Description of problem:
The “provision Template” sets “DEFROUTE=no” on the “provisioning interface” of the control node in the following block:

<% if @host.hostgroup.to_s.include?("Controller") %>
echo "setting DEFROUTE=no on $PROVISION_IFACE"
sed -i '
    /DEFROUTE/ d
    $ a\DEFROUTE=no
' /etc/sysconfig/network-scripts/ifcfg-$PROVISION_IFACE
<% end -%>

This is contradictory to the proceeding block that specifically avoids setting “DEFROUTE=no” on the provisioning interface:

# get name of provisioning interface
PROVISION_IFACE=$(ip route  | awk '$1 == "default" {print $5}' | head -1)
echo "found provisioning interface = $PROVISION_IFACE"

IFACES=$(ls -d /sys/class/net/* | while read iface; do readlink $iface | grep -q virtual || echo ${iface##*/}; done)
for i in $IFACES; do
    sed -i 's/ONBOOT.*/ONBOOT=yes/' /etc/sysconfig/network-scripts/ifcfg-$i
    if [ "$i" != "$PROVISION_IFACE" ]; then
        echo "setting PEERDNS=no on $i"
        sed -i '
            /PEERDNS/ d
            $ a\PEERDNS=no
        ' /etc/sysconfig/network-scripts/ifcfg-$i
<% unless @host.hostgroup.to_s.include?("Controller") %>
        echo "setting DEFROUTE=no on $i"
        sed -i '
            /DEFROUTE/ d
            $ a\DEFROUTE=no
        ' /etc/sysconfig/network-scripts/ifcfg-$i
<% end -%>
    fi
done

Version-Release number of selected component (if applicable):
RHEL-OSP5 Installer

How reproducible:
Reproducible

Steps to Reproduce:
1. Create Deployment
2. Add node to "base_RedHat_7/rhelosp1/Controller (Neutron)" host group
3. Install node

Actual results:
"DEFROUTE=no" get set on the “provisioning interface” and horizon cannot be reach off-net.

Expected results:
"DEFROUTE=yes" get set on the “provisioning interface” and horizon can be reach off-net.

Additional info:
I worked around this by setting DEFROUTE=yes in the second block.