diff --git a/Documentation/dev/libvirt-howto.md b/Documentation/dev/libvirt-howto.md
index 89e485a8af1..78de5b713a4 100644
--- a/Documentation/dev/libvirt-howto.md
+++ b/Documentation/dev/libvirt-howto.md
@@ -80,7 +80,7 @@ echo server=/tt.testing/192.168.124.1 | sudo tee /etc/NetworkManager/dnsmasq.d/t
 1. Make sure you have the `virsh` binary installed: `sudo dnf install libvirt-client libvirt-devel`
 2. Install the libvirt terraform provider:
 ```sh
-go get github.com/dmacvicar/terraform-provider-libvirt
+go get github.com/crawford/terraform-provider-libvirt
 mkdir -p ~/.terraform.d/plugins
 cp $GOPATH/bin/terraform-provider-libvirt ~/.terraform.d/plugins/
 ```
diff --git a/Documentation/dev/node-bootstrap-flow.md b/Documentation/dev/node-bootstrap-flow.md
index b21e4b0c380..31edb5a315a 100644
--- a/Documentation/dev/node-bootstrap-flow.md
+++ b/Documentation/dev/node-bootstrap-flow.md
@@ -47,12 +47,6 @@ WantedBy=multi-user.target
 This service is enabled by default and can crash-loop until success.
 It is started on every boot.
 
-### `rm-assets.service`
-
-This service waits for the bootkube and tectonic process to be completed.
-It is a oneshot service, thus marked as started only once the script returns with success.
-This is an optional service only present on platforms which pull assets from block storage.
-
 ## Diagram
 
 This is a visual simplified representation of the overall bootstrapping flow.
@@ -64,30 +58,29 @@ Legend:
  * k.s   -> kubelet.service
  * b.s   -> bootkube.service
  * t.s   -> tectonic.service
- * rm.s  -> rm-assets.service
-
-.--------------------------------------------------------------------------------------------------------------------------------+
-|                                                                                                                                |
-|           Provision cloud/userdata           +----------+                                                                      |
-|     ,---------------------------------------o|    TF    |                                                                      |
-|     |                                        +----------+                                                                      |
-|     |                                                                                                                          |
-|     |                                                                                                                          |
-|     |                                                                                                                          |
-|     |                                                                                                                          |
-|     V                                                                                                                          |
-| +-------+                          Before   +------------+   Before                                                            |
-| |  IGN  |                  .--------------->|    k.s     |o--------.                                                           |
-| +-------+                  |                +------------+         |                                                           |
-|     |                      |                   ^      |            |    +-----+      Before     +-------+   Before +-----+     |
-|     '----------------------'                   |      v            '--->| b.s |o--------------->|  t.s  |--------> |rm.s |     |
-|   Enable                                       '------'                 +-----+                 +-------+          +-----+     |
-|                                                                                                                                |
-|                                                                                                                                |
-|                                       o                            o                                                           |
-|                                       |                            |                                                           |
-|                                       |        * Each boot         |         * First boot                                      |
-|                                       |        * All nodes         |         * Bootkube master                                 |
-|                                       |                            |                                                           |
-'---------------------------------------o----------------------------o-----------------------------------------------------------+
+
+.-----------------------------------------------------------------------------------------------------------+
+|                                                                                                           |
+|           Provision cloud/userdata           +----------+                                                 |
+|     ,---------------------------------------o|    TF    |                                                 |
+|     |                                        +----------+                                                 |
+|     |                                                                                                     |
+|     |                                                                                                     |
+|     |                                                                                                     |
+|     |                                                                                                     |
+|     V                                                                                                     |
+| +-------+                          Before   +------------+   Before                                       |
+| |  IGN  |                  .--------------->|    k.s     |o--------.                                      |
+| +-------+                  |                +------------+         |                                      |
+|     |                      |                   ^      |            |    +-----+      Before     +-------+ |
+|     '----------------------'                   |      v            '--->| b.s |o--------------->|  t.s  | |
+|   Enable                                       '------'                 +-----+                 +-------+ |
+|                                                                                                           |
+|                                                                                                           |
+|                                       o                            o                                      |
+|                                       |                            |                                      |
+|                                       |        * Each boot         |         * First boot                 |
+|                                       |        * All nodes         |         * Bootkube master            |
+|                                       |                            |                                      |
+'---------------------------------------o----------------------------o--------------------------------------+
 ```
diff --git a/config.tf b/config.tf
index 6e76af3d605..d2258d7f48d 100644
--- a/config.tf
+++ b/config.tf
@@ -58,20 +58,19 @@ variable "tectonic_container_images" {
 
   default = {
     addon_resizer                        = "gcr.io/google_containers/addon-resizer:2.1"
-    awscli                               = "quay.io/coreos/awscli:025a357f05242fdad6a81e8a6b520098aa65a600"
     bootkube                             = "quay.io/coreos/bootkube:v0.10.0"
-    tnc_operator                         = "quay.io/coreos/tectonic-node-controller-operator-dev:6705af4bcf26f899e347c88ffddc892a236648e4"
+    tnc_operator                         = "quay.io/coreos/tectonic-node-controller-operator-dev:32681d92536d3e180604622825ee76935d0a5692"
     etcd_cert_signer                     = "quay.io/coreos/kube-etcd-signer-server:678cc8e6841e2121ebfdb6e2db568fce290b67d6"
     etcd                                 = "quay.io/coreos/etcd:v3.2.14"
     hyperkube                            = "openshift/origin-node:latest"
-    kube_core_renderer                   = "quay.io/coreos/kube-core-renderer-dev:6705af4bcf26f899e347c88ffddc892a236648e4"
-    kube_core_operator                   = "quay.io/coreos/kube-core-operator-dev:6705af4bcf26f899e347c88ffddc892a236648e4"
-    tectonic_channel_operator            = "quay.io/coreos/tectonic-channel-operator-dev:6705af4bcf26f899e347c88ffddc892a236648e4"
-    kube_addon_operator                  = "quay.io/coreos/kube-addon-operator-dev:6705af4bcf26f899e347c88ffddc892a236648e4"
+    kube_core_renderer                   = "quay.io/coreos/kube-core-renderer-dev:32681d92536d3e180604622825ee76935d0a5692"
+    kube_core_operator                   = "quay.io/coreos/kube-core-operator-dev:32681d92536d3e180604622825ee76935d0a5692"
+    tectonic_channel_operator            = "quay.io/coreos/tectonic-channel-operator-dev:32681d92536d3e180604622825ee76935d0a5692"
+    kube_addon_operator                  = "quay.io/coreos/kube-addon-operator-dev:32681d92536d3e180604622825ee76935d0a5692"
     tectonic_alm_operator                = "quay.io/coreos/tectonic-alm-operator:v0.3.1"
-    tectonic_ingress_controller_operator = "quay.io/coreos/tectonic-ingress-controller-operator-dev:6705af4bcf26f899e347c88ffddc892a236648e4"
-    tectonic_utility_operator            = "quay.io/coreos/tectonic-utility-operator-dev:6705af4bcf26f899e347c88ffddc892a236648e4"
-    tectonic_network_operator            = "quay.io/coreos/tectonic-network-operator-dev:6705af4bcf26f899e347c88ffddc892a236648e4"
+    tectonic_ingress_controller_operator = "quay.io/coreos/tectonic-ingress-controller-operator-dev:32681d92536d3e180604622825ee76935d0a5692"
+    tectonic_utility_operator            = "quay.io/coreos/tectonic-utility-operator-dev:32681d92536d3e180604622825ee76935d0a5692"
+    tectonic_network_operator            = "quay.io/coreos/tectonic-network-operator-dev:32681d92536d3e180604622825ee76935d0a5692"
   }
 }
 
@@ -333,12 +332,12 @@ variable "tectonic_kubelet_debug_config" {
   description = "(internal) debug flags for the kubelet (used in CI only)"
 }
 
-variable "tectonic_ignition_master" {
-  type    = "string"
-  default = ""
+variable "tectonic_ignition_masters" {
+  type    = "list"
+  default = []
 
   description = <<EOF
-(internal) Ignition config file path. This is automatically generated by the installer.
+(internal) Ignition config file paths. This is automatically generated by the installer.
 EOF
 }
 
diff --git a/installer/pkg/config-generator/fixtures/test-aws.yaml b/installer/pkg/config-generator/fixtures/test-aws.yaml
index 4fb626ffbc0..fc900c822ce 100644
--- a/installer/pkg/config-generator/fixtures/test-aws.yaml
+++ b/installer/pkg/config-generator/fixtures/test-aws.yaml
@@ -6,15 +6,12 @@ networking:
   mtu: 1480
   podCIDR: 10.2.0.0/16
   serviceCIDR: 10.3.0.0/16
-masters:
+master:
   nodePools:
     - master
-workers:
+worker:
   nodePools:
     - worker
-etcd:
-  nodePools:
-    - etcd
 pullSecretPath: /path/config.json
 licensePath: /path/tectonic-license.txt
 containerLinux:
@@ -27,12 +24,6 @@ aws:
   region: eu-west-1
   sshKey: tectonic
   vpcCIDRBlock: 10.0.0.0/16
-  etcd:
-    ec2Type: t2.medium
-    rootVolume:
-      iops: 100
-      size: 30
-      type: gp2
   master:
     ec2Type: t2.medium
     rootVolume:
@@ -47,8 +38,6 @@ aws:
       type: gp2
 nodePools:
   - name: master
-    count: 2
-  - name: worker
     count: 3
-  - name: etcd
+  - name: worker
     count: 3
diff --git a/installer/pkg/config-generator/fixtures/test.yaml b/installer/pkg/config-generator/fixtures/test.yaml
index 3af36921829..0ec4099a156 100644
--- a/installer/pkg/config-generator/fixtures/test.yaml
+++ b/installer/pkg/config-generator/fixtures/test.yaml
@@ -1,9 +1,9 @@
 name: test
 platform: aws
 baseDomain: cluster.com
-etcd:
+master:
   nodePools:
-    - etcd
+    - master
 nodePools:
-  - name: etcd
+  - name: master
     count: 3
diff --git a/installer/pkg/config-generator/generator.go b/installer/pkg/config-generator/generator.go
index a00e8a36f64..0ae46cc4923 100644
--- a/installer/pkg/config-generator/generator.go
+++ b/installer/pkg/config-generator/generator.go
@@ -203,7 +203,7 @@ func (c *ConfigGenerator) tncoConfig() (*tnco.OperatorConfig, error) {
 	tncoConfig.ControllerConfig.CloudProviderConfig = "" // TODO(yifan): Get CloudProviderConfig.
 	tncoConfig.ControllerConfig.ClusterName = c.Cluster.Name
 	tncoConfig.ControllerConfig.BaseDomain = c.Cluster.BaseDomain
-	tncoConfig.ControllerConfig.EtcdInitialCount = c.Cluster.NodeCount(c.Cluster.Etcd.NodePools)
+	tncoConfig.ControllerConfig.EtcdInitialCount = c.Cluster.NodeCount(c.Cluster.Master.NodePools)
 	tncoConfig.ControllerConfig.AdditionalConfigs = []string{} // TODO(yifan): Get additional configs.
 	tncoConfig.ControllerConfig.NodePoolUpdateLimit = nil      // TODO(yifan): Get the node pool update limit.
 
@@ -271,7 +271,7 @@ func marshalYAML(obj interface{}) (string, error) {
 }
 
 func (c *ConfigGenerator) getEtcdServersURLs() string {
-	etcdServers := make([]string, c.Cluster.NodeCount(c.Cluster.Etcd.NodePools))
+	etcdServers := make([]string, c.Cluster.NodeCount(c.Cluster.Master.NodePools))
 	for i := range etcdServers {
 		etcdServers[i] = fmt.Sprintf("https://%s-etcd-%v.%s:2379", c.Cluster.Name, i, c.Cluster.BaseDomain)
 	}
diff --git a/installer/pkg/config-generator/ignition.go b/installer/pkg/config-generator/ignition.go
index 2f0ffa8c187..ee0a9d93b42 100644
--- a/installer/pkg/config-generator/ignition.go
+++ b/installer/pkg/config-generator/ignition.go
@@ -42,29 +42,50 @@ func (c *ConfigGenerator) poolToRoleMap() map[string]string {
 func (c *ConfigGenerator) GenerateIgnConfig(clusterDir string) error {
 	poolToRole := c.poolToRoleMap()
 	for _, p := range c.NodePools {
-		ignFile := p.IgnitionFile
-		ignCfg, err := parseIgnFile(ignFile)
+		role := poolToRole[p.Name]
+		if _, ok := ignFilesPath[role]; !ok {
+			return fmt.Errorf("unrecognized pool: %s", p.Name)
+		}
+
+		ignCfg, err := parseIgnFile(p.IgnitionFile)
 		if err != nil {
 			return fmt.Errorf("failed to GenerateIgnConfig for pool %s and file %s: %v", p.Name, p.IgnitionFile, err)
 		}
-		role := poolToRole[p.Name]
-		// TODO(alberto): Append block need to be different for each etcd node.
-		// add loop over count if role is etcd
-		c.embedAppendBlock(ignCfg, role)
 
-		ca := filepath.Join(clusterDir, caPath)
-		if err = c.appendCertificateAuthority(ignCfg, ca); err != nil {
+		var ignCfgs []ignconfigtypes.Config
+		for i := 0; i < p.Count; i++ {
+			ignCfgs = append(ignCfgs, *ignCfg)
+		}
+
+		ca, err := ioutil.ReadFile(filepath.Join(clusterDir, caPath))
+		if err != nil {
 			return err
 		}
 
+		for i := range ignCfgs {
+			c.appendCertificateAuthority(&ignCfgs[i], ca)
+		}
+
 		// XXX(crawford): The SSH key should only be added to the bootstrap
 		//                node. After that, MCO should be responsible for
 		//                distributing SSH keys.
-		c.embedUserBlock(ignCfg)
+		for i := range ignCfgs {
+			c.embedUserBlock(&ignCfgs[i])
+		}
 
 		fileTargetPath := filepath.Join(clusterDir, ignFilesPath[role])
-		if err = ignCfgToFile(*ignCfg, fileTargetPath); err != nil {
-			return err
+		if role == "master" {
+			for i := range ignCfgs {
+				c.embedAppendBlock(&ignCfgs[i], role, fmt.Sprintf("etcd_index=%d", i))
+				if err = ignCfgToFile(ignCfgs[i], fmt.Sprintf(fileTargetPath, i)); err != nil {
+					return err
+				}
+			}
+		} else {
+			c.embedAppendBlock(&ignCfgs[0], role, "")
+			if err = ignCfgToFile(ignCfgs[0], fileTargetPath); err != nil {
+				return err
+			}
 		}
 	}
 	return nil
@@ -91,25 +112,18 @@ func parseIgnFile(filePath string) (*ignconfigtypes.Config, error) {
 	return &cfg, nil
 }
 
-func (c *ConfigGenerator) embedAppendBlock(ignCfg *ignconfigtypes.Config, role string) {
+func (c *ConfigGenerator) embedAppendBlock(ignCfg *ignconfigtypes.Config, role string, query string) {
 	appendBlock := ignconfigtypes.ConfigReference{
-		Source:       c.getTNCURL(role),
+		Source:       c.getTNCURL(role, query),
 		Verification: ignconfigtypes.Verification{Hash: nil},
 	}
 	ignCfg.Ignition.Config.Append = append(ignCfg.Ignition.Config.Append, appendBlock)
 }
 
-func (c *ConfigGenerator) appendCertificateAuthority(ignCfg *ignconfigtypes.Config, caPath string) error {
-	ca, err := ioutil.ReadFile(caPath)
-	if err != nil {
-		return err
-	}
-
+func (c *ConfigGenerator) appendCertificateAuthority(ignCfg *ignconfigtypes.Config, ca []byte) {
 	ignCfg.Ignition.Security.TLS.CertificateAuthorities = append(ignCfg.Ignition.Security.TLS.CertificateAuthorities, ignconfigtypes.CaReference{
 		Source: dataurl.EncodeBytes(ca),
 	})
-
-	return nil
 }
 
 func (c *ConfigGenerator) embedUserBlock(ignCfg *ignconfigtypes.Config) {
@@ -123,7 +137,7 @@ func (c *ConfigGenerator) embedUserBlock(ignCfg *ignconfigtypes.Config) {
 	ignCfg.Passwd.Users = append(ignCfg.Passwd.Users, userBlock)
 }
 
-func (c *ConfigGenerator) getTNCURL(role string) string {
+func (c *ConfigGenerator) getTNCURL(role string, query string) string {
 	var u string
 
 	// cloud platforms put this behind a load balancer which remaps ports;
@@ -133,19 +147,13 @@ func (c *ConfigGenerator) getTNCURL(role string) string {
 		port = 49500
 	}
 
-	// XXX: The bootstrap node on AWS uses a CNAME to redirect TNC-bound
-	// traffic to S3. Because of this, HTTPS cannot be used.
-	scheme := "https"
-	if c.Platform == config.PlatformAWS && role == "master" {
-		scheme = "http"
-	}
-
 	if role == "master" || role == "worker" {
 		u = func() *url.URL {
 			return &url.URL{
-				Scheme: scheme,
-				Host:   fmt.Sprintf("%s-tnc.%s:%d", c.Name, c.BaseDomain, port),
-				Path:   fmt.Sprintf("/config/%s", role),
+				Scheme:   "https",
+				Host:     fmt.Sprintf("%s-tnc.%s:%d", c.Name, c.BaseDomain, port),
+				Path:     fmt.Sprintf("/config/%s", role),
+				RawQuery: query,
 			}
 		}().String()
 	}
diff --git a/installer/pkg/config/cluster.go b/installer/pkg/config/cluster.go
index f29fdc41ed3..866e51abfd0 100644
--- a/installer/pkg/config/cluster.go
+++ b/installer/pkg/config/cluster.go
@@ -13,7 +13,8 @@ import (
 
 const (
 	// IgnitionMaster is the relative path to the ign master cfg from the tf working directory
-	IgnitionMaster = "master.ign"
+	// This is a format string so that the index can be populated later
+	IgnitionMaster = "master-%d.ign"
 	// IgnitionWorker is the relative path to the ign worker cfg from the tf working directory
 	IgnitionWorker = "worker.ign"
 	// IgnitionEtcd is the relative path to the ign etcd cfg from the tf working directory
@@ -81,9 +82,9 @@ type Cluster struct {
 	CA              `json:",inline" yaml:"CA,omitempty"`
 	ContainerLinux  `json:",inline" yaml:"containerLinux,omitempty"`
 	Etcd            `json:",inline" yaml:"etcd,omitempty"`
-	IgnitionEtcd    string `json:"tectonic_ignition_etcd,omitempty" yaml:"-"`
-	IgnitionMaster  string `json:"tectonic_ignition_master,omitempty" yaml:"-"`
-	IgnitionWorker  string `json:"tectonic_ignition_worker,omitempty" yaml:"-"`
+	IgnitionEtcd    string   `json:"tectonic_ignition_etcd,omitempty" yaml:"-"`
+	IgnitionMasters []string `json:"tectonic_ignition_masters,omitempty" yaml:"-"`
+	IgnitionWorker  string   `json:"tectonic_ignition_worker,omitempty" yaml:"-"`
 	Internal        `json:",inline" yaml:"-"`
 	libvirt.Libvirt `json:",inline" yaml:"libvirt,omitempty"`
 	LicensePath     string `json:"tectonic_license_path,omitempty" yaml:"licensePath,omitempty"`
@@ -117,13 +118,16 @@ func (c *Cluster) TFVars() (string, error) {
 	c.Master.Count = c.NodeCount(c.Master.NodePools)
 	c.Worker.Count = c.NodeCount(c.Worker.NodePools)
 
-	c.IgnitionMaster = IgnitionMaster
+	for i := 0; i < c.Master.Count; i++ {
+		c.IgnitionMasters = append(c.IgnitionMasters, fmt.Sprintf(IgnitionMaster, i))
+	}
+
 	c.IgnitionWorker = IgnitionWorker
 	c.IgnitionEtcd = IgnitionEtcd
 
 	// fill in master ips
 	if c.Platform == PlatformLibvirt {
-		if err := c.Libvirt.TFVars(c.Master.Count); err != nil {
+		if err := c.Libvirt.TFVars(c.Master.Count, c.Worker.Count, c.Etcd.Count); err != nil {
 			return "", err
 		}
 	}
diff --git a/installer/pkg/config/libvirt/libvirt.go b/installer/pkg/config/libvirt/libvirt.go
index 83c2eef122d..425af0d9e7b 100644
--- a/installer/pkg/config/libvirt/libvirt.go
+++ b/installer/pkg/config/libvirt/libvirt.go
@@ -20,6 +20,9 @@ type Libvirt struct {
 	QCOWImagePath string `json:"tectonic_coreos_qcow_path,omitempty" yaml:"imagePath"`
 	Network       `json:",inline" yaml:"network"`
 	MasterIPs     []string `json:"tectonic_libvirt_master_ips,omitempty" yaml:"masterIPs"`
+	WorkerIPs     []string `json:"tectonic_libvirt_worker_ips,omitempty" yaml:"workerIPs"`
+	EtcdIPs       []string `json:"tectonic_libvirt_etcd_ips,omitempty" yaml:"etcdIPs"`
+	BootstrapIP   string `json:"tectonic_libvirt_bootstrap_ip,omitempty" yaml:"bootstrapIP"`
 }
 
 // Network describes a libvirt network configuration.
@@ -31,26 +34,68 @@ type Network struct {
 }
 
 // TFVars fills in computed Terraform variables.
-func (l *Libvirt) TFVars(masterCount int) error {
+func (l *Libvirt) TFVars(masterCount int, workerCount int, etcdCount int) error {
 	_, network, err := net.ParseCIDR(l.Network.IPRange)
 	if err != nil {
 		return fmt.Errorf("failed to parse libvirt network ipRange: %v", err)
 	}
 
+	if l.BootstrapIP == "" {
+		ip, err := cidr.Host(network, 10)
+		if err != nil {
+			return fmt.Errorf("failed to generate bootstrap IP: %v", err)
+		}
+		l.BootstrapIP = ip.String()
+	}
+
 	if len(l.MasterIPs) > 0 {
 		if len(l.MasterIPs) != masterCount {
 			return fmt.Errorf("length of MasterIPs doesn't match master count")
 		}
-		return nil
+	} else {
+		if ips, err := generateIPs("master", network, masterCount, 11); err == nil {
+			l.MasterIPs = ips
+		} else {
+			return err
+		}
 	}
 
-	for i := 0; i < masterCount; i++ {
-		ip, err := cidr.Host(network, i+10)
-		if err != nil {
-			return fmt.Errorf("failed to generate master IPs: %v", err)
+	if len(l.WorkerIPs) > 0 {
+		if len(l.WorkerIPs) != workerCount {
+			return fmt.Errorf("length of WorkerIPs doesn't match worker count")
+		}
+	} else {
+		if ips, err := generateIPs("worker", network, workerCount, 50); err == nil {
+			l.WorkerIPs = ips
+		} else {
+			return err
+		}
+	}
+
+	if len(l.EtcdIPs) > 0 {
+		if len(l.EtcdIPs) != etcdCount {
+			return fmt.Errorf("length of EtcdIPs doesn't match etcd count")
+		}
+	} else {
+		if ips, err := generateIPs("etcd", network, etcdCount, 20); err == nil {
+			l.EtcdIPs = ips
+		} else {
+			return err
 		}
-		l.MasterIPs = append(l.MasterIPs, ip.String())
 	}
 
 	return nil
 }
+
+func generateIPs(name string, network *net.IPNet, count int, offset int) ([]string, error) {
+	var ips []string
+	for i := 0; i < count; i++ {
+		ip, err := cidr.Host(network, offset+i)
+		if err != nil {
+			return nil, fmt.Errorf("failed to generate %s IPs: %v", name, err)
+		}
+		ips = append(ips, ip.String())
+	}
+
+	return ips, nil
+}
diff --git a/installer/pkg/workflow/destroy.go b/installer/pkg/workflow/destroy.go
index 21cf5dccd99..e1e5d39b4af 100644
--- a/installer/pkg/workflow/destroy.go
+++ b/installer/pkg/workflow/destroy.go
@@ -10,9 +10,7 @@ func DestroyWorkflow(clusterDir string) Workflow {
 			refreshConfigStep,
 			destroyJoinMastersStep,
 			destroyJoinWorkersStep,
-			destroyEtcdStep,
 			destroyBootstrapStep,
-			destroyTNCDNSStep,
 			destroyTopologyStep,
 			destroyAssetsStep,
 		},
@@ -23,16 +21,8 @@ func destroyAssetsStep(m *metadata) error {
 	return runDestroyStep(m, assetsStep)
 }
 
-func destroyEtcdStep(m *metadata) error {
-	return runDestroyStep(m, etcdStep)
-}
-
 func destroyBootstrapStep(m *metadata) error {
-	return runDestroyStep(m, mastersStep, []string{bootstrapOff}...)
-}
-
-func destroyTNCDNSStep(m *metadata) error {
-	return destroyTNCDNS(m)
+	return runDestroyStep(m, bootstrapStep)
 }
 
 func destroyTopologyStep(m *metadata) error {
@@ -44,7 +34,7 @@ func destroyJoinWorkersStep(m *metadata) error {
 }
 
 func destroyJoinMastersStep(m *metadata) error {
-	return runDestroyStep(m, mastersStep, []string{bootstrapOff}...)
+	return runDestroyStep(m, mastersStep)
 }
 
 func runDestroyStep(m *metadata, step string, extraArgs ...string) error {
diff --git a/installer/pkg/workflow/fixtures/terraform.tfvars b/installer/pkg/workflow/fixtures/terraform.tfvars
index 81c9c3f1227..2df6cca97c9 100644
--- a/installer/pkg/workflow/fixtures/terraform.tfvars
+++ b/installer/pkg/workflow/fixtures/terraform.tfvars
@@ -22,7 +22,10 @@
   "tectonic_container_linux_version": "latest",
   "tectonic_etcd_count": 3,
   "tectonic_ignition_etcd": "etcd.ign",
-  "tectonic_ignition_master": "master.ign",
+  "tectonic_ignition_masters": [
+    "master-0.ign",
+    "master-1.ign"
+  ],
   "tectonic_ignition_worker": "worker.ign",
   "tectonic_libvirt_network_if": "osbr0",
   "tectonic_libvirt_resolver": "8.8.8.8",
diff --git a/installer/pkg/workflow/install.go b/installer/pkg/workflow/install.go
index e3d6bc39ebf..e1f9fbf160c 100644
--- a/installer/pkg/workflow/install.go
+++ b/installer/pkg/workflow/install.go
@@ -22,10 +22,7 @@ func InstallFullWorkflow(clusterDir string) Workflow {
 			installAssetsStep,
 			generateIgnConfigStep,
 			installTopologyStep,
-			installTNCCNAMEStep,
 			installBootstrapStep,
-			installTNCARecordStep,
-			installEtcdStep,
 			installJoinMastersStep,
 			installJoinWorkersStep,
 		},
@@ -66,10 +63,7 @@ func InstallBootstrapWorkflow(clusterDir string) Workflow {
 		steps: []step{
 			refreshConfigStep,
 			installTopologyStep,
-			installTNCCNAMEStep,
 			installBootstrapStep,
-			installTNCARecordStep,
-			installEtcdStep,
 		},
 	}
 }
@@ -104,28 +98,13 @@ func installTopologyStep(m *metadata) error {
 
 func installBootstrapStep(m *metadata) error {
 	if !clusterIsBootstrapped(m.clusterDir) {
-		return runInstallStep(m, mastersStep, []string{bootstrapOn}...)
+		return runInstallStep(m, bootstrapStep)
 	}
 	return nil
 }
 
-func installTNCCNAMEStep(m *metadata) error {
-	if !clusterIsBootstrapped(m.clusterDir) {
-		return createTNCCNAME(m)
-	}
-	return nil
-}
-
-func installTNCARecordStep(m *metadata) error {
-	return createTNCARecord(m)
-}
-
-func installEtcdStep(m *metadata) error {
-	return runInstallStep(m, etcdStep)
-}
-
 func installJoinMastersStep(m *metadata) error {
-	return runInstallStep(m, mastersStep, []string{bootstrapOff}...)
+	return runInstallStep(m, mastersStep)
 }
 
 func installJoinWorkersStep(m *metadata) error {
diff --git a/installer/pkg/workflow/utils.go b/installer/pkg/workflow/utils.go
index 751a9e26866..d768b664872 100644
--- a/installer/pkg/workflow/utils.go
+++ b/installer/pkg/workflow/utils.go
@@ -14,17 +14,14 @@ import (
 
 const (
 	assetsStep       = "assets"
+	bootstrapStep    = "bootstrap"
 	binaryPrefix     = "installer"
-	bootstrapOff     = "-var=tectonic_bootstrap=false"
-	bootstrapOn      = "-var=tectonic_bootstrap=true"
 	configFileName   = "config.yaml"
-	etcdStep         = "etcd"
 	internalFileName = "internal.yaml"
 	joinWorkersStep  = "joining_workers"
 	mastersStep      = "masters"
 	newTLSStep       = "tls"
 	stepsBaseDir     = "steps"
-	tncDNSStep       = "tnc_dns"
 	topologyStep     = "topology"
 )
 
@@ -165,18 +162,5 @@ func baseLocation() (string, error) {
 
 func clusterIsBootstrapped(stateDir string) bool {
 	return hasStateFile(stateDir, topologyStep) &&
-		hasStateFile(stateDir, mastersStep) &&
-		hasStateFile(stateDir, tncDNSStep)
-}
-
-func createTNCCNAME(m *metadata) error {
-	return runInstallStep(m, tncDNSStep, []string{bootstrapOn}...)
-}
-
-func createTNCARecord(m *metadata) error {
-	return runInstallStep(m, tncDNSStep, []string{bootstrapOff}...)
-}
-
-func destroyTNCDNS(m *metadata) error {
-	return runDestroyStep(m, tncDNSStep, []string{bootstrapOff}...)
+		hasStateFile(stateDir, bootstrapStep)
 }
diff --git a/modules/aws/etcd/README.md b/modules/aws/etcd/README.md
deleted file mode 100644
index 4776ff2d9a0..00000000000
--- a/modules/aws/etcd/README.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# AWS Etcd Module
-
-This [Terraform][] [module][] makes it easy to create [etcd][] nodes on [AWS][].
-
-Read the [etcd recommended hardware guide][hardware] for best performance.
-
-## Example
-
-```hcl
-locals {
-  region = "us-east-1"
-}
-
-provider "aws" {
-  region = "${local.region}"
-}
-
-resource "aws_s3_bucket" "etcd_ignition" {
-}
-
-resource "aws_vpc" "example" {
-  cidr_block           = "10.0.0.0/16"
-  enable_dns_hostnames = true
-  enable_dns_support   = true
-}
-
-resource "aws_subnet" "example" {
-  vpc_id     = "${aws_vpc.example.id}"
-  cidr_block = "${aws_vpc.example.cidr_block}"
-}
-
-resource "aws_security_group" "etcd" {
-  vpc_id = "${aws_vpc.example.id}"
-
-  ingress {
-    from_port   = 2379
-    to_port     = 2380
-    protocol    = "tcp"
-    cidr_blocks = ["${aws_subnet.example.cidr_block}"]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["${aws_subnet.example.cidr_block}"]
-  }
-}
-
-module "etcd" {
-  source = "github.com/openshift/installer//modules/aws/etcd"
-
-  base_domain    = "openshift.example.com"
-  cluster_id     = "123"
-  cluster_name   = "my-cluster"
-  instance_count = "3"
-  region         = "${local.region}"
-  s3_bucket      = "${aws_s3_bucket.etcd_ignition.id}"
-  sg_ids         = ["${aws_security_group.etcd.id}"]
-  subnets        = ["${aws_subnet.example.id}"]
-}
-```
-
-You can set `container_linux_channel` and `container_linux_version` if you need a specific [Container Linux][container-linux] install.
-Alternatively, you can set `ec2_ami` directly if you want to use an [AMI][] that is not Container Linux.
-
-[AMI]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html
-[AWS]: https://aws.amazon.com/
-[container-linux]: https://coreos.com/os/docs/latest/
-[etcd]: https://github.com/coreos/etcd
-[hardware]: https://github.com/coreos/etcd/blob/v3.3.8/Documentation/op-guide/hardware.md#example-hardware-configurations
-[module]: https://www.terraform.io/docs/modules/
-[Terraform]: https://www.terraform.io/
diff --git a/modules/aws/etcd/ignition.tf b/modules/aws/etcd/ignition.tf
deleted file mode 100644
index 1f9053e14d2..00000000000
--- a/modules/aws/etcd/ignition.tf
+++ /dev/null
@@ -1,16 +0,0 @@
-data "ignition_config" "tnc" {
-  count = "${var.instance_count}"
-
-  append {
-    source = "${format("http://${var.cluster_name}-tnc.${var.base_domain}/config/etcd?etcd_index=%d", count.index)}"
-
-    # TODO: add verification
-  }
-
-  # Used for loading certificates
-  append {
-    source = "${format("s3://%s/ignition_etcd_%d.json", var.s3_bucket, count.index)}"
-
-    # TODO: add verification
-  }
-}
diff --git a/modules/aws/etcd/nodes.tf b/modules/aws/etcd/nodes.tf
deleted file mode 100644
index d87d7b49e56..00000000000
--- a/modules/aws/etcd/nodes.tf
+++ /dev/null
@@ -1,119 +0,0 @@
-locals {
-  arn = "aws"
-}
-
-module "ami" {
-  source = "../ami"
-
-  region          = "${var.region}"
-  release_channel = "${var.container_linux_channel}"
-  release_version = "${var.container_linux_version}"
-}
-
-resource "aws_iam_instance_profile" "etcd" {
-  name = "${var.cluster_name}-etcd-profile"
-
-  role = "${var.etcd_iam_role == "" ?
-    join("|", aws_iam_role.etcd_role.*.name) :
-    join("|", data.aws_iam_role.etcd_role.*.name)
-  }"
-}
-
-data "aws_iam_role" "etcd_role" {
-  count = "${var.etcd_iam_role == "" ? 0 : 1}"
-  name  = "${var.etcd_iam_role}"
-}
-
-resource "aws_iam_role" "etcd_role" {
-  count = "${var.etcd_iam_role == "" ? 1 : 0}"
-  name  = "${var.cluster_name}-etcd-role"
-  path  = "/"
-
-  assume_role_policy = <<EOF
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Action": "sts:AssumeRole",
-            "Principal": {
-                "Service": "ec2.amazonaws.com"
-            },
-            "Effect": "Allow",
-            "Sid": ""
-        }
-    ]
-}
-EOF
-}
-
-resource "aws_iam_role_policy" "etcd" {
-  count = "${var.etcd_iam_role == "" ? 1 : 0}"
-  name  = "${var.cluster_name}_etcd_policy"
-  role  = "${aws_iam_role.etcd_role.id}"
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": "ec2:Describe*",
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": "ec2:AttachVolume",
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": "ec2:DetachVolume",
-      "Resource": "*"
-    },
-    {
-      "Action" : [
-        "s3:GetObject"
-      ],
-      "Resource": "arn:${local.arn}:s3:::*",
-      "Effect": "Allow"
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_instance" "etcd_node" {
-  count = "${var.instance_count}"
-  ami   = "${coalesce(var.ec2_ami, module.ami.id)}"
-
-  iam_instance_profile   = "${aws_iam_instance_profile.etcd.name}"
-  instance_type          = "${var.ec2_type}"
-  subnet_id              = "${element(var.subnets, count.index)}"
-  user_data              = "${data.ignition_config.tnc.*.rendered[count.index]}"
-  vpc_security_group_ids = ["${var.sg_ids}"]
-
-  lifecycle {
-    # Ignore changes in the AMI which force recreation of the resource. This
-    # avoids accidental deletion of nodes whenever a new CoreOS Release comes
-    # out.
-    ignore_changes = ["ami"]
-  }
-
-  tags = "${merge(map(
-      "Name", "${var.cluster_name}-etcd-${count.index}",
-      "kubernetes.io/cluster/${var.cluster_name}", "owned",
-      "tectonicClusterID", "${var.cluster_id}"
-    ), var.extra_tags)}"
-
-  root_block_device {
-    volume_type = "${var.root_volume_type}"
-    volume_size = "${var.root_volume_size}"
-    iops        = "${var.root_volume_type == "io1" ? var.root_volume_iops : var.root_volume_type == "gp2" ? min(10000, max(100, 3 * var.root_volume_size)) : 0}"
-  }
-
-  volume_tags = "${merge(map(
-    "Name", "${var.cluster_name}-etcd-${count.index}-vol",
-    "kubernetes.io/cluster/${var.cluster_name}", "owned",
-    "tectonicClusterID", "${var.cluster_id}"
-  ), var.extra_tags)}"
-}
diff --git a/modules/aws/etcd/outputs.tf b/modules/aws/etcd/outputs.tf
deleted file mode 100644
index 8fbb67dde28..00000000000
--- a/modules/aws/etcd/outputs.tf
+++ /dev/null
@@ -1,3 +0,0 @@
-output "ip_addresses" {
-  value = "${aws_instance.etcd_node.*.private_ip}"
-}
diff --git a/modules/aws/etcd/variables.tf b/modules/aws/etcd/variables.tf
deleted file mode 100644
index b1f9aa85180..00000000000
--- a/modules/aws/etcd/variables.tf
+++ /dev/null
@@ -1,97 +0,0 @@
-variable "base_domain" {
-  type = "string"
-}
-
-variable "cluster_id" {
-  type = "string"
-}
-
-variable "cluster_name" {
-  type = "string"
-}
-
-variable "container_linux_channel" {
-  type    = "string"
-  default = "stable"
-}
-
-variable "container_linux_version" {
-  type    = "string"
-  default = "latest"
-}
-
-variable "instance_count" {
-  default = "3"
-}
-
-variable "region" {
-  type = "string"
-
-  description = <<EOF
-This is the AWS region.
-It is passed through to the Terraform aws provider: https://www.terraform.io/docs/providers/aws/#region
-EOF
-}
-
-variable "subnets" {
-  type = "list"
-}
-
-variable "container_image" {
-  type    = "string"
-  default = "quay.io/coreos/etcd:v3.3.8"
-}
-
-variable "ec2_type" {
-  type    = "string"
-  default = "t2.medium"
-}
-
-variable "ec2_ami" {
-  type    = "string"
-  default = ""
-}
-
-variable "extra_tags" {
-  description = "Extra AWS tags to be applied to created resources."
-  type        = "map"
-  default     = {}
-}
-
-variable "root_volume_type" {
-  type        = "string"
-  default     = "gp2"
-  description = "The type of volume for the root block device."
-}
-
-variable "root_volume_size" {
-  type        = "string"
-  default     = "30"
-  description = "The size of the volume in gigabytes for the root block device."
-}
-
-variable "root_volume_iops" {
-  type        = "string"
-  default     = "100"
-  description = "The amount of provisioned IOPS for the root block device."
-}
-
-variable "sg_ids" {
-  type        = "list"
-  description = "The security group IDs to be applied."
-}
-
-variable "s3_bucket" {
-  type = "string"
-}
-
-variable "etcd_iam_role" {
-  type        = "string"
-  default     = ""
-  description = "IAM role to use for the instance profiles of etcd nodes."
-}
-
-variable "dns_server_ip" {
-  type    = "string"
-  default = ""
-}
diff --git a/modules/aws/master/main.tf b/modules/aws/master/main.tf
index a078a12e3ac..ccab9e9c406 100644
--- a/modules/aws/master/main.tf
+++ b/modules/aws/master/main.tf
@@ -91,10 +91,11 @@ resource "aws_instance" "master" {
   count = "${var.instance_count}"
   ami   = "${coalesce(var.ec2_ami, module.ami.id)}"
 
-  iam_instance_profile        = "${aws_iam_instance_profile.master.name}"
-  instance_type               = "${var.ec2_type}"
-  subnet_id                   = "${element(var.subnet_ids, count.index)}"
-  user_data                   = "${var.user_data_ign}"
+  iam_instance_profile = "${aws_iam_instance_profile.master.name}"
+  instance_type        = "${var.ec2_type}"
+  subnet_id            = "${element(var.subnet_ids, count.index)}"
+  user_data            = "${file(format("%s/%s", path.cwd, var.user_data_igns[count.index]))}"
+
   vpc_security_group_ids      = ["${var.master_sg_ids}"]
   associate_public_ip_address = "${var.public_endpoints}"
 
diff --git a/modules/aws/master/outputs.tf b/modules/aws/master/outputs.tf
index 74488bdbcbf..d011a457df3 100644
--- a/modules/aws/master/outputs.tf
+++ b/modules/aws/master/outputs.tf
@@ -9,3 +9,7 @@ output "aws_lbs" {
 output "cluster_id" {
   value = "${var.cluster_id}"
 }
+
+output "ip_addresses" {
+  value = "${aws_instance.master.*.private_ip}"
+}
diff --git a/modules/aws/master/variables.tf b/modules/aws/master/variables.tf
index 7f9f019bb46..988440f8bb5 100644
--- a/modules/aws/master/variables.tf
+++ b/modules/aws/master/variables.tf
@@ -109,6 +109,6 @@ variable "kubeconfig_content" {
   default = ""
 }
 
-variable "user_data_ign" {
-  type = "string"
+variable "user_data_igns" {
+  type = "list"
 }
diff --git a/modules/aws/target-defaults/README.md b/modules/aws/target-defaults/README.md
deleted file mode 100644
index 1f9b09432b7..00000000000
--- a/modules/aws/target-defaults/README.md
+++ /dev/null
@@ -1,30 +0,0 @@
-# AWS Default Module
-
-This [Terraform][] [module][] gives us a central location for [AWS][]-specific defaults.
-For example, on AWS our default [etcd][] count depends on the availability zone count.
-On libvirt, on the other hand, our default etcd count is one.
-Because Terraform's [HashiCorp Configuration Language (HCL)[hcl] does not allow us to declare such conditional defaults directly, we use this module to convert user-supplied default values to values appropriate to the target system.
-
-## Example
-
-From the module directory:
-
-```console
-$ terraform init
-$ terraform apply --var region=us-east-1  # currently 6 zones
-$ terraform output etcd_count
-5
-$ terraform apply --var region=us-east-2
-$ terraform output etcd_count
-3
-$ terraform apply --var region=us-east-2 --var etcd_count=1  # currently 3 zones
-$ terraform output etcd_count
-1
-```
-
-When you're done, clean up by removing the `.terraform` directory created by `init` and the `terraform.tfstate*` files created by `apply`.
-
-[AWS]: https://aws.amazon.com/
-[etcd]: https://github.com/coreos/etcd
-[module]: https://www.terraform.io/docs/modules/
-[Terraform]: https://www.terraform.io/
diff --git a/modules/aws/target-defaults/main.tf b/modules/aws/target-defaults/main.tf
deleted file mode 100644
index 5660dc7a361..00000000000
--- a/modules/aws/target-defaults/main.tf
+++ /dev/null
@@ -1,16 +0,0 @@
-provider "aws" {
-  region  = "${var.region}"
-  profile = "${var.profile}"
-  version = "1.8.0"
-
-  assume_role {
-    role_arn = "${var.role_arn}"
-  }
-}
-
-data "aws_availability_zones" "zones" {}
-
-locals {
-  zone_count     = "${length(data.aws_availability_zones.zones.names)}"
-  zone_count_odd = "${local.zone_count % 2 == 0 ? local.zone_count - 1 : local.zone_count}"
-}
diff --git a/modules/aws/target-defaults/outputs.tf b/modules/aws/target-defaults/outputs.tf
deleted file mode 100644
index 1b55b018bfb..00000000000
--- a/modules/aws/target-defaults/outputs.tf
+++ /dev/null
@@ -1,8 +0,0 @@
-output "etcd_count" {
-  value = "${var.etcd_count > 0 ? var.etcd_count : max(local.zone_count_odd, 3)}"
-
-  description = <<EOF
-The number of etcd nodes to be created.
-This will always be greater than zero.
-EOF
-}
diff --git a/modules/aws/target-defaults/variables.tf b/modules/aws/target-defaults/variables.tf
deleted file mode 100644
index e5e3c20e731..00000000000
--- a/modules/aws/target-defaults/variables.tf
+++ /dev/null
@@ -1,38 +0,0 @@
-variable "profile" {
-  type    = "string"
-  default = ""
-
-  description = <<EOF
-(Optional) This is the AWS profile name as set in the shared credentials file.
-This is passed through to the Terraform aws provider: https://www.terraform.io/docs/providers/aws/#profile
-EOF
-}
-
-variable "region" {
-  type = "string"
-
-  description = <<EOF
-This is the AWS region.
-It is passed through to the Terraform aws provider: https://www.terraform.io/docs/providers/aws/#region
-EOF
-}
-
-variable "role_arn" {
-  type    = "string"
-  default = ""
-
-  description = <<EOF
-(Optional) Name (full ARN) of IAM role to use to access AWS.
-It is passed through to the Terraform aws provider: https://www.terraform.io/docs/providers/aws/#role_arn
-EOF
-}
-
-variable "etcd_count" {
-  type    = "string"
-  default = "0"
-
-  description = <<EOF
-The number of etcd nodes to be created.
-If set to zero, the count of etcd nodes will be determined automatically.
-EOF
-}
diff --git a/modules/bootkube/resources/manifests/02-ingress-namespace.yaml b/modules/bootkube/resources/manifests/02-ingress-namespace.yaml
index 1a30847cb6d..b02ff7d5c2c 100644
--- a/modules/bootkube/resources/manifests/02-ingress-namespace.yaml
+++ b/modules/bootkube/resources/manifests/02-ingress-namespace.yaml
@@ -2,9 +2,9 @@ apiVersion: v1
 kind: Namespace
 metadata:
   # This is the namespace used to hold the tectonic ingress controllers
-  name: tectonic-ingress
+  name: openshift-ingress
   # Give the namespace a label, so we can select for it in networkpolicy
   labels:
     kubernetes.io/ingress.class: tectonic
-    name: tectonic-ingress
+    name: openshift-ingress
     openshift.io/run-level: "1"
diff --git a/modules/ignition/assets.tf b/modules/ignition/assets.tf
index dcfeda81e12..087dcbe4a1d 100644
--- a/modules/ignition/assets.tf
+++ b/modules/ignition/assets.tf
@@ -59,12 +59,6 @@ data "ignition_systemd_unit" "kubelet_workaround" {
   content = "${data.template_file.kubelet_workaround.rendered}"
 }
 
-data "ignition_systemd_unit" "rm_assets" {
-  name    = "rm-assets.service"
-  enabled = true
-  content = "${file("${path.module}/resources/services/rm-assets.service")}"
-}
-
 data "ignition_systemd_unit" "locksmithd" {
   name = "locksmithd.service"
   mask = true
diff --git a/modules/ignition/outputs.tf b/modules/ignition/outputs.tf
index 4e426b725a8..09a87d2d990 100644
--- a/modules/ignition/outputs.tf
+++ b/modules/ignition/outputs.tf
@@ -33,6 +33,5 @@ output "ignition_systemd_id_list" {
     "${data.ignition_systemd_unit.kubelet_workaround.id}",
     "${data.ignition_systemd_unit.locksmithd.id}",
     "${data.ignition_systemd_unit.update_ca_certificates_dropin.id}",
-    "${data.ignition_systemd_unit.rm_assets.id}",
   ]
 }
diff --git a/modules/ignition/resources/services/rm-assets.service b/modules/ignition/resources/services/rm-assets.service
deleted file mode 100644
index ceda149507e..00000000000
--- a/modules/ignition/resources/services/rm-assets.service
+++ /dev/null
@@ -1,19 +0,0 @@
-[Unit]
-Description=Clean up install assets from S3
-ConditionPathExists=/opt/tectonic
-Requires=tectonic.service
-After=bootkube.service tectonic.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=true
-WorkingDirectory=/opt
-
-User=root
-Group=root
-
-ExecStartPre=/usr/bin/bash /opt/tectonic/rm-assets.sh
-ExecStart=/usr/bin/echo "cleaned up installation assets"
-
-[Install]
-WantedBy=multi-user.target
diff --git a/modules/libvirt/target-defaults/README.md b/modules/libvirt/target-defaults/README.md
deleted file mode 100644
index 625f9c6a3f1..00000000000
--- a/modules/libvirt/target-defaults/README.md
+++ /dev/null
@@ -1,27 +0,0 @@
-# Libvirt Default Module
-
-This [Terraform][] [module][] gives us a central location for [libvirt][]-specific defaults.
-For example, on AWS our default [etcd][] count depends on the availability zone count.
-On libvirt, on the other hand, our default etcd count is one.
-Because Terraform's [HashiCorp Configuration Language (HCL)[hcl] does not allow us to declare such conditional defaults directly, we use this module to convert user-supplied default values to values appropriate to the target system.
-
-## Example
-
-From the module directory:
-
-```console
-$ terraform init
-$ terraform apply
-$ terraform output etcd_count
-1
-$ terraform apply --var etcd_count=3
-$ terraform output etcd_count
-3
-```
-
-When you're done, clean up by removing the `terraform.tfstate*` files created by `apply`.
-
-[etcd]: https://github.com/coreos/etcd
-[libvirt]: https://libvirt.org/
-[module]: https://www.terraform.io/docs/modules/
-[Terraform]: https://www.terraform.io/
diff --git a/modules/libvirt/target-defaults/main.tf b/modules/libvirt/target-defaults/main.tf
deleted file mode 100644
index f304ae30d88..00000000000
--- a/modules/libvirt/target-defaults/main.tf
+++ /dev/null
@@ -1,4 +0,0 @@
-# nothing to do here, just conforming to [1]:
-#
-# [1]: https://www.terraform.io/docs/modules/create.html#standard-module-structure
-
diff --git a/modules/libvirt/target-defaults/outputs.tf b/modules/libvirt/target-defaults/outputs.tf
deleted file mode 100644
index 36e1031e18a..00000000000
--- a/modules/libvirt/target-defaults/outputs.tf
+++ /dev/null
@@ -1,8 +0,0 @@
-output "etcd_count" {
-  value = "${var.etcd_count > 0 ? var.etcd_count : 1}"
-
-  description = <<EOF
-The number of etcd nodes to be created.
-This will always be greater than zero.
-EOF
-}
diff --git a/modules/libvirt/target-defaults/variables.tf b/modules/libvirt/target-defaults/variables.tf
deleted file mode 100644
index 04cb8e40d45..00000000000
--- a/modules/libvirt/target-defaults/variables.tf
+++ /dev/null
@@ -1,9 +0,0 @@
-variable "etcd_count" {
-  type    = "string"
-  default = "0"
-
-  description = <<EOF
-The number of etcd nodes to be created.
-If set to zero, the count of etcd nodes will be determined automatically.
-EOF
-}
diff --git a/modules/tectonic/assets.tf b/modules/tectonic/assets.tf
index 7af8ba0999e..58826121223 100644
--- a/modules/tectonic/assets.tf
+++ b/modules/tectonic/assets.tf
@@ -55,6 +55,6 @@ data "template_file" "tectonic_service" {
 
 data "ignition_systemd_unit" "tectonic_service" {
   name    = "tectonic.service"
-  enabled = false
+  enabled = true
   content = "${data.template_file.tectonic_service.rendered}"
 }
diff --git a/modules/tectonic/resources/manifests/ingress/cluster-config.yaml b/modules/tectonic/resources/manifests/ingress/cluster-config.yaml
index f73e7610012..13192da85bf 100644
--- a/modules/tectonic/resources/manifests/ingress/cluster-config.yaml
+++ b/modules/tectonic/resources/manifests/ingress/cluster-config.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: cluster-config-v1
-  namespace: tectonic-ingress
+  namespace: openshift-ingress
 data:
   ingress-config: |
     apiVersion: v1
diff --git a/modules/tectonic/resources/manifests/ingress/pull.json b/modules/tectonic/resources/manifests/ingress/pull.json
index e1909447fbc..410066261f5 100644
--- a/modules/tectonic/resources/manifests/ingress/pull.json
+++ b/modules/tectonic/resources/manifests/ingress/pull.json
@@ -3,7 +3,7 @@
   "kind": "Secret",
   "type": "kubernetes.io/dockerconfigjson",
   "metadata": {
-    "namespace": "tectonic-ingress",
+    "namespace": "openshift-ingress",
     "name": "coreos-pull-secret"
   },
   "data": {
diff --git a/modules/tectonic/resources/manifests/ingress/svc-account.yaml b/modules/tectonic/resources/manifests/ingress/svc-account.yaml
index 6403ef72365..bfebbd07690 100644
--- a/modules/tectonic/resources/manifests/ingress/svc-account.yaml
+++ b/modules/tectonic/resources/manifests/ingress/svc-account.yaml
@@ -2,4 +2,4 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: tectonic-ingress-controller-operator
-  namespace: tectonic-ingress
+  namespace: openshift-ingress
diff --git a/modules/tectonic/resources/manifests/rbac/binding-admin.yaml b/modules/tectonic/resources/manifests/rbac/binding-admin.yaml
index 3a0d4db9a74..c0f3294fc04 100644
--- a/modules/tectonic/resources/manifests/rbac/binding-admin.yaml
+++ b/modules/tectonic/resources/manifests/rbac/binding-admin.yaml
@@ -7,7 +7,7 @@ subjects:
     namespace: tectonic-system
     name: default
   - kind: ServiceAccount
-    namespace: tectonic-ingress
+    namespace: openshift-ingress
     name: tectonic-ingress-controller-operator
 roleRef:
   kind: ClusterRole
diff --git a/modules/tectonic/resources/manifests/secrets/ingress-tls.yaml b/modules/tectonic/resources/manifests/secrets/ingress-tls.yaml
index 6b8106ff0dd..7898800cc04 100644
--- a/modules/tectonic/resources/manifests/secrets/ingress-tls.yaml
+++ b/modules/tectonic/resources/manifests/secrets/ingress-tls.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: tectonic-ingress-tls
-  namespace: tectonic-ingress
+  namespace: openshift-ingress
 type: Opaque
 data:
   tls.crt: ${ingress_tls_cert}
diff --git a/modules/tectonic/resources/manifests/security/priviledged-scc-tectonic.yaml b/modules/tectonic/resources/manifests/security/priviledged-scc-tectonic.yaml
index f035ce463cf..89975bfddc5 100644
--- a/modules/tectonic/resources/manifests/security/priviledged-scc-tectonic.yaml
+++ b/modules/tectonic/resources/manifests/security/priviledged-scc-tectonic.yaml
@@ -16,7 +16,7 @@ fsGroup:
   type: RunAsAny
 groups:
 - system:serviceaccounts:tectonic-system
-- system:serviceaccounts:tectonic-ingress
+- system:serviceaccounts:openshift-ingress
 readOnlyRootFilesystem: false
 runAsUser:
   type: RunAsAny
diff --git a/modules/tectonic/resources/manifests/updater/operators/tectonic-ingress-controller-operator.yaml b/modules/tectonic/resources/manifests/updater/operators/tectonic-ingress-controller-operator.yaml
index 533aa2b4c34..4a7a4e59087 100644
--- a/modules/tectonic/resources/manifests/updater/operators/tectonic-ingress-controller-operator.yaml
+++ b/modules/tectonic/resources/manifests/updater/operators/tectonic-ingress-controller-operator.yaml
@@ -2,7 +2,7 @@ apiVersion: apps/v1beta2
 kind: Deployment
 metadata:
   name: tectonic-ingress-controller-operator
-  namespace: tectonic-ingress
+  namespace: openshift-ingress
   labels:
     k8s-app: tectonic-ingress-controller-operator
     managed-by-channel-operator: "true"
diff --git a/modules/tectonic/resources/tectonic.service b/modules/tectonic/resources/tectonic.service
index 5fa7a98bad3..5b100a4c631 100644
--- a/modules/tectonic/resources/tectonic.service
+++ b/modules/tectonic/resources/tectonic.service
@@ -14,3 +14,6 @@ Group=root
 
 ExecStart=/usr/bin/bash /opt/tectonic/tectonic-wrapper.sh
 ExecStartPost=/bin/touch /opt/tectonic/init_tectonic.done
+
+[Install]
+WantedBy=multi-user.target
diff --git a/steps/assets/aws/main.tf b/steps/assets/aws/main.tf
index 323ee595d0c..5f9f4b8e4a3 100644
--- a/steps/assets/aws/main.tf
+++ b/steps/assets/aws/main.tf
@@ -1,19 +1,7 @@
-# Terraform doesn't support "inheritance"
-# So we have to pass all variables down
-module "defaults" {
-  source = "../../../modules/aws/target-defaults"
-
-  region     = "${var.tectonic_aws_region}"
-  profile    = "${var.tectonic_aws_profile}"
-  role_arn   = "${var.tectonic_aws_installer_role}"
-  etcd_count = "${var.tectonic_etcd_count}"
-}
-
 module assets_base {
   source = "../base"
 
   cloud_provider = "aws"
-  etcd_count     = "${module.defaults.etcd_count}"
   ingress_kind   = "haproxy-router"
 
   tectonic_admin_email             = "${var.tectonic_admin_email}"
@@ -36,38 +24,3 @@ module assets_base {
   tectonic_update_channel          = "${var.tectonic_update_channel}"
   tectonic_versions                = "${var.tectonic_versions}"
 }
-
-# Removing assets is platform-specific
-# But it must be installed in /opt/tectonic/rm-assets.sh
-data "template_file" "rm_assets_sh" {
-  template = "${file("${path.module}/resources/rm-assets.sh")}"
-
-  vars {
-    cluster_name       = "${var.tectonic_cluster_name}"
-    awscli_image       = "${var.tectonic_container_images["awscli"]}"
-    bucket_s3_location = "${var.tectonic_cluster_name}-tnc.${var.tectonic_base_domain}"
-  }
-}
-
-data "ignition_file" "rm_assets_sh" {
-  filesystem = "root"
-  path       = "/opt/tectonic/rm-assets.sh"
-  mode       = "0700"
-
-  content {
-    content = "${data.template_file.rm_assets_sh.rendered}"
-  }
-}
-
-data "ignition_config" "bootstrap" {
-  files = ["${flatten(list(
-    list(
-      data.ignition_file.rm_assets_sh.id,
-    ),
-    module.assets_base.ignition_bootstrap_files,
-  ))}"]
-
-  systemd = [
-    "${module.assets_base.ignition_bootstrap_systemd}",
-  ]
-}
diff --git a/steps/assets/aws/outputs.tf b/steps/assets/aws/outputs.tf
index ed03dd15725..70a832ecb02 100644
--- a/steps/assets/aws/outputs.tf
+++ b/steps/assets/aws/outputs.tf
@@ -1,7 +1,6 @@
+# XXX(crawford): This is only needed because the installer will only run either
+#                AWS or libvirt. This prevents us from outputting anything
+#                directly from the base.
 output "ignition_bootstrap" {
-  value = "${data.ignition_config.bootstrap.rendered}"
-}
-
-output "ignition_etcd" {
-  value = "${module.assets_base.ignition_etcd}"
+  value = "${module.assets_base.ignition_bootstrap}"
 }
diff --git a/steps/assets/aws/resources/rm-assets.sh b/steps/assets/aws/resources/rm-assets.sh
deleted file mode 100644
index 23c8bf3252f..00000000000
--- a/steps/assets/aws/resources/rm-assets.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/bin/bash
-set -e
-
-s3_clean() {
-    # instead of simply removing the remote assets.zip,
-    # overwrite it with a zero byte file, such that terraform doesn't
-    # detect deletion but rather a simple change which it can ignore.
-    touch /tmp/empty
-
-    # shellcheck disable=SC2086,SC2154,SC2016
-    /usr/bin/docker run \
-        --volume /tmp:/tmp \
-        --network=host \
-        --env LOCATION="${bucket_s3_location}" \
-        --entrypoint=/bin/bash \
-        ${awscli_image} \
-        -c '
-            set -e
-            set -o pipefail
-            set -u
-            REGION=$(wget -q -O - http://169.254.169.254/latest/meta-data/placement/availability-zone | sed '"'"'s/[a-zA-Z]$//'"'"')
-            /usr/bin/aws --region="$REGION" s3 cp /tmp/empty s3://"$LOCATION/config/bootstrap"
-        '
-}
-
-bootstrap_cleanup() {
-    rm /etc/systemd/system/multi-user.target.wants/rm-assets.service
-    rm /etc/systemd/system/tectonic.service
-    rm /etc/systemd/system/bootkube.service
-    rm /etc/systemd/system/rm-assets.service
-    rm -rf /opt/tectonic
-}
-
-until s3_clean; do
-  echo "failed to clean up S3 assets. retrying in 5 seconds."
-  sleep 5
-done
-
-bootstrap_cleanup
diff --git a/steps/assets/base/ignition-bootstrap.tf b/steps/assets/base/ignition-bootstrap.tf
index 68676b76129..ad5e0c0be61 100644
--- a/steps/assets/base/ignition-bootstrap.tf
+++ b/steps/assets/base/ignition-bootstrap.tf
@@ -4,14 +4,14 @@ module "ignition_bootstrap" {
   cloud_provider       = "${var.cloud_provider}"
   container_images     = "${var.tectonic_container_images}"
   etcd_ca_cert_pem     = "${local.etcd_ca_cert_pem}"
-  etcd_count           = "${length(data.template_file.etcd_hostname_list.*.id)}"
+  etcd_count           = "${var.tectonic_master_count}"
   image_re             = "${var.tectonic_image_re}"
   ingress_ca_cert_pem  = "${local.ingress_ca_cert_pem}"
   root_ca_cert_pem     = "${local.root_ca_cert_pem}"
   kube_dns_service_ip  = "${module.bootkube.kube_dns_service_ip}"
   kubelet_debug_config = "${var.tectonic_kubelet_debug_config}"
-  kubelet_node_label   = "node-role.kubernetes.io/master"
-  kubelet_node_taints  = "node-role.kubernetes.io/master=:NoSchedule"
+  kubelet_node_label   = "node-role.kubernetes.io/bootstrap"
+  kubelet_node_taints  = "node-role.kubernetes.io/bootstrap=:NoSchedule"
 }
 
 # The cluster configs written by the install binary external to Terraform.
@@ -75,3 +75,45 @@ data "ignition_file" "kubelet_kubeconfig" {
     content = "${module.bootkube.kubeconfig-kubelet}"
   }
 }
+
+data "ignition_user" "core" {
+  name = "core"
+
+  ssh_authorized_keys = [
+    "${var.tectonic_admin_ssh_key}",
+  ]
+}
+
+data "ignition_config" "bootstrap" {
+  files = ["${compact(flatten(list(
+    list(
+      data.ignition_file.kube-system_cluster_config.id,
+      data.ignition_file.tectonic_cluster_config.id,
+      data.ignition_file.tnco_config.id,
+      data.ignition_file.kco_config.id,
+      data.ignition_file.bootstrap_kubeconfig.id,
+      data.ignition_file.kubelet_kubeconfig.id,
+    ),
+    module.ignition_bootstrap.etcd_crt_id_list,
+    module.ignition_bootstrap.ignition_file_id_list,
+    module.bootkube.ignition_file_id_list,
+    module.tectonic.ignition_file_id_list,
+    local.ca_certs_ignition_file_id_list,
+    local.etcd_certs_ignition_file_id_list,
+    local.kube_certs_ignition_file_id_list,
+    local.tnc_certs_ignition_file_id_list,
+    local.service_account_keys_ignition_file_id_list,
+   )))}"]
+
+  systemd = ["${compact(flatten(list(
+    list(
+      module.bootkube.systemd_service_id,
+      module.tectonic.systemd_service_id,
+    ),
+    module.ignition_bootstrap.ignition_systemd_id_list,
+   )))}"]
+
+  users = [
+    "${data.ignition_user.core.id}",
+  ]
+}
diff --git a/steps/assets/base/ignition-etcd.tf b/steps/assets/base/ignition-etcd.tf
deleted file mode 100644
index 6750b56096e..00000000000
--- a/steps/assets/base/ignition-etcd.tf
+++ /dev/null
@@ -1,5 +0,0 @@
-data "ignition_config" "etcd" {
-  count = "${var.etcd_count}"
-
-  files = ["${module.ignition_bootstrap.etcd_crt_id_list}"]
-}
diff --git a/steps/assets/base/outputs.tf b/steps/assets/base/outputs.tf
index 648c3de865a..46aef6c1001 100644
--- a/steps/assets/base/outputs.tf
+++ b/steps/assets/base/outputs.tf
@@ -2,45 +2,6 @@ output "kubeconfig_kubelet_content" {
   value = "${module.bootkube.kubeconfig-kubelet}"
 }
 
-# For the bootstrap nodes, let them build their ignition configuration
-# as they see fit.
-output "ignition_bootstrap_files" {
-  value = ["${compact(flatten(list(
-    list(
-      data.ignition_file.kube-system_cluster_config.id,
-      data.ignition_file.tectonic_cluster_config.id,
-      data.ignition_file.tnco_config.id,
-      data.ignition_file.kco_config.id,
-      data.ignition_file.bootstrap_kubeconfig.id,
-      data.ignition_file.kubelet_kubeconfig.id,
-    ),
-    module.ignition_bootstrap.ignition_file_id_list,
-    module.bootkube.ignition_file_id_list,
-    module.tectonic.ignition_file_id_list,
-    local.ca_certs_ignition_file_id_list,
-    local.etcd_certs_ignition_file_id_list,
-    local.kube_certs_ignition_file_id_list,
-    local.tnc_certs_ignition_file_id_list,
-    local.service_account_keys_ignition_file_id_list,
-   )))}"]
-}
-
-output "ignition_bootstrap_systemd" {
-  value = ["${compact(flatten(list(
-    list(
-      module.bootkube.systemd_service_id,
-      module.tectonic.systemd_service_id,
-    ),
-    module.ignition_bootstrap.ignition_systemd_id_list,
-   )))}"]
-}
-
-# right now, etcd is currently the same per-platform.
-output "ignition_etcd" {
-  value = "${data.ignition_config.etcd.*.rendered}"
-}
-
-# TODO(cdc) clean this up, get rid of ignition_etcd
-output "ignition_etcd_files" {
-  value = ["${module.ignition_bootstrap.etcd_crt_id_list}"]
+output "ignition_bootstrap" {
+  value = "${data.ignition_config.bootstrap.rendered}"
 }
diff --git a/steps/assets/base/tectonic.tf b/steps/assets/base/tectonic.tf
index b366d8739ae..b18bc549d80 100644
--- a/steps/assets/base/tectonic.tf
+++ b/steps/assets/base/tectonic.tf
@@ -4,7 +4,7 @@ locals {
 }
 
 data "template_file" "etcd_hostname_list" {
-  count    = "${var.etcd_count}"
+  count    = "${var.tectonic_master_count}"
   template = "${var.tectonic_cluster_name}-etcd-${count.index}.${var.tectonic_base_domain}"
 }
 
diff --git a/steps/assets/base/variables.tf b/steps/assets/base/variables.tf
index d6c4204af2a..6094fe1a365 100644
--- a/steps/assets/base/variables.tf
+++ b/steps/assets/base/variables.tf
@@ -1,9 +1,5 @@
 # We use the same variables as the platform-specific step, to keep from going insane. Here
 # is where we can define variables that the steps can pass directly
-variable "etcd_count" {
-  type = "string"
-}
-
 variable "cloud_provider" {
   type = "string"
 }
diff --git a/steps/assets/libvirt/main.tf b/steps/assets/libvirt/main.tf
index 7309f5a0ef6..28a5f81700e 100644
--- a/steps/assets/libvirt/main.tf
+++ b/steps/assets/libvirt/main.tf
@@ -1,89 +1,26 @@
-module "defaults" {
-  source = "../../../modules/libvirt/target-defaults"
-
-  etcd_count = "${var.tectonic_etcd_count}"
-}
-
-# Terraform doesn't support "inheritance"
-# So we have to pass all variables down
 module assets_base {
   source = "../base"
 
   cloud_provider = ""
-  etcd_count     = "${module.defaults.etcd_count}"
-
-  ingress_kind = "haproxy-router"
+  ingress_kind   = "haproxy-router"
 
   tectonic_admin_email             = "${var.tectonic_admin_email}"
   tectonic_admin_password          = "${var.tectonic_admin_password}"
   tectonic_admin_ssh_key           = "${var.tectonic_admin_ssh_key}"
   tectonic_base_domain             = "${var.tectonic_base_domain}"
+  tectonic_cluster_cidr            = "${var.tectonic_cluster_cidr}"
+  tectonic_cluster_id              = "${var.tectonic_cluster_id}"
   tectonic_cluster_name            = "${var.tectonic_cluster_name}"
   tectonic_container_images        = "${var.tectonic_container_images}"
+  tectonic_container_linux_channel = "${var.tectonic_container_linux_channel}"
+  tectonic_container_linux_version = "${var.tectonic_container_linux_version}"
   tectonic_image_re                = "${var.tectonic_image_re}"
   tectonic_kubelet_debug_config    = "${var.tectonic_kubelet_debug_config}"
-  tectonic_cluster_cidr            = "${var.tectonic_cluster_cidr}"
-  tectonic_service_cidr            = "${var.tectonic_service_cidr}"
-  tectonic_networking              = "${var.tectonic_networking}"
   tectonic_license_path            = "${var.tectonic_license_path}"
+  tectonic_networking              = "${var.tectonic_networking}"
+  tectonic_platform                = "${var.tectonic_platform}"
   tectonic_pull_secret_path        = "${var.tectonic_pull_secret_path}"
+  tectonic_service_cidr            = "${var.tectonic_service_cidr}"
   tectonic_update_channel          = "${var.tectonic_update_channel}"
-  tectonic_platform                = "${var.tectonic_platform}"
   tectonic_versions                = "${var.tectonic_versions}"
-  tectonic_cluster_id              = "${var.tectonic_cluster_id}"
-  tectonic_container_linux_channel = "${var.tectonic_container_linux_channel}"
-  tectonic_container_linux_version = "${var.tectonic_container_linux_version}"
-}
-
-# Removing assets is platform-specific
-# But it must be installed in /opt/tectonic/rm-assets.sh
-data "ignition_file" "rm_assets_sh" {
-  filesystem = "root"
-  path       = "/opt/tectonic/rm-assets.sh"
-  mode       = "0700"
-
-  content {
-    content = "${file("${path.module}/resources/rm-assets.sh")}"
-  }
-}
-
-data "ignition_user" "core" {
-  name = "core"
-
-  ssh_authorized_keys = [
-    "${var.tectonic_admin_ssh_key}",
-  ]
-}
-
-data "ignition_config" "bootstrap" {
-  files = ["${flatten(list(
-    list(
-      data.ignition_file.rm_assets_sh.id,
-    ),
-    module.assets_base.ignition_bootstrap_files,
-  ))}"]
-
-  systemd = [
-    "${module.assets_base.ignition_bootstrap_systemd}",
-  ]
-
-  users = [
-    "${data.ignition_user.core.id}",
-  ]
-}
-
-data "ignition_config" "etcd" {
-  count = "${module.defaults.etcd_count}"
-
-  users = [
-    "${data.ignition_user.core.id}",
-  ]
-
-  files = [
-    "${module.assets_base.ignition_etcd_files}",
-  ]
-
-  append {
-    source = "${format("http://${var.tectonic_cluster_name}-tnc.${var.tectonic_base_domain}:49500/config/etcd?etcd_index=%d", count.index)}"
-  }
 }
diff --git a/steps/assets/libvirt/outputs.tf b/steps/assets/libvirt/outputs.tf
index 244c456c06a..70a832ecb02 100644
--- a/steps/assets/libvirt/outputs.tf
+++ b/steps/assets/libvirt/outputs.tf
@@ -1,7 +1,6 @@
+# XXX(crawford): This is only needed because the installer will only run either
+#                AWS or libvirt. This prevents us from outputting anything
+#                directly from the base.
 output "ignition_bootstrap" {
-  value = "${data.ignition_config.bootstrap.rendered}"
-}
-
-output "ignition_etcd" {
-  value = "${data.ignition_config.etcd.*.rendered}"
+  value = "${module.assets_base.ignition_bootstrap}"
 }
diff --git a/steps/assets/libvirt/resources/rm-assets.sh b/steps/assets/libvirt/resources/rm-assets.sh
deleted file mode 100644
index e5c905feebd..00000000000
--- a/steps/assets/libvirt/resources/rm-assets.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/bash
-# This file has to exist (because we unconditionally create the service)
-exit 0
diff --git a/steps/etcd/aws/config.tf b/steps/bootstrap/aws/config.tf
similarity index 100%
rename from steps/etcd/aws/config.tf
rename to steps/bootstrap/aws/config.tf
diff --git a/steps/bootstrap/aws/inputs.tf b/steps/bootstrap/aws/inputs.tf
new file mode 100644
index 00000000000..e2dc0894d41
--- /dev/null
+++ b/steps/bootstrap/aws/inputs.tf
@@ -0,0 +1,24 @@
+data "terraform_remote_state" "topology" {
+  backend = "local"
+
+  config {
+    path = "${path.cwd}/topology.tfstate"
+  }
+}
+
+data "terraform_remote_state" "assets" {
+  backend = "local"
+
+  config {
+    path = "${path.cwd}/assets.tfstate"
+  }
+}
+
+locals {
+  subnet_ids = "${data.terraform_remote_state.topology.subnet_ids_masters}"
+  aws_lbs    = "${data.terraform_remote_state.topology.aws_lbs}"
+  sg_id      = "${data.terraform_remote_state.topology.master_sg_id}"
+  s3_bucket  = "${data.terraform_remote_state.topology.s3_bucket}"
+
+  ignition_bootstrap = "${data.terraform_remote_state.assets.ignition_bootstrap}"
+}
diff --git a/steps/bootstrap/aws/main.tf b/steps/bootstrap/aws/main.tf
new file mode 100644
index 00000000000..f58e41fbda3
--- /dev/null
+++ b/steps/bootstrap/aws/main.tf
@@ -0,0 +1,158 @@
+locals {
+  private_endpoints = "${var.tectonic_aws_endpoints != "public"}"
+  public_endpoints  = "${var.tectonic_aws_endpoints != "private"}"
+}
+
+provider "aws" {
+  region  = "${var.tectonic_aws_region}"
+  profile = "${var.tectonic_aws_profile}"
+  version = "1.8.0"
+
+  assume_role {
+    role_arn     = "${var.tectonic_aws_installer_role}"
+    session_name = "TECTONIC_INSTALLER_${var.tectonic_cluster_name}"
+  }
+}
+
+resource "aws_s3_bucket_object" "ignition_bootstrap" {
+  bucket  = "${local.s3_bucket}"
+  key     = "bootstrap.ign"
+  content = "${local.ignition_bootstrap}"
+  acl     = "private"
+
+  server_side_encryption = "AES256"
+
+  tags = "${merge(map(
+      "Name", "${var.tectonic_cluster_name}-ignition-bootstrap",
+      "KubernetesCluster", "${var.tectonic_cluster_name}",
+      "tectonicClusterID", "${var.tectonic_cluster_id}"
+    ), var.tectonic_aws_extra_tags)}"
+
+  lifecycle {
+    ignore_changes = ["*"]
+  }
+}
+
+data "ignition_config" "bootstrap_redirect" {
+  replace {
+    source = "s3://${local.s3_bucket}/bootstrap.ign"
+  }
+}
+
+module "ami" {
+  source = "../../../modules/aws/ami"
+
+  region          = "${var.tectonic_aws_region}"
+  release_channel = "${var.tectonic_container_linux_channel}"
+  release_version = "${var.tectonic_container_linux_version}"
+}
+
+resource "aws_iam_instance_profile" "bootstrap" {
+  name = "${var.tectonic_cluster_name}-bootstrap-profile"
+
+  role = "${var.tectonic_aws_master_iam_role_name == "" ? join("|", aws_iam_role.bootstrap_role.*.name) : join("|", data.aws_iam_role.bootstrap_role.*.name)}"
+}
+
+data "aws_iam_role" "bootstrap_role" {
+  count = "${var.tectonic_aws_master_iam_role_name == "" ? 0 : 1}"
+  name  = "${var.tectonic_aws_master_iam_role_name}"
+}
+
+resource "aws_iam_role" "bootstrap_role" {
+  count = "${var.tectonic_aws_master_iam_role_name == "" ? 1 : 0}"
+  name  = "${var.tectonic_cluster_name}-bootstrap-role"
+  path  = "/"
+
+  assume_role_policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {
+                "Service": "ec2.amazonaws.com"
+            },
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "bootstrap_policy" {
+  count = "${var.tectonic_aws_master_iam_role_name == "" ? 1 : 0}"
+  name  = "${var.tectonic_cluster_name}-bootstrap-policy"
+  role  = "${aws_iam_role.bootstrap_role.id}"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": "ec2:Describe*",
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "ec2:AttachVolume",
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "ec2:DetachVolume",
+      "Resource": "*"
+    },
+    {
+      "Action" : [
+        "s3:GetObject"
+      ],
+      "Resource": "arn:aws:s3:::*",
+      "Effect": "Allow"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_instance" "bootstrap" {
+  ami = "${coalesce(var.tectonic_aws_ec2_ami_override, module.ami.id)}"
+
+  iam_instance_profile        = "${aws_iam_instance_profile.bootstrap.name}"
+  instance_type               = "${var.tectonic_aws_master_ec2_type}"
+  subnet_id                   = "${local.subnet_ids[0]}"
+  user_data                   = "${data.ignition_config.bootstrap_redirect.rendered}"
+  vpc_security_group_ids      = ["${concat(var.tectonic_aws_master_extra_sg_ids, list(local.sg_id))}"]
+  associate_public_ip_address = "${local.public_endpoints}"
+
+  lifecycle {
+    # Ignore changes in the AMI which force recreation of the resource. This
+    # avoids accidental deletion of nodes whenever a new OS release comes out.
+    ignore_changes = ["ami"]
+  }
+
+  tags = "${merge(map(
+      "Name", "${var.tectonic_cluster_name}-bootstrap",
+      "kubernetes.io/cluster/${var.tectonic_cluster_name}", "owned",
+      "tectonicClusterID", "${var.tectonic_cluster_id}"
+    ), var.tectonic_aws_extra_tags)}"
+
+  root_block_device {
+    volume_type = "${var.tectonic_aws_master_root_volume_type}"
+    volume_size = "${var.tectonic_aws_master_root_volume_size}"
+    iops        = "${var.tectonic_aws_master_root_volume_type == "io1" ? var.tectonic_aws_master_root_volume_iops : 0}"
+  }
+
+  volume_tags = "${merge(map(
+    "Name", "${var.tectonic_cluster_name}-bootstrap",
+    "kubernetes.io/cluster/${var.tectonic_cluster_name}", "owned",
+    "tectonicClusterID", "${var.tectonic_cluster_id}"
+  ), var.tectonic_aws_extra_tags)}"
+}
+
+resource "aws_elb_attachment" "bootstrap" {
+  count    = "${length(local.aws_lbs)}"
+  elb      = "${local.aws_lbs[count.index]}"
+  instance = "${aws_instance.bootstrap.0.id}"
+}
diff --git a/steps/etcd/aws/variables-aws.tf b/steps/bootstrap/aws/variables-aws.tf
similarity index 100%
rename from steps/etcd/aws/variables-aws.tf
rename to steps/bootstrap/aws/variables-aws.tf
diff --git a/steps/etcd/libvirt/config.tf b/steps/bootstrap/libvirt/config.tf
similarity index 100%
rename from steps/etcd/libvirt/config.tf
rename to steps/bootstrap/libvirt/config.tf
diff --git a/steps/etcd/libvirt/inputs.tf b/steps/bootstrap/libvirt/inputs.tf
similarity index 77%
rename from steps/etcd/libvirt/inputs.tf
rename to steps/bootstrap/libvirt/inputs.tf
index 504a754d729..98022b0e789 100644
--- a/steps/etcd/libvirt/inputs.tf
+++ b/steps/bootstrap/libvirt/inputs.tf
@@ -1,4 +1,3 @@
-// This could be encapsulated as a data source
 data "terraform_remote_state" "topology" {
   backend = "local"
 
@@ -16,7 +15,8 @@ data "terraform_remote_state" "assets" {
 }
 
 locals {
-  ignition               = "${data.terraform_remote_state.assets.ignition_etcd}"
   libvirt_network_id     = "${data.terraform_remote_state.topology.libvirt_network_id}"
   libvirt_base_volume_id = "${data.terraform_remote_state.topology.libvirt_base_volume_id}"
+
+  ignition_bootstrap = "${data.terraform_remote_state.assets.ignition_bootstrap}"
 }
diff --git a/steps/bootstrap/libvirt/main.tf b/steps/bootstrap/libvirt/main.tf
new file mode 100644
index 00000000000..b5b8efa8d72
--- /dev/null
+++ b/steps/bootstrap/libvirt/main.tf
@@ -0,0 +1,33 @@
+provider "libvirt" {
+  uri = "${var.tectonic_libvirt_uri}"
+}
+
+resource "libvirt_volume" "bootstrap" {
+  name           = "bootstrap"
+  base_volume_id = "${local.libvirt_base_volume_id}"
+}
+
+resource "libvirt_ignition" "bootstrap" {
+  name    = "bootstrap.ign"
+  content = "${local.ignition_bootstrap}"
+}
+
+resource "libvirt_domain" "bootstrap" {
+  name = "bootstrap"
+
+  memory = "2048"
+
+  vcpu = "2"
+
+  coreos_ignition = "${libvirt_ignition.bootstrap.id}"
+
+  disk {
+    volume_id = "${libvirt_volume.bootstrap.id}"
+  }
+
+  network_interface {
+    network_id = "${local.libvirt_network_id}"
+    hostname   = "${var.tectonic_cluster_name}-bootstrap"
+    addresses  = ["${var.tectonic_libvirt_bootstrap_ip}"]
+  }
+}
diff --git a/steps/etcd/libvirt/variables-libvirt.tf b/steps/bootstrap/libvirt/variables-libvirt.tf
similarity index 100%
rename from steps/etcd/libvirt/variables-libvirt.tf
rename to steps/bootstrap/libvirt/variables-libvirt.tf
diff --git a/steps/etcd/aws/etcd.tf b/steps/etcd/aws/etcd.tf
deleted file mode 100644
index 3d5b65c23e5..00000000000
--- a/steps/etcd/aws/etcd.tf
+++ /dev/null
@@ -1,79 +0,0 @@
-provider "aws" {
-  region  = "${var.tectonic_aws_region}"
-  profile = "${var.tectonic_aws_profile}"
-  version = "1.8.0"
-
-  assume_role {
-    role_arn     = "${var.tectonic_aws_installer_role == "" ? "" : "${var.tectonic_aws_installer_role}"}"
-    session_name = "TECTONIC_INSTALLER_${var.tectonic_cluster_name}"
-  }
-}
-
-module "defaults" {
-  source = "../../../modules/aws/target-defaults"
-
-  region     = "${var.tectonic_aws_region}"
-  profile    = "${var.tectonic_aws_profile}"
-  role_arn   = "${var.tectonic_aws_installer_role}"
-  etcd_count = "${var.tectonic_etcd_count}"
-}
-
-module "container_linux" {
-  source = "../../../modules/container_linux"
-
-  release_channel = "${var.tectonic_container_linux_channel}"
-  release_version = "${var.tectonic_container_linux_version}"
-}
-
-data "template_file" "etcd_hostname_list" {
-  count    = "${module.defaults.etcd_count}"
-  template = "${var.tectonic_cluster_name}-etcd-${count.index}.${var.tectonic_base_domain}"
-}
-
-resource "aws_s3_bucket_object" "ignition_etcd" {
-  count   = "${length(data.template_file.etcd_hostname_list.*.id)}"
-  bucket  = "${local.s3_bucket}"
-  key     = "ignition_etcd_${count.index}.json"
-  content = "${local.ignition[count.index]}"
-  acl     = "private"
-
-  server_side_encryption = "AES256"
-
-  tags = "${merge(map(
-      "Name", "${var.tectonic_cluster_name}-ignition-etcd-${count.index}",
-      "KubernetesCluster", "${var.tectonic_cluster_name}",
-      "tectonicClusterID", "${var.tectonic_cluster_id}"
-    ), var.tectonic_aws_extra_tags)}"
-}
-
-module "etcd" {
-  source = "../../../modules/aws/etcd"
-
-  base_domain             = "${var.tectonic_base_domain}"
-  cluster_id              = "${var.tectonic_cluster_id}"
-  cluster_name            = "${var.tectonic_cluster_name}"
-  container_image         = "${var.tectonic_container_images["etcd"]}"
-  container_linux_channel = "${var.tectonic_container_linux_channel}"
-  container_linux_version = "${module.container_linux.version}"
-  ec2_type                = "${var.tectonic_aws_etcd_ec2_type}"
-  extra_tags              = "${var.tectonic_aws_extra_tags}"
-  instance_count          = "${length(data.template_file.etcd_hostname_list.*.id)}"
-  region                  = "${var.tectonic_aws_region}"
-  root_volume_iops        = "${var.tectonic_aws_etcd_root_volume_iops}"
-  root_volume_size        = "${var.tectonic_aws_etcd_root_volume_size}"
-  root_volume_type        = "${var.tectonic_aws_etcd_root_volume_type}"
-  s3_bucket               = "${local.s3_bucket}"
-  sg_ids                  = "${concat(var.tectonic_aws_etcd_extra_sg_ids, list(local.sg_id))}"
-  subnets                 = ["${local.subnet_ids_workers}"]
-  etcd_iam_role           = "${var.tectonic_aws_etcd_iam_role_name}"
-  ec2_ami                 = "${var.tectonic_aws_ec2_ami_override}"
-}
-
-resource "aws_route53_record" "etcd_a_nodes" {
-  count   = "${length(data.template_file.etcd_hostname_list.*.id)}"
-  type    = "A"
-  ttl     = "60"
-  zone_id = "${local.private_zone_id}"
-  name    = "${var.tectonic_cluster_name}-etcd-${count.index}"
-  records = ["${module.etcd.ip_addresses[count.index]}"]
-}
diff --git a/steps/etcd/aws/inputs.tf b/steps/etcd/aws/inputs.tf
deleted file mode 100644
index ab53c0b35ce..00000000000
--- a/steps/etcd/aws/inputs.tf
+++ /dev/null
@@ -1,24 +0,0 @@
-// This could be encapsulated as a data source
-data "terraform_remote_state" "topology" {
-  backend = "local"
-
-  config {
-    path = "${path.cwd}/topology.tfstate"
-  }
-}
-
-data "terraform_remote_state" "assets" {
-  backend = "local"
-
-  config {
-    path = "${path.cwd}/assets.tfstate"
-  }
-}
-
-locals {
-  ignition           = "${data.terraform_remote_state.assets.ignition_etcd}"
-  sg_id              = "${data.terraform_remote_state.topology.etcd_sg_id}"
-  subnet_ids_workers = "${data.terraform_remote_state.topology.subnet_ids_workers}"
-  s3_bucket          = "${data.terraform_remote_state.topology.s3_bucket}"
-  private_zone_id    = "${var.tectonic_aws_external_private_zone != "" ? var.tectonic_aws_external_private_zone : data.terraform_remote_state.topology.private_zone_id}"
-}
diff --git a/steps/etcd/libvirt/main.tf b/steps/etcd/libvirt/main.tf
deleted file mode 100644
index c037d4a0e82..00000000000
--- a/steps/etcd/libvirt/main.tf
+++ /dev/null
@@ -1,45 +0,0 @@
-provider "libvirt" {
-  uri = "${var.tectonic_libvirt_uri}"
-}
-
-module "defaults" {
-  source = "../../../modules/libvirt/target-defaults"
-
-  etcd_count = "${var.tectonic_etcd_count}"
-}
-
-resource "libvirt_volume" "etcd" {
-  count          = "${module.defaults.etcd_count}"
-  name           = "etcd${count.index}"
-  base_volume_id = "${local.libvirt_base_volume_id}"
-}
-
-resource "libvirt_ignition" "etcd" {
-  count   = "${module.defaults.etcd_count}"
-  name    = "etcd${count.index}.ign"
-  content = "${local.ignition[count.index]}"
-}
-
-resource "libvirt_domain" "etcd" {
-  count = "${module.defaults.etcd_count}"
-
-  name            = "etcd${count.index}"
-  memory          = "1024"
-  vcpu            = "2"
-  coreos_ignition = "${element(libvirt_ignition.etcd.*.id,count.index)}"
-
-  disk {
-    volume_id = "${element(libvirt_volume.etcd.*.id, count.index)}"
-  }
-
-  console {
-    type        = "pty"
-    target_port = 0
-  }
-
-  network_interface {
-    network_id = "${local.libvirt_network_id}"
-    hostname   = "${var.tectonic_cluster_name}-etcd-${count.index}"
-    addresses  = ["${cidrhost(var.tectonic_libvirt_ip_range, var.tectonic_libvirt_first_ip_etcd + count.index)}"]
-  }
-}
diff --git a/steps/joining_workers/libvirt/workers.tf b/steps/joining_workers/libvirt/workers.tf
index 0ced1d691fa..7c648b2d248 100644
--- a/steps/joining_workers/libvirt/workers.tf
+++ b/steps/joining_workers/libvirt/workers.tf
@@ -33,6 +33,6 @@ resource "libvirt_domain" "worker" {
   network_interface {
     network_id = "${local.libvirt_network_id}"
     hostname   = "${var.tectonic_cluster_name}-worker-${count.index}"
-    addresses  = ["${cidrhost(var.tectonic_libvirt_ip_range, var.tectonic_libvirt_first_ip_worker + count.index)}"]
+    addresses  = ["${var.tectonic_libvirt_worker_ips[count.index]}"]
   }
 }
diff --git a/steps/masters/aws/inputs.tf b/steps/masters/aws/inputs.tf
index f4980c5a869..fb7a5401c9c 100644
--- a/steps/masters/aws/inputs.tf
+++ b/steps/masters/aws/inputs.tf
@@ -10,4 +10,6 @@ locals {
   subnet_ids = "${data.terraform_remote_state.topology.subnet_ids_masters}"
   aws_lbs    = "${data.terraform_remote_state.topology.aws_lbs}"
   sg_id      = "${data.terraform_remote_state.topology.master_sg_id}"
+
+  private_zone_id = "${var.tectonic_aws_external_private_zone != "" ? var.tectonic_aws_external_private_zone : data.terraform_remote_state.topology.private_zone_id}"
 }
diff --git a/steps/masters/aws/main.tf b/steps/masters/aws/main.tf
index c841d863479..d728a670d03 100644
--- a/steps/masters/aws/main.tf
+++ b/steps/masters/aws/main.tf
@@ -33,7 +33,7 @@ module "masters" {
   container_linux_version = "${module.container_linux.version}"
   ec2_type                = "${var.tectonic_aws_master_ec2_type}"
   extra_tags              = "${var.tectonic_aws_extra_tags}"
-  instance_count          = "${var.tectonic_bootstrap == "true" ? 1 : var.tectonic_master_count}"
+  instance_count          = "${var.tectonic_master_count}"
   master_iam_role         = "${var.tectonic_aws_master_iam_role_name}"
   master_sg_ids           = "${concat(var.tectonic_aws_master_extra_sg_ids, list(local.sg_id))}"
   private_endpoints       = "${local.private_endpoints}"
@@ -44,5 +44,14 @@ module "masters" {
   root_volume_type        = "${var.tectonic_aws_master_root_volume_type}"
   subnet_ids              = "${local.subnet_ids}"
   ec2_ami                 = "${var.tectonic_aws_ec2_ami_override}"
-  user_data_ign           = "${file("${path.cwd}/${var.tectonic_ignition_master}")}"
+  user_data_igns          = "${var.tectonic_ignition_masters}"
+}
+
+resource "aws_route53_record" "etcd_a_nodes" {
+  count   = "${var.tectonic_master_count}"
+  type    = "A"
+  ttl     = "60"
+  zone_id = "${local.private_zone_id}"
+  name    = "${var.tectonic_cluster_name}-etcd-${count.index}"
+  records = ["${module.masters.ip_addresses[count.index]}"]
 }
diff --git a/steps/masters/aws/masters.variables.tf b/steps/masters/aws/masters.variables.tf
deleted file mode 100644
index 3a120fd6458..00000000000
--- a/steps/masters/aws/masters.variables.tf
+++ /dev/null
@@ -1,3 +0,0 @@
-variable "tectonic_bootstrap" {
-  type = "string"
-}
diff --git a/steps/masters/libvirt/inputs.tf b/steps/masters/libvirt/inputs.tf
index 98022b0e789..4ebe141b1d6 100644
--- a/steps/masters/libvirt/inputs.tf
+++ b/steps/masters/libvirt/inputs.tf
@@ -17,6 +17,4 @@ data "terraform_remote_state" "assets" {
 locals {
   libvirt_network_id     = "${data.terraform_remote_state.topology.libvirt_network_id}"
   libvirt_base_volume_id = "${data.terraform_remote_state.topology.libvirt_base_volume_id}"
-
-  ignition_bootstrap = "${data.terraform_remote_state.assets.ignition_bootstrap}"
 }
diff --git a/steps/masters/libvirt/main.tf b/steps/masters/libvirt/main.tf
index c464db8db9a..d143bc6d738 100644
--- a/steps/masters/libvirt/main.tf
+++ b/steps/masters/libvirt/main.tf
@@ -2,40 +2,28 @@ provider "libvirt" {
   uri = "${var.tectonic_libvirt_uri}"
 }
 
-locals {
-  master_count = "${var.tectonic_bootstrap == "true" ? 1 : var.tectonic_master_count}"
-}
-
 resource "libvirt_volume" "master" {
-  count = "${local.master_count}"
+  count = "${var.tectonic_master_count}"
 
   name           = "master${count.index}"
   base_volume_id = "${local.libvirt_base_volume_id}"
 }
 
-# The first master node should be booted with the bootstrap ignition configuration
-resource "libvirt_ignition" "master_bootstrap" {
-  name    = "master-bootstrap.ign"
-  content = "${local.ignition_bootstrap}"
-}
-
-# Ignition for the remaining masters
 resource "libvirt_ignition" "master" {
-  name    = "master.ign"
-  content = "${file("${path.cwd}/${var.tectonic_ignition_master}")}"
+  count   = "${var.tectonic_master_count}"
+  name    = "master-${count.index}.ign"
+  content = "${file(format("%s/%s", path.cwd, var.tectonic_ignition_masters[count.index]))}"
 }
 
 resource "libvirt_domain" "master" {
-  count = "${local.master_count}"
+  count = "${var.tectonic_master_count}"
 
   name = "master${count.index}"
 
   memory = "2048"
   vcpu   = "2"
 
-  # Override ignition for the first (bootstrap) node. It can't be re-ignited,
-  # but that's okay for us
-  coreos_ignition = "${count.index == 0 ? libvirt_ignition.master_bootstrap.id : libvirt_ignition.master.id}"
+  coreos_ignition = "${libvirt_ignition.master.*.id[count.index]}"
 
   disk {
     volume_id = "${element(libvirt_volume.master.*.id, count.index)}"
diff --git a/steps/masters/libvirt/masters.variables.tf b/steps/masters/libvirt/masters.variables.tf
deleted file mode 100644
index 3a120fd6458..00000000000
--- a/steps/masters/libvirt/masters.variables.tf
+++ /dev/null
@@ -1,3 +0,0 @@
-variable "tectonic_bootstrap" {
-  type = "string"
-}
diff --git a/steps/tnc_dns/aws/config.tf b/steps/tnc_dns/aws/config.tf
deleted file mode 120000
index 7b4967dbe1f..00000000000
--- a/steps/tnc_dns/aws/config.tf
+++ /dev/null
@@ -1 +0,0 @@
-../../../config.tf
\ No newline at end of file
diff --git a/steps/tnc_dns/aws/inputs.tf b/steps/tnc_dns/aws/inputs.tf
deleted file mode 100644
index 97ca675ea77..00000000000
--- a/steps/tnc_dns/aws/inputs.tf
+++ /dev/null
@@ -1,14 +0,0 @@
-data "terraform_remote_state" "topology" {
-  backend = "local"
-
-  config {
-    path = "${path.cwd}/topology.tfstate"
-  }
-}
-
-locals {
-  private_zone_id           = "${var.tectonic_aws_external_private_zone != "" ? var.tectonic_aws_external_private_zone : data.terraform_remote_state.topology.private_zone_id}"
-  tnc_s3_bucket_domain_name = "${data.terraform_remote_state.topology.tnc_s3_bucket_domain_name}"
-  tnc_elb_dns_name          = "${data.terraform_remote_state.topology.tnc_elb_dns_name}"
-  tnc_elb_zone_id           = "${data.terraform_remote_state.topology.tnc_elb_zone_id}"
-}
diff --git a/steps/tnc_dns/aws/main.tf b/steps/tnc_dns/aws/main.tf
deleted file mode 100644
index b05af6856e8..00000000000
--- a/steps/tnc_dns/aws/main.tf
+++ /dev/null
@@ -1,34 +0,0 @@
-provider "aws" {
-  region  = "${var.tectonic_aws_region}"
-  profile = "${var.tectonic_aws_profile}"
-  version = "1.8.0"
-
-  assume_role {
-    role_arn     = "${var.tectonic_aws_installer_role == "" ? "" : "${var.tectonic_aws_installer_role}"}"
-    session_name = "TECTONIC_INSTALLER_${var.tectonic_cluster_name}"
-  }
-}
-
-resource "aws_route53_record" "tectonic_tnc_cname" {
-  count   = "${var.tectonic_bootstrap == "true" ? 1 : 0}"
-  zone_id = "${local.private_zone_id}"
-  name    = "${var.tectonic_cluster_name}-tnc.${var.tectonic_base_domain}"
-  type    = "CNAME"
-  ttl     = "1"
-
-  records = ["${local.tnc_s3_bucket_domain_name}"]
-}
-
-resource "aws_route53_record" "tectonic_tnc_a" {
-  depends_on = ["aws_route53_record.tectonic_tnc_cname"]
-  count      = "${var.tectonic_bootstrap == "true" ? 0 : 1}"
-  zone_id    = "${local.private_zone_id}"
-  name       = "${var.tectonic_cluster_name}-tnc.${var.tectonic_base_domain}"
-  type       = "A"
-
-  alias {
-    name                   = "${local.tnc_elb_dns_name}"
-    zone_id                = "${local.tnc_elb_zone_id}"
-    evaluate_target_health = true
-  }
-}
diff --git a/steps/tnc_dns/aws/tnc.variables.tf b/steps/tnc_dns/aws/tnc.variables.tf
deleted file mode 100644
index 3a120fd6458..00000000000
--- a/steps/tnc_dns/aws/tnc.variables.tf
+++ /dev/null
@@ -1,3 +0,0 @@
-variable "tectonic_bootstrap" {
-  type = "string"
-}
diff --git a/steps/tnc_dns/aws/variables-aws.tf b/steps/tnc_dns/aws/variables-aws.tf
deleted file mode 120000
index d0ec4db3217..00000000000
--- a/steps/tnc_dns/aws/variables-aws.tf
+++ /dev/null
@@ -1 +0,0 @@
-../../variables-aws.tf
\ No newline at end of file
diff --git a/steps/tnc_dns/libvirt/config.tf b/steps/tnc_dns/libvirt/config.tf
deleted file mode 120000
index 7b4967dbe1f..00000000000
--- a/steps/tnc_dns/libvirt/config.tf
+++ /dev/null
@@ -1 +0,0 @@
-../../../config.tf
\ No newline at end of file
diff --git a/steps/tnc_dns/libvirt/main.tf b/steps/tnc_dns/libvirt/main.tf
deleted file mode 100644
index 1de3dc19671..00000000000
--- a/steps/tnc_dns/libvirt/main.tf
+++ /dev/null
@@ -1,6 +0,0 @@
-# Sets up the libvirt domain name
-resource "null_resource" "tnc_dns" {
-  provisioner "local-exec" {
-    command = "virsh -c ${var.tectonic_libvirt_uri} net-update ${var.tectonic_libvirt_network_name} add dns-host \"<host ip='${var.tectonic_libvirt_master_ips[0]}'><hostname>${var.tectonic_cluster_name}-api</hostname><hostname>${var.tectonic_cluster_name}-tnc</hostname></host>\" --live --config"
-  }
-}
diff --git a/steps/tnc_dns/libvirt/variables-libvirt.tf b/steps/tnc_dns/libvirt/variables-libvirt.tf
deleted file mode 120000
index 0b2a79a7f6f..00000000000
--- a/steps/tnc_dns/libvirt/variables-libvirt.tf
+++ /dev/null
@@ -1 +0,0 @@
-../../variables-libvirt.tf
\ No newline at end of file
diff --git a/steps/topology/aws/inputs.tf b/steps/topology/aws/inputs.tf
deleted file mode 100644
index ade2b1619a0..00000000000
--- a/steps/topology/aws/inputs.tf
+++ /dev/null
@@ -1,11 +0,0 @@
-data "terraform_remote_state" "assets" {
-  backend = "local"
-
-  config {
-    path = "${path.cwd}/assets.tfstate"
-  }
-}
-
-locals {
-  ignition_bootstrap = "${data.terraform_remote_state.assets.ignition_bootstrap}"
-}
diff --git a/steps/topology/aws/main.tf b/steps/topology/aws/main.tf
index 354c90f7403..932319e4b0e 100644
--- a/steps/topology/aws/main.tf
+++ b/steps/topology/aws/main.tf
@@ -72,3 +72,15 @@ module "dns" {
   private_endpoints         = "${local.private_endpoints}"
   public_endpoints          = "${local.public_endpoints}"
 }
+
+resource "aws_route53_record" "tectonic_tnc_a" {
+  zone_id = "${var.tectonic_aws_external_private_zone != "" ? var.tectonic_aws_external_private_zone : join("", aws_route53_zone.tectonic_int.*.zone_id)}"
+  name    = "${var.tectonic_cluster_name}-tnc.${var.tectonic_base_domain}"
+  type    = "A"
+
+  alias {
+    name                   = "${module.vpc.aws_elb_tnc_dns_name}"
+    zone_id                = "${module.vpc.aws_elb_tnc_zone_id}"
+    evaluate_target_health = true
+  }
+}
diff --git a/steps/topology/aws/outputs.tf b/steps/topology/aws/outputs.tf
index 158c20df274..bb02187e9c8 100644
--- a/steps/topology/aws/outputs.tf
+++ b/steps/topology/aws/outputs.tf
@@ -29,19 +29,6 @@ output "worker_sg_id" {
   value = "${module.vpc.worker_sg_id}"
 }
 
-# TNC
 output "private_zone_id" {
   value = "${join("", aws_route53_zone.tectonic_int.*.zone_id)}"
 }
-
-output "tnc_elb_dns_name" {
-  value = "${module.vpc.aws_elb_tnc_dns_name}"
-}
-
-output "tnc_elb_zone_id" {
-  value = "${module.vpc.aws_elb_tnc_zone_id}"
-}
-
-output "tnc_s3_bucket_domain_name" {
-  value = "${aws_s3_bucket.tectonic.bucket_domain_name}"
-}
diff --git a/steps/topology/aws/s3-assets.tf b/steps/topology/aws/s3-assets.tf
index 62a5a45804b..3b2577b18b5 100644
--- a/steps/topology/aws/s3-assets.tf
+++ b/steps/topology/aws/s3-assets.tf
@@ -1,14 +1,5 @@
-## Create the S3 bucket where we'll upload the initial ignition file
-# This needs a bit of a special setup. Because Ignition is fetching the 
-# configuration over the tnc LB pointed to the s3 bucket, it doesn't have any
-# identity. So, the file needs to be public. But then we'd expose secrets,
-# so the public ignition file just has an ignition redirect to a s3:// url,
-# which ignition can fetch directly with authentication.
-
 resource "aws_s3_bucket" "tectonic" {
-  # This bucket name must match the CNAME
-  # https://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html#VirtualHostingCustomURLs
-  bucket = "${lower(var.tectonic_cluster_name)}-tnc.${var.tectonic_base_domain}"
+  bucket = "${lower(var.tectonic_cluster_name)}.${var.tectonic_base_domain}"
 
   acl = "private"
 
@@ -22,51 +13,3 @@ resource "aws_s3_bucket" "tectonic" {
     ignore_changes = ["*"]
   }
 }
-
-# The real ignition contents, with secrets.
-# Must be private. The node will zero this out as soon as it boots.
-resource "aws_s3_bucket_object" "ignition_bootstrap_real" {
-  bucket  = "${aws_s3_bucket.tectonic.bucket}"
-  key     = "config/bootstrap"
-  content = "${local.ignition_bootstrap}"
-  acl     = "private"
-
-  server_side_encryption = "AES256"
-
-  tags = "${merge(map(
-      "Name", "${var.tectonic_cluster_name}-ignition-master",
-      "KubernetesCluster", "${var.tectonic_cluster_name}",
-      "tectonicClusterID", "${var.tectonic_cluster_id}"
-    ), var.tectonic_aws_extra_tags)}"
-
-  lifecycle {
-    ignore_changes = ["*"]
-  }
-}
-
-# The public ignition configuration
-data "ignition_config" "bootstrap_redirect" {
-  replace {
-    source = "s3://${aws_s3_bucket.tectonic.bucket}/config/bootstrap"
-  }
-}
-
-# The public ignition object.
-resource "aws_s3_bucket_object" "ignition_bootstrap" {
-  bucket  = "${aws_s3_bucket.tectonic.bucket}"
-  key     = "config/master"
-  content = "${data.ignition_config.bootstrap_redirect.rendered}"
-  acl     = "public-read"
-
-  server_side_encryption = "AES256"
-
-  tags = "${merge(map(
-      "Name", "${var.tectonic_cluster_name}-ignition-master",
-      "KubernetesCluster", "${var.tectonic_cluster_name}",
-      "tectonicClusterID", "${var.tectonic_cluster_id}"
-    ), var.tectonic_aws_extra_tags)}"
-
-  lifecycle {
-    ignore_changes = ["*"]
-  }
-}
diff --git a/steps/topology/libvirt/main.tf b/steps/topology/libvirt/main.tf
index d73b0490744..dc18a26b408 100644
--- a/steps/topology/libvirt/main.tf
+++ b/steps/topology/libvirt/main.tf
@@ -18,6 +18,15 @@ resource "libvirt_network" "tectonic_net" {
   dns_forwarder {
     address = "${var.tectonic_libvirt_resolver}"
   }
+
+  dns_host = ["${flatten(list(
+    data.libvirt_network_dns_host_template.bootstrap.*.rendered,
+    data.libvirt_network_dns_host_template.masters.*.rendered,
+    data.libvirt_network_dns_host_template.etcds.*.rendered,
+    data.libvirt_network_dns_host_template.workers.*.rendered,
+  ))}"]
+
+  autostart = true
 }
 
 module "libvirt_base_volume" {
@@ -27,13 +36,40 @@ module "libvirt_base_volume" {
 }
 
 locals {
-  first_worker_ip = "${cidrhost(var.tectonic_libvirt_ip_range, var.tectonic_libvirt_first_ip_worker)}"
+  "hostnames" = [
+    "${var.tectonic_cluster_name}-api",
+    "${var.tectonic_cluster_name}-tnc",
+  ]
 }
 
-# Set up the cluster domain name
-# This is currently limited to the first worker, due to an issue with net-update, even though libvirt supports multiple a-records
-resource "null_resource" "console_dns" {
-  provisioner "local-exec" {
-    command = "virsh -c ${var.tectonic_libvirt_uri} net-update ${libvirt_network.tectonic_net.name} add dns-host \"<host ip='${local.first_worker_ip}'><hostname>${var.tectonic_cluster_name}</hostname></host>\" --live --config"
-  }
+data "libvirt_network_dns_host_template" "bootstrap" {
+  count = "${length(local.hostnames)}"
+
+  ip = "${var.tectonic_libvirt_bootstrap_ip}"
+
+  hostname = "${local.hostnames[count.index]}"
+}
+
+data "libvirt_network_dns_host_template" "masters" {
+  count = "${var.tectonic_master_count * length(local.hostnames)}"
+
+  ip = "${var.tectonic_libvirt_master_ips[count.index / length(local.hostnames)]}"
+
+  hostname = "${local.hostnames[count.index % length(local.hostnames)]}"
+}
+
+data "libvirt_network_dns_host_template" "etcds" {
+  count = "${var.tectonic_master_count}"
+
+  ip = "${var.tectonic_libvirt_master_ips[count.index]}"
+
+  hostname = "${var.tectonic_cluster_name}-etcd-${count.index}"
+}
+
+data "libvirt_network_dns_host_template" "workers" {
+  count = "${var.tectonic_worker_count}"
+
+  ip = "${var.tectonic_libvirt_worker_ips[count.index]}"
+
+  hostname = "${var.tectonic_cluster_name}"
 }
diff --git a/steps/variables-aws.tf b/steps/variables-aws.tf
index 8316a69d9b5..59d396e9403 100644
--- a/steps/variables-aws.tf
+++ b/steps/variables-aws.tf
@@ -27,33 +27,12 @@ variable "tectonic_aws_worker_ec2_type" {
   default     = "t2.medium"
 }
 
-variable "tectonic_aws_etcd_ec2_type" {
-  type = "string"
-
-  description = <<EOF
-  Instance size for the etcd node(s). Example: `t2.medium`. Read the [etcd recommended hardware](https://coreos.com/etcd/docs/latest/op-guide/hardware.html) guide for best performance
-  EOF
-
-  default = "t2.medium"
-}
-
 variable "tectonic_aws_ec2_ami_override" {
   type        = "string"
   description = "(optional) AMI override for all nodes. Example: `ami-foobar123`."
   default     = ""
 }
 
-variable "tectonic_aws_etcd_extra_sg_ids" {
-  description = <<EOF
-(optional) List of additional security group IDs for etcd nodes.
-
-Example: `["sg-51530134", "sg-b253d7cc"]`
-EOF
-
-  type    = "list"
-  default = []
-}
-
 variable "tectonic_aws_master_extra_sg_ids" {
   description = <<EOF
 (optional) List of additional security group IDs for master nodes.
@@ -156,28 +135,6 @@ EOF
   default = {}
 }
 
-variable "tectonic_aws_etcd_root_volume_type" {
-  type        = "string"
-  default     = "gp2"
-  description = "The type of volume for the root block device of etcd nodes."
-}
-
-variable "tectonic_aws_etcd_root_volume_size" {
-  type        = "string"
-  default     = "30"
-  description = "The size of the volume in gigabytes for the root block device of etcd nodes."
-}
-
-variable "tectonic_aws_etcd_root_volume_iops" {
-  type    = "string"
-  default = "100"
-
-  description = <<EOF
-The amount of provisioned IOPS for the root block device of etcd nodes.
-Ignored if the volume type is not io1.
-EOF
-}
-
 variable "tectonic_aws_master_root_volume_type" {
   type        = "string"
   default     = "gp2"
@@ -291,20 +248,6 @@ Example:
 EOF
 }
 
-variable "tectonic_aws_etcd_iam_role_name" {
-  type    = "string"
-  default = ""
-
-  description = <<EOF
-(optional) Name of IAM role to use for the instance profiles of etcd nodes.
-The name is also the last part of a role's ARN.
-
-Example:
- * Role ARN  = arn:aws:iam::123456789012:role/tectonic-installer
- * Role Name = tectonic-installer
-EOF
-}
-
 variable "tectonic_aws_worker_load_balancers" {
   type    = "list"
   default = []
diff --git a/steps/variables-libvirt.tf b/steps/variables-libvirt.tf
index 8bd54067bb2..673b7af7f2a 100644
--- a/steps/variables-libvirt.tf
+++ b/steps/variables-libvirt.tf
@@ -28,19 +28,17 @@ variable "tectonic_coreos_qcow_path" {
   description = "path to a container linux qcow image"
 }
 
+variable "tectonic_libvirt_bootstrap_ip" {
+  type        = "string"
+  description = "the desired bootstrap ip"
+}
+
 variable "tectonic_libvirt_master_ips" {
   type        = "list"
   description = "the list of desired master ips. Must match tectonic_master_count"
 }
 
-variable "tectonic_libvirt_first_ip_etcd" {
-  type        = "string"
-  description = "the offset in the ip range of the first etcd servers"
-  default     = "20"
-}
-
-variable "tectonic_libvirt_first_ip_worker" {
-  type        = "string"
-  description = "the offset in the ip range of the first worker"
-  default     = "50"
+variable "tectonic_libvirt_worker_ips" {
+  type        = "list"
+  description = "the list of desired worker ips. Must match tectonic_worker_count"
 }
diff --git a/tests/run.sh b/tests/run.sh
index d9a48e2b5ff..e0c61bfea5b 100755
--- a/tests/run.sh
+++ b/tests/run.sh
@@ -47,8 +47,7 @@ CONFIG=$(echo "${CONFIG}" | jq ".name = \"${CLUSTER_NAME}\"" |\
                             jq ".pullSecretPath = \"${PULL_SECRET_PATH}\"" |\
                             jq ".aws.region = \"${AWS_REGION}\"" |\
                             jq ".aws.master.iamRoleName = \"tf-tectonic-master-node\"" |\
-                            jq ".aws.worker.iamRoleName = \"tf-tectonic-worker-node\"" |\
-                            jq ".aws.etcd.iamRoleName = \"tf-tectonic-etcd-node\""
+                            jq ".aws.worker.iamRoleName = \"tf-tectonic-worker-node\""
 )
 echo "${CONFIG}" | python -c 'import sys, yaml, json; yaml.safe_dump(json.load(sys.stdin), sys.stdout)' > "${CLUSTER_NAME}.yaml"
 
@@ -77,7 +76,7 @@ echo -e "\\e[36m Deploying Tectonic...\\e[0m"
 tectonic install --dir="${CLUSTER_NAME}"
 echo -e "\\e[36m Running smoke test...\\e[0m"
 export SMOKE_KUBECONFIG="$(pwd)/$CLUSTER_NAME/generated/auth/kubeconfig"
-export SMOKE_NODE_COUNT="7"  # Sum of all nodes (etcd + master + worker)
+export SMOKE_NODE_COUNT="5"  # Sum of all nodes (master + worker)
 export SMOKE_MANIFEST_PATHS="$(pwd)/$CLUSTER_NAME/generated"
 exec 5>&1
 SMOKE_TEST_OUTPUT=$(./smoke -test.v --cluster | tee >(cat - >&5))
diff --git a/tests/smoke/aws/README.md b/tests/smoke/aws/README.md
index 800fa49336c..47e0dfdd8dc 100644
--- a/tests/smoke/aws/README.md
+++ b/tests/smoke/aws/README.md
@@ -100,8 +100,8 @@ $ aws ec2 describe-instances --query "Reservations[].Instances[] | [?Tags[? Key
 $ ssh -A core@52.15.184.15
 ```
 
-Once connected to the master node, follow the [troubleshooting guide](../../../Documentation/troubleshooting/troubleshooting.md) for master, worker, and etcd nodes to investigate the following checklist:
+Once connected to the master node, follow the [troubleshooting guide](../../../Documentation/troubleshooting/troubleshooting.md) for master and worker nodes to investigate the following checklist:
 
-- SSH connectivity to the master/worker/etcd nodes
+- SSH connectivity to the master/worker nodes
 - Successful start of all relevant installation service units on the corresponding nodes
 - Successful login to the Tectonic Console