diff --git a/charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml b/charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml
index 887e84536..53c074012 100644
--- a/charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml
+++ b/charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml
@@ -75,6 +75,10 @@ spec:
                               infra-readwrite)
                                 openstack role add --user "${SVC_ID}" --project-domain infra --project baremetal admin
                                 ;;
+                              system-readwrite)
+                                openstack role add --user "${SVC_ID}" --system all reader
+                                openstack role add --user "${SVC_ID}" --system all member
+                                ;;
                               *)
                                 echo "Invalid role ${svc_role}"
                                 ;;
diff --git a/components/openstack/templates/automation-infrasetup-system.yaml.tpl b/components/openstack/templates/automation-infrasetup-system.yaml.tpl
new file mode 100644
index 000000000..086216ab9
--- /dev/null
+++ b/components/openstack/templates/automation-infrasetup-system.yaml.tpl
@@ -0,0 +1,46 @@
+---
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: "infrasetup-system-{{ .Values.regionName }}"
+spec:
+  length: 32
+  digits: 6
+  symbols: 6
+  symbolCharacters: "~!@#$%^*()_+-={}[]<>?"
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: "infrasetup-system-{{ .Values.regionName }}"
+spec:
+  refreshInterval: 20160m
+  target:
+    name: infrasetup-system
+    template:
+      engineVersion: v2
+      type: Opaque
+      metadata:
+        labels:
+          understack.rackspace.com/keystone-role: system-readwrite
+          understack.rackspace.com/keystone-user: "infrasetup-system-{{ .Values.regionName }}"
+      data:
+        password: "{{ `{{ .password }}` }}"
+        clouds.yaml: |
+          clouds:
+            understack:
+              auth:
+                auth_url: "{{ .Values.keystoneUrl }}"
+                user_domain_name: "service"
+                username: "infrasetup-system-{{ .Values.regionName }}"
+                password: "{{ `{{ .password }}` }}"
+                system_scope: "all"
+              region_name: "{{ .Values.regionName }}"
+              interface: "public"
+              identity_api_version: 3
+  dataFrom:
+  - sourceRef:
+      generatorRef:
+        apiVersion: generators.external-secrets.io/v1alpha1
+        kind: Password
+        name: "infrasetup-system-{{ .Values.regionName }}"