ -163,41 +186,18 @@ parameters:
     description: The password for RabbitMQ
     type: string
     hidden: true
-  RabbitCookieSalt:
+  SnmpdReadonlyUserName:
+    default: ro_snmp_user
+    description: The user name for SNMPd with readonly rights running on all Overcloud nodes
     type: string
+  SnmpdReadonlyUserPassword:
     default: unset
-    description: Salt for the rabbit cookie, change this to force the randomly generated rabbit cookie to change.
-  HeatStackDomainAdminPassword:
-    description: Password for heat_domain_admin user.
-    type: string
-    default: ''
-    hidden: true
-  MysqlInnodbBufferPoolSize:
-    description: >
-        Specifies the size of the buffer pool in megabytes. Setting to
-        zero should be interpreted as "no value" and will defer to the
-        lower level default.
-    type: number
-    default: 0
-  KeystoneCACertificate:
-    default: ''
-    description: Keystone self-signed certificate authority certificate.
-    type: string
-  KeystoneSigningCertificate:
-    default: ''
-    description: Keystone certificate for verifying token validity.
-    type: string
-  KeystoneSigningKey:
-    default: ''
-    description: Keystone key for signing tokens.
+    description: The user password for SNMPd with readonly rights running on all Overcloud nodes
     type: string
     hidden: true
-  DefaultSignalTransport:
-    default: CFN_SIGNAL
-    description: Transport to use for software-config signals.
+  undercloudImage:
+    default: undercloud
     type: string
-    constraints:
-      - allowed_values: [ CFN_SIGNAL, HEAT_SIGNAL, NO_SIGNAL ]
 resources:
   RabbitCookie:
     type: OS::Heat::RandomString
diff --git a/undercloud-vm-nova-deploy.yaml b/undercloud-vm-nova-deploy.yaml
index 7b13643c4b..c6278a1b8b 100644
--- a/undercloud-vm-nova-deploy.yaml
+++ b/undercloud-vm-nova-deploy.yaml
@@ -19,10 +19,6 @@ parameters:
     default: nova.virt.baremetal.virtual_power_driver.VirtualPowerManager
     description: Bare metal power manager driver.
     type: string
-  PxeDeployTimeout:
-    default: 2400
-    description: Timeout for PXE deployment of baremetal nodes
-    type: number
   PowerSSHHost:
     default: 192.168.122.1
     description: SSH host to ssh to for power management operations.
@@ -35,6 +31,10 @@ parameters:
     default: stack
     description: What username to ssh to the virtual power host with.
     type: string
+  PxeDeployTimeout:
+    default: 2400
+    description: Timeout for PXE deployment of baremetal nodes
+    type: number
 resources:
   undercloudNovaDeployment:
     type: OS::Heat::StructuredDeployment