diff --git a/pkg/manager/component/component.go b/pkg/manager/component/component.go
index 9ecc2feab..c84c40e5d 100644
--- a/pkg/manager/component/component.go
+++ b/pkg/manager/component/component.go
@@ -35,7 +35,6 @@ import (
 	"k8s.io/client-go/tools/cache"
 	"k8s.io/klog"
 
-	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
 	errorswrap "yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/utils"
@@ -49,6 +48,7 @@ import (
 	"yunion.io/x/onecloud-operator/pkg/manager"
 	"yunion.io/x/onecloud-operator/pkg/service-init/component"
 	"yunion.io/x/onecloud-operator/pkg/util/k8sutil"
+	"yunion.io/x/onecloud-operator/pkg/util/onecloud"
 )
 
 type ComponentManager struct {
@@ -638,7 +638,7 @@ func (m *ComponentManager) newConfigMap(componentType v1alpha1.ComponentType, zo
 }
 
 func (m *ComponentManager) newServiceConfigMap(cType v1alpha1.ComponentType, zone string, oc *v1alpha1.OnecloudCluster, opt interface{}) *corev1.ConfigMap {
-	configYaml := jsonutils.Marshal(opt).YAMLString()
+	configYaml := onecloud.GetConfig(opt).YAMLString()
 	return m.newConfigMap(cType, zone, oc, configYaml)
 }
 
diff --git a/pkg/manager/component/utils.go b/pkg/manager/component/utils.go
index e8429355c..fe4fe81e5 100644
--- a/pkg/manager/component/utils.go
+++ b/pkg/manager/component/utils.go
@@ -18,6 +18,9 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"path"
+	"reflect"
+
 	"github.com/pkg/errors"
 	apps "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1beta1"
@@ -29,8 +32,6 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 	clientset "k8s.io/client-go/kubernetes"
 	"k8s.io/klog"
-	"path"
-	"reflect"
 
 	"yunion.io/x/onecloud-operator/pkg/apis/constants"
 	"yunion.io/x/onecloud-operator/pkg/apis/onecloud/v1alpha1"
diff --git a/pkg/service-init/component/apigateway.go b/pkg/service-init/component/apigateway.go
index 9a7c92f06..eb951d09b 100644
--- a/pkg/service-init/component/apigateway.go
+++ b/pkg/service-init/component/apigateway.go
@@ -46,6 +46,14 @@ func (a apiGateway) GetConfig(oc *v1alpha1.OnecloudCluster, cfg *v1alpha1.Oneclo
 
 	return opt, nil
 }
+
+func (a apiGateway) GetServiceInitConfig(oc *v1alpha1.OnecloudCluster) map[string]interface{} {
+	return map[string]interface{}{
+		"ws_port":    constants.APIWebsocketPort,
+		"cors_hosts": oc.Spec.APIGateway.CorsHosts,
+	}
+}
+
 func (a apiGateway) GetDefaultCloudUser(cfg *v1alpha1.OnecloudClusterConfig) *v1alpha1.CloudUser {
 	return &cfg.APIGateway.CloudUser
 }
diff --git a/pkg/service-init/component/base_service.go b/pkg/service-init/component/base_service.go
index 06859edb1..12f7ceee9 100644
--- a/pkg/service-init/component/base_service.go
+++ b/pkg/service-init/component/base_service.go
@@ -42,6 +42,10 @@ func (bs baseService) GetOptions() interface{} {
 	return bs.options
 }
 
+func (c baseService) GetServiceInitConfig(oc *v1alpha1.OnecloudCluster) map[string]interface{} {
+	return map[string]interface{}{}
+}
+
 func (c baseService) GetConfig(oc *v1alpha1.OnecloudCluster, cfg *v1alpha1.OnecloudClusterConfig) (interface{}, error) {
 	return nil, nil
 }
diff --git a/pkg/service-init/component/component.go b/pkg/service-init/component/component.go
index 61e845616..ebbd1f11e 100644
--- a/pkg/service-init/component/component.go
+++ b/pkg/service-init/component/component.go
@@ -23,6 +23,7 @@ type Component interface {
 	BuildClusterConfigCloudUser(clsCfg *v1alpha1.OnecloudClusterConfig, user v1alpha1.CloudUser) error
 
 	GetConfig(oc *v1alpha1.OnecloudCluster, cfg *v1alpha1.OnecloudClusterConfig) (interface{}, error)
+	GetServiceInitConfig(oc *v1alpha1.OnecloudCluster) map[string]interface{}
 	GetOptions() interface{}
 	GetDefaultDBConfig(cfg *v1alpha1.OnecloudClusterConfig) *v1alpha1.DBConfig
 	GetDefaultClickhouseConfig(cfg *v1alpha1.OnecloudClusterConfig) *v1alpha1.DBConfig
diff --git a/pkg/service-init/component/glance.go b/pkg/service-init/component/glance.go
index f479ecaf2..f97036ef5 100644
--- a/pkg/service-init/component/glance.go
+++ b/pkg/service-init/component/glance.go
@@ -55,21 +55,23 @@ func (g glance) GetConfig(oc *v1alpha1.OnecloudCluster, cfg *v1alpha1.OnecloudCl
 	option.SetClickhouseOptions(&opt.DBOptions, oc.Spec.Clickhouse, config.ClickhouseConf)
 	option.SetOptionsServiceTLS(&opt.BaseOptions, false)
 	option.SetServiceCommonOptions(&opt.CommonOptions, oc, config.ServiceDBCommonOptions.ServiceCommonOptions)
-
-	opt.FilesystemStoreDatadir = constants.GlanceFileStoreDir
-	//opt.TorrentStoreDir = constants.GlanceTorrentStoreDir
-	opt.EnableTorrentService = false
 	// TODO: fix this
 	opt.AutoSyncTable = true
 	opt.Port = config.Port
+	return opt, nil
+}
 
+func (g glance) GetServiceInitConfig(oc *v1alpha1.OnecloudCluster) map[string]interface{} {
+	ret := map[string]interface{}{
+		"filesystem_store_datadir": constants.GlanceFileStoreDir,
+		"enable_torrent_service":   false,
+		"enable_remote_executor":   true,
+	}
 	if oc.Spec.ProductVersion == v1alpha1.ProductVersionCMP {
-		opt.EnableRemoteExecutor = false
-		opt.TargetImageFormats = []string{"qcow2", "vmdk"}
-	} else {
-		opt.EnableRemoteExecutor = true
+		ret["enable_remote_executor"] = false
+		ret["target_image_formats"] = []string{"qcow2", "vmdk"}
 	}
-	return opt, nil
+	return ret
 }
 
 func (g glance) GetPhaseControl(man controller.ComponentManager) controller.PhaseControl {
diff --git a/pkg/service-init/component/keystone.go b/pkg/service-init/component/keystone.go
index 0132dae9b..f96fbe777 100644
--- a/pkg/service-init/component/keystone.go
+++ b/pkg/service-init/component/keystone.go
@@ -58,14 +58,20 @@ func (k keystone) GetConfig(oc *v1alpha1.OnecloudCluster, cfg *v1alpha1.Onecloud
 	option.SetOptionsServiceTLS(&opt.BaseOptions, oc.Spec.Keystone.DisableTLS)
 	option.SetServiceBaseOptions(&opt.BaseOptions, oc.GetRegion(), config.ServiceBaseConfig)
 
-	opt.BootstrapAdminUserPassword = oc.Spec.Keystone.BootstrapPassword
-	// always reset admin user password to ensure password is correct
-	opt.ResetAdminUserPassword = true
 	opt.AdminPort = constants.KeystoneAdminPort
 
 	return opt, nil
 }
 
+func (k keystone) GetServiceInitConfig(oc *v1alpha1.OnecloudCluster) map[string]interface{} {
+	ret := map[string]interface{}{
+		"bootstrap_admin_user_password": oc.Spec.Keystone.BootstrapPassword,
+		// always reset admin user password to ensure password is correct
+		"ResetAdminUserPassword": true,
+	}
+	return ret
+}
+
 func (k keystone) GetDefaultDBConfig(cfg *v1alpha1.OnecloudClusterConfig) *v1alpha1.DBConfig {
 	return &cfg.Keystone.DB
 }
diff --git a/pkg/service-init/component/kubeserver.go b/pkg/service-init/component/kubeserver.go
index ec74fc75d..b9223d575 100644
--- a/pkg/service-init/component/kubeserver.go
+++ b/pkg/service-init/component/kubeserver.go
@@ -73,6 +73,7 @@ func (r kubeServer) GetConfig(oc *v1alpha1.OnecloudCluster, cfg *v1alpha1.Oneclo
 
 	return opt, nil
 }
+
 func (r kubeServer) GetPhaseControl(man controller.ComponentManager) controller.PhaseControl {
 	return man.KubeServer(nil)
 }
diff --git a/pkg/service-init/component/notify.go b/pkg/service-init/component/notify.go
index 842029920..d1269d77b 100644
--- a/pkg/service-init/component/notify.go
+++ b/pkg/service-init/component/notify.go
@@ -45,6 +45,7 @@ func (r notify) GetDefaultClickhouseConfig(cfg *v1alpha1.OnecloudClusterConfig)
 func (r notify) GetDefaultCloudUser(cfg *v1alpha1.OnecloudClusterConfig) *v1alpha1.CloudUser {
 	return &cfg.Notify.CloudUser
 }
+
 func (r notify) GetConfig(oc *v1alpha1.OnecloudCluster, cfg *v1alpha1.OnecloudClusterConfig) (interface{}, error) {
 	opt := &options.Options
 	if err := option.SetOptionsDefault(opt, constants.ServiceTypeNotify); err != nil {
diff --git a/pkg/service-init/component/prepare.go b/pkg/service-init/component/prepare.go
index 1e69aad19..ee3a8272e 100644
--- a/pkg/service-init/component/prepare.go
+++ b/pkg/service-init/component/prepare.go
@@ -14,6 +14,7 @@ import (
 	"yunion.io/x/onecloud-operator/pkg/controller"
 	"yunion.io/x/onecloud-operator/pkg/manager/config"
 	"yunion.io/x/onecloud-operator/pkg/service-init/cluster"
+	"yunion.io/x/onecloud-operator/pkg/util/onecloud"
 )
 
 type PrepareManager interface {
@@ -283,7 +284,7 @@ func (m *prepareManager) syncComponentConfig(
 	case string:
 		optContent = opt.(string)
 	default:
-		optContent = jsonutils.Marshal(opt).YAMLString()
+		optContent = onecloud.GetConfig(opt).YAMLString()
 	}
 	if err := os.WriteFile(
 		cfgFilePath,
diff --git a/pkg/service-init/component/webconsole.go b/pkg/service-init/component/webconsole.go
index 227b72834..4da89074c 100644
--- a/pkg/service-init/component/webconsole.go
+++ b/pkg/service-init/component/webconsole.go
@@ -2,6 +2,7 @@ package component
 
 import (
 	"fmt"
+
 	"yunion.io/x/onecloud-operator/pkg/apis/constants"
 	"yunion.io/x/onecloud-operator/pkg/controller"
 	"yunion.io/x/onecloud-operator/pkg/util/option"
@@ -44,8 +45,6 @@ func (r webconsole) GetConfig(oc *v1alpha1.OnecloudCluster, cfg *v1alpha1.Oneclo
 	option.SetOptionsServiceTLS(&opt.BaseOptions, false)
 	option.SetServiceCommonOptions(&opt.CommonOptions, oc, config.ServiceCommonOptions)
 
-	opt.IpmitoolPath = "/usr/sbin/ipmitool"
-	opt.EnableAutoLogin = true
 	address := oc.Spec.LoadBalancerEndpoint
 	opt.Port = constants.WebconsolePort
 	// opt.ApiServer = fmt.Sprintf("https://%s:%d", address, constants.WebconsolePort)
@@ -54,6 +53,13 @@ func (r webconsole) GetConfig(oc *v1alpha1.OnecloudCluster, cfg *v1alpha1.Oneclo
 	return opt, nil
 }
 
+func (r webconsole) GetServiceInitConfig(oc *v1alpha1.OnecloudCluster) map[string]interface{} {
+	return map[string]interface{}{
+		"ipmitool_path":     "/usr/sbin/ipmitool",
+		"enable_auto_login": true,
+	}
+}
+
 func (w webconsole) GetDefaultDBConfig(cfg *v1alpha1.OnecloudClusterConfig) *v1alpha1.DBConfig {
 	return &cfg.Webconsole.DB
 }
diff --git a/pkg/util/onecloud/onecloud.go b/pkg/util/onecloud/onecloud.go
index 7fcd48ddb..787011122 100644
--- a/pkg/util/onecloud/onecloud.go
+++ b/pkg/util/onecloud/onecloud.go
@@ -15,7 +15,9 @@
 package onecloud
 
 import (
+	"context"
 	"net/http"
+	"reflect"
 	"strings"
 
 	"golang.org/x/sync/errgroup"
@@ -24,11 +26,14 @@ import (
 	"yunion.io/x/log"
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/httputils"
+	"yunion.io/x/pkg/utils"
 
 	ansibleapi "yunion.io/x/onecloud/pkg/apis/ansible"
 	devtoolapi "yunion.io/x/onecloud/pkg/apis/devtool"
+	identityapi "yunion.io/x/onecloud/pkg/apis/identity"
 	monitorapi "yunion.io/x/onecloud/pkg/apis/monitor"
 	"yunion.io/x/onecloud/pkg/mcclient"
+	"yunion.io/x/onecloud/pkg/mcclient/auth"
 	"yunion.io/x/onecloud/pkg/mcclient/modulebase"
 	ansible_modules "yunion.io/x/onecloud/pkg/mcclient/modules/ansible"
 	"yunion.io/x/onecloud/pkg/mcclient/modules/compute"
@@ -888,3 +893,39 @@ func EnsureAgentAnsiblePlaybookRef(s *mcclient.ClientSession) error {
 	}
 	return nil
 }
+
+func GetConfig(opt interface{}) jsonutils.JSONObject {
+	config := jsonutils.Marshal(opt)
+	options, ok := config.(*jsonutils.JSONDict)
+	if !ok {
+		return config
+	}
+	rv := reflect.Indirect(reflect.ValueOf(opt))
+	if !(rv.FieldByName("CommonOptions").IsValid() ||
+		(rv.FieldByName("DBOptions").IsValid() && rv.FieldByName("BaseOptions").IsValid())) { // keystone
+		return config
+	}
+	for _, k := range options.SortedKeys() {
+		if !utils.IsInArray(k, identityapi.ServiceBlacklistOptionMap["default"]) {
+			options.Remove(k)
+		}
+	}
+	return options
+}
+
+func InitServiceConfig(service, region string, opts map[string]interface{}) error {
+	s := auth.GetAdminSession(context.Background(), region)
+	resp, err := identity.ServicesV3.GetSpecific(s, service, "config", nil)
+	if err != nil {
+		return errors.Wrapf(err, "get spec")
+	}
+	values := jsonutils.NewDict()
+	for k, v := range opts {
+		if resp.Contains("config", "default", k) {
+			continue
+		}
+		values.Add(jsonutils.Marshal(v), "config", "default", k)
+	}
+	_, err = identity.ServicesV3.PerformAction(s, service, "config", values)
+	return err
+}