diff --git a/src/com/mirantis/mcp/UpgradeChecks.groovy b/src/com/mirantis/mcp/UpgradeChecks.groovy
index 60ab9a6..c9b0192 100644
--- a/src/com/mirantis/mcp/UpgradeChecks.groovy
+++ b/src/com/mirantis/mcp/UpgradeChecks.groovy
@@ -139,8 +139,9 @@
 
 def check_36461_2 (salt, venvPepper, String cluster_name, Boolean raise_exc) {
     def cephMonPillar = salt.getPillar(venvPepper, 'I@ceph:mon', 'ceph:common:config:mon:auth_allow_insecure_global_id_reclaim').get("return")[0].values()[0]
+    def cephVersion = salt.getPillar(venvPepper, 'I@ceph:mon', 'ceph:common:version').get("return")[0].values()[0]
     def waStatus = [prodId: "PROD-36461_2", isFixed: "", waInfo: ""]
-    if (cephMonPillar.toString().toLowerCase() != 'false') {
+    if (cephMonPillar.toString().toLowerCase() != 'false' && cephVersion.toString().toLowerCase() == 'nautilus') {
         waStatus.isFixed = "Work-around should be applied manually"
         waStatus.waInfo = "See https://docs.mirantis.com/mcp/q4-18/mcp-release-notes/single/index.html#i-cve-2021-20288 for more info"
         if (raise_exc) {
diff --git a/src/com/mirantis/mk/Openstack.groovy b/src/com/mirantis/mk/Openstack.groovy
index 8568ad4..f552fc3 100644
--- a/src/com/mirantis/mk/Openstack.groovy
+++ b/src/com/mirantis/mk/Openstack.groovy
@@ -578,3 +578,104 @@
     common.warningMsg("restoreGaleraDb method was moved to Galera class. Please change your calls accordingly.")
     return galera.restoreGaleraDb(env)
 }
+
+/**
+ * create connection to OpenStack API endpoint via Docker
+ *
+ * @param authUrl         OpenStack API endpoint address
+ * @param credentialsId   Credentials to the OpenStack API
+ * @param project         OpenStack project to connect to
+ */
+def createOpenstackEnvInDocker(authUrl, credentialsId, project, project_domain="default", project_id="", user_domain="default", cacert="/etc/ssl/certs/ca-certificates.crt") {
+    def common = new com.mirantis.mk.Common()
+    creds = common.getPasswordCredentials(credentialsId)
+    def env = ["OS_USERNAME=${creds.username}", "OS_PASSWORD=${creds.password.toString()}", "OS_TENANT_NAME=${project}", "OS_AUTH_URL=${authUrl}", "OS_AUTH_STRATEGY=keystone -e OS_PROJECT_NAME=${project}", "OS_PROJECT_ID=${project_id}", "OS_PROJECT_DOMAIN_ID=${project_domain}", "OS_USER_DOMAIN_NAME=${user_domain}", "OS_CACERT=${cacert}"]
+    return env
+}
+
+/**
+ * prepare Docker docker image for OpenstackEnv
+ *
+ * @param credentials     Credentials for access to artifact-metadata repo
+ * @param release         Optional openstack release for image
+ * @param img             Optional URL for Docker image 
+ */
+def prepareOpenstackDockerImage(credentialsId, release=null, img=null) {
+    def common = new com.mirantis.mk.Common()
+    Map getMetadataParams = ['metadataCredentialsId': credentialsId]
+    if (!img) {
+        if (!release) {
+            release = 'ussuri'
+        }
+        def releaseWorkflow = new com.mirantis.mk.ReleaseWorkflow()
+        img = releaseWorkflow.getReleaseMetadataValue("images:openstack:${release}:heat:url", getMetadataParams).replace('"', '')
+    }
+    common.infoMsg("Use image ${img}")
+    return img
+}
+
+/**
+ * create connection to OpenStack API endpoint in the Docker container
+ *
+ * @param cmd    Command to be executed
+ * @param env    Environmental parameters with endpoint credentials (from createOpenstackEnvInDocker)
+ * @param img    Docker image for container (from prepareOpenstackDockerImage)
+ */
+def runOpenstackCommandInDocker(cmd, env, img) {
+    def dockerImg = docker.image(img)
+    def result
+    dockerImg.inside() {
+        withEnv(env) {
+            result = sh(script: "${cmd}", returnStdout: true).trim()
+        }
+    }
+    return result
+}
+
+/**
+ * Delete nova key pair
+ *
+ * @param env          Connection parameters for OpenStack API endpoint
+ * @param name         Name of the key pair to delete
+ */
+def deleteKeyPairInDocker(env, name, img) {
+    def common = new com.mirantis.mk.Common()
+    common.infoMsg("Removing key pair ${name}")
+    def cmd = "openstack keypair delete ${name}"
+    runOpenstackCommandInDocker(cmd, env, img)
+}
+
+/**
+ * Check if Nova keypair exists and delete it.
+ *
+ * @param env          Connection parameters for OpenStack API endpoint
+ * @param name         Name of the key pair to delete
+**/
+def ensureKeyPairRemovedInDocker(String name, env, img) {
+    def common = new com.mirantis.mk.Common()
+    def keypairs = runOpenstackCommandInDocker("openstack keypair list -f value -c Name", env, img).tokenize('\n')
+    if (name in keypairs) {
+        deleteKeyPairInDocker(env, name, img)
+        common.infoMsg("Keypair ${name} has been deleted")
+    } else {
+        common.warningMsg("Keypair ${name} not found")
+    }
+}
+
+/**
+ * Get nova key pair
+ *
+ * @param env          Connection parameters for OpenStack API endpoint
+ * @param name         Name of the key pair to show
+ */
+def getKeyPairInDocker(env, name, img) {
+    def common = new com.mirantis.mk.Common()
+    def cmd = "openstack keypair show ${name}"
+    def outputTable
+    try {
+        outputTable = runOpenstackCommandInDocker(cmd, env, img)
+    } catch (Exception e) {
+        common.infoMsg("Key pair ${name} not found")
+    }
+    return outputTable
+}
diff --git a/src/com/mirantis/mk/Python.groovy b/src/com/mirantis/mk/Python.groovy
index 9c9bf88..8f934c0 100644
--- a/src/com/mirantis/mk/Python.groovy
+++ b/src/com/mirantis/mk/Python.groovy
@@ -484,13 +484,13 @@
  * @param url SALT_MASTER_URL
  * @param credentialsId Credentials to salt api
  */
-def setupPepperVirtualenv(path, url, credentialsId) {
+def setupPepperVirtualenv(path, url, credentialsId, python_version = 'python2', useSystemPackages = true) {
     def common = new com.mirantis.mk.Common()
 
     // virtualenv setup
     // pin pepper till https://mirantis.jira.com/browse/PROD-18188 is fixed
     requirements = ['salt-pepper>=0.5.2,<0.5.4']
-    setupVirtualenv(path, 'python2', requirements, null, true, true)
+    setupVirtualenv(path, python_version, requirements, null, true, useSystemPackages)
 
     // pepperrc creation
     rcFile = "${path}/pepperrc"