diff --git a/install_puppet.sh b/install_puppet.sh
index 507e88aec1..f0cf7e04bd 100755
--- a/install_puppet.sh
+++ b/install_puppet.sh
@@ -133,6 +133,7 @@ EOF
 }
 
 function setup_puppet_ubuntu {
+
     lsbdistcodename=`lsb_release -c -s`
     if [ $lsbdistcodename != 'trusty' ] ; then
         rubypkg=rubygems
@@ -143,18 +144,24 @@ function setup_puppet_ubuntu {
 
     # NB: keep in sync with openstack_project/files/00-puppet.pref
     if [ "$THREE" == 'yes' ]; then
-        PUPPET_VERSION=3.4.*
+        PUPPET_VERSION=3.6.*
+        PUPPETDB_TERMINUS_VERSION=2.*
         FACTER_VERSION=2.*
     else
         PUPPET_VERSION=2.7*
+        PUPPETDB_TERMINUS_VERSION=1.*
         FACTER_VERSION=1.*
     fi
 
     cat > /etc/apt/preferences.d/00-puppet.pref <<EOF
-Package: puppet puppet-common puppetmaster puppetmaster-common puppetmaster-passenger puppetdb-terminus
+Package: puppet puppet-common puppetmaster puppetmaster-common puppetmaster-passenger
 Pin: version $PUPPET_VERSION
 Pin-Priority: 501
 
+Package: puppetdb-terminus
+Pin: version $PUPPETDB_TERMINUS_VERSION
+Pin-Priority: 501
+
 Package: facter
 Pin: version $FACTER_VERSION
 Pin-Priority: 501
@@ -205,10 +212,6 @@ function setup_pip {
     pip install -U setuptools
 }
 
-#
-# Install pip & puppet
-#
-
 setup_pip
 
 if is_fedora; then
diff --git a/modules/openstack_project/manifests/base.pp b/modules/openstack_project/manifests/base.pp
index 159470b8b0..76599e9f34 100644
--- a/modules/openstack_project/manifests/base.pp
+++ b/modules/openstack_project/manifests/base.pp
@@ -1,11 +1,10 @@
 # == Class: openstack_project::base
 #
 class openstack_project::base(
-  $certname      = $::fqdn,
-  $install_users = true,
-  $pin_puppet    = '2.7.',
-  $pin_facter    = '1.',
-  $ca_server     = undef,
+  $certname              = $::fqdn,
+  $install_users         = true,
+  $pin_puppet            = '2.7.',
+  $ca_server             = undef,
 ) {
   if ($::osfamily == 'Debian') {
     include apt
@@ -14,6 +13,20 @@ class openstack_project::base(
   include openstack_project::users
   include sudoers
 
+  case $pin_puppet {
+    '2.7.': {
+      $pin_facter = '1.'
+      $pin_puppetdb_terminus = '1.'
+    }
+    /^3\./: {
+      $pin_facter = '2.'
+      $pin_puppetdb_terminus = '2.'
+    }
+    default: {
+      fail("Puppet version not supported")
+    }
+  }
+
   file { '/etc/profile.d/Z98-byobu.sh':
     ensure => absent,
   }
@@ -158,6 +171,7 @@ class openstack_project::base(
     }
   }
 
+  $puppet_version = $pin_puppet
   file { '/etc/puppet/puppet.conf':
     ensure  => present,
     owner   => 'root',
diff --git a/modules/openstack_project/templates/00-puppet.pref.erb b/modules/openstack_project/templates/00-puppet.pref.erb
index abf45412f6..e07ef0c858 100644
--- a/modules/openstack_project/templates/00-puppet.pref.erb
+++ b/modules/openstack_project/templates/00-puppet.pref.erb
@@ -1,7 +1,11 @@
-Package: puppet puppet-common puppetmaster puppetmaster-common puppetmaster-passenger puppetdb-terminus
+Package: puppet puppet-common puppetmaster puppetmaster-common puppetmaster-passenger
 Pin: version <%= @pin_puppet %>*
 Pin-Priority: 501
 
+Package: puppetdb-terminus
+Pin: version <%= @pin_puppetdb_terminus %>*
+Pin-Priority: 501
+
 Package: facter
 Pin: version <%= @pin_facter %>*
 Pin-Priority: 501
diff --git a/modules/openstack_project/templates/puppet.conf.erb b/modules/openstack_project/templates/puppet.conf.erb
index c1c3379069..af73e2c55a 100644
--- a/modules/openstack_project/templates/puppet.conf.erb
+++ b/modules/openstack_project/templates/puppet.conf.erb
@@ -3,20 +3,30 @@ logdir=/var/log/puppet
 vardir=/var/lib/puppet
 ssldir=/var/lib/puppet/ssl
 rundir=/var/run/puppet
+<% if @puppet_version.to_f < 3.6 -%>
 factpath=$vardir/lib/facter
 templatedir=$confdir/templates
 server=ci-puppetmaster.openstack.org
 certname=<%= @certname %>
 pluginsync=true
+<% end %>
+<% if @puppet_version.to_f >= 3.6 -%>
+basemodulepath = /etc/puppet/modules
+environmentpath = /etc/puppet/environments
+environmenttimeout = 0
+<% end %>
+
 
 [master]
 # These are needed when the puppetmaster is run by passenger
 # and can safely be removed if webrick is used.
 ssl_client_header = SSL_CLIENT_S_DN
 ssl_client_verify_header = SSL_CLIENT_VERIFY
+<% if @puppet_version.to_f < 3.6 -%>
 manifestdir=/opt/config/$environment/manifests
 modulepath=/opt/config/$environment/modules:/etc/puppet/modules
 manifest=$manifestdir/site.pp
+<% end -%>
 reports=store,puppetdb
 <% if @ca_server -%>
 ca = false
diff --git a/util/puppetmaster_bootstrap.sh b/util/puppetmaster_bootstrap.sh
new file mode 100755
index 0000000000..ec4e194183
--- /dev/null
+++ b/util/puppetmaster_bootstrap.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+set -x
+
+# Script to build a puppet 3 master to infra/config standards
+apt-get update
+apt-get install git
+git clone https://git.openstack.org/openstack-infra/config
+
+cd config
+
+cat > manifests/local.pp <<EOF
+node default {
+  class { 'openstack_project::puppetmaster':
+    root_rsa_key => hiera('puppetmaster_root_rsa_key', 'XXX'),
+    update_slave => false,
+    sysadmins    => hiera('sysadmins', []),
+    version      => '3.6.',
+    ca_server    => 'ci-puppetmaster.openstack.org',
+    puppetdb     => false,
+  }
+}
+EOF
+
+export PUPPET_VERSION=3
+./install_puppet.sh
+./install_modules.sh
+puppet apply  --modulepath=modules:/etc/puppet/modules manifests/local.pp