diff --git a/Dockerfile b/Dockerfile
index 94afd9e..b0c5587 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,6 +11,8 @@
 ARG MANILA_TAG="mcp/pike"
 ARG TELEMETRY_TAG="mcp/pike"
 ARG OCTAVIA_TAG="mcp/pike"
+ARG PATROLE_TAG="0.4.x"
+ARG TUNGSTEN_TAG="0.1.x"
 # global openstack requirements repo
 # This is the commit where tempest version is 17.2.0 in u-c
 ARG UPPER_CONSTRAINTS_TAG="83b1de74834fbcdbe749e270c29e76cdc28f85d5"
@@ -87,6 +89,16 @@
     pip install --constraint /var/lib/openstack_requirements/upper-constraints.txt -r requirements.txt . ; \
     popd;
 
+RUN git clone ssh://mcp-jenkins@gerrit.mcp.mirantis.com:29418/packaging/sources/patrole patrole-tempest-plugin ; \
+    pushd /var/lib/patrole-tempest-plugin; git checkout $PATROLE_TAG; \
+    pip install --constraint /var/lib/openstack_requirements/upper-constraints.txt -r requirements.txt . ; \
+    popd;
+
+RUN git clone ssh://mcp-jenkins@gerrit.mcp.mirantis.com:29418/contrail/tungsten-tempest tungsten-tempest-plugin ; \
+    pushd /var/lib/tungsten-tempest-plugin; git checkout $TUNGSTEN_TAG; \
+    pip install --constraint /var/lib/openstack_requirements/upper-constraints.txt -r requirements.txt . ; \
+    popd;
+
 RUN git clone ssh://mcp-jenkins@gerrit.mcp.mirantis.com:29418/packaging/sources/tempest && \
     pushd tempest; git checkout $TEMPEST_TAG; \
     pip install --constraint /var/lib/openstack_requirements/upper-constraints.txt -r requirements.txt ; \
@@ -114,6 +126,7 @@
 #
 COPY bin/entrypoint.sh /usr/bin/entrypoint.sh
 COPY bin/run_tempest.sh /usr/bin/run-tempest
+COPY bin/opencontrail/policy.json /etc/opencontrail/policy.json
 
 ENV LOG_DIR='/root/tempest'
 
diff --git a/bin/opencontrail/policy.json b/bin/opencontrail/policy.json
new file mode 100644
index 0000000..c2ab0ab
--- /dev/null
+++ b/bin/opencontrail/policy.json
@@ -0,0 +1,294 @@
+{
+    "list_api_access_lists": "role:admin",
+    "create_api_access_lists": "role:admin",
+    "show_api_access_list": "role:admin",
+    "update_api_access_list": "role:admin",
+    "delete_api_access_list": "role:admin",
+    "list_access_control_lists": "role:admin",
+    "create_access_control_lists": "role:admin",
+    "show_access_control_list": "role:admin",
+    "update_access_control_list": "role:admin",
+    "delete_access_control_list": "role:admin",
+    "list_alarms": "role:admin",
+    "create_alarms": "role:admin",
+    "show_alarm": "role:admin",
+    "update_alarm": "role:admin",
+    "delete_alarm": "role:admin",
+    "list_alias_ips": "role:admin",
+    "create_alias_ips": "role:admin",
+    "show_alias_ip": "role:admin",
+    "update_alias_ip": "role:admin",
+    "delete_alias_ip": "role:admin",
+    "list_alias_ip_pools": "role:admin",
+    "create_alias_ip_pools": "role:admin",
+    "show_alias_ip_pool": "role:admin",
+    "update_alias_ip_pool": "role:admin",
+    "delete_alias_ip_pool": "role:admin",
+    "list_analytics_nodes": "role:admin",
+    "show_analytics_node": "role:admin",
+    "create_analytics_nodes": "role:admin",
+    "update_analytics_node": "role:admin",
+    "delete_analytics_node": "role:admin",
+    "list_provider_attachments": "role:admin",
+    "create_provider_attachments": "role:admin",
+    "show_provider_attachment": "role:admin",
+    "update_provider_attachment": "role:admin",
+    "delete_provider_attachment": "role:admin",
+    "list_customer_attachments": "role:admin",
+    "create_customer_attachments": "role:admin",
+    "show_customer_attachment": "role:admin",
+    "update_customer_attachment": "role:admin",
+    "delete_customer_attachment": "role:admin",
+    "list_bgp_as_a_services": "role:admin",
+    "create_bgp_as_a_services": "role:admin",
+    "show_bgp_as_a_service": "role:admin",
+    "delete_bgp_as_a_service": "role:admin",
+    "update_bgp_as_a_service": "role:admin",
+    "list_config_nodes": "role:admin",
+    "create_config_nodes": "role:admin",
+    "delete_config_node": "role:admin",
+    "show_config_node": "role:admin",
+    "update_config_node": "role:admin",
+    "create_config_roots": "role:admin",
+    "delete_config_root": "role:admin",
+    "show_config_root": "role:admin",
+    "update_config_root": "role:admin",
+    "list_config_roots": "role:admin",
+    "list_global_system_configs": "role:admin",
+    "create_global_system_configs": "role:admin",
+    "show_global_system_config": "role:admin",
+    "update_global_system_config": "role:admin",
+    "delete_global_system_config": "role:admin",
+    "list_database_nodes": "role:admin",
+    "show_database_node": "role:admin",
+    "create_database_nodes": "role:admin",
+    "update_database_node": "role:admin",
+    "delete_database_node": "role:admin",
+    "list_discovery_service_assignments": "role:admin",
+    "create_discovery_service_assignments": "role:admin",
+    "show_discovery_service_assignment": "role:admin",
+    "update_discovery_service_assignment": "role:admin",
+    "delete_discovery_service_assignment": "role:admin",
+    "list_domains": "role:admin",
+    "create_domains": "role:admin",
+    "show_domain": "role:admin",
+    "update_domain": "role:admin",
+    "delete_domain": "role:admin",
+    "list_dsa_rules": "role:admin",
+    "show_dsa_rule": "role:admin",
+    "create_dsa_rules": "role:admin",
+    "update_dsa_rule": "role:admin",
+    "delete_dsa_rule": "role:admin",
+    "create_floating_ip_pools": "role:admin",
+    "list_floating_ip_pools": "role:admin",
+    "show_floating_ip_pool": "role:admin",
+    "update_floating_ip_pool": "role:admin",
+    "delete_floating_ip_pool": "role:admin",
+    "create_floating_ips": "role:admin",
+    "list_floating_ips": "role:admin",
+    "show_floating_ip": "role:admin",
+    "update_floating_ip": "role:admin",
+    "delete_floating_ip": "role:admin",
+    "list_forwarding_classs": "role:admin",
+    "show_forwarding_class": "role:admin",
+    "create_forwarding_classs": "role:admin",
+    "update_forwarding_class": "role:admin",
+    "delete_forwarding_class": "role:admin",
+    "fqname_to_id": "role:admin",
+    "id_to_fqname": "role:admin",
+    "list_instance_ips": "role:admin",
+    "create_instance_ips": "role:admin",
+    "show_instance_ip": "role:admin",
+    "update_instance_ip": "role:admin",
+    "delete_instance_ip": "role:admin",
+    "list_physical_interfaces": "role:admin",
+    "create_physical_interfaces": "role:admin",
+    "update_physical_interface": "role:admin",
+    "delete_physical_interface": "role:admin",
+    "show_physical_interface": "role:admin",
+    "list_logical_interfaces": "role:admin",
+    "create_logical_interfaces": "role:admin",
+    "update_logical_interface": "role:admin",
+    "delete_logical_interface": "role:admin",
+    "show_logical_interface": "role:admin",
+    "list_load_balancers": "role:admin",
+    "create_load_balancers": "role:admin",
+    "show_load_balancer": "role:admin",
+    "update_load_balancer": "role:admin",
+    "delete_load_balancer": "role:admin",
+    "list_load_balancer_health_monitors": "role:admin",
+    "create_load_balancer_health_monitors": "role:admin",
+    "show_load_balancer_health_monitor": "role:admin",
+    "update_load_balancer_health_monitor": "role:admin",
+    "delete_load_balancer_health_monitor": "role:admin",
+    "list_load_balancer_listeners": "role:admin",
+    "create_load_balancer_listeners": "role:admin",
+    "show_load_balancer_listener": "role:admin",
+    "update_load_balancer_listener": "role:admin",
+    "delete_load_balancer_listener": "role:admin",
+    "list_load_balancer_pools": "role:admin",
+    "create_load_balancer_pools": "role:admin",
+    "show_load_balancer_pool": "role:admin",
+    "update_load_balancer_pool": "role:admin",
+    "delete_load_balancer_pool": "role:admin",
+    "list_load_balancer_members": "role:admin",
+    "create_load_balancer_members": "role:admin",
+    "show_load_balancer_member": "role:admin",
+    "update_load_balancer_member": "role:admin",
+    "delete_load_balancer_member": "role:admin",
+    "list_namespaces": "role:admin",
+    "create_namespaces": "role:admin",
+    "show_namespace": "role:admin",
+    "update_namespace": "role:admin",
+    "delete_namespace": "role:admin",
+    "list_network_ipams": "role:admin",
+    "create_network_ipams": "role:admin",
+    "show_network_ipam": "role:admin",
+    "delete_network_ipam": "role:admin",
+    "update_network_ipam": "role:admin",
+    "list_network_policys": "role:admin",
+    "create_network_policys": "role:admin",
+    "show_network_policy": "role:admin",
+    "update_network_policy": "role:admin",
+    "delete_network_policy": "role:admin",
+    "list_port_tuples": "role:admin",
+    "show_port_tuple": "role:admin",
+    "create_port_tuples": "role:admin",
+    "update_port_tuple": "role:admin",
+    "delete_port_tuple": "role:admin",
+    "list_projects": "role:admin",
+    "create_projects": "role:admin",
+    "show_project": "role:admin",
+    "update_project": "role:admin",
+    "delete_project": "role:admin",
+    "list_qos_configs": "role:admin",
+    "create_qos_configs": "role:admin",
+    "show_qos_config": "role:admin",
+    "delete_qos_config": "role:admin",
+    "update_qos_config": "role:admin",
+    "list_global_qos_configs": "role:admin",
+    "create_global_qos_configs": "role:admin",
+    "show_global_qos_config": "role:admin",
+    "update_global_qos_config": "role:admin",
+    "delete_global_qos_config": "role:admin",
+    "list_qos_queues": "role:admin",
+    "create_qos_queues": "role:admin",
+    "show_qos_queue": "role:admin",
+    "delete_qos_queue": "role:admin",
+    "update_qos_queue": "role:admin",
+    "list_route_tables": "role:admin",
+    "show_route_table": "role:admin",
+    "create_route_tables": "role:admin",
+    "update_route_table": "role:admin",
+    "delete_route_table": "role:admin",
+    "list_interface_route_tables": "role:admin",
+    "show_interface_route_table": "role:admin",
+    "create_interface_route_tables": "role:admin",
+    "update_interface_route_table": "role:admin",
+    "delete_interface_route_table": "role:admin",
+    "list_route_targets": "role:admin",
+    "show_route_target": "role:admin",
+    "create_route_targets": "role:admin",
+    "update_route_target": "role:admin",
+    "delete_route_target": "role:admin",
+    "list_route_aggregates": "role:admin",
+    "show_route_aggregate": "role:admin",
+    "create_route_aggregates": "role:admin",
+    "update_route_aggregate": "role:admin",
+    "delete_route_aggregate": "role:admin",
+    "list_physical_routers": "role:admin",
+    "create_physical_routers": "role:admin",
+    "show_physical_router": "role:admin",
+    "update_physical_router": "role:admin",
+    "delete_physical_router": "role:admin",
+    "list_bgp_routers": "role:admin",
+    "create_bgp_routers": "role:admin",
+    "show_bgp_router": "role:admin",
+    "update_bgp_router": "role:admin",
+    "delete_bgp_router": "role:admin",
+    "list_global_vrouter_configs": "role:admin",
+    "create_global_vrouter_configs": "role:admin",
+    "show_global_vrouter_config": "role:admin",
+    "update_global_vrouter_config": "role:admin",
+    "delete_global_vrouter_config": "role:admin",
+    "list_logical_routers": "role:admin",
+    "create_logical_routers": "role:admin",
+    "show_logical_router": "role:admin",
+    "update_logical_router": "role:admin",
+    "delete_logical_router": "role:admin",
+    "list_virtual_routers": "role:admin",
+    "create_virtual_routers": "role:admin",
+    "show_virtual_router": "role:admin",
+    "update_virtual_router": "role:admin",
+    "delete_virtual_router": "role:admin",
+    "list_routing_policys": "role:admin",
+    "create_routing_policys": "role:admin",
+    "show_routing_policy": "role:admin",
+    "update_routing_policy": "role:admin",
+    "delete_routing_policy": "role:admin",
+    "list_routing_instances": "role:admin",
+    "create_routing_instances": "role:admin",
+    "show_routing_instance": "role:admin",
+    "delete_routing_instance": "role:admin",
+    "update_routing_instance": "role:admin",
+    "list_security_groups": "role:admin",
+    "show_security_group": "role:admin",
+    "delete_security_group": "role:admin",
+    "create_security_groups": "role:admin",
+    "update_security_group": "role:admin",
+    "list_service_appliances": "role:admin",
+    "create_service_appliances": "role:admin",
+    "show_service_appliance": "role:admin",
+    "update_service_appliance": "role:admin",
+    "delete_service_appliance": "role:admin",
+    "list_service_appliance_sets": "role:admin",
+    "create_service_appliance_sets": "role:admin",
+    "show_service_appliance_set": "role:admin",
+    "update_service_appliance_set": "role:admin",
+    "delete_service_appliance_set": "role:admin",
+    "list_service_templates": "role:admin",
+    "create_service_templates": "role:admin",
+    "show_service_template": "role:admin",
+    "update_service_template": "role:admin",
+    "delete_service_template": "role:admin",
+    "list_service_health_checks": "role:admin",
+    "create_service_health_checks": "role:admin",
+    "show_service_health_check": "role:admin",
+    "update_service_health_check": "role:admin",
+    "delete_service_health_check": "role:admin",
+    "create_service_instances": "role:admin",
+    "show_service_instance": "role:admin",
+    "delete_service_instance": "role:admin",
+    "list_service_instances": "role:admin",
+    "update_service_instance": "role:admin",
+    "list_subnets": "role:admin",
+    "create_subnets": "role:admin",
+    "show_subnet": "role:admin",
+    "update_subnet": "role:admin",
+    "delete_subnet": "role:admin",
+    "list_virtual_DNSs": "role:admin",
+    "create_virtual_DNSs": "role:admin",
+    "show_virtual_DNS": "role:admin",
+    "delete_virtual_DNS": "role:admin",
+    "update_virtual_DNS": "role:admin",
+    "list_virtual_DNS_records": "role:admin",
+    "create_virtual_DNS_records": "role:admin",
+    "show_virtual_DNS_record": "role:admin",
+    "delete_virtual_DNS_record": "role:admin",
+    "update_virtual_DNS_record": "role:admin",
+    "list_virtual_ips": "role:admin",
+    "create_virtual_ips": "role:admin",
+    "show_virtual_ip": "role:admin",
+    "update_virtual_ip": "role:admin",
+    "delete_virtual_ip": "role:admin",
+    "list_virtual_machine_interfaces": "role:admin",
+    "create_virtual_machine_interfaces": "role:admin",
+    "show_virtual_machine_interface": "role:admin",
+    "delete_virtual_machine_interface": "role:admin",
+    "update_virtual_machine_interface": "role:admin",
+    "list_virtual_networks": "role:admin",
+    "create_virtual_networks": "role:admin",
+    "update_virtual_network": "role:admin",
+    "delete_virtual_network": "role:admin",
+    "show_virtual_network": "role:admin"
+}