There is a fallback in the jinja templating, {{network.name}}IpList property is passed (using the ctlplane IP for all networks) to OS::TripleO::Network::Ports::NetIpListMap resource even if the network is not enabled or not defined in the role.
overcloud.j2.yaml:549
{%- for network in networks %}
{%- if network.enabled|default(true) and network.name in role.networks|default([]) %}
{{network.name}}IpList: {get_attr: [{{role.name}}, {{network.name_lower}}_ip_address]}
{%- else %}
{{network.name}}IpList: {get_attr: [{{role.name}}, ip_address]}
{%- endif %}
{%- endfor %}
The fix is probably to remove these lines:
{%- else %}
{{network.name}}IpList: {get_attr: [{{role.name}}, ip_address]}
OPNFV bug: https:/ /jira.opnfv. org/browse/ APEX-659