The OSP12 version of the "Creating a Custom Role and Flavor for the Ceph MON Service" documentation [1] will need to be updated so that when the Controller role gets the following service removed: 

- OS::TripleO::Services::CephMon

It gets the following service added in its place: 

- OS::TripleO::Services::CephClient

There is nothing wrong with the OSP11 and earlier versions of the document as puppet-ceph did this implicitly based on availability of the key in hieradata. However, in OSP12 when ceph-ansible is used, this service additional service is required. If it is not included then the controller node will not get the ceph.client.openstack.keyring that ceph clients use to connect to the ceph cluster. 

[1] https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/11/html-single/red_hat_ceph_storage_for_the_overcloud/#dedicated-nodes-mon