diff --git a/doc/source/install/keystone.rst b/doc/source/install/keystone.rst
index 7f5697167..97c1ad3ab 100644
--- a/doc/source/install/keystone.rst
+++ b/doc/source/install/keystone.rst
@@ -40,3 +40,13 @@ a file will be written to the user's home directory that is executing
 the installation.  That file can be located at
 ``~/.config/openstack/clouds.yaml``. The cloud that is written
 to that file is named ``bifrost``.
+
+Creation of openrc
+------------------
+
+Also by default, after bifrost installation and again, when keystone
+is enabled, a file will be written to the user's home directory that
+you can use to set the appropriate environment variables in your
+current shell to be able to use OpenStack utilities:
+
+    . ~/openrc bifrost && openstack baremetal driver list
diff --git a/playbooks/roles/bifrost-keystone-client-config/tasks/main.yml b/playbooks/roles/bifrost-keystone-client-config/tasks/main.yml
index f372d5243..1e5632268 100644
--- a/playbooks/roles/bifrost-keystone-client-config/tasks/main.yml
+++ b/playbooks/roles/bifrost-keystone-client-config/tasks/main.yml
@@ -51,3 +51,10 @@
     dest: "~{{ user | default('root') }}/.config/openstack/clouds.yaml"
     owner: "{{ user | default('root') }}"
     mode: 0600
+
+- name: "Write openrc configuration from template"
+  template:
+    src: openrc.j2
+    dest: "~{{ user | default('root') }}/openrc"
+    owner: "{{ user | default('root') }}"
+    mode: 0600
diff --git a/playbooks/roles/bifrost-keystone-client-config/templates/openrc.j2 b/playbooks/roles/bifrost-keystone-client-config/templates/openrc.j2
new file mode 100644
index 000000000..481896b24
--- /dev/null
+++ b/playbooks/roles/bifrost-keystone-client-config/templates/openrc.j2
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+# WARNING: This file is managed by bifrost.
+{% if (enable_keystone | default(false) | bool) %}
+case "$1" in
+{% for cloud in clouds | default({}) | dictsort %}
+# Section for {{ cloud.0 }}
+    {{ cloud.0 }}")
+    export OS_PROJECT_DOMAIN_NAME="{{ cloud.1.config_project_domain_id | default('default') }}"
+    export OS_USER_DOMAIN_NAME="{{ cloud.1.config_user_domain_id | default('default') }}"
+    export OS_PROJECT_NAME={{ cloud.1.config_project_name }}
+    export OS_USERNAME={{ cloud.1.config_username }}
+    export OS_PASSWORD={{ cloud.1.config_password }}
+    export OS_AUTH_URL={{ cloud.1.config_auth_url }}
+    export OS_IDENTITY_API_VERSION=3
+    ;;
+{% endfor %}
+    *) echo -e "\nERROR unsupported or unspecified profile: $1\nMust be one of {{ clouds | default({}) | dictsort | map(attribute='0') | join(',') }}";;
+esac
+{% else %}
+export IRONIC_URL={{ ironic_api_url }}
+export OS_AUTH_TOKEN='fake-token'
+{% endif %}
diff --git a/releasenotes/notes/create-openrc-9e7f959790f7f409.yaml b/releasenotes/notes/create-openrc-9e7f959790f7f409.yaml
new file mode 100644
index 000000000..6b3b6e921
--- /dev/null
+++ b/releasenotes/notes/create-openrc-9e7f959790f7f409.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - The Bifrost role which is used to create a clouds.yaml, now also
+    creates a openrc file in the user home directory when keystone
+    is enabled. This should be used to call OpenStack CLI utilities
+    and have proper credentials. The file location is ``~/openrc``.