Merge "Do not install salt-formula-auditd for 2018.4.0 buildID"
diff --git a/branch-git-repos.groovy b/branch-git-repos.groovy
new file mode 100644
index 0000000..47c143a
--- /dev/null
+++ b/branch-git-repos.groovy
@@ -0,0 +1,135 @@
+#!groovy
+
+/**
+ * (Re-)Create git branches
+ *
+ * @param GIT_REPO_LIST   List of repositories to handle
+ *     Multiline text: '<name> <url> <src_obj>' (full format)
+ *                 or: '<url>' (assuming src_obj=='SUBS_SOURCE_REF')
+ * @param GIT_CREDENTIALS Credentials ID to use for the ALL given repositories
+ * @param BRANCH          New branch name
+ * @param SOURCE_REVISION Source object (commit/tag/branch) to apply to all repos
+ *     having empty src_obj or src_obj=='SUBS_SOURCE_REF'
+ *
+ * @see <a href="https://mirantis.jira.com/browse/PROD-17759">PROD-17759</a>
+ */
+
+// Get job environment to use as a map to get values with defaults
+Map jobEnv = env.getEnvironment().findAll { k, v -> v }
+
+// Prepare job parameters
+ArrayList gitRepoList   = jobEnv.get('GIT_REPO_LIST', '').readLines()
+String gitBranchNew     = jobEnv.get('BRANCH')
+String srcObj           = jobEnv.get('SOURCE_REVISION', 'master')
+String gitCredentialsId = jobEnv.get('GIT_CREDENTIALS')
+
+// Check if new branch name is given
+if (! gitBranchNew) {
+    error ('No new branch name is given')
+}
+
+/**
+ * Returns local path for the given URL constructed from hostname and repository
+ *
+ * @param  repoUrl git repository URL
+ * @return string representing local relative patch
+ */
+String getRepoLocalPath(String repoUrl) {
+    // Regex to split git repository URLs
+    String re = '^(?:(?<proto>[a-z]+)://)?(?:(?<creds>[^@]+)@)?(?<host>[^:/]+)(?::(?<port>[0-9]+)/|[:/])(?<repo>.+)$'
+
+    java.util.regex.Matcher urlMatcher = repoUrl =~ re
+    if (urlMatcher.matches()) {
+        return new File(
+            urlMatcher.group('host'),
+            urlMatcher.group('repo').replaceAll(/\.git$/,'')
+        ).toString()
+    } else {
+        return ''
+    }
+}
+
+// Variables to use as repo parameters
+String gitRepoName
+String gitRepoUrl
+String gitSrcObj
+
+// Store current commit SHA
+String gitCommit
+
+node() {
+    for (gitRepo in gitRepoList) {
+        (gitRepoName, gitRepoUrl, gitSrcObj) = gitRepo.trim().tokenize(' ')
+
+        if (gitRepoName.startsWith('#')){
+            echo ("Skipping repo '${gitRepo}'")
+            continue
+        }
+
+        if (! gitRepoUrl) {
+        // The only token is the git repo url
+            gitRepoUrl = gitRepoName
+            gitRepoName = getRepoLocalPath(gitRepoUrl)
+            gitSrcObj = srcObj
+        } else if (! gitSrcObj) {
+        // Two tokens - can't decide is gitRepoName or gitSrcObj given
+            error ("Wrong repository string format: '${gitRepo}'")
+        }
+
+        if (gitSrcObj.contains('SUBS_SOURCE_REF')) {
+            echo ("Replacing 'SUBS_SOURCE_REF' => ${SOURCE_REVISION}")
+            gitSrcObj = gitSrcObj.replace('SUBS_SOURCE_REF', srcObj)
+        }
+
+        // Remove preifix `origin/` from gitSrcObj
+        java.util.regex.Pattern reOrigin = ~'^origin/'
+        gitSrcObj = gitSrcObj - reOrigin
+
+        checkout([
+            $class: 'GitSCM',
+            branches: [
+                [name: 'FETCH_HEAD'],
+            ],
+            userRemoteConfigs: [
+                [url: gitRepoUrl, refspec: gitSrcObj, credentialsId: gitCredentialsId],
+            ],
+            extensions: [
+                [$class: 'PruneStaleBranch'],
+                [$class: 'RelativeTargetDirectory', relativeTargetDir: gitRepoName],
+                [$class: 'SubmoduleOption', disableSubmodules: true],
+                [$class: 'UserIdentity', name: 'MCP CI', email: 'ci+infra@mirantis.com'],
+            ],
+        ])
+
+        // Proceed branch creation
+        dir(gitRepoName) {
+            sshagent (credentials: [gitCredentialsId]) {
+                // FIXME: Ensure git has configured user and email
+                // See: https://issues.jenkins-ci.org/browse/JENKINS-46052
+                sh 'git config user.name "MCP CI"'
+                sh 'git config user.email "ci+infra@mirantis.com"'
+
+                // Update list of branches
+                sh 'git remote update origin --prune'
+
+                // Ensure there is no branch or tag with gitBranchNew name
+                sh "git branch -d '${gitBranchNew}' && git push origin ':${gitBranchNew}' || :"
+                sh "git tag    -d '${gitBranchNew}' && git push origin ':refs/tags/${gitBranchNew}' || :"
+
+                // Check if gitSrcObj is a branch
+                gitCommit = sh (script: "git ls-remote --heads --quiet origin '${gitSrcObj}' | awk '{print \$1}'",
+                                returnStdout: true).trim()
+                if (gitCommit) {
+                // Rename existing branch
+                    sh "git checkout -b '${gitSrcObj}' -t 'origin/${gitSrcObj}'" // Checkout old branch
+                    sh "git branch -m '${gitSrcObj}' '${gitBranchNew}'"          // ... rename it
+                    sh "git push origin ':${gitSrcObj}'"                         // ... remove old remote branch
+                } else {
+                // Create new branch
+                    sh "git checkout -b '${gitBranchNew}' '${gitSrcObj}'"        // Create new local branch
+                }
+                sh "git push origin '${gitBranchNew}'"                           // ... push new branch
+            }
+        }
+    }
+}
diff --git a/cloud-update.groovy b/cloud-update.groovy
index 19d563f..2729d98 100644
--- a/cloud-update.groovy
+++ b/cloud-update.groovy
@@ -38,6 +38,7 @@
  *   RESTORE_GALERA             Restore Galera DB (bool)
  *   RESTORE_CONTRAIL_DB        Restore Cassandra and Zookeeper DBs for OpenContrail (bool)
  *   RUN_CVP_TESTS              Run cloud validation pipelines before and after upgrade
+ *   MINIONS_TEST_TIMEOUT       Time in seconds for a Salt result to receive a response when calling a minionsReachable method.
  *
 **/
 def common = new com.mirantis.mk.Common()
@@ -57,6 +58,11 @@
 def command
 def commandKwargs
 
+def wait = 10
+if (common.validInputParam('MINIONS_TEST_TIMEOUT') && MINIONS_TEST_TIMEOUT.isInteger()) {
+    wait = "${MINIONS_TEST_TIMEOUT}".toInteger()
+}
+
 def updatePkgs(pepperEnv, target, targetType="", targetPackages="") {
     def salt = new com.mirantis.mk.Salt()
     def common = new com.mirantis.mk.Common()
@@ -153,11 +159,11 @@
         if (targetType == 'cfg') {
             common.warningMsg('salt-master pkg upgrade, rerun the pipeline if disconnected')
             salt.runSaltProcessStep(pepperEnv, target, 'pkg.install', ['salt-master'], null, true, 5)
-            salt.minionsReachable(pepperEnv, 'I@salt:master', '*')
+            salt.minionsReachable(pepperEnv, 'I@salt:master', '*', null, wait)
         }
         // salt minion pkg
         salt.runSaltProcessStep(pepperEnv, target, 'pkg.install', ['salt-minion'], null, true, 5)
-        salt.minionsReachable(pepperEnv, 'I@salt:master', target)
+        salt.minionsReachable(pepperEnv, 'I@salt:master', target, null, wait)
         common.infoMsg('Performing pkg upgrades ... ')
         common.retry(3){
             out = salt.runSaltCommand(pepperEnv, 'local', ['expression': target, 'type': 'compound'], command, true, packages, commandKwargs)
@@ -317,7 +323,7 @@
                 common.retry(3){
                     out = salt.runSaltProcessStep(pepperEnv, target, 'cmd.run', [args + ' install salt-minion'], null, true, 5)
                 }
-                salt.minionsReachable(pepperEnv, 'I@salt:master', target)
+                salt.minionsReachable(pepperEnv, 'I@salt:master', target, null, wait)
                 common.retry(3){
                     out = salt.runSaltProcessStep(pepperEnv, target, 'cmd.run', [args + ' install ' + packages])
                 }
@@ -433,7 +439,7 @@
     while(count < maxRetries) {
         try {
             sleep(10)
-            salt.minionsReachable(pepperEnv, 'I@salt:master', target)
+            salt.minionsReachable(pepperEnv, 'I@salt:master', target, null, wait)
             break
         } catch (Exception e) {
             common.warningMsg("${target} not ready yet. Waiting ...")
@@ -483,7 +489,7 @@
             } else {
                 salt.runSaltProcessStep(pepperEnv, target, 'system.reboot', null, null, true, 5)
                 sleep 10
-                salt.minionsReachable(pepperEnv, 'I@salt:master', target)
+                salt.minionsReachable(pepperEnv, 'I@salt:master', target, null, wait)
             }
         }
     }
@@ -541,7 +547,7 @@
             virsh.liveSnapshotMerge(pepperEnv, nodeProvider, target, SNAPSHOT_NAME)
         }
     }
-    salt.minionsReachable(pepperEnv, 'I@salt:master', tgt)
+    salt.minionsReachable(pepperEnv, 'I@salt:master', tgt, null, wait)
 }
 
 
diff --git a/cvp-spt.groovy b/cvp-spt.groovy
index ea4680f..b9d53d5 100644
--- a/cvp-spt.groovy
+++ b/cvp-spt.groovy
@@ -44,7 +44,7 @@
                  file: "report.xml",
                  nodeType: 'NODESET',
                  url: '',
-                 xpath: '/testsuite/testcase[@classname="cvp-spt.cvp_spt.tests.test_hw2hw"]/properties/property']]
+                 xpath: '/testsuite/testcase[@classname="cvp_spt.tests.test_hw2hw"]/properties/property']]
             plot csvFileName: 'plot-8634d2fe-dc48-4713-99f9-b69a381483bc.csv',
                  group: 'SPT',
                  style: 'line',
@@ -53,7 +53,7 @@
                  file: "report.xml",
                  nodeType: 'NODESET',
                  url: '',
-                 xpath: '/testsuite/testcase[@classname="cvp-spt.cvp_spt.tests.test_vm2vm"]/properties/property']]
+                 xpath: '/testsuite/testcase[@classname="cvp_spt.tests.test_vm2vm"]/properties/property']]
         }
     } catch (Throwable e) {
         // If there was an error or exception thrown, the build failed
diff --git a/test-cookiecutter-reclass-chunk.groovy b/test-cookiecutter-reclass-chunk.groovy
index 12428ba..9e34cea 100644
--- a/test-cookiecutter-reclass-chunk.groovy
+++ b/test-cookiecutter-reclass-chunk.groovy
@@ -1,23 +1,27 @@
 package com.mirantis.mk
+
 def common = new com.mirantis.mk.Common()
 def saltModelTesting = new com.mirantis.mk.SaltModelTesting()
 
 /**
  * Test CC model wrapper
  *  EXTRA_VARIABLES_YAML: yaml based string, to be directly passed into testCCModel
+ *  SLAVE_NODE:
  */
 
+slaveNode = env.SLAVE_NODE ?: 'python&&docker'
+
 timeout(time: 1, unit: 'HOURS') {
-node() {
-  try {
-    extra_vars = readYaml text: EXTRA_VARIABLES_YAML
-    currentBuild.description = extra_vars.modelFile
-    saltModelTesting.testCCModel(extra_vars)
+  node(slaveNode) {
+    try {
+      extraVars = readYaml text: EXTRA_VARIABLES_YAML
+      currentBuild.description = extraVars.modelFile
+      saltModelTesting.testCCModel(extraVars)
     } catch (Throwable e) {
-          // If there was an error or exception thrown, the build failed
-          currentBuild.result = "FAILURE"
-          currentBuild.description = currentBuild.description ? e.message + " " + currentBuild.description : e.message
-          throw e
-        }
-      }
+      // If there was an error or exception thrown, the build failed
+      currentBuild.result = "FAILURE"
+      currentBuild.description = currentBuild.description ? e.message + " " + currentBuild.description : e.message
+      throw e
     }
+  }
+}
diff --git a/test-cookiecutter-reclass.groovy b/test-cookiecutter-reclass.groovy
index 2a64990..e6d3070 100644
--- a/test-cookiecutter-reclass.groovy
+++ b/test-cookiecutter-reclass.groovy
@@ -2,17 +2,19 @@
 gerrit = new com.mirantis.mk.Gerrit()
 git = new com.mirantis.mk.Git()
 python = new com.mirantis.mk.Python()
-saltModelTesting = new com.mirantis.mk.SaltModelTesting()
 
-slave_node = 'python&&docker'
+gerritRef = env.GERRIT_REFSPEC ?: null
+slaveNode = (env.SLAVE_NODE ?: 'python&&docker')
+def alreadyMerged = false
+
 def reclassVersion = 'v1.5.4'
 if (common.validInputParam('RECLASS_VERSION')) {
-  reclassVersion = RECLASS_VERSION
+    reclassVersion = RECLASS_VERSION
 }
 
 def generateSaltMaster(modEnv, clusterDomain, clusterName) {
-  def nodeFile = "${modEnv}/nodes/cfg01.${clusterDomain}.yml"
-  def nodeString = """classes:
+    def nodeFile = "${modEnv}/nodes/cfg01.${clusterDomain}.yml"
+    def nodeString = """classes:
 - cluster.${clusterName}.infra.config
 parameters:
     _param:
@@ -23,82 +25,78 @@
             name: cfg01
             domain: ${clusterDomain}
 """
-  sh "mkdir -p ${modEnv}/nodes/"
-  println "Create file ${nodeFile}"
-  writeFile(file: nodeFile, text: nodeString)
+    sh "mkdir -p ${modEnv}/nodes/"
+    println "Create file ${nodeFile}"
+    writeFile(file: nodeFile, text: nodeString)
 }
 
-def GetBaseName(line, remove_ext) {
- filename = line.toString().split('/').last()
- if (remove_ext && filename.endsWith(remove_ext.toString())) {
-   filename = filename.take(filename.lastIndexOf(remove_ext.toString()))
- }
- return filename
-}
+/**
+ *
+ * @param contextFile - path to `contexts/XXX.yaml file`
+ * @param virtualenv  - pyvenv with CC and dep's
+ * @param templateEnvDir - root of CookieCutter
+ * @return
+ */
 
-def generateModel(modelFile, cutterEnv) {
-  def templateEnv = "${env.WORKSPACE}"
-  def modelEnv = "${env.WORKSPACE}/model"
-  def basename = GetBaseName(modelFile, '.yml')
-  def generatedModel = "${modelEnv}/${basename}"
-  def testEnv = "${env.WORKSPACE}/test"
-  def content = readFile(file: "${templateEnv}/contexts/${modelFile}")
-  def templateContext = readYaml text: content
-  def clusterDomain = templateContext.default_context.cluster_domain
-  def clusterName = templateContext.default_context.cluster_name
-  def outputDestination = "${generatedModel}/classes/cluster/${clusterName}"
-  def targetBranch = "feature/${clusterName}"
-  def templateBaseDir = "${env.WORKSPACE}"
-  def templateDir = "${templateEnv}/dir"
-  def templateOutputDir = templateBaseDir
-  sh(script: "rm -rf ${generatedModel} || true")
+def generateModel(contextFile, virtualenv, templateEnvDir) {
+    def modelEnv = "${templateEnvDir}/model"
+    def basename = common.GetBaseName(contextFile, '.yml')
+    def generatedModel = "${modelEnv}/${basename}"
+    def content = readFile(file: "${templateEnvDir}/contexts/${contextFile}")
+    def templateContext = readYaml text: content
+    def clusterDomain = templateContext.default_context.cluster_domain
+    def clusterName = templateContext.default_context.cluster_name
+    def outputDestination = "${generatedModel}/classes/cluster/${clusterName}"
+    def templateBaseDir = templateEnvDir
+    def templateDir = "${templateEnvDir}/dir"
+    def templateOutputDir = templateBaseDir
+    dir(templateEnvDir) {
+        sh(script: "rm -rf ${generatedModel} || true")
+        common.infoMsg("Generating model from context ${contextFile}")
+        def productList = ["infra", "cicd", "opencontrail", "kubernetes", "openstack", "oss", "stacklight", "ceph"]
+        for (product in productList) {
 
-  common.infoMsg("Generating model from context ${modelFile}")
+            // get templateOutputDir and productDir
+            if (product.startsWith("stacklight")) {
+                templateOutputDir = "${templateEnvDir}/output/stacklight"
+                try {
+                    productDir = "stacklight" + templateContext.default_context['stacklight_version']
+                } catch (Throwable e) {
+                    productDir = "stacklight1"
+                }
+            } else {
+                templateOutputDir = "${templateEnvDir}/output/${product}"
+                productDir = product
+            }
 
-  def productList = ["infra", "cicd", "opencontrail", "kubernetes", "openstack", "oss", "stacklight", "ceph"]
-  for (product in productList) {
+            if (product == "infra" || (templateContext.default_context["${product}_enabled"]
+                && templateContext.default_context["${product}_enabled"].toBoolean())) {
 
-    // get templateOutputDir and productDir
-    if (product.startsWith("stacklight")) {
-      templateOutputDir = "${env.WORKSPACE}/output/stacklight"
-      try {
-        productDir = "stacklight" + templateContext.default_context['stacklight_version']
-      } catch (Throwable e) {
-        productDir = "stacklight1"
-      }
-    } else {
-      templateOutputDir = "${env.WORKSPACE}/output/${product}"
-      productDir = product
+                templateDir = "${templateEnvDir}/cluster_product/${productDir}"
+                common.infoMsg("Generating product " + product + " from " + templateDir + " to " + templateOutputDir)
+
+                sh "rm -rf ${templateOutputDir} || true"
+                sh "mkdir -p ${templateOutputDir}"
+                sh "mkdir -p ${outputDestination}"
+
+                python.buildCookiecutterTemplate(templateDir, content, templateOutputDir, virtualenv, templateBaseDir)
+                sh "mv -v ${templateOutputDir}/${clusterName}/* ${outputDestination}"
+            } else {
+                common.warningMsg("Product " + product + " is disabled")
+            }
+        }
+        generateSaltMaster(generatedModel, clusterDomain, clusterName)
     }
-
-    if (product == "infra" || (templateContext.default_context["${product}_enabled"]
-        && templateContext.default_context["${product}_enabled"].toBoolean())) {
-
-      templateDir = "${templateEnv}/cluster_product/${productDir}"
-      common.infoMsg("Generating product " + product + " from " + templateDir + " to " + templateOutputDir)
-
-      sh "rm -rf ${templateOutputDir} || true"
-      sh "mkdir -p ${templateOutputDir}"
-      sh "mkdir -p ${outputDestination}"
-
-      python.buildCookiecutterTemplate(templateDir, content, templateOutputDir, cutterEnv, templateBaseDir)
-      sh "mv -v ${templateOutputDir}/${clusterName}/* ${outputDestination}"
-    } else {
-      common.warningMsg("Product " + product + " is disabled")
-    }
-  }
-  generateSaltMaster(generatedModel, clusterDomain, clusterName)
 }
 
 
-def testModel(modelFile, testEnv, reclassVersion='v1.5.4') {
-  // modelFile - `modelfiname` from model/modelfiname/modelfiname.yaml
-  // testEnv - path for model (model/modelfilename/)
-  //* Grub all models and send it to check in paralell - by one in thread.
+def testModel(modelFile, reclassVersion = 'v1.5.4') {
+    // modelFile - `modelfiname` from model/modelfiname/modelfiname.yaml
+    //* Grub all models and send it to check in paralell - by one in thread.
 
-  _values_string =  """
+    _values_string = """
   ---
-  MODELS_TARGZ: "${env.BUILD_URL}/artifact/reclass.tar.gz"
+  MODELS_TARGZ: "${env.BUILD_URL}/artifact/patched_reclass.tar.gz"
   DockerCName: "${env.JOB_NAME.toLowerCase()}_${env.BUILD_TAG.toLowerCase()}_${modelFile.toLowerCase()}"
   testReclassEnv: "model/${modelFile}/"
   modelFile: "contexts/${modelFile}.yml"
@@ -106,143 +104,197 @@
   EXTRA_FORMULAS: "${env.EXTRA_FORMULAS}"
   reclassVersion: "${reclassVersion}"
   """
-  build job: "test-mk-cookiecutter-templates-chunk", parameters: [
-  [$class: 'StringParameterValue', name: 'EXTRA_VARIABLES_YAML', value: _values_string.stripIndent() ],
-  ]
+    build job: "test-mk-cookiecutter-templates-chunk", parameters: [
+        [$class: 'StringParameterValue', name: 'EXTRA_VARIABLES_YAML',
+         value : _values_string.stripIndent()],
+    ]
 }
 
-def gerritRef
-try {
-  gerritRef = GERRIT_REFSPEC
-  } catch (MissingPropertyException e) {
-    gerritRef = null
-  }
-
-def testModelStep(basename,testEnv) {
-  // We need to wrap what we return in a Groovy closure, or else it's invoked
-  // when this method is called, not when we pass it to parallel.
-  // To do this, you need to wrap the code below in { }, and either return
-  // that explicitly, or use { -> } syntax.
-  return {
-    node(slave_node) {
-      testModel(basename, testEnv)
+def StepTestModel(basename) {
+    // We need to wrap what we return in a Groovy closure, or else it's invoked
+    // when this method is called, not when we pass it to parallel.
+    // To do this, you need to wrap the code below in { }, and either return
+    // that explicitly, or use { -> } syntax.
+    // return node object
+    return {
+        node(slaveNode) {
+            testModel(basename)
+        }
     }
-  }
 }
 
-timeout(time: 2, unit: 'HOURS') {
-  node(slave_node) {
-    def templateEnv = "${env.WORKSPACE}"
-    def cutterEnv = "${env.WORKSPACE}/cutter"
-    def jinjaEnv = "${env.WORKSPACE}/jinja"
-
-    try {
-      // Fixme. Just use 'cleanup workspace' option.
-      stage("Cleanup") {
-        sh(script:  'find . -mindepth 1 -delete > /dev/null || true')
-      }
-
-      stage('Download Cookiecutter template') {
-        if (gerritRef) {
-          def gerritChange = gerrit.getGerritChange(GERRIT_NAME, GERRIT_HOST, GERRIT_CHANGE_NUMBER, CREDENTIALS_ID)
-          merged = gerritChange.status == "MERGED"
-          if (!merged) {
-            checkouted = gerrit.gerritPatchsetCheckout([
-              credentialsId: CREDENTIALS_ID
-              ])
-            } else {
-              common.successMsg("Change ${GERRIT_CHANGE_NUMBER} is already merged, no need to gate them")
-            }
-            } else {
-              git.checkoutGitRepository(templateEnv, COOKIECUTTER_TEMPLATE_URL, COOKIECUTTER_TEMPLATE_BRANCH, CREDENTIALS_ID)
-            }
-          }
-
-          stage("Setup") {
-            python.setupCookiecutterVirtualenv(cutterEnv)
-          }
-
-          stage("Check workflow_definition") {
-            sh(script: "python ${env.WORKSPACE}/workflow_definition_test.py")
-          }
-
-          def contextFileList = []
-          dir("${templateEnv}/contexts") {
-            for (String x : findFiles(glob: "*.yml")) {
-              contextFileList.add(x)
-            }
-          }
-
-          stage("generate-model") {
-            for (contextFile in contextFileList) {
-              generateModel(contextFile, cutterEnv)
-            }
-          }
-
-          dir("${env.WORKSPACE}") {
-          // Collect only models. For backward compatability - who know, probably someone use it..
-          sh(script: "tar -czf model.tar.gz -C model ../contexts .", returnStatus: true)
-          archiveArtifacts artifacts: "model.tar.gz"
-          // to be able share reclass for all subenvs
-          // Also, makes artifact test more solid - use one reclass for all of sub-models.
-          // Archive Structure will be:
-          // tar.gz
-          // ├── contexts
-          // │   └── ceph.yml
-          // ├── global_reclass <<< reclass system
-          // ├── model
-          // │   └── ceph       <<< from `context basename`
-          // │       ├── classes
-          // │       │   ├── cluster
-          // │       │   └── system -> ../../../global_reclass
-          // │       └── nodes
-          // │           └── cfg01.ceph-cluster-domain.local.yml
-
-          if (SYSTEM_GIT_URL == "") {
-            git.checkoutGitRepository("${env.WORKSPACE}/global_reclass/", RECLASS_MODEL_URL, RECLASS_MODEL_BRANCH, CREDENTIALS_ID)
-            } else {
-              dir("${env.WORKSPACE}/global_reclass/") {
-                if (!gerrit.gerritPatchsetCheckout(SYSTEM_GIT_URL, SYSTEM_GIT_REF, "HEAD", CREDENTIALS_ID)) {
-                  common.errorMsg("Failed to obtain system reclass with url: ${SYSTEM_GIT_URL} and ${SYSTEM_GIT_REF}")
-                  throw new RuntimeException("Failed to obtain system reclass")
+def StepPrepareCCenv(refchange, templateEnvFolder) {
+    // return git clone  object
+    return {
+        // fetch needed sources
+        dir(templateEnvFolder) {
+            if (refchange) {
+                def gerritChange = gerrit.getGerritChange(GERRIT_NAME, GERRIT_HOST, GERRIT_CHANGE_NUMBER, CREDENTIALS_ID)
+                merged = gerritChange.status == "MERGED"
+                if (!merged) {
+                    checkouted = gerrit.gerritPatchsetCheckout([
+                        credentialsId: CREDENTIALS_ID
+                    ])
+                } else {
+                    // update global variable for success return from pipeline
+                    //alreadyMerged = true
+                    common.successMsg("Change ${GERRIT_CHANGE_NUMBER} is already merged, no need to gate them")
+                    currentBuild.result = 'ABORTED'
+                    throw new hudson.AbortException('change already merged')
                 }
-              }
+            } else {
+                git.checkoutGitRepository(templateEnvFolder, COOKIECUTTER_TEMPLATE_URL, COOKIECUTTER_TEMPLATE_BRANCH, CREDENTIALS_ID)
             }
-            // link all models, to use one global reclass
-            for (String context : contextFileList) {
-              def basename = GetBaseName(context, '.yml')
-              dir("${env.WORKSPACE}/model/${basename}"){
-                sh(script: 'mkdir -p classes/; ln -sfv ../../../global_reclass classes/system ')
-              }
-            }
-            // Save all models and all contexts. Warning! `h` flag has been used.
-            sh(script: "tar -chzf reclass.tar.gz --exclude='*@tmp' model contexts global_reclass", returnStatus: true)
-            archiveArtifacts artifacts: "reclass.tar.gz"
-          }
-
-          stage("test-contexts") {
-            stepsForParallel = [:]
-            common.infoMsg("Found: ${contextFileList.size()} contexts to test.")
-            for (String context : contextFileList) {
-              def basename = GetBaseName(context, '.yml')
-              def testEnv = "${env.WORKSPACE}/model/${basename}"
-              stepsForParallel.put("Test:${basename}", testModelStep(basename, testEnv))
-            }
-            parallel stepsForParallel
-            common.infoMsg('All tests done')
-          }
-
-          stage('Clean workspace directories') {
-            sh(script:  'find . -mindepth 1 -delete > /dev/null || true')
-          }
-
-} catch (Throwable e) {
-  currentBuild.result = "FAILURE"
-  currentBuild.description = currentBuild.description ? e.message + " " + currentBuild.description : e.message
-  throw e
-  } finally {
-    def dummy = "dummy"
-      //FAILING common.sendNotification(currentBuild.result,"",["slack"])
+        }
     }
-  }
+}
+
+def StepGenerateModels(_contextFileList, _virtualenv, _templateEnvDir) {
+    return {
+        for (contextFile in _contextFileList) {
+            generateModel(contextFile, _virtualenv, _templateEnvDir)
+        }
+    }
+}
+
+timeout(time: 1, unit: 'HOURS') {
+    node(slaveNode) {
+        def templateEnvHead = "${env.WORKSPACE}/EnvHead/"
+        def templateEnvPatched = "${env.WORKSPACE}/EnvPatched/"
+        def contextFileListHead = []
+        def contextFileListPatched = []
+        def vEnv = "${env.WORKSPACE}/venv"
+
+        try {
+            sh(script: 'find . -mindepth 1 -delete > /dev/null || true')
+            stage('Download and prepare CC env') {
+                // Prepare 2 env - for patchset, and for HEAD
+                paralellEnvs = [:]
+                paralellEnvs.failFast = true
+                paralellEnvs['downloadEnvHead'] = StepPrepareCCenv('', templateEnvHead)
+                paralellEnvs['downloadEnvPatched'] = StepPrepareCCenv(gerritRef, templateEnvPatched)
+                parallel paralellEnvs
+            }
+            stage("Check workflow_definition") {
+                // Check only for patchset
+                python.setupVirtualenv(vEnv, 'python2', [], "${templateEnvPatched}/requirements.txt")
+                common.infoMsg(python.runVirtualenvCommand(vEnv, "python ${templateEnvPatched}/workflow_definition_test.py"))
+            }
+
+            stage("generate models") {
+                dir("${templateEnvHead}/contexts") {
+                    for (String x : findFiles(glob: "*.yml")) {
+                        contextFileListHead.add(x)
+                    }
+                }
+                dir("${templateEnvPatched}/contexts") {
+                    for (String x : findFiles(glob: "*.yml")) {
+                        contextFileListPatched.add(x)
+                    }
+                }
+                // Generate over 2env's - for patchset, and for HEAD
+                paralellEnvs = [:]
+                paralellEnvs.failFast = true
+                paralellEnvs['GenerateEnvPatched'] = StepGenerateModels(contextFileListPatched, vEnv, templateEnvPatched)
+                paralellEnvs['GenerateEnvHead'] = StepGenerateModels(contextFileListHead, vEnv, templateEnvHead)
+                parallel paralellEnvs
+
+                // Collect artifacts
+                dir(templateEnvPatched) {
+                    // Collect only models. For backward comparability - who know, probably someone use it..
+                    sh(script: "tar -czf model.tar.gz -C model ../contexts .", returnStatus: true)
+                    archiveArtifacts artifacts: "model.tar.gz"
+                }
+
+                // to be able share reclass for all subenvs
+                // Also, makes artifact test more solid - use one reclass for all of sub-models.
+                // Archive Structure will be:
+                // tar.gz
+                // ├── contexts
+                // │   └── ceph.yml
+                // ├── global_reclass <<< reclass system
+                // ├── model
+                // │   └── ceph       <<< from `context basename`
+                // │       ├── classes
+                // │       │   ├── cluster
+                // │       │   └── system -> ../../../global_reclass
+                // │       └── nodes
+                // │           └── cfg01.ceph-cluster-domain.local.yml
+
+                if (SYSTEM_GIT_URL == "") {
+                    git.checkoutGitRepository("${env.WORKSPACE}/global_reclass/", RECLASS_MODEL_URL, RECLASS_MODEL_BRANCH, CREDENTIALS_ID)
+                } else {
+                    dir("${env.WORKSPACE}/global_reclass/") {
+                        if (!gerrit.gerritPatchsetCheckout(SYSTEM_GIT_URL, SYSTEM_GIT_REF, "HEAD", CREDENTIALS_ID)) {
+                            common.errorMsg("Failed to obtain system reclass with url: ${SYSTEM_GIT_URL} and ${SYSTEM_GIT_REF}")
+                            throw new RuntimeException("Failed to obtain system reclass")
+                        }
+                    }
+                }
+                // link all models, to use one global reclass
+                // For HEAD
+                dir(templateEnvHead) {
+                    for (String context : contextFileListHead) {
+                        def basename = common.GetBaseName(context, '.yml')
+                        dir("${templateEnvHead}/model/${basename}") {
+                            sh(script: 'mkdir -p classes/; ln -sfv ../../../../global_reclass classes/system ')
+                        }
+                    }
+                    // Save all models and all contexts. Warning! `h` flag must be used.
+                    sh(script: "tar -chzf head_reclass.tar.gz --exclude='*@tmp' model contexts global_reclass", returnStatus: true)
+                    archiveArtifacts artifacts: "head_reclass.tar.gz"
+                    // move for "Compare Pillars" stage
+                    sh(script: "mv -v head_reclass.tar.gz ${env.WORKSPACE}")
+                }
+                // For patched
+                dir(templateEnvPatched) {
+                    for (String context : contextFileListPatched) {
+                        def basename = common.GetBaseName(context, '.yml')
+                        dir("${templateEnvPatched}/model/${basename}") {
+                            sh(script: 'mkdir -p classes/; ln -sfv ../../../../global_reclass classes/system ')
+                        }
+                    }
+                    // Save all models and all contexts. Warning! `h` flag must be used.
+                    sh(script: "tar -chzf patched_reclass.tar.gz --exclude='*@tmp' model contexts global_reclass", returnStatus: true)
+                    archiveArtifacts artifacts: "patched_reclass.tar.gz"
+                    // move for "Compare Pillars" stage
+                    sh(script: "mv -v patched_reclass.tar.gz ${env.WORKSPACE}")
+                }
+            }
+
+            stage("Compare Pillars") {
+                // Compare patched and HEAD reclass pillars
+                compareRoot = "${env.WORKSPACE}/test_compare/"
+                sh(script: """
+                   mkdir -pv ${compareRoot}/new ${compareRoot}/old
+                   tar -xzf patched_reclass.tar.gz  --directory ${compareRoot}/new
+                   tar -xzf head_reclass.tar.gz  --directory ${compareRoot}/old
+                   """)
+                common.warningMsg('infra/secrets.yml has been skipped from compare!')
+                rezult = common.comparePillars(compareRoot, env.BUILD_URL, "-Ev \'infra/secrets.yml\'")
+                currentBuild.description = rezult
+            }
+            stage("test-contexts") {
+                // Test contexts for patched only
+                stepsForParallel = [:]
+                common.infoMsg("Found: ${contextFileListPatched.size()} patched contexts to test.")
+                for (String context : contextFileListPatched) {
+                    def basename = common.GetBaseName(context, '.yml')
+                    stepsForParallel.put("ContextPatchTest:${basename}", StepTestModel(basename))
+                }
+                parallel stepsForParallel
+                common.infoMsg('All tests done')
+            }
+
+            sh(script: 'find . -mindepth 1 -delete > /dev/null || true')
+
+        } catch (Throwable e) {
+            currentBuild.result = "FAILURE"
+            currentBuild.description = currentBuild.description ? e.message + " " + currentBuild.description : e.message
+            throw e
+        } finally {
+            def dummy = "dummy"
+            //FAILING common.sendNotification(currentBuild.result,"",["slack"])
+        }
+    }
 }
diff --git a/test-salt-formulas-pipeline.groovy b/test-salt-formulas-pipeline.groovy
index ca4eb67..0caef9c 100644
--- a/test-salt-formulas-pipeline.groovy
+++ b/test-salt-formulas-pipeline.groovy
@@ -4,28 +4,19 @@
  *  DEFAULT_GIT_URL
  *  CREDENTIALS_ID
  *  KITCHEN_TESTS_PARALLEL
- *  RUN_TEST_IN_DOCKER     If true, run test stage in docker
  *  SMOKE_TEST_DOCKER_IMG  Docker image for run test (default "ubuntu:16.04")
  */
 common = new com.mirantis.mk.Common()
 def gerrit = new com.mirantis.mk.Gerrit()
 def ruby = new com.mirantis.mk.Ruby()
 
-def gerritRef
-try {
-  gerritRef = GERRIT_REFSPEC
-} catch (MissingPropertyException e) {
-  gerritRef = null
-}
-
-def defaultGitRef, defaultGitUrl
-try {
-  defaultGitRef = DEFAULT_GIT_REF
-  defaultGitUrl = DEFAULT_GIT_URL
-} catch (MissingPropertyException e) {
-  defaultGitRef = null
-  defaultGitUrl = null
-}
+def gerritRef = env.GERRIT_REFSPEC ?: null
+def defaultGitRef = env.DEFAULT_GIT_REF ?: null
+def defaultGitUrl = env.DEFAULT_GIT_URL ?: null
+def slaveNode = env.SLAVE_NODE ?: 'python&&docker'
+def saltVersion = env.SALT_VERSION ?: ""
+def dockerLib = new com.mirantis.mk.Docker()
+def img = dockerLib.getImage(env.SMOKE_TEST_DOCKER_IMG, "ubuntu:16.04")
 
 def checkouted = false
 
@@ -70,9 +61,13 @@
     [$class: 'StringParameterValue', name: 'SALT_VERSION', value: SALT_VERSION]
   ]
 }
-timeout(time: 12, unit: 'HOURS') {
-  node("python") {
+timeout(time: 2, unit: 'HOURS') {
+  node(slaveNode) {
     try {
+      if (fileExists("tests/build")) {
+        common.infoMsg('Cleaning test env')
+        sh ("sudo rm -rf tests/build")
+      }
       stage("checkout") {
         if (gerritRef) {
           // job is triggered by Gerrit
@@ -102,39 +97,39 @@
           throw new Exception("Cannot checkout gerrit patchset, GERRIT_REFSPEC and DEFAULT_GIT_REF is null")
         }
     }
-    stage("test") {
-      if (checkouted) {
-        try {
-          saltVersion = SALT_VERSION
-            } catch (MissingPropertyException e) {
-          saltVersion = "" // default value is empty string, means latest
-        }
-        withEnv(["SALT_VERSION=${saltVersion}"]) {
-          boolean run_test_in_docker = (env.RUN_TEST_IN_DOCKER ?: false).toBoolean()
-          if (run_test_in_docker) {
-            def dockerLib = new com.mirantis.mk.Docker()
-            def img = dockerLib.getImage(env.SMOKE_TEST_DOCKER_IMG, "ubuntu:16.04")
-            def workspace = common.getWorkspace()
-            img.inside("-u root:root -v ${workspace}/:/formula/") {
-              sh("""cd /etc/apt/ && echo > sources.list \
-              && echo "deb [arch=amd64] http://cz.archive.ubuntu.com/ubuntu xenial main restricted universe multiverse" >> sources.list \
-              && echo "deb [arch=amd64] http://cz.archive.ubuntu.com/ubuntu xenial-updates main restricted universe multiverse" >> sources.list \
-              && echo "deb [arch=amd64] http://cz.archive.ubuntu.com/ubuntu xenial-backports main restricted universe multiverse" >> sources.list \
-              && echo 'Acquire::Languages "none";' > apt.conf.d/docker-no-languages \
-              && echo 'Acquire::GzipIndexes "true"; Acquire::CompressionTypes::Order:: "gz";' > apt.conf.d/docker-gzip-indexes \
-              && echo 'APT::Get::Install-Recommends "false"; APT::Get::Install-Suggests "false";' > apt.conf.d/docker-recommends \
-              && apt-get update \
-              && apt-get install -y git-core wget curl apt-transport-https \
-              && apt-get install -y python-pip python3-pip python-virtualenv python3-virtualenv python-yaml autoconf build-essential""")
-              sh("cd /formula/ && make clean && make test")
+      stage("test") {
+        if (checkouted) {
+          try {
+            // TODO add try\finally for image-stuck case. (copy-paste from SaltModelTesting)
+            withEnv(["SALT_VERSION=${saltVersion}"]) {
+              img.inside("-v ${env.WORKSPACE}/:/formula/ -u root:root --cpus=4 --ulimit nofile=4096:8192") {
+                sh('''#!/bin/bash -xe
+                      cd /etc/apt/
+                      echo "deb [arch=amd64] http://cz.archive.ubuntu.com/ubuntu xenial main restricted universe" > sources.list
+                      echo "deb [arch=amd64] http://cz.archive.ubuntu.com/ubuntu xenial-updates main restricted universe" >> sources.list
+                      echo 'Acquire::Languages "none";' > apt.conf.d/docker-no-languages
+                      echo 'Acquire::GzipIndexes "true"; Acquire::CompressionTypes::Order:: "gz";' > apt.conf.d/docker-gzip-indexes
+                      echo 'APT::Get::Install-Recommends "false"; APT::Get::Install-Suggests "false";' > apt.conf.d/docker-recommends
+                      apt-get update
+                      apt-get install -y git-core wget curl apt-transport-https
+                      apt-get install -y python-pip python3-pip python-virtualenv python3-virtualenv python-yaml autoconf build-essential
+                      cd /formula/
+                      make clean
+                      make test
+                      make clean
+                      ''')
+              }
             }
-          } else {
-            common.warningMsg("Those tests should be always be run in clean env! Recommends to use docker env!")
-            sh("make clean && make test")
+          }
+          finally {
+            if (fileExists("tests/build")) {
+              common.infoMsg('Cleaning test env')
+              sh ("sudo rm -rf tests/build")
+            }
           }
         }
+
       }
-    }
     stage("kitchen") {
         if (checkouted) {
           if (fileExists(".kitchen.yml")) {
diff --git a/update-package.groovy b/update-package.groovy
index 790e2ac..10f3a85 100644
--- a/update-package.groovy
+++ b/update-package.groovy
@@ -11,12 +11,10 @@
  *   TARGET_BATCH_LIVE          Batch size for the complete live package update on all nodes, empty string means apply to all targetted nodes.
  *
 **/
-
+pepperEnv = "pepperEnv"
+salt = new com.mirantis.mk.Salt()
 def common = new com.mirantis.mk.Common()
-def salt = new com.mirantis.mk.Salt()
 def python = new com.mirantis.mk.Python()
-
-def pepperEnv = "pepperEnv"
 def targetTestSubset
 def targetLiveSubset
 def targetLiveAll
@@ -25,6 +23,10 @@
 def packages
 def command
 def commandKwargs
+def installSaltStack(target, pkgs){
+    salt.runSaltProcessStep(pepperEnv, target, 'pkg.install', ["force_yes=True", "pkgs='$pkgs'"], null, true, 30)
+}
+
 timeout(time: 12, unit: 'HOURS') {
     node() {
         try {
@@ -89,8 +91,27 @@
             }
 
             stage('Apply package upgrades on sample') {
+                if(packages == null || packages.contains("salt-master") || packages.contains("salt-common") || packages.contains("salt-minion") || packages.contains("salt-api")){
+                    def saltTargets = (targetLiveSubset.split(' or ').collect{it as String})
+                    for(int i = 0; i < saltTargets.size(); i++ ){
+                        common.infoMsg("During salt-minion upgrade on cfg node, pipeline lose connectivy to salt-master for 2 min. If pipeline ended with error rerun pipeline again.")
+                        common.retry(10, 5) {
+                            if(salt.minionsReachable(pepperEnv, 'I@salt:master', "I@salt:master and ${saltTargets[i]}")){
+                                installSaltStack("I@salt:master and ${saltTargets[i]}", '["salt-master", "salt-common", "salt-api", "salt-minion"]')
+                            }
+                            if(salt.minionsReachable(pepperEnv, 'I@salt:master', "I@salt:minion and not I@salt:master and ${saltTargets[i]}")){
+                                installSaltStack("I@salt:minion and not I@salt:master and ${saltTargets[i]}", '["salt-minion"]')
+                            }
+                        }
+                    }
+                }
                 out = salt.runSaltCommand(pepperEnv, 'local', ['expression': targetLiveSubset, 'type': 'compound'], command, null, packages, commandKwargs)
                 salt.printSaltCommandResult(out)
+                for(value in out.get("return")[0].values()){
+                    if (value.containsKey('result') && value.result == false) {
+                        throw new Exception("The package upgrade on sample node has failed. Please check the Salt run result above for more information.")
+                    }
+                }
             }
 
             stage('Confirm package upgrades on all nodes') {
@@ -100,8 +121,30 @@
             }
 
             stage('Apply package upgrades on all nodes') {
+
+                if(packages == null || packages.contains("salt-master") || packages.contains("salt-common") || packages.contains("salt-minion") || packages.contains("salt-api")){
+                    def saltTargets = (targetLiveAll.split(' or ').collect{it as String})
+                    for(int i = 0; i < saltTargets.size(); i++ ){
+                        common.infoMsg("During salt-minion upgrade on cfg node, pipeline lose connectivy to salt-master for 2 min. If pipeline ended with error rerun pipeline again.")
+                        common.retry(10, 5) {
+                            if(salt.minionsReachable(pepperEnv, 'I@salt:master', "I@salt:master and ${saltTargets[i]}")){
+                                installSaltStack("I@salt:master and ${saltTargets[i]}", '["salt-master", "salt-common", "salt-api", "salt-minion"]')
+                            }
+                            if(salt.minionsReachable(pepperEnv, 'I@salt:master', "I@salt:minion and not I@salt:master and ${saltTargets[i]}")){
+                                installSaltStack("I@salt:minion and not I@salt:master and ${saltTargets[i]}", '["salt-minion"]')
+                            }
+                        }
+                    }
+                }
+
                 out = salt.runSaltCommand(pepperEnv, 'local', ['expression': targetLiveAll, 'type': 'compound'], command, null, packages, commandKwargs)
                 salt.printSaltCommandResult(out)
+                for(value in out.get("return")[0].values()){
+                    if (value.containsKey('result') && value.result == false) {
+                        throw new Exception("The package upgrade on sample node has failed. Please check the Salt run result above for more information.")
+                    }
+                }
+                common.warningMsg("Pipeline has finished successfully, but please, check if any packages have been kept back.")
             }
 
         } catch (Throwable e) {