diff --git a/README.rst b/README.rst
index 7bbb04e..ba5e04b 100644
--- a/README.rst
+++ b/README.rst
@@ -620,6 +620,49 @@
    {{- item }}
    %- endfor
 
+Provision VM with secured image source.
+
+.. code-block:: yaml
+
+  salt:
+    control:
+      cluster:
+        mycluster:
+          domain: mydomain.com
+          engine: virt
+          node:
+            ubuntu01:
+              image_source:
+                secured: true
+                protocol: http
+                user: foo
+                password: bar
+                url_prefix: mirror.com
+                url_path: xenial/image.qcow2
+
+Provision several VMs with same secured image source.
+
+  salt:
+    control:
+      common_image_source:
+        protocol: https
+        user: foo
+        password: bar
+        url_prefix: mirror.com
+      cluster:
+        mycluster:
+          domain: mydomain.com
+          engine: virt
+          node:
+            ubuntu01:
+              image_source:
+                secured: true
+                url_path: xenial/ubuntu.qcow2
+            debian01:
+              image_source:
+                secured: true
+                url_path: stretch/debian.qcow2
+
 MCP Cluster health checks
 ~~~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/salt/control/virt.sls b/salt/control/virt.sls
index 187462c..93c3a04 100644
--- a/salt/control/virt.sls
+++ b/salt/control/virt.sls
@@ -53,6 +53,17 @@
 {%- set cluster_cloud_init = cluster.get('cloud_init', {}) %}
 {%- set node_cloud_init = node.get('cloud_init', {}) %}
 {%- set cloud_init = salt['grains.filter_by']({'default': cluster_cloud_init}, merge=node_cloud_init) %}
+{%- set image_source = node.get('image_source', {}) %}
+{%- if image_source.get('secured', False) %}
+{%- set common_image_source = control.get('common_image_source', {}) %}
+{%- set node_image = image_source.get('protocol', common_image_source.get('protocol', 'http')) + '://' +
+                     image_source.get('user', common_image_source.get('user')) + ':' +
+                     image_source.get('password', common_image_source.get('password')) + '@' +
+                     image_source.get('url_prefix', common_image_source.get('url_prefix', '')) +
+                     image_source.get('url_path') %}
+{%- else %}
+{%- set node_image = node.image %}
+{%- endif %}
 
 salt_control_virt_{{ cluster_name }}_{{ node_name }}:
   module.run:
@@ -60,7 +71,7 @@
   - m_name: {{ node_name }}.{{ cluster.domain }}
   - cpu: {{ size.cpu }}
   - mem: {{ size.ram }}
-  - image: {{ node.image }}
+  - image: {{ node_image }}
   - start: True
   - dry_run: False
   - disk: {{ size.disk_profile }}
diff --git a/salt/files/profiles.conf b/salt/files/profiles.conf
index 6baa6ff..a2837a2 100644
--- a/salt/files/profiles.conf
+++ b/salt/files/profiles.conf
@@ -4,9 +4,21 @@
 
 {%- for node_name, node in cluster.node.iteritems() %}
 
+{%- set image_source = node.get('image_source', {}) %}
+{%- if image_source.get('secured', False) %}
+{%- set common_image_source = control.get('common_image_source', {}) %}
+{%- set node_image = image_source.get('protocol', common_image_source.get('protocol', 'http')) + '://' +
+                     image_source.get('user', common_image_source.get('user')) + ':' +
+                     image_source.get('password', common_image_source.get('password')) + '@' +
+                     image_source.get('url_prefix', common_image_source.get('url_prefix', '')) +
+                     image_source.get('url_path') %}
+{%- else %}
+{%- set node_image = node.image %}
+{%- endif %}
+
 {{ node_name }}.{{ cluster.domain }}:
   provider: {{ node.provider }}
-  image: {{ node.image }}
+  image: {{ node_image }}
   size: {{ node.size }}
   minion:
     master: {{ cluster.config.host }}
@@ -14,9 +26,9 @@
   {%- if node.userdata is defined %}
   userdata_file: /srv/salt/cloud/userdata/{{ cluster_name }}/{{ node_name }}.conf
   {%- endif %}
-  {%- if 'ubuntu' in node.image|lower %}
+  {%- if 'ubuntu' in node_image|lower %}
   ssh_username: ubuntu
-  {%- elif 'centos' in node.image|lower %}
+  {%- elif 'centos' in node_image|lower %}
   ssh_username: cloud-user
   {%- endif %}
 
diff --git a/tests/pillar/control_virt.sls b/tests/pillar/control_virt.sls
index 7587594..0d108ff 100644
--- a/tests/pillar/control_virt.sls
+++ b/tests/pillar/control_virt.sls
@@ -16,6 +16,11 @@
       host: config01.dc01.domain.com
   control:
     enabled: true
+    common_image_source:
+      protocol: https
+      user: foo1
+      password: bar1
+      url_prefix: mirror.com
     virt_enabled: true
     size:
       small:
@@ -51,3 +56,19 @@
             provider: node03.domain.com
             image: meowbuntu.qcom2
             size: medium_three_disks
+          ubuntu4:
+            provider: node04.domain.com
+            size: small
+            image_source:
+              secured: true
+              protocol: http
+              user: foo
+              password: bar
+              url_prefix: mirror.com
+              url_path: xenial/image.qcow2
+            ubuntu5:
+              provider: node05.domain.com
+              size: small
+              image_source:
+                secured: true
+                url_path: stretch/debian.qcow2