Processing parameters, environments and templates is slightly different on the CLI than it is in the UI. Consequently, the passwords generated automatically by the UI cannot be changed from the templates. If you want to use custom passwords, you have to set them manually in the UI as a parameter in the overall deployment configuration or by editing the role card. Alternatively, you can create a plan without auto-generated passwords by entering the '$ openstack overcloud plan create <my_plan> --disable-password-generation' on the CLI. You will have to provide the passwords explicitly by using templates or manually through the UI.