diff --git a/clusters/raas-citycloud/.secrets/rancher.rc b/clusters/raas-citycloud/.secrets/rancher.rc
index 774c516..4169f2a 100644
--- a/clusters/raas-citycloud/.secrets/rancher.rc
+++ b/clusters/raas-citycloud/.secrets/rancher.rc
@@ -1,8 +1,10 @@
-
 export TF_VAR_os_auth_url=$OS_AUTH_URL/v$OS_AUTH_VERSION
 export TF_VAR_os_region=$OS_REGION_NAME
 export TF_VAR_os_username=$OS_USERNAME
 export TF_VAR_os_password=$OS_PASSWORD
-
+export TF_VAR_os_tenant_name=$OS_TENANT_NAME
+export TF_VAR_os_user_domain_name=$OS_USER_DOMAIN_NAME
+export TF_VAR_s3_access_key=""
+export TF_VAR_s3_secret_key=""
 export TF_VAR_rancher_access_key=""
-export TF_VAR_rancher_secret_key=""
+export TF_VAR_rancher_secret_key=""
\ No newline at end of file
diff --git a/clusters/raas-citycloud/README.md b/clusters/raas-citycloud/README.md
new file mode 100644
index 0000000..3561c4f
--- /dev/null
+++ b/clusters/raas-citycloud/README.md
@@ -0,0 +1,24 @@
+# Prerequisites
+## Object storage
+These scripts expect an S3-compatible bucket for automated backups of the cluster state.
+Instructions on how to create one can be found here:
+https://cleura.cloud/storage/objectstorage
+
+## Rancher
+You'll need an access key and a secret key from RaaS.
+This can be created under your user (on the top right in the UI) "Account and API Keys" and "Create API Key".
+Take notes of these as they can not to retrieved again.
+
+## OpenStack
+You need to create an OpenStack user with permissions to create resources.
+This can be done here:
+https://cleura.cloud/users/openstack
+
+## SSH
+You'll need to provide a SSH keypair which in turn will be created as an OpenStack keypair.
+This key needs to be placed in $PWD/.secrets
+A key using ed25519 is expected.
+You can either provide your own key or create a new one:
+```bash
+$ ssh-keygen -t ed25519
+```
\ No newline at end of file
diff --git a/clusters/raas-citycloud/apps.tf b/clusters/raas-citycloud/apps.tf
index 82c4dcb..bbe3406 100644
--- a/clusters/raas-citycloud/apps.tf
+++ b/clusters/raas-citycloud/apps.tf
@@ -1,13 +1,131 @@
-/* Example!
+resource "rancher2_catalog_v2" "cloud-provider-openstack" {
+  cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}"
+  name = "cloud-provider-openstack"
+  url = "https://kubernetes.github.io/cloud-provider-openstack"
+  depends_on = [
+    rancher2_cluster_sync.cluster,
+  ]
+}
+resource "rancher2_catalog_v2" "ingress-nginx" {
+  cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}"
+  name = "ingress-nginx"
+  url = "https://kubernetes.github.io/ingress-nginx"
+  depends_on = [
+    rancher2_cluster_sync.cluster,
+  ]
+}
+
+resource "rancher2_catalog_v2" "jetstack" {
+  cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}"
+  name = "jetstack"
+  url = "https://charts.jetstack.io"
+  depends_on = [
+    rancher2_cluster_sync.cluster,
+  ]
+}
+
+resource "rancher2_app_v2" "cert-manager" {
+  cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}"
+  name = "cert-manager"
+  namespace = "cert-manager"
+  repo_name = "jetstack"
+  chart_name = "cert-manager"
+  values = file("${path.module}/config/cert_manager-values.yaml")
+  depends_on = [
+    rancher2_catalog_v2.jetstack,
+  ]
+}
+
+resource "rancher2_app_v2" "openstack-cloud-controller-manager" {
+  cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}"
+  name = "openstack-cloud-controller-manager"
+  namespace = "kube-system"
+  repo_name = "cloud-provider-openstack"
+  chart_name = "openstack-cloud-controller-manager"
+  values = templatefile("${path.module}/templates/openstack-ccm_values.tftpl", { floating_network_id = (data.openstack_networking_network_v2.external-network.id), subnet_id = openstack_networking_subnet_v2.subnet.id, endpoint = "https://${lower(data.openstack_identity_auth_scope_v3.scope.region)}.citycloud.com:5000", username = (data.openstack_identity_auth_scope_v3.scope.user_name), password = var.os_password, tenant_name = (data.openstack_identity_auth_scope_v3.scope.project_name), domain_name = (data.openstack_identity_auth_scope_v3.scope.user_domain_name), region = (data.openstack_identity_auth_scope_v3.scope.region), router_id = "${openstack_networking_router_v2.router.id}", cluster_name = rancher2_cluster_v2.cluster.name })
+  # For some reason, that I can't really find, the cloud-provider-openstack helm chart does not create the neccesary roles and rolebindings.
+  # So, solving it like this for now.
+  provisioner "local-exec" {
+    command = <<-EOT
+      kubectl --kubeconfig kubeconfig.yml apply -f https://raw.githubusercontent.com/kubernetes/cloud-provider-openstack/master/manifests/controller-manager/cloud-controller-manager-roles.yaml
+      kubectl --kubeconfig kubeconfig.yml apply -f https://raw.githubusercontent.com/kubernetes/cloud-provider-openstack/master/manifests/controller-manager/cloud-controller-manager-role-bindings.yaml
+    EOT
+  }
+  depends_on = [
+    rancher2_catalog_v2.cloud-provider-openstack,
+    local_sensitive_file.kube_config,
+  ]
+}
+
+resource "rancher2_app_v2" "openstack-cinder-csi" {
+  cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}"
+  name = "openstack-cinder-csi"
+  namespace = "kube-system"
+  repo_name = "cloud-provider-openstack"
+  chart_name = "openstack-cinder-csi"
+  values = templatefile("${path.module}/templates/csi-values.tftpl", { endpoint = "https://${lower(data.openstack_identity_auth_scope_v3.scope.region)}.citycloud.com:5000/v3/", username = (data.openstack_identity_auth_scope_v3.scope.user_name), password = var.os_password, tenant_name = (data.openstack_identity_auth_scope_v3.scope.project_name), domain_name = (data.openstack_identity_auth_scope_v3.scope.user_domain_name), subnet_name = openstack_networking_subnet_v2.subnet.name, cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}" })
+  depends_on = [
+    rancher2_catalog_v2.cloud-provider-openstack,
+  ]
+  # Terraform wants to apply changes to the chart values.yaml on every apply, so ignoring any changes pending a proper fix.
+  lifecycle {
+    ignore_changes = [
+      values,
+    ]
+  }
+}
+
+resource "rancher2_app_v2" "rancher-monitoring" {
+  cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}"
+  name = "rancher-monitoring"
+  namespace = "cattle-monitoring-system"
+  repo_name = "rancher-charts"
+  chart_name = "rancher-monitoring"
+  values = file("./config/rancher-monitoring_values.yaml")
+  depends_on = [
+    rancher2_cluster_sync.cluster,
+  ]
+}
 
-resource "rancher2_cluster_sync" "active_cluster" {
-  cluster_id =  rancher2_cluster.cluster.id
+resource "rancher2_app_v2" "ingress-nginx" {
+  cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}"
+  name = "ingress-nginx"
+  namespace = "ingress-nginx"
+  repo_name = "ingress-nginx"
+  chart_name = "ingress-nginx"
+  values = file("./config/ingress-nginx_values.yaml")
+  depends_on = [
+    rancher2_catalog_v2.ingress-nginx,
+    rancher2_app_v2.openstack-cloud-controller-manager,
+  ]
 }
 
-module "wordpress" {
-  source = "./modules/wordpress"
-  domain = var.caas_domain
-  cluster = rancher2_cluster_sync.active_cluster
+resource "rancher2_secret_v2" "rancher-backup-secret" {
+  cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}"
+  name = "s3-credentials"
+  namespace = "cattle-resources-system"
+  data = {
+      accessKey = var.s3_access_key
+      secretKey = var.s3_secret_key
+  }
+  depends_on = [
+    rancher2_cluster_sync.cluster,
+  ]
 }
 
-*/
+resource "rancher2_app_v2" "rancher-backup" {
+  cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}"
+  name = "rancher-backup"
+  namespace = "cattle-resources-system"
+  repo_name = "rancher-charts"
+  chart_name = "rancher-backup"
+  values = templatefile("${path.module}/templates/rancher-backup_values.tftpl", { region = (data.openstack_identity_auth_scope_v3.scope.region), bucket_name = var.prefix, s3_endpoint = var.s3_endpoint,  })
+  provisioner "local-exec" {
+    command = <<-EOT
+      kubectl --kubeconfig kubeconfig.yml apply -f ./config/rancher-backup_midnight.yaml
+    EOT
+  }
+  depends_on = [
+    rancher2_cluster_sync.cluster,
+  ]
+}
\ No newline at end of file
diff --git a/clusters/raas-citycloud/cluster.tf b/clusters/raas-citycloud/cluster.tf
index 3ca0aca..6db3362 100644
--- a/clusters/raas-citycloud/cluster.tf
+++ b/clusters/raas-citycloud/cluster.tf
@@ -1,44 +1,58 @@
-
-resource "rancher2_cluster" "cluster" {
+resource "rancher2_cluster_v2" "cluster" {
   name = var.prefix
+  kubernetes_version = "v1.24.8+rke2r1"
+  enable_network_policy = false
+  default_cluster_role_for_project_members = "user"
   rke_config {
-    network {
-      plugin = "canal"
+    machine_pools {
+      name = "master"
+      cloud_credential_secret_name = data.rancher2_cloud_credential.rancher2_cloud_credential.id
+      control_plane_role = true
+      etcd_role = true
+      worker_role = false
+      quantity = var.no_master_nodes
+      machine_config {
+        kind = rancher2_machine_config_v2.openstack.kind
+        name = rancher2_machine_config_v2.openstack.name
+      }
     }
-
-    cloud_provider {
-      openstack_cloud_provider {
-        global {
-          auth_url = "https://${lower(data.openstack_identity_auth_scope_v3.scope.region)}.citycloud.com:5000/v3/"
-          password = var.os_password
-          username = data.openstack_identity_auth_scope_v3.scope.user_name
-          domain_id = data.openstack_identity_auth_scope_v3.scope.project_domain_id
-          tenant_id = data.openstack_identity_auth_scope_v3.scope.project_id
-        }
-        block_storage {
-          ignore_volume_az = true
-          trust_device_path = false
-        }
-        metadata {
-          request_timeout = 0
-        }
-        load_balancer {
-          subnet_id = openstack_networking_subnet_v2.subnet.id
-          floating_network_id = data.openstack_networking_network_v2.external-network.id
-          use_octavia = true
-        }
+    machine_pools {
+      name = "worker"
+      cloud_credential_secret_name = data.rancher2_cloud_credential.rancher2_cloud_credential.id
+      control_plane_role = false
+      etcd_role = false
+      worker_role = true
+      quantity = var.no_worker_nodes
+      machine_config {
+        kind = rancher2_machine_config_v2.openstack.kind
+        name = rancher2_machine_config_v2.openstack.name
+      }
+    }
+    machine_selector_config {
+      config = {
+        disable = "rke2-ingress-nginx"
       }
     }
+}
+  lifecycle {
+    ignore_changes = [
+      cloud_credential_secret_name,
+    ]
   }
+  depends_on = [
+    openstack_networking_subnet_v2.subnet,
+    rancher2_cloud_credential.cloud_credential_name,
+  ]
 }
 
-resource "rancher2_node_pool" "node_pool" {
-  cluster_id = rancher2_cluster.cluster.id
-  name = var.prefix
-  hostname_prefix = var.prefix
-  node_template_id = rancher2_node_template.citycloud.id
-  quantity = 3
-  control_plane = true
-  etcd = true
-  worker = true
+resource "rancher2_cluster_sync" "cluster" {
+  cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}"
+  depends_on = [
+    rancher2_cluster_v2.cluster,
+  ]
+}
+
+resource "local_sensitive_file" "kube_config" {
+  filename = "kubeconfig.yml"
+  content = rancher2_cluster_v2.cluster.kube_config
 }
diff --git a/clusters/raas-citycloud/config/cert_manager-values.yaml b/clusters/raas-citycloud/config/cert_manager-values.yaml
new file mode 100644
index 0000000..1b4551c
--- /dev/null
+++ b/clusters/raas-citycloud/config/cert_manager-values.yaml
@@ -0,0 +1 @@
+installCRDs: true
diff --git a/clusters/raas-citycloud/config/ingress-nginx_values.yaml b/clusters/raas-citycloud/config/ingress-nginx_values.yaml
new file mode 100644
index 0000000..cd50e1a
--- /dev/null
+++ b/clusters/raas-citycloud/config/ingress-nginx_values.yaml
@@ -0,0 +1,2 @@
+controller:
+  kind: DaemonSet
\ No newline at end of file
diff --git a/clusters/raas-citycloud/config/rancher-backup_midnight.yaml b/clusters/raas-citycloud/config/rancher-backup_midnight.yaml
new file mode 100644
index 0000000..f1a7b13
--- /dev/null
+++ b/clusters/raas-citycloud/config/rancher-backup_midnight.yaml
@@ -0,0 +1,9 @@
+apiVersion: resources.cattle.io/v1
+kind: Backup
+metadata:
+  name: daily
+  namespace: cattle-resources-system
+spec:
+  resourceSetName: rancher-resource-set
+  retentionCount: 10
+  schedule: '@midnight'
\ No newline at end of file
diff --git a/clusters/raas-citycloud/config/rancher-monitoring_values.yaml b/clusters/raas-citycloud/config/rancher-monitoring_values.yaml
new file mode 100644
index 0000000..4dfc1b2
--- /dev/null
+++ b/clusters/raas-citycloud/config/rancher-monitoring_values.yaml
@@ -0,0 +1,28 @@
+alertmanager:
+  enabled: true
+grafana:
+  enabled: true
+  persistence:
+    accessModes:
+      - ReadWriteOnce
+    enabled: true
+    finalizers:
+      - kubernetes.io/pvc-protection
+    inMemory:
+      enabled: false
+    size: 5Gi
+    type: pvc
+    storageClassName: csi-cinder-sc-delete
+prometheus:
+  enabled: true
+  prometheusSpec:
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 50Gi
+          storageClassName: csi-cinder-sc-delete
+          volumeMode: Filesystem
diff --git a/clusters/raas-citycloud/data.tf b/clusters/raas-citycloud/data.tf
index 8d35217..d380abd 100644
--- a/clusters/raas-citycloud/data.tf
+++ b/clusters/raas-citycloud/data.tf
@@ -5,3 +5,13 @@ data "openstack_networking_network_v2" "external-network" {
 data "openstack_identity_auth_scope_v3" "scope" {
   name = "scope"
 }
+
+# https://github.com/rancher/terraform-provider-rancher2/issues/835
+data "rancher2_cloud_credential" "rancher2_cloud_credential" {
+  name = "${var.prefix}"
+}
+
+data "rancher2_project" "system" {
+  name = "System"
+  cluster_id = "${rancher2_cluster_v2.cluster.cluster_v1_id}"
+}
\ No newline at end of file
diff --git a/clusters/raas-citycloud/networks.tf b/clusters/raas-citycloud/networks.tf
index e2c6cca..2a4cf20 100644
--- a/clusters/raas-citycloud/networks.tf
+++ b/clusters/raas-citycloud/networks.tf
@@ -17,3 +17,8 @@ resource "openstack_networking_router_interface_v2" "router-if" {
   router_id = openstack_networking_router_v2.router.id
   subnet_id = openstack_networking_subnet_v2.subnet.id
 }
+
+resource "openstack_compute_keypair_v2" "keypair" {
+  name = var.vm_keypair_name
+  public_key = file(pathexpand(var.ssh_public_key))
+}
\ No newline at end of file
diff --git a/clusters/raas-citycloud/node_template.tf b/clusters/raas-citycloud/node_template.tf
index 796d348..0c80c24 100644
--- a/clusters/raas-citycloud/node_template.tf
+++ b/clusters/raas-citycloud/node_template.tf
@@ -1,30 +1,32 @@
 
-resource "rancher2_cloud_credential" "cred" {
-  name = "${var.prefix}-cred"
+resource "rancher2_cloud_credential" "cloud_credential_name" {
+  name = "${var.prefix}"
   openstack_credential_config {
     password = var.os_password
   }
 }
 
-resource "rancher2_node_template" "citycloud" {
-  name = "${lower(data.openstack_identity_auth_scope_v3.scope.project_name)}-${data.openstack_identity_auth_scope_v3.scope.region}-${var.node_flavor}"
-  cloud_credential_id = rancher2_cloud_credential.cred.id
-  engine_install_url= "https://releases.rancher.com/install-docker/${var.docker_version}.sh"
+resource "rancher2_machine_config_v2" "openstack" {
+  generate_name = "openstack"
   openstack_config {
-    availability_zone = ""
-    auth_url = "https://${lower(data.openstack_identity_auth_scope_v3.scope.region)}.citycloud.com:5000/v3"
+    availability_zone = "nova"
+    auth_url = "https://${lower(data.openstack_identity_auth_scope_v3.scope.region)}.citycloud.com:5000/v3/"
     region = data.openstack_identity_auth_scope_v3.scope.region
     username = data.openstack_identity_auth_scope_v3.scope.user_name
-    // Do NOT use domain_name as it does not work with Openstack ATM
     domain_id = data.openstack_identity_auth_scope_v3.scope.project_domain_id
-    // Do NOT use tenant_name as it does not work with Openstack ATM
-    tenant_id = data.openstack_identity_auth_scope_v3.scope.project_id
-    // Do NOT use net_name as it does not work with Openstack ATM
-    net_id = openstack_networking_network_v2.custom_network.id
     endpoint_type = "publicURL"
-    floating_ip_pool = data.openstack_networking_network_v2.external-network.name
     flavor_name = var.node_flavor
     image_name = var.vm_image
+    keypair_name = var.vm_keypair_name
+    private_key_file = "${var.ssh_private_key}"
+    net_id = openstack_networking_network_v2.custom_network.id
+    password = var.os_password
     ssh_user = var.vm_ssh_user
+    tenant_id = data.openstack_identity_auth_scope_v3.scope.project_id
+  }
+  lifecycle {
+    ignore_changes = [
+      openstack_config.0.volume_size,
+    ]
   }
 }
diff --git a/clusters/raas-citycloud/templates/cloud-config.tftpl b/clusters/raas-citycloud/templates/cloud-config.tftpl
new file mode 100644
index 0000000..c9bcc26
--- /dev/null
+++ b/clusters/raas-citycloud/templates/cloud-config.tftpl
@@ -0,0 +1,12 @@
+[Global]
+auth-url=${ auth_url }
+username=${ username }
+password=${ password }
+region=${ region }
+tenant-name="${ tenant_name }"
+domain-name=${ domain_name }
+
+[LoadBalancer]
+use-octavia=true
+subnet-id=${ subnet_id }
+floating-network-id=${ floating_network_id }
\ No newline at end of file
diff --git a/clusters/raas-citycloud/templates/csi-values.tftpl b/clusters/raas-citycloud/templates/csi-values.tftpl
new file mode 100644
index 0000000..48d458c
--- /dev/null
+++ b/clusters/raas-citycloud/templates/csi-values.tftpl
@@ -0,0 +1,137 @@
+extraLabels: {}
+
+nameOverride: ""
+fullnameOverride: ""
+timeout: 3m
+
+csi:
+  attacher:
+    image:
+      repository: k8s.gcr.io/sig-storage/csi-attacher
+      tag: v3.4.0
+      pullPolicy: IfNotPresent
+    resources: {}
+  provisioner:
+    topology: "true"
+    image:
+      repository: k8s.gcr.io/sig-storage/csi-provisioner
+      tag: v3.1.0
+      pullPolicy: IfNotPresent
+    resources: {}
+  snapshotter:
+    image:
+      repository: k8s.gcr.io/sig-storage/csi-snapshotter
+      tag: v5.0.1
+      pullPolicy: IfNotPresent
+    resources: {}
+  resizer:
+    image:
+      repository: k8s.gcr.io/sig-storage/csi-resizer
+      tag: v1.4.0
+      pullPolicy: IfNotPresent
+    resources: {}
+  livenessprobe:
+    image:
+      repository: k8s.gcr.io/sig-storage/livenessprobe
+      tag: v2.6.0
+      pullPolicy: IfNotPresent
+    failureThreshold: 5
+    initialDelaySeconds: 10
+    timeoutSeconds: 10
+    periodSeconds: 60
+    resources: {}
+  nodeDriverRegistrar:
+    image:
+      repository: k8s.gcr.io/sig-storage/csi-node-driver-registrar
+      tag: v2.5.0
+      pullPolicy: IfNotPresent
+    resources: {}
+  plugin:
+    image:
+      repository: docker.io/k8scloudprovider/cinder-csi-plugin
+      pullPolicy: IfNotPresent
+      tag:  # defaults to .Chart.AppVersion
+    volumes:
+      - name: cacert
+        hostPath:
+          path: /etc/cacert
+    volumeMounts:
+      - name: cacert
+        mountPath: /etc/cacert
+        readOnly: true
+      - name: cloud-config
+        mountPath: /etc/kubernetes
+        readOnly: true
+    nodePlugin:
+      affinity: {}
+      nodeSelector: {}
+      tolerations:
+        - operator: Exists
+      kubeletDir: /var/lib/kubelet
+    controllerPlugin:
+      replicas: 1
+      strategy:
+        # RollingUpdate strategy replaces old pods with new ones gradually,
+        # without incurring downtime.
+        type: RollingUpdate
+        rollingUpdate:
+          # maxUnavailable is the maximum number of pods that can be
+          # unavailable during the update process.
+          maxUnavailable: 0
+          # maxSurge is the maximum number of pods that can be
+          # created over the desired number of pods.
+          maxSurge: 1
+      affinity: {}
+      nodeSelector: {}
+      tolerations: []
+    resources: {}
+  snapshotController:
+    enabled: false
+    image:
+      repository: k8s.gcr.io/sig-storage/snapshot-controller
+      tag: v5.0.1
+    resources: {}
+    affinity: {}
+    nodeSelector: {}
+    tolerations: []
+
+# Log verbosity level.
+# See https://github.com/kubernetes/community/blob/master/contributors/devel/sig-instrumentation/logging.md
+# for description of individual verbosity levels.
+logVerbosityLevel: 2
+
+secret:
+  enabled: true
+  create: true
+  filename: cloud.conf
+  name: cinder-csi-cloud-config
+  data:
+    cloud.conf: |-
+      [Global]
+      auth-url    = ${ endpoint }
+      username    = ${ username }
+      password    = ${ password }
+      tenant-name = "${ tenant_name }"
+      domain-name = "${ domain_name }"
+
+      [LoadBalancer]
+      use-octavia = true
+      subnet-name   = ${ subnet_name }
+
+      [BlockStorage]
+
+      [Route]
+
+      [Metadata]
+
+storageClass:
+  enabled: true
+  delete:
+    isDefault: true
+    allowVolumeExpansion: true
+  retain:
+    isDefault: false
+    allowVolumeExpansion: true
+clusterID: ${ cluster_id }
+
+priorityClassName: ""
diff --git a/clusters/raas-citycloud/templates/openstack-ccm_values.tftpl b/clusters/raas-citycloud/templates/openstack-ccm_values.tftpl
new file mode 100644
index 0000000..9367d2b
--- /dev/null
+++ b/clusters/raas-citycloud/templates/openstack-ccm_values.tftpl
@@ -0,0 +1,16 @@
+cloudConfig:
+  loadBalancer:
+    use-octavia: true
+    floating-network-id: ${ floating_network_id }
+    subnet-id: ${ subnet_id }
+  global:
+    auth-url: ${ endpoint }
+    username: ${ username }
+    password: ${ password }
+    domain-name: ${ domain_name }
+    tenant-name: "${ tenant_name }"
+    region: ${ region }
+  route:
+    router-id: ${ router_id }
+  cluster:
+    name: ${ cluster_name }
\ No newline at end of file
diff --git a/clusters/raas-citycloud/templates/rancher-backup_values.tftpl b/clusters/raas-citycloud/templates/rancher-backup_values.tftpl
new file mode 100644
index 0000000..43f036a
--- /dev/null
+++ b/clusters/raas-citycloud/templates/rancher-backup_values.tftpl
@@ -0,0 +1,10 @@
+s3:
+  enabled: true
+  credentialSecretName: s3-credentials
+  credentialSecretNamespace: "cattle-resources-system"
+  region: "${ region }"
+  bucketName: "${ bucket_name }"
+  folder: "/"
+  endpoint: "${ s3_endpoint }"
+  endpointCA: ""
+  insecureTLSSkipVerify: false
\ No newline at end of file
diff --git a/clusters/raas-citycloud/variables.tf b/clusters/raas-citycloud/variables.tf
index 00ee2eb..911a9d9 100644
--- a/clusters/raas-citycloud/variables.tf
+++ b/clusters/raas-citycloud/variables.tf
@@ -2,8 +2,11 @@
 ///////////////////////
 // ENVIRONMENT VARs
 ///////////////////////
-
 variable "os_password" { type = string }
+variable "os_tenant_name" { type = string }
+variable "os_user_domain_name" { type = string }
+variable "s3_access_key" { type = string }
+variable "s3_secret_key" { type = string }
 
 variable "rancher_access_key" { type = string }
 variable "rancher_secret_key" { type = string }
@@ -21,7 +24,7 @@ variable "raas_domain" {
 }
 
 variable "node_flavor" {
-  default = "2C-4GB-50GB"
+  default = "4C-8GB-50GB"
 }
 
 variable "cidr" {
@@ -29,15 +32,36 @@ variable "cidr" {
 }
 
 variable "vm_image" {
-  default = "Ubuntu 18.04 Bionic Beaver"
+  default = "Ubuntu 22.04 Jammy Jellyfish 20220810"
 }
 
 variable "vm_ssh_user" {
   default = "ubuntu"
 }
 
-// supported docker version can be found at https://github.com/rancher/install-docker
-variable "docker_version" {
-  default = "20.10"
-  description = "The docker version to install on all nodes"
+variable "vm_keypair_name" {
+  default = "citycloud"
+}
+
+variable "ssh_private_key" {
+  default = "./.secrets/id_ed25519"
 }
+
+variable "ssh_public_key" {
+  default = "./.secrets/id_ed25519.pub"
+}
+
+variable "no_master_nodes" {
+  default = "3"
+}
+
+variable "no_worker_nodes" {
+  default = "3"
+}
+
+///////////////////////
+// RANCHER BACKUP
+///////////////////////
+variable "s3_endpoint" {
+  default = "s3endpoint"
+}
\ No newline at end of file
diff --git a/clusters/raas-citycloud/versions.tf b/clusters/raas-citycloud/versions.tf
index e08eaa2..c34a697 100644
--- a/clusters/raas-citycloud/versions.tf
+++ b/clusters/raas-citycloud/versions.tf
@@ -1,14 +1,10 @@
 terraform {
   required_providers {
     openstack = {
-      source = "terraform-providers/openstack"
-    }
-    template = {
-      source = "hashicorp/template"
+      source = "terraform-provider-openstack/openstack"
     }
     local = {
       source  = "hashicorp/local"
-      version = "~> 1.4"
     }
     null = {
       source = "hashicorp/null"
@@ -17,5 +13,5 @@ terraform {
       source = "rancher/rancher2"
     }
   }
-  required_version = ">= 0.13"
+  required_version = ">= 1.3.3"
 }