diff --git a/manifests/api.pp b/manifests/api.pp
index c4a9bf97..afc2ad0d 100644
--- a/manifests/api.pp
+++ b/manifests/api.pp
@@ -113,6 +113,7 @@ class ironic::api (
   $memcached_servers = undef,
 ) inherits ironic::params {
 
+  include ::ironic::deps
   include ::ironic::params
   include ::ironic::policy
 
@@ -142,9 +143,6 @@ class ironic::api (
 
   include ::ironic::api::authtoken
 
-  Ironic_config<||> ~> Service[$service_name]
-  Class['ironic::policy'] ~> Service[$service_name]
-
   # Configure ironic.conf
   ironic_config {
     'api/host_ip':         value => $host_ip;
@@ -157,8 +155,6 @@ class ironic::api (
 
   # Install package
   if $::ironic::params::api_package {
-    Package['ironic-api'] -> Class['ironic::policy']
-    Package['ironic-api'] -> Service[$service_name]
     package { 'ironic-api':
       ensure => $package_ensure,
       name   => $::ironic::params::api_package,
diff --git a/manifests/api/authtoken.pp b/manifests/api/authtoken.pp
index 34f6f89a..715ce746 100644
--- a/manifests/api/authtoken.pp
+++ b/manifests/api/authtoken.pp
@@ -228,6 +228,8 @@ class ironic::api::authtoken(
   $token_cache_time               = $::os_service_default,
 ) {
 
+  include ::ironic::deps
+
   if is_service_default($password) and ! $::ironic::api::admin_password {
     fail('Please set password for Ironic API service user')
   }
diff --git a/manifests/bifrost.pp b/manifests/bifrost.pp
index bda15ebe..a541b94d 100644
--- a/manifests/bifrost.pp
+++ b/manifests/bifrost.pp
@@ -190,6 +190,8 @@ class ironic::bifrost (
   $ipmi_bridging                  = 'no',
 ) {
 
+  include ::ironic::deps
+
   vcsrepo { $git_dest_repo_folder:
     ensure   => $ensure,
     provider => git,
diff --git a/manifests/client.pp b/manifests/client.pp
index 71570e98..7bc34d37 100644
--- a/manifests/client.pp
+++ b/manifests/client.pp
@@ -30,12 +30,13 @@ class ironic::client (
   $package_ensure = present
 ) {
 
+  include ::ironic::deps
   include ::ironic::params
 
   package { 'python-ironicclient':
     ensure => $package_ensure,
     name   => $::ironic::params::client_package,
-    tag    => 'openstack',
+    tag    => ['openstack', 'ironic-support-package'],
   }
 
 }
diff --git a/manifests/conductor.pp b/manifests/conductor.pp
index 725c5282..15cfca2b 100644
--- a/manifests/conductor.pp
+++ b/manifests/conductor.pp
@@ -127,11 +127,10 @@ class ironic::conductor (
   $configdrive_swift_container          = $::os_service_default,
 ) {
 
+  include ::ironic::deps
   include ::ironic::params
   include ::ironic::drivers::deploy
 
-  Ironic_config<||> ~> Service['ironic-conductor']
-
   $enabled_drivers_real = pick($::ironic::enabled_drivers, $enabled_drivers)
 
   validate_array($enabled_drivers_real)
@@ -200,7 +199,6 @@ class ironic::conductor (
 
   # Install package
   if $::ironic::params::conductor_package {
-    Package<| tag == 'ironic-package' |> -> Service['ironic-conductor']
     package { 'ironic-conductor':
       ensure => $package_ensure,
       name   => $::ironic::params::conductor_package,
diff --git a/manifests/config.pp b/manifests/config.pp
index 7a1569ec..d20bff7b 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -28,6 +28,7 @@ class ironic::config (
   $ironic_api_paste_ini = {},
 ) {
 
+  include ::ironic::deps
   validate_hash($ironic_config)
   validate_hash($ironic_api_paste_ini)
 
diff --git a/manifests/cors.pp b/manifests/cors.pp
index 8100716a..8fa855ca 100644
--- a/manifests/cors.pp
+++ b/manifests/cors.pp
@@ -45,6 +45,8 @@ class ironic::cors (
   $allow_headers     = $::os_service_default,
 ) {
 
+  include ::ironic::deps
+
   oslo::cors { 'ironic_config':
     allowed_origin    => $allowed_origin,
     allow_credentials => $allow_credentials,
diff --git a/manifests/db.pp b/manifests/db.pp
index fd16bd4b..bdccdbbf 100644
--- a/manifests/db.pp
+++ b/manifests/db.pp
@@ -48,6 +48,7 @@ class ironic::db (
   $database_max_overflow   = $::os_service_default,
   $database_db_max_retries = $::os_service_default,
 ) {
+  include ::ironic::deps
 
   # NOTE(spredzy): In order to keep backward compatibility we rely on the pick function
   # to use ironic::<myparam> if ironic::db::<myparam> isn't specified.
diff --git a/manifests/db/inspector_sync.pp b/manifests/db/inspector_sync.pp
index d09decf4..4b15e6f8 100644
--- a/manifests/db/inspector_sync.pp
+++ b/manifests/db/inspector_sync.pp
@@ -3,19 +3,20 @@
 #
 class ironic::db::inspector_sync {
 
+  include ::ironic::deps
   include ::ironic::params
 
-  Package<| tag == 'ironic-inspector-package' |> ~> Exec['ironic-inspector-dbsync']
-  Exec['ironic-inspector-dbsync'] ~> Service <| tag == 'ironic-inspector-service' |>
-
-  Ironic_inspector_config<||> -> Exec['ironic-inspector-dbsync']
-  Ironic_inspector_config<| title == 'database/connection' |> ~> Exec['ironic-inspector-dbsync']
-
   exec { 'ironic-inspector-dbsync':
     command     => $::ironic::params::inspector_dbsync_command,
     path        => '/usr/bin',
     user        => 'ironic-inspector',
     refreshonly => true,
     logoutput   => on_failure,
+    subscribe   => [
+      Anchor['ironic-inspector::install::end'],
+      Anchor['ironic-inspector::config::end'],
+      Anchor['ironic-inspector::dbsync::begin']
+    ],
+    notify      => Anchor['ironic-inspector::dbsync::end'],
   }
 }
diff --git a/manifests/db/mysql.pp b/manifests/db/mysql.pp
index e9b685b4..1f7404d3 100644
--- a/manifests/db/mysql.pp
+++ b/manifests/db/mysql.pp
@@ -54,6 +54,8 @@ class ironic::db::mysql (
   $collate       = 'utf8_general_ci',
 ) {
 
+  include ::ironic::deps
+
   ::openstacklib::db::mysql { 'ironic':
     user          => $user,
     password_hash => mysql_password($password),
@@ -64,6 +66,7 @@ class ironic::db::mysql (
     allowed_hosts => $allowed_hosts,
   }
 
-  ::Openstacklib::Db::Mysql['ironic'] ~> Exec<| title == 'ironic-dbsync' |>
-
+  Anchor['ironic::db::begin']
+  ~> Class['ironic::db::mysql']
+  ~> Anchor['ironic::db::end']
 }
diff --git a/manifests/db/postgresql.pp b/manifests/db/postgresql.pp
index 7fe7bb25..ce929d83 100644
--- a/manifests/db/postgresql.pp
+++ b/manifests/db/postgresql.pp
@@ -32,7 +32,7 @@ class ironic::db::postgresql(
   $privileges = 'ALL',
 ) {
 
-  Class['ironic::db::postgresql'] -> Service<| title == 'ironic' |>
+  include ::ironic::deps
 
   ::openstacklib::db::postgresql { 'ironic':
     password_hash => postgresql_password($user, $password),
@@ -42,6 +42,7 @@ class ironic::db::postgresql(
     privileges    => $privileges,
   }
 
-  ::Openstacklib::Db::Postgresql['ironic'] ~> Exec<| title == 'ironic-dbsync' |>
-
+  Anchor['ironic::db::begin']
+  ~> Class['ironic::db::postgresql']
+  ~> Anchor['ironic::db::end']
 }
diff --git a/manifests/db/sync.pp b/manifests/db/sync.pp
index 8fec73b9..ac5375e2 100644
--- a/manifests/db/sync.pp
+++ b/manifests/db/sync.pp
@@ -12,14 +12,9 @@ class ironic::db::sync(
   $extra_params  = undef,
 ) {
 
+  include ::ironic::deps
   include ::ironic::params
 
-  Package<| tag == 'ironic-package' |> ~> Exec['ironic-dbsync']
-  Exec['ironic-dbsync'] ~> Service <| tag == 'ironic-service' |>
-
-  Ironic_config<||> -> Exec['ironic-dbsync']
-  Ironic_config<| title == 'database/connection' |> ~> Exec['ironic-dbsync']
-
   exec { 'ironic-dbsync':
     command     => "${::ironic::params::dbsync_command} ${extra_params}",
     path        => '/usr/bin',
@@ -31,5 +26,11 @@ class ironic::db::sync(
     user        => 'root',
     refreshonly => true,
     logoutput   => on_failure,
+    subscribe   => [
+      Anchor['ironic::install::end'],
+      Anchor['ironic::config::end'],
+      Anchor['ironic::dbsync::begin']
+    ],
+    notify      => Anchor['ironic::dbsync::end'],
   }
 }
diff --git a/manifests/deps.pp b/manifests/deps.pp
new file mode 100644
index 00000000..68dffdf9
--- /dev/null
+++ b/manifests/deps.pp
@@ -0,0 +1,72 @@
+# == Class: ironic::deps
+#
+#  ironic anchors and dependency management
+#
+class ironic::deps {
+  # Setup anchors for install, config and service phases of the module.  These
+  # anchors allow external modules to hook the begin and end of any of these
+  # phases.  Package or service management can also be replaced by ensuring the
+  # package is absent or turning off service management and having the
+  # replacement depend on the appropriate anchors.  When applicable, end tags
+  # should be notified so that subscribers can determine if installation,
+  # config or service state changed and act on that if needed.
+  anchor { 'ironic::install::begin': }
+  -> Package<| tag == 'ironic-package'|>
+  ~> anchor { 'ironic::install::end': }
+  -> anchor { 'ironic::config::begin': }
+  -> Ironic_config<||>
+  ~> anchor { 'ironic::config::end': }
+  -> anchor { 'ironic::db::begin': }
+  -> anchor { 'ironic::db::end': }
+  ~> anchor { 'ironic::dbsync::begin': }
+  -> anchor { 'ironic::dbsync::end': }
+  ~> anchor { 'ironic::service::begin': }
+  ~> Service<| tag == 'ironic-service' |>
+  ~> anchor { 'ironic::service::end': }
+
+  # paste-api.ini config should occur in the config block also.
+  Anchor['ironic::config::begin']
+  -> Ironic_api_paste_ini<||>
+  ~> Anchor['ironic::config::end']
+
+  # ironic-inspector is supported by this module.  This service uses a
+  # specific conf file and uses it's own config provider. Split out install
+  # and configure of this service so that other services are not affected.
+  anchor { 'ironic-inspector::install::begin': }
+  -> Package<| tag == 'ironic-inspector-package'|>
+  ~> anchor { 'ironic-inspector::install::end': }
+  -> anchor { 'ironic-inspector::config::begin': }
+  -> Ironic_inspector_config<||>
+  ~> anchor { 'ironic-inspector::config::end': }
+  -> anchor { 'ironic-inspector::dbsync::begin': }
+  -> anchor { 'ironic-inspector::dbsync::end': }
+  ~> anchor { 'ironic-inspector::service::begin': }
+  ~> Service<| tag == 'ironic-inspector-service' |>
+  ~> Service<| tag == 'ironic-inspector-dnsmasq-service' |>
+  ~> anchor { 'ironic-inspector::service::end': }
+
+  Anchor['ironic::db::end']
+  -> Anchor['ironic-inspector::dbsync::begin']
+
+  # Support packages need to be installed in the install phase, but we don't
+  # put them in the chain above because we don't want any false dependencies
+  # between packages with the ironic-package tag and the ironic-support-package
+  # tag.  Note: the package resources here will have a 'before' relationshop on
+  # the ironic::install::end anchor.  The line between ironic-support-package and
+  # ironic-package should be whether or not ironic services would need to be
+  # restarted if the package state was changed.
+  Anchor['ironic::install::begin']
+  -> Package<| tag == 'ironic-support-package'|>
+  -> Anchor['ironic::install::end']
+
+  # ironic-inspector depends on support packages in pxe.pp
+  Anchor['ironic-inspector::install::begin']
+  -> Package<| tag == 'ironic-support-package'|>
+  -> Anchor['ironic-inspector::install::end']
+
+# Installation or config changes will always restart services.
+  Anchor['ironic::install::end'] ~> Anchor['ironic::service::begin']
+  Anchor['ironic::config::end']  ~> Anchor['ironic::service::begin']
+  Anchor['ironic-inspector::install::end'] ~> Anchor['ironic-inspector::service::begin']
+  Anchor['ironic-inspector::config::end']  ~> Anchor['ironic-inspector::service::begin']
+}
diff --git a/manifests/drivers/agent.pp b/manifests/drivers/agent.pp
index 21f70fa8..25c85678 100644
--- a/manifests/drivers/agent.pp
+++ b/manifests/drivers/agent.pp
@@ -65,6 +65,8 @@ class ironic::drivers::agent (
   $deploy_logs_swift_days_to_expire             = $::os_service_default,
 ) {
 
+  include ::ironic::deps
+
   # Configure ironic.conf
   ironic_config {
     'agent/stream_raw_images':                          value => $stream_raw_images;
diff --git a/manifests/drivers/ipmi.pp b/manifests/drivers/ipmi.pp
index 2baf03ee..7a9b4559 100644
--- a/manifests/drivers/ipmi.pp
+++ b/manifests/drivers/ipmi.pp
@@ -29,6 +29,8 @@ class ironic::drivers::ipmi (
   $retry_timeout = '10'
 ) {
 
+  include ::ironic::deps
+
   # Configure ironic.conf
   ironic_config {
     'ipmi/retry_timeout': value => $retry_timeout;
diff --git a/manifests/drivers/pxe.pp b/manifests/drivers/pxe.pp
index 65f4a3f3..dba94d08 100644
--- a/manifests/drivers/pxe.pp
+++ b/manifests/drivers/pxe.pp
@@ -113,6 +113,7 @@ class ironic::drivers::pxe (
   $pxe_deploy_timeout       = undef,
 ) {
 
+  include ::ironic::deps
   include ::ironic::pxe::common
   $tftp_root_real    = pick($::ironic::pxe::common::tftp_root, $tftp_root)
   $ipxe_timeout_real = pick($::ironic::pxe::common::ipxe_timeout, $ipxe_timeout)
diff --git a/manifests/drivers/ssh.pp b/manifests/drivers/ssh.pp
index 88fdc491..6a0a408e 100644
--- a/manifests/drivers/ssh.pp
+++ b/manifests/drivers/ssh.pp
@@ -26,6 +26,8 @@ class ironic::drivers::ssh (
   $libvirt_uri = $::os_service_default,
 ) {
 
+  include ::ironic::deps
+
   # Configure ironic.conf
   ironic_config {
     'ssh/libvirt_uri': value => $libvirt_uri;
diff --git a/manifests/init.pp b/manifests/init.pp
index c180fef3..cf87f855 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -360,6 +360,7 @@ class ironic (
   $enabled_drivers                    = undef,
 ) {
 
+  include ::ironic::deps
   include ::ironic::logging
   include ::ironic::db
   include ::ironic::params
@@ -380,14 +381,12 @@ class ironic (
     name   => $::ironic::params::common_package_name,
     tag    => ['openstack', 'ironic-package'],
   }
-  Package['ironic-common'] ~> Service<| tag == 'ironic-service' |>
 
   package { 'ironic-lib':
     ensure => $package_ensure,
     name   => $::ironic::params::lib_package_name,
     tag    => ['openstack', 'ironic-package'],
   }
-  Package['ironic-lib'] ~> Service<| tag == 'ironic-service' |>
 
   resources { 'ironic_config':
     purge => $purge_config,
diff --git a/manifests/inspector.pp b/manifests/inspector.pp
index cebb1c8a..f947b03b 100644
--- a/manifests/inspector.pp
+++ b/manifests/inspector.pp
@@ -225,6 +225,7 @@ class ironic::inspector (
   $auth_uri                       = undef,
 ) {
 
+  include ::ironic::deps
   include ::ironic::params
   include ::ironic::pxe::common
   include ::ironic::inspector::logging
@@ -261,18 +262,16 @@ class ironic::inspector (
   $http_port_real = pick($::ironic::pxe::common::http_port, $http_port)
   $ipxe_timeout_real     = pick($::ironic::pxe::common::ipxe_timeout, $ipxe_timeout)
 
-  Ironic_inspector_config<||> ~> Service['ironic-inspector']
-
   file { '/etc/ironic-inspector/inspector.conf':
     ensure  => 'present',
-    require => Package['ironic-inspector'],
+    require => Anchor['ironic-inspector::config::begin'],
   }
 
   if $pxe_transfer_protocol == 'tftp' {
     file { '/etc/ironic-inspector/dnsmasq.conf':
       ensure  => 'present',
       content => template('ironic/inspector_dnsmasq_tftp.erb'),
-      require => Package['ironic-inspector'],
+      require => Anchor['ironic-inspector::config::begin'],
     }
     file { "${tftp_root_real}/pxelinux.cfg/default":
       ensure  => 'present',
@@ -280,7 +279,7 @@ class ironic::inspector (
       owner   => 'ironic-inspector',
       group   => 'ironic-inspector',
       content => template('ironic/inspector_pxelinux_cfg.erb'),
-      require => Package['ironic-inspector'],
+      require => Anchor['ironic-inspector::config::begin'],
     }
   }
 
@@ -288,7 +287,7 @@ class ironic::inspector (
     file { '/etc/ironic-inspector/dnsmasq.conf':
       ensure  => 'present',
       content => template('ironic/inspector_dnsmasq_http.erb'),
-      require => Package['ironic-inspector'],
+      require => Anchor['ironic-inspector::config::begin'],
     }
     file { "${http_root_real}/inspector.ipxe":
       ensure  => 'present',
@@ -296,7 +295,7 @@ class ironic::inspector (
       owner   => 'ironic-inspector',
       group   => 'ironic-inspector',
       content => template('ironic/inspector_ipxe.erb'),
-      require => Package['ironic-inspector'],
+      require => Anchor['ironic-inspector::config::begin'],
     }
   }
 
@@ -330,8 +329,6 @@ class ironic::inspector (
 
   # Install package
   if $::ironic::params::inspector_package {
-    Package['ironic-inspector'] -> Service['ironic-inspector']
-    Package['ironic-inspector'] -> Service['ironic-inspector-dnsmasq']
     package { 'ironic-inspector':
       ensure => $package_ensure,
       name   => $::ironic::params::inspector_package,
@@ -358,7 +355,6 @@ class ironic::inspector (
     tag       => 'ironic-inspector-service',
   }
 
-  Service['ironic-inspector'] -> Service['ironic-inspector-dnsmasq']
   service { 'ironic-inspector-dnsmasq':
     ensure    => $ensure,
     name      => $::ironic::params::inspector_dnsmasq_service,
diff --git a/manifests/inspector/authtoken.pp b/manifests/inspector/authtoken.pp
index 91895df6..e6e0340e 100644
--- a/manifests/inspector/authtoken.pp
+++ b/manifests/inspector/authtoken.pp
@@ -228,6 +228,8 @@ class ironic::inspector::authtoken(
   $token_cache_time               = $::os_service_default,
 ) {
 
+  include ::ironic::deps
+
   if is_service_default($password) and ! $::ironic::inspector::admin_password {
     fail('Please set password for Ironic Inspector service user')
   }
diff --git a/manifests/inspector/logging.pp b/manifests/inspector/logging.pp
index 50fb7834..1254fe05 100644
--- a/manifests/inspector/logging.pp
+++ b/manifests/inspector/logging.pp
@@ -112,6 +112,8 @@ class ironic::inspector::logging(
   $verbose                       = undef,
 ) {
 
+  include ::ironic::deps
+
   $debug_real = pick($::ironic::inspector::debug,$debug)
   if is_service_default($default_log_levels) {
     $default_log_levels_real = $default_log_levels
diff --git a/manifests/keystone/auth.pp b/manifests/keystone/auth.pp
index b6fbc4f7..042b25a2 100644
--- a/manifests/keystone/auth.pp
+++ b/manifests/keystone/auth.pp
@@ -95,6 +95,8 @@ class ironic::keystone::auth (
   $internal_url        = 'http://127.0.0.1:6385',
 ) {
 
+  include ::ironic::deps
+
   if $configure_user_role {
     Keystone_user_role["${auth_name}@${tenant}"] ~> Service <| name == 'ironic-server' |>
   }
diff --git a/manifests/keystone/auth_inspector.pp b/manifests/keystone/auth_inspector.pp
index 2f98daac..80bf3110 100644
--- a/manifests/keystone/auth_inspector.pp
+++ b/manifests/keystone/auth_inspector.pp
@@ -95,6 +95,8 @@ class ironic::keystone::auth_inspector (
   $internal_url        = 'http://127.0.0.1:5050',
 ) {
 
+  include ::ironic::deps
+
   $real_service_name = pick($service_name, $auth_name)
 
   if $configure_user_role {
diff --git a/manifests/logging.pp b/manifests/logging.pp
index f6ea7ba0..f6f21ce8 100644
--- a/manifests/logging.pp
+++ b/manifests/logging.pp
@@ -116,6 +116,8 @@ class ironic::logging(
   $verbose                       = undef,
 ) {
 
+  include ::ironic::deps
+
   # NOTE(spredzy): In order to keep backward compatibility we rely on the pick function
   # to use ironic::<myparam> first then ironic::logging::<myparam>.
   $use_syslog_real = pick($::ironic::use_syslog,$use_syslog)
diff --git a/manifests/policy.pp b/manifests/policy.pp
index 0a477569..9b982ddf 100644
--- a/manifests/policy.pp
+++ b/manifests/policy.pp
@@ -18,6 +18,8 @@ class ironic::policy (
   $policy_path = '/etc/ironic/policy.json',
 ) {
 
+  include ::ironic::deps
+
   validate_hash($policies)
 
   Openstacklib::Policy::Base {
diff --git a/manifests/pxe.pp b/manifests/pxe.pp
index 00eb59df..9bf21f0e 100644
--- a/manifests/pxe.pp
+++ b/manifests/pxe.pp
@@ -51,6 +51,7 @@ class ironic::pxe (
   $syslinux_files = $::ironic::params::syslinux_files,
 ) inherits ::ironic::params {
 
+  include ::ironic::deps
   include ::ironic::pxe::common
 
   $tftp_root_real = pick($::ironic::pxe::common::tftp_root, $tftp_root)
@@ -62,7 +63,8 @@ class ironic::pxe (
     seltype => 'tftpdir_t',
     owner   => 'ironic',
     group   => 'ironic',
-    require => Package['ironic-common'],
+    require => Anchor['ironic::config::begin'],
+    before  => Anchor['ironic::config::end'],
   }
 
   file { "${tftp_root_real}/pxelinux.cfg":
@@ -78,13 +80,14 @@ class ironic::pxe (
     seltype => 'httpd_sys_content_t',
     owner   => 'ironic',
     group   => 'ironic',
-    require => Package['ironic-common'],
+    require => Anchor['ironic::config::begin'],
+    before  => Anchor['ironic::config::end'],
   }
 
   ensure_resource( 'package', 'tftp-server', {
     'ensure' => $package_ensure,
     'name'   => $::ironic::params::tftpd_package,
-    'tag'    => ['openstack', 'ironic-ipxe'],
+    'tag'    => ['openstack', 'ironic-ipxe', 'ironic-support-package'],
   })
 
   $options = "--map-file ${tftp_root_real}/map-file"
@@ -100,7 +103,7 @@ class ironic::pxe (
     flags       => 'IPv4',
     per_source  => '11',
     wait        => 'yes',
-    require     => Package['tftp-server'],
+    subscribe   => Anchor['ironic::install::end'],
   }
 
   file { "${tftp_root_real}/map-file":
@@ -123,7 +126,7 @@ class ironic::pxe (
   ensure_resource( 'package', 'ipxe', {
     ensure => $package_ensure,
     name   => $::ironic::params::ipxe_package,
-    tag    => ['openstack', 'ironic-ipxe'],
+    tag    => ['openstack', 'ironic-ipxe', 'ironic-support-package'],
   })
 
   file { "${tftp_root_real}/undionly.kpxe":
diff --git a/manifests/pxe/common.pp b/manifests/pxe/common.pp
index 6cb64968..d5007792 100644
--- a/manifests/pxe/common.pp
+++ b/manifests/pxe/common.pp
@@ -43,4 +43,5 @@ class ironic::pxe::common (
   $http_port        = undef,
   $ipxe_timeout     = undef,
 ) {
+  include ::ironic::deps
 }
diff --git a/manifests/pxe/tftpboot_file.pp b/manifests/pxe/tftpboot_file.pp
index 5d10d386..4e5607f3 100644
--- a/manifests/pxe/tftpboot_file.pp
+++ b/manifests/pxe/tftpboot_file.pp
@@ -32,6 +32,8 @@ define ironic::pxe::tftpboot_file (
   $destination_directory,
   $file = $title,
 ) {
+  include ::ironic::deps
+
   file {"${destination_directory}/${file}":
     ensure  => 'present',
     seltype => 'tftpdir_t',
diff --git a/manifests/wsgi/apache.pp b/manifests/wsgi/apache.pp
index d2308eba..bb9a5834 100644
--- a/manifests/wsgi/apache.pp
+++ b/manifests/wsgi/apache.pp
@@ -91,6 +91,7 @@ class ironic::wsgi::apache (
   $priority      = '10',
 ) {
 
+  include ::ironic::deps
   include ::ironic::params
   include ::apache
   include ::apache::mod::wsgi
diff --git a/releasenotes/notes/external-hooks-ebebbb5d72f14f9f.yaml b/releasenotes/notes/external-hooks-ebebbb5d72f14f9f.yaml
new file mode 100644
index 00000000..0ac7ba9d
--- /dev/null
+++ b/releasenotes/notes/external-hooks-ebebbb5d72f14f9f.yaml
@@ -0,0 +1,8 @@
+---
+features:
+  - Add hooks for external install & svc management
+    This adds defined anchor points for external modules to hook into the
+    software install, config and service dependency chain.  This allows
+    external modules to manage software installation (virtualenv,
+    containers, etc) and service management (pacemaker) without needing rely
+    on resources that may change or be renamed.
diff --git a/spec/classes/ironic_api_spec.rb b/spec/classes/ironic_api_spec.rb
index 48f4613a..62a7a378 100644
--- a/spec/classes/ironic_api_spec.rb
+++ b/spec/classes/ironic_api_spec.rb
@@ -51,7 +51,8 @@ describe 'ironic::api' do
           :ensure => p[:package_ensure],
           :tag    => ['openstack', 'ironic-package'],
         )
-        is_expected.to contain_package('ironic-api').with_before(/Service\[ironic-api\]/)
+        is_expected.to contain_package('ironic-api').that_requires('Anchor[ironic::install::begin]')
+        is_expected.to contain_package('ironic-api').that_notifies('Anchor[ironic::install::end]')
       end
     end
 
diff --git a/spec/classes/ironic_conductor_spec.rb b/spec/classes/ironic_conductor_spec.rb
index 2b71fc85..6abc108d 100644
--- a/spec/classes/ironic_conductor_spec.rb
+++ b/spec/classes/ironic_conductor_spec.rb
@@ -49,7 +49,8 @@ describe 'ironic::conductor' do
           :ensure => p[:package_ensure],
           :tag    => ['openstack', 'ironic-package'],
         )
-        is_expected.to contain_package('ironic-conductor').with_before(/Service\[ironic-conductor\]/)
+        is_expected.to contain_package('ironic-conductor').that_requires('Anchor[ironic::install::begin]')
+        is_expected.to contain_package('ironic-conductor').that_notifies('Anchor[ironic::install::end]')
       end
     end
 
diff --git a/spec/classes/ironic_inspector_spec.rb b/spec/classes/ironic_inspector_spec.rb
index 2b68a7d2..136b9fbb 100644
--- a/spec/classes/ironic_inspector_spec.rb
+++ b/spec/classes/ironic_inspector_spec.rb
@@ -72,7 +72,8 @@ describe 'ironic::inspector' do
           :ensure => p[:package_ensure],
           :tag    => ['openstack', 'ironic-inspector-package'],
         )
-        is_expected.to contain_package('ironic-inspector').with_before(/Service\[ironic-inspector\]/)
+        is_expected.to contain_package('ironic-inspector').that_requires('Anchor[ironic-inspector::install::begin]')
+        is_expected.to contain_package('ironic-inspector').that_notifies('Anchor[ironic-inspector::install::end]')
       end
     end
 
@@ -118,10 +119,16 @@ describe 'ironic::inspector' do
       is_expected.to contain_ironic_inspector_config('processing/processing_hooks').with_value('$default_processing_hooks')
     end
 
+    it 'should contain file /etc/ironic-inspector/inspector.conf' do
+      is_expected.to contain_file('/etc/ironic-inspector/inspector.conf').with(
+        'ensure'  => 'present',
+        'require' => 'Anchor[ironic-inspector::config::begin]',
+      )
+    end
     it 'should contain file /etc/ironic-inspector/dnsmasq.conf' do
       is_expected.to contain_file('/etc/ironic-inspector/dnsmasq.conf').with(
         'ensure'  => 'present',
-        'require' => 'Package[ironic-inspector]',
+        'require' => 'Anchor[ironic-inspector::config::begin]',
         'content' => /pxelinux/,
       )
     end
@@ -131,7 +138,7 @@ describe 'ironic::inspector' do
         'group'   => 'ironic-inspector',
         'seltype' => 'tftpdir_t',
         'ensure'  => 'present',
-        'require' => 'Package[ironic-inspector]',
+        'require' => 'Anchor[ironic-inspector::config::begin]',
         'content' => /default/,
       )
       is_expected.to contain_file('/tftpboot/pxelinux.cfg/default').with_content(
@@ -176,7 +183,7 @@ describe 'ironic::inspector' do
       it 'should contain file /etc/ironic-inspector/dnsmasq.conf' do
         is_expected.to contain_file('/etc/ironic-inspector/dnsmasq.conf').with(
           'ensure'  => 'present',
-          'require' => 'Package[ironic-inspector]',
+          'require' => 'Anchor[ironic-inspector::config::begin]',
           'content' => /ipxe/,
         )
         is_expected.to contain_file('/etc/ironic-inspector/dnsmasq.conf').with_content(
@@ -187,9 +194,9 @@ describe 'ironic::inspector' do
         is_expected.to contain_file('/var/www/httpboot/inspector.ipxe').with(
           'owner'   => 'ironic-inspector',
           'group'   => 'ironic-inspector',
-          'require' => 'Package[ironic-inspector]',
           'seltype' => 'httpd_sys_content_t',
           'ensure'  => 'present',
+          'require' => 'Anchor[ironic-inspector::config::begin]',
           'content' => /ipxe/,
         )
         is_expected.to contain_file('/var/www/httpboot/inspector.ipxe').with_content(
diff --git a/spec/classes/ironic_pxe_spec.rb b/spec/classes/ironic_pxe_spec.rb
index 55e63108..41325487 100644
--- a/spec/classes/ironic_pxe_spec.rb
+++ b/spec/classes/ironic_pxe_spec.rb
@@ -23,7 +23,7 @@ describe 'ironic::pxe' do
       is_expected.to contain_file('/tftpboot').with(
         'owner'   => 'ironic',
         'group'   => 'ironic',
-        'require' => 'Package[ironic-common]',
+        'require' => 'Anchor[ironic::config::begin]',
         'ensure'  => 'directory',
         'seltype' => 'tftpdir_t',
       )
@@ -43,7 +43,7 @@ describe 'ironic::pxe' do
       is_expected.to contain_file('/httpboot').with(
         'owner'   => 'ironic',
         'group'   => 'ironic',
-        'require' => 'Package[ironic-common]',
+        'require' => 'Anchor[ironic::config::begin]',
         'ensure'  => 'directory',
         'seltype' => 'httpd_sys_content_t',
       )
@@ -67,7 +67,7 @@ describe 'ironic::pxe' do
        'flags'       => 'IPv4',
        'per_source'  => '11',
        'wait'        => 'yes',
-       'require'     => 'Package[tftp-server]',
+       'subscribe'   => 'Anchor[ironic::install::end]',
       )
     end
 
@@ -84,7 +84,7 @@ describe 'ironic::pxe' do
         is_expected.to contain_file('/var/www/httpboot').with(
           'owner'   => 'ironic',
           'group'   => 'ironic',
-          'require' => 'Package[ironic-common]',
+          'require' => 'Anchor[ironic::config::begin]',
           'ensure'  => 'directory',
           'seltype' => 'httpd_sys_content_t',
         )
@@ -94,7 +94,7 @@ describe 'ironic::pxe' do
         is_expected.to contain_file('/var/lib/tftpboot').with(
           'owner'   => 'ironic',
           'group'   => 'ironic',
-          'require' => 'Package[ironic-common]',
+          'require' => 'Anchor[ironic::config::begin]',
           'ensure'  => 'directory',
           'seltype' => 'tftpdir_t',
         )