diff --git a/.kitchen.yml b/.kitchen.yml
index c3e27e9..418d93e 100644
--- a/.kitchen.yml
+++ b/.kitchen.yml
@@ -32,11 +32,7 @@
         "*":
           - linux_repo_openstack
           - nova
-    nova:
-      controller:
-        version: <%= ENV['OS_VERSION'] || 'mitaka' %>
-      compute:
-        version: <%= ENV['OS_VERSION'] || 'mitaka' %>
+          - release
   pillars-from-files:
     linux_repo_openstack.sls: tests/pillar/repo_mcp_openstack_<%= ENV['OS_VERSION'] || 'mitaka' %>.sls
 
@@ -56,10 +52,20 @@
     provisioner:
       pillars-from-files:
         nova.sls: tests/pillar/compute_cluster.sls
+      pillars:
+        release.sls:
+          nova:
+            compute:
+              version: <%= ENV['OS_VERSION'] || 'mitaka' %>
 
   - name: control_cluster
     provisioner:
       pillars-from-files:
         nova.sls: tests/pillar/control_cluster.sls
+      pillars:
+        release.sls:
+          nova:
+            controller:
+              version: <%= ENV['OS_VERSION'] || 'mitaka' %>
 
 # vim: ft=yaml sw=2 ts=2 sts=2 tw=125
diff --git a/README.rst b/README.rst
index 1ae8d07..a1f929c 100644
--- a/README.rst
+++ b/README.rst
@@ -440,6 +440,21 @@
       workaround:
         disable_libvirt_livesnapshot: False
 
+Config drive options
+--------------------
+
+See example below on how to configure the options for the config drive.
+
+.. code-block:: yaml
+
+  nova:
+    compute:
+      config_drive:
+        forced: True  # Default: True
+        cdrom: True  # Default: False
+        format: iso9660  # Default: vfat
+        inject_password: False  # Default: False
+
 
 Documentation and Bugs
 ======================
diff --git a/nova/compute.sls b/nova/compute.sls
index b2d0142..226df97 100644
--- a/nova/compute.sls
+++ b/nova/compute.sls
@@ -1,5 +1,6 @@
 {%- from "nova/map.jinja" import compute with context %}
-{%- if compute.enabled %}
+
+{%- if compute.get('enabled') %}
 
 nova_compute_packages:
   pkg.installed:
@@ -63,7 +64,7 @@
 
 {%- endif %}
 
-{%- if pillar.nova.controller is not defined %}
+{%- if not pillar.nova.get('controller',{}).get('enabled') %}
 /etc/nova/nova.conf:
   file.managed:
   - source: salt://nova/files/{{ compute.version }}/nova-compute.conf.{{ grains.os_family }}
diff --git a/nova/controller.sls b/nova/controller.sls
index d6df274..664cb2b 100644
--- a/nova/controller.sls
+++ b/nova/controller.sls
@@ -1,6 +1,6 @@
 {% from "nova/map.jinja" import controller with context %}
 
-{%- if controller.enabled %}
+{%- if controller.get('enabled') %}
 
 {%- if grains.os_family == 'Debian' %}
 debconf-set-prerequisite:
@@ -69,6 +69,20 @@
   - require:
     - pkg: nova_controller_packages
 
+{% if controller.get('policy', {}) and controller.version not in ['liberty', 'mitaka', 'newton'] %}
+{# nova no longer ships with a default policy.json #}
+
+/etc/nova/policy.json:
+  file.managed:
+    - contents: '{}'
+    - replace: False
+    - user: nova
+    - group: nova
+    - require:
+      - pkg: nova_controller_packages
+
+{% endif %}
+
 {%- for name, rule in controller.get('policy', {}).iteritems() %}
 
 {%- if rule != None %}
@@ -79,6 +93,9 @@
   - rule: {{ rule }}
   - require:
     - pkg: nova_controller_packages
+    {% if controller.version not in ['liberty', 'mitaka', 'newton'] %}
+    - file: /etc/nova/policy.json
+    {% endif%}
 
 {%- else %}
 
@@ -88,6 +105,9 @@
   - name: {{ name }}
   - require:
     - pkg: nova_controller_packages
+    {% if controller.version not in ['liberty', 'mitaka', 'newton'] %}
+    - file: /etc/nova/policy.json
+    {% endif%}
 
 {%- endif %}
 
@@ -120,10 +140,16 @@
 nova_controller_map_cell0:
   cmd.run:
   - name: nova-manage cell_v2 map_cell0
+  {%- if grains.get('noservices') %}
+  - onlyif: /bin/false
+  {%- endif %}
 
 nova_cell1_create:
   cmd.run:
   - name: nova-manage cell_v2 create_cell --name=cell1
+  {%- if grains.get('noservices') %}
+  - onlyif: /bin/false
+  {%- endif %}
   - unless: 'nova-manage cell_v2 list_cells | grep cell1'
 
 nova_placement_service_mask:
@@ -153,6 +179,9 @@
 nova_controller_discover_hosts:
   cmd.run:
   - name: nova-manage cell_v2 discover_hosts
+  {%- if grains.get('noservices') %}
+  - onlyif: /bin/false
+  {%- endif %}
   - require:
     - cmd: nova_controller_map_cell0
     - cmd: nova_cell1_create
@@ -160,6 +189,9 @@
 nova_controller_map_instances:
   novang.map_instances:
   - name: 'cell1'
+  {%- if grains.get('noservices') %}
+  - onlyif: /bin/false
+  {%- endif %}
   - require:
     - cmd: nova_controller_discover_hosts
     - pkg: nova_controller_packages
@@ -182,6 +214,9 @@
   cmd.run:
   - names:
     - nova-manage db sync
+  {%- if grains.get('noservices') %}
+  - onlyif: /bin/false
+  {%- endif %}
   - require:
     - file: /etc/nova/nova.conf
 
@@ -190,6 +225,9 @@
 nova_controller_online_data_migrations:
   cmd.run:
   - name: nova-manage db online_data_migrations
+  {%- if grains.get('noservices') %}
+  - onlyif: /bin/false
+  {%- endif %}
   - require:
     - cmd: nova_controller_syncdb
 
@@ -201,6 +239,9 @@
   service.running:
   - enable: true
   - name: apache2
+  {%- if grains.get('noservices') %}
+  - onlyif: /bin/false
+  {%- endif %}
   - require:
     - cmd: nova_controller_syncdb
   - watch:
@@ -214,6 +255,9 @@
   service.running:
   - enable: true
   - names: {{ controller.services }}
+  {%- if grains.get('noservices') %}
+  - onlyif: /bin/false
+  {%- endif %}
   - require:
     - cmd: nova_controller_syncdb
   - watch:
diff --git a/nova/files/mitaka/nova-compute.conf.Debian b/nova/files/mitaka/nova-compute.conf.Debian
index 7e94913..3195bbd 100644
--- a/nova/files/mitaka/nova-compute.conf.Debian
+++ b/nova/files/mitaka/nova-compute.conf.Debian
@@ -11,8 +11,10 @@
 compute_manager=nova.compute.manager.ComputeManager
 network_device_mtu=65000
 use_neutron = True
-config_drive_format=vfat
-force_config_drive=True
+config_drive_format={{ compute.get('config_drive_format', compute.get('config_drive', {}).get('format', 'vfat')) }}
+config_drive_cdrom={{ compute.get('config_drive', {}).get('cdrom', False)|lower }}
+force_config_drive={{ compute.get('config_drive', {}).get('forced', True)|lower }}
+config_drive_inject_password={{ compute.get('config_drive', {}).get('inject_password', False)|lower }}
 security_group_api=neutron
 vif_plugging_is_fatal=True
 vif_plugging_timeout=300
diff --git a/nova/files/newton/nova-compute.conf.Debian b/nova/files/newton/nova-compute.conf.Debian
index 8b44941..09cd0d0 100644
--- a/nova/files/newton/nova-compute.conf.Debian
+++ b/nova/files/newton/nova-compute.conf.Debian
@@ -11,8 +11,10 @@
 compute_manager=nova.compute.manager.ComputeManager
 network_device_mtu=65000
 use_neutron = True
-config_drive_format={{ compute.get('config_drive_format', 'vfat') }}
-force_config_drive=True
+config_drive_format={{ compute.get('config_drive_format', compute.get('config_drive', {}).get('format', 'vfat')) }}
+config_drive_cdrom={{ compute.get('config_drive', {}).get('cdrom', False)|lower }}
+force_config_drive={{ compute.get('config_drive', {}).get('forced', True)|lower }}
+config_drive_inject_password={{ compute.get('config_drive', {}).get('inject_password', False)|lower }}
 force_raw_images=True
 notify_api_faults=False
 security_group_api=neutron
diff --git a/nova/files/ocata/nova-compute.conf.Debian b/nova/files/ocata/nova-compute.conf.Debian
index d518fbe..0cd91e5 100644
--- a/nova/files/ocata/nova-compute.conf.Debian
+++ b/nova/files/ocata/nova-compute.conf.Debian
@@ -1257,7 +1257,7 @@
 #  (string value)
 # Allowed values: iso9660, vfat
 #config_drive_format=iso9660
-config_drive_format={{ compute.get('config_drive_format', 'vfat') }}
+config_drive_format={{ compute.get('config_drive_format', compute.get('config_drive', {}).get('format', 'vfat')) }}
 
 #
 # Force injection to take place on a config drive
@@ -1285,7 +1285,7 @@
 #   installation.
 #  (boolean value)
 #force_config_drive=false
-force_config_drive=true
+force_config_drive={{ compute.get('config_drive', {}).get('forced', True)|lower }}
 
 #
 # Name or path of the tool used for ISO image creation
@@ -5346,6 +5346,7 @@
 #   drive by setting the force_config_drive option to 'True'.
 #  (boolean value)
 #config_drive_cdrom=false
+config_drive_cdrom={{ compute.get('config_drive', {}).get('cdrom', False)|lower }}
 
 #
 # Configuration drive inject password
@@ -5359,6 +5360,7 @@
 # * Currently, the only accepted config_drive_format is 'iso9660'.
 #  (boolean value)
 #config_drive_inject_password=false
+config_drive_inject_password={{ compute.get('config_drive', {}).get('inject_password', False)|lower }}
 
 #
 # Volume attach retry count
diff --git a/tests/pillar/compute_single_config_drive_options.sls b/tests/pillar/compute_single_config_drive_options.sls
new file mode 100644
index 0000000..a181f8b
--- /dev/null
+++ b/tests/pillar/compute_single_config_drive_options.sls
@@ -0,0 +1,54 @@
+nova:
+  compute:
+    version: mitaka
+    enabled: true
+    virtualization: kvm
+    heal_instance_info_cache_interval: 60
+    vncproxy_url: openstack:6080
+    vnc_keymap: en-gb
+    resume_guests_state_on_host_boot: False
+    bind:
+      vnc_address: 127.0.0.1
+      vnc_port: 6080
+      vnc_name: 0.0.0.0
+    database:
+      engine: mysql
+      host: 127.0.0.1
+      port: 3306
+      name: nova
+      user: nova
+      password: password
+    identity:
+      engine: keystone
+      region: RegionOne
+      host: 127.0.0.1
+      port: 35357
+      user: nova
+      password: password
+      tenant: service
+    message_queue:
+      engine: rabbitmq
+      host: 127.0.0.1
+      port: 5672
+      user: openstack
+      password: password
+      virtual_host: '/openstack'
+    image:
+      engine: glance
+      host: 127.0.0.1
+      port: 9292
+    network:
+      engine: neutron
+      region: RegionOne
+      host: 127.0.0.1
+      port: 9696
+      password: password
+    cache:
+      engine: memcached
+      members:
+      - host: 127.0.0.1
+        port: 11211
+    config_drive:
+      cdrom: True
+      format: iso9660
+      inject_password: True
\ No newline at end of file
diff --git a/tests/pillar/control_cluster.sls b/tests/pillar/control_cluster.sls
index 84da744..9744dd1 100644
--- a/tests/pillar/control_cluster.sls
+++ b/tests/pillar/control_cluster.sls
@@ -42,7 +42,7 @@
       password: password
       virtual_host: '/openstack'
     glance:
-      host: 
+      host:
       port: 9292
     network:
       engine: neutron
@@ -59,7 +59,6 @@
       filter_factory: 'keystonemiddleware.audit:filter_factory'
       map_file: '/etc/pycadf/nova_api_audit_map.conf'
     policy:
-      context_is_admin: 'role:admin or role:administrator'
+      'context_is_admin': 'role:admin or role:administrator'
       'compute:create': 'rule:admin_or_owner'
       'compute:create:attach_network':
-
diff --git a/tests/pillar/control_single.sls b/tests/pillar/control_single.sls
index ce33f8c..78eaa40 100644
--- a/tests/pillar/control_single.sls
+++ b/tests/pillar/control_single.sls
@@ -57,6 +57,6 @@
       - host: 127.0.0.1
         port: 11211
     policy:
-      context_is_admin: 'role:admin or role:administrator'
+      'context_is_admin': 'role:admin or role:administrator'
       'compute:create': 'rule:admin_or_owner'
       'compute:create:attach_network':