diff --git a/contrail/environment/modules/contrail/manifests/profile/openstack/heat.pp b/contrail/environment/modules/contrail/manifests/profile/openstack/heat.pp
index 5dcbda0b..aac322e5 100644
--- a/contrail/environment/modules/contrail/manifests/profile/openstack/heat.pp
+++ b/contrail/environment/modules/contrail/manifests/profile/openstack/heat.pp
@@ -2,7 +2,9 @@
 # The puppet module to set up openstack::heat for contrail
 #
 #
-class contrail::profile::openstack::heat () {
+class contrail::profile::openstack::heat (
+  $heat_auth_encryption_key = $::openstack::config::heat_encryption_key
+) {
     openstack::resources::controller { 'heat': }
     openstack::resources::database { 'heat': }
     openstack::resources::firewall { 'Heat API': port     => '8004', }
@@ -65,7 +67,7 @@
     }
 
     class { '::heat::engine':
-      auth_encryption_key => $::openstack::config::heat_encryption_key,
+      auth_encryption_key => $heat_auth_encryption_key
     }
 
     $contrail_api_server = $::contrail::params::config_ip_to_use
diff --git a/contrail/environment/modules/openstack/manifests/init.pp b/contrail/environment/modules/openstack/manifests/init.pp
index da08afc9..d8f60d66 100644
--- a/contrail/environment/modules/openstack/manifests/init.pp
+++ b/contrail/environment/modules/openstack/manifests/init.pp
@@ -179,6 +179,7 @@
 #
 # [*heat_encryption_key*]
 #   The encyption key for the shared heat services.
+#   Defaults to "notgood but just long enough i think"
 #
 # == Horizon
 # [*horizon_secret_key*]
@@ -283,7 +284,7 @@
   $ceilometer_password = undef,
   $ceilometer_meteringsecret = undef,
   $heat_password = undef,
-  $heat_encryption_key = undef,
+  $heat_encryption_key = "notgood but just long enough i think",
   $horizon_secret_key = undef,
   $tempest_configure_images    = undef,
   $tempest_image_name          = undef,
@@ -348,7 +349,7 @@
       ceilometer_password           => hiera(openstack::ceilometer::password),
       ceilometer_meteringsecret     => hiera(openstack::ceilometer::meteringsecret),
       heat_password                 => hiera(openstack::heat::password),
-      heat_encryption_key           => hiera(openstack::heat::encryption_key),
+      heat_encryption_key           => hiera(openstack::heat::encryption_key, $heat_encryption_key),
       horizon_secret_key            => hiera(openstack::horizon::secret_key),
       verbose                       => hiera(openstack::verbose),
       debug                         => hiera(openstack::debug),