diff --git a/playbooks/cleanup-ipa.yml b/playbooks/cleanup-ipa.yml
new file mode 100644
index 0000000..764aac5
--- /dev/null
+++ b/playbooks/cleanup-ipa.yml
@@ -0,0 +1,76 @@
+---
+# Copyright 2020 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# This playbook is used to clean up any host and service entries in IPA
+# when a stack is deleted.  It should be run on the undercloud against the
+# inventory generated by tripleo-ansible-inventory.
+#
+# In particular, we expect the node on which this playbook is run to be an
+# IPA client and to have a valid keytab
+
+- name: delete ipa entries for overcloud nodes
+  connection: "{{ (tripleo_target_host is defined) | ternary('ssh', 'local') }}"
+  hosts: "{{ tripleo_target_host | default('localhost') }}"
+  remote_user: "{{ tripleo_target_user | default(lookup('env', 'USER')) }}"
+  gather_facts: "{{ (tripleo_target_host is defined) | ternary(true, false) }}"
+  any_errors_fatal: true
+  pre_tasks:
+    - name: Check if undercloud is an ipa client
+      stat:
+        path: /etc/ipa/default.conf
+      register: default_conf_stat
+
+    - name: End play if undercloud is not an ipa client
+      meta: end_host
+      when: default_conf_stat.stat.exists == False
+
+    - name: Get realm and host and keytab
+      set_fact:
+        ipa_realm: "{{ lookup('ini', 'realm section=global /etc/ipa/default.conf') }}"
+        ipa_client_host: "{{ lookup('ini', 'host section=global /etc/ipa/default.conf') }}"
+        ipa_keytab: "{{ ipa_keytab | default('/etc/novajoin/krb5.keytab') }}"
+
+    - name: set ipa_principal
+      set_fact:
+        ipa_principal: "nova/{{ ipa_client_host }}@{{ ipa_realm }}"
+
+    - name: check if keytab exists
+      stat:
+        path: "{{ ipa_keytab }}"
+      register: ipa_keytab_stat
+
+    - name: End play if the keytab does not exist
+      meta: end_host
+      when: ipa_keytab_stat.stat.exists == False
+
+  tasks:
+    - name: initialize the list of hosts to clean up
+      set_fact:
+        hosts_list: []
+
+    - name: create list of hosts to clean up in IPA
+      set_fact:
+        hosts_list: "{{ hosts_list + [ hostvars[item]['canonical_hostname'] ] }}"
+      loop: "{{ groups.certmonger_user }}"
+
+    - name: import cleanup tasks from the tripleo-ipa role
+      include_role:
+        name: tripleo_ipa_cleanup
+      vars:
+        tripleo_ipa_principal: "{{ ipa_principal }}"
+        tripleo_ipa_keytab: "{{ ipa_keytab }}"
+        tripleo_ipa_hosts_to_delete: "{{ hosts_list }}"
+