diff --git a/contrail/environment/modules/contrail/hiera.yaml b/contrail/environment/modules/contrail/hiera.yaml
new file mode 100644
index 00000000..48cd7ff9
--- /dev/null
+++ b/contrail/environment/modules/contrail/hiera.yaml
@@ -0,0 +1,6 @@
+:hierarchy:
+  - common
+:backends:
+  - yaml
+:yaml:
+:datadir: 'hieradata'
diff --git a/contrail/environment/modules/contrail/hieradata/common.yaml b/contrail/environment/modules/contrail/hieradata/common.yaml
new file mode 100644
index 00000000..86a6e83b
--- /dev/null
+++ b/contrail/environment/modules/contrail/hieradata/common.yaml
@@ -0,0 +1,3 @@
+---
+cmon_db_pwd: cmon
+keystone_db_pwd: keystone
diff --git a/contrail/environment/modules/contrail/manifests/ha_config.pp b/contrail/environment/modules/contrail/manifests/ha_config.pp
index 83508160..b290e663 100644
--- a/contrail/environment/modules/contrail/manifests/ha_config.pp
+++ b/contrail/environment/modules/contrail/manifests/ha_config.pp
@@ -117,9 +117,9 @@
         }
 
         $cmon_db_user = "cmon"
-        $cmon_db_pass = "cmon"
+        $cmon_db_pass = hiera('cmon_db_pwd')
         $keystone_db_user = "keystone"
-        $keystone_db_pass = "keystone"
+        $keystone_db_pass = hiera('keystone_db_pwd')
         # Hard-coded to true because this code runs only when internal vip is defined
         $monitor_galera="True"