diff --git a/ansible/roles/kolla-ansible/templates/globals.yml.j2 b/ansible/roles/kolla-ansible/templates/globals.yml.j2
index 97a966e59..472cb6d72 100644
--- a/ansible/roles/kolla-ansible/templates/globals.yml.j2
+++ b/ansible/roles/kolla-ansible/templates/globals.yml.j2
@@ -117,10 +117,6 @@ neutron_bridge_name: "{{ kolla_neutron_bridge_names | join(',') }}"
 # control plane.
 bifrost_network_interface: "{{ kolla_bifrost_network_interface }}"
 
-# This is the interface to use for bare metal provisioning. It is not a
-# standard kolla variable.
-provision_interface: "{{ kolla_provision_interface }}"
-
 # Interface on which the inspector dnsmasq service listens.
 ironic_dnsmasq_interface: "{{ kolla_inspector_dnsmasq_interface }}"
 
diff --git a/ansible/roles/kolla-ansible/tests/test-defaults.yml b/ansible/roles/kolla-ansible/tests/test-defaults.yml
index de0c4f804..9a430aca6 100644
--- a/ansible/roles/kolla-ansible/tests/test-defaults.yml
+++ b/ansible/roles/kolla-ansible/tests/test-defaults.yml
@@ -90,7 +90,6 @@
               neutron_external_interface: "eth6,eth7"
               neutron_bridge_name: "br0,br1"
               bifrost_network_interface: "eth8"
-              provision_interface: "eth9"
               ironic_dnsmasq_interface: "eth10"
               neutron_plugin_agent: "openvswitch"
               kolla_enable_tls_external: False
diff --git a/ansible/roles/kolla-ansible/tests/test-extras.yml b/ansible/roles/kolla-ansible/tests/test-extras.yml
index 2a93f134c..5b8240887 100644
--- a/ansible/roles/kolla-ansible/tests/test-extras.yml
+++ b/ansible/roles/kolla-ansible/tests/test-extras.yml
@@ -184,7 +184,6 @@
               neutron_external_interface: "eth6,eth7"
               neutron_bridge_name: "br0,br1"
               bifrost_network_interface: "eth8"
-              provision_interface: "eth9"
               ironic_dnsmasq_interface: "eth10"
               neutron_plugin_agent: "openvswitch"
               kolla_enable_tls_external: False
diff --git a/ansible/roles/kolla-openstack/templates/ironic-dnsmasq.conf.j2 b/ansible/roles/kolla-openstack/templates/ironic-dnsmasq.conf.j2
index 7a8dda9b8..5bf19b696 100644
--- a/ansible/roles/kolla-openstack/templates/ironic-dnsmasq.conf.j2
+++ b/ansible/roles/kolla-openstack/templates/ironic-dnsmasq.conf.j2
@@ -4,9 +4,9 @@ interface={% raw %}{{ ironic_dnsmasq_interface }}{% endraw %}
 bind-interfaces
 dhcp-range={{ kolla_inspector_dhcp_pool_start }},{{ kolla_inspector_dhcp_pool_end }},12h
 dhcp-sequential-ip
-dhcp-option=option:tftp-server,{% raw %}{{ hostvars[inventory_hostname]['ansible_' ~ provision_interface | replace('-', '_')]['ipv4']['address'] }}{% endraw %}
+dhcp-option=option:tftp-server,{% raw %}{{ hostvars[inventory_hostname]['ansible_' ~ api_interface | replace('-', '_')]['ipv4']['address'] }}{% endraw %}
 
-dhcp-option=option:server-ip-address,{% raw %}{{ hostvars[inventory_hostname]['ansible_' ~ provision_interface | replace('-', '_')]['ipv4']['address'] }}{% endraw %}
+dhcp-option=option:server-ip-address,{% raw %}{{ hostvars[inventory_hostname]['ansible_' ~ api_interface | replace('-', '_')]['ipv4']['address'] }}{% endraw %}
 
 {% if kolla_inspector_default_gateway %}
 dhcp-option=3,{{ kolla_inspector_default_gateway }}
diff --git a/ansible/roles/kolla-openstack/templates/ironic.conf.j2 b/ansible/roles/kolla-openstack/templates/ironic.conf.j2
index 03e9310e9..0b8bbd026 100644
--- a/ansible/roles/kolla-openstack/templates/ironic.conf.j2
+++ b/ansible/roles/kolla-openstack/templates/ironic.conf.j2
@@ -37,7 +37,7 @@ pxe_append_params = {{ kolla_ironic_pxe_append_params | join(',') }}
 {% endif %}
 
 {% raw %}
-tftp_server = {{ hostvars[inventory_hostname]['ansible_' + provision_interface | replace('-', '_')]['ipv4']['address'] }}
+tftp_server = {{ hostvars[inventory_hostname]['ansible_' + api_interface | replace('-', '_')]['ipv4']['address'] }}
 {% endraw %}
 
 {% if kolla_extra_ironic %}
diff --git a/releasenotes/notes/tftp-listen-on-internal-interface-09aeec7ad99fc13d.yaml b/releasenotes/notes/tftp-listen-on-internal-interface-09aeec7ad99fc13d.yaml
new file mode 100644
index 000000000..9d69696cf
--- /dev/null
+++ b/releasenotes/notes/tftp-listen-on-internal-interface-09aeec7ad99fc13d.yaml
@@ -0,0 +1,3 @@
+---
+upgrade:
+  - Ironic is now configured to use the internal network to reach the TFTP server (by default).