diff --git a/firstboot/userdata_heat_admin.yaml b/firstboot/userdata_heat_admin.yaml
new file mode 100644
index 0000000000..73481c6337
--- /dev/null
+++ b/firstboot/userdata_heat_admin.yaml
@@ -0,0 +1,29 @@
+heat_template_version: 2014-10-16
+
+parameters:
+  # Can be overriden via parameter_defaults in the environment
+  node_admin_username:
+    type: string
+    default: heat-admin
+
+description: >
+  Uses cloud-init to create an additional user with a known name, in addition
+  to the distro-default user created by the cloud-init default.
+
+resources:
+  userdata:
+    type: OS::Heat::MultipartMime
+    properties:
+      parts:
+      - config: {get_resource: user_config}
+
+  # Note this requires cloud-init >= 0.7.2 ref bug #1100920
+  user_config:
+    type: OS::Heat::CloudConfig
+    properties:
+      cloud_config:
+        user: {get_param: node_admin_username}
+
+outputs:
+  OS::stack_id:
+    value: {get_resource: userdata}
diff --git a/overcloud-resource-registry-puppet.yaml b/overcloud-resource-registry-puppet.yaml
index 523e44771e..39d752f5ad 100644
--- a/overcloud-resource-registry-puppet.yaml
+++ b/overcloud-resource-registry-puppet.yaml
@@ -23,6 +23,10 @@ resource_registry:
   OS::TripleO::BootstrapNode::SoftwareConfig: puppet/bootstrap-config.yaml
   OS::TripleO::Tasks::PackageUpdate: extraconfig/tasks/yum_update.yaml
 
+  # This creates the "heat-admin" user for all OS images by default
+  # To disable, replace with firstboot/userdata_default.yaml
+  OS::TripleO::NodeAdminUserData: firstboot/userdata_heat_admin.yaml
+
   # Hooks for operator extra config
   # NodeUserData == Cloud-init additional user-data, e.g cloud-config
   # ControllerExtraConfigPre == Controller configuration pre service deployment
diff --git a/puppet/ceph-storage-puppet.yaml b/puppet/ceph-storage-puppet.yaml
index fcf4259f53..db73f03a05 100644
--- a/puppet/ceph-storage-puppet.yaml
+++ b/puppet/ceph-storage-puppet.yaml
@@ -66,9 +66,26 @@ resources:
       networks:
         - network: ctlplane
       user_data_format: SOFTWARE_CONFIG
-      user_data: {get_resource: NodeUserData}
+      user_data: {get_resource: UserData}
       name: {get_param: Hostname}
 
+  # Combine the NodeAdminUserData and NodeUserData mime archives
+  UserData:
+    type: OS::Heat::MultipartMime
+    properties:
+      parts:
+      - config: {get_resource: NodeAdminUserData}
+        type: multipart
+      - config: {get_resource: NodeUserData}
+        type: multipart
+
+  # Creates the "heat-admin" user if configured via the environment
+  # Should return a OS::Heat::MultipartMime reference via OS::stack_id
+  NodeAdminUserData:
+    type: OS::TripleO::NodeAdminUserData
+
+  # For optional operator additional userdata
+  # Should return a OS::Heat::MultipartMime reference via OS::stack_id
   NodeUserData:
     type: OS::TripleO::NodeUserData
 
diff --git a/puppet/cinder-storage-puppet.yaml b/puppet/cinder-storage-puppet.yaml
index 091d1f1b2b..403ce9cee6 100644
--- a/puppet/cinder-storage-puppet.yaml
+++ b/puppet/cinder-storage-puppet.yaml
@@ -120,9 +120,26 @@ resources:
       networks:
         - network: ctlplane
       user_data_format: SOFTWARE_CONFIG
-      user_data: {get_resource: NodeUserData}
+      user_data: {get_resource: UserData}
       name: {get_param: Hostname}
 
+  # Combine the NodeAdminUserData and NodeUserData mime archives
+  UserData:
+    type: OS::Heat::MultipartMime
+    properties:
+      parts:
+      - config: {get_resource: NodeAdminUserData}
+        type: multipart
+      - config: {get_resource: NodeUserData}
+        type: multipart
+
+  # Creates the "heat-admin" user if configured via the environment
+  # Should return a OS::Heat::MultipartMime reference via OS::stack_id
+  NodeAdminUserData:
+    type: OS::TripleO::NodeAdminUserData
+
+  # For optional operator additional userdata
+  # Should return a OS::Heat::MultipartMime reference via OS::stack_id
   NodeUserData:
     type: OS::TripleO::NodeUserData
 
diff --git a/puppet/compute-puppet.yaml b/puppet/compute-puppet.yaml
index 7966fd48a6..6648073c27 100644
--- a/puppet/compute-puppet.yaml
+++ b/puppet/compute-puppet.yaml
@@ -260,9 +260,26 @@ resources:
       networks:
         - network: ctlplane
       user_data_format: SOFTWARE_CONFIG
-      user_data: {get_resource: NodeUserData}
+      user_data: {get_resource: UserData}
       name: {get_param: Hostname}
 
+  # Combine the NodeAdminUserData and NodeUserData mime archives
+  UserData:
+    type: OS::Heat::MultipartMime
+    properties:
+      parts:
+      - config: {get_resource: NodeAdminUserData}
+        type: multipart
+      - config: {get_resource: NodeUserData}
+        type: multipart
+
+  # Creates the "heat-admin" user if configured via the environment
+  # Should return a OS::Heat::MultipartMime reference via OS::stack_id
+  NodeAdminUserData:
+    type: OS::TripleO::NodeAdminUserData
+
+  # For optional operator additional userdata
+  # Should return a OS::Heat::MultipartMime reference via OS::stack_id
   NodeUserData:
     type: OS::TripleO::NodeUserData
 
diff --git a/puppet/controller-puppet.yaml b/puppet/controller-puppet.yaml
index 296388afee..ce33d1c58d 100644
--- a/puppet/controller-puppet.yaml
+++ b/puppet/controller-puppet.yaml
@@ -528,9 +528,26 @@ resources:
       networks:
         - network: ctlplane
       user_data_format: SOFTWARE_CONFIG
-      user_data: {get_resource: NodeUserData}
+      user_data: {get_resource: UserData}
       name: {get_param: Hostname}
 
+  # Combine the NodeAdminUserData and NodeUserData mime archives
+  UserData:
+    type: OS::Heat::MultipartMime
+    properties:
+      parts:
+      - config: {get_resource: NodeAdminUserData}
+        type: multipart
+      - config: {get_resource: NodeUserData}
+        type: multipart
+
+  # Creates the "heat-admin" user if configured via the environment
+  # Should return a OS::Heat::MultipartMime reference via OS::stack_id
+  NodeAdminUserData:
+    type: OS::TripleO::NodeAdminUserData
+
+  # For optional operator additional userdata
+  # Should return a OS::Heat::MultipartMime reference via OS::stack_id
   NodeUserData:
     type: OS::TripleO::NodeUserData
 
diff --git a/puppet/swift-storage-puppet.yaml b/puppet/swift-storage-puppet.yaml
index b357942954..5ed63bb20d 100644
--- a/puppet/swift-storage-puppet.yaml
+++ b/puppet/swift-storage-puppet.yaml
@@ -89,9 +89,26 @@ resources:
       networks:
         - network: ctlplane
       user_data_format: SOFTWARE_CONFIG
-      user_data: {get_resource: NodeUserData}
+      user_data: {get_resource: UserData}
       name: {get_param: Hostname}
 
+  # Combine the NodeAdminUserData and NodeUserData mime archives
+  UserData:
+    type: OS::Heat::MultipartMime
+    properties:
+      parts:
+      - config: {get_resource: NodeAdminUserData}
+        type: multipart
+      - config: {get_resource: NodeUserData}
+        type: multipart
+
+  # Creates the "heat-admin" user if configured via the environment
+  # Should return a OS::Heat::MultipartMime reference via OS::stack_id
+  NodeAdminUserData:
+    type: OS::TripleO::NodeAdminUserData
+
+  # For optional operator additional userdata
+  # Should return a OS::Heat::MultipartMime reference via OS::stack_id
   NodeUserData:
     type: OS::TripleO::NodeUserData