diff --git a/tcp_tests/templates/cookied-model-generator/salt_heat-cicd-k8s-calico-sl.yaml b/tcp_tests/templates/cookied-model-generator/salt_heat-cicd-k8s-calico-sl.yaml
new file mode 100644
index 0000000..4aaa2bf
--- /dev/null
+++ b/tcp_tests/templates/cookied-model-generator/salt_heat-cicd-k8s-calico-sl.yaml
@@ -0,0 +1,23 @@
+{% from 'cookied-model-generator/underlay.yaml' import HOSTNAME_CFG01 with context %}
+{% from 'cookied-model-generator/underlay.yaml' import DOMAIN_NAME with context %}
+
+{% set LAB_CONFIG_NAME = 'heat-cicd-k8s-calico-sl' %}
+# Name of the context file (without extension, that is fixed .yaml) used to render the Environment model
+{% set ENVIRONMENT_MODEL_INVENTORY_NAME = os_env('ENVIRONMENT_MODEL_INVENTORY_NAME', LAB_CONFIG_NAME) %}
+# Path to the context files used to render Cluster and Environment models
+{%- set CLUSTER_CONTEXT_NAME = 'cookiecutter-context-k8s-sl.yaml' %}
+{%- set ENVIRONMENT_CONTEXT_NAMES = ['environment-context-k8s-sl.yaml', 'cookiecutter-context-k8s-sl.yaml'] %}
+
+{% import 'shared-salt.yaml' as SHARED with context %}
+
+{{ SHARED.MACRO_INSTALL_PACKAGES_ON_NODES(HOSTNAME_CFG01) }}
+
+{{ SHARED.MACRO_INSTALL_FORMULAS('\*') }}
+
+{{ SHARED.MACRO_UPLOAD_AND_IMPORT_GPG_ENCRYPTION_KEY() }}
+
+{{ SHARED.MACRO_GENERATE_COOKIECUTTER_MODEL() }}
+
+{{ SHARED.MACRO_GENERATE_AND_ENABLE_ENVIRONMENT_MODEL() }}
+
+{{ SHARED.MACRO_GENERATE_INVENTORY(RERUN_SALTMASTER_STATE=true) }}
diff --git a/tcp_tests/templates/heat-cicd-k8s-calico-sl/cookiecutter-context-k8s-sl.yaml b/tcp_tests/templates/heat-cicd-k8s-calico-sl/cookiecutter-context-k8s-sl.yaml
new file mode 100644
index 0000000..40b5867
--- /dev/null
+++ b/tcp_tests/templates/heat-cicd-k8s-calico-sl/cookiecutter-context-k8s-sl.yaml
@@ -0,0 +1,215 @@
+default_context:
+  auditd_enabled: 'False'
+  backup_private_key: |
+      -----BEGIN RSA PRIVATE KEY-----
+      MIIEowIBAAKCAQEAxL6/rVgCetsETpZaUmXmkj8cZ1WN0eubH1FvMDOi/La9ZJyT
+      k0C6AYpJnIyEm93pMj5cLm08qRqMW+2pdOhYjcH69yg5MrX5SkRk8jCmIHIYoIbh
+      Qnwbnj3dd3I39ZdfU2FO7u2vlbglVou6ZoQxlJDItuLNtzq6EG+w9eF19e7+OsC6
+      6iUItp618zfw1l3J/8nKvCGe2RYDf7mJW6XwCl/DwryJmwwzvPgYJ3QMuDD8/HFj
+      lrJ3xjFTXj4b4Ws1XIoy78fFbtiLr4OwqCYkho03u2E5rOOP1qZxZB63sivHMLMO
+      MM5bOAQKbulFNoyALADGYfc7sf0bZ4u9XXDXxQIDAQABAoIBAQCfmc2MJRT97KW1
+      yqpCpX9BrAiymuiNHf+cjEcSZxEUyHkjIRFmJt+9WB0W7ba1anM92vCUiPDojSzH
+      dig9Oi578JxR20NrK8uqv4jUHzrknynzLveVI3CUEcOSnglfJQijbxDFKfOCFPvV
+      FUyE1UATMNBh6+LNfMprgu+exuMWOPnDyUiYQ+WZ0JfuZY8fuaZte4woJJOb9LUu
+      5rsMG/smIzjpgZ0Z9ZVDMurfq565qhpaXRAqKeIuyht8pacTo31iMQdHB78AvY/3
+      g0z21Gk8k3z0Kr/YFKr2r4FmXY5m/gAUvZly2ZrVQM5XsbTVCzq/JpI5fssNvSbU
+      AKmXzf4RAoGBAOO3d4/cstxERzW6hyOTjZIN1ppR52CsnZTsVPbfd0pCtmzmVZce
+      CtHKdcXSbTwZvvkK09QSWAp3MoSpd0gIOiLU8Wx/R/RIZsu9BlhTS3r3EQLnk72d
+      H/1TTA+j4T/LIYLSojQ1RxvIrHetAD44j732aTwKAHj/SybEAVqNkOB/AoGBAN0u
+      gLcrgqIHGrk4VjWSvlCGymfF40equcx+ud7XhfZDGETUOSahW4dPZ52cjPAkrCBQ
+      MMfcDwSVGsOAjd+mNt11BHUKobnhXwFaWWuyqyn9NmWFbjMbICVh7E3Of5aVN38o
+      lrmo/7LuKMVG7XRwphCv5NkaJmQG4njDyUQWlaW7AoGADCd8wDb9bPhP/LQqBmIX
+      ylXmwHHisaxE9O/wUQT4bwREjGd25gv6c9wkkRx8LBsLsGs9hzI7dMOL9Ly+2x9l
+      SvqmsC3S/1zl77X1Ir2/Z57MT6Vgo1xBmtnZU3Rhz2/eKAdqFPNLClaZrgGT475N
+      HcyLLWMzR0IJFtabY+Puea0CgYA8Zb5wRkldxWLewSuJZZDinGwY+kieAVjLJq/K
+      0j+ah6fQ48LXcah0wpIgz+cMjHcUO9GWQdk3/x9X03rqX5EL2DBnZYfUIl63F9zj
+      M97ZkHOSNWVqPzX//0Vv2butewG0j3jZKfTo/2/SrxOYgEpYtC9huWpSVi7xm0US
+      erhSkQKBgFIf9JEsfgE57ANhvITZ3ZI0uZXNxZkXQaVg8jvScDi79IIhy9iPzhKC
+      aIIQoDNIlWv1ftCRZ5AlBvVXgvQ/QNrwy48JiQTzWZlb9Ezg8w+olQmSbG6fq7Y+
+      7r3i+QUZ7RBdOb24QcQ618q54ozNTCB7OywY78ptFzeoBeptiNr1
+      -----END RSA PRIVATE KEY-----
+  backup_public_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEvr+tWAJ62wROllpSZeaSPxxnVY3R65sfUW8wM6L8tr1knJOTQLoBikmcjISb3ekyPlwubTypGoxb7al06FiNwfr3KDkytflKRGTyMKYgchighuFCfBuePd13cjf1l19TYU7u7a+VuCVWi7pmhDGUkMi24s23OroQb7D14XX17v46wLrqJQi2nrXzN/DWXcn/ycq8IZ7ZFgN/uYlbpfAKX8PCvImbDDO8+BgndAy4MPz8cWOWsnfGMVNePhvhazVcijLvx8Vu2Iuvg7CoJiSGjTe7YTms44/WpnFkHreyK8cwsw4wzls4BApu6UU2jIAsAMZh9zux/Rtni71dcNfF
+  bmk_enabled: 'False'
+  calico_cni_image: docker-prod-local.artifactory.mirantis.com/mirantis/projectcalico/calico/cni:latest
+  calico_enable_nat: 'True'
+  calico_image: docker-prod-local.artifactory.mirantis.com/mirantis/projectcalico/calico/node:latest
+  calico_netmask: '16'
+  calico_network: 192.168.0.0
+  calicoctl_image: docker-prod-local.artifactory.mirantis.com/mirantis/projectcalico/calico/ctl:latest
+  ceph_enabled: 'False'
+  cicd_control_node01_address: ==IPV4_NET_CONTROL_PREFIX==.91
+  cicd_control_node01_hostname: cid01
+  cicd_control_node02_address: ==IPV4_NET_CONTROL_PREFIX==.92
+  cicd_control_node02_hostname: cid02
+  cicd_control_node03_address: ==IPV4_NET_CONTROL_PREFIX==.93
+  cicd_control_node03_hostname: cid03
+  cicd_control_vip_address: ==IPV4_NET_CONTROL_PREFIX==.90
+  cicd_control_vip_hostname: cid
+  cicd_enabled: 'True'
+  cicd_private_key: |-
+    -----BEGIN RSA PRIVATE KEY-----
+    MIIEpAIBAAKCAQEAv64AnFbEuuOQHLlmMkmaZ+Hh/8hJ+VfFpJ/MzW1wWzYyhis7
+    3A8rxNFWJ/I1/LJSsFI8qU0DpxjFjS9LMTTFXhDPPpuzgRLwfVusEmuQdXjOiT34
+    AIs07Q4w1nlvJ2+/l788ie1AEfnewd9erUHOs8Wt/PT3OOM/0ikY7EibvYF4L1Lb
+    xGRKYnUkY7G3eal9XcQpsTzAFRXoK3WafbCFBFsfzEWOhx1T+tn1SwaxPYJDt1OB
+    B1s77enFtBwbmbd0m1F1ufSXmdWea2xF3+5caS6tps/hwhCoOSJUQb7+dK4ri8og
+    q2YIhfEptrMP1R+nVqEY76P31aa/YSw4zOvcQwIDAQABAoIBAQCLKOzQlD4n4ObT
+    s9Z6U+2B1gCaDvOFzy9yoYGy8u1Li0GLHwBKd8kzDzgZsEN5vo1B7bKUx5ELU3S5
+    V8ijZMiVzmZn8eqUnwdyO4flp6otXxOzmAXhfy9hm5fhXjBQ1VSn+vMcv95wLpSG
+    9IBsEQbchXwX1lFWP8Yp8iRiByTqoz6A7qSxRzIOtq1/coYS9Vcy7VZDMiUjqvuc
+    pYvwYHvrgeYqxLXyDRzbZX1BbkSoNI/5VwxLb9IMG901IXph0r4V3uVgnnq+Xzkk
+    MoOfmB3cyOrvtWblZAjkyA+jzTs/QNALRUeI7wUeh4FvlwEGHE6v5G4G28zOS0vL
+    7IEhCqThAoGBAOeyDO07b060l+NOO+Jkv+NV31VD0w3S4TMyLPVSxXsrRPoHM9RM
+    udi6lewmALE4wk2Lc1Il6n0UrUGVbXxf55NJp2BQoSic+ZK2nTki0cZ/CkUDVNwY
+    R0WtWE0i3J+eF3e8j9VYm1mIlv0aDoYeH4qCp5is/JanvLy4MUl6tM7/AoGBANPJ
+    XheDO5lmqq1ejDTo3GAzYuAs44dQLDs0znEuuaUKZ4MKgQ4ax0L9n0MxvsuUGVcN
+    Nm7fZS4uMY3zLCOLcAXyD1jXY210gmOgFdXeYrH+2kSmqfflV8KHOLCatxLzRtbe
+    KBflcrEnrpUVNGKlpZaYr+4AyapXeMuXIxwveva9AoGAYtoDS9/UwHaqau+A+zlS
+    6TJFA8LZNAepz0b0CYLUAJXYavhRs508mWwZ9NPN7c6yj5UUkZLdtZnxxY50VOEy
+    ExQUljIwX/yBOogxEiR57b9b6U/fj7vIBMFNcDOUf4Far9pCX5rbRNrS2I+abLxD
+    ZrwRt0Duz3QnQTkwxhHVPI8CgYAaIjQJJLl7AW84O32DneRrvouJ7CAbd2ot2CNN
+    Vh20XudNBUPNkMJb4t3/Nak8h8bktg2sesaKf0rAIGym6jLlmOwJ43IydHkOgBeR
+    r4JwQml+pS4+F7/Pkk4NhNnobbqlEv7RjA+uCp6BaP9w2M3pGmhDLzezXF3ciYbc
+    mINM5QKBgQCyM9ZWwSiA0D3oitnhs7C4eC0IHBfnSoa7f40osKm4VvmqKBFgRu8L
+    qYK9qX++pUm4sk0q7poGUscc1udMlejAkfc/HLIlUi6MM+S7ZQ2NHtnZ7COZa5O4
+    9fG8FTiigLvMHka9ihYXtPbyGvusCaqyHp3D9VyOT+WsyM5eJe40lA==
+    -----END RSA PRIVATE KEY-----
+  cicd_public_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/rgCcVsS645AcuWYySZpn4eH/yEn5V8Wkn8zNbXBbNjKGKzvcDyvE0VYn8jX8slKwUjypTQOnGMWNL0sxNMVeEM8+m7OBEvB9W6wSa5B1eM6JPfgAizTtDjDWeW8nb7+XvzyJ7UAR+d7B316tQc6zxa389Pc44z/SKRjsSJu9gXgvUtvEZEpidSRjsbd5qX1dxCmxPMAVFegrdZp9sIUEWx/MRY6HHVP62fVLBrE9gkO3U4EHWzvt6cW0HBuZt3SbUXW59JeZ1Z5rbEXf7lxpLq2mz+HCEKg5IlRBvv50riuLyiCrZgiF8Sm2sw/VH6dWoRjvo/fVpr9hLDjM69xD
+  cluster_domain: heat-cicd-k8s-calico-sl.local
+  cluster_name: heat-cicd-k8s-calico-sl
+  context_seed: T3sbEdCaBfxrg9ysyA6LIaift250Ktb389rpcISKbdqPi5j0WHKiKAhBftYueBKl
+  control_network_netmask: 255.255.255.0
+  control_network_subnet: ==IPV4_NET_CONTROL_PREFIX==.0/24
+  control_vlan: '10'
+  cookiecutter_template_branch: ''
+  jenkins_pipelines_branch: 'release/2019.2.0'
+  cookiecutter_template_credentials: gerrit
+  cookiecutter_template_url: https://gerrit.mcp.mirantis.com/mk/cookiecutter-templates.git
+  deploy_network_gateway: ==IPV4_NET_ADMIN_PREFIX==.1
+  deploy_network_netmask: 255.255.255.0
+  deploy_network_subnet: ==IPV4_NET_ADMIN_PREFIX==.0/24
+  deployment_type: physical
+  dns_server01: 172.18.176.6
+  dns_server02: 172.18.208.44
+  email_address: ddmitriev@mirantis.com
+  etcd_ssl: 'True'
+  infra_bond_mode: active-backup
+  infra_deploy_nic: eth0
+  infra_kvm01_control_address: ==IPV4_NET_CONTROL_PREFIX==.241
+  infra_kvm01_deploy_address: ==IPV4_NET_ADMIN_PREFIX==.91
+  infra_kvm01_hostname: kvm01
+  infra_kvm02_control_address: ==IPV4_NET_CONTROL_PREFIX==.242
+  infra_kvm02_deploy_address: ==IPV4_NET_ADMIN_PREFIX==.92
+  infra_kvm02_hostname: kvm02
+  infra_kvm03_control_address: ==IPV4_NET_CONTROL_PREFIX==.243
+  infra_kvm03_deploy_address: ==IPV4_NET_ADMIN_PREFIX==.93
+  infra_kvm03_hostname: kvm03
+  infra_kvm_vip_address: ==IPV4_NET_CONTROL_PREFIX==.240
+  infra_primary_first_nic: eth1
+  infra_primary_second_nic: eth2
+  internal_proxy_enabled: 'False'
+  kqueen_custom_mail_enabled: 'False'
+  kqueen_enabled: 'False'
+  kubernetes_control_address: ==IPV4_NET_CONTROL_PREFIX==.10
+  kubernetes_control_node01_address: ==IPV4_NET_CONTROL_PREFIX==.11
+  kubernetes_control_node01_deploy_address: ==IPV4_NET_ADMIN_PREFIX==.11
+  kubernetes_control_node01_hostname: ctl01
+  kubernetes_control_node02_address: ==IPV4_NET_CONTROL_PREFIX==.12
+  kubernetes_control_node02_deploy_address: ==IPV4_NET_ADMIN_PREFIX==.12
+  kubernetes_control_node02_hostname: ctl02
+  kubernetes_control_node03_address: ==IPV4_NET_CONTROL_PREFIX==.13
+  kubernetes_control_node03_deploy_address: ==IPV4_NET_ADMIN_PREFIX==.13
+  kubernetes_control_node03_hostname: ctl03
+  kubernetes_compute_count: 4
+  kubernetes_compute_rack01_hostname: cmp
+  kubernetes_compute_deploy_address_ranges: ==IPV4_NET_ADMIN_PREFIX==.101-==IPV4_NET_ADMIN_PREFIX==.104
+  kubernetes_compute_single_address_ranges: ==IPV4_NET_CONTROL_PREFIX==.101-==IPV4_NET_CONTROL_PREFIX==.104
+  kubernetes_compute_tenant_address_ranges: ==IPV4_NET_TENANT_PREFIX==.101-==IPV4_NET_TENANT_PREFIX==.104
+  kubernetes_enabled: 'True'
+  kubernetes_externaldns_enabled: 'False'
+  kubernetes_keepalived_vip_interface: br_ctl
+  kubernetes_network_calico_enabled: 'True'
+  kubernetes_virtlet_enabled: 'True'
+  kubernetes_proxy_hostname: prx
+  kubernetes_proxy_node01_hostname: prx01
+  kubernetes_proxy_node02_hostname: prx02
+  kubernetes_proxy_address: ==IPV4_NET_CONTROL_PREFIX==.220
+  kubernetes_proxy_node01_address: ==IPV4_NET_CONTROL_PREFIX==.221
+  kubernetes_proxy_node02_address: ==IPV4_NET_CONTROL_PREFIX==.222
+  kubernetes_metallb_enabled: 'True'
+  metallb_addresses: 172.17.16.150-172.17.16.190
+  kubernetes_ingressnginx_enabled: 'True'
+  kubernetes_ingressnginx_controller_replicas: 2
+  local_repositories: 'False'
+  maas_deploy_address: ==IPV4_NET_ADMIN_PREFIX==.15
+  maas_deploy_range_end: ==IPV4_NET_ADMIN_PREFIX==.199
+  maas_deploy_range_start: ==IPV4_NET_ADMIN_PREFIX==.180
+  maas_deploy_vlan: '0'
+  maas_fabric_name: deploy-fabric0
+  maas_hostname: cfg01
+  mcp_common_scripts_branch: ''
+  mcp_version: proposed
+  offline_deployment: 'False'
+  opencontrail_enabled: 'False'
+  openldap_domain: ${_param:cluster_name}.local
+  openldap_enabled: 'True'
+  openldap_organisation: ${_param:cluster_name}
+  openssh_groups: cicd
+  openstack_enabled: 'False'
+  oss_enabled: 'False'
+  oss_node03_address: ${_param:stacklight_monitor_node03_address}
+  oss_webhook_app_id: '24'
+  oss_pushkin_email_sender_password: password
+  oss_pushkin_smtp_port: '587'
+  oss_webhook_login_id: '13'
+  platform: kubernetes_enabled
+  public_host: ${_param:infra_config_address}
+  publication_method: email
+  reclass_repository: https://github.com/Mirantis/mk-lab-salt-model.git
+  salt_api_password: LTlVnap35hqpRVbB5QjA27EuKh9Ttl3k
+  salt_api_password_hash: $6$RKagUPuQ$Javpjz7b.hqKOOr1rai7uGQd/FnqlOH59tXn12/0G.LkVyunYmgBkSC5zTjoqZvIS1fOOOqsmCb9Q4HcGUbXS.
+  salt_master_address: ==IPV4_NET_CONTROL_PREFIX==.15
+  salt_master_hostname: cfg01
+  salt_master_management_address: ==IPV4_NET_ADMIN_PREFIX==.15
+  shared_reclass_branch: 'proposed'
+  shared_reclass_url: https://gerrit.mcp.mirantis.com/salt-models/reclass-system.git
+  stacklight_enabled: 'True'
+  stacklight_log_address: ==IPV4_NET_CONTROL_PREFIX==.60
+  stacklight_log_hostname: log
+  stacklight_log_node01_address: ==IPV4_NET_CONTROL_PREFIX==.61
+  stacklight_log_node01_hostname: log01
+  stacklight_log_node02_address: ==IPV4_NET_CONTROL_PREFIX==.62
+  stacklight_log_node02_hostname: log02
+  stacklight_log_node03_address: ==IPV4_NET_CONTROL_PREFIX==.63
+  stacklight_log_node03_hostname: log03
+  stacklight_long_term_storage_type: prometheus
+  stacklight_monitor_address: ==IPV4_NET_CONTROL_PREFIX==.70
+  stacklight_monitor_hostname: mon
+  stacklight_monitor_node01_address: ==IPV4_NET_CONTROL_PREFIX==.71
+  stacklight_monitor_node01_hostname: mon01
+  stacklight_monitor_node02_address: ==IPV4_NET_CONTROL_PREFIX==.72
+  stacklight_monitor_node02_hostname: mon02
+  stacklight_monitor_node03_address: ==IPV4_NET_CONTROL_PREFIX==.73
+  stacklight_monitor_node03_hostname: mon03
+  stacklight_telemetry_address: ==IPV4_NET_CONTROL_PREFIX==.85
+  stacklight_telemetry_hostname: mtr
+  stacklight_telemetry_node01_address: ==IPV4_NET_CONTROL_PREFIX==.86
+  stacklight_telemetry_node01_hostname: mtr01
+  stacklight_telemetry_node02_address: ==IPV4_NET_CONTROL_PREFIX==.87
+  stacklight_telemetry_node02_hostname: mtr02
+  stacklight_telemetry_node03_address: ==IPV4_NET_CONTROL_PREFIX==.88
+  stacklight_telemetry_node03_hostname: mtr03
+  stacklight_version: '2'
+  static_ips_on_deploy_network_enabled: 'False'
+  tenant_network_gateway: ==IPV4_NET_TENANT_PREFIX==.1
+  tenant_network_netmask: 255.255.255.0
+  tenant_network_subnet: ==IPV4_NET_TENANT_PREFIX==.0/24
+  tenant_vlan: '20'
+  upstream_proxy_enabled: 'False'
+  use_default_network_scheme: 'False'
+  vnf_onboarding_enabled: 'False'
+  secrets_encryption_enabled: 'True'
+  secrets_encryption_key_id: 'F5CB2ADC36159B03'
+  # Used on CI only.
+  secrets_encryption_private_key: ''
+  kubernetes_helm_enabled: 'True'
diff --git a/tcp_tests/templates/heat-cicd-k8s-calico-sl/encryption-key.asc b/tcp_tests/templates/heat-cicd-k8s-calico-sl/encryption-key.asc
new file mode 100644
index 0000000..381eb77
--- /dev/null
+++ b/tcp_tests/templates/heat-cicd-k8s-calico-sl/encryption-key.asc
@@ -0,0 +1,56 @@
+-----BEGIN PGP PRIVATE KEY BLOCK-----
+
+lQcYBFyBRcUBEACmP/muUIwbEg6Z7dA3c9I2NadcjDHXKg/ViXwaOB4KSd9/FC0o
+KSBPccWb+1sm+zdUy2f/LC5r8RvU7yZd4Mbzz8R1DQncXg4nG7bppW7oAcHpc0jk
+pV/SvdMYxuXsrbKbpoGEquwVkbb4oTv2MLSBfGfFzBeQfiwGEWm1xPLSeXc4biLC
+FatCU7w4LS1U4BEOqRCp6lW/hQFLoX+j6rNT8TwC5AeFpKgUWuQZGOO4fZKpbvo2
+sCvF5VA1HSVXlZtzum6pL1yzLL/SoyLrYOy1KrZQmSBHG9htCZQVmvYK7U5WtWE4
+Ws5IAj+HwvgKyzXE2Srsirj1NqauQRsk+1riQk3rpDrX2BeXNUSoHR5M/RDY0gCc
+8P6heanQRnyFtjUSoovkQsydY77+QVxe0MCs+lZlg31fL+wJVG7FIbIKKwR5sj8i
+/JqhWE+t2ZzIrQ/7o7fRk7hv/u69Vb/t/Nt7fkbn53zoubqi3kNgXf6hwhTUtfW/
+lE9cc4JTzis4i/RnILUDnAwos1c0Z+tGCUo4pbiP71VfU8L259g+clPFXOIkqA9t
+L9JSZQfhH/lRj3Abs57OvZjN7/D1h8PWB+8nTB8bkoUt45SubgQb0Y9maWUcwjxw
+AcJSIk6mq8vVdBu7zOuslDjMnoUZbtJwcSwQQOnb9UUppjs3CjbcH80ttQARAQAB
+AA/9ExdprtDlJf6u2pJqxNNyInOK4p/e4VydMOJ28/PZz0iod8lzXhdK9JSWItF8
+qD9VHVG2gaErO44Wqh9EgqdbcYg8gUycA0hxy5/tI2uyDsaU5CAvEMLE/Eh8Q24j
+3UgdKK64VOnj7p4rKuYpIp55PB1zNU24rwkuOQwq3Yreb7kvLbXIHA2s+xLunGzj
+tcl9a/eSSFD2w+WcPnkvVT2QlmUvhQ12p6w++QdvBkrLa9ZPz1FFPp6AiFtLGK5e
+KW6uyV1xc9BSjujmpmPBkNIynKNpCFxtTn0uH2doMAr5kkuqIV726SfUZISNkyOa
+pHKtnAtsWHmdv9skzQIBAgAzcXTBGbdDxRj6QR+ohqbsCzfu3z9QHSbXUmxezti9
+bQqpsU1SIg8z2oDARFR6KlRzhnfpPvan+Gp9TvYsvxrXe61HpxRMdLj6Gt2Ibruf
+YHCtr1S9J5CzTTOurlIKpACUYIqgVXfgIkQzqiYX8e56PiDTUB++OqEg66i0orXB
+nbHAD2vu16CNvcaNqsak3DWkHMwmEfsuxqyUXNte0eYu9SCHtnNoYT/D7A72gK4b
+Gqg80J8ZCpo1ilIX3xUq8WsH+CoXs0X7hy6Cbi22AqnHFRYmrgoIWmRzJonp393b
+yqmTV+QsKQRpmwdX4hiH78zJLnLEUQMn8CuHAGwaJCzk4okIAMKNrIQZhkdbCCe4
+IrLuMKn4aQj3c22SMXNmu78/0cP9Rtsm3ChjzzelLO7NjvPm0nIvEcThFSIZIXCv
+iWGZCXFCKn3WtA5xWuMFNXsEQcc3AG/qRODdDSeFpo+VH/9IwppAc3zI2jxe1PRD
+G2DnheLaLIKgHunsCYxpftJDod/vRqRHeU7ulMVJfEKVxdzrCbKGiIOXSyS6KowQ
+JOxF/80ocq/25Zc/oH25Y2r/0y+xzDpOHBgU0ndrCZf2z8oOuECJTxcq83UDyJzT
+HrG/hTrU83YsQMZ0AwBrYxpzUfdH7b6y60VE19FrwmMDK6Fz8I/x4Ai0sNkI3QLR
+NntY9fsIANrB3QM8CtsdxXsFvdTEwNLsG8LMdn3loCH6Cq3ejkEKa69Uua+sB6ND
+wYOXWzyksLZJyfxIXux/hMlK/kO3ohGcEFiMUaDZndJy8IKUlDrhwcUZqm7dXMDU
+CIf0T3rOEzOXbNu3UTds3j/ruSvA5KmjzOa4Qnb41CyL5Fh7x0R8Rux3NzAn6Ecx
+Y+nAWRtI/Yz7zdL8zuHaJfbVuxAPJ+ImcXAS7cX6T9dM3tWRlam1+0Ezhdb4F8i5
+lcY7sMu95scDwhV7qOmln6wtGSkBPZgE0+TqRuELZrPvlcIRRIM42UwPWhYO2PG8
+kKd2i5teweDnhzN8+E87VV2BQhP9DA8H/0+ZiXsvaG60JGqNmWzVbB6U1qgwrFOR
+VcuzIWpdZyQR8Ok63GXuA0odoqReolba9R6fVlXchj6INBz2WY2F0twwCRPx7tRg
+Pyq4PaTA8ZYYjAVWVCd9k97gY2i80p4MPzQCnE8g4n6OWGY47pcTwSkm4HBoGoam
+igIRn3Soz7CXGF+PvSGi1T0jpwM5IWfM3IwEUPdPTIJuA2iD/9zSKDvhsP+trJ1Y
+TMe9CW3Llf5mFbHLRZ7LfMOLIngKOIxBAxHiT8wUrIRaH78wHdz8ALDsC+LNP6rK
+hKb8h/VHXaqmf0BlNjGpO7XZXfxXWJ0oTUG5Z+jKz2Ir14HYLZI1GlOA8bQlZXhh
+bXBsZS5jb20gPHNhbHQtbWFzdGVyQGV4YW1wbGUuY29tPokCTgQTAQgAOBYhBLaR
+Vrvqyq56MiGjUvXLKtw2FZsDBQJcgUXFAhsvBQsJCAcCBhUKCQgLAgQWAgMBAh4B
+AheAAAoJEPXLKtw2FZsDpi4P/1kmvlpkbOhrL73zAPyMzYa4Yo2Pi/BoMbyEKNKO
+K3wLCdP6xLGecVIt8pANosksDSGlWAnWj36/jfgt/aZisx1u6MTYaOEHkXahxOX4
+ghDW1cTbdtz7Uy5Ah9O3WNI+ejmOpCtuc3P/XOkdttKZLuCNCs6ocgCsejpNHcFK
+vMhOhnRKV8kcBrG2QLyfSyafBtM/zV+NR4Wrng71Za8fiXHlDanmrAIyuSnD538r
+hTwSFe0C9HntwuF6W+UShN7c+jPJaKQjKbZy9fuFp33NcTSPCB5dH9yrhQvOeFQo
+dFzEabMDFVGPfUVWR+TH39dWYOsq5zFmgQAbOB/vHdmEtrYNrxX0AiCZZHQHTUb9
+oBK68V8eVeFdoRLcMORBZ2RCqkQTOQoAF7o772knltjtsymnI0XNvVC/XCnZv89Q
+/eoivrd/rMMpTFOGcys6EAnSUWx0ZG/JCkezQqnx9U219BvqKNOZ60aOeOYHKpsX
+Ha8Nr72YRmtm0UMsDjEUyLOj+o06XnN7uafMv2bZpjWh2hfOrkAbxe41z6t+78ho
+P+C5vSvp01OmAt71iq+62MXVcLVKEWDpiuZSj8m83RlY5AGIaPaGX9LKPcHdGxKw
+QSczgB/jI3G08vWaq82he6UJuYexbYe1iJXfvcx8kThwZ1nXQJm+7UsISUsh8/NZ
+x0n/
+=uxDD
+-----END PGP PRIVATE KEY BLOCK-----
diff --git a/tcp_tests/templates/heat-cicd-k8s-calico-sl/environment-context-k8s-sl.yaml b/tcp_tests/templates/heat-cicd-k8s-calico-sl/environment-context-k8s-sl.yaml
new file mode 100644
index 0000000..2d4689c
--- /dev/null
+++ b/tcp_tests/templates/heat-cicd-k8s-calico-sl/environment-context-k8s-sl.yaml
@@ -0,0 +1,244 @@
+nodes:
+    cfg01:
+      reclass_storage_name: infra_config_node01
+      roles:
+      - infra_config
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_static_ctl
+
+    kvm01:
+      reclass_storage_name: infra_kvm_node01
+      roles:
+      - infra_kvm
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    kvm02:
+      reclass_storage_name: infra_kvm_node02
+      roles:
+      - infra_kvm
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    kvm03:
+      reclass_storage_name: infra_kvm_node03
+      roles:
+      - infra_kvm
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    cid01:
+      reclass_storage_name: cicd_control_node01
+      roles:
+      - cicd_control_leader
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    cid02:
+      reclass_storage_name: cicd_control_node02
+      roles:
+      - cicd_control_manager
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    cid03:
+      reclass_storage_name: cicd_control_node03
+      roles:
+      - cicd_control_manager
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    ctl01:
+      reclass_storage_name: kubernetes_control_node01
+      roles:
+      - kubernetes_control
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl_calico
+
+    ctl02:
+      reclass_storage_name: kubernetes_control_node02
+      roles:
+      - kubernetes_control
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl_calico
+
+    ctl03:
+      reclass_storage_name: kubernetes_control_node03
+      roles:
+      - kubernetes_control
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl_calico
+
+    prx01:
+      reclass_storage_name: kubernetes_proxy_node01
+      roles:
+      - kubernetes_proxy
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    prx02:
+      reclass_storage_name: kubernetes_proxy_node02
+      roles:
+      - kubernetes_proxy
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    # Generator-based computes. For compatibility only
+    cmp<<count>>:
+      reclass_storage_name: kubernetes_compute_rack01
+      roles:
+      - kubernetes_compute
+      - linux_system_codename_xenial
+      - salt_master_host
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl_calico
+
+    mon01:
+      reclass_storage_name: stacklight_server_node01
+      roles:
+      - stacklightv2_server_leader
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    mon02:
+      reclass_storage_name: stacklight_server_node02
+      roles:
+      - stacklightv2_server
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    mon03:
+      reclass_storage_name: stacklight_server_node03
+      roles:
+      - stacklightv2_server
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    mtr01:
+      reclass_storage_name: stacklight_telemetry_node01
+      roles:
+      - stacklight_telemetry_leader
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    mtr02:
+      reclass_storage_name: stacklight_telemetry_node02
+      roles:
+      - stacklight_telemetry
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    mtr03:
+      reclass_storage_name: stacklight_telemetry_node03
+      roles:
+      - stacklight_telemetry
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    log01:
+      reclass_storage_name: stacklight_log_node01
+      roles:
+      - stacklight_log_leader_v2
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    log02:
+      reclass_storage_name: stacklight_log_node02
+      roles:
+      - stacklight_log
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
+
+    log03:
+      reclass_storage_name: stacklight_log_node03
+      roles:
+      - stacklight_log
+      - linux_system_codename_xenial
+      interfaces:
+        ens3:
+          role: single_dhcp
+        ens4:
+          role: single_ctl
diff --git a/tcp_tests/templates/heat-cicd-k8s-calico-sl/salt.yaml b/tcp_tests/templates/heat-cicd-k8s-calico-sl/salt.yaml
new file mode 100644
index 0000000..745b97c
--- /dev/null
+++ b/tcp_tests/templates/heat-cicd-k8s-calico-sl/salt.yaml
@@ -0,0 +1,23 @@
+{% set HOSTNAME_CFG01='cfg01.heat-cicd-k8s-calico-sl.local' %}
+{% set LAB_CONFIG_NAME='heat-cicd-k8s-calico-sl' %}
+{% set DOMAIN_NAME='heat-cicd-k8s-calico-sl.local' %}
+{% set SALT_MODELS_REPOSITORY = os_env('SALT_MODELS_REPOSITORY','https://gerrit.mcp.mirantis.com/salt-models/mcp-virtual-lab') %}
+# Other salt model repository parameters see in shared-salt.yaml
+
+{% import 'shared-salt.yaml' as SHARED with context %}
+
+{{ SHARED.MACRO_INSTALL_SALT_MINIONS() }}
+
+{{SHARED.MACRO_CHECK_SALT_VERSION_SERVICES_ON_CFG()}}
+
+{{SHARED.MACRO_CHECK_SALT_VERSION_ON_NODES()}}
+
+- description: "Share custom key from cfg to give each node acces with key from cfg01"
+  cmd: |
+    set -e;
+    set -x;
+    key=$(ssh-keygen -y -f /root/.ssh/id_rsa);
+    salt '*' cmd.run "echo $key >> /root/.ssh/authorized_keys";
+  node_name: {{ HOSTNAME_CFG01 }}
+  retry: {count: 1, delay: 5}
+  skip_fail: true
diff --git a/tcp_tests/templates/heat-cicd-k8s-calico-sl/underlay--user-data-foundation.yaml b/tcp_tests/templates/heat-cicd-k8s-calico-sl/underlay--user-data-foundation.yaml
new file mode 100644
index 0000000..1677dcd
--- /dev/null
+++ b/tcp_tests/templates/heat-cicd-k8s-calico-sl/underlay--user-data-foundation.yaml
@@ -0,0 +1,64 @@
+#cloud-config, see http://cloudinit.readthedocs.io/en/latest/topics/examples.html
+
+ssh_pwauth: True
+users:
+  - name: root
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+  - name: jenkins
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFSxeuXh2sO4VYL8N2dlNFVyNcr2RvoH4MeDD/cV2HThfU4/BcH6IOOWXSDibIU279bWVKCL7QUp3mf0Vf7HPuyFuC12QM+l7MwT0jCYh5um3hmAvM6Ga0nkhJygHexe9/rLEYzZJkIjP9/IS/YXSv8rhHg484wQ6qkEuq15nyMqil8tbDQCq0XQ+AWEpNpIa4pUoKmFMsOP8lq10KZXIXsJyZxizadr6Bh4Lm9LWrk8YCw7qP3rmgWxK/s8qXQh1ISZe6ONfcmk6p03qbh4H3CwKyWzxmnIHQvE6PgN/O+PuAZj3PbR2mkkJjYX4jNPlxvj8uTStaVPhAwfR9Spdx jenkins@cz8133
+
+disable_root: false
+chpasswd:
+  list: |
+    root:r00tme
+    jenkins:qalab
+  expire: False
+
+packages:
+  - openjdk-8-jre-headless
+  - libyaml-dev
+  - libffi-dev
+  - libvirt-dev
+  - python-dev
+  - python-pip
+  - python-virtualenv
+  #- python-psycopg2
+  - pkg-config
+  - vlan
+  - bridge-utils
+  - ebtables
+
+bootcmd:
+  # Enable root access
+  - sed -i -e '/^PermitRootLogin/s/^.*$/PermitRootLogin yes/' /etc/ssh/sshd_config
+  - service sshd restart
+output:
+  all: '| tee -a /var/log/cloud-init-output.log /dev/tty0'
+
+runcmd:
+  # Create swap
+  - fallocate -l 16G /swapfile
+  - chmod 600 /swapfile
+  - mkswap /swapfile
+  - swapon /swapfile
+  - echo "/swapfile   none    swap    defaults   0   0" >> /etc/fstab
+
+write_files:
+  - path: /etc/default/grub.d/97-enable-grub-menu.cfg
+    content: |
+      GRUB_RECORDFAIL_TIMEOUT=30
+      GRUB_TIMEOUT=3
+      GRUB_TIMEOUT_STYLE=menu
+
+  - path: /etc/network/interfaces
+    content: |
+      auto ens3
+      iface ens3 inet dhcp
+
+  - path: /etc/bash_completion.d/fuel_devops30_activate
+    content: |
+      source /home/jenkins/fuel-devops30/bin/activate
diff --git a/tcp_tests/templates/heat-cicd-k8s-calico-sl/underlay-userdata.yaml b/tcp_tests/templates/heat-cicd-k8s-calico-sl/underlay-userdata.yaml
new file mode 100644
index 0000000..8c1f248
--- /dev/null
+++ b/tcp_tests/templates/heat-cicd-k8s-calico-sl/underlay-userdata.yaml
@@ -0,0 +1,71 @@
+#cloud-config, see http://cloudinit.readthedocs.io/en/latest/topics/examples.html
+
+ssh_pwauth: True
+users:
+   - name: root
+     sudo: ALL=(ALL) NOPASSWD:ALL
+     shell: /bin/bash
+
+disable_root: false
+chpasswd:
+   list: |
+    root:r00tme
+   expire: False
+
+bootcmd:
+   # Enable root access
+   - sed -i -e '/^PermitRootLogin/s/^.*$/PermitRootLogin yes/' /etc/ssh/sshd_config
+   - service sshd restart
+output:
+    all: '| tee -a /var/log/cloud-init-output.log /dev/tty0'
+
+runcmd:
+   - if lvs vg0; then pvresize /dev/vda3; fi
+   - if lvs vg0; then /usr/bin/growlvm.py --image-layout-file /usr/share/growlvm/image-layout.yml; fi
+
+   - export TERM=linux
+   - export LANG=C
+   # Configure dhclient
+   - sudo resolvconf -u
+   #- sudo echo "nameserver {gateway}" >> /etc/resolvconf/resolv.conf.d/base
+   # Enable grub menu using updated config below
+   - update-grub
+
+   # Prepare network connection
+   - sudo ifup ens3
+   #- sudo route add default gw {gateway} {interface_name}
+
+write_files:
+   - path: /etc/default/grub.d/97-enable-grub-menu.cfg
+     content: |
+         GRUB_RECORDFAIL_TIMEOUT=30
+         GRUB_TIMEOUT=3
+         GRUB_TIMEOUT_STYLE=menu
+
+   - path: /etc/network/interfaces
+     content: |
+          auto ens3
+          iface ens3 inet dhcp
+
+   - path: /usr/share/growlvm/image-layout.yml
+     content: |
+       root:
+         size: '65%VG'
+       home:
+         size: '1%VG'
+       var_log:
+         size: '10%VG'
+       var_log_audit:
+         size: '5%VG'
+       var_tmp:
+         size: '10%VG'
+       tmp:
+         size: '5%VG'
+     owner: root:root
+
+growpart:
+    mode: auto
+    devices:
+      - '/'
+      - '/dev/vda3'
+    ignore_growroot_disabled: false
diff --git a/tcp_tests/templates/heat-cicd-k8s-calico-sl/underlay.hot b/tcp_tests/templates/heat-cicd-k8s-calico-sl/underlay.hot
new file mode 100644
index 0000000..deb6158
--- /dev/null
+++ b/tcp_tests/templates/heat-cicd-k8s-calico-sl/underlay.hot
@@ -0,0 +1,375 @@
+---
+
+heat_template_version: queens
+
+description: MCP environment for heat-cicd-k8s-calico-sl
+
+parameters:
+  instance_domain:
+    type: string
+    default: heat-cicd-k8s-calico-sl.local
+  mcp_version:
+    type: string
+  env_name:
+    type: string
+  control_subnet_cidr:
+    type: string
+  management_subnet_cidr:
+    type: string
+  management_subnet_pool_start:
+    type: string
+  management_subnet_pool_end:
+    type: string
+  management_subnet_cfg01_ip:
+    type: string
+  management_subnet_gateway_ip:
+    type: string
+
+  key_pair:
+    type: string
+
+  ctl_flavor:
+    type: string
+  cfg_flavor:
+    type: string
+  cid_flavor:
+    type: string
+  kvm_fake_flavor:
+    type: string
+  mon_flavor:
+    type: string
+  log_flavor:
+    type: string
+  mtr_flavor:
+    type: string
+  cmp_flavor:
+    type: string
+  foundation_flavor:
+    type: string
+
+  net_public:
+    type: string
+
+resources:
+  networks:
+    type: MCP::Networks
+    properties:
+      stack_name: { get_param: "OS::stack_name" }
+      env_name: { get_param: env_name }
+
+  #flavors:
+  #  type: MCP::Flavors
+
+  cfg01_node:
+    type: MCP::MasterNode
+    depends_on: [networks]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      cfg01_flavor: { get_param: cfg_flavor }
+      instance_name: cfg01
+      instance_domain: {get_param: instance_domain}
+      network: { get_attr: [networks, network] }
+
+  control_cluster:
+    type: MCP::MultipleInstance
+    depends_on: [cfg01_node]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance01_name: ctl01
+      instance02_name: ctl02
+      instance03_name: ctl03
+      instance01_role: k8s_controller
+      instance_flavor: {get_param: ctl_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay-userdata.yaml }
+      instance01_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '11' ]
+      instance02_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '12' ]
+      instance03_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '13' ]
+
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+  fake_kvm_cluster:
+    type: MCP::MultipleInstance
+    depends_on: [control_cluster]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance01_name: kvm01
+      instance02_name: kvm02
+      instance03_name: kvm03
+      instance_flavor: {get_param: kvm_fake_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay-userdata.yaml }
+      instance01_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '241' ]
+      instance02_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '242' ]
+      instance03_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '243' ]
+
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+  cicd_cluster:
+    type: MCP::MultipleInstance
+    depends_on: [fake_kvm_cluster]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance01_name: cid01
+      instance02_name: cid02
+      instance03_name: cid03
+      instance_flavor: {get_param: cid_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay-userdata.yaml }
+      instance01_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '91' ]
+      instance02_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '92' ]
+      instance03_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '93' ]
+
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+  stacklight_monitor_cluster:
+    type: MCP::MultipleInstance
+    depends_on: [cicd_cluster]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance01_name: mon01
+      instance02_name: mon02
+      instance03_name: mon03
+      instance_flavor: {get_param: mon_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay-userdata.yaml }
+      instance01_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '71' ]
+      instance02_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '72' ]
+      instance03_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '73' ]
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+  stacklight_log_cluster:
+    type: MCP::MultipleInstance
+    depends_on: [stacklight_monitor_cluster]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance01_name: log01
+      instance02_name: log02
+      instance03_name: log03
+      instance_flavor: {get_param: log_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay-userdata.yaml }
+      instance01_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '61' ]
+      instance02_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '62' ]
+      instance03_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '63' ]
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+  stacklight_mtr_cluster:
+    type: MCP::MultipleInstance
+    depends_on: [stacklight_log_cluster]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance01_name: mtr01
+      instance02_name: mtr02
+      instance03_name: mtr03
+      instance_flavor: {get_param: mtr_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay-userdata.yaml }
+      instance01_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '86' ]
+      instance02_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '87' ]
+      instance03_control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '88' ]
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+  prx01_virtual:
+    type: MCP::SingleInstance
+    depends_on: [stacklight_mtr_cluster]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance_name: prx01
+      instance_flavor: {get_param: cid_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay-userdata.yaml }
+      control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '221' ]
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+  prx02_virtual:
+    type: MCP::SingleInstance
+    depends_on: [prx01_virtual]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance_name: prx02
+      instance_flavor: {get_param: cid_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay-userdata.yaml }
+      control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '222' ]
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+  cmp001_virtual:
+    type: MCP::Compute
+    depends_on: [prx02_virtual]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance_name: cmp001
+      instance_flavor: {get_param: cmp_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay-userdata.yaml }
+      control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '101' ]
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+  cmp002_virtual:
+    type: MCP::Compute
+    depends_on: [cmp001_virtual]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance_name: cmp002
+      instance_flavor: {get_param: cmp_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay-userdata.yaml }
+      control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '102' ]
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+  cmp003_virtual:
+    type: MCP::Compute
+    depends_on: [cmp002_virtual]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance_name: cmp003
+      instance_flavor: {get_param: cmp_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay-userdata.yaml }
+      control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '103' ]
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+  cmp004_virtual:
+    type: MCP::Compute
+    depends_on: [cmp003_virtual]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance_name: cmp004
+      instance_flavor: {get_param: cmp_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay-userdata.yaml }
+      control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '104' ]
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+  foundation_node:
+    type: MCP::FoundationNode
+    depends_on: [networks]
+    properties:
+      env_name: { get_param: env_name }
+      mcp_version: { get_param: mcp_version }
+      instance_domain: {get_param: instance_domain}
+      instance_name: foundation
+      instance_flavor: {get_param: foundation_flavor}
+      network: { get_attr: [networks, network] }
+      underlay_userdata: { get_file: ./underlay--user-data-foundation.yaml }
+      control_net_static_ip:
+        list_join:
+        - '.'
+        - [ { get_attr: [networks, control_net_prefix] }, '5' ]
+      instance_config_host: { get_attr: [cfg01_node, instance_address] }
+
+outputs:
+
+  control_subnet_cidr:
+    description: Control network CIDR
+    value: { get_param: control_subnet_cidr }
+
+  management_subnet_cidr:
+    description: Admin network CIDR
+    value: { get_param: management_subnet_cidr }
+
+  foundation_floating:
+    description: foundation node IP address (floating) from external network
+    value:
+      get_attr:
+      - foundation_node
+      - instance_floating_address
+...