diff --git a/common/clients.py b/common/clients.py
index 9718d03..cff3bf2 100644
--- a/common/clients.py
+++ b/common/clients.py
@@ -12,14 +12,49 @@
 
 import os
 
-import ceilometerclient.client
-import cinderclient.client
-import heatclient.client
-import keystoneclient.exceptions
-import keystoneclient.v2_0.client
-import neutronclient.v2_0.client
-import novaclient.client
-import swiftclient
+from ceilometerclient import client as ceilometer_client
+from cinderclient import client as cinder_client
+from heatclient import client as heat_client
+from keystoneclient.auth.identity.generic import password
+from keystoneclient import exceptions as kc_exceptions
+from keystoneclient import session
+from neutronclient.v2_0 import client as neutron_client
+from novaclient import client as nova_client
+from swiftclient import client as swift_client
+
+
+class KeystoneWrapperClient(object):
+    """Wrapper object for keystone client
+
+    This wraps keystone client, so we can encpasulate certain
+    added properties like auth_token, project_id etc.
+    """
+    def __init__(self, auth_plugin, verify=True):
+        self.auth_plugin = auth_plugin
+        self.session = session.Session(
+            auth=auth_plugin,
+            verify=verify)
+
+    @property
+    def auth_token(self):
+        return self.auth_plugin.get_token(self.session)
+
+    @property
+    def auth_ref(self):
+        return self.auth_plugin.get_access(self.session)
+
+    @property
+    def project_id(self):
+        return self.auth_plugin.get_project_id(self.session)
+
+    def get_endpoint_url(self, service_type, region=None):
+        kwargs = {
+            'service_type': service_type,
+            'endpoint_type': 'publicURL'}
+        if region:
+            kwargs.update({'attr': 'region',
+                           'filter_value': region})
+        return self.auth_ref.service_catalog.url_for(**kwargs)
 
 
 class ClientManager(object):
@@ -36,6 +71,8 @@
 
     def __init__(self, conf):
         self.conf = conf
+        self.v2_auth_url = self.conf.auth_url.replace('/v3', '/v2.0')
+        self.auth_version = self.conf.auth_url.split('/v')[1]
         self.identity_client = self._get_identity_client()
         self.orchestration_client = self._get_orchestration_client()
         self.compute_client = self._get_compute_client()
@@ -45,24 +82,19 @@
         self.metering_client = self._get_metering_client()
 
     def _get_orchestration_client(self):
-        region = self.conf.region
         endpoint = os.environ.get('HEAT_URL')
         if os.environ.get('OS_NO_CLIENT_AUTH') == 'True':
             token = None
         else:
-            keystone = self._get_identity_client()
-            token = keystone.auth_token
+            token = self.identity_client.auth_token
         try:
             if endpoint is None:
-                endpoint = keystone.service_catalog.url_for(
-                    attr='region',
-                    filter_value=region,
-                    service_type='orchestration',
-                    endpoint_type='publicURL')
-        except keystoneclient.exceptions.EndpointNotFound:
+                endpoint = self.identity_client.get_endpoint_url(
+                    'orchestration', self.conf.region)
+        except kc_exceptions.EndpointNotFound:
             return None
         else:
-            return heatclient.client.Client(
+            return heat_client.Client(
                 self.HEATCLIENT_VERSION,
                 endpoint,
                 token=token,
@@ -70,12 +102,22 @@
                 password=self.conf.password)
 
     def _get_identity_client(self):
-        return keystoneclient.v2_0.client.Client(
-            username=self.conf.username,
-            password=self.conf.password,
-            tenant_name=self.conf.tenant_name,
-            auth_url=self.conf.auth_url,
-            insecure=self.conf.disable_ssl_certificate_validation)
+        domain = self.conf.domain_name
+        kwargs = {
+            'username': self.conf.username,
+            'password': self.conf.password,
+            'tenant_name': self.conf.tenant_name,
+            'auth_url': self.conf.auth_url
+        }
+        # keystone v2 can't ignore domain details
+        if self.auth_version == '3':
+            kwargs.update({
+                'project_domain_name': domain,
+                'user_domain_name': domain})
+        auth = password.Password(**kwargs)
+        return KeystoneWrapperClient(
+            auth,
+            not self.conf.disable_ssl_certificate_validation)
 
     def _get_compute_client(self):
 
@@ -86,11 +128,12 @@
             self.conf.username,
             self.conf.password,
             self.conf.tenant_name,
-            self.conf.auth_url
+            # novaclient can not use v3 url
+            self.v2_auth_url
         )
 
         # Create our default Nova client to use in testing
-        return novaclient.client.Client(
+        return nova_client.Client(
             self.NOVACLIENT_VERSION,
             *client_args,
             service_type='compute',
@@ -101,28 +144,28 @@
             http_log_debug=True)
 
     def _get_network_client(self):
-        auth_url = self.conf.auth_url
         dscv = self.conf.disable_ssl_certificate_validation
 
-        return neutronclient.v2_0.client.Client(
+        return neutron_client.Client(
             username=self.conf.username,
             password=self.conf.password,
             tenant_name=self.conf.tenant_name,
             endpoint_type='publicURL',
-            auth_url=auth_url,
+            # neutronclient can not use v3 url
+            auth_url=self.v2_auth_url,
             insecure=dscv)
 
     def _get_volume_client(self):
-        auth_url = self.conf.auth_url
         region = self.conf.region
         endpoint_type = 'publicURL'
         dscv = self.conf.disable_ssl_certificate_validation
-        return cinderclient.client.Client(
+        return cinder_client.Client(
             self.CINDERCLIENT_VERSION,
             self.conf.username,
             self.conf.password,
             self.conf.tenant_name,
-            auth_url,
+            # cinderclient can not use v3 url
+            self.v2_auth_url,
             region_name=region,
             endpoint_type=endpoint_type,
             insecure=dscv,
@@ -131,7 +174,7 @@
     def _get_object_client(self):
         dscv = self.conf.disable_ssl_certificate_validation
         args = {
-            'auth_version': '2.0',
+            'auth_version': self.auth_version,
             'tenant_name': self.conf.tenant_name,
             'user': self.conf.username,
             'key': self.conf.password,
@@ -139,20 +182,15 @@
             'os_options': {'endpoint_type': 'publicURL'},
             'insecure': dscv,
         }
-        return swiftclient.client.Connection(**args)
+        return swift_client.Connection(**args)
 
     def _get_metering_client(self):
         dscv = self.conf.disable_ssl_certificate_validation
-
-        keystone = self._get_identity_client()
+        domain = self.conf.domain_name
         try:
-            endpoint = keystone.service_catalog.url_for(
-                attr='region',
-                filter_value=self.conf.region,
-                service_type='metering',
-                endpoint_type='publicURL')
-
-        except keystoneclient.exceptions.EndpointNotFound:
+            endpoint = self.identity_client.get_endpoint_url('metering',
+                                                             self.conf.region)
+        except kc_exceptions.EndpointNotFound:
             return None
         else:
             args = {
@@ -165,6 +203,12 @@
                 'endpoint_type': 'publicURL',
                 'service_type': 'metering',
             }
+            # ceilometerclient can't ignore domain details for
+            # v2 auth_url
+            if self.auth_version == '3':
+                args.update(
+                    {'user_domain_name': domain,
+                     'project_domain_name': domain})
 
-            return ceilometerclient.client.Client(self.CEILOMETER_VERSION,
-                                                  endpoint, **args)
+            return ceilometer_client.Client(self.CEILOMETER_VERSION,
+                                            endpoint, **args)
diff --git a/common/config.py b/common/config.py
index 9ad6337..39c0846 100644
--- a/common/config.py
+++ b/common/config.py
@@ -32,10 +32,14 @@
                help="Tenant name to use for API requests."),
     cfg.StrOpt('auth_url',
                default=os.environ.get('OS_AUTH_URL'),
-               help="Full URI of the OpenStack Identity API (Keystone), v2"),
+               help="Full URI of the OpenStack Identity API (Keystone)"),
+    cfg.StrOpt('domain_name',
+               default='default',
+               help="User/project domain name, if keystone v3 auth_url"
+                    "is used"),
     cfg.StrOpt('region',
                default=os.environ.get('OS_REGION_NAME'),
-               help="The region name to us"),
+               help="The region name to use"),
     cfg.StrOpt('instance_type',
                help="Instance type for tests. Needs to be big enough for a "
                     "full OS plus the test workload"),
@@ -48,10 +52,6 @@
     cfg.StrOpt('minimal_image_ref',
                help="Name of minimal (e.g cirros) image to use when "
                     "launching test instances."),
-    cfg.StrOpt('auth_version',
-               default='v2',
-               help="Identity API version to be used for authentication "
-                    "for API tests."),
     cfg.BoolOpt('disable_ssl_certificate_validation',
                 default=False,
                 help="Set to True if using self-signed SSL certificates."),
@@ -124,6 +124,7 @@
     cfg.StrOpt('heat-config-notify-script',
                default=('heat-config-notify'),
                help="Path to the script heat-config-notify"),
+
 ]
 
 
diff --git a/common/test.py b/common/test.py
index 1ffe222..8fc5c60 100644
--- a/common/test.py
+++ b/common/test.py
@@ -392,7 +392,8 @@
 
     def preview_update_stack(self, stack_identifier, template,
                              environment=None, files=None, parameters=None,
-                             tags=None, disable_rollback=True):
+                             tags=None, disable_rollback=True,
+                             show_nested=False):
         env = environment or {}
         env_files = files or {}
         parameters = parameters or {}
@@ -406,7 +407,8 @@
             disable_rollback=disable_rollback,
             parameters=parameters,
             environment=env,
-            tags=tags
+            tags=tags,
+            show_nested=show_nested
         )
 
     def assert_resource_is_a_stack(self, stack_identifier, res_name,
diff --git a/functional/test_aws_stack.py b/functional/test_aws_stack.py
index 5fbe24f..13c4278 100644
--- a/functional/test_aws_stack.py
+++ b/functional/test_aws_stack.py
@@ -77,7 +77,7 @@
     def setUp(self):
         super(AwsStackTest, self).setUp()
         self.object_container_name = test.rand_name()
-        self.project_id = self.identity_client.auth_ref.project_id
+        self.project_id = self.identity_client.project_id
         self.swift_key = hashlib.sha224(
             str(random.getrandbits(256))).hexdigest()[:32]
         key_header = 'x-container-meta-temp-url-key'
diff --git a/functional/test_conditional_exposure.py b/functional/test_conditional_exposure.py
index 90f7d7a..c1175f1 100644
--- a/functional/test_conditional_exposure.py
+++ b/functional/test_conditional_exposure.py
@@ -42,13 +42,9 @@
                           "Sahara resources availability.")
 
     def _is_sahara_deployed(self):
-        keystone = self.identity_client
         try:
-            keystone.service_catalog.url_for(
-                attr='region',
-                filter_value=self.conf.region,
-                service_type='data-processing',
-                endpoint_type='publicURL')
+            self.identity_client.get_endpoint_url('data-processing',
+                                                  self.conf.region)
         except keystoneclient.exceptions.EndpointNotFound:
             return False
         return True
diff --git a/functional/test_nova_server_networks.py b/functional/test_nova_server_networks.py
index 99311d0..ae550b2 100644
--- a/functional/test_nova_server_networks.py
+++ b/functional/test_nova_server_networks.py
@@ -64,3 +64,25 @@
             parameters=parms)
         networks = self.get_outputs(stack_identifier, 'networks')
         self.assertEqual(['11.11.11.11'], networks['my_net'])
+
+    def test_create_update_server_with_subnet(self):
+        parms = {'flavor': self.conf.minimal_instance_type,
+                 'image': self.conf.minimal_image_ref}
+        template = server_with_sub_fixed_ip_template.replace(
+            'fixed_ip: 11.11.11.11', 'fixed_ip: 11.11.11.22')
+        stack_identifier = self.stack_create(
+            template=template,
+            stack_name='create_server_with_sub_ip',
+            parameters=parms)
+        networks = self.get_outputs(stack_identifier, 'networks')
+        self.assertEqual(['11.11.11.22'], networks['my_net'])
+
+        # update the server only with subnet, we won't pass
+        # both port_id and net_id to attach interface, then update success
+        template_only_subnet = template.replace(
+            'fixed_ip: 11.11.11.22', '')
+        self.update_stack(stack_identifier,
+                          template_only_subnet,
+                          parameters=parms)
+        new_networks = self.get_outputs(stack_identifier, 'networks')
+        self.assertNotEqual(['11.11.11.22'], new_networks['my_net'])
diff --git a/functional/test_preview.py b/functional/test_preview.py
index b927a25..5846523 100644
--- a/functional/test_preview.py
+++ b/functional/test_preview.py
@@ -43,7 +43,7 @@
     def setUp(self):
         super(StackPreviewTest, self).setUp()
         self.client = self.orchestration_client
-        self.project_id = self.identity_client.auth_ref.project_id
+        self.project_id = self.identity_client.project_id
 
     def _assert_resource(self, res, stack_name):
         self.assertEqual(stack_name, res['stack_name'])
diff --git a/functional/test_preview_update.py b/functional/test_preview_update.py
index 0e39bc9..971e9c5 100644
--- a/functional/test_preview_update.py
+++ b/functional/test_preview_update.py
@@ -54,7 +54,14 @@
 }
 
 
-class UpdatePreviewStackTest(functional_base.FunctionalTestsBase):
+class UpdatePreviewBase(functional_base.FunctionalTestsBase):
+
+    def assert_empty_sections(self, changes, empty_sections):
+        for section in empty_sections:
+            self.assertEqual([], changes[section])
+
+
+class UpdatePreviewStackTest(UpdatePreviewBase):
 
     def test_add_resource(self):
         self.stack_identifier = self.stack_create(
@@ -69,9 +76,7 @@
         added = changes['added'][0]['resource_name']
         self.assertEqual('test2', added)
 
-        empty_sections = ('updated', 'replaced', 'deleted')
-        for section in empty_sections:
-            self.assertEqual([], changes[section])
+        self.assert_empty_sections(changes, ['updated', 'replaced', 'deleted'])
 
     def test_no_change(self):
         self.stack_identifier = self.stack_create(
@@ -83,9 +88,8 @@
         unchanged = changes['unchanged'][0]['resource_name']
         self.assertEqual('test1', unchanged)
 
-        empty_sections = ('updated', 'replaced', 'deleted', 'added')
-        for section in empty_sections:
-            self.assertEqual([], changes[section])
+        self.assert_empty_sections(
+            changes, ['updated', 'replaced', 'deleted', 'added'])
 
     def test_update_resource(self):
         self.stack_identifier = self.stack_create(
@@ -113,9 +117,8 @@
         updated = changes['updated'][0]['resource_name']
         self.assertEqual('test1', updated)
 
-        empty_sections = ('added', 'unchanged', 'replaced', 'deleted')
-        for section in empty_sections:
-            self.assertEqual([], changes[section])
+        self.assert_empty_sections(
+            changes, ['added', 'unchanged', 'replaced', 'deleted'])
 
     def test_replaced_resource(self):
         self.stack_identifier = self.stack_create(
@@ -139,9 +142,8 @@
         replaced = changes['replaced'][0]['resource_name']
         self.assertEqual('test1', replaced)
 
-        empty_sections = ('added', 'unchanged', 'updated', 'deleted')
-        for section in empty_sections:
-            self.assertEqual([], changes[section])
+        self.assert_empty_sections(
+            changes, ['added', 'unchanged', 'updated', 'deleted'])
 
     def test_delete_resource(self):
         self.stack_identifier = self.stack_create(
@@ -156,6 +158,141 @@
         deleted = changes['deleted'][0]['resource_name']
         self.assertEqual('test2', deleted)
 
-        empty_sections = ('updated', 'replaced', 'added')
-        for section in empty_sections:
-            self.assertEqual([], changes[section])
+        self.assert_empty_sections(changes, ['updated', 'replaced', 'added'])
+
+
+class UpdatePreviewStackTestNested(UpdatePreviewBase):
+    template_nested_parent = '''
+heat_template_version: 2016-04-08
+resources:
+  nested1:
+    type: nested1.yaml
+'''
+
+    template_nested1 = '''
+heat_template_version: 2016-04-08
+resources:
+  nested2:
+    type: nested2.yaml
+'''
+
+    template_nested2 = '''
+heat_template_version: 2016-04-08
+resources:
+  random:
+    type: OS::Heat::RandomString
+'''
+
+    template_nested2_2 = '''
+heat_template_version: 2016-04-08
+resources:
+  random:
+    type: OS::Heat::RandomString
+  random2:
+    type: OS::Heat::RandomString
+'''
+
+    def _get_by_resource_name(self, changes, name, action):
+        filtered_l = [x for x in changes[action]
+                      if x['resource_name'] == name]
+        self.assertEqual(1, len(filtered_l))
+        return filtered_l[0]
+
+    def test_nested_resources_nochange(self):
+        files = {'nested1.yaml': self.template_nested1,
+                 'nested2.yaml': self.template_nested2}
+        self.stack_identifier = self.stack_create(
+            template=self.template_nested_parent, files=files)
+        result = self.preview_update_stack(
+            self.stack_identifier,
+            template=self.template_nested_parent,
+            files=files, show_nested=True)
+        changes = result['resource_changes']
+
+        # The nested random resource should be unchanged, but we always
+        # update nested stacks even when there are no changes
+        self.assertEqual(1, len(changes['unchanged']))
+        self.assertEqual('random', changes['unchanged'][0]['resource_name'])
+        self.assertEqual('nested2', changes['unchanged'][0]['parent_resource'])
+
+        self.assertEqual(2, len(changes['updated']))
+        u_nested1 = self._get_by_resource_name(changes, 'nested1', 'updated')
+        self.assertNotIn('parent_resource', u_nested1)
+        u_nested2 = self._get_by_resource_name(changes, 'nested2', 'updated')
+        self.assertEqual('nested1', u_nested2['parent_resource'])
+
+        self.assert_empty_sections(changes, ['replaced', 'deleted', 'added'])
+
+    def test_nested_resources_add(self):
+        files = {'nested1.yaml': self.template_nested1,
+                 'nested2.yaml': self.template_nested2}
+        self.stack_identifier = self.stack_create(
+            template=self.template_nested_parent, files=files)
+        files['nested2.yaml'] = self.template_nested2_2
+        result = self.preview_update_stack(
+            self.stack_identifier,
+            template=self.template_nested_parent,
+            files=files, show_nested=True)
+        changes = result['resource_changes']
+
+        # The nested random resource should be unchanged, but we always
+        # update nested stacks even when there are no changes
+        self.assertEqual(1, len(changes['unchanged']))
+        self.assertEqual('random', changes['unchanged'][0]['resource_name'])
+        self.assertEqual('nested2', changes['unchanged'][0]['parent_resource'])
+
+        self.assertEqual(1, len(changes['added']))
+        self.assertEqual('random2', changes['added'][0]['resource_name'])
+        self.assertEqual('nested2', changes['added'][0]['parent_resource'])
+
+        self.assert_empty_sections(changes, ['replaced', 'deleted'])
+
+    def test_nested_resources_delete(self):
+        files = {'nested1.yaml': self.template_nested1,
+                 'nested2.yaml': self.template_nested2_2}
+        self.stack_identifier = self.stack_create(
+            template=self.template_nested_parent, files=files)
+        files['nested2.yaml'] = self.template_nested2
+        result = self.preview_update_stack(
+            self.stack_identifier,
+            template=self.template_nested_parent,
+            files=files, show_nested=True)
+        changes = result['resource_changes']
+
+        # The nested random resource should be unchanged, but we always
+        # update nested stacks even when there are no changes
+        self.assertEqual(1, len(changes['unchanged']))
+        self.assertEqual('random', changes['unchanged'][0]['resource_name'])
+        self.assertEqual('nested2', changes['unchanged'][0]['parent_resource'])
+
+        self.assertEqual(1, len(changes['deleted']))
+        self.assertEqual('random2', changes['deleted'][0]['resource_name'])
+        self.assertEqual('nested2', changes['deleted'][0]['parent_resource'])
+
+        self.assert_empty_sections(changes, ['replaced', 'added'])
+
+    def test_nested_resources_replace(self):
+        files = {'nested1.yaml': self.template_nested1,
+                 'nested2.yaml': self.template_nested2}
+        self.stack_identifier = self.stack_create(
+            template=self.template_nested_parent, files=files)
+        parent_none = self.template_nested_parent.replace(
+            'nested1.yaml', 'OS::Heat::None')
+        result = self.preview_update_stack(
+            self.stack_identifier,
+            template=parent_none,
+            show_nested=True)
+        changes = result['resource_changes']
+
+        # The nested random resource should be unchanged, but we always
+        # update nested stacks even when there are no changes
+        self.assertEqual(1, len(changes['replaced']))
+        self.assertEqual('nested1', changes['replaced'][0]['resource_name'])
+
+        self.assertEqual(2, len(changes['deleted']))
+        d_random = self._get_by_resource_name(changes, 'random', 'deleted')
+        self.assertEqual('nested2', d_random['parent_resource'])
+        d_nested2 = self._get_by_resource_name(changes, 'nested2', 'deleted')
+        self.assertEqual('nested1', d_nested2['parent_resource'])
+
+        self.assert_empty_sections(changes, ['updated', 'unchanged', 'added'])
diff --git a/functional/test_waitcondition.py b/functional/test_waitcondition.py
new file mode 100644
index 0000000..fd5399f
--- /dev/null
+++ b/functional/test_waitcondition.py
@@ -0,0 +1,72 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import json
+
+from keystoneclient.v3 import client as keystoneclient
+from zaqarclient.queues.v1 import client as zaqarclient
+
+from heat_integrationtests.functional import functional_base
+
+
+class ZaqarWaitConditionTest(functional_base.FunctionalTestsBase):
+    template = '''
+heat_template_version: "2013-05-23"
+
+resources:
+  wait_condition:
+    type: OS::Heat::WaitCondition
+    properties:
+      handle: {get_resource: wait_handle}
+      timeout: 120
+  wait_handle:
+    type: OS::Heat::WaitConditionHandle
+    properties:
+      signal_transport: ZAQAR_SIGNAL
+
+outputs:
+  wait_data:
+   value: {'Fn::Select': ['data_id', {get_attr: [wait_condition, data]}]}
+'''
+
+    def test_signal_queues(self):
+        stack_identifier = self.stack_create(
+            template=self.template,
+            expected_status=None)
+        self._wait_for_resource_status(stack_identifier, 'wait_handle',
+                                       'CREATE_COMPLETE')
+        resource = self.client.resources.get(stack_identifier, 'wait_handle')
+        signal = json.loads(resource.attributes['signal'])
+        ks = keystoneclient.Client(
+            auth_url=signal['auth_url'],
+            user_id=signal['user_id'],
+            password=signal['password'],
+            project_id=signal['project_id'])
+        endpoint = ks.service_catalog.url_for(
+            service_type='messaging', endpoint_type='publicURL')
+        conf = {
+            'auth_opts': {
+                'backend': 'keystone',
+                'options': {
+                    'os_auth_token': ks.auth_token,
+                    'os_project_id': signal['project_id']
+                }
+            }
+        }
+
+        zaqar = zaqarclient.Client(endpoint, conf=conf, version=1.1)
+
+        queue = zaqar.queue(signal['queue_id'])
+        queue.post({'body': {'data': 'here!', 'id': 'data_id'}, 'ttl': 600})
+        self._wait_for_stack_status(stack_identifier, 'CREATE_COMPLETE')
+        stack = self.client.stacks.get(stack_identifier)
+        self.assertEqual('here!', stack.outputs[0]['output_value'])
diff --git a/scenario/test_autoscaling_lb.py b/scenario/test_autoscaling_lb.py
index bba55e1..080f17f 100644
--- a/scenario/test_autoscaling_lb.py
+++ b/scenario/test_autoscaling_lb.py
@@ -39,7 +39,7 @@
         for count in range(retries):
             time.sleep(1)
             r = requests.get(url)
-            # skip unsuccessfull requests
+            # skip unsuccessful requests
             if r.status_code == 200:
                 resp.add(r.text)
         self.assertEqual(expected_num, len(resp))