Comment 2 for bug 1717322

Ok having looked closer I see we defined the noops in the base environment template, e.g:

https://github.com/openstack/tripleo-heat-templates/blob/stable/ocata/overcloud-resource-registry-puppet.j2.yaml#L32

We still do that:

https://github.com/openstack/tripleo-heat-templates/blob/master/overcloud-resource-registry-puppet.j2.yaml#L29

So as Dan says we need to remove generating the ports in network-isolation.yaml, or validate the ordering