diff --git a/docker/services/pacemaker/cinder-backup.yaml b/docker/services/pacemaker/cinder-backup.yaml
index a19767d340..c80fb975a9 100644
--- a/docker/services/pacemaker/cinder-backup.yaml
+++ b/docker/services/pacemaker/cinder-backup.yaml
@@ -158,29 +158,6 @@ outputs:
               recurse: true
       docker_config_scripts: {get_attr: [ContainersCommon, docker_config_scripts]}
       docker_config:
-        step_1:
-          cinder_backup_image_tag:
-            start_order: 1
-            detach: false
-            net: host
-            user: root
-            command:
-              - '/bin/bash'
-              - '-c'
-              - str_replace:
-                  template:
-                    "/usr/bin/docker tag 'CINDERBACKUP_IMAGE' 'CINDERBACKUP_IMAGE_PCMKLATEST'"
-                  params:
-                    CINDERBACKUP_IMAGE: {get_param: DockerCinderBackupImage}
-                    CINDERBACKUP_IMAGE_PCMKLATEST: *cinder_backup_image_pcmklatest
-            image: {get_param: DockerCinderBackupImage}
-            volumes:
-              - /etc/hosts:/etc/hosts:ro
-              - /etc/localtime:/etc/localtime:ro
-              - /dev/shm:/dev/shm:rw
-              - /etc/sysconfig/docker:/etc/sysconfig/docker:ro
-              - /usr/bin:/usr/bin:ro
-              - /var/run/docker.sock:/var/run/docker.sock:rw
         step_3:
           cinder_backup_init_logs:
             start_order: 0
@@ -260,6 +237,14 @@ outputs:
           file:
             path: /etc/ceph
             state: directory
+      deploy_steps_tasks:
+        - name: Cinder Backup tag container image for pacemaker
+          when: step|int == 2
+          import_role:
+            name: tripleo-container-tag
+          vars:
+            container_image: {get_param: DockerCinderBackupImage}
+            container_image_latest: *cinder_backup_image_pcmklatest
       update_tasks:
         - name: Cinder-Backup fetch and retag container image for pacemaker
           when: step|int == 2
@@ -286,7 +271,11 @@ outputs:
             - name: Pull latest Cinder-Backup images
               command: "docker pull {{docker_image}}"
             - name: Retag pcmklatest to latest Cinder-Backup image
-              shell: "docker tag {{docker_image}} {{docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{docker_image}}"
+                container_image_latest: "{{docker_image_latest}}"
             # Got to check that pacemaker_is_active is working fine with bundle.
             # TODO: pacemaker_is_active resource doesn't support bundle.
       upgrade_tasks:
@@ -311,8 +300,12 @@ outputs:
                   shell: "docker images | awk '/cinder-backup.* pcmklatest/{print $3}' | uniq"
                   register: cinder_backup_current_pcmklatest_id
                 - name: Temporarily tag the current cinder_backup image id with the upgraded image name
-                  shell: "docker tag {{cinder_backup_current_pcmklatest_id.stdout}} {{cinder_backup_docker_image_latest}}"
                   when: cinder_backup_current_pcmklatest_id.stdout != ''
+                  import_role:
+                    name: tripleo-container-tag
+                  vars:
+                    container_image: "{{cinder_backup_current_pcmklatest_id.stdout}}"
+                    container_image_latest: "{{cinder_backup_docker_image_latest}}"
             - name: Check openstack-cinder-backup cluster resource status
               pacemaker_resource:
                 resource: openstack-cinder-backup
diff --git a/docker/services/pacemaker/cinder-volume.yaml b/docker/services/pacemaker/cinder-volume.yaml
index 3fe670a993..97e37f14f6 100644
--- a/docker/services/pacemaker/cinder-volume.yaml
+++ b/docker/services/pacemaker/cinder-volume.yaml
@@ -143,29 +143,6 @@ outputs:
               recurse: true
       docker_config_scripts: {get_attr: [ContainersCommon, docker_config_scripts]}
       docker_config:
-        step_1:
-          cinder_volume_image_tag:
-            start_order: 1
-            detach: false
-            net: host
-            user: root
-            command:
-              - '/bin/bash'
-              - '-c'
-              - str_replace:
-                  template:
-                    "/usr/bin/docker tag 'CINDERVOLUME_IMAGE' 'CINDERVOLUME_IMAGE_PCMKLATEST'"
-                  params:
-                    CINDERVOLUME_IMAGE: {get_param: DockerCinderVolumeImage}
-                    CINDERVOLUME_IMAGE_PCMKLATEST: *cinder_volume_image_pcmklatest
-            image: {get_param: DockerCinderVolumeImage}
-            volumes:
-              - /etc/hosts:/etc/hosts:ro
-              - /etc/localtime:/etc/localtime:ro
-              - /dev/shm:/dev/shm:rw
-              - /etc/sysconfig/docker:/etc/sysconfig/docker:ro
-              - /usr/bin:/usr/bin:ro
-              - /var/run/docker.sock:/var/run/docker.sock:rw
         step_3:
           cinder_volume_init_logs:
             start_order: 0
@@ -227,6 +204,14 @@ outputs:
                   - - 'TRIPLEO_DEPLOY_IDENTIFIER='
                     - {get_param: DeployIdentifier}
       host_prep_tasks: {get_attr: [CinderCommon, cinder_volume_host_prep_tasks]}
+      deploy_steps_tasks:
+        - name: Cinder Volume tag container image for pacemaker
+          when: step|int == 2
+          import_role:
+            name: tripleo-container-tag
+          vars:
+            container_image: {get_param: DockerCinderVolumeImage}
+            container_image_latest: *cinder_volume_image_pcmklatest
       update_tasks:
         - name: Cinder-Volume fetch and retag container image for pacemaker
           when: step|int == 2
@@ -253,7 +238,11 @@ outputs:
             - name: Pull latest Cinder-Volume images
               command: "docker pull {{docker_image}}"
             - name: Retag pcmklatest to latest Cinder-Volume image
-              shell: "docker tag {{docker_image}} {{docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{docker_image}}"
+                container_image_latest: "{{docker_image_latest}}"
             # Got to check that pacemaker_is_active is working fine with bundle.
             # TODO: pacemaker_is_active resource doesn't support bundle.
       upgrade_tasks:
@@ -278,7 +267,11 @@ outputs:
                   shell: "docker images | awk '/cinder-volume.* pcmklatest/{print $3}' | uniq"
                   register: cinder_volume_current_pcmklatest_id
                 - name: Temporarily tag the current cinder_volume image id with the upgraded image name
-                  shell: "docker tag {{cinder_volume_current_pcmklatest_id.stdout}} {{cinder_volume_docker_image_latest}}"
+                  import_role:
+                    name: tripleo-container-tag
+                  vars:
+                    container_image: "{{cinder_volume_current_pcmklatest_id.stdout}}"
+                    container_image_latest: "{{cinder_volume_docker_image_latest}}"
                   when: cinder_volume_current_pcmklatest_id.stdout != ''
             - name: Check openstack-cinder-volume cluster resource status
               pacemaker_resource:
diff --git a/docker/services/pacemaker/database/mysql.yaml b/docker/services/pacemaker/database/mysql.yaml
index 9e7d02d83e..4be6a420aa 100644
--- a/docker/services/pacemaker/database/mysql.yaml
+++ b/docker/services/pacemaker/database/mysql.yaml
@@ -227,28 +227,6 @@ outputs:
                           passwords:
                             - {get_param: MysqlRootPassword}
                             - {get_param: [DefaultPasswords, mysql_root_password]}
-          mysql_image_tag:
-            start_order: 2
-            detach: false
-            net: host
-            user: root
-            command:
-              - '/bin/bash'
-              - '-c'
-              - str_replace:
-                  template:
-                    "/usr/bin/docker tag 'MYSQL_IMAGE' 'MYSQL_IMAGE_PCMKLATEST'"
-                  params:
-                    MYSQL_IMAGE: {get_param: DockerMysqlImage}
-                    MYSQL_IMAGE_PCMKLATEST: *mysql_image_pcmklatest
-            image: {get_param: DockerMysqlImage}
-            volumes:
-              - /etc/hosts:/etc/hosts:ro
-              - /etc/localtime:/etc/localtime:ro
-              - /dev/shm:/dev/shm:rw
-              - /etc/sysconfig/docker:/etc/sysconfig/docker:ro
-              - /usr/bin:/usr/bin:ro
-              - /var/run/docker.sock:/var/run/docker.sock:rw
         step_2:
           mysql_restart_bundle:
             start_order: 0
@@ -319,6 +297,14 @@ outputs:
           ignore_errors: true
       metadata_settings:
         get_attr: [MysqlPuppetBase, role_data, metadata_settings]
+      deploy_steps_tasks:
+        - name: MySQL tag container image for pacemaker
+          when: step|int == 2
+          import_role:
+            name: tripleo-container-tag
+          vars:
+            container_image: {get_param: DockerMysqlImage}
+            container_image_latest: *mysql_image_pcmklatest
       update_tasks:
         - name: Mariadb fetch and retag container image for pacemaker
           when: step|int == 2
@@ -345,7 +331,11 @@ outputs:
             - name: Pull latest Mariadb images
               command: "docker pull {{docker_image}}"
             - name: Retag pcmklatest to latest Mariadb image
-              shell: "docker tag {{docker_image}} {{docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{docker_image}}"
+                container_image_latest: "{{docker_image_latest}}"
             # Got to check that pacemaker_is_active is working fine with bundle.
             # TODO: pacemaker_is_active resource doesn't support bundle.
       upgrade_tasks:
@@ -374,7 +364,11 @@ outputs:
                   shell: "docker images | awk '/mariadb.* pcmklatest/{print $3}' | uniq"
                   register: galera_current_pcmklatest_id
                 - name: Temporarily tag the current galera image id with the upgraded image name
-                  shell: "docker tag {{galera_current_pcmklatest_id.stdout}} {{mysql_docker_image_latest}}"
+                  import_role:
+                    name: tripleo-container-tag
+                  vars:
+                    container_image: "{{galera_current_pcmklatest_id.stdout}}"
+                    container_image_latest: "{{mysql_docker_image_latest}}"
                   when: galera_current_pcmklatest_id.stdout != ''
             - name: Check galera cluster resource status
               pacemaker_resource:
diff --git a/docker/services/pacemaker/database/redis.yaml b/docker/services/pacemaker/database/redis.yaml
index 62bf36d1af..67e4cfdb57 100644
--- a/docker/services/pacemaker/database/redis.yaml
+++ b/docker/services/pacemaker/database/redis.yaml
@@ -186,29 +186,6 @@ outputs:
               optional: true
       docker_config_scripts: {get_attr: [ContainersCommon, docker_config_scripts]}
       docker_config:
-        step_1:
-          redis_image_tag:
-            start_order: 1
-            detach: false
-            net: host
-            user: root
-            command:
-              - '/bin/bash'
-              - '-c'
-              - str_replace:
-                  template:
-                    "/usr/bin/docker tag 'REDIS_IMAGE' 'REDIS_IMAGE_PCMKLATEST'"
-                  params:
-                    REDIS_IMAGE: {get_param: DockerRedisImage}
-                    REDIS_IMAGE_PCMKLATEST: *redis_image_pcmklatest
-            image: {get_param: DockerRedisImage}
-            volumes:
-              - /etc/hosts:/etc/hosts:ro
-              - /etc/localtime:/etc/localtime:ro
-              - /dev/shm:/dev/shm:rw
-              - /etc/sysconfig/docker:/etc/sysconfig/docker:ro
-              - /usr/bin:/usr/bin:ro
-              - /var/run/docker.sock:/var/run/docker.sock:rw
         step_2:
           map_merge:
             - redis_restart_bundle:
@@ -299,6 +276,14 @@ outputs:
               Log files from redis containers can be found under
               /var/log/containers/redis.
           ignore_errors: true
+      deploy_steps_tasks:
+        - name: Redis tag container image for pacemaker
+          when: step|int == 2
+          import_role:
+            name: tripleo-container-tag
+          vars:
+            container_image: {get_param: DockerRedisImage}
+            container_image_latest: *redis_image_pcmklatest
       update_tasks:
         - name: Redis fetch and retag container image for pacemaker
           when: step|int == 2
@@ -325,7 +310,11 @@ outputs:
             - name: Pull latest Redis images
               command: "docker pull {{docker_image}}"
             - name: Retag pcmklatest to latest Redis image
-              shell: "docker tag {{docker_image}} {{docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{docker_image}}"
+                container_image_latest: "{{docker_image_latest}}"
             # Got to check that pacemaker_is_active is working fine with bundle.
             # TODO: pacemaker_is_active resource doesn't support bundle.
       upgrade_tasks:
@@ -354,7 +343,11 @@ outputs:
                   shell: "docker images | awk '/redis.* pcmklatest/{print $3}' | uniq"
                   register: redis_current_pcmklatest_id
                 - name: Temporarily tag the current redis image id with the upgraded image name
-                  shell: "docker tag {{redis_current_pcmklatest_id.stdout}} {{redis_docker_image_latest}}"
+                  import_role:
+                    name: tripleo-container-tag
+                  vars:
+                    container_image: "{{redis_current_pcmklatest_id.stdout}}"
+                    container_image_latest: "{{redis_docker_image_latest}}"
                   when: redis_current_pcmklatest_id.stdout != ''
             - name: Check redis-bundle cluster resource status
               pacemaker_resource:
diff --git a/docker/services/pacemaker/haproxy.yaml b/docker/services/pacemaker/haproxy.yaml
index e625379b1e..08bd0078f5 100644
--- a/docker/services/pacemaker/haproxy.yaml
+++ b/docker/services/pacemaker/haproxy.yaml
@@ -210,30 +210,6 @@ outputs:
               optional: true
       docker_config_scripts: {get_attr: [ContainersCommon, docker_config_scripts]}
       docker_config:
-        step_1:
-          haproxy_image_tag:
-            start_order: 1
-            detach: false
-            net: host
-            user: root
-            command:
-              - '/bin/bash'
-              - '-c'
-              - str_replace:
-                  template:
-                    "/usr/bin/docker tag 'HAPROXY_IMAGE' 'HAPROXY_IMAGE_PCMKLATEST'"
-                  params:
-                    HAPROXY_IMAGE: {get_param: DockerHAProxyImage}
-                    HAPROXY_IMAGE_PCMKLATEST: *haproxy_image_pcmklatest
-            image: {get_param: DockerHAProxyImage}
-            volumes:
-              - /etc/hosts:/etc/hosts:ro
-              - /etc/localtime:/etc/localtime:ro
-              - /dev/shm:/dev/shm:rw
-              - /etc/sysconfig/docker:/etc/sysconfig/docker:ro
-              - /usr/bin:/usr/bin:ro
-              - /var/run/docker.sock:/var/run/docker.sock:rw
-            image: {get_param: DockerHAProxyImage}
         step_2:
           haproxy_restart_bundle:
             start_order: 2
@@ -305,6 +281,14 @@ outputs:
             - { 'path': /var/lib/haproxy, 'setype': svirt_sandbox_file_t }
       metadata_settings:
         get_attr: [HAProxyBase, role_data, metadata_settings]
+      deploy_steps_tasks:
+        - name: HAproxy tag container image for pacemaker
+          when: step|int == 2
+          import_role:
+            name: tripleo-container-tag
+          vars:
+            container_image: {get_param: DockerHAProxyImage}
+            container_image_latest: *haproxy_image_pcmklatest
       update_tasks:
         - name: Set HAProxy upgrade facts
           block: &haproxy_update_upgrade_facts
@@ -383,7 +367,11 @@ outputs:
             - name: Pull latest Haproxy images
               command: "docker pull {{docker_image}}"
             - name: Retag pcmklatest to latest Haproxy image
-              shell: "docker tag {{docker_image}} {{docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{ docker_image }}"
+                container_image_latest: "{{ docker_image_latest }}"
             # Got to check that pacemaker_is_active is working fine with bundle.
             # TODO: pacemaker_is_active resource doesn't support bundle.
       upgrade_tasks:
@@ -402,7 +390,11 @@ outputs:
                   shell: "docker images | awk '/haproxy.* pcmklatest/{print $3}' | uniq"
                   register: haproxy_current_pcmklatest_id
                 - name: Temporarily tag the current haproxy image id with the upgraded image name
-                  shell: "docker tag {{haproxy_current_pcmklatest_id.stdout}} {{haproxy_docker_image_latest}}"
+                  import_role:
+                    name: tripleo-container-tag
+                  vars:
+                    container_image: "{{haproxy_current_pcmklatest_id.stdout}}"
+                    container_image_latest: "{{haproxy_docker_image_latest}}"
                   when: haproxy_current_pcmklatest_id.stdout != ''
             - name: Check haproxy-bundle cluster resource status
               pacemaker_resource:
diff --git a/docker/services/pacemaker/manila-share.yaml b/docker/services/pacemaker/manila-share.yaml
index 11ccb8b3d3..4ff2fd8cbb 100644
--- a/docker/services/pacemaker/manila-share.yaml
+++ b/docker/services/pacemaker/manila-share.yaml
@@ -125,29 +125,6 @@ outputs:
               recurse: true
       docker_config_scripts: {get_attr: [ContainersCommon, docker_config_scripts]}
       docker_config:
-        step_1:
-          manila_share_image_tag:
-            start_order: 1
-            detach: false
-            net: host
-            user: root
-            command:
-              - '/bin/bash'
-              - '-c'
-              - str_replace:
-                  template:
-                    "/usr/bin/docker tag 'MANILASHARE_IMAGE' 'MANILASHARE_IMAGE_PCMKLATEST'"
-                  params:
-                    MANILASHARE_IMAGE: {get_param: DockerManilaShareImage}
-                    MANILASHARE_IMAGE_PCMKLATEST: *manila_share_image_pcmklatest
-            image: {get_param: DockerManilaShareImage}
-            volumes:
-              - /etc/hosts:/etc/hosts:ro
-              - /etc/localtime:/etc/localtime:ro
-              - /dev/shm:/dev/shm:rw
-              - /etc/sysconfig/docker:/etc/sysconfig/docker:ro
-              - /usr/bin:/usr/bin:ro
-              - /var/run/docker.sock:/var/run/docker.sock:rw
         step_3:
           manila_share_init_logs:
             start_order: 0
@@ -227,6 +204,14 @@ outputs:
           file:
             path: /etc/ceph
             state: directory
+      deploy_steps_tasks:
+        - name: Manila Share tag container image for pacemaker
+          when: step|int == 2
+          import_role:
+            name: tripleo-container-tag
+          vars:
+            container_image: {get_param: DockerManilaShareImage}
+            container_image_latest: *manila_share_image_pcmklatest
       update_tasks:
         - name: Manila-Share fetch and retag container image for pacemaker
           when: step|int == 2
@@ -253,7 +238,11 @@ outputs:
             - name: Pull latest Manila-Share images
               command: "docker pull {{docker_image}}"
             - name: Retag pcmklatest to latest Manila-Share image
-              shell: "docker tag {{docker_image}} {{docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{docker_image}}"
+                container_image_latest: "{{docker_image_latest}}"
             # Got to check that pacemaker_is_active is working fine with bundle.
             # TODO: pacemaker_is_active resource doesn't support bundle.
       upgrade_tasks:
@@ -278,7 +267,11 @@ outputs:
                   shell: "docker images | awk '/manila-share.* pcmklatest/{print $3}' | uniq"
                   register: manila_share_current_pcmklatest_id
                 - name: Temporarily tag the current Manila-Share image id with the upgraded image name
-                  shell: "docker tag {{manila_share_current_pcmklatest_id.stdout}} {{manila_share_docker_image_latest}}"
+                  import_role:
+                    name: tripleo-container-tag
+                  vars:
+                    container_image: "{{manila_share_current_pcmklatest_id.stdout}}"
+                    container_image_latest: "{{manila_share_docker_image_latest}}"
                   when: manila_share_current_pcmklatest_id.stdout != ''
             - name: Check openstack-manila-share cluster resource status
               pacemaker_resource:
diff --git a/docker/services/pacemaker/notify-rabbitmq.yaml b/docker/services/pacemaker/notify-rabbitmq.yaml
index 387bce80b6..4b59c28c66 100644
--- a/docker/services/pacemaker/notify-rabbitmq.yaml
+++ b/docker/services/pacemaker/notify-rabbitmq.yaml
@@ -172,28 +172,6 @@ outputs:
                           passwords:
                             - {get_param: RabbitCookie}
                             - {get_param: [DefaultPasswords, rabbit_cookie]}
-          rabbitmq_image_tag:
-            start_order: 1
-            detach: false
-            net: host
-            user: root
-            command:
-              - '/bin/bash'
-              - '-c'
-              - str_replace:
-                  template:
-                    "/usr/bin/docker tag 'RABBITMQ_IMAGE' 'RABBITMQ_IMAGE_PCMKLATEST'"
-                  params:
-                    RABBITMQ_IMAGE: {get_param: DockerRabbitmqImage}
-                    RABBITMQ_IMAGE_PCMKLATEST: *rabbitmq_image_pcmklatest
-            image: {get_param: DockerRabbitmqImage}
-            volumes:
-              - /etc/hosts:/etc/hosts:ro
-              - /etc/localtime:/etc/localtime:ro
-              - /dev/shm:/dev/shm:rw
-              - /etc/sysconfig/docker:/etc/sysconfig/docker:ro
-              - /usr/bin:/usr/bin:ro
-              - /var/run/docker.sock:/var/run/docker.sock:rw
         step_2:
           rabbitmq_restart_bundle:
             start_order: 0
@@ -268,6 +246,14 @@ outputs:
             for pid in $(pgrep epmd --ns 1 --nslist pid); do kill $pid; done
       metadata_settings:
         get_attr: [RabbitmqBase, role_data, metadata_settings]
+      deploy_steps_tasks:
+        - name: RabbitMQ tag container image for pacemaker
+          when: step|int == 2
+          import_role:
+            name: tripleo-container-tag
+          vars:
+            container_image: {get_param: DockerRabbitmqImage}
+            container_image_latest: *rabbitmq_image_pcmklatest
       update_tasks:
         - name: Rabbit fetch and retag container image for pacemaker
           when: step|int == 2
@@ -294,7 +280,11 @@ outputs:
             - name: Pull latest Rabbitmq images
               command: "docker pull {{docker_image}}"
             - name: Retag pcmklatest to latest Rabbitmq image
-              shell: "docker tag {{docker_image}} {{docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{docker_image}}"
+                container_image_latest: "{{docker_image_latest}}"
             # Got to check that pacemaker_is_active is working fine with bundle.
             # TODO: pacemaker_is_active resource doesn't support bundle.
       upgrade_tasks:
diff --git a/docker/services/pacemaker/ovn-dbs.yaml b/docker/services/pacemaker/ovn-dbs.yaml
index 203eb8a711..94915a9c4f 100644
--- a/docker/services/pacemaker/ovn-dbs.yaml
+++ b/docker/services/pacemaker/ovn-dbs.yaml
@@ -119,29 +119,6 @@ outputs:
               optional: true
       docker_config_scripts: {get_attr: [ContainersCommon, docker_config_scripts]}
       docker_config:
-        step_2:
-          ovn_dbs_image_tag:
-            start_order: 0
-            detach: false
-            net: host
-            user: root
-            command:
-              - '/bin/bash'
-              - '-c'
-              - str_replace:
-                  template:
-                    "/usr/bin/docker tag 'OVN_DBS_IMAGE' 'OVN_DBS_IMAGE_PCMKLATEST'"
-                  params:
-                    OVN_DBS_IMAGE: {get_param: DockerOvnDbsImage}
-                    OVN_DBS_IMAGE_PCMKLATEST: *ovn_dbs_image_pcmklatest
-            image: {get_param: DockerOvnDbsImage}
-            volumes:
-              - /etc/hosts:/etc/hosts:ro
-              - /etc/localtime:/etc/localtime:ro
-              - /dev/shm:/dev/shm:rw
-              - /etc/sysconfig/docker:/etc/sysconfig/docker:ro
-              - /usr/bin:/usr/bin:ro
-              - /var/run/docker.sock:/var/run/docker.sock:rw
         step_3:
           ovn_dbs_restart_bundle:
             start_order: 0
@@ -209,6 +186,14 @@ outputs:
               Log files from openvswitch containers can be found under
               /var/log/containers/openvswitch.
           ignore_errors: true
+      deploy_steps_tasks:
+        - name: OVN DBS tag container image for pacemaker
+          when: step|int == 2
+          import_role:
+            name: tripleo-container-tag
+          vars:
+            container_image: {get_param: DockerOvnDbsImage}
+            container_image_latest: *ovn_dbs_image_pcmklatest
       update_tasks:
         - name: Get docker ovn-dbs image
           set_fact:
@@ -249,7 +234,11 @@ outputs:
             - name: Pull latest ovn-dbs images
               command: "docker pull {{ovn_dbs_docker_image}}"
             - name: Retag pcmklatest to latest ovn-dbs image
-              shell: "docker tag {{ovn_dbs_docker_image}} {{ovn_dbs_docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{docker_image}}"
+                container_image_latest: "{{docker_image_latest}}"
             # Got to check that pacemaker_is_active is working fine with bundle.
             # TODO: pacemaker_is_active resource doesn't support bundle.
         # When ovn-dbs-bundle support was added, we didn't tag the ovn-dbs image
@@ -301,7 +290,11 @@ outputs:
               shell: "docker images | awk '/ovn.* pcmklatest/{print $3}' | uniq"
               register: ovn_dbs_current_pcmklatest_id
             - name: Temporarily tag the current ovn-dbs pcmklatest image id with the upgraded image name
-              shell: "docker tag {{ovn_dbs_current_pcmklatest_id.stdout}} {{ovn_dbs_docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{ovn_dbs_current_pcmklatest_id.stdout}}"
+                container_image_latest: "{{ovn_dbs_docker_image_latest}}"
               when: ovn_dbs_current_pcmklatest_id.stdout != ''
             # If ovn-dbs image is not tagged with pcmklatest, then create a new
             # tag. This could happen if the stack is upgraded without updating the stack before.
@@ -313,7 +306,11 @@ outputs:
                   shell: "pcs resource show ovn-dbs-bundle | grep image | awk '{ split($2, image, \"=\"); print image[2] }'"
                   register: ovn_dbs_current_image
                 - name: Tag the current image with pcmklatest tag
-                  shell: "docker tag {{ovn_dbs_current_image.stdout}} {{ovn_dbs_docker_image_latest}}"
+                  import_role:
+                    name: tripleo-container-tag
+                  vars:
+                    container_image: "{{ovn_dbs_current_image.stdout}}"
+                    container_image_latest: "{{ovn_dbs_docker_image_latest}}"
               when:
                 - ovn_dbs_current_pcmklatest_id.stdout == ''
         - name: Check ovn-dbs-bundle cluster resource status
diff --git a/docker/services/pacemaker/rabbitmq.yaml b/docker/services/pacemaker/rabbitmq.yaml
index c736252b06..538e4b0856 100644
--- a/docker/services/pacemaker/rabbitmq.yaml
+++ b/docker/services/pacemaker/rabbitmq.yaml
@@ -171,28 +171,6 @@ outputs:
                           passwords:
                             - {get_param: RabbitCookie}
                             - {get_param: [DefaultPasswords, rabbit_cookie]}
-          rabbitmq_image_tag:
-            start_order: 1
-            detach: false
-            net: host
-            user: root
-            command:
-              - '/bin/bash'
-              - '-c'
-              - str_replace:
-                  template:
-                    "/usr/bin/docker tag 'RABBITMQ_IMAGE' 'RABBITMQ_IMAGE_PCMKLATEST'"
-                  params:
-                    RABBITMQ_IMAGE: {get_param: DockerRabbitmqImage}
-                    RABBITMQ_IMAGE_PCMKLATEST: *rabbitmq_image_pcmklatest
-            image: {get_param: DockerRabbitmqImage}
-            volumes:
-              - /etc/hosts:/etc/hosts:ro
-              - /etc/localtime:/etc/localtime:ro
-              - /dev/shm:/dev/shm:rw
-              - /etc/sysconfig/docker:/etc/sysconfig/docker:ro
-              - /usr/bin:/usr/bin:ro
-              - /var/run/docker.sock:/var/run/docker.sock:rw
         step_2:
           rabbitmq_restart_bundle:
             start_order: 0
@@ -267,6 +245,14 @@ outputs:
             for pid in $(pgrep epmd --ns 1 --nslist pid); do kill $pid; done
       metadata_settings:
         get_attr: [RabbitmqBase, role_data, metadata_settings]
+      deploy_steps_tasks:
+        - name: RabbitMQ tag container image for pacemaker
+          when: step|int == 2
+          import_role:
+            name: tripleo-container-tag
+          vars:
+            container_image: {get_param: DockerRabbitmqImage}
+            container_image_latest: *rabbitmq_image_pcmklatest
       update_tasks:
         - name: Rabbit fetch and retag container image for pacemaker
           when: step|int == 2
@@ -293,7 +279,11 @@ outputs:
             - name: Pull latest Rabbitmq images
               command: "docker pull {{docker_image}}"
             - name: Retag pcmklatest to latest Rabbitmq image
-              shell: "docker tag {{docker_image}} {{docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{docker_image}}"
+                container_image_latest: "{{docker_image_latest}}"
             # Got to check that pacemaker_is_active is working fine with bundle.
             # TODO: pacemaker_is_active resource doesn't support bundle.
       upgrade_tasks:
@@ -353,7 +343,11 @@ outputs:
               shell: "docker images | awk '/rabbitmq.* pcmklatest/{print $3}' | uniq"
               register: rabbitmq_current_pcmklatest_id
             - name: Temporarily tag the current rabbitmq image id with the upgraded image name
-              shell: "docker tag {{rabbitmq_current_pcmklatest_id.stdout}} {{rabbitmq_docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{rabbitmq_current_pcmklatest_id.stdout}}"
+                container_image_latest: "{{rabbitmq_docker_image_latest}}"
               when: rabbitmq_current_pcmklatest_id.stdout != ''
         - name: Check rabbitmq-bundle cluster resource status
           pacemaker_resource:
diff --git a/docker/services/pacemaker/rpc-rabbitmq.yaml b/docker/services/pacemaker/rpc-rabbitmq.yaml
index a2b3311af3..ecb51c6bfe 100644
--- a/docker/services/pacemaker/rpc-rabbitmq.yaml
+++ b/docker/services/pacemaker/rpc-rabbitmq.yaml
@@ -172,28 +172,6 @@ outputs:
                           passwords:
                             - {get_param: RabbitCookie}
                             - {get_param: [DefaultPasswords, rabbit_cookie]}
-          rabbitmq_image_tag:
-            start_order: 1
-            detach: false
-            net: host
-            user: root
-            command:
-              - '/bin/bash'
-              - '-c'
-              - str_replace:
-                  template:
-                    "/usr/bin/docker tag 'RABBITMQ_IMAGE' 'RABBITMQ_IMAGE_PCMKLATEST'"
-                  params:
-                    RABBITMQ_IMAGE: {get_param: DockerRabbitmqImage}
-                    RABBITMQ_IMAGE_PCMKLATEST: *rabbitmq_image_pcmklatest
-            image: {get_param: DockerRabbitmqImage}
-            volumes:
-              - /etc/hosts:/etc/hosts:ro
-              - /etc/localtime:/etc/localtime:ro
-              - /dev/shm:/dev/shm:rw
-              - /etc/sysconfig/docker:/etc/sysconfig/docker:ro
-              - /usr/bin:/usr/bin:ro
-              - /var/run/docker.sock:/var/run/docker.sock:rw
         step_2:
           rabbitmq_restart_bundle:
             start_order: 0
@@ -268,6 +246,14 @@ outputs:
             echo 'export ERL_EPMD_ADDRESS=127.0.0.1' > /etc/rabbitmq/rabbitmq-env.conf
             echo 'export ERL_EPMD_PORT=4370' >> /etc/rabbitmq/rabbitmq-env.conf
             for pid in $(pgrep epmd --ns 1 --nslist pid); do kill $pid; done
+      deploy_steps_tasks:
+        - name: RabbitMQ tag container image for pacemaker
+          when: step|int == 2
+          import_role:
+            name: tripleo-container-tag
+          vars:
+            container_image: {get_param: DockerRabbitmqImage}
+            container_image_latest: *rabbitmq_image_pcmklatest
       update_tasks:
         - name: Rabbit fetch and retag container image for pacemaker
           when: step|int == 2
@@ -294,7 +280,11 @@ outputs:
             - name: Pull latest Rabbitmq images
               command: "docker pull {{docker_image}}"
             - name: Retag pcmklatest to latest Rabbitmq image
-              shell: "docker tag {{docker_image}} {{docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{docker_image}}"
+                container_image_latest: "{{docker_image_latest}}"
             # Got to check that pacemaker_is_active is working fine with bundle.
             # TODO: pacemaker_is_active resource doesn't support bundle.
       upgrade_tasks:
@@ -354,7 +344,11 @@ outputs:
               shell: "docker images | awk '/rabbitmq.* pcmklatest/{print $3}' | uniq"
               register: rabbitmq_current_pcmklatest_id
             - name: Temporarily tag the current rabbitmq image id with the upgraded image name
-              shell: "docker tag {{rabbitmq_current_pcmklatest_id.stdout}} {{rabbitmq_docker_image_latest}}"
+              import_role:
+                name: tripleo-container-tag
+              vars:
+                container_image: "{{rabbitmq_current_pcmklatest_id.stdout}}"
+                container_image_latest: "{{rabbitmq_docker_image_latest}}"
               when: rabbitmq_current_pcmklatest_id.stdout != ''
         - name: Check rabbitmq-bundle cluster resource status
           pacemaker_resource: