diff --git a/bin/get_roles.py b/bin/get_roles.py
index 565befe..df00a27 100755
--- a/bin/get_roles.py
+++ b/bin/get_roles.py
@@ -23,7 +23,7 @@ def read_file_skip_jinja(filename):
 def get_roles_of_one_minion(minion):
     content = read_file_skip_jinja("pillar/id/%s" % minion)
     try:
-        roles = yaml.safe_load(content)['grains']['roles']
+        roles = yaml.safe_load(content)['roles']
     except KeyError:
         roles = []
 
diff --git a/bin/prepare_test_env.sh b/bin/prepare_test_env.sh
index 2be14c0..ffc1335 100755
--- a/bin/prepare_test_env.sh
+++ b/bin/prepare_test_env.sh
@@ -68,13 +68,17 @@ $SUDO ln -s $PWD/salt /srv/salt
 $SUDO ln -s $PWD/pillar /srv/pillar
 
 ID=$(/usr/bin/hostname -f)
+IDFILE="pillar/id/${ID//./_}.sls"
+IDFILE_BASE="$IDFILE.base.sls"
 
-printf "grains:\n  city: nuremberg\n  country: de\n  hostusage: test\n  reboot_safe: no\n  salt_cluster: $SALT_CLUSTER\n  virt_cluster: $VIRT_CLUSTER\n" > pillar/id/${ID//./_}.sls
+printf "grains:\n  city: nuremberg\n  country: de\n  hostusage: test\n  reboot_safe: no\n  salt_cluster: $SALT_CLUSTER\n  virt_cluster: $VIRT_CLUSTER\n" > "$IDFILE"
+cp "$IDFILE" "$IDFILE_BASE"
 
 if [[ -n "$HIGHSTATE" ]]; then
     ROLES=$(bin/get_roles.py -o yaml)
-    [[ -n "$OS" ]] && OS_GRAINS="osfullname: ${OS[0]}\nosmajorrelease: ${OS[1]}\nosrelease_info: [${OS[1]}, ${OS[2]}]\n"
-    printf "city:\ncountry:\ndomain: $DOMAIN\ninclude_secrets: $SECRETS\n$OS_GRAINS$ROLES\nsalt_cluster: $SALT_CLUSTER\nvirt_cluster:\nvirtual:\n" > /etc/salt/grains
+    [[ -n "$OS" ]] && OS_GRAINS="osfullname: ${OS[0]}\nosmajorrelease: ${OS[1]}\nosrelease_info: [${OS[1]}, ${OS[2]}]"
+    printf "city:\ncountry:\ndomain: $DOMAIN\ninclude_secrets: $SECRETS\n$OS_GRAINS\nsalt_cluster: $SALT_CLUSTER\nvirt_cluster:\nvirtual:\n" > /etc/salt/grains
+    printf "$ROLES" >> "$IDFILE"
 
     if [ ! -d /etc/salt/minion.d ]
     then
@@ -86,4 +90,6 @@ if [[ -n "$HIGHSTATE" ]]; then
 	    - /srv/salt
 	    - /usr/share/salt-formulas/states
 	EOF
+
+    cp "$IDFILE_BASE" "$IDFILE"
 fi
diff --git a/bin/test_nginx.sh b/bin/test_nginx.sh
index 70d80aa..b882b3f 100755
--- a/bin/test_nginx.sh
+++ b/bin/test_nginx.sh
@@ -8,10 +8,16 @@ source bin/get_colors.sh
 
 rpm -q nginx salt salt-master
 
+IDFILE="pillar/id/$(hostname).sls"
+IDFILE_BASE="$IDFILE.base.sls"
+sed -i -e '/virtual/d' -e '/virt_cluster/d' /etc/salt/grains
+cp "$IDFILE" "$IDFILE_BASE"
+
 reset_nginx() {
+    cp "$IDFILE_BASE" "$IDFILE"
     rm -rf /etc/nginx
     cp -a /etc/nginx_orig /etc/nginx
-    printf "roles:\n- $role" > /etc/salt/grains
+    printf "roles:\n- $role" >> "$IDFILE"
 }
 
 reset_ip() {
diff --git a/pillar/common/init.sls b/pillar/common/init.sls
index 568084b..3582d1b 100644
--- a/pillar/common/init.sls
+++ b/pillar/common/init.sls
@@ -5,7 +5,7 @@ chrony:
   driftfile: /var/lib/chrony/drift
   logdir: /var/log/chrony
   otherparams:
-    {% if 'ntp' not in salt['grains.get']('roles', []) %}
+    {% if salt['grains.get']('configure_ntp', True) %}
     - logchange 0.5
     - log measurements statistics tracking rtc
     - makestep 1.0 3
diff --git a/pillar/id/anna_infra_opensuse_org.sls b/pillar/id/anna_infra_opensuse_org.sls
index 7a39879..b5ec456 100644
--- a/pillar/id/anna_infra_opensuse_org.sls
+++ b/pillar/id/anna_infra_opensuse_org.sls
@@ -9,11 +9,6 @@ grains:
     - ntp2.i.o.o
     - proxy-nue1.o.o
     - relay.i.o.o
-  roles:
-    - ha
-    - proxy
-    - proxy_master
-    - ntp
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -28,3 +23,9 @@ grains:
     - elsa.infra.opensuse.org
   weburls:
     - https://anna.opensuse.org
+  configure_ntp: false
+roles:
+  - ha
+  - proxy
+  - proxy_master
+  - ntp
diff --git a/pillar/id/baloo_infra_opensuse_org.sls b/pillar/id/baloo_infra_opensuse_org.sls
index df8f7d8..8f2a508 100644
--- a/pillar/id/baloo_infra_opensuse_org.sls
+++ b/pillar/id/baloo_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - lists.o.o
-  roles:
-    - lists
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -17,3 +15,5 @@ grains:
   partners: []
   weburls:
     - https://lists.opensuse.org
+roles:
+  - lists
diff --git a/pillar/id/chip_infra_opensuse_org.sls b/pillar/id/chip_infra_opensuse_org.sls
index dd4267d..06f15ef 100644
--- a/pillar/id/chip_infra_opensuse_org.sls
+++ b/pillar/id/chip_infra_opensuse_org.sls
@@ -3,9 +3,6 @@ grains:
   country: de
   hostusage:
     - pDNS master
-  roles:
-    - ns
-    - ns_slave
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -17,3 +14,6 @@ grains:
   responsible: []
   partners: []
   weburls: []
+roles:
+  - ns
+  - ns_slave
diff --git a/pillar/id/ci-container_infra_opensuse_org.sls b/pillar/id/ci-container_infra_opensuse_org.sls
index f6b6d18..291b13b 100644
--- a/pillar/id/ci-container_infra_opensuse_org.sls
+++ b/pillar/id/ci-container_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - Jenkins Containers
-  roles:
-    - docker
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -18,7 +16,8 @@ grains:
     - crameleon
   partners: []
   weburls: []
-
+roles:
+  - docker
 profile:
   docker:
     data_root: /data/docker
diff --git a/pillar/id/ci-opensuse_infra_opensuse_org.sls b/pillar/id/ci-opensuse_infra_opensuse_org.sls
index d5d943d..3727901 100644
--- a/pillar/id/ci-opensuse_infra_opensuse_org.sls
+++ b/pillar/id/ci-opensuse_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - jenkins
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -18,3 +17,4 @@ grains:
   partners: []
   weburls:
     - https://ci.opensuse.org
+roles: []
diff --git a/pillar/id/crtmgr_infra_opensuse_org.sls b/pillar/id/crtmgr_infra_opensuse_org.sls
index 1b158e3..04565ff 100644
--- a/pillar/id/crtmgr_infra_opensuse_org.sls
+++ b/pillar/id/crtmgr_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - crtmgr.o.o
-  roles:
-    - crtmgr
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -27,3 +25,5 @@ users:
       - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCdjsWFf1vdFs/zBF9t9is81BFrxKuPS0WEYcFoAH06qmxnisDOibZSEYSYgOiIC1v1MdDXopo82qOETMRi8zYi6iCWfzYDgvRAaEeSrqsN/VAId9/Hy1/lwksMUzZAdFKIuTvAP5tsv8JOuTP+zVTN5hgxfBdN4dPErHUjcztpAnvncIz65Rqg8VNH1V01mtQaiGQFoVT15/d75XeG1EtEBRW65zaVgpyXyh1Ie86zwD1GH9EouBNX6Y4hFMmdXL4ujpNscCCQIO5/1HjxoerSHjkPBmMagn7aKVv1zMWprDvHIywi2VIyOK+HNyW9YzfzDc4dqKwasvi/Z8yr1TkD kbabioch@suse.de
       - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDF0ybcoCJWjn6Mgxxi1t+qgE83w0MFSqvPaSi2pzE0gZT1bzBUDkj9Kuib90ioY8mBQD/a2ZYXehZuOQQ+1/1Ny2HRcI0NdY2JUIbrijCAWtqVxk6//Uxx/kJumHv7G3GoPoULTiUtFTIjNy9orOcNOfERb43bgnGhmTEfxK4Xgco5i300oau/WrneZr6y+V9YuAd0kReIYQ0EhTM37GDlWYF4PTTVlwez5nTJsM1LeNPzLhPYjHZ6g5PNK/YWyJ5fbX9k5lrlj4mmM1Z0j2yjyJYzPlDh26bG/0GDUnmmtGtSUOICZ+tntD++eofcVg3qdU5eNkOPIpaR62Nuv32rMB82vozngLfRtnmUX9DkCpJ0pi7fP7L/V/T0ELeHI4JXdIlZzOS5YuDKR+mVg+2WN0CAO7s1n88X/vOS7XU6jucDs4CjIxS4GXPuKjGTuNUogk6Ww8kcMh8I1q6ClJ8r8pBCRej25/QcCHiX5L47NcNdZfOZkMi0ZVF7zGAUjIHxyK2UvesB2JvSwQvbG9soaZH18cP95j1lpdEyByAmaqH9qQ61eksIML1xRHcYQOoWa96c1acB3UTjr3irlFr8YMcg2Bpv7URqinGWwVoiK8EHSGzrs/cnFM1lI8uCOYorkKELAOvOTTtVKd1GwcZgaIAGk7MsUYSDDOo8HPBiNQ== kbabioch@suse.de
       - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDkuYLad5YFXhv3IRz4VTVmC4kIu5bhtdXpvzLyVfU3cXGk0E4W+/Eu2ZGC0t0m/Q5lmqvCBXPc2ZBLVaMjwcq/x0q9M54bAFZqwlfzv/4m8PAzg/Nui2r6V737DuoMHK8z//bHB3odPRukkyrFKGql0LiEjuNT4v5V2Y78WOEIxWzPBdh8FuXAtvgL7EF8EVG7iTAlJjFjs+AYqmb949ptJ/lr/2gHxJiAeYg1UE57w6Omzk2UwIxlQXjLm9z3wtqFBNZiSVfRNCouF48t0WOYWTgF/lJY26OwLrP740oR4lULCUfnGKH0ydddVqo+OO3iDApg2Rbo6s8uVe69D2LVM4u+iplllHaD8QKBB0NSmvdw9wZNy2VCEs2Dpuik7yDT4gmxZbKaWOiW6ELUrodkJ0d9bepfxWwJ1Y/wXVsPdo/0R/KTeuBTHs+aIISSBCxMxj0SSXKLJ7wTIXO4UHRFPp6xsrQaBLu1qAA+g/wG+npenoeGI8ScYABq2feY1psvL/QzRGassAJEtDj2ozjuiVrUxNlx7rBQQ8TEIdAl1FJqvlCjMg28ZXuwYSb0GcC2kTry7jWREE/jt56CE2fnQVura9rrRqzVUHnweo7sV0Ct/20lyTvY0qVCs7aUXxM11g9IXytW+hatvJvxNw+xuvYoJYRyhwWtLAgfebzj5w== rklein@suse.com
+roles:
+  - crtmgr
diff --git a/pillar/id/daffy1_infra_opensuse_org.sls b/pillar/id/daffy1_infra_opensuse_org.sls
index 0b18264..e55e601 100644
--- a/pillar/id/daffy1_infra_opensuse_org.sls
+++ b/pillar/id/daffy1_infra_opensuse_org.sls
@@ -3,10 +3,6 @@ grains:
   country: de
   hostusage:
     - login2.o.o
-  roles:
-    - ha
-    - login
-    - login_master
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -21,3 +17,7 @@ grains:
     - daffy2.infra.opensuse.org
   weburls:
     - https://login2.opensuse.org
+roles:
+  - ha
+  - login
+  - login_master
diff --git a/pillar/id/daffy2_infra_opensuse_org.sls b/pillar/id/daffy2_infra_opensuse_org.sls
index 3a56e27..4bcb7ec 100644
--- a/pillar/id/daffy2_infra_opensuse_org.sls
+++ b/pillar/id/daffy2_infra_opensuse_org.sls
@@ -3,14 +3,9 @@ grains:
   country: de
   hostusage:
     - login2.o.o
-  roles:
-    - ha
-    - login
-    - login_slave
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: atreju
-
   aliases: []
   description: Login proxy for servers with authentication
   documentation:
@@ -21,3 +16,7 @@ grains:
     - daffy1.infra.opensuse.org
   weburls:
     - https://login2.opensuse.org
+roles:
+  - ha
+  - login
+  - login_slave
diff --git a/pillar/id/dale_infra_opensuse_org.sls b/pillar/id/dale_infra_opensuse_org.sls
index 5cf0edc..823fe3d 100644
--- a/pillar/id/dale_infra_opensuse_org.sls
+++ b/pillar/id/dale_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - events.o.o
-  roles:
-    - web_osem
   reboot_safe: yes
   # Henne created zypper locks for ruby2.5 because a version change breaks osem (needs a Gemfile update when the version changes)
   salt_cluster: opensuse
@@ -19,3 +17,5 @@ grains:
   weburls:
     - https://events.opensuse.org
     - https://hackweek.opensuse.org
+roles:
+  - web_osem
diff --git a/pillar/id/discourse01_infra_opensuse_org.sls b/pillar/id/discourse01_infra_opensuse_org.sls
index ede05fb..4bd37b2 100644
--- a/pillar/id/discourse01_infra_opensuse_org.sls
+++ b/pillar/id/discourse01_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - discourse
-  roles:
-    - discourse
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -17,3 +15,5 @@ grains:
   partners: []
   weburls:
     - https://forums.opensuse.org
+roles:
+  - discourse
diff --git a/pillar/id/elections2_infra_opensuse_org.sls b/pillar/id/elections2_infra_opensuse_org.sls
index 8a1eca0..a2aee73 100644
--- a/pillar/id/elections2_infra_opensuse_org.sls
+++ b/pillar/id/elections2_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - elections.o.o
-  roles:
-    - web_elections
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -19,3 +17,5 @@ grains:
   partners: []
   weburls:
     - https://elections.opensuse.org
+roles:
+  - web_elections
diff --git a/pillar/id/elsa_infra_opensuse_org.sls b/pillar/id/elsa_infra_opensuse_org.sls
index a355892..be68dfe 100644
--- a/pillar/id/elsa_infra_opensuse_org.sls
+++ b/pillar/id/elsa_infra_opensuse_org.sls
@@ -9,11 +9,6 @@ grains:
     - ntp3.i.o.o
     - proxy-nue2.o.o
     - relay.i.o.o
-  roles:
-    - ha
-    - proxy
-    - proxy_slave
-    - ntp
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -28,3 +23,9 @@ grains:
     - anna.infra.opensuse.org
   weburls:
     - https://elsa.opensuse.org
+  configure_ntp: false
+roles:
+  - ha
+  - proxy
+  - proxy_slave
+  - ntp
diff --git a/pillar/id/fedora-accounts_infra_opensuse_org.sls b/pillar/id/fedora-accounts_infra_opensuse_org.sls
index 0b05d22..e553596 100644
--- a/pillar/id/fedora-accounts_infra_opensuse_org.sls
+++ b/pillar/id/fedora-accounts_infra_opensuse_org.sls
@@ -2,7 +2,6 @@ grains:
   city: nuremberg
   country: de
   hostusage: []
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -15,3 +14,4 @@ grains:
     - Pharaoh_Atem
   partners: []
   weburls: []
+roles: []
diff --git a/pillar/id/fedora-freeipa_infra_opensuse_org.sls b/pillar/id/fedora-freeipa_infra_opensuse_org.sls
index 6270d56..fb16e48 100644
--- a/pillar/id/fedora-freeipa_infra_opensuse_org.sls
+++ b/pillar/id/fedora-freeipa_infra_opensuse_org.sls
@@ -2,7 +2,6 @@ grains:
   city: nuremberg
   country: de
   hostusage: []
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -15,3 +14,4 @@ grains:
     - Pharaoh_Atem
   partners: []
   weburls: []
+roles: []
diff --git a/pillar/id/fedora-sso_infra_opensuse_org.sls b/pillar/id/fedora-sso_infra_opensuse_org.sls
index 44e0ba9..f7a6808 100644
--- a/pillar/id/fedora-sso_infra_opensuse_org.sls
+++ b/pillar/id/fedora-sso_infra_opensuse_org.sls
@@ -2,7 +2,6 @@ grains:
   city: nuremberg
   country: de
   hostusage: []
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -15,3 +14,4 @@ grains:
     - Pharaoh_Atem
   partners: []
   weburls: []
+roles: []
diff --git a/pillar/id/forum_infra_opensuse_org.sls b/pillar/id/forum_infra_opensuse_org.sls
index 87586a9..e71135c 100644
--- a/pillar/id/forum_infra_opensuse_org.sls
+++ b/pillar/id/forum_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - forums.o.o
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -17,3 +16,4 @@ grains:
   partners: []
   weburls:
     - https://forums.opensuse.org
+roles: []
diff --git a/pillar/id/freeipa2_infra_opensuse_org.sls b/pillar/id/freeipa2_infra_opensuse_org.sls
index 0d411a0..db6de4b 100644
--- a/pillar/id/freeipa2_infra_opensuse_org.sls
+++ b/pillar/id/freeipa2_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - freeipa2
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -18,3 +17,4 @@ grains:
   partners: []
   weburls:
     - https://freeipa2.infra.opensuse.org/
+roles: []
diff --git a/pillar/id/freeipa_infra_opensuse_org.sls b/pillar/id/freeipa_infra_opensuse_org.sls
index 0aee419..edf0e78 100644
--- a/pillar/id/freeipa_infra_opensuse_org.sls
+++ b/pillar/id/freeipa_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - freeipa
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -19,3 +18,4 @@ grains:
   partners: []
   weburls:
     - https://freeipa.infra.opensuse.org/
+roles: []
diff --git a/pillar/id/gcc-stats_infra_opensuse_org.sls b/pillar/id/gcc-stats_infra_opensuse_org.sls
index 5d6553b..846a8c6 100644
--- a/pillar/id/gcc-stats_infra_opensuse_org.sls
+++ b/pillar/id/gcc-stats_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - gcc.o.o
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +15,4 @@ grains:
   partners: []
   weburls: 
     - https://gcc.opensuse.org/
+roles: []
diff --git a/pillar/id/gitlab-runner1_infra_opensuse_org.sls b/pillar/id/gitlab-runner1_infra_opensuse_org.sls
index e6d5d6e..6f63202 100644
--- a/pillar/id/gitlab-runner1_infra_opensuse_org.sls
+++ b/pillar/id/gitlab-runner1_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - gitlab runner
-  roles:
-    - gitlab_runner
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -18,3 +16,5 @@ grains:
   partners: 
     - gitlab-runner2.infra.opensuse.org
   weburls: []
+roles:
+  - gitlab_runner
diff --git a/pillar/id/gitlab-runner2_infra_opensuse_org.sls b/pillar/id/gitlab-runner2_infra_opensuse_org.sls
index e6d5d6e..6f63202 100644
--- a/pillar/id/gitlab-runner2_infra_opensuse_org.sls
+++ b/pillar/id/gitlab-runner2_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - gitlab runner
-  roles:
-    - gitlab_runner
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -18,3 +16,5 @@ grains:
   partners: 
     - gitlab-runner2.infra.opensuse.org
   weburls: []
+roles:
+  - gitlab_runner
diff --git a/pillar/id/identification2_infra_opensuse_org.sls b/pillar/id/identification2_infra_opensuse_org.sls
index 6c67fb4..ba2b5b2 100644
--- a/pillar/id/identification2_infra_opensuse_org.sls
+++ b/pillar/id/identification2_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - freeIPA
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -14,3 +13,4 @@ grains:
     - hellcp
   partners: []
   weburls: []
+roles: []
diff --git a/pillar/id/identification_infra_opensuse_org.sls b/pillar/id/identification_infra_opensuse_org.sls
index 6c67fb4..ba2b5b2 100644
--- a/pillar/id/identification_infra_opensuse_org.sls
+++ b/pillar/id/identification_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - freeIPA
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -14,3 +13,4 @@ grains:
     - hellcp
   partners: []
   weburls: []
+roles: []
diff --git a/pillar/id/jekyll_infra_opensuse_org.sls b/pillar/id/jekyll_infra_opensuse_org.sls
index 0c04e65..6640572 100644
--- a/pillar/id/jekyll_infra_opensuse_org.sls
+++ b/pillar/id/jekyll_infra_opensuse_org.sls
@@ -4,9 +4,6 @@ grains:
   hostusage:
     - news.o.o
     - planet.o.o
-  roles:
-    - jekyll_master
-    - web_jekyll
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -20,3 +17,6 @@ grains:
   weburls:
     - https://news.opensuse.org
     - https://planet.opensuse.org
+roles:
+  - jekyll_master
+  - web_jekyll
diff --git a/pillar/id/jenkins-agent_infra_opensuse_org.sls b/pillar/id/jenkins-agent_infra_opensuse_org.sls
index 563120f..e42a005 100644
--- a/pillar/id/jenkins-agent_infra_opensuse_org.sls
+++ b/pillar/id/jenkins-agent_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - jenkins agent
-  roles:
-    - worker_jenkins
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -17,3 +15,5 @@ grains:
     - luc14n0
   partners: []
   weburls: []
+roles:
+  - worker_jenkins
diff --git a/pillar/id/jenkins_infra_opensuse_org.sls b/pillar/id/jenkins_infra_opensuse_org.sls
index 3894f47..202db5b 100644
--- a/pillar/id/jenkins_infra_opensuse_org.sls
+++ b/pillar/id/jenkins_infra_opensuse_org.sls
@@ -4,9 +4,6 @@ grains:
   hostusage:
     - jenkins controller
     - jenkins agent
-  roles:
-    - web_jenkins
-    - worker_jenkins
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -18,3 +15,6 @@ grains:
   responsible: []
   partners: []
   weburls: []
+roles:
+  - web_jenkins
+  - worker_jenkins
diff --git a/pillar/id/ldap-proxy_infra_opensuse_org.sls b/pillar/id/ldap-proxy_infra_opensuse_org.sls
index 6d7034b..fec1a66 100644
--- a/pillar/id/ldap-proxy_infra_opensuse_org.sls
+++ b/pillar/id/ldap-proxy_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - idp proxy server
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -17,3 +16,4 @@ grains:
   weburls:
     - https://www.opensuse.org/openid
     - https://id.opensuse.org/
+roles: []
diff --git a/pillar/id/limesurvey_infra_opensuse_org.sls b/pillar/id/limesurvey_infra_opensuse_org.sls
index 3034752..e9049d2 100644
--- a/pillar/id/limesurvey_infra_opensuse_org.sls
+++ b/pillar/id/limesurvey_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - limesurvey
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -17,3 +16,4 @@ grains:
   partners: []
   weburls:
     - https://survey.opensuse.org
+roles: []
diff --git a/pillar/id/lnt_infra_opensuse_org.sls b/pillar/id/lnt_infra_opensuse_org.sls
index a6af1d2..5195135 100644
--- a/pillar/id/lnt_infra_opensuse_org.sls
+++ b/pillar/id/lnt_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - lnt.o.o
-  roles:
-    - web_lnt
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +14,5 @@ grains:
   partners: []
   weburls:
     - https://lnt.opensuse.org
+roles:
+  - web_lnt
diff --git a/pillar/id/login3_infra_opensuse_org.sls b/pillar/id/login3_infra_opensuse_org.sls
index 2dd70ad..0937d3b 100644
--- a/pillar/id/login3_infra_opensuse_org.sls
+++ b/pillar/id/login3_infra_opensuse_org.sls
@@ -3,9 +3,6 @@ grains:
   country: us
   hostusage:
     - login3.o.o
-  roles:
-    - login
-    - login_master
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -18,3 +15,6 @@ grains:
   partners: []
   weburls:
     - https://login3.opensuse.org
+roles:
+  - login
+  - login_master
diff --git a/pillar/id/mailman3_infra_opensuse_org.sls b/pillar/id/mailman3_infra_opensuse_org.sls
index 281988a..57cf155 100644
--- a/pillar/id/mailman3_infra_opensuse_org.sls
+++ b/pillar/id/mailman3_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - lists.o.o
-  roles:
-    - mailman3
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -18,3 +16,5 @@ grains:
   partners: []
   weburls:
     - http://mailman3.infra.opensuse.org
+roles:
+  - mailman3
diff --git a/pillar/id/man_infra_opensuse_org.sls b/pillar/id/man_infra_opensuse_org.sls
index a4f9c21..abd6ff3 100644
--- a/pillar/id/man_infra_opensuse_org.sls
+++ b/pillar/id/man_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - manpages.o.o
-  roles:
-    - manpages
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -14,3 +12,5 @@ grains:
     - kukuk
   partners: []
   weburls: []
+roles:
+  - manpages
diff --git a/pillar/id/matrix_infra_opensuse_org.sls b/pillar/id/matrix_infra_opensuse_org.sls
index 9a01ac2..002ea6a 100644
--- a/pillar/id/matrix_infra_opensuse_org.sls
+++ b/pillar/id/matrix_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - matrix.o.o
-  roles:
-    - matrix
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -21,3 +19,5 @@ grains:
     - https://chat.opensuse.org/
     - https://webhook.opensuse.org/
     - https://dimension.opensuse.org/
+roles:
+  - matrix
diff --git a/pillar/id/meet_infra_opensuse_org.sls b/pillar/id/meet_infra_opensuse_org.sls
index 2ea3214..454bc1d 100644
--- a/pillar/id/meet_infra_opensuse_org.sls
+++ b/pillar/id/meet_infra_opensuse_org.sls
@@ -3,8 +3,7 @@ grains:
   country: de
   hostusage:
     - meet.o.o
-  roles: []
-  reboot_safe: yes 
+  reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
 
@@ -17,3 +16,4 @@ grains:
   partners: []
   weburls:
     - https://meet.opensuse.org
+roles: []
diff --git a/pillar/id/mickey_infra_opensuse_org.sls b/pillar/id/mickey_infra_opensuse_org.sls
index e62814b..e3d3d9a 100644
--- a/pillar/id/mickey_infra_opensuse_org.sls
+++ b/pillar/id/mickey_infra_opensuse_org.sls
@@ -4,9 +4,6 @@ grains:
   hostusage:
     - gitlab.i.o.o
     - gitlab runner
-  roles:
-    - web_gitlab
-    - worker_gitlab
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -18,3 +15,6 @@ grains:
   partners: []
   weburls:
     - https://gitlab.infra.opensuse.org
+roles:
+  - web_gitlab
+  - worker_gitlab
diff --git a/pillar/id/minio_infra_opensuse_org.sls b/pillar/id/minio_infra_opensuse_org.sls
index aceff7e..2446e9c 100644
--- a/pillar/id/minio_infra_opensuse_org.sls
+++ b/pillar/id/minio_infra_opensuse_org.sls
@@ -2,8 +2,6 @@ grains:
   city: nuremberg
   country: de
   hostusage: []
-  roles:
-    - minio
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +14,5 @@ grains:
   partners: []
   weburls:
     - s3.opensuse-project.net
+roles:
+  - minio
diff --git a/pillar/id/minnie_infra_opensuse_org.sls b/pillar/id/minnie_infra_opensuse_org.sls
index c080836..edf02aa 100644
--- a/pillar/id/minnie_infra_opensuse_org.sls
+++ b/pillar/id/minnie_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - saltmaster
-  roles:
-    - saltmaster
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -17,3 +15,5 @@ grains:
   responsible: []
   partners: []
   weburls: []
+roles:
+  - saltmaster
diff --git a/pillar/id/mirrorcache-us_infra_opensuse_org.sls b/pillar/id/mirrorcache-us_infra_opensuse_org.sls
index c807c74..02092e6 100644
--- a/pillar/id/mirrorcache-us_infra_opensuse_org.sls
+++ b/pillar/id/mirrorcache-us_infra_opensuse_org.sls
@@ -6,7 +6,6 @@ grains:
   country: us
   hostusage:
     - mirrorcache
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -20,3 +19,4 @@ grains:
   partners: []
   weburls:
     - https://mirrorcache-us.opensuse.org/
+roles: []
diff --git a/pillar/id/mirrorcache2_infra_opensuse_org.sls b/pillar/id/mirrorcache2_infra_opensuse_org.sls
index 9a1fb6c..974f0bc 100644
--- a/pillar/id/mirrorcache2_infra_opensuse_org.sls
+++ b/pillar/id/mirrorcache2_infra_opensuse_org.sls
@@ -6,7 +6,6 @@ grains:
   country: de
   hostusage:
     - mirrorcache
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -20,3 +19,4 @@ grains:
   partners: []
   weburls:
     - https://mirrorcache-eu.opensuse.org/
+roles: []
diff --git a/pillar/id/mirrorcache_infra_opensuse_org.sls b/pillar/id/mirrorcache_infra_opensuse_org.sls
index fc018cc..25eebe1 100644
--- a/pillar/id/mirrorcache_infra_opensuse_org.sls
+++ b/pillar/id/mirrorcache_infra_opensuse_org.sls
@@ -6,7 +6,6 @@ grains:
   country: de
   hostusage:
     - mb devel
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -18,3 +17,4 @@ grains:
   responsible:
     - anikitin
   partners: []
+roles: []
diff --git a/pillar/id/mirrordb1_infra_opensuse_org.sls b/pillar/id/mirrordb1_infra_opensuse_org.sls
index c772e0a..36a4cce 100644
--- a/pillar/id/mirrordb1_infra_opensuse_org.sls
+++ b/pillar/id/mirrordb1_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - postgreSQL cluster
-  roles:
-    - postgresql
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +14,5 @@ grains:
   partners:
     - mirrordb2.infra.opensuse.org
   weburls: []
+roles:
+  - postgresql
diff --git a/pillar/id/mirrordb2_infra_opensuse_org.sls b/pillar/id/mirrordb2_infra_opensuse_org.sls
index 0487c68..a57b063 100644
--- a/pillar/id/mirrordb2_infra_opensuse_org.sls
+++ b/pillar/id/mirrordb2_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - postgreSQL cluster
-  roles:
-    - postgresql
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +14,5 @@ grains:
   partners:
     - mirrordb1.infra.opensuse.org
   weburls: []
+roles:
+  - postgresql
diff --git a/pillar/id/mirrordb3_infra_opensuse_org.sls b/pillar/id/mirrordb3_infra_opensuse_org.sls
index 81e3038..e70c53a 100644
--- a/pillar/id/mirrordb3_infra_opensuse_org.sls
+++ b/pillar/id/mirrordb3_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: us
   hostusage:
     - postgreSQL
-  roles:
-    - postgresql
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -23,3 +21,5 @@ grains:
     - lrupp
   partners: []
   weburls: []
+roles:
+  - postgresql
diff --git a/pillar/id/monitor_infra_opensuse_org.sls b/pillar/id/monitor_infra_opensuse_org.sls
index e73505f..28c5e60 100644
--- a/pillar/id/monitor_infra_opensuse_org.sls
+++ b/pillar/id/monitor_infra_opensuse_org.sls
@@ -5,10 +5,6 @@ grains:
     - heroes-bot
     - monitor.o.o
     - syslog.i.o.o
-  roles:
-    - ircbot
-    - syslog
-    - monitoring
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -21,3 +17,7 @@ grains:
   partners: []
   weburls:
     - https://monitor.opensuse.org
+roles:
+  - ircbot
+  - syslog
+  - monitoring
diff --git a/pillar/id/moodle_infra_opensuse_org.sls b/pillar/id/moodle_infra_opensuse_org.sls
index a5da254..e2cc53e 100644
--- a/pillar/id/moodle_infra_opensuse_org.sls
+++ b/pillar/id/moodle_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - moodle
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +15,4 @@ grains:
   partners: []
   weburls:
     - https://moodle.opensuse.org
+roles: []
diff --git a/pillar/id/mx-test_infra_opensuse_org.sls b/pillar/id/mx-test_infra_opensuse_org.sls
index 2790ba7..f92e1bf 100644
--- a/pillar/id/mx-test_infra_opensuse_org.sls
+++ b/pillar/id/mx-test_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - mx-test.o.o
-  roles:
-    - mailserver
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -14,3 +12,5 @@ grains:
   responsible:
     - pjessen
   partners: []
+roles:
+  - mailserver
diff --git a/pillar/id/mx1_infra_opensuse_org.sls b/pillar/id/mx1_infra_opensuse_org.sls
index 1de8fbc..5e97110 100644
--- a/pillar/id/mx1_infra_opensuse_org.sls
+++ b/pillar/id/mx1_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - mx1.o.o
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -13,3 +12,4 @@ grains:
   responsible:
     - mstrigl 
   partners: []
+roles: []
diff --git a/pillar/id/mx2_infra_opensuse_org.sls b/pillar/id/mx2_infra_opensuse_org.sls
index 1e4689f..c735b77 100644
--- a/pillar/id/mx2_infra_opensuse_org.sls
+++ b/pillar/id/mx2_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - mx2.o.o
-  roles:
-    - mailserver
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -14,3 +12,5 @@ grains:
   responsible:
     - mstrigl 
   partners: []
+roles:
+  - mailserver
diff --git a/pillar/id/mx4_infra_opensuse_org.sls b/pillar/id/mx4_infra_opensuse_org.sls
index 4354b3f..19985bb 100644
--- a/pillar/id/mx4_infra_opensuse_org.sls
+++ b/pillar/id/mx4_infra_opensuse_org.sls
@@ -2,7 +2,6 @@ grains:
   city: provo
   country: us
   hostusage: []
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -12,3 +11,4 @@ grains:
     - pjessen
   partners: []
   weburls: []
+roles: []
diff --git a/pillar/id/nala2_infra_opensuse_org.sls b/pillar/id/nala2_infra_opensuse_org.sls
index b9a3a0e..912d5e2 100644
--- a/pillar/id/nala2_infra_opensuse_org.sls
+++ b/pillar/id/nala2_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: us
   hostusage:
     - PostgreSQL node
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -19,3 +18,4 @@ grains:
     - mirrordb2.infra.opensuse.org
     - nala.infra.opensuse.org
   weburls: []
+roles: []
diff --git a/pillar/id/nala_infra_opensuse_org.sls b/pillar/id/nala_infra_opensuse_org.sls
index 4962201..0ab299a 100644
--- a/pillar/id/nala_infra_opensuse_org.sls
+++ b/pillar/id/nala_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: us
   hostusage:
     - PostgreSQL node
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -19,3 +18,4 @@ grains:
     - mirrordb2.infra.opensuse.org
     - nala2.infra.opensuse.org
   weburls: []
+roles: []
diff --git a/pillar/id/narwal4_infra_opensuse_org.sls b/pillar/id/narwal4_infra_opensuse_org.sls
index 549bbb0..7fe3de8 100644
--- a/pillar/id/narwal4_infra_opensuse_org.sls
+++ b/pillar/id/narwal4_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: us
   hostusage:
     - static.o.o
-  roles:
-    - web_static
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -23,3 +21,5 @@ grains:
     - https://shop.opensuse.org
     - https://static.opensuse.org
     - https://studioexpress.opensuse.org
+roles:
+  - web_static
diff --git a/pillar/id/narwal5_infra_opensuse_org.sls b/pillar/id/narwal5_infra_opensuse_org.sls
index 254e443..8c937ac 100644
--- a/pillar/id/narwal5_infra_opensuse_org.sls
+++ b/pillar/id/narwal5_infra_opensuse_org.sls
@@ -4,9 +4,6 @@ grains:
   hostusage:
     - static.o.o
     - static.o.o master
-  roles:
-    - static_master
-    - web_static
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -27,3 +24,6 @@ grains:
     - https://shop.opensuse.org
     - https://static.opensuse.org
     - https://studioexpress.opensuse.org
+roles:
+  - static_master
+  - web_static
diff --git a/pillar/id/narwal6_infra_opensuse_org.sls b/pillar/id/narwal6_infra_opensuse_org.sls
index 2e57281..13e964c 100644
--- a/pillar/id/narwal6_infra_opensuse_org.sls
+++ b/pillar/id/narwal6_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - static.o.o
-  roles:
-    - web_static
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -25,3 +23,5 @@ grains:
     - https://shop.opensuse.org
     - https://static.opensuse.org
     - https://studioexpress.opensuse.org
+roles:
+  - web_static
diff --git a/pillar/id/narwal7_infra_opensuse_org.sls b/pillar/id/narwal7_infra_opensuse_org.sls
index 811ab3d..49e0eca 100644
--- a/pillar/id/narwal7_infra_opensuse_org.sls
+++ b/pillar/id/narwal7_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - static.o.o
-  roles:
-    - web_static
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -25,3 +23,5 @@ grains:
     - https://shop.opensuse.org
     - https://static.opensuse.org
     - https://studioexpress.opensuse.org
+roles:
+  - web_static
diff --git a/pillar/id/new-forum_infra_opensuse_org.sls b/pillar/id/new-forum_infra_opensuse_org.sls
index 3e0771c..3b9c728 100644
--- a/pillar/id/new-forum_infra_opensuse_org.sls
+++ b/pillar/id/new-forum_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - vBulletin
-  roles:
-    - web_forum
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -19,3 +17,5 @@ grains:
   partners: []
   weburls:
     - https://forums.opensuse.org
+roles:
+  - web_forum
diff --git a/pillar/id/nue-ns1_infra_opensuse_org.sls b/pillar/id/nue-ns1_infra_opensuse_org.sls
index 0e060a6..219731f 100644
--- a/pillar/id/nue-ns1_infra_opensuse_org.sls
+++ b/pillar/id/nue-ns1_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - DNS
-  roles: 
-    - dns
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -22,3 +20,5 @@ grains:
     - qsc-ns3.infra.opensuse-org
     - provo-ns.infra.opensuse.org
   weburls: []
+roles:
+  - dns
diff --git a/pillar/id/nue-ns2_infra_opensuse_org.sls b/pillar/id/nue-ns2_infra_opensuse_org.sls
index 00467a2..ca959f8 100644
--- a/pillar/id/nue-ns2_infra_opensuse_org.sls
+++ b/pillar/id/nue-ns2_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - DNS
-  roles: 
-    - dns
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -22,3 +20,5 @@ grains:
     - qsc-ns3.infra.opensuse-org
     - provo-ns.infra.opensuse.org
   weburls: []
+roles:
+  - dns
diff --git a/pillar/id/nuka_infra_opensuse_org.sls b/pillar/id/nuka_infra_opensuse_org.sls
index fcecba6..099f061 100644
--- a/pillar/id/nuka_infra_opensuse_org.sls
+++ b/pillar/id/nuka_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - l10n.o.o
-  roles:
-    - weblate
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -18,3 +16,5 @@ grains:
   partners: []
   weburls:
     - https://l10n.opensuse.org
+roles:
+  - weblate
diff --git a/pillar/id/olaf_infra_opensuse_org.sls b/pillar/id/olaf_infra_opensuse_org.sls
index 518b0fb..9a93a34 100644
--- a/pillar/id/olaf_infra_opensuse_org.sls
+++ b/pillar/id/olaf_infra_opensuse_org.sls
@@ -4,8 +4,6 @@ grains:
   hostusage:
     - mirrors.o.o
     - scanner.o.o
-  roles:
-    - web_mirrors
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -21,3 +19,5 @@ grains:
   weburls:
     - https://mirrordb.opensuse.org
     - https://mirrors.opensuse.org
+roles:
+  - web_mirrors
diff --git a/pillar/id/opi-proxy_infra_opensuse_org.sls b/pillar/id/opi-proxy_infra_opensuse_org.sls
index 0659ba4..50008b6 100644
--- a/pillar/id/opi-proxy_infra_opensuse_org.sls
+++ b/pillar/id/opi-proxy_infra_opensuse_org.sls
@@ -3,8 +3,7 @@ grains:
   country: de
   hostusage:
     - opi proxy
-  roles: []
-  reboot_safe: yes 
+  reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
 
@@ -17,3 +16,4 @@ grains:
   partners: []
   weburls:
     - https://opi-proxy.opensuse.org
+roles: []
diff --git a/pillar/id/os-rt_infra_opensuse_org.sls b/pillar/id/os-rt_infra_opensuse_org.sls
index a91c1c6..c955906 100644
--- a/pillar/id/os-rt_infra_opensuse_org.sls
+++ b/pillar/id/os-rt_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - RT
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -17,3 +16,4 @@ grains:
   partners: []
   weburls:
     - https://osrt.opensuse.org
+roles: []
diff --git a/pillar/id/osc-collab2_infra_opensuse_org.sls b/pillar/id/osc-collab2_infra_opensuse_org.sls
index de037e3..7ab25fa 100644
--- a/pillar/id/osc-collab2_infra_opensuse_org.sls
+++ b/pillar/id/osc-collab2_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage: 
     - osc-collab
-  roles:
-    - osc-collab
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +14,5 @@ grains:
     - dimstar
   partners: []
   weburls:
+roles:
+  - osc-collab
diff --git a/pillar/id/osc-collab_infra_opensuse_org.sls b/pillar/id/osc-collab_infra_opensuse_org.sls
index 01fbc4d..062c0f3 100644
--- a/pillar/id/osc-collab_infra_opensuse_org.sls
+++ b/pillar/id/osc-collab_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage: 
     - osc-collab
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +15,4 @@ grains:
   partners: []
   weburls:
     - https://osc-collab.opensuse.org/
+roles: []
diff --git a/pillar/id/pagure01_infra_opensuse_org.sls b/pillar/id/pagure01_infra_opensuse_org.sls
index 1f32a46..a468db3 100644
--- a/pillar/id/pagure01_infra_opensuse_org.sls
+++ b/pillar/id/pagure01_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - pagure
-  roles:
-    - pagure
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -21,3 +19,5 @@ grains:
     - https://pages.opensuse.org
     - https://releases.opensuse.org
     - https://ev.opensuse.org
+roles:
+  - pagure
diff --git a/pillar/id/paste_infra_opensuse_org.sls b/pillar/id/paste_infra_opensuse_org.sls
index 729e282..1035596 100644
--- a/pillar/id/paste_infra_opensuse_org.sls
+++ b/pillar/id/paste_infra_opensuse_org.sls
@@ -2,8 +2,6 @@ grains:
   city: nuremberg
   country: de
   hostusage: []
-  roles:
-  - paste
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +14,5 @@ grains:
   partners: []
   weburls:
     - paste.opensuse.org
+roles:
+  - paste
diff --git a/pillar/id/pinot_infra_opensuse_org.sls b/pillar/id/pinot_infra_opensuse_org.sls
index 75acc7d..7239e12 100644
--- a/pillar/id/pinot_infra_opensuse_org.sls
+++ b/pillar/id/pinot_infra_opensuse_org.sls
@@ -3,12 +3,6 @@ grains:
   country: de
   hostusage:
     - countdown.o.o, release-notes etc.
-  roles:
-    - countdown
-    - documentation
-    - mail_reminder
-    - phpmyadmin
-    - asknot
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -25,3 +19,9 @@ grains:
     - https://doc.opensuse.org/release-notes/
     - https://pmya.opensuse.org
     - https://contribute.opensuse.org/
+roles:
+  - countdown
+  - documentation
+  - mail_reminder
+  - phpmyadmin
+  - asknot
diff --git a/pillar/id/pontifex2_infra_opensuse_org.sls b/pillar/id/pontifex2_infra_opensuse_org.sls
index 9ef1b99..024a1ef 100644
--- a/pillar/id/pontifex2_infra_opensuse_org.sls
+++ b/pillar/id/pontifex2_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - download.o.o
-  roles:
-    - web_download
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -19,3 +17,5 @@ grains:
   weburls:
     - http://download.opensuse.org
     - https://download.opensuse.org
+roles:
+  - web_download
diff --git a/pillar/id/progress_infra_opensuse_org.sls b/pillar/id/progress_infra_opensuse_org.sls
index c890b45..5d116af 100644
--- a/pillar/id/progress_infra_opensuse_org.sls
+++ b/pillar/id/progress_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - progress.o.o
-  roles:
-    - web_progress
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -19,3 +17,5 @@ grains:
     - https://progress.opensuse.org
     - https://progress-test.opensuse.org
     - https://tickets.opensuse.org
+roles:
+  - web_progress
diff --git a/pillar/id/provo-galera1_infra_opensuse_org.sls b/pillar/id/provo-galera1_infra_opensuse_org.sls
index c1adb6b..3d12ad2 100644
--- a/pillar/id/provo-galera1_infra_opensuse_org.sls
+++ b/pillar/id/provo-galera1_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: us
   hostusage:
     - Galera node (MySQL)
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -22,3 +21,4 @@ grains:
     - provo-galera2.infra.opensuse.org
     - provo-galera3.infra.opensuse-org
   weburls: []
+roles: []
diff --git a/pillar/id/provo-galera2_infra_opensuse_org.sls b/pillar/id/provo-galera2_infra_opensuse_org.sls
index 85149a5..77e5099 100644
--- a/pillar/id/provo-galera2_infra_opensuse_org.sls
+++ b/pillar/id/provo-galera2_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: us
   hostusage:
     - Galera node (MySQL)
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -22,3 +21,4 @@ grains:
     - provo-galera1.infra.opensuse.org
     - provo-galera3.infra.opensuse-org
   weburls: []
+roles: []
diff --git a/pillar/id/provo-galera3_infra_opensuse_org.sls b/pillar/id/provo-galera3_infra_opensuse_org.sls
index 177c034..b535115 100644
--- a/pillar/id/provo-galera3_infra_opensuse_org.sls
+++ b/pillar/id/provo-galera3_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: us
   hostusage:
     - Galera node (MySQL)
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -22,3 +21,4 @@ grains:
     - provo-galera1.infra.opensuse.org
     - provo-galera2.infra.opensuse.org
   weburls: []
+roles: []
diff --git a/pillar/id/provo-gate_infra_opensuse_org.sls b/pillar/id/provo-gate_infra_opensuse_org.sls
index a21d987..439ab6f 100644
--- a/pillar/id/provo-gate_infra_opensuse_org.sls
+++ b/pillar/id/provo-gate_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: us
   hostusage:
     - gate.o.o
-  roles:
-    - openvpn
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -19,3 +17,5 @@ grains:
   partners:
     - scar.opensuse.org
   weburls: []
+roles:
+  - openvpn
diff --git a/pillar/id/provo-mirror_infra_opensuse_org.sls b/pillar/id/provo-mirror_infra_opensuse_org.sls
index efb33a6..378e184 100644
--- a/pillar/id/provo-mirror_infra_opensuse_org.sls
+++ b/pillar/id/provo-mirror_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: us
   hostusage:
     - mirror
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -20,3 +19,4 @@ grains:
   weburls:
     - http://provo-mirror.opensuse.org/
     - http://twsnapshot.opensuse.org/
+roles: []
diff --git a/pillar/id/provo-ns_infra_opensuse_org.sls b/pillar/id/provo-ns_infra_opensuse_org.sls
index 5c33aa8..c8579ab 100644
--- a/pillar/id/provo-ns_infra_opensuse_org.sls
+++ b/pillar/id/provo-ns_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: us
   hostusage:
     - DNS
-  roles: 
-    - dns
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -21,3 +19,5 @@ grains:
     - nue-ns2.infra.opensuse.org
     - qsc-ns3.infra.opensuse-org
   weburls: []
+roles:
+  - dns
diff --git a/pillar/id/provo-proxy1_infra_opensuse_org.sls b/pillar/id/provo-proxy1_infra_opensuse_org.sls
index b08cd48..f07247f 100644
--- a/pillar/id/provo-proxy1_infra_opensuse_org.sls
+++ b/pillar/id/provo-proxy1_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: us
   hostusage:
     - proxy
-  roles:
-    - proxy
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -17,3 +15,5 @@ grains:
   partners: []
   weburls:
     - https://proxy-prv1.opensuse.org
+roles:
+  - proxy
diff --git a/pillar/id/qsc-ns3_infra_opensuse_org.sls b/pillar/id/qsc-ns3_infra_opensuse_org.sls
index 67457c0..6da5eb3 100644
--- a/pillar/id/qsc-ns3_infra_opensuse_org.sls
+++ b/pillar/id/qsc-ns3_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de-qsc
   hostusage:
     - DNS
-  roles: 
-    - dns
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: slimhat
@@ -21,3 +19,5 @@ grains:
     - nue-ns2.infra.opensuse.org
     - provo-ns.infra.opensuse.org
   weburls: []
+roles:
+  - dns
diff --git a/pillar/id/redmine_infra_opensuse_org.sls b/pillar/id/redmine_infra_opensuse_org.sls
index c105b78..75c97b0 100644
--- a/pillar/id/redmine_infra_opensuse_org.sls
+++ b/pillar/id/redmine_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - progress.o.o
-  roles:
-    - web_progress
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -15,3 +13,5 @@ grains:
   responsible: []
   partners: []
   weburls: []
+roles:
+  - web_progress
diff --git a/pillar/id/riesling2_infra_opensuse_org.sls b/pillar/id/riesling2_infra_opensuse_org.sls
index 7485fd1..43f4ded 100644
--- a/pillar/id/riesling2_infra_opensuse_org.sls
+++ b/pillar/id/riesling2_infra_opensuse_org.sls
@@ -3,10 +3,6 @@ grains:
   country: us
   hostusage:
     - en.o.o (read-only)
-  roles:
-    - mysql
-    - wiki
-    - wiki_readonly
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -17,3 +13,7 @@ grains:
   responsible: []
   partners: []
   weburls: []
+roles:
+  - mysql
+  - wiki
+  - wiki_readonly
diff --git a/pillar/id/riesling3_infra_opensuse_org.sls b/pillar/id/riesling3_infra_opensuse_org.sls
index 8a46b68..6b2ab71 100644
--- a/pillar/id/riesling3_infra_opensuse_org.sls
+++ b/pillar/id/riesling3_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - wikis
-  roles:
-    - wiki
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +14,5 @@ grains:
     - cboltz
   partners: []
   weburls: []
+roles:
+  - wiki
diff --git a/pillar/id/riesling_infra_opensuse_org.sls b/pillar/id/riesling_infra_opensuse_org.sls
index d050dc1..ecd4914 100644
--- a/pillar/id/riesling_infra_opensuse_org.sls
+++ b/pillar/id/riesling_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - en.o.o (all *.o.o wikis)
-  roles:
-    - wiki
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -23,3 +21,5 @@ grains:
     - https://$lang.opensuse.org
     - https://languages.opensuse.org
     - https://files.opensuse.org
+roles:
+  - wiki
diff --git a/pillar/id/scar_infra_opensuse_org.sls b/pillar/id/scar_infra_opensuse_org.sls
index 3d66aec..065cb9b 100644
--- a/pillar/id/scar_infra_opensuse_org.sls
+++ b/pillar/id/scar_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - gate.o.o
-  roles:
-    - openvpn
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -21,3 +19,5 @@ grains:
     - rklein
   partners: []
   weburls: []
+roles:
+  - openvpn
diff --git a/pillar/id/slimhat_infra_opensuse_org.sls b/pillar/id/slimhat_infra_opensuse_org.sls
index 96038f6..0753814 100644
--- a/pillar/id/slimhat_infra_opensuse_org.sls
+++ b/pillar/id/slimhat_infra_opensuse_org.sls
@@ -1,8 +1,6 @@
 grains:
   city: QSC-nuremberg
   country: de-qsc
-  roles:
-    - firewall
   hostusage:
     - IPMI access
   reboot_safe: yes
@@ -77,3 +75,5 @@ firewalld:
       short: Work
     trusted:
       short: Trusted
+roles:
+  - firewall
diff --git a/pillar/id/status1_opensuse_org.sls b/pillar/id/status1_opensuse_org.sls
index bc6cdfc..5915c02 100644
--- a/pillar/id/status1_opensuse_org.sls
+++ b/pillar/id/status1_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - status
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -19,3 +18,4 @@ grains:
   weburls:
     - https://status.opensuse.org
     - https://status1.opensuse.org
+roles: []
diff --git a/pillar/id/status2_opensuse_org.sls b/pillar/id/status2_opensuse_org.sls
index c57b756..5d3dee1 100644
--- a/pillar/id/status2_opensuse_org.sls
+++ b/pillar/id/status2_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: us
   hostusage:
     - status
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -18,3 +17,4 @@ grains:
     - status1.opensuse.org
   weburls:
     - https://status2.opensuse.org
+roles: []
diff --git a/pillar/id/svn_infra_opensuse_org.sls b/pillar/id/svn_infra_opensuse_org.sls
index 822deab..fb226a8 100644
--- a/pillar/id/svn_infra_opensuse_org.sls
+++ b/pillar/id/svn_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de
   hostusage:
     - svn_git
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +15,4 @@ grains:
   partners: []
   weburls:
     - https://svn.opensuse.org/
+roles: []
diff --git a/pillar/id/tsp_infra_opensuse_org.sls b/pillar/id/tsp_infra_opensuse_org.sls
index 5316657..5c4df1c 100644
--- a/pillar/id/tsp_infra_opensuse_org.sls
+++ b/pillar/id/tsp_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - Travel Support Program webapp
-  roles:
-    - web_tsp
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -19,3 +17,5 @@ grains:
   partners: []
   weburls: 
     - https://tsp.opensuse.org
+roles:
+  - web_tsp
diff --git a/pillar/id/water2_infra_opensuse_org.sls b/pillar/id/water2_infra_opensuse_org.sls
index 17a7d85..da316ff 100644
--- a/pillar/id/water2_infra_opensuse_org.sls
+++ b/pillar/id/water2_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: us
   hostusage:
     - en.o.o wiki search backend
-  roles:
-    - wikisearch
   reboot_safe: unknown
   salt_cluster: opensuse
   virt_cluster: bryce
@@ -15,3 +13,5 @@ grains:
   responsible: []
   partners: []
   weburls: []
+roles:
+  - wikisearch
diff --git a/pillar/id/water3_infra_opensuse_org.sls b/pillar/id/water3_infra_opensuse_org.sls
index 6a02263..46e5439 100644
--- a/pillar/id/water3_infra_opensuse_org.sls
+++ b/pillar/id/water3_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - en.o.o search backend
-  roles:
-    - wikisearch
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +14,5 @@ grains:
     - cboltz
   partners: []
   weburls: []
+roles:
+  - wikisearch
diff --git a/pillar/id/water4_infra_opensuse_org.sls b/pillar/id/water4_infra_opensuse_org.sls
index d9c9b0c..f041a2c 100644
--- a/pillar/id/water4_infra_opensuse_org.sls
+++ b/pillar/id/water4_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - wiki search backend
-  roles:
-    - wikisearch
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -16,3 +14,5 @@ grains:
     - cboltz
   partners: []
   weburls: []
+roles:
+  - wikisearch
diff --git a/pillar/id/water_infra_opensuse_org.sls b/pillar/id/water_infra_opensuse_org.sls
index 6c52169..f836946 100644
--- a/pillar/id/water_infra_opensuse_org.sls
+++ b/pillar/id/water_infra_opensuse_org.sls
@@ -3,8 +3,6 @@ grains:
   country: de
   hostusage:
     - en.o.o search backend
-  roles:
-    - wikisearch
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: atreju
@@ -17,3 +15,5 @@ grains:
     - cboltz
   partners: []
   weburls: []
+roles:
+  - wikisearch
diff --git a/pillar/id/widehat_infra_opensuse_org.sls b/pillar/id/widehat_infra_opensuse_org.sls
index ef9c0b6..8886862 100644
--- a/pillar/id/widehat_infra_opensuse_org.sls
+++ b/pillar/id/widehat_infra_opensuse_org.sls
@@ -3,7 +3,6 @@ grains:
   country: de-qsc
   hostusage:
     - rsync.o.o
-  roles: []
   reboot_safe: yes
   salt_cluster: opensuse
   virt_cluster: bare-metal
@@ -17,3 +16,4 @@ grains:
     - rklein
   partners: []
   weburls: []
+roles: []
diff --git a/pillar/salt_cluster/opensuse.sls b/pillar/salt_cluster/opensuse.sls
index 1aef050..5f58c50 100644
--- a/pillar/salt_cluster/opensuse.sls
+++ b/pillar/salt_cluster/opensuse.sls
@@ -7,7 +7,7 @@ chrony:
    - ntp{{ n+1 }}.infra.opensuse.org
    {% endif %}
    {% endfor %}
-{% if 'ntp' not in salt['grains.get']('roles' ,[]) %}
+{% if salt['grains.get']('configure_ntp', True) %}
 ntp:
   ng:
     settings:
diff --git a/pillar/top.sls b/pillar/top.sls
index 15b65d9..3028a0d 100644
--- a/pillar/top.sls
+++ b/pillar/top.sls
@@ -1,19 +1,16 @@
-{% set id = salt['grains.get']('id') %}
-{% set osfullname = salt['grains.get']('osfullname') %}
-{% set roles = salt['grains.get']('roles', []) %}
-{% set salt_cluster = salt['grains.get']('salt_cluster') %}
-{% set virtual = salt['grains.get']('virtual') %}
-{% set virt_cluster = salt['grains.get']('virt_cluster') %}
+{%- set id = salt['grains.get']('id') -%}
+{%- set id_subst = id.replace('.', '_') -%}
+{%- set pillar_id = '/srv/pillar/id/' ~ id_subst ~ '.sls' %}
+{%- set idstruct = salt['slsutil.renderer'](pillar_id) %}
+{%- set roles = idstruct.get('roles', []) %}
+{%- set osfullname = salt['grains.get']('osfullname') -%}
+{%- set salt_cluster = salt['grains.get']('salt_cluster') -%}
+{%- set virtual = salt['grains.get']('virtual') -%}
+{%- set virt_cluster = salt['grains.get']('virt_cluster') -%}
 
 {{ saltenv }}:
   '*':
     - common
-  {% for role in roles %}
-  'roles:{{ role }}':
-    - match: grain
-    - ignore_missing: True
-    - role.{{ role }}
-  {% endfor %}
   'virtual:{{ virtual }}':
     - match: grain
     - virtual.{{ virtual }}
@@ -32,4 +29,8 @@
     - virt_cluster.{{ virt_cluster }}
   {% endif %}
   '{{ id }}':
-    - id.{{ id.replace('.', '_') }}
+    - id.{{ id_subst }}
+  {%- for role in roles %}
+    - role.{{ role }}
+  {%- endfor %}
+
diff --git a/salt/profile/jekyll/user.sls b/salt/profile/jekyll/user.sls
index 1b792d1..9052231 100644
--- a/salt/profile/jekyll/user.sls
+++ b/salt/profile/jekyll/user.sls
@@ -1,4 +1,4 @@
-{% set roles = salt['grains.get']('roles', []) %}
+{% set roles = salt['pillar.get']('roles', []) %}
 
 web_jekyll:
     user.present:
diff --git a/salt/profile/log/init.sls b/salt/profile/log/init.sls
index 8f9e0ca..a8e04c5 100644
--- a/salt/profile/log/init.sls
+++ b/salt/profile/log/init.sls
@@ -1,5 +1,5 @@
 {% set osmajorrelease = salt['grains.get']('osmajorrelease') %}
-{% set roles = salt['grains.get']('roles', []) %}
+{% set roles = salt['pillar.get']('roles', []) %}
 
 include:
   - rsyslog
diff --git a/salt/profile/static/user.sls b/salt/profile/static/user.sls
index 9c052f3..0f2028a 100644
--- a/salt/profile/static/user.sls
+++ b/salt/profile/static/user.sls
@@ -1,4 +1,4 @@
-{% set roles = salt['grains.get']('roles', []) %}
+{% set roles = salt['pillar.get']('roles', []) %}
 
 web_static:
     user.present:
diff --git a/salt/top.sls b/salt/top.sls
index d4e36c6..7d5a62b 100644
--- a/salt/top.sls
+++ b/salt/top.sls
@@ -1,10 +1,11 @@
-{% set roles = salt['grains.get']('roles', []) %}
+{% set roles = salt['pillar.get']('roles', []) %}
 
 {{ saltenv }}:
   '*':
     - role.base
-  {% for role in roles %}
-  'roles:{{ role }}':
-    - match: grain
+  {%- if roles | length %}
+  '{{ grains['id'] }}':
+  {%- for role in roles %}
     - role.{{ role }}
-  {% endfor %}
+  {%- endfor %}
+  {%- endif %}