diff --git a/tcp_tests/templates/_heat_environments/bm-ovs-cloud.env b/tcp_tests/templates/_heat_environments/bm-ovs-cloud.env
new file mode 100644
index 0000000..86d4085
--- /dev/null
+++ b/tcp_tests/templates/_heat_environments/bm-ovs-cloud.env
@@ -0,0 +1,47 @@
+resource_registry:
+  "MCP::MultipleInstance": fragments/MultipleInstance.yaml
+  #"MCP::Flavors": fragments/Flavors.yaml
+  "MCP::MasterNode": fragments/MasterNode.yaml
+  "MCP::Compute": fragments/Compute.yaml
+  "MCP::Networks": fragments/Networks.yaml
+  "MCP::SingleInstance": fragments/Instance.yaml
+  "MCP::FoundationNode": fragments/FoundationNode.yaml
+  "MCP::Subnets": fragments/Subnets.yaml
+
+parameter_defaults:
+
+  cfg_flavor: system.virtual.salt_master
+  ctl_flavor: system.compact.openstack.control
+  cid_flavor: system.compact.cicd.control
+  ntw_flavor: system.compact.opencontrail.control
+  nal_flavor: system.compact.opencontrail.analytics
+  dbs_flavor: system.compact.openstack.database
+  msg_flavor: system.compact.openstack.message_queue
+  mon_flavor: system.compact.stacklight.server
+  log_flavor: system.compact.stacklight.log
+  mtr_flavor: system.compact.stacklight.telemetry
+  cmp_flavor: system.virtual.openstack.compute
+  cmn_flavor: system.compact.ceph.mon
+  rgw_flavor: system.compact.ceph.rgw
+  osd_flavor: system.virtual.openstack.compute
+  dns_flavor: system.compact.openstack.dns
+  kmn_flavor: system.compact.openstack.barbican
+  prx_flavor: system.compact.openstack.proxy
+  gtw_flavor: system.compact.openstack.gateway
+  kvm_fake_flavor: system.virtual.fake_kvm
+  foundation_flavor: system.virtual.foundation
+  key_pair: system_key_8133
+  bm_availability_zone: BM
+  net_public: public
+
+  foundation_image: system.foundation
+  nameservers: 172.18.208.44
+  control_subnet_cidr: "10.167.11.0/24"
+  tenant_subnet_cidr: "10.167.12.0/24"
+  external_subnet_cidr: "172.17.42.0/26"
+  management_subnet_cidr: "172.16.164.0/26"
+  management_subnet_cfg01_ip: 172.16.164.2
+  management_subnet_gateway_ip: 172.16.164.1
+  management_subnet_pool_start: 172.16.164.3
+  management_subnet_pool_end: 172.16.164.62
+  salt_master_control_ip: 10.167.11.5
\ No newline at end of file
diff --git a/tcp_tests/templates/bm-cicd-pike-ovs-maas/encryption-key.asc b/tcp_tests/templates/bm-cicd-pike-ovs-maas/encryption-key.asc
new file mode 100644
index 0000000..381eb77
--- /dev/null
+++ b/tcp_tests/templates/bm-cicd-pike-ovs-maas/encryption-key.asc
@@ -0,0 +1,56 @@
+-----BEGIN PGP PRIVATE KEY BLOCK-----
+
+lQcYBFyBRcUBEACmP/muUIwbEg6Z7dA3c9I2NadcjDHXKg/ViXwaOB4KSd9/FC0o
+KSBPccWb+1sm+zdUy2f/LC5r8RvU7yZd4Mbzz8R1DQncXg4nG7bppW7oAcHpc0jk
+pV/SvdMYxuXsrbKbpoGEquwVkbb4oTv2MLSBfGfFzBeQfiwGEWm1xPLSeXc4biLC
+FatCU7w4LS1U4BEOqRCp6lW/hQFLoX+j6rNT8TwC5AeFpKgUWuQZGOO4fZKpbvo2
+sCvF5VA1HSVXlZtzum6pL1yzLL/SoyLrYOy1KrZQmSBHG9htCZQVmvYK7U5WtWE4
+Ws5IAj+HwvgKyzXE2Srsirj1NqauQRsk+1riQk3rpDrX2BeXNUSoHR5M/RDY0gCc
+8P6heanQRnyFtjUSoovkQsydY77+QVxe0MCs+lZlg31fL+wJVG7FIbIKKwR5sj8i
+/JqhWE+t2ZzIrQ/7o7fRk7hv/u69Vb/t/Nt7fkbn53zoubqi3kNgXf6hwhTUtfW/
+lE9cc4JTzis4i/RnILUDnAwos1c0Z+tGCUo4pbiP71VfU8L259g+clPFXOIkqA9t
+L9JSZQfhH/lRj3Abs57OvZjN7/D1h8PWB+8nTB8bkoUt45SubgQb0Y9maWUcwjxw
+AcJSIk6mq8vVdBu7zOuslDjMnoUZbtJwcSwQQOnb9UUppjs3CjbcH80ttQARAQAB
+AA/9ExdprtDlJf6u2pJqxNNyInOK4p/e4VydMOJ28/PZz0iod8lzXhdK9JSWItF8
+qD9VHVG2gaErO44Wqh9EgqdbcYg8gUycA0hxy5/tI2uyDsaU5CAvEMLE/Eh8Q24j
+3UgdKK64VOnj7p4rKuYpIp55PB1zNU24rwkuOQwq3Yreb7kvLbXIHA2s+xLunGzj
+tcl9a/eSSFD2w+WcPnkvVT2QlmUvhQ12p6w++QdvBkrLa9ZPz1FFPp6AiFtLGK5e
+KW6uyV1xc9BSjujmpmPBkNIynKNpCFxtTn0uH2doMAr5kkuqIV726SfUZISNkyOa
+pHKtnAtsWHmdv9skzQIBAgAzcXTBGbdDxRj6QR+ohqbsCzfu3z9QHSbXUmxezti9
+bQqpsU1SIg8z2oDARFR6KlRzhnfpPvan+Gp9TvYsvxrXe61HpxRMdLj6Gt2Ibruf
+YHCtr1S9J5CzTTOurlIKpACUYIqgVXfgIkQzqiYX8e56PiDTUB++OqEg66i0orXB
+nbHAD2vu16CNvcaNqsak3DWkHMwmEfsuxqyUXNte0eYu9SCHtnNoYT/D7A72gK4b
+Gqg80J8ZCpo1ilIX3xUq8WsH+CoXs0X7hy6Cbi22AqnHFRYmrgoIWmRzJonp393b
+yqmTV+QsKQRpmwdX4hiH78zJLnLEUQMn8CuHAGwaJCzk4okIAMKNrIQZhkdbCCe4
+IrLuMKn4aQj3c22SMXNmu78/0cP9Rtsm3ChjzzelLO7NjvPm0nIvEcThFSIZIXCv
+iWGZCXFCKn3WtA5xWuMFNXsEQcc3AG/qRODdDSeFpo+VH/9IwppAc3zI2jxe1PRD
+G2DnheLaLIKgHunsCYxpftJDod/vRqRHeU7ulMVJfEKVxdzrCbKGiIOXSyS6KowQ
+JOxF/80ocq/25Zc/oH25Y2r/0y+xzDpOHBgU0ndrCZf2z8oOuECJTxcq83UDyJzT
+HrG/hTrU83YsQMZ0AwBrYxpzUfdH7b6y60VE19FrwmMDK6Fz8I/x4Ai0sNkI3QLR
+NntY9fsIANrB3QM8CtsdxXsFvdTEwNLsG8LMdn3loCH6Cq3ejkEKa69Uua+sB6ND
+wYOXWzyksLZJyfxIXux/hMlK/kO3ohGcEFiMUaDZndJy8IKUlDrhwcUZqm7dXMDU
+CIf0T3rOEzOXbNu3UTds3j/ruSvA5KmjzOa4Qnb41CyL5Fh7x0R8Rux3NzAn6Ecx
+Y+nAWRtI/Yz7zdL8zuHaJfbVuxAPJ+ImcXAS7cX6T9dM3tWRlam1+0Ezhdb4F8i5
+lcY7sMu95scDwhV7qOmln6wtGSkBPZgE0+TqRuELZrPvlcIRRIM42UwPWhYO2PG8
+kKd2i5teweDnhzN8+E87VV2BQhP9DA8H/0+ZiXsvaG60JGqNmWzVbB6U1qgwrFOR
+VcuzIWpdZyQR8Ok63GXuA0odoqReolba9R6fVlXchj6INBz2WY2F0twwCRPx7tRg
+Pyq4PaTA8ZYYjAVWVCd9k97gY2i80p4MPzQCnE8g4n6OWGY47pcTwSkm4HBoGoam
+igIRn3Soz7CXGF+PvSGi1T0jpwM5IWfM3IwEUPdPTIJuA2iD/9zSKDvhsP+trJ1Y
+TMe9CW3Llf5mFbHLRZ7LfMOLIngKOIxBAxHiT8wUrIRaH78wHdz8ALDsC+LNP6rK
+hKb8h/VHXaqmf0BlNjGpO7XZXfxXWJ0oTUG5Z+jKz2Ir14HYLZI1GlOA8bQlZXhh
+bXBsZS5jb20gPHNhbHQtbWFzdGVyQGV4YW1wbGUuY29tPokCTgQTAQgAOBYhBLaR
+Vrvqyq56MiGjUvXLKtw2FZsDBQJcgUXFAhsvBQsJCAcCBhUKCQgLAgQWAgMBAh4B
+AheAAAoJEPXLKtw2FZsDpi4P/1kmvlpkbOhrL73zAPyMzYa4Yo2Pi/BoMbyEKNKO
+K3wLCdP6xLGecVIt8pANosksDSGlWAnWj36/jfgt/aZisx1u6MTYaOEHkXahxOX4
+ghDW1cTbdtz7Uy5Ah9O3WNI+ejmOpCtuc3P/XOkdttKZLuCNCs6ocgCsejpNHcFK
+vMhOhnRKV8kcBrG2QLyfSyafBtM/zV+NR4Wrng71Za8fiXHlDanmrAIyuSnD538r
+hTwSFe0C9HntwuF6W+UShN7c+jPJaKQjKbZy9fuFp33NcTSPCB5dH9yrhQvOeFQo
+dFzEabMDFVGPfUVWR+TH39dWYOsq5zFmgQAbOB/vHdmEtrYNrxX0AiCZZHQHTUb9
+oBK68V8eVeFdoRLcMORBZ2RCqkQTOQoAF7o772knltjtsymnI0XNvVC/XCnZv89Q
+/eoivrd/rMMpTFOGcys6EAnSUWx0ZG/JCkezQqnx9U219BvqKNOZ60aOeOYHKpsX
+Ha8Nr72YRmtm0UMsDjEUyLOj+o06XnN7uafMv2bZpjWh2hfOrkAbxe41z6t+78ho
+P+C5vSvp01OmAt71iq+62MXVcLVKEWDpiuZSj8m83RlY5AGIaPaGX9LKPcHdGxKw
+QSczgB/jI3G08vWaq82he6UJuYexbYe1iJXfvcx8kThwZ1nXQJm+7UsISUsh8/NZ
+x0n/
+=uxDD
+-----END PGP PRIVATE KEY BLOCK-----
diff --git a/tcp_tests/templates/bm-cicd-pike-ovs-maas/salt-context-cookiecutter-openstack_ovs.yaml b/tcp_tests/templates/bm-cicd-pike-ovs-maas/salt-context-cookiecutter-openstack_ovs.yaml
index a1a81ad..a15a3f7 100644
--- a/tcp_tests/templates/bm-cicd-pike-ovs-maas/salt-context-cookiecutter-openstack_ovs.yaml
+++ b/tcp_tests/templates/bm-cicd-pike-ovs-maas/salt-context-cookiecutter-openstack_ovs.yaml
@@ -1,33 +1,4 @@
 default_context:
-  backup_private_key: |-
-    -----BEGIN RSA PRIVATE KEY-----
-    MIIEogIBAAKCAQEAvDqzt/PHWvSSJrBtvD3UWp21CDrAajgOPeXrVm7VU+sDDpw0
-    YqDvVhYfT/N6ha+SWOK00KyTuMMbB8/I4tvsP9vvCXy7v2AJID/ZO2z/t8KfTDEJ
-    C75/6a0UBg6sl3i7+cUOHbeK+lkcfdnSI1H8Jzdhk4Xj7t7q+MIKTs5n+AlScgyz
-    NSiD2nG/U5LmaQ+rjZ1VsF9J0YTds0yLDF3hztVoDTs7j5obl7Xab3ZlwalgH5Gc
-    Id6BI09jkUbppdPzHpzV2oad7cFpVYTt9m3/MMT0amzPuwl/u/dI64rRuWPe60eT
-    qeVMQD0zP6o9F79upbzQStt82lPJcfF4CXvxYwIDAQABAoIBAAHUXDzUfMKQj/8a
-    RebHfxHmaIUM9SPTKahGXNQ5PY+UQDJbKFMxF0Jx8pn3VuCHxVdh1LoWg1UPaGra
-    BSzXUGOKgrdH5BdHGq+aj0T5mT6zAJNgAqN/lYSy7vfkGp9aSBF0bd+yEgK+7Pz4
-    Kge320iSTDt/2KhQuF30nN8JOI97m2uk2YHH8TixfVtmgLPEy+0Mw4VZLsHD4OY1
-    zu8xN6co2aQR0DB0MPKD6IxH62wSOJKBzF4o5xzzy/fl0ysDZbZ8Z/5Rejvp3yNT
-    68B0X5CM27hVdYE+/tcKGl9WKmewIf3fTZUfBcwFIObMIl9fkK/519nwFed4AfOX
-    /a2LCBECgYEA9Lyl/eyzXuU2dgs6Gw/WMobqOVnHF9wbukS1XSKdwMogtpt7Pb23
-    +32r9xHgeRDvvWwSp8lNPZ8mu77dQ6akbOuOk5C6V3Mqt4zam3DBDMtL63nKq8tq
-    LQ0PVjj8cAgu3GSDCz7htqUb44rn5tX9zlM0vrwxzyYqbet7ZbsGoYsCgYEAxORQ
-    JFn1vwag8VBw3bngx3SJ46CpCC8Gz830W7pEaTS6zTTiDC4p5sATGya91JS8l47G
-    ikP2bcWzvT6aP/u+TZSqZiqp5Kn37fx8Et+ltIl47SH+PJHIR9F9r2f9zqla6mlP
-    zcX/mTSuAJCTP4whQA3/f1wNAeBnewhK9fXCOokCgYAz6TPYSXW+giXsIfOAO/q2
-    GvHhmk5lnDVxbBOAHtCRTQ5lTVN1xCEbQgvQy0TuyQ3hAuRuHH+6u2BO4Gw0Zkto
-    IwrJ+B/eXrpH1qOj5uW73f9Lgjjf+bSau7NuGYZKCSJPcy5smzjrMdhZimQoDWnZ
-    csK0VlzGUJUdXZ599I6ygwKBgGTf+LN3J7H0Snb4WKsw9Zoa+h6WjKO1vE6xXVW1
-    rCEes+o5Autsp2ki1WcexTlp7unTa6MhSNta5Ei8Dzli2FBVL6xihWKzNmRG7Kaa
-    0QIbQMp1lRUhN7Sb/0HkDKRaHktlI07w95Bd7hw59kcjm1F/Gnz9A2kHuNzPFeDI
-    RffJAoGAdeCID5sb0oHEHTIxxB+cgfaiyaAe9qrW2INNWLVn5OTDh6cidatnWAor
-    M/SxwNoiYcCpi869q7wzjw5gNOVoNJbmwzDA7s+lgjTPQpq2jmO6RtweKbYoN5Zw
-    ++LiD3r07TD3p2QAyeooT29D/d6/2Hd6oyTJcZWIQTN+MTcXQO4=
-    -----END RSA PRIVATE KEY-----
-  backup_public_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8OrO388da9JImsG28PdRanbUIOsBqOA495etWbtVT6wMOnDRioO9WFh9P83qFr5JY4rTQrJO4wxsHz8ji2+w/2+8JfLu/YAkgP9k7bP+3wp9MMQkLvn/prRQGDqyXeLv5xQ4dt4r6WRx92dIjUfwnN2GThePu3ur4wgpOzmf4CVJyDLM1KIPacb9TkuZpD6uNnVWwX0nRhN2zTIsMXeHO1WgNOzuPmhuXtdpvdmXBqWAfkZwh3oEjT2ORRuml0/MenNXahp3twWlVhO32bf8wxPRqbM+7CX+790jritG5Y97rR5Op5UxAPTM/qj0Xv26lvNBK23zaU8lx8XgJe/Fj
   bmk_enabled: 'False'
   cicd_control_node01_address: 10.167.11.91
   cicd_control_node01_hostname: cid01
@@ -38,35 +9,6 @@
   cicd_control_vip_address: 10.167.11.90
   cicd_control_vip_hostname: cid
   cicd_enabled: 'True'
-  cicd_private_key: |-
-    -----BEGIN RSA PRIVATE KEY-----
-    MIIEowIBAAKCAQEAshiE2vK11KH1/PHO9v5IcT1ol3kuAorv6IgW+1paT9w4pFnd
-    H2DHQxTJsZ629cig+ELVAKHQnkND2U++/DM20ai5ZfpOwlvd+dL95/FbGb62Ozxx
-    kxBjyc/Bbbs8LcZtS1SN+agdkjQG1StpckUbFppoJ9nzWgnEcdYdonQ6aThgd+YL
-    rAOX04s3cMlCflClQl3lGFo24Qdhk/Y4M5rodfqfD5NOSKEhYP/dTMunri8zB5bU
-    ifvOvCWUKUOxLjkx95raY82xMHUobMYk87RcLPcq8pyz96/FPoiLqxM1oznTKNiI
-    0bW0xjf7FFjfLCjTapKZPRz8+Wkvzmzj35LLrwIDAQABAoIBADJoGCo0Kdy93nay
-    JgboX66VV+YPaUNU+aQR6JdJsmgKB4oU2S4JYTyORKveJSCZoV3C5LCiG/6/QRPf
-    q0mMYUaj/51qZCJEiCYuXqjoOgWmYcOQTwD10ZiMEc4yAU1fbQ22J9zyhTQdP5XU
-    DKtH/eu+1h35ZRQl0ZD6rjaNuP6QekJM6IVCC7XBaCG5+wSER9R25HbbDhdb7CwH
-    W1GP9IgISqy9Z3f4PQOyCUmn/O99lN8kry6ui7bCywRfITV6C+pn02DpMgzKZ8jn
-    3yts1f2mIbYVxnahtCaI3QTag6wBsnFq+U0uIXrUGMeeRzg9N1Ur01qdJpIR9g0v
-    Nt7QUZkCgYEA4lEavsFitSll/33JY4q82nYpjXAxTON3xraUqNYn5Cde06gNi8n1
-    t9TCLUqDhSpvgEOyJE/uwo5LAj79Ce2EwLkCttNggqRXBlY5ZpljwfWmxZtuGm/z
-    BJaOtkaK/1diR/+Qn/fTMyPH5JIXuQ6/XF60W4MSbzPgY4GO1BDx+G0CgYEAyXRT
-    00GDdiXbxQmzeHTO9Bg5y36Y1FEWDLnc89bpHPTR4sT/XCczerevy/l8jsdzZlnu
-    5ZddfWMF7EGNo51Zbmi0oLQ7nzigoVFcnhFHRFoCP36T9mvJk7O8Ao3ttpl/J2r0
-    mFiaKi0lhmZVbNpmliKjWAMZJyt6I7AfYekcOwsCgYEA0W8MuQptNgkhgtX80ElL
-    iz9eJK12chjuds3vtG66a8CjWGtkXcB/y6bwKsmR/GHQ3XnIGSJ/aTwU3fc8YzuS
-    ZmbPxDDIVx2OCycv52p7jrqtoqC7u2tuEQji+Hs/lhxfrxEp3V+R6vlpunQX0AF9
-    xRU/ApDBNndjZ7I1YrprseECgYA+zx8HgaiMIJeZokGrb7fKkPcMBCeAItveEeDa
-    wYmito3txv/a6nn5a+XKkbmNBpBrO+To/j1ux33kQDf56Cgm7UxLwoXISa6DPUvE
-    GJ0AqZOD2mIldUu+2k3m+ftAcDEdyBIEobNHLRZDBgriSmGrs5b77NNdzAdjsxjF
-    vRlJKwKBgD8DcP/C9pABC2mRQyH//RTk6XZfiDY0L18lwH7acEdHlJiF1PTwvIHD
-    cj1nMyG2MxEiSt1E5O/YQ4Lo3sognFIb8keu7IYxEgLXhvWFR3RwaYCjrF4ZGfD2
-    +83eUFPZQvEwTY/8OCogzJQfs1CT8+pLdO9tZQbrAaxfmF6c48KN
-    -----END RSA PRIVATE KEY-----
-  cicd_public_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyGITa8rXUofX88c72/khxPWiXeS4Ciu/oiBb7WlpP3DikWd0fYMdDFMmxnrb1yKD4QtUAodCeQ0PZT778MzbRqLll+k7CW9350v3n8VsZvrY7PHGTEGPJz8Ftuzwtxm1LVI35qB2SNAbVK2lyRRsWmmgn2fNaCcRx1h2idDppOGB35gusA5fTizdwyUJ+UKVCXeUYWjbhB2GT9jgzmuh1+p8Pk05IoSFg/91My6euLzMHltSJ+868JZQpQ7EuOTH3mtpjzbEwdShsxiTztFws9yrynLP3r8U+iIurEzWjOdMo2IjRtbTGN/sUWN8sKNNqkpk9HPz5aS/ObOPfksuv
   cluster_domain: bm-cicd-pike-ovs-maas.local
   cluster_name: bm-cicd-pike-ovs-maas
   compute_bond_mode: active-backup
@@ -118,7 +60,7 @@
   maas_deploy_address: 172.16.164.2
   maas_deploy_cidr: 172.16.164.0/26
   maas_deploy_gateway: 172.16.164.1
-  maas_deploy_range_end: 172.16.164.62
+  maas_deploy_range_end: 172.16.164.61
   maas_deploy_range_start: 172.16.164.18
   maas_deploy_vlan: '0'
   maas_dhcp_enabled: 'True'
@@ -772,7 +714,7 @@
   reclass_repository: https://github.com/Mirantis/mk-lab-salt-model.git
   salt_api_password: HlcaUHzUnsWsg62uhF8ua5KEbqRbzijz
   salt_api_password_hash: $6$qdIFillN$XnzP7oIXRcbroVch7nlthyrSekjKlWND8q2MtoMF3Wz2ymepjAOjyqpyR55nmbH9OQzS8EcQJ6sfr5hWKDesV1
-  salt_master_address: 10.167.11.2
+  salt_master_address: 10.167.11.5
   salt_master_hostname: cfg01
   salt_master_management_address: 172.16.164.2
   shared_reclass_branch: proposed
@@ -884,7 +826,7 @@
   openstack_create_public_network: 'True'
   openstack_public_neutron_subnet_gateway: 172.17.42.1
   openstack_public_neutron_subnet_cidr: 172.17.42.0/26
-  openstack_public_neutron_subnet_allocation_start: 172.17.42.15
+  openstack_public_neutron_subnet_allocation_start: 172.17.42.20
   openstack_public_neutron_subnet_allocation_end: 172.17.42.55
   backend_vlan: '2402'
   storage_vlan: '2405'  # not implemented yet, placeholder
@@ -901,35 +843,6 @@
   octavia_lb_mgmt_allocation_pool_start: 192.168.1.2
   octavia_lb_mgmt_allocation_pool_end: 192.168.1.200
   openstack_octavia_enabled: 'True'
-  octavia_private_key: |-
-    -----BEGIN RSA PRIVATE KEY-----
-    MIIEpAIBAAKCAQEAtjnPDJsQToHBtoqIo15mdSYpfi8z6DFMi8Gbo0KCN33OUn5u
-    OctbdtjUfeuhvI6px1SCnvyWi09Ft8eWwq+KwLCGKbUxLvqKltuJ7K3LIrGXkt+m
-    qZN4O9XKeVKfZH+mQWkkxRWgX2r8RKNV3GkdNtd74VjhP+R6XSKJQ1Z8b7eHM10v
-    6IjTY/jPczjK+eyCeEj4qbSnV8eKlqLhhquuSQRmUO2DRSjLVdpdf2BB4/BdWFsD
-    YOmX7mb8kpEr9vQ+c1JKMXDwD6ehzyU8kE+1kVm5zOeEy4HdYIMpvUfN49P1anRV
-    2ISQ1ZE+r22IAMKl0tekrGH0e/1NP1DF5rINMwIDAQABAoIBAQCkP/cgpaRNHyg8
-    ISKIHs67SWqdEm73G3ijgB+JSKmW2w7dzJgN//6xYUAnP/zIuM7PnJ0gMQyBBTMS
-    NBTv5spqZLKJZYivj6Tb1Ya8jupKm0jEWlMfBo2ZYVrfgFmrfGOfEebSvmuPlh9M
-    vuzlftmWVSSUOkjODmM9D6QpzgrbpktBuA/WpX+6esMTwJpOcQ5xZWEnHXnVzuTc
-    SncodVweE4gz6F1qorbqIJz8UAUQ5T0OZTdHzIS1IbamACHWaxQfixAO2s4+BoUK
-    ANGGZWkfneCxx7lthvY8DiKn7M5cSRnqFyDToGqaLezdkMNlGC7v3U11FF5blSEW
-    fL1o/HwBAoGBAOavhTr8eqezTchqZvarorFIq7HFWk/l0vguIotu6/wlh1V/KdF+
-    aLLHgPgJ5j+RrCMvTBoKqMeeHfVGrS2udEy8L1mK6b3meG+tMxU05OA55abmhYn7
-    7vF0q8XJmYIHIXmuCgF90R8Piscb0eaMlmHW9unKTKo8EOs5j+D8+AMJAoGBAMo4
-    8WW+D3XiD7fsymsfXalf7VpAt/H834QTbNZJweUWhg11eLutyahyyfjjHV200nNZ
-    cnU09DWKpBbLg7d1pyT69CNLXpNnxuWCt8oiUjhWCUpNqVm2nDJbUdlRFTzYb2fS
-    ZC4r0oQaPD5kMLSipjcwzMWe0PniySxNvKXKInFbAoGBAKxW2qD7uKKKuQSOQUft
-    aAksMmEIAHWKTDdvOA2VG6XvX5DHBLXmy08s7rPfqW06ZjCPCDq4Velzvgvc9koX
-    d/lP6cvqlL9za+x6p5wjPQ4rEt/CfmdcmOE4eY+1EgLrUt314LHGjjG3ScWAiirE
-    QyDrGOIGaYoQf89L3KqIMr0JAoGARYAklw8nSSCUvmXHe+Gf0yKA9M/haG28dCwo
-    780RsqZ3FBEXmYk1EYvCFqQX56jJ25MWX2n/tJcdpifz8Q2ikHcfiTHSI187YI34
-    lKQPFgWb08m1NnwoWrY//yx63BqWz1vjymqNQ5GwutC8XJi5/6Xp+tGGiRuEgJGH
-    EIPUKpkCgYAjBIVMkpNiLCREZ6b+qjrPV96ed3iTUt7TqP7yGlFI/OkORFS38xqC
-    hBP6Fk8iNWuOWQD+ohM/vMMnvIhk5jwlcwn+kF0ra04gi5KBFWSh/ddWMJxUtPC1
-    2htvlEc6zQAR6QfqXHmwhg1hP81JcpqpicQzCMhkzLoR1DC6stXdLg==
-    -----END RSA PRIVATE KEY-----
-  octavia_public_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2Oc8MmxBOgcG2ioijXmZ1Jil+LzPoMUyLwZujQoI3fc5Sfm45y1t22NR966G8jqnHVIKe/JaLT0W3x5bCr4rAsIYptTEu+oqW24nsrcsisZeS36apk3g71cp5Up9kf6ZBaSTFFaBfavxEo1XcaR0213vhWOE/5HpdIolDVnxvt4czXS/oiNNj+M9zOMr57IJ4SPiptKdXx4qWouGGq65JBGZQ7YNFKMtV2l1/YEHj8F1YWwNg6ZfuZvySkSv29D5zUkoxcPAPp6HPJTyQT7WRWbnM54TLgd1ggym9R83j0/VqdFXYhJDVkT6vbYgAwqXS16SsYfR7/U0/UMXmsg0z
   cinder_backup_engine: 'ceph'
   cinder_ceph_backup_pool_name: 'backups'
   openstack_keystone_security:
@@ -941,4 +854,8 @@
     minimum_password_age: 0
     password_regex: "'^[a-zA-Z0-9~!@#%^&\\*_=+]{32,}$$'"
     password_regex_description: "Your password could contains capital letters, lowercase letters, digits, symbols '~ ! @ # % ^ & * _ = +' and have a minimum length of 32 characters"
-    change_password_upon_first_use: False
\ No newline at end of file
+    change_password_upon_first_use: False
+  secrets_encryption_enabled: 'True'
+  secrets_encryption_key_id: 'F5CB2ADC36159B03'
+  # Used on CI only.
+  secrets_encryption_private_key: ''
\ No newline at end of file
diff --git a/tcp_tests/templates/bm-cicd-pike-ovs-maas/salt.yaml b/tcp_tests/templates/bm-cicd-pike-ovs-maas/salt.yaml
index 2fc8aba..4e66daa 100644
--- a/tcp_tests/templates/bm-cicd-pike-ovs-maas/salt.yaml
+++ b/tcp_tests/templates/bm-cicd-pike-ovs-maas/salt.yaml
@@ -1,6 +1,6 @@
-{% from 'bm-cicd-pike-ovs-maas/underlay.yaml' import HOSTNAME_CFG01 with context %}
-{% from 'bm-cicd-pike-ovs-maas/underlay.yaml' import LAB_CONFIG_NAME with context %}
-{% from 'bm-cicd-pike-ovs-maas/underlay.yaml' import DOMAIN_NAME with context %}
+{% set HOSTNAME_CFG01='cfg01.bm-cicd-pike-ovs-maas.local' %}
+{% set LAB_CONFIG_NAME='bm-cicd-pike-ovs-maas' %}
+{% set DOMAIN_NAME='bm-cicd-pike-ovs-maas.local' %}
 
 {% import 'shared-salt.yaml' as SHARED with context %}
 
diff --git a/tcp_tests/templates/bm-cicd-pike-ovs-maas/underlay--user-data-foundation.yaml b/tcp_tests/templates/bm-cicd-pike-ovs-maas/underlay--user-data-foundation.yaml
new file mode 100644
index 0000000..c9fd9d6
--- /dev/null
+++ b/tcp_tests/templates/bm-cicd-pike-ovs-maas/underlay--user-data-foundation.yaml
@@ -0,0 +1,82 @@
+#cloud-config, see http://cloudinit.readthedocs.io/en/latest/topics/examples.html
+
+ssh_pwauth: True
+users:
+  - name: root
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+  - name: jenkins
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFSxeuXh2sO4VYL8N2dlNFVyNcr2RvoH4MeDD/cV2HThfU4/BcH6IOOWXSDibIU279bWVKCL7QUp3mf0Vf7HPuyFuC12QM+l7MwT0jCYh5um3hmAvM6Ga0nkhJygHexe9/rLEYzZJkIjP9/IS/YXSv8rhHg484wQ6qkEuq15nyMqil8tbDQCq0XQ+AWEpNpIa4pUoKmFMsOP8lq10KZXIXsJyZxizadr6Bh4Lm9LWrk8YCw7qP3rmgWxK/s8qXQh1ISZe6ONfcmk6p03qbh4H3CwKyWzxmnIHQvE6PgN/O+PuAZj3PbR2mkkJjYX4jNPlxvj8uTStaVPhAwfR9Spdx jenkins@cz8133
+
+disable_root: false
+chpasswd:
+  list: |
+    root:r00tme
+    jenkins:qalab
+  expire: False
+
+packages:
+  - openjdk-8-jre-headless
+  - libyaml-dev
+  - libffi-dev
+  - libvirt-dev
+  - python-dev
+  - python-pip
+  - python-virtualenv
+  #- python-psycopg2
+  - pkg-config
+  - vlan
+  - bridge-utils
+  - ebtables
+
+bootcmd:
+  # Enable root access
+  - sed -i -e '/^PermitRootLogin/s/^.*$/PermitRootLogin yes/' /etc/ssh/sshd_config
+  - service sshd restart
+output:
+  all: '| tee -a /var/log/cloud-init-output.log /dev/tty0'
+
+runcmd:
+  # Create swap
+  - fallocate -l 16G /swapfile
+  - chmod 600 /swapfile
+  - mkswap /swapfile
+  - swapon /swapfile
+  - echo "/swapfile   none    swap    defaults   0   0" >> /etc/fstab
+  - find /etc/network/interfaces.d/ -type f -delete
+  - kill $(pidof /sbin/dhclient) || /bin/true
+  - ip a flush dev ens3
+  - ip a flush dev ens4
+  - rm -f /var/run/network/ifstate.ens3
+  - rm -f /var/run/network/ifstate.ens4
+  - ip route delete default || /bin/true
+  - ifup ens3
+  - ifup ens4
+
+write_files:
+  - path: /etc/default/grub.d/97-enable-grub-menu.cfg
+    content: |
+      GRUB_RECORDFAIL_TIMEOUT=30
+      GRUB_TIMEOUT=3
+      GRUB_TIMEOUT_STYLE=menu
+
+  - path: /etc/network/interfaces
+    content: |
+      auto ens3
+      iface ens3 inet static
+      address $management_static_ip
+      netmask 255.255.255.192
+      gateway $management_gw
+      dns-nameservers $dnsaddress
+
+      auto ens4
+      iface ens4 inet static
+      address $control_static_ip
+      netmask 255.255.255.0
+
+  - path: /etc/bash_completion.d/fuel_devops30_activate
+    content: |
+      source /home/jenkins/fuel-devops30/bin/activate
diff --git a/tcp_tests/templates/bm-cicd-pike-ovs-maas/underlay-userdata.yaml b/tcp_tests/templates/bm-cicd-pike-ovs-maas/underlay-userdata.yaml
new file mode 100644
index 0000000..567a445
--- /dev/null
+++ b/tcp_tests/templates/bm-cicd-pike-ovs-maas/underlay-userdata.yaml
@@ -0,0 +1,78 @@
+#cloud-config, see http://cloudinit.readthedocs.io/en/latest/topics/examples.html
+
+ssh_pwauth: True
+users:
+   - name: root
+     sudo: ALL=(ALL) NOPASSWD:ALL
+     shell: /bin/bash
+
+disable_root: false
+chpasswd:
+   list: |
+    root:r00tme
+   expire: False
+
+bootcmd:
+   # Enable root access
+   - sed -i -e '/^PermitRootLogin/s/^.*$/PermitRootLogin yes/' /etc/ssh/sshd_config
+   - service sshd restart
+output:
+    all: '| tee -a /var/log/cloud-init-output.log /dev/tty0'
+
+runcmd:
+   - if lvs vg0; then pvresize /dev/vda3; fi
+   - if lvs vg0; then /usr/bin/growlvm.py --image-layout-file /usr/share/growlvm/image-layout.yml; fi
+
+   - export TERM=linux
+   - export LANG=C
+   # Configure dhclient
+   - sudo resolvconf -u
+   #- sudo echo "nameserver {gateway}" >> /etc/resolvconf/resolv.conf.d/base
+   # Enable grub menu using updated config below
+   - update-grub
+
+   # Prepare network connection
+   - sudo ifup ens3
+   #- sudo route add default gw {gateway} {interface_name}
+
+   # Create swap
+   - fallocate -l 16G /swapfile
+   - chmod 600 /swapfile
+   - mkswap /swapfile
+   - swapon /swapfile
+   - echo "/swapfile   none    swap    defaults   0   0" >> /etc/fstab
+
+write_files:
+   - path: /etc/default/grub.d/97-enable-grub-menu.cfg
+     content: |
+         GRUB_RECORDFAIL_TIMEOUT=30
+         GRUB_TIMEOUT=3
+         GRUB_TIMEOUT_STYLE=menu
+
+   - path: /etc/network/interfaces
+     content: |
+          auto ens3
+          iface ens3 inet dhcp
+
+   - path: /usr/share/growlvm/image-layout.yml
+     content: |
+       root:
+         size: '65%VG'
+       home:
+         size: '1%VG'
+       var_log:
+         size: '10%VG'
+       var_log_audit:
+         size: '5%VG'
+       var_tmp:
+         size: '10%VG'
+       tmp:
+         size: '5%VG'
+     owner: root:root
+
+growpart:
+    mode: auto
+    devices:
+      - '/'
+      - '/dev/vda3'
+    ignore_growroot_disabled: false
diff --git a/tcp_tests/templates/bm-cicd-pike-ovs-maas/underlay.hot b/tcp_tests/templates/bm-cicd-pike-ovs-maas/underlay.hot
new file mode 100644
index 0000000..7b8216f
--- /dev/null
+++ b/tcp_tests/templates/bm-cicd-pike-ovs-maas/underlay.hot
@@ -0,0 +1,99 @@
+---
+
+heat_template_version: queens
+
+description: MCP environment for bm-cicd-pike-ovs-maas
+
+parameters:
+  instance_domain:
+    type: string
+    default: bm-cicd-pike-ovs-maas.local
+  mcp_version:
+    type: string
+  env_name:
+    type: string
+  key_pair:
+    type: string
+  cfg_flavor:
+    type: string
+  foundation_image:
+    type: string
+  foundation_flavor:
+    type: string
+
+resources:
+  subnets:
+    type: MCP::Subnets
+    properties:
+      stack_name: { get_param: "OS::stack_name" }
+      env_name: { get_param: env_name }
+      management_net: 'system-phys-2401'
+      control_net: 'system-phys-2404'
+      tenant_net: 'system-phys-2406'
+      external_net: 'system-phys-2403'
+
+  #flavors:
+  #  type: MCP::Flavors
+
+  cfg01_node:
+    type: MCP::MasterNode
+    depends_on: [subnets]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      cfg01_flavor: { get_param: cfg_flavor }
+      management_net: 'system-phys-2401'
+      control_net: 'system-phys-2404'
+      tenant_net: 'system-phys-2406'
+      external_net: 'system-phys-2403'
+      tenant_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [subnets, tenant_net_prefix] }, '5' ]
+      external_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [subnets, external_net_prefix] }, '5' ]
+      instance_name: cfg01
+      instance_domain: {get_param: instance_domain}
+
+  foundation_node:
+    type: MCP::FoundationNode
+    depends_on: [subnets]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance_name: foundation
+      management_net: 'system-phys-2401'
+      control_net: 'system-phys-2404'
+      tenant_net: 'system-phys-2406'
+      external_net: 'system-phys-2403'
+      instance_image: { get_param: foundation_image }
+      instance_flavor: {get_param: foundation_flavor}
+      underlay_userdata: { get_file: ./underlay--user-data-foundation.yaml }
+      management_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [subnets, management_net_prefix] }, '62' ]
+      control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [subnets, control_net_prefix] }, '6' ]
+      tenant_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [subnets, tenant_net_prefix] }, '6' ]
+      external_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [subnets, external_net_prefix] }, '6' ]
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+outputs:
+  foundation_public_ip:
+    description: foundation node IP address (management)
+    value:
+      get_attr:
+      - foundation_node
+      - instance_address
+...
diff --git a/tcp_tests/templates/bm-cicd-pike-ovs-maas/underlay.yaml b/tcp_tests/templates/bm-cicd-pike-ovs-maas/underlay.yaml
deleted file mode 100644
index b704e89..0000000
--- a/tcp_tests/templates/bm-cicd-pike-ovs-maas/underlay.yaml
+++ /dev/null
@@ -1,127 +0,0 @@
-# Set the repository suite, one of the: 'nightly', 'testing', 'stable', or any other required
-{% set REPOSITORY_SUITE = os_env('REPOSITORY_SUITE', 'proposed') %}
-{% set LAB_CONFIG_NAME = os_env('LAB_CONFIG_NAME', 'bm-cicd-pike-ovs-maas') %}
-{% set DOMAIN_NAME = os_env('DOMAIN_NAME', LAB_CONFIG_NAME + '.local') %}
-{% set HOSTNAME_CFG01 = os_env('HOSTNAME_CFG01', 'cfg01.' + DOMAIN_NAME) %}
-
-{% set ETH1_IP_ADDRESS_CFG01 = os_env('ETH1_IP_ADDRESS_CFG01', '172.16.164.2') %}
-
----
-aliases:
- - &interface_model {{ os_env('INTERFACE_MODEL', 'virtio') }}
- - &cloudinit_meta_data {{ CLOUDINIT_META_DATA }}
- - &cloudinit_user_data_cfg01 {{ CLOUDINIT_USER_DATA_CFG01 }}
-
-template:
-  devops_settings:
-    env_name: {{ os_env('ENV_NAME', 'bm-cicd-pike-ovs-maas_' + REPOSITORY_SUITE + "_" + os_env('BUILD_NUMBER', '')) }}
-
-    address_pools:
-      admin-pool01:
-        net: {{ os_env('ADMIN_ADDRESS_POOL01', '172.16.164.0/26:26') }}
-        params:
-          ip_reserved:
-            gateway: +1
-            l2_network_device: +1
-            default_{{ HOSTNAME_CFG01 }}: {{ ETH1_IP_ADDRESS_CFG01 }}
-          ip_ranges:
-              dhcp: [+2, -4]
-      private-pool01:
-        net: {{ os_env('PRIVATE_ADDRESS_POOL01', '10.167.11.0/24:24') }}
-        params:
-          ip_reserved:
-            gateway: +1
-            l2_network_device: +1
-          ip_ranges:
-              dhcp: [+2, -4]
-
-      tenant-pool01:
-        net: {{ os_env('TENANT_ADDRESS_POOL01', '10.167.12.0/24:24') }}
-        params:
-          ip_reserved:
-            gateway: +1
-            l2_network_device: +1
-          ip_ranges:
-              dhcp: [+2, -4]
-
-      external-pool01:
-        net: {{ os_env('EXTERNAL_ADDRESS_POOL01', '172.17.42.0/26:26') }}
-        params:
-          ip_reserved:
-            gateway: '172.17.42.1'
-          ip_ranges:
-              dhcp: ['172.17.42.10', '172.17.42.20']
-
-
-    groups:
-      - name: default
-        driver:
-          name: devops.driver.libvirt
-          params:
-            connection_string: !os_env CONNECTION_STRING, qemu:///system
-            storage_pool_name: !os_env STORAGE_POOL_NAME, default
-            stp: False
-            hpet: False
-            enable_acpi: true
-            use_host_cpu: !os_env DRIVER_USE_HOST_CPU, true
-            use_hugepages: !os_env DRIVER_USE_HUGEPAGES, false
-
-        network_pools:
-          admin: admin-pool01
-
-        l2_network_devices:
-          # maas management interface
-          admin:
-            address_pool: admin-pool01
-            dhcp: false
-            forward:
-              mode: bridge
-            parent_iface:
-              phys_dev: !os_env LAB_MANAGEMENT_IFACE
-          private:
-            address_pool: private-pool01
-            dhcp: false
-            forward:
-              mode: bridge
-            parent_iface:
-              phys_dev: !os_env LAB_CONTROL_IFACE
-
-        group_volumes:
-         - name: cfg01_day01_image               # Pre-configured day01 image
-           source_image: {{ os_env('IMAGE_PATH_CFG01_DAY01') }} # http://images.mirantis.com/cfg01-day01.qcow2 or fallback to IMAGE_PATH1604
-           format: qcow2
-
-        nodes:
-          - name: {{ HOSTNAME_CFG01 }}
-            role: salt_master
-            params:
-              vcpu: !os_env SLAVE_NODE_CPU, 4
-              memory: !os_env SLAVE_NODE_MEMORY, 12288
-              boot:
-                - hd
-              volumes:
-                - name: system
-                  capacity: !os_env NODE_VOLUME_SIZE, 150
-                  backing_store: cfg01_day01_image
-                  format: qcow2
-                - name: config
-                  capacity: 1
-                  format: raw
-                  device: cdrom
-                  bus: ide
-
-              interfaces:
-                - label: ens3
-                  l2_network_device: admin
-                  interface_model: *interface_model
-                - label: ens4
-                  l2_network_device: private
-                  interface_model: *interface_model
-
-              network_config:
-                ens3:
-                  networks:
-                    - admin
-                ens4:
-                  networks:
-                    - private
diff --git a/tcp_tests/templates/bm-cicd-queens-ovs-maas/salt-context-cookiecutter-openstack_ovs.yaml b/tcp_tests/templates/bm-cicd-queens-ovs-maas/salt-context-cookiecutter-openstack_ovs.yaml
index 4625136..d8fb608 100644
--- a/tcp_tests/templates/bm-cicd-queens-ovs-maas/salt-context-cookiecutter-openstack_ovs.yaml
+++ b/tcp_tests/templates/bm-cicd-queens-ovs-maas/salt-context-cookiecutter-openstack_ovs.yaml
@@ -714,7 +714,7 @@
   reclass_repository: https://github.com/Mirantis/mk-lab-salt-model.git
   salt_api_password: HlcaUHzUnsWsg62uhF8ua5KEbqRbzijz
   salt_api_password_hash: $6$qdIFillN$XnzP7oIXRcbroVch7nlthyrSekjKlWND8q2MtoMF3Wz2ymepjAOjyqpyR55nmbH9OQzS8EcQJ6sfr5hWKDesV1
-  salt_master_address: 10.167.11.2
+  salt_master_address: 10.167.11.5
   salt_master_hostname: cfg01
   salt_master_management_address: 172.16.164.2
   shared_reclass_branch: proposed
@@ -826,7 +826,7 @@
   openstack_create_public_network: 'True'
   openstack_public_neutron_subnet_gateway: 172.17.42.1
   openstack_public_neutron_subnet_cidr: 172.17.42.0/26
-  openstack_public_neutron_subnet_allocation_start: 172.17.42.15
+  openstack_public_neutron_subnet_allocation_start: 172.17.42.20
   openstack_public_neutron_subnet_allocation_end: 172.17.42.55
   backend_vlan: '2402'
   storage_vlan: '2405'  # not implemented yet, placeholder
@@ -849,3 +849,13 @@
   secrets_encryption_private_key: ''
   cinder_backup_engine: 'ceph'
   cinder_ceph_backup_pool_name: 'backups'
+  openstack_keystone_security:
+    disable_user_account_days_inactive: 7
+    lockout_failure_attempts: 60
+    lockout_duration: 600
+    password_expires_days: 730
+    unique_last_password_count: 5
+    minimum_password_age: 0
+    password_regex: "'^[a-zA-Z0-9~!@#%^&\\*_=+]{32,}$$'"
+    password_regex_description: "Your password could contains capital letters, lowercase letters, digits, symbols '~ ! @ # % ^ & * _ = +' and have a minimum length of 32 characters"
+    change_password_upon_first_use: False
diff --git a/tcp_tests/templates/bm-cicd-queens-ovs-maas/salt.yaml b/tcp_tests/templates/bm-cicd-queens-ovs-maas/salt.yaml
index 7295ad9..5f7d480 100644
--- a/tcp_tests/templates/bm-cicd-queens-ovs-maas/salt.yaml
+++ b/tcp_tests/templates/bm-cicd-queens-ovs-maas/salt.yaml
@@ -1,6 +1,6 @@
-{% from 'bm-cicd-queens-ovs-maas/underlay.yaml' import HOSTNAME_CFG01 with context %}
-{% from 'bm-cicd-queens-ovs-maas/underlay.yaml' import LAB_CONFIG_NAME with context %}
-{% from 'bm-cicd-queens-ovs-maas/underlay.yaml' import DOMAIN_NAME with context %}
+{% set HOSTNAME_CFG01='cfg01.bm-cicd-queens-ovs-maas.local' %}
+{% set LAB_CONFIG_NAME='bm-cicd-queens-ovs-maas' %}
+{% set DOMAIN_NAME='bm-cicd-queens-ovs-maas.local' %}
 
 {% import 'shared-salt.yaml' as SHARED with context %}
 
diff --git a/tcp_tests/templates/bm-cicd-queens-ovs-maas/underlay--user-data-foundation.yaml b/tcp_tests/templates/bm-cicd-queens-ovs-maas/underlay--user-data-foundation.yaml
new file mode 100644
index 0000000..c9fd9d6
--- /dev/null
+++ b/tcp_tests/templates/bm-cicd-queens-ovs-maas/underlay--user-data-foundation.yaml
@@ -0,0 +1,82 @@
+#cloud-config, see http://cloudinit.readthedocs.io/en/latest/topics/examples.html
+
+ssh_pwauth: True
+users:
+  - name: root
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+  - name: jenkins
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFSxeuXh2sO4VYL8N2dlNFVyNcr2RvoH4MeDD/cV2HThfU4/BcH6IOOWXSDibIU279bWVKCL7QUp3mf0Vf7HPuyFuC12QM+l7MwT0jCYh5um3hmAvM6Ga0nkhJygHexe9/rLEYzZJkIjP9/IS/YXSv8rhHg484wQ6qkEuq15nyMqil8tbDQCq0XQ+AWEpNpIa4pUoKmFMsOP8lq10KZXIXsJyZxizadr6Bh4Lm9LWrk8YCw7qP3rmgWxK/s8qXQh1ISZe6ONfcmk6p03qbh4H3CwKyWzxmnIHQvE6PgN/O+PuAZj3PbR2mkkJjYX4jNPlxvj8uTStaVPhAwfR9Spdx jenkins@cz8133
+
+disable_root: false
+chpasswd:
+  list: |
+    root:r00tme
+    jenkins:qalab
+  expire: False
+
+packages:
+  - openjdk-8-jre-headless
+  - libyaml-dev
+  - libffi-dev
+  - libvirt-dev
+  - python-dev
+  - python-pip
+  - python-virtualenv
+  #- python-psycopg2
+  - pkg-config
+  - vlan
+  - bridge-utils
+  - ebtables
+
+bootcmd:
+  # Enable root access
+  - sed -i -e '/^PermitRootLogin/s/^.*$/PermitRootLogin yes/' /etc/ssh/sshd_config
+  - service sshd restart
+output:
+  all: '| tee -a /var/log/cloud-init-output.log /dev/tty0'
+
+runcmd:
+  # Create swap
+  - fallocate -l 16G /swapfile
+  - chmod 600 /swapfile
+  - mkswap /swapfile
+  - swapon /swapfile
+  - echo "/swapfile   none    swap    defaults   0   0" >> /etc/fstab
+  - find /etc/network/interfaces.d/ -type f -delete
+  - kill $(pidof /sbin/dhclient) || /bin/true
+  - ip a flush dev ens3
+  - ip a flush dev ens4
+  - rm -f /var/run/network/ifstate.ens3
+  - rm -f /var/run/network/ifstate.ens4
+  - ip route delete default || /bin/true
+  - ifup ens3
+  - ifup ens4
+
+write_files:
+  - path: /etc/default/grub.d/97-enable-grub-menu.cfg
+    content: |
+      GRUB_RECORDFAIL_TIMEOUT=30
+      GRUB_TIMEOUT=3
+      GRUB_TIMEOUT_STYLE=menu
+
+  - path: /etc/network/interfaces
+    content: |
+      auto ens3
+      iface ens3 inet static
+      address $management_static_ip
+      netmask 255.255.255.192
+      gateway $management_gw
+      dns-nameservers $dnsaddress
+
+      auto ens4
+      iface ens4 inet static
+      address $control_static_ip
+      netmask 255.255.255.0
+
+  - path: /etc/bash_completion.d/fuel_devops30_activate
+    content: |
+      source /home/jenkins/fuel-devops30/bin/activate
diff --git a/tcp_tests/templates/bm-cicd-queens-ovs-maas/underlay-userdata.yaml b/tcp_tests/templates/bm-cicd-queens-ovs-maas/underlay-userdata.yaml
new file mode 100644
index 0000000..567a445
--- /dev/null
+++ b/tcp_tests/templates/bm-cicd-queens-ovs-maas/underlay-userdata.yaml
@@ -0,0 +1,78 @@
+#cloud-config, see http://cloudinit.readthedocs.io/en/latest/topics/examples.html
+
+ssh_pwauth: True
+users:
+   - name: root
+     sudo: ALL=(ALL) NOPASSWD:ALL
+     shell: /bin/bash
+
+disable_root: false
+chpasswd:
+   list: |
+    root:r00tme
+   expire: False
+
+bootcmd:
+   # Enable root access
+   - sed -i -e '/^PermitRootLogin/s/^.*$/PermitRootLogin yes/' /etc/ssh/sshd_config
+   - service sshd restart
+output:
+    all: '| tee -a /var/log/cloud-init-output.log /dev/tty0'
+
+runcmd:
+   - if lvs vg0; then pvresize /dev/vda3; fi
+   - if lvs vg0; then /usr/bin/growlvm.py --image-layout-file /usr/share/growlvm/image-layout.yml; fi
+
+   - export TERM=linux
+   - export LANG=C
+   # Configure dhclient
+   - sudo resolvconf -u
+   #- sudo echo "nameserver {gateway}" >> /etc/resolvconf/resolv.conf.d/base
+   # Enable grub menu using updated config below
+   - update-grub
+
+   # Prepare network connection
+   - sudo ifup ens3
+   #- sudo route add default gw {gateway} {interface_name}
+
+   # Create swap
+   - fallocate -l 16G /swapfile
+   - chmod 600 /swapfile
+   - mkswap /swapfile
+   - swapon /swapfile
+   - echo "/swapfile   none    swap    defaults   0   0" >> /etc/fstab
+
+write_files:
+   - path: /etc/default/grub.d/97-enable-grub-menu.cfg
+     content: |
+         GRUB_RECORDFAIL_TIMEOUT=30
+         GRUB_TIMEOUT=3
+         GRUB_TIMEOUT_STYLE=menu
+
+   - path: /etc/network/interfaces
+     content: |
+          auto ens3
+          iface ens3 inet dhcp
+
+   - path: /usr/share/growlvm/image-layout.yml
+     content: |
+       root:
+         size: '65%VG'
+       home:
+         size: '1%VG'
+       var_log:
+         size: '10%VG'
+       var_log_audit:
+         size: '5%VG'
+       var_tmp:
+         size: '10%VG'
+       tmp:
+         size: '5%VG'
+     owner: root:root
+
+growpart:
+    mode: auto
+    devices:
+      - '/'
+      - '/dev/vda3'
+    ignore_growroot_disabled: false
diff --git a/tcp_tests/templates/bm-cicd-queens-ovs-maas/underlay.hot b/tcp_tests/templates/bm-cicd-queens-ovs-maas/underlay.hot
new file mode 100644
index 0000000..060ddab
--- /dev/null
+++ b/tcp_tests/templates/bm-cicd-queens-ovs-maas/underlay.hot
@@ -0,0 +1,99 @@
+---
+
+heat_template_version: queens
+
+description: MCP environment for bm-cicd-queens-ovs-maas
+
+parameters:
+  instance_domain:
+    type: string
+    default: bm-cicd-queens-ovs-maas.local
+  mcp_version:
+    type: string
+  env_name:
+    type: string
+  key_pair:
+    type: string
+  cfg_flavor:
+    type: string
+  foundation_image:
+    type: string
+  foundation_flavor:
+    type: string
+
+resources:
+  subnets:
+    type: MCP::Subnets
+    properties:
+      stack_name: { get_param: "OS::stack_name" }
+      env_name: { get_param: env_name }
+      management_net: 'system-phys-2401'
+      control_net: 'system-phys-2404'
+      tenant_net: 'system-phys-2406'
+      external_net: 'system-phys-2403'
+
+  #flavors:
+  #  type: MCP::Flavors
+
+  cfg01_node:
+    type: MCP::MasterNode
+    depends_on: [subnets]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      cfg01_flavor: { get_param: cfg_flavor }
+      management_net: 'system-phys-2401'
+      control_net: 'system-phys-2404'
+      tenant_net: 'system-phys-2406'
+      external_net: 'system-phys-2403'
+      tenant_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [subnets, tenant_net_prefix] }, '5' ]
+      external_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [subnets, external_net_prefix] }, '5' ]
+      instance_name: cfg01
+      instance_domain: {get_param: instance_domain}
+
+  foundation_node:
+    type: MCP::FoundationNode
+    depends_on: [subnets]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance_name: foundation
+      management_net: 'system-phys-2401'
+      control_net: 'system-phys-2404'
+      tenant_net: 'system-phys-2406'
+      external_net: 'system-phys-2403'
+      instance_image: { get_param: foundation_image }
+      instance_flavor: {get_param: foundation_flavor}
+      underlay_userdata: { get_file: ./underlay--user-data-foundation.yaml }
+      management_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [subnets, management_net_prefix] }, '62' ]
+      control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [subnets, control_net_prefix] }, '6' ]
+      tenant_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [subnets, tenant_net_prefix] }, '6' ]
+      external_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [subnets, external_net_prefix] }, '6' ]
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+outputs:
+  foundation_public_ip:
+    description: foundation node IP address (management)
+    value:
+      get_attr:
+      - foundation_node
+      - instance_address
+...
diff --git a/tcp_tests/templates/bm-cicd-queens-ovs-maas/underlay.yaml b/tcp_tests/templates/bm-cicd-queens-ovs-maas/underlay.yaml
deleted file mode 100644
index 9ed29bc..0000000
--- a/tcp_tests/templates/bm-cicd-queens-ovs-maas/underlay.yaml
+++ /dev/null
@@ -1,127 +0,0 @@
-# Set the repository suite, one of the: 'nightly', 'testing', 'stable', or any other required
-{% set REPOSITORY_SUITE = os_env('REPOSITORY_SUITE', 'proposed') %}
-{% set LAB_CONFIG_NAME = os_env('LAB_CONFIG_NAME', 'bm-cicd-queens-ovs-maas') %}
-{% set DOMAIN_NAME = os_env('DOMAIN_NAME', LAB_CONFIG_NAME + '.local') %}
-{% set HOSTNAME_CFG01 = os_env('HOSTNAME_CFG01', 'cfg01.' + DOMAIN_NAME) %}
-
-{% set ETH1_IP_ADDRESS_CFG01 = os_env('ETH1_IP_ADDRESS_CFG01', '172.16.164.2') %}
-
----
-aliases:
- - &interface_model {{ os_env('INTERFACE_MODEL', 'virtio') }}
- - &cloudinit_meta_data {{ CLOUDINIT_META_DATA }}
- - &cloudinit_user_data_cfg01 {{ CLOUDINIT_USER_DATA_CFG01 }}
-
-template:
-  devops_settings:
-    env_name: {{ os_env('ENV_NAME', 'bm-cicd-queens-ovs-maas_' + REPOSITORY_SUITE + "_" + os_env('BUILD_NUMBER', '')) }}
-
-    address_pools:
-      admin-pool01:
-        net: {{ os_env('ADMIN_ADDRESS_POOL01', '172.16.164.0/26:26') }}
-        params:
-          ip_reserved:
-            gateway: +1
-            l2_network_device: +1
-            default_{{ HOSTNAME_CFG01 }}: {{ ETH1_IP_ADDRESS_CFG01 }}
-          ip_ranges:
-              dhcp: [+2, -4]
-      private-pool01:
-        net: {{ os_env('PRIVATE_ADDRESS_POOL01', '10.167.11.0/24:24') }}
-        params:
-          ip_reserved:
-            gateway: +1
-            l2_network_device: +1
-          ip_ranges:
-              dhcp: [+2, -4]
-
-      tenant-pool01:
-        net: {{ os_env('TENANT_ADDRESS_POOL01', '10.167.12.0/24:24') }}
-        params:
-          ip_reserved:
-            gateway: +1
-            l2_network_device: +1
-          ip_ranges:
-              dhcp: [+2, -4]
-
-      external-pool01:
-        net: {{ os_env('EXTERNAL_ADDRESS_POOL01', '172.17.42.0/26:26') }}
-        params:
-          ip_reserved:
-            gateway: '172.17.42.1'
-          ip_ranges:
-              dhcp: ['172.17.42.10', '172.17.42.20']
-
-
-    groups:
-      - name: default
-        driver:
-          name: devops.driver.libvirt
-          params:
-            connection_string: !os_env CONNECTION_STRING, qemu:///system
-            storage_pool_name: !os_env STORAGE_POOL_NAME, default
-            stp: False
-            hpet: False
-            enable_acpi: true
-            use_host_cpu: !os_env DRIVER_USE_HOST_CPU, true
-            use_hugepages: !os_env DRIVER_USE_HUGEPAGES, false
-
-        network_pools:
-          admin: admin-pool01
-
-        l2_network_devices:
-          # maas management interface
-          admin:
-            address_pool: admin-pool01
-            dhcp: false
-            forward:
-              mode: bridge
-            parent_iface:
-              phys_dev: !os_env LAB_MANAGEMENT_IFACE
-          private:
-            address_pool: private-pool01
-            dhcp: false
-            forward:
-              mode: bridge
-            parent_iface:
-              phys_dev: !os_env LAB_CONTROL_IFACE
-
-        group_volumes:
-         - name: cfg01_day01_image               # Pre-configured day01 image
-           source_image: {{ os_env('IMAGE_PATH_CFG01_DAY01') }} # http://images.mirantis.com/cfg01-day01.qcow2 or fallback to IMAGE_PATH1604
-           format: qcow2
-
-        nodes:
-          - name: {{ HOSTNAME_CFG01 }}
-            role: salt_master
-            params:
-              vcpu: !os_env SLAVE_NODE_CPU, 8
-              memory: !os_env SLAVE_NODE_MEMORY, 20480
-              boot:
-                - hd
-              volumes:
-                - name: system
-                  capacity: !os_env NODE_VOLUME_SIZE, 150
-                  backing_store: cfg01_day01_image
-                  format: qcow2
-                - name: config
-                  capacity: 1
-                  format: raw
-                  device: cdrom
-                  bus: ide
-
-              interfaces:
-                - label: ens3
-                  l2_network_device: admin
-                  interface_model: *interface_model
-                - label: ens4
-                  l2_network_device: private
-                  interface_model: *interface_model
-
-              network_config:
-                ens3:
-                  networks:
-                    - admin
-                ens4:
-                  networks:
-                    - private
diff --git a/tcp_tests/templates/cookied-model-generator/salt_bm-cicd-pike-ovs-maas.yaml b/tcp_tests/templates/cookied-model-generator/salt_bm-cicd-pike-ovs-maas.yaml
index cb12b3f..ba710e8 100644
--- a/tcp_tests/templates/cookied-model-generator/salt_bm-cicd-pike-ovs-maas.yaml
+++ b/tcp_tests/templates/cookied-model-generator/salt_bm-cicd-pike-ovs-maas.yaml
@@ -19,12 +19,12 @@
 
 {{ SHARED.MACRO_INSTALL_PACKAGES_ON_NODES(HOSTNAME_CFG01) }}
 
-
 {{ SHARED.MACRO_INSTALL_FORMULAS_FROM_UPDATE() }}
 
-
 {{ SHARED.MACRO_INSTALL_FORMULAS('\*') }}
 
+{{ SHARED.MACRO_UPLOAD_AND_IMPORT_GPG_ENCRYPTION_KEY() }}
+
 {{ SHARED.MACRO_GENERATE_COOKIECUTTER_MODEL(CONTROL_VLAN=CONTROL_VLAN, TENANT_VLAN=TENANT_VLAN) }}
 
 {{ SHARED.MACRO_GENERATE_AND_ENABLE_ENVIRONMENT_MODEL() }}