diff --git a/deployment/neutron/neutron-sriov-agent-container-puppet.yaml b/deployment/neutron/neutron-sriov-agent-container-puppet.yaml
index b47104b24f..96fffc9b08 100644
--- a/deployment/neutron/neutron-sriov-agent-container-puppet.yaml
+++ b/deployment/neutron/neutron-sriov-agent-container-puppet.yaml
@@ -79,6 +79,21 @@ parameters:
     type: comma_delimited_list
     tags:
       - role_specific
+  DerivePciWhitelistEnabled:
+    default: true
+    description: Whether to enable or not the pci passthrough whitelist automation.
+    type: boolean
+    tags:
+      - role_specific
+
+conditions:
+
+  derive_pci_whitelist_enabled:
+    or:
+      - and:
+        - equals: [{get_param: DerivePciWhitelistEnabled}, true]
+        - equals: [{get_param: [RoleParameters, DerivePciWhitelistEnabled]}, '']
+      - equals: [{get_param: [RoleParameters, DerivePciWhitelistEnabled]}, true]
 
 parameter_groups:
 - label: deprecated
@@ -191,20 +206,24 @@ outputs:
                 name: virt_sandbox_use_netlink
                 persistent: yes
                 state: yes
-            - name: "creating directory"
-              file:
-                state: directory
-                path: /var/lib/pci_passthrough_whitelist_scripts
-                owner: root
-                group: root
-                mode: 0750
-            - name: derive pci passthrough whitelist
-              copy:
-                content: {get_file: ./derive_pci_passthrough_whitelist.py}
-                dest: '/var/lib/pci_passthrough_whitelist_scripts/derive_pci_passthrough_whitelist.py'
-                mode: 0700
-            - name: run derive_pci_passthrough_whitelist.py
-              command:  /var/lib/pci_passthrough_whitelist_scripts/derive_pci_passthrough_whitelist.py
+            -
+              if:
+                - derive_pci_whitelist_enabled
+                - - name: "creating directory"
+                    file:
+                      state: directory
+                      path: /var/lib/pci_passthrough_whitelist_scripts
+                      owner: root
+                      group: root
+                      mode: 0750
+                  - name: derive pci passthrough whitelist
+                    copy:
+                      content: {get_file: ./derive_pci_passthrough_whitelist.py}
+                      dest: '/var/lib/pci_passthrough_whitelist_scripts/derive_pci_passthrough_whitelist.py'
+                      mode: 0700
+                  - name: run derive_pci_passthrough_whitelist.py
+                    command:  /var/lib/pci_passthrough_whitelist_scripts/derive_pci_passthrough_whitelist.py
+                - []
       metadata_settings:
         get_attr: [NeutronBase, role_data, metadata_settings]
       upgrade_tasks: []