diff --git a/defaults/main.yml b/defaults/main.yml
index b57fd3ff..39009040 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -16,6 +16,11 @@
 ## Verbosity Options
 debug: False
 
+# Set the host which will execute the shade modules
+# for the service setup. The host must already have
+# clouds.yaml properly configured.
+horizon_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}"
+
 # Set the package install state for distribution and pip packages
 # Options are 'present' and 'latest'
 horizon_package_state: "latest"
@@ -203,7 +208,7 @@ horizon_launch_instance_defaults:
   disable_volume_snapshot: False
   create_volume: True
 
-## Ironic UI Panel
+## horizon UI Panel
 horizon_enable_ironic_ui: False
 
 ## Magnum UI Panel
@@ -287,12 +292,6 @@ horizon_listen_ports:
   - "80"
   - "443"
 
-# horizon packages that must be installed before anything else
-horizon_requires_pip_packages:
-  - virtualenv
-  - python-keystoneclient # Keystoneclient needed to OSA keystone lib
-  - httplib2
-
 horizon_pip_packages:
   - cryptography
   - django-appconf
diff --git a/meta/main.yml b/meta/main.yml
index eb23df8a..87f080ff 100644
--- a/meta/main.yml
+++ b/meta/main.yml
@@ -42,4 +42,3 @@ dependencies:
     when:
       - ansible_pkg_mgr == 'apt'
   - galera_client
-  - openstack_openrc
diff --git a/releasenotes/notes/horizon-service-setup-host-9728b772d2514dd9.yaml b/releasenotes/notes/horizon-service-setup-host-9728b772d2514dd9.yaml
new file mode 100644
index 00000000..c3cdddbf
--- /dev/null
+++ b/releasenotes/notes/horizon-service-setup-host-9728b772d2514dd9.yaml
@@ -0,0 +1,17 @@
+---
+features:
+  - |
+    The service setup in keystone for horizon will now be executed
+    through delegation to the ``horizon_service_setup_host`` which,
+    by default, is ``localhost`` (the deploy host). Deployers can
+    opt to rather change this to the utility container by implementing
+    the following override in ``user_variables.yml``.
+
+    .. code-block:: yaml
+
+      horizon_service_setup_host: "{{ groups['utility_all'][0] }}"
+
+deprecations:
+  - |
+    The variable ``horizon_requires_pip_packages`` is no longer required
+    and has therefore been removed.
diff --git a/tasks/horizon_install.yml b/tasks/horizon_install.yml
index f1bcc7b0..1322f470 100644
--- a/tasks/horizon_install.yml
+++ b/tasks/horizon_install.yml
@@ -57,18 +57,6 @@
       {% endfor %}
   when: horizon_developer_mode | bool
 
-- name: Install requires pip packages
-  pip:
-    name: "{{ horizon_requires_pip_packages }}"
-    state: "{{ horizon_pip_package_state }}"
-    extra_args: >-
-      {{ (pip_install_upper_constraints is defined) | ternary('--constraint ' + pip_install_upper_constraints | default(''),'') }}
-      {{ pip_install_options | default('') }}
-  register: install_packages
-  until: install_packages|success
-  retries: 5
-  delay: 2
-
 - name: Retrieve checksum for venv download
   uri:
     url: "{{ horizon_venv_download_url | replace('tgz', 'checksum') }}"
diff --git a/tasks/horizon_service_setup.yml b/tasks/horizon_service_setup.yml
index 8c6fd5ae..f19e3edd 100644
--- a/tasks/horizon_service_setup.yml
+++ b/tasks/horizon_service_setup.yml
@@ -13,25 +13,31 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-
-# Add the default user role
-- name: Ensure default keystone user role
-  keystone:
-    command: "ensure_role"
-    endpoint: "{{ keystone_service_adminurl }}"
-    login_user: "{{ keystone_admin_user_name }}"
-    login_password: "{{ keystone_auth_admin_password }}"
-    login_project_name: "{{ keystone_admin_tenant_name }}"
-    role_name: "{{ horizon_default_role_name }}"
-    insecure: "{{ keystone_service_adminuri_insecure }}"
-  when:
-    - keystone_admin_user_name is defined
-    - keystone_auth_admin_password is defined
-    - keystone_admin_tenant_name is defined
-    - keystone_service_adminurl is defined
-    - keystone_service_adminuri_insecure is defined
-  register: add_member_role
-  no_log: true
-  until: add_member_role|success
-  retries: 5
-  delay: 10
+# We set the python interpreter to the ansible runtime venv if
+# the delegation is to localhost so that we get access to the
+# appropriate python libraries in that venv. If the delegation
+# is to another host, we assume that it is accessible by the
+# system python instead.
+- name: Setup the default member role
+  delegate_to: "{{ horizon_service_setup_host }}"
+  vars:
+    ansible_python_interpreter: >-
+      {{ (horizon_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_python['executable']) }}
+  block:
+    - name: Add default member role
+      os_keystone_role:
+        cloud: default
+        state: present
+        name: "{{ horizon_default_role_name }}"
+        endpoint_type: admin
+        verify: "{{ not keystone_service_adminuri_insecure }}"
+      when:
+        - keystone_admin_user_name is defined
+        - keystone_auth_admin_password is defined
+        - keystone_admin_tenant_name is defined
+        - keystone_service_adminurl is defined
+        - keystone_service_adminuri_insecure is defined
+      register: add_member_role
+      until: add_member_role is success
+      retries: 5
+      delay: 10
diff --git a/tests/host_vars/localhost.yml b/tests/host_vars/localhost.yml
index 65ddeaa0..6c26f31a 100644
--- a/tests/host_vars/localhost.yml
+++ b/tests/host_vars/localhost.yml
@@ -15,5 +15,3 @@
 
 bridges:
   - "br-mgmt"
-
-ansible_python_interpreter: "/usr/bin/python2"