diff --git a/manifests/auth_file.pp b/manifests/auth_file.pp
index 78d297ca..ec9d1f99 100644
--- a/manifests/auth_file.pp
+++ b/manifests/auth_file.pp
@@ -25,11 +25,14 @@ class swift::auth_file (
   $auth_url        = 'http://127.0.0.1:5000/v2.0/'
 ) {
 
+  include ::swift::deps
+
   file { '/root/swiftrc':
     ensure  => file,
     owner   => 'root',
     group   => 'root',
     mode    => '0600',
+    tag     => 'swift-file',
     content =>
   "
   export ST_USER=${admin_tenant}:${admin_user}
diff --git a/manifests/bench.pp b/manifests/bench.pp
index d390c595..b9f20405 100644
--- a/manifests/bench.pp
+++ b/manifests/bench.pp
@@ -84,6 +84,8 @@ class swift::bench (
   $delete            = 'yes',
 ){
 
+  include ::swift::deps
+
   swift_bench_config {
     'bench/auth':              value => $auth_url;
     'bench/user':              value => $swift_user;
diff --git a/manifests/client.pp b/manifests/client.pp
index 088d9731..b52af79d 100644
--- a/manifests/client.pp
+++ b/manifests/client.pp
@@ -12,12 +12,13 @@ class swift::client (
   $ensure = 'present'
 ) {
 
+  include ::swift::deps
   include ::swift::params
 
   package { 'swiftclient':
     ensure => $ensure,
     name   => $::swift::params::client_package,
-    tag    => 'openstack',
+    tag    => ['openstack','swift-support-package']
   }
 
 }
diff --git a/manifests/config.pp b/manifests/config.pp
index 9f8a4fe0..50f2b22e 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -24,6 +24,7 @@ class swift::config (
   $swift_config        = {},
 ) {
 
+  include ::swift::deps
   validate_hash($swift_config)
 
   create_resources('swift_config', $swift_config)
diff --git a/manifests/deps.pp b/manifests/deps.pp
new file mode 100644
index 00000000..673d007d
--- /dev/null
+++ b/manifests/deps.pp
@@ -0,0 +1,59 @@
+# == Class: swift::deps
+#
+#  swift anchors and dependency management
+#
+class swift::deps {
+  # Setup anchors for install, config and service phases of the module.  These
+  # anchors allow external modules to hook the begin and end of any of these
+  # phases.  Package or service management can also be replaced by ensuring the
+  # package is absent or turning off service management and having the
+  # replacement depend on the appropriate anchors.  When applicable, end tags
+  # should be notified so that subscribers can determine if installation,
+  # config or service state changed and act on that if needed.
+  anchor { 'swift::install::begin': }
+  -> Package<| tag == 'swift-package'|>
+  ~> anchor { 'swift::install::end': }
+  -> anchor { 'swift::config::begin': }
+  -> Swift_config<||>
+  ~> anchor { 'swift::config::end': }
+  ~> anchor { 'swift::service::begin': }
+  ~> Service<| tag == 'swift-service' |>
+  ~> anchor { 'swift::service::end': }
+  ~> Swift_dispersion_config<||>
+
+  Anchor['swift::config::begin']
+  -> Swift_proxy_config<||>
+  ~> Anchor['swift::config::end']
+
+  Anchor['swift::config::begin']
+  -> Swift_object_config<||>
+  ~> Anchor['swift::config::end']
+
+  Anchor['swift::config::begin']
+  -> Swift_container_config<||>
+  ~> Anchor['swift::config::end']
+
+  Anchor['swift::config::begin']
+  -> Swift_account_config<||>
+  ~> Anchor['swift::config::end']
+
+  Anchor['swift::config::begin']
+  -> File<| tag == 'swift-file' |>
+  ~> Anchor['swift::config::end']
+
+  # Support packages need to be installed in the install phase, but we don't
+  # put them in the chain above because we don't want any false dependencies
+  # between packages with the swift-package tag and the swift-support-package
+  # tag.  Note: the package resources here will have a 'before' relationshop on
+  # the swift::install::end anchor.  The line between swift-support-package and
+  # swift-package should be whether or not swift services would need to be
+  # restarted if the package state was changed.
+  Anchor['swift::install::begin']
+  -> Package<| tag == 'swift-support-package'|>
+  -> Anchor['swift::install::end']
+
+  # Installation or config changes will always restart services.
+  Anchor['swift::install::end'] ~> Anchor['swift::service::begin']
+  Anchor['swift::config::end']  ~> Anchor['swift::service::begin']
+
+}
diff --git a/manifests/dispersion.pp b/manifests/dispersion.pp
index 36e9242b..3e1a899e 100644
--- a/manifests/dispersion.pp
+++ b/manifests/dispersion.pp
@@ -80,15 +80,15 @@ class swift::dispersion (
   $dump_json     = 'no'
 ) {
 
+  include ::swift::deps
   include ::swift::params
 
   Swift_dispersion_config<||> ~> Exec['swift-dispersion-populate']
 
   file { '/etc/swift/dispersion.conf':
-    ensure  => file,
-    owner   => 'swift',
-    group   => 'swift',
-    require => Package['swift'],
+    ensure => file,
+    owner  => 'swift',
+    group  => 'swift',
   }
 
   swift_dispersion_config {
diff --git a/manifests/init.pp b/manifests/init.pp
index cffe2ee9..662f8a19 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -62,6 +62,7 @@ class swift(
   $swift_hash_suffix      = undef,
 ) {
 
+  include ::swift::deps
   include ::swift::params
 
   if ($swift_hash_suffix == undef and $swift_hash_path_suffix == undef) {
@@ -85,7 +86,11 @@ class swift(
     ensure => $client_package_ensure;
   }
 
-  File { owner => 'swift', group => 'swift', require => Package['swift'] }
+  File {
+    owner   => 'swift',
+    group   => 'swift',
+    tag     => 'swift-file',
+  }
 
   file { '/etc/swift':
     ensure => directory,
diff --git a/manifests/keystone/auth.pp b/manifests/keystone/auth.pp
index 4b9ee423..516bc3af 100644
--- a/manifests/keystone/auth.pp
+++ b/manifests/keystone/auth.pp
@@ -183,6 +183,8 @@ class swift::keystone::auth(
   $admin_address          = undef,
 ) {
 
+  include ::swift::deps
+
   if $endpoint_prefix {
     warning('The endpoint_prefix parameter is deprecated, use public_url, internal_url and admin_url instead.')
   }
diff --git a/manifests/keystone/dispersion.pp b/manifests/keystone/dispersion.pp
index 1e1bcdc4..37ec651d 100644
--- a/manifests/keystone/dispersion.pp
+++ b/manifests/keystone/dispersion.pp
@@ -36,6 +36,8 @@ class swift::keystone::dispersion(
   $tenant    = 'services'
 ) {
 
+  include ::swift::deps
+
   keystone_user { $auth_user:
     ensure   => present,
     password => $auth_pass,
diff --git a/manifests/objectexpirer.pp b/manifests/objectexpirer.pp
index 0cd3d75d..27017256 100644
--- a/manifests/objectexpirer.pp
+++ b/manifests/objectexpirer.pp
@@ -81,6 +81,7 @@ class swift::objectexpirer(
   $service_provider              = $::swift::params::service_provider
 ) inherits ::swift::params {
 
+  include ::swift::deps
   Swift_config<| |> ~> Service['swift-object-expirer']
   Swift_object_expirer_config<||> ~> Service['swift-object-expirer']
 
diff --git a/manifests/proxy.pp b/manifests/proxy.pp
index 0e0292e2..fc070922 100644
--- a/manifests/proxy.pp
+++ b/manifests/proxy.pp
@@ -141,6 +141,7 @@ class swift::proxy(
   $service_provider          = $::swift::params::service_provider
 ) inherits ::swift::params {
 
+  include ::swift::deps
   Swift_config<| |> ~> Service['swift-proxy-server']
 
   validate_bool($account_autocreate)
diff --git a/manifests/proxy/account_quotas.pp b/manifests/proxy/account_quotas.pp
index d3a77c79..d921f15a 100644
--- a/manifests/proxy/account_quotas.pp
+++ b/manifests/proxy/account_quotas.pp
@@ -18,6 +18,9 @@
 # Configure Swift Account Quotas
 #
 class swift::proxy::account_quotas() {
+
+  include ::swift::deps
+
   concat::fragment { 'swift_account_quotas':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/account_quotas.conf.erb'),
diff --git a/manifests/proxy/authtoken.pp b/manifests/proxy/authtoken.pp
index 7e6cdb31..792d0b45 100644
--- a/manifests/proxy/authtoken.pp
+++ b/manifests/proxy/authtoken.pp
@@ -87,6 +87,8 @@ class swift::proxy::authtoken(
   $auth_admin_prefix   = false,
 ) {
 
+  include ::swift::deps
+
   if $auth_uri {
     $auth_uri_real = $auth_uri
   } else {
@@ -116,6 +118,8 @@ class swift::proxy::authtoken(
     owner                   => 'swift',
     group                   => 'swift',
     selinux_ignore_defaults => true,
+    require                 => Anchor['swift::config::begin'],
+    before                  => Anchor['swift::config::end'],
   }
 
   concat::fragment { 'swift_authtoken':
diff --git a/manifests/proxy/bulk.pp b/manifests/proxy/bulk.pp
index e5e1897d..a19c51bf 100644
--- a/manifests/proxy/bulk.pp
+++ b/manifests/proxy/bulk.pp
@@ -43,6 +43,9 @@ class swift::proxy::bulk(
   $max_deletes_per_request       = '10000',
   $yield_frequency               = '60',
 ) {
+
+  include ::swift::deps
+
   concat::fragment { 'swift_bulk':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/bulk.conf.erb'),
diff --git a/manifests/proxy/cache.pp b/manifests/proxy/cache.pp
index a4023f31..ba56d547 100644
--- a/manifests/proxy/cache.pp
+++ b/manifests/proxy/cache.pp
@@ -22,6 +22,8 @@ class swift::proxy::cache(
   $memcache_servers = ['127.0.0.1:11211']
 ) {
 
+  include ::swift::deps
+
   # require the memcached class if its on the same machine
   if grep(any2array($memcache_servers), '^127\.0\.0\.1') {
     Class['memcached'] -> Class['swift::proxy::cache']
diff --git a/manifests/proxy/catch_errors.pp b/manifests/proxy/catch_errors.pp
index c1f88fbc..50af8347 100644
--- a/manifests/proxy/catch_errors.pp
+++ b/manifests/proxy/catch_errors.pp
@@ -17,6 +17,8 @@
 #
 class swift::proxy::catch_errors() {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_catch_errors':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/catch_errors.conf.erb'),
diff --git a/manifests/proxy/ceilometer.pp b/manifests/proxy/ceilometer.pp
index c21b1a1f..993aa0ed 100644
--- a/manifests/proxy/ceilometer.pp
+++ b/manifests/proxy/ceilometer.pp
@@ -78,6 +78,8 @@ class swift::proxy::ceilometer(
   $group               = 'ceilometer',
 ) inherits swift {
 
+  include ::swift::deps
+
   if(is_array($rabbit_hosts)) {
     $rabbit_hosts_with_creds = prefix($rabbit_hosts, "${rabbit_user}:${rabbit_password}@")
   }
@@ -106,7 +108,7 @@ class swift::proxy::ceilometer(
 
   package { 'python-ceilometermiddleware':
     ensure => $ensure,
-    tag    => 'openstack',
+    tag    => ['openstack', 'swift-support-package'],
   }
 
 }
diff --git a/manifests/proxy/container_quotas.pp b/manifests/proxy/container_quotas.pp
index f423443a..38d43f1d 100644
--- a/manifests/proxy/container_quotas.pp
+++ b/manifests/proxy/container_quotas.pp
@@ -18,6 +18,9 @@
 # Configure Swift Container Quotas
 #
 class swift::proxy::container_quotas() {
+
+  include ::swift::deps
+
   concat::fragment { 'swift_container_quotas':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/container_quotas.conf.erb'),
diff --git a/manifests/proxy/crossdomain.pp b/manifests/proxy/crossdomain.pp
index 6530ded4..a2dac1f6 100644
--- a/manifests/proxy/crossdomain.pp
+++ b/manifests/proxy/crossdomain.pp
@@ -15,6 +15,8 @@ class swift::proxy::crossdomain (
   $cross_domain_policy = '<allow-access-from domain="*" secure="false" />',
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_crossdomain':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/crossdomain.conf.erb'),
diff --git a/manifests/proxy/dlo.pp b/manifests/proxy/dlo.pp
index ca14547a..b086efa2 100644
--- a/manifests/proxy/dlo.pp
+++ b/manifests/proxy/dlo.pp
@@ -34,6 +34,8 @@ class swift::proxy::dlo (
   $max_get_time                = '86400'
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_dlo':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/dlo.conf.erb'),
diff --git a/manifests/proxy/formpost.pp b/manifests/proxy/formpost.pp
index 597ef301..03a92dc0 100644
--- a/manifests/proxy/formpost.pp
+++ b/manifests/proxy/formpost.pp
@@ -17,6 +17,8 @@
 #
 class swift::proxy::formpost() {
 
+  include ::swift::deps
+
   concat::fragment { 'swift-proxy-formpost':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/formpost.conf.erb'),
diff --git a/manifests/proxy/gatekeeper.pp b/manifests/proxy/gatekeeper.pp
index 95d8237d..0bb5304b 100644
--- a/manifests/proxy/gatekeeper.pp
+++ b/manifests/proxy/gatekeeper.pp
@@ -43,6 +43,8 @@ class swift::proxy::gatekeeper(
   $log_address  = '/dev/log'
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_gatekeeper':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/gatekeeper.conf.erb'),
diff --git a/manifests/proxy/healthcheck.pp b/manifests/proxy/healthcheck.pp
index 6ab6da38..cf408c3c 100644
--- a/manifests/proxy/healthcheck.pp
+++ b/manifests/proxy/healthcheck.pp
@@ -15,6 +15,8 @@
 #
 class swift::proxy::healthcheck() {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_healthcheck':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/healthcheck.conf.erb'),
diff --git a/manifests/proxy/keystone.pp b/manifests/proxy/keystone.pp
index ecbfd69f..9517abdd 100644
--- a/manifests/proxy/keystone.pp
+++ b/manifests/proxy/keystone.pp
@@ -29,6 +29,8 @@ class swift::proxy::keystone(
   $reseller_prefix     = 'AUTH_'
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_keystone':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/keystone.conf.erb'),
diff --git a/manifests/proxy/proxy_logging.pp b/manifests/proxy/proxy_logging.pp
index d9d353a5..e3a8677b 100644
--- a/manifests/proxy/proxy_logging.pp
+++ b/manifests/proxy/proxy_logging.pp
@@ -7,6 +7,8 @@
 #
 class swift::proxy::proxy_logging {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_proxy-logging':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/proxy-logging.conf.erb'),
diff --git a/manifests/proxy/ratelimit.pp b/manifests/proxy/ratelimit.pp
index 7b465b34..87ba78d5 100644
--- a/manifests/proxy/ratelimit.pp
+++ b/manifests/proxy/ratelimit.pp
@@ -48,6 +48,8 @@ class swift::proxy::ratelimit(
   $account_ratelimit = 0
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_ratelimit':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/ratelimit.conf.erb'),
diff --git a/manifests/proxy/s3token.pp b/manifests/proxy/s3token.pp
index 8b5dff89..2392eb0b 100644
--- a/manifests/proxy/s3token.pp
+++ b/manifests/proxy/s3token.pp
@@ -34,6 +34,8 @@ class swift::proxy::s3token(
   $auth_protocol = 'http'
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_s3token':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/s3token.conf.erb'),
diff --git a/manifests/proxy/slo.pp b/manifests/proxy/slo.pp
index 20601be8..d8249bd8 100644
--- a/manifests/proxy/slo.pp
+++ b/manifests/proxy/slo.pp
@@ -49,6 +49,8 @@ class swift::proxy::slo (
   $max_get_time                = '86400'
 ) {
 
+  include ::swift::deps
+
   concat::fragment { 'swift_slo':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/slo.conf.erb'),
diff --git a/manifests/proxy/staticweb.pp b/manifests/proxy/staticweb.pp
index 18c2f9f8..add9b1ae 100644
--- a/manifests/proxy/staticweb.pp
+++ b/manifests/proxy/staticweb.pp
@@ -18,6 +18,8 @@
 #
 class swift::proxy::staticweb() {
 
+  include ::swift::deps
+
   concat::fragment { 'swift-proxy-staticweb':
     target  => '/etc/swift/proxy-server.conf',
     content => template('swift/proxy/staticweb.conf.erb'),
diff --git a/manifests/proxy/swauth.pp b/manifests/proxy/swauth.pp
index 923e9b7e..b9f938a7 100644
--- a/manifests/proxy/swauth.pp
+++ b/manifests/proxy/swauth.pp
@@ -21,9 +21,12 @@ class swift::proxy::swauth(
   $package_ensure = 'present'
 ) {
 
+  include ::swift::deps
+
   package { 'python-swauth':
     ensure => $package_ensure,
     before => Package['swift-proxy'],
+    tag    => 'swift-package',
   }
 
   concat::fragment { 'swift_proxy_swauth':
diff --git a/manifests/proxy/swift3.pp b/manifests/proxy/swift3.pp
index dec0e0de..4511badd 100644
--- a/manifests/proxy/swift3.pp
+++ b/manifests/proxy/swift3.pp
@@ -24,12 +24,13 @@ class swift::proxy::swift3(
   $ensure = 'present'
 ) {
 
+  include ::swift::deps
   include ::swift::params
 
   package { 'swift-plugin-s3':
     ensure => $ensure,
     name   => $::swift::params::swift3,
-    tag    => 'openstack',
+    tag    => ['openstack','swift-package']
   }
 
   concat::fragment { 'swift_swift3':
diff --git a/manifests/proxy/tempauth.pp b/manifests/proxy/tempauth.pp
index e875b387..e8341e00 100644
--- a/manifests/proxy/tempauth.pp
+++ b/manifests/proxy/tempauth.pp
@@ -81,6 +81,8 @@ class swift::proxy::tempauth (
   $storage_url_scheme = undef,
 ) {
 
+  include ::swift::deps
+
   validate_array($account_user_list)
 
   if ($reseller_prefix) {
diff --git a/manifests/proxy/tempurl.pp b/manifests/proxy/tempurl.pp
index b58a4372..3c554180 100644
--- a/manifests/proxy/tempurl.pp
+++ b/manifests/proxy/tempurl.pp
@@ -52,6 +52,8 @@ class swift::proxy::tempurl (
   $outgoing_allow_headers  = undef,
 ) {
 
+  include ::swift::deps
+
   if($methods) {
     if is_array($methods) {
       $methods_real = join($methods,' ')
diff --git a/manifests/ringbuilder.pp b/manifests/ringbuilder.pp
index 4fe0416b..0eaeb6f4 100644
--- a/manifests/ringbuilder.pp
+++ b/manifests/ringbuilder.pp
@@ -30,6 +30,7 @@ class swift::ringbuilder(
   $min_part_hours = undef
 ) {
 
+  include ::swift::deps
   Class['swift'] -> Class['swift::ringbuilder']
 
   swift::ringbuilder::create{ ['object', 'account', 'container']:
diff --git a/manifests/ringbuilder/create.pp b/manifests/ringbuilder/create.pp
index 68e4dd6b..d959f1a2 100644
--- a/manifests/ringbuilder/create.pp
+++ b/manifests/ringbuilder/create.pp
@@ -39,6 +39,8 @@ define swift::ringbuilder::create(
   $user = 'swift'
 ) {
 
+  include ::swift::deps
+
   validate_re($name, '^object|container|account$')
 
   exec { "create_${name}":
@@ -46,6 +48,7 @@ define swift::ringbuilder::create(
     path    => ['/usr/bin'],
     user    => $user,
     creates => "/etc/swift/${name}.builder",
+    before  => Anchor['swift::config::end'],
   }
 
 }
diff --git a/manifests/ringbuilder/rebalance.pp b/manifests/ringbuilder/rebalance.pp
index c028bd48..256249e7 100644
--- a/manifests/ringbuilder/rebalance.pp
+++ b/manifests/ringbuilder/rebalance.pp
@@ -12,6 +12,8 @@ define swift::ringbuilder::rebalance(
   $seed = undef
 ) {
 
+  include ::swift::deps
+
   validate_re($name, '^object|container|account$')
   if $seed {
     validate_re($seed, '^\d+$')
@@ -21,5 +23,6 @@ define swift::ringbuilder::rebalance(
     command     => strip("swift-ring-builder /etc/swift/${name}.builder rebalance ${seed}"),
     path        => ['/usr/bin'],
     refreshonly => true,
+    before      => Anchor['swift::config::end'],
   }
 }
diff --git a/manifests/ringserver.pp b/manifests/ringserver.pp
index 9e6db0e2..9f9f1959 100644
--- a/manifests/ringserver.pp
+++ b/manifests/ringserver.pp
@@ -30,6 +30,7 @@ class swift::ringserver(
   $max_connections = 5
 ) {
 
+  include ::swift::deps
   Class['swift::ringbuilder'] -> Class['swift::ringserver']
 
   if !defined(Class['rsync::server']) {
diff --git a/manifests/ringsync.pp b/manifests/ringsync.pp
index 5e41fdb6..7a89c442 100644
--- a/manifests/ringsync.pp
+++ b/manifests/ringsync.pp
@@ -7,6 +7,8 @@ define swift::ringsync(
   $ring_server
 ) {
 
+  include ::swift::deps
+
   Exec { path => '/usr/bin' }
 
   rsync::get { "/etc/swift/${name}.ring.gz":
diff --git a/manifests/service.pp b/manifests/service.pp
index 4682c4b9..91de0357 100644
--- a/manifests/service.pp
+++ b/manifests/service.pp
@@ -39,6 +39,7 @@ define swift::service(
   $service_provider = $::swift::params::service_provider,
 ) {
 
+  include ::swift::deps
   include ::swift::params
 
   if(! member($::swift::params::swift_init_service_names, $name)) {
diff --git a/manifests/storage.pp b/manifests/storage.pp
index 61b893d4..1f1d200e 100644
--- a/manifests/storage.pp
+++ b/manifests/storage.pp
@@ -23,6 +23,8 @@ class swift::storage(
   $storage_local_net_ip
 ) {
 
+  include ::swift::deps
+
   if !defined(Class['rsync::server']){
     class{ '::rsync::server':
       use_xinetd => true,
diff --git a/manifests/storage/account.pp b/manifests/storage/account.pp
index 252e2236..69607bfe 100644
--- a/manifests/storage/account.pp
+++ b/manifests/storage/account.pp
@@ -34,6 +34,7 @@ class swift::storage::account(
   $service_provider = $::swift::params::service_provider
 ) inherits ::swift::params {
 
+  include ::swift::deps
   Swift_config<| |> ~> Service['swift-account-reaper']
 
   swift::storage::generic { 'account':
diff --git a/manifests/storage/all.pp b/manifests/storage/all.pp
index 84d9e30b..886a152c 100644
--- a/manifests/storage/all.pp
+++ b/manifests/storage/all.pp
@@ -91,6 +91,8 @@ class swift::storage::all(
   $outgoing_chmod     = 'Du=rwx,g=rx,o=rx,Fu=rw,g=r,o=r',
 ) {
 
+  include ::swift::deps
+
   class { '::swift::storage':
     storage_local_net_ip => $storage_local_net_ip,
   }
diff --git a/manifests/storage/container.pp b/manifests/storage/container.pp
index d7fe0a50..86eaad27 100644
--- a/manifests/storage/container.pp
+++ b/manifests/storage/container.pp
@@ -40,6 +40,8 @@ class swift::storage::container(
   $service_provider = $::swift::params::service_provider
 ) inherits ::swift::params {
 
+  include ::swift::deps
+
   Swift_config<| |> ~> Service['swift-container-updater']
 
   swift::storage::generic { 'container':
diff --git a/manifests/storage/disk.pp b/manifests/storage/disk.pp
index 561fe051..ecc9536c 100644
--- a/manifests/storage/disk.pp
+++ b/manifests/storage/disk.pp
@@ -49,11 +49,15 @@ define swift::storage::disk(
   $byte_size    = '1024',
 ) {
 
+  include ::swift::deps
+
   if(!defined(File[$mnt_base_dir])) {
     file { $mnt_base_dir:
-      ensure => directory,
-      owner  => 'swift',
-      group  => 'swift',
+      ensure  => directory,
+      owner   => 'swift',
+      group   => 'swift',
+      require => Anchor['swift::config::begin'],
+      before  => Anchor['swift::config::end'],
     }
   }
 
@@ -61,6 +65,7 @@ define swift::storage::disk(
     command => "parted -s ${base_dir}/${name} mklabel gpt",
     path    => ['/usr/bin/', '/sbin','/bin'],
     onlyif  => ["test -b ${base_dir}/${name}","parted ${base_dir}/${name} print|tail -1|grep 'Error'"],
+    before  => Anchor['swift::config::end'],
   }
 
   swift::storage::xfs { $name:
diff --git a/manifests/storage/ext4.pp b/manifests/storage/ext4.pp
index 2a96009c..da43be6d 100644
--- a/manifests/storage/ext4.pp
+++ b/manifests/storage/ext4.pp
@@ -29,12 +29,14 @@ define swift::storage::ext4(
   $loopback     = false
 ) {
 
+  include ::swift::deps
   # does this have to be refreshonly?
   # how can I know if this drive has been formatted?
   exec { "mkfs-${name}":
     command     => "mkfs.ext4 -I ${byte_size} -F ${device}",
     path        => ['/sbin/'],
     refreshonly => true,
+    before      => Anchor['swift::config::end'],
   }
 
   swift::storage::mount { $name:
diff --git a/manifests/storage/filter/healthcheck.pp b/manifests/storage/filter/healthcheck.pp
index dba89ab7..1dbf9d65 100644
--- a/manifests/storage/filter/healthcheck.pp
+++ b/manifests/storage/filter/healthcheck.pp
@@ -17,6 +17,8 @@
 define swift::storage::filter::healthcheck(
 ) {
 
+  include ::swift::deps
+
   concat::fragment { "swift_healthcheck_${name}":
     target  => "/etc/swift/${name}-server.conf",
     content => template('swift/proxy/healthcheck.conf.erb'),
diff --git a/manifests/storage/filter/recon.pp b/manifests/storage/filter/recon.pp
index 6a8c5263..65a7e4be 100644
--- a/manifests/storage/filter/recon.pp
+++ b/manifests/storage/filter/recon.pp
@@ -22,6 +22,8 @@ define swift::storage::filter::recon(
   $cache_path = '/var/cache/swift'
 ) {
 
+  include ::swift::deps
+
   concat::fragment { "swift_recon_${name}":
     target  => "/etc/swift/${name}-server.conf",
     content => template('swift/recon.conf.erb'),
diff --git a/manifests/storage/generic.pp b/manifests/storage/generic.pp
index 7dd84965..18143eea 100644
--- a/manifests/storage/generic.pp
+++ b/manifests/storage/generic.pp
@@ -38,6 +38,7 @@ define swift::storage::generic(
   $service_provider = $::swift::params::service_provider
 ) {
 
+  include ::swift::deps
   include ::swift::params
 
   Class['swift::storage'] -> Swift::Storage::Generic[$name]
@@ -55,10 +56,10 @@ define swift::storage::generic(
   }
 
   file { "/etc/swift/${name}-server/":
-    ensure  => directory,
-    owner   => 'swift',
-    group   => 'swift',
-    require => Package["swift-${name}"],
+    ensure => directory,
+    owner  => 'swift',
+    group  => 'swift',
+    tag    => 'swift-file',
   }
 
   if $manage_service {
diff --git a/manifests/storage/loopback.pp b/manifests/storage/loopback.pp
index 77d619a0..78ba0aea 100644
--- a/manifests/storage/loopback.pp
+++ b/manifests/storage/loopback.pp
@@ -38,17 +38,23 @@ define swift::storage::loopback(
   $fstype       = 'xfs'
 ) {
 
+  include ::swift::deps
+
   if(!defined(File[$base_dir])) {
     file { $base_dir:
-      ensure => directory,
+      ensure  => directory,
+      require => Anchor['swift::config::begin'],
+      before  => Anchor['swift::config::end'],
     }
   }
 
   if(!defined(File[$mnt_base_dir])) {
     file { $mnt_base_dir:
-      ensure => directory,
-      owner  => 'swift',
-      group  => 'swift',
+      ensure  => directory,
+      owner   => 'swift',
+      group   => 'swift',
+      require => Anchor['swift::config::begin'],
+      before  => Anchor['swift::config::end'],
     }
   }
 
@@ -57,6 +63,7 @@ define swift::storage::loopback(
     path    => ['/usr/bin/', '/bin'],
     unless  => "test -f ${base_dir}/${name}",
     require => File[$base_dir],
+    before  => Anchor['swift::config::end'],
   }
 
   $storage_params = {
diff --git a/manifests/storage/mount.pp b/manifests/storage/mount.pp
index e77e2bf2..a121576f 100644
--- a/manifests/storage/mount.pp
+++ b/manifests/storage/mount.pp
@@ -28,6 +28,8 @@ define swift::storage::mount(
   $fstype       = 'xfs'
 ) {
 
+  include ::swift::deps
+
   if($loopback){
     $options = 'noatime,nodiratime,nobarrier,loop'
   } else {
@@ -43,9 +45,11 @@ define swift::storage::mount(
   # the directory that represents the mount point
   # needs to exist
   file { "${mnt_base_dir}/${name}":
-    ensure => directory,
-    owner  => 'swift',
-    group  => 'swift',
+    ensure  => directory,
+    owner   => 'swift',
+    group   => 'swift',
+    require => Anchor['swift::config::begin'],
+    before  => Anchor['swift::config::end'],
   }
 
   mount { "${mnt_base_dir}/${name}":
@@ -64,6 +68,7 @@ define swift::storage::mount(
     unless    => "grep ${mnt_base_dir}/${name} /etc/mtab",
     # TODO - this needs to be removed when I am done testing
     logoutput => true,
+    before    => Anchor['swift::config::end'],
   }
 
   exec { "fix_mount_permissions_${name}":
@@ -71,6 +76,7 @@ define swift::storage::mount(
     path        => ['/usr/sbin', '/bin'],
     subscribe   => Exec["mount_${name}"],
     refreshonly => true,
+    before      => Anchor['swift::config::end'],
   }
 
   # mounting in linux and puppet is broken and non-atomic
@@ -85,7 +91,7 @@ define swift::storage::mount(
       command     => "restorecon ${mnt_base_dir}/${name}",
       path        => ['/usr/sbin', '/sbin'],
       subscribe   => Exec["mount_${name}"],
-      before      =>  Exec["fix_mount_permissions_${name}"],
+      before      =>  [Exec["fix_mount_permissions_${name}"],Anchor['swift::config::end']],
       refreshonly => true,
     }
   }
diff --git a/manifests/storage/node.pp b/manifests/storage/node.pp
index fcaee1ad..30f3c514 100644
--- a/manifests/storage/node.pp
+++ b/manifests/storage/node.pp
@@ -55,6 +55,8 @@ define swift::storage::node(
   $manage_ring = true
 ) {
 
+  include ::swift::deps
+
   validate_re($zone, '^\d+$', 'The zone parameter must be an integer')
 
   Swift::Storage::Server {
diff --git a/manifests/storage/object.pp b/manifests/storage/object.pp
index 259fc53a..f73a4b02 100644
--- a/manifests/storage/object.pp
+++ b/manifests/storage/object.pp
@@ -34,6 +34,7 @@ class swift::storage::object(
   $service_provider = $::swift::params::service_provider
 ) inherits ::swift::params {
 
+  include ::swift::deps
   Swift_config<| |> ~> Service['swift-object-updater']
 
   swift::storage::generic { 'object':
diff --git a/manifests/storage/server.pp b/manifests/storage/server.pp
index ab6a5d7c..9eb9693c 100644
--- a/manifests/storage/server.pp
+++ b/manifests/storage/server.pp
@@ -137,6 +137,8 @@ define swift::storage::server(
   $config_file_path       = "${type}-server.conf",
 ) {
 
+  include ::swift::deps
+
   if ($incoming_chmod == '0644') {
     warning('The default incoming_chmod set to 0644 may yield in error prone directories and will be changed in a later release.')
   }
diff --git a/manifests/storage/xfs.pp b/manifests/storage/xfs.pp
index 974ef7c0..3de40dce 100644
--- a/manifests/storage/xfs.pp
+++ b/manifests/storage/xfs.pp
@@ -35,6 +35,7 @@ define swift::storage::xfs(
   $loopback     = false
 ) {
 
+  include ::swift::deps
   include ::swift::xfs
 
   if $device == '' {
@@ -45,9 +46,11 @@ define swift::storage::xfs(
 
   if(!defined(File[$mnt_base_dir])) {
     file { $mnt_base_dir:
-      ensure => directory,
-      owner  => 'swift',
-      group  => 'swift',
+      ensure  => directory,
+      owner   => 'swift',
+      group   => 'swift',
+      require => Anchor['swift::config::begin'],
+      before  => Anchor['swift::config::end'],
     }
   }
 
@@ -60,6 +63,7 @@ define swift::storage::xfs(
     path    => ['/sbin/', '/usr/sbin/'],
     require => Package['xfsprogs'],
     unless  => "xfs_admin -l ${target_device}",
+    before  => Anchor['swift::config::end'],
   }
 
   swift::storage::mount { $name:
diff --git a/manifests/test_file.pp b/manifests/test_file.pp
index c515f5be..3fe6e100 100644
--- a/manifests/test_file.pp
+++ b/manifests/test_file.pp
@@ -36,8 +36,12 @@ class swift::test_file (
   $tenant      = 'openstack',
   $user        = 'admin'
 ) {
+
+  include ::swift::deps
+
   file { '/tmp/swift_test_file.rb':
     mode    => '0755',
     content => template('swift/swift_keystone_test.erb'),
+    tag     => 'swift-file',
   }
 }
diff --git a/manifests/xfs.pp b/manifests/xfs.pp
index 86d19fc6..6a44e1e2 100644
--- a/manifests/xfs.pp
+++ b/manifests/xfs.pp
@@ -3,6 +3,8 @@
 # xfs partitions
 class swift::xfs {
 
+  include ::swift::deps
+
   $packages = ['xfsprogs', 'parted']
   ensure_packages($packages)
 
diff --git a/releasenotes/notes/external_install_mgmt_hooks-32ca80d2280efc53.yaml b/releasenotes/notes/external_install_mgmt_hooks-32ca80d2280efc53.yaml
new file mode 100644
index 00000000..eeb3c9b5
--- /dev/null
+++ b/releasenotes/notes/external_install_mgmt_hooks-32ca80d2280efc53.yaml
@@ -0,0 +1,10 @@
+---
+prelude: >
+    Add hooks for external install & svc management.
+features:
+  - This adds defined anchor points for external modules to
+    hook into the software install, config and service dependency
+    chain. This allows external modules to manage software
+    installation (virtualenv, containers, etc) and service management
+    (pacemaker) without needing rely on resources that may change or
+    be renamed.
diff --git a/spec/acceptance/basic_swift_spec.rb b/spec/acceptance/basic_swift_spec.rb
index e49c7971..c1f20fda 100644
--- a/spec/acceptance/basic_swift_spec.rb
+++ b/spec/acceptance/basic_swift_spec.rb
@@ -50,13 +50,11 @@ describe 'basic swift' do
         part_power     => '18',
         replicas       => '1',
         min_part_hours => 1,
-        require        => Class['swift'],
       }
       class { '::swift::proxy':
         proxy_local_net_ip => '127.0.0.1',
         pipeline           => ['healthcheck', 'proxy-logging', 'cache', 'authtoken', 'keystone', 'dlo', 'proxy-server'],
         account_autocreate => true,
-        require            => Class['swift::ringbuilder'],
       }
       class { '::swift::proxy::authtoken':
         admin_password => 'a_big_secret',
@@ -142,13 +140,11 @@ describe 'basic swift' do
         part_power     => '18',
         replicas       => '1',
         min_part_hours => 1,
-        require        => Class['swift'],
       }
       class { '::swift::proxy':
         proxy_local_net_ip => '127.0.0.1',
         pipeline           => ['healthcheck', 'proxy-logging', 'cache', 'authtoken', 'keystone', 'dlo', 'proxy-server'],
         account_autocreate => true,
-        require            => Class['swift::ringbuilder'],
         service_provider   => 'swiftinit',
       }
       class { '::swift::proxy::authtoken':
diff --git a/spec/classes/swift_client_spec.rb b/spec/classes/swift_client_spec.rb
index b4da0905..3e681a6c 100644
--- a/spec/classes/swift_client_spec.rb
+++ b/spec/classes/swift_client_spec.rb
@@ -21,7 +21,7 @@ describe 'swift::client' do
       is_expected.to contain_package('swiftclient').with(
         :name   => 'python-swiftclient',
         :ensure => p[:package_ensure],
-        :tag    => 'openstack'
+        :tag    => ['openstack','swift-support-package'],
       )
     end
 
diff --git a/spec/classes/swift_dispersion_spec.rb b/spec/classes/swift_dispersion_spec.rb
index 8aaf3e57..bd1c864e 100644
--- a/spec/classes/swift_dispersion_spec.rb
+++ b/spec/classes/swift_dispersion_spec.rb
@@ -31,8 +31,7 @@ describe 'swift::dispersion' do
   it { is_expected.to contain_file('/etc/swift/dispersion.conf').with(
     :ensure  => 'file',
     :owner   => 'swift',
-    :group   => 'swift',
-    :require => 'Package[swift]')
+    :group   => 'swift',)
   }
 
   shared_examples 'swift::dispersion' do
diff --git a/spec/classes/swift_proxy_spec.rb b/spec/classes/swift_proxy_spec.rb
index e0aa3d55..3aa914d1 100644
--- a/spec/classes/swift_proxy_spec.rb
+++ b/spec/classes/swift_proxy_spec.rb
@@ -37,6 +37,9 @@ describe 'swift::proxy' do
         {:proxy_local_net_ip => '127.0.0.1'}
       end
 
+      it { is_expected.to contain_package('swift-proxy').that_requires('Anchor[swift::install::begin]')
+           is_expected.to contain_package('swift-proxy').that_notifies('Anchor[swift::install::end]') }
+
       it { is_expected.to contain_service('swift-proxy-server').with(
         {:ensure     => 'running',
          :provider   => nil,
@@ -46,6 +49,12 @@ describe 'swift::proxy' do
          :tag        => 'swift-service',
         }
       )}
+      it { is_expected.to contain_concat('/etc/swift/proxy-server.conf').with(
+        {:ensure  => 'present',
+         :owner   => 'swift',
+         :group   => 'swift',
+        }
+      )}
 
       it 'should build the header file with all of the default contents' do
         is_expected.to contain_concat_fragment('swift_proxy').with_content('# This file is managed by puppet.  Do not edit
diff --git a/spec/classes/swift_spec.rb b/spec/classes/swift_spec.rb
index e4385767..ca04efe5 100644
--- a/spec/classes/swift_spec.rb
+++ b/spec/classes/swift_spec.rb
@@ -30,7 +30,7 @@ describe 'swift' do
       {
         :owner   => 'swift',
         :group   => 'swift',
-        :require => 'Package[swift]'
+        :tag     => 'swift-file',
       }
     end
     it {is_expected.to contain_user('swift')}
@@ -55,7 +55,9 @@ describe 'swift' do
       is_expected.to contain_swift_config(
         'swift-constraints/max_header_size').with_value('16384')
     end
-    it { is_expected.to contain_package('swift').with_ensure('present') }
+    it { is_expected.to contain_package('swift').with_ensure('present')
+         is_expected.to contain_package('swift').that_requires('Anchor[swift::install::begin]')
+         is_expected.to contain_package('swift').that_notifies('Anchor[swift::install::end]')}
     it { is_expected.to contain_file('/etc/swift/swift.conf').with_before(/Swift_config\[.+\]/) }
   end
 
diff --git a/spec/defines/swift_storage_generic_spec.rb b/spec/defines/swift_storage_generic_spec.rb
index 86821189..bc31884a 100644
--- a/spec/defines/swift_storage_generic_spec.rb
+++ b/spec/defines/swift_storage_generic_spec.rb
@@ -55,7 +55,8 @@ describe 'swift::storage::generic' do
               it do
                 is_expected.to contain_package("swift-#{t}").with(
                   :ensure => params[:package_ensure],
-                  :tag    => ['openstack', 'swift-package']
+                  :tag    => ['openstack', 'swift-package'],
+                  :notify => ['Anchor[swift::install::end]']
                 )
               end
               it do