diff --git a/pkg/manager/component/component.go b/pkg/manager/component/component.go
index 9ecc2feab..c84c40e5d 100644
--- a/pkg/manager/component/component.go
+++ b/pkg/manager/component/component.go
@@ -35,7 +35,6 @@ import (
 	"k8s.io/client-go/tools/cache"
 	"k8s.io/klog"
 
-	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
 	errorswrap "yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/utils"
@@ -49,6 +48,7 @@ import (
 	"yunion.io/x/onecloud-operator/pkg/manager"
 	"yunion.io/x/onecloud-operator/pkg/service-init/component"
 	"yunion.io/x/onecloud-operator/pkg/util/k8sutil"
+	"yunion.io/x/onecloud-operator/pkg/util/onecloud"
 )
 
 type ComponentManager struct {
@@ -638,7 +638,7 @@ func (m *ComponentManager) newConfigMap(componentType v1alpha1.ComponentType, zo
 }
 
 func (m *ComponentManager) newServiceConfigMap(cType v1alpha1.ComponentType, zone string, oc *v1alpha1.OnecloudCluster, opt interface{}) *corev1.ConfigMap {
-	configYaml := jsonutils.Marshal(opt).YAMLString()
+	configYaml := onecloud.GetConfig(opt).YAMLString()
 	return m.newConfigMap(cType, zone, oc, configYaml)
 }
 
diff --git a/pkg/service-init/component/prepare.go b/pkg/service-init/component/prepare.go
index 1e69aad19..ee3a8272e 100644
--- a/pkg/service-init/component/prepare.go
+++ b/pkg/service-init/component/prepare.go
@@ -14,6 +14,7 @@ import (
 	"yunion.io/x/onecloud-operator/pkg/controller"
 	"yunion.io/x/onecloud-operator/pkg/manager/config"
 	"yunion.io/x/onecloud-operator/pkg/service-init/cluster"
+	"yunion.io/x/onecloud-operator/pkg/util/onecloud"
 )
 
 type PrepareManager interface {
@@ -283,7 +284,7 @@ func (m *prepareManager) syncComponentConfig(
 	case string:
 		optContent = opt.(string)
 	default:
-		optContent = jsonutils.Marshal(opt).YAMLString()
+		optContent = onecloud.GetConfig(opt).YAMLString()
 	}
 	if err := os.WriteFile(
 		cfgFilePath,
diff --git a/pkg/util/onecloud/onecloud.go b/pkg/util/onecloud/onecloud.go
index 7fcd48ddb..dd3421755 100644
--- a/pkg/util/onecloud/onecloud.go
+++ b/pkg/util/onecloud/onecloud.go
@@ -16,6 +16,7 @@ package onecloud
 
 import (
 	"net/http"
+	"reflect"
 	"strings"
 
 	"golang.org/x/sync/errgroup"
@@ -24,9 +25,11 @@ import (
 	"yunion.io/x/log"
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/httputils"
+	"yunion.io/x/pkg/utils"
 
 	ansibleapi "yunion.io/x/onecloud/pkg/apis/ansible"
 	devtoolapi "yunion.io/x/onecloud/pkg/apis/devtool"
+	identityapi "yunion.io/x/onecloud/pkg/apis/identity"
 	monitorapi "yunion.io/x/onecloud/pkg/apis/monitor"
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/onecloud/pkg/mcclient/modulebase"
@@ -888,3 +891,22 @@ func EnsureAgentAnsiblePlaybookRef(s *mcclient.ClientSession) error {
 	}
 	return nil
 }
+
+func GetConfig(opt interface{}) jsonutils.JSONObject {
+	config := jsonutils.Marshal(opt)
+	options, ok := config.(*jsonutils.JSONDict)
+	if !ok {
+		return config
+	}
+	rv := reflect.Indirect(reflect.ValueOf(opt))
+	if !(rv.FieldByName("CommonOptions").IsValid() ||
+		(rv.FieldByName("DBOptions").IsValid() && rv.FieldByName("BaseOptions").IsValid())) { // keystone
+		return config
+	}
+	for _, k := range options.SortedKeys() {
+		if !utils.IsInArray(k, identityapi.ServiceBlacklistOptionMap["default"]) {
+			options.Remove(k)
+		}
+	}
+	return options
+}