diff --git a/.zuul.yaml b/.zuul.yaml
deleted file mode 100644
index 98a3c3a..0000000
--- a/.zuul.yaml
+++ /dev/null
@@ -1,1444 +0,0 @@
-- job:
-    name: neutron-tempest-plugin
-    parent: devstack-tempest
-    abstract: true
-    description: |
-      Perform setup common to all Neutron tempest tests
-    roles:
-      - zuul: openstack/devstack
-    required-projects:
-      - openstack/devstack-gate
-      - openstack/neutron
-      - openstack/neutron-tempest-plugin
-      - openstack/tempest
-    vars:
-      tempest_concurrency: 4
-      tox_envlist: all
-      network_api_extensions_common: &api_extensions_master
-        - address-scope
-        - agent
-        - allowed-address-pairs
-        - auto-allocated-topology
-        - availability_zone
-        - binding
-        - default-subnetpools
-        - dhcp_agent_scheduler
-        - dns-domain-ports
-        - dns-integration
-        - empty-string-filtering
-        - expose-port-forwarding-in-fip
-        - expose-l3-conntrack-helper
-        - ext-gw-mode
-        - external-net
-        - extra_dhcp_opt
-        - extraroute
-        - extraroute-atomic
-        - filter-validation
-        - fip-port-details
-        - flavors
-        - floating-ip-port-forwarding
-        - floatingip-pools
-        - ip-substring-filtering
-        - l3-conntrack-helper
-        - l3-flavors
-        - l3-ha
-        - l3_agent_scheduler
-        - logging
-        - metering
-        - multi-provider
-        - net-mtu
-        - net-mtu-writable
-        - network-ip-availability
-        - network_availability_zone
-        - network-segment-range
-        - pagination
-        - port-resource-request
-        - port-mac-address-regenerate
-        - port-security
-        - port-security-groups-filtering
-        - project-id
-        - provider
-        - qos
-        - qos-bw-minimum-ingress
-        - qos-fip
-        - quotas
-        - quota_details
-        - rbac-policies
-        - rbac-security-groups
-        - router
-        - router-admin-state-down-before-update
-        - router_availability_zone
-        - security-group
-        - segment
-        - service-type
-        - sorting
-        - standard-attr-description
-        - standard-attr-revisions
-        - standard-attr-segment
-        - standard-attr-tag
-        - standard-attr-timestamp
-        - subnet_allocation
-        - subnet-dns-publish-fixed-ip
-        - subnetpool-prefix-ops
-        - trunk
-        - trunk-details
-        - uplink-status-propagation
-      network_api_extensions_tempest:
-        - dvr
-      devstack_localrc:
-        USE_PYTHON3: true
-        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
-      devstack_plugins:
-        neutron: https://opendev.org/openstack/neutron.git
-        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin.git
-      tempest_plugins:
-        - neutron-tempest-plugin
-      devstack_services:
-        tls-proxy: false
-        tempest: true
-        neutron-dns: true
-        neutron-qos: true
-        neutron-segments: true
-        neutron-trunk: true
-        neutron-uplink-status-propagation: true
-        neutron-network-segment-range: true
-        neutron-port-forwarding: true
-        neutron-conntrack-helper: true
-      devstack_local_conf:
-        post-config:
-          $NEUTRON_CONF:
-            QUOTAS:
-              quota_router: 100
-              quota_floatingip: 500
-              quota_security_group: 150
-              quota_security_group_rule: 1000
-          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
-          # devstack-tempest job will be switched to use lib/neutron instead of
-          # lib/neutron-legacy
-          /$NEUTRON_CORE_PLUGIN_CONF:
-            ml2:
-              type_drivers: flat,geneve,vlan,gre,local,vxlan
-            ml2_type_vlan:
-              network_vlan_ranges: foo:1:10
-            ml2_type_vxlan:
-              vni_ranges: 1:2000
-            ml2_type_gre:
-              tunnel_id_ranges: 1:1000
-          $NEUTRON_L3_CONF:
-            agent:
-              availability_zone: nova
-          $NEUTRON_DHCP_CONF:
-            agent:
-              availability_zone: nova
-          /etc/neutron/api-paste.ini:
-            composite:neutronapi_v2_0:
-              use: call:neutron.auth:pipeline_factory
-              noauth: cors request_id catch_errors osprofiler extensions neutronapiapp_v2_0
-              keystone: cors request_id catch_errors osprofiler authtoken keystonecontext extensions neutronapiapp_v2_0
-        test-config:
-          $TEMPEST_CONFIG:
-            neutron_plugin_options:
-              provider_vlans: foo,
-              agent_availability_zone: nova
-              image_is_advanced: true
-              available_type_drivers: flat,geneve,vlan,gre,local,vxlan
-              provider_net_base_segm_id: 1
-    irrelevant-files: &tempest-irrelevant-files
-      - ^(test-|)requirements.txt$
-      - ^releasenotes/.*$
-      - ^doc/.*$
-      - ^setup.cfg$
-      - ^.*\.rst$
-      - ^neutron/locale/.*$
-      - ^neutron/tests/unit/.*$
-      - ^tools/.*$
-      - ^tox.ini$
-
-- job:
-    name: neutron-tempest-plugin-api
-    parent: neutron-tempest-plugin
-    vars:
-      tempest_test_regex: ^neutron_tempest_plugin\.api
-      devstack_services:
-        neutron-log: true
-      devstack_local_conf:
-        post-config:
-          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
-          # devstack-tempest job will be switched to use lib/neutron instead of
-          # lib/neutron-legacy
-          /$NEUTRON_CORE_PLUGIN_CONF:
-            AGENT:
-              tunnel_types: gre,vxlan
-            network_log:
-              local_output_log_base: /tmp/test_log.log
-
-- job:
-    name: neutron-tempest-plugin-api-queens
-    nodeset: openstack-single-node-xenial
-    parent: neutron-tempest-plugin-api
-    override-checkout: stable/queens
-    required-projects:
-      - openstack/devstack-gate
-      - openstack/neutron
-      - name: openstack/neutron-tempest-plugin
-        override-checkout: 0.3.0
-      - openstack/tempest
-    vars:
-      branch_override: stable/queens
-      # TODO(slaweq): find a way to put this list of extensions in
-      # neutron repository and keep it different per branch,
-      # then it could be removed from here
-      network_api_extensions_common: &api_extensions_queens
-        - address-scope
-        - agent
-        - allowed-address-pairs
-        - auto-allocated-topology
-        - availability_zone
-        - binding
-        - default-subnetpools
-        - dhcp_agent_scheduler
-        - dns-domain-ports
-        - dns-integration
-        - ext-gw-mode
-        - external-net
-        - extra_dhcp_opt
-        - extraroute
-        - flavors
-        - ip-substring-filtering
-        - l3-flavors
-        - l3-ha
-        - l3_agent_scheduler
-        - logging
-        - metering
-        - multi-provider
-        - net-mtu
-        - net-mtu-writable
-        - network-ip-availability
-        - network_availability_zone
-        - pagination
-        - port-security
-        - project-id
-        - provider
-        - qos
-        - qos-fip
-        - quotas
-        - quota_details
-        - rbac-policies
-        - router
-        - router_availability_zone
-        - security-group
-        - segment
-        - service-type
-        - sorting
-        - standard-attr-description
-        - standard-attr-revisions
-        - standard-attr-timestamp
-        - standard-attr-tag
-        - subnet_allocation
-        - trunk
-        - trunk-details
-      network_api_extensions_tempest:
-        - dvr
-      devstack_localrc:
-        USE_PYTHON3: false
-        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
-        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
-
-- job:
-    name: neutron-tempest-plugin-api-rocky
-    nodeset: openstack-single-node-xenial
-    parent: neutron-tempest-plugin-api
-    description: |
-      This job run on py2 for stable/rocky gate.
-    override-checkout: stable/rocky
-    required-projects: &required-projects-rocky
-      - openstack/devstack-gate
-      - openstack/neutron
-      - name: openstack/neutron-tempest-plugin
-        override-checkout: 0.9.0
-      - openstack/tempest
-    vars: &api_vars_rocky
-      branch_override: stable/rocky
-      # TODO(slaweq): find a way to put this list of extensions in
-      # neutron repository and keep it different per branch,
-      # then it could be removed from here
-      network_api_extensions_common: &api_extensions_rocky
-        - address-scope
-        - agent
-        - allowed-address-pairs
-        - auto-allocated-topology
-        - availability_zone
-        - binding
-        - default-subnetpools
-        - dhcp_agent_scheduler
-        - dns-domain-ports
-        - dns-integration
-        - empty-string-filtering
-        - expose-port-forwarding-in-fip
-        - ext-gw-mode
-        - external-net
-        - extra_dhcp_opt
-        - extraroute
-        - fip-port-details
-        - flavors
-        - floating-ip-port-forwarding
-        - ip-substring-filtering
-        - l3-flavors
-        - l3-ha
-        - l3_agent_scheduler
-        - logging
-        - metering
-        - multi-provider
-        - net-mtu
-        - net-mtu-writable
-        - network-ip-availability
-        - network_availability_zone
-        - pagination
-        - port-mac-address-regenerate
-        - port-security
-        - port-security-groups-filtering
-        - project-id
-        - provider
-        - qos
-        - qos-fip
-        - quotas
-        - quota_details
-        - rbac-policies
-        - router
-        - router_availability_zone
-        - security-group
-        - segment
-        - service-type
-        - sorting
-        - standard-attr-description
-        - standard-attr-revisions
-        - standard-attr-segment
-        - standard-attr-timestamp
-        - standard-attr-tag
-        - subnet_allocation
-        - trunk
-        - trunk-details
-      network_api_extensions_tempest:
-        - dvr
-      devstack_localrc:
-        USE_PYTHON3: false
-        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
-        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
-    # NOTE(gmann): This job run on py2 for stable/rocky gate.
-    branches:
-      - stable/rocky
-
-
-- job:
-    name: neutron-tempest-plugin-api-rocky
-    nodeset: openstack-single-node-xenial
-    parent: neutron-tempest-plugin-api
-    description: |
-      This job run on py3 for other than stable/rocky gate
-      which is nothing but neutron-tempest-pluign master gate.
-    override-checkout: stable/rocky
-    required-projects: *required-projects-rocky
-    vars:
-      <<: *api_vars_rocky
-      devstack_localrc:
-        USE_PYTHON3: True
-    branches: ^(?!stable/rocky).*$
-
-- job:
-    name: neutron-tempest-plugin-api-stein
-    parent: neutron-tempest-plugin-api
-    override-checkout: stable/stein
-    vars:
-      branch_override: stable/stein
-      # TODO(slaweq): find a way to put this list of extensions in
-      # neutron repository and keep it different per branch,
-      # then it could be removed from here
-      network_api_extensions_common: &api_extensions_stein
-        - address-scope
-        - agent
-        - allowed-address-pairs
-        - auto-allocated-topology
-        - availability_zone
-        - binding
-        - default-subnetpools
-        - dhcp_agent_scheduler
-        - dns-domain-ports
-        - dns-integration
-        - empty-string-filtering
-        - expose-port-forwarding-in-fip
-        - ext-gw-mode
-        - external-net
-        - extra_dhcp_opt
-        - extraroute
-        - filter-validation
-        - fip-port-details
-        - flavors
-        - floatingip-pools
-        - floating-ip-port-forwarding
-        - ip-substring-filtering
-        - l3-flavors
-        - l3-ha
-        - l3_agent_scheduler
-        - logging
-        - metering
-        - multi-provider
-        - net-mtu
-        - net-mtu-writable
-        - network-ip-availability
-        - network_availability_zone
-        - network-segment-range
-        - pagination
-        - port-resource-request
-        - port-mac-address-regenerate
-        - port-security
-        - port-security-groups-filtering
-        - project-id
-        - provider
-        - qos
-        - qos-bw-minimum-ingress
-        - qos-fip
-        - quotas
-        - quota_details
-        - rbac-policies
-        - rbac-security-groups
-        - router
-        - router_availability_zone
-        - security-group
-        - segment
-        - service-type
-        - sorting
-        - standard-attr-description
-        - standard-attr-revisions
-        - standard-attr-segment
-        - standard-attr-tag
-        - standard-attr-timestamp
-        - subnet_allocation
-        - trunk
-        - trunk-details
-        - uplink-status-propagation
-      network_api_extensions_tempest:
-        - dvr
-      devstack_localrc:
-        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
-
-- job:
-    name: neutron-tempest-plugin-api-train
-    parent: neutron-tempest-plugin-api
-    override-checkout: stable/train
-    vars:
-      branch_override: stable/train
-      # TODO(slaweq): find a way to put this list of extensions in
-      # neutron repository and keep it different per branch,
-      # then it could be removed from here
-      network_api_extensions_common: &api_extensions_train
-        - address-scope
-        - agent
-        - allowed-address-pairs
-        - auto-allocated-topology
-        - availability_zone
-        - binding
-        - default-subnetpools
-        - dhcp_agent_scheduler
-        - dns-domain-ports
-        - dns-integration
-        - empty-string-filtering
-        - expose-port-forwarding-in-fip
-        - expose-l3-conntrack-helper
-        - ext-gw-mode
-        - external-net
-        - extra_dhcp_opt
-        - extraroute
-        - extraroute-atomic
-        - filter-validation
-        - fip-port-details
-        - flavors
-        - floating-ip-port-forwarding
-        - floatingip-pools
-        - ip-substring-filtering
-        - l3-conntrack-helper
-        - l3-flavors
-        - l3-ha
-        - l3_agent_scheduler
-        - logging
-        - metering
-        - multi-provider
-        - net-mtu
-        - net-mtu-writable
-        - network-ip-availability
-        - network_availability_zone
-        - network-segment-range
-        - pagination
-        - port-resource-request
-        - port-mac-address-regenerate
-        - port-security
-        - port-security-groups-filtering
-        - project-id
-        - provider
-        - qos
-        - qos-bw-minimum-ingress
-        - qos-fip
-        - quotas
-        - quota_details
-        - rbac-policies
-        - rbac-security-groups
-        - router
-        - router-admin-state-down-before-update
-        - router_availability_zone
-        - security-group
-        - segment
-        - service-type
-        - sorting
-        - standard-attr-description
-        - standard-attr-revisions
-        - standard-attr-segment
-        - standard-attr-tag
-        - standard-attr-timestamp
-        - subnet_allocation
-        - subnetpool-prefix-ops
-        - trunk
-        - trunk-details
-        - uplink-status-propagation
-      network_api_extensions_tempest:
-        - dvr
-      devstack_localrc:
-        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
-
-- job:
-    name: neutron-tempest-plugin-scenario
-    parent: neutron-tempest-plugin
-    abstract: true
-    description: |
-      Perform setup common to all tempest scenario test jobs.
-    vars:
-      tempest_test_regex: ^neutron_tempest_plugin\.scenario
-      devstack_localrc:
-        PHYSICAL_NETWORK: default
-        IMAGE_URLS: https://cloud-images.ubuntu.com/releases/xenial/release/ubuntu-16.04-server-cloudimg-amd64-disk1.img
-        ADVANCED_IMAGE_NAME: ubuntu-16.04-server-cloudimg-amd64-disk1
-        ADVANCED_INSTANCE_TYPE: ds512M
-        ADVANCED_INSTANCE_USER: ubuntu
-        BUILD_TIMEOUT: 784
-      devstack_services:
-        cinder: true
-
-- job:
-    name: neutron-tempest-plugin-scenario-openvswitch
-    parent: neutron-tempest-plugin-scenario
-    timeout: 10000
-    vars:
-      network_api_extensions: *api_extensions_master
-      devstack_localrc:
-        Q_AGENT: openvswitch
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-      devstack_local_conf:
-        post-config:
-          $NEUTRON_CONF:
-            DEFAULT:
-              enable_dvr: false
-          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
-          # devstack-tempest job will be switched to use lib/neutron instead of
-          # lib/neutron-legacy
-          /$NEUTRON_CORE_PLUGIN_CONF:
-            agent:
-              tunnel_types: vxlan,gre
-            ovs:
-              tunnel_bridge: br-tun
-              bridge_mappings: public:br-ex
-        test-config:
-          $TEMPEST_CONFIG:
-            neutron_plugin_options:
-              available_type_drivers: flat,vlan,local,vxlan
-
-- job:
-    name: neutron-tempest-plugin-scenario-openvswitch-queens
-    parent: neutron-tempest-plugin-scenario-openvswitch
-    nodeset: openstack-single-node-xenial
-    override-checkout: stable/queens
-    required-projects:
-      - openstack/devstack-gate
-      - openstack/neutron
-      - name: openstack/neutron-tempest-plugin
-        override-checkout: 0.3.0
-      - openstack/tempest
-    vars:
-      branch_override: stable/queens
-      network_api_extensions: *api_extensions_queens
-      # TODO(slaweq): remove trunks subport_connectivity test from blacklist
-      # when bug https://bugs.launchpad.net/neutron/+bug/1838760 will be fixed
-      # NOTE(bcafarel): remove DNS test as queens pinned version does not have
-      # fix for https://bugs.launchpad.net/neutron/+bug/1826419
-      tempest_black_regex: "\
-          (^neutron_tempest_plugin.scenario.test_trunk.TrunkTest.test_subport_connectivity)|\
-          (^neutron_tempest_plugin.scenario.test_internal_dns.InternalDNSTest.test_dns_domain_and_name)"
-      devstack_localrc:
-        USE_PYTHON3: false
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
-
-- job:
-    name: neutron-tempest-plugin-scenario-openvswitch-rocky
-    parent: neutron-tempest-plugin-scenario-openvswitch
-    description: |
-      This job run on py2 for stable/rocky gate.
-    nodeset: openstack-single-node-xenial
-    override-checkout: stable/rocky
-    required-projects: *required-projects-rocky
-    vars: &scenario_vars_rocky
-      branch_override: stable/rocky
-      network_api_extensions: *api_extensions_rocky
-      devstack_localrc:
-        USE_PYTHON3: false
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
-      # NOTE(bcafarel): newer tests, unstable on rocky branch
-      tempest_black_regex: "\
-          (^neutron_tempest_plugin.scenario.test_port_forwardings.PortForwardingTestJSON.test_port_forwarding_to_2_servers)|\
-          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)"
-    branches:
-      - stable/rocky
-
-- job:
-    name: neutron-tempest-plugin-scenario-openvswitch-rocky
-    parent: neutron-tempest-plugin-scenario-openvswitch
-    nodeset: openstack-single-node-xenial
-    description: |
-      This job run on py3 for other than stable/rocky gate
-      which is nothing but neutron-tempest-pluign master gate.
-    override-checkout: stable/rocky
-    required-projects: *required-projects-rocky
-    vars:
-      <<: *scenario_vars_rocky
-      devstack_localrc:
-        USE_PYTHON3: True
-    branches: ^(?!stable/rocky).*$
-
-- job:
-    name: neutron-tempest-plugin-scenario-openvswitch-stein
-    parent: neutron-tempest-plugin-scenario-openvswitch
-    override-checkout: stable/stein
-    vars:
-      branch_override: stable/stein
-      network_api_extensions: *api_extensions_stein
-      devstack_localrc:
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-
-- job:
-    name: neutron-tempest-plugin-scenario-openvswitch-train
-    parent: neutron-tempest-plugin-scenario-openvswitch
-    override-checkout: stable/train
-    vars:
-      branch_override: stable/train
-      network_api_extensions: *api_extensions_train
-      devstack_localrc:
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-
-- job:
-    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
-    parent: neutron-tempest-plugin-scenario
-    timeout: 10000
-    vars:
-      network_api_extensions: *api_extensions_master
-      # TODO(slaweq): remove trunks subport_connectivity test from blacklist
-      # when bug https://bugs.launchpad.net/neutron/+bug/1838760 will be fixed
-      tempest_black_regex: "(^neutron_tempest_plugin.scenario.test_trunk.TrunkTest.test_subport_connectivity)"
-      devstack_localrc:
-        Q_AGENT: openvswitch
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-      devstack_local_conf:
-        post-config:
-          $NEUTRON_CONF:
-            DEFAULT:
-              enable_dvr: false
-          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
-          # devstack-tempest job will be switched to use lib/neutron instead of
-          # lib/neutron-legacy
-          /$NEUTRON_CORE_PLUGIN_CONF:
-            agent:
-              tunnel_types: vxlan,gre
-            ovs:
-              tunnel_bridge: br-tun
-              bridge_mappings: public:br-ex
-            securitygroup:
-              firewall_driver: iptables_hybrid
-        test-config:
-          $TEMPEST_CONFIG:
-            neutron_plugin_options:
-              available_type_drivers: flat,vlan,local,vxlan
-
-- job:
-    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-rocky
-    parent: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
-    nodeset: openstack-single-node-xenial
-    description: |
-      This job run on py2 for stable/rocky gate.
-    override-checkout: stable/rocky
-    required-projects: *required-projects-rocky
-    vars: &openvswitch_vars_rocky
-      branch_override: stable/rocky
-      network_api_extensions: *api_extensions_rocky
-      devstack_localrc:
-        USE_PYTHON3: false
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
-      # NOTE(bcafarel): newer tests, unstable on rocky branch
-      tempest_black_regex: "\
-          (^neutron_tempest_plugin.scenario.test_port_forwardings.PortForwardingTestJSON.test_port_forwarding_to_2_servers)|\
-          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)"
-    branches:
-      - stable/rocky
-
-- job:
-    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-rocky
-    parent: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
-    nodeset: openstack-single-node-xenial
-    description: |
-      This job run on py3 for other than stable/rocky gate
-      which is nothing but neutron-tempest-pluign master gate.
-    override-checkout: stable/rocky
-    required-projects: *required-projects-rocky
-    vars:
-      <<: *openvswitch_vars_rocky
-      devstack_localrc:
-        USE_PYTHON3: True
-    branches: ^(?!stable/rocky).*$
-
-- job:
-    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-stein
-    parent: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
-    override-checkout: stable/stein
-    vars:
-      branch_override: stable/stein
-      network_api_extensions: *api_extensions_stein
-      devstack_localrc:
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-
-- job:
-    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-train
-    parent: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
-    override-checkout: stable/train
-    vars:
-      branch_override: stable/train
-      network_api_extensions: *api_extensions_train
-      devstack_localrc:
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-
-- job:
-    name: neutron-tempest-plugin-scenario-linuxbridge
-    parent: neutron-tempest-plugin-scenario
-    timeout: 10000
-    vars:
-      network_api_extensions: *api_extensions_master
-      devstack_localrc:
-        Q_AGENT: linuxbridge
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-      devstack_local_conf:
-        post-config:
-          $NEUTRON_CONF:
-            DEFAULT:
-              enable_dvr: false
-            AGENT:
-              debug_iptables_rules: true
-          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
-          # devstack-tempest job will be switched to use lib/neutron instead of
-          # lib/neutron-legacy
-          /$NEUTRON_CORE_PLUGIN_CONF:
-            ml2:
-              type_drivers: flat,vlan,local,vxlan
-        test-config:
-          $TEMPEST_CONFIG:
-            neutron_plugin_options:
-              available_type_drivers: flat,vlan,local,vxlan
-              q_agent: linuxbridge
-
-- job:
-    name: neutron-tempest-plugin-scenario-linuxbridge-queens
-    parent: neutron-tempest-plugin-scenario-linuxbridge
-    nodeset: openstack-single-node-xenial
-    override-checkout: stable/queens
-    required-projects:
-      - openstack/devstack-gate
-      - openstack/neutron
-      - name: openstack/neutron-tempest-plugin
-        override-checkout: 0.3.0
-      - openstack/tempest
-    vars:
-      branch_override: stable/queens
-      network_api_extensions: *api_extensions_queens
-      # NOTE(bcafarel): remove DNS test as queens pinned version does not have
-      # fix for https://bugs.launchpad.net/neutron/+bug/1826419
-      tempest_black_regex: "\
-          (^neutron_tempest_plugin.scenario.test_internal_dns.InternalDNSTest.test_dns_domain_and_name)"
-      devstack_localrc:
-        USE_PYTHON3: false
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
-      devstack_local_conf:
-        test-config:
-          # NOTE: ignores linux bridge's trunk delete on bound port test
-          # for queens branch (as https://review.opendev.org/#/c/605589/
-          # fix will not apply for queens branch)
-          $TEMPEST_CONFIG:
-            neutron_plugin_options:
-              q_agent: None
-
-- job:
-    name: neutron-tempest-plugin-scenario-linuxbridge-rocky
-    parent: neutron-tempest-plugin-scenario-linuxbridge
-    description: |
-      This job run on py2 for stable/rocky gate.
-    nodeset: openstack-single-node-xenial
-    override-checkout: stable/rocky
-    required-projects: *required-projects-rocky
-    vars: &linuxbridge_vars_rocky
-      branch_override: stable/rocky
-      network_api_extensions: *api_extensions_rocky
-      devstack_localrc:
-        USE_PYTHON3: false
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
-      devstack_local_conf:
-        test-config:
-          # NOTE: ignores linux bridge's trunk delete on bound port test
-          # for rocky branch (as https://review.opendev.org/#/c/605589/
-          # fix will not apply for rocky branch)
-          $TEMPEST_CONFIG:
-            neutron_plugin_options:
-              q_agent: None
-      # NOTE(bcafarel): newer tests, unstable on rocky branch
-      tempest_black_regex: "\
-          (^neutron_tempest_plugin.scenario.test_port_forwardings.PortForwardingTestJSON.test_port_forwarding_to_2_servers)|\
-          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)"
-    branches:
-      - stable/rocky
-
-- job:
-    name: neutron-tempest-plugin-scenario-linuxbridge-rocky
-    parent: neutron-tempest-plugin-scenario-linuxbridge
-    nodeset: openstack-single-node-xenial
-    description: |
-      This job run on py3 for other than stable/rocky gate
-      which is nothing but neutron-tempest-pluign master gate.
-    override-checkout: stable/rocky
-    required-projects: *required-projects-rocky
-    vars:
-      <<: *linuxbridge_vars_rocky
-      devstack_localrc:
-        USE_PYTHON3: True
-    branches: ^(?!stable/rocky).*$
-
-- job:
-    name: neutron-tempest-plugin-scenario-linuxbridge-stein
-    parent: neutron-tempest-plugin-scenario-linuxbridge
-    override-checkout: stable/stein
-    vars:
-      branch_override: stable/stein
-      network_api_extensions: *api_extensions_stein
-      devstack_localrc:
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-
-- job:
-    name: neutron-tempest-plugin-scenario-linuxbridge-train
-    parent: neutron-tempest-plugin-scenario-linuxbridge
-    override-checkout: stable/train
-    vars:
-      branch_override: stable/train
-      network_api_extensions: *api_extensions_train
-      devstack_localrc:
-        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
-
-- job:
-    name: neutron-tempest-plugin-dvr-multinode-scenario
-    parent: tempest-multinode-full
-    description: |
-        Perform setup for Neutron tempest tests in multinode with DVR scenario
-    roles:
-      - zuul: openstack/devstack
-    required-projects:
-      - openstack/devstack-gate
-      - openstack/neutron
-      - openstack/neutron-tempest-plugin
-      - openstack/tempest
-    pre-run: playbooks/dvr-multinode-scenario-pre-run.yaml
-    voting: false
-    vars:
-      tempest_concurrency: 4
-      tox_envlist: all
-      tempest_test_regex: ^neutron_tempest_plugin\.scenario
-      network_api_extensions_common: *api_extensions_master
-      network_api_extensions_dvr:
-        - dvr
-      devstack_localrc:
-        USE_PYTHON3: true
-        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_dvr) | join(',') }}"
-        PHYSICAL_NETWORK: default
-        IMAGE_URLS: https://cloud-images.ubuntu.com/releases/xenial/release/ubuntu-16.04-server-cloudimg-amd64-disk1.img
-        ADVANCED_IMAGE_NAME: ubuntu-16.04-server-cloudimg-amd64-disk1
-        ADVANCED_INSTANCE_TYPE: ds512M
-        ADVANCED_INSTANCE_USER: ubuntu
-        BUILD_TIMEOUT: 784
-      devstack_plugins:
-        neutron: https://opendev.org/openstack/neutron.git
-        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin.git
-      tempest_plugins:
-        - neutron-tempest-plugin
-      devstack_services:
-        tls-proxy: false
-        tempest: true
-        neutron-dns: true
-        neutron-qos: true
-        neutron-segments: true
-        neutron-trunk: true
-        neutron-log: true
-        neutron-port-forwarding: true
-        cinder: true
-      devstack_local_conf:
-        post-config:
-          $NEUTRON_CONF:
-            quotas:
-              quota_router: 100
-              quota_floatingip: 500
-              quota_security_group: 100
-              quota_security_group_rule: 1000
-            DEFAULT:
-              router_distributed: True
-          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
-          # devstack-tempest job will be switched to use lib/neutron instead of
-          # lib/neutron-legacy
-          "/$NEUTRON_CORE_PLUGIN_CONF":
-            ml2:
-              type_drivers: flat,geneve,vlan,gre,local,vxlan
-              mechanism_drivers: openvswitch,l2population
-            ml2_type_vlan:
-              network_vlan_ranges: foo:1:10
-            ml2_type_vxlan:
-              vni_ranges: 1:2000
-            ml2_type_gre:
-              tunnel_id_ranges: 1:1000
-            agent:
-              enable_distributed_routing: True
-              l2_population: True
-              tunnel_types: vxlan,gre
-            ovs:
-              tunnel_bridge: br-tun
-              bridge_mappings: public:br-ex
-          $NEUTRON_L3_CONF:
-            DEFAULT:
-              agent_mode: dvr_snat
-            agent:
-              availability_zone: nova
-          $NEUTRON_DHCP_CONF:
-            agent:
-              availability_zone: nova
-          "/etc/neutron/api-paste.ini":
-            "composite:neutronapi_v2_0":
-              use: "call:neutron.auth:pipeline_factory"
-              noauth: "cors request_id catch_errors osprofiler extensions neutronapiapp_v2_0"
-              keystone: "cors request_id catch_errors osprofiler authtoken keystonecontext extensions neutronapiapp_v2_0"
-        test-config:
-          $TEMPEST_CONFIG:
-            neutron_plugin_options:
-              provider_vlans: foo,
-              agent_availability_zone: nova
-              image_is_advanced: true
-              available_type_drivers: flat,geneve,vlan,gre,local,vxlan
-              l3_agent_mode: dvr_snat
-    group-vars:
-      subnode:
-        devstack_services:
-          tls-proxy: false
-          q-agt: true
-          q-l3: true
-          q-meta: true
-          neutron-qos: true
-          neutron-trunk: true
-          neutron-log: true
-          neutron-port-forwarding: true
-        devstack_localrc:
-          USE_PYTHON3: true
-        devstack_local_conf:
-          post-config:
-            $NEUTRON_CONF:
-              DEFAULT:
-                router_distributed: True
-            # NOTE(slaweq): We can get rid of this hardcoded absolute path when
-            # devstack-tempest job will be switched to use lib/neutron instead of
-            # lib/neutron-legacy
-            "/$NEUTRON_CORE_PLUGIN_CONF":
-              agent:
-                enable_distributed_routing: True
-                l2_population: True
-                tunnel_types: vxlan,gre
-              ovs:
-                tunnel_bridge: br-tun
-                bridge_mappings: public:br-ex
-            $NEUTRON_L3_CONF:
-              DEFAULT:
-                agent_mode: dvr_snat
-              agent:
-                availability_zone: nova
-    irrelevant-files: *tempest-irrelevant-files
-
-- job:
-    name: neutron-tempest-plugin-dvr-multinode-scenario-queens
-    parent: neutron-tempest-plugin-dvr-multinode-scenario
-    nodeset: openstack-two-node-xenial
-    override-checkout: stable/queens
-    required-projects:
-      - openstack/devstack-gate
-      - openstack/neutron
-      - name: openstack/neutron-tempest-plugin
-        override-checkout: 0.3.0
-      - openstack/tempest
-    vars:
-      branch_override: stable/queens
-      network_api_extensions_common: *api_extensions_queens
-      # TODO(slaweq): remove trunks subport_connectivity test from blacklist
-      # when bug https://bugs.launchpad.net/neutron/+bug/1838760 will be fixed
-      # NOTE(bcafarel): remove DNS test as queens pinned version does not have
-      # fix for https://bugs.launchpad.net/neutron/+bug/1826419
-      tempest_black_regex: "\
-          (^neutron_tempest_plugin.scenario.test_trunk.TrunkTest.test_subport_connectivity)|\
-          (^neutron_tempest_plugin.scenario.test_internal_dns.InternalDNSTest.test_dns_domain_and_name)"
-      devstack_localrc:
-        USE_PYTHON3: false
-        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
-
-- job:
-    name: neutron-tempest-plugin-dvr-multinode-scenario-rocky
-    parent: neutron-tempest-plugin-dvr-multinode-scenario
-    description: |
-      This job run on py2 for stable/rocky gate.
-    nodeset: openstack-two-node-xenial
-    override-checkout: stable/rocky
-    required-projects: *required-projects-rocky
-    vars: &multinode_scenario_vars_rocky
-      branch_override: stable/rocky
-      network_api_extensions_common: *api_extensions_rocky
-      devstack_localrc:
-        USE_PYTHON3: false
-        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
-      # NOTE(bcafarel): newer tests, unstable on rocky branch
-      tempest_black_regex: "\
-          (^neutron_tempest_plugin.scenario.test_port_forwardings.PortForwardingTestJSON.test_port_forwarding_to_2_servers)|\
-          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)"
-    branches:
-      - stable/rocky
-
-- job:
-    name: neutron-tempest-plugin-dvr-multinode-scenario-rocky
-    parent: neutron-tempest-plugin-dvr-multinode-scenario
-    nodeset: openstack-two-node-xenial
-    description: |
-      This job run on py3 for other than stable/rocky gate
-      which is nothing but neutron-tempest-pluign master gate.
-    override-checkout: stable/rocky
-    vars:
-      <<: *multinode_scenario_vars_rocky
-      devstack_localrc:
-        USE_PYTHON3: True
-    required-projects: *required-projects-rocky
-    group-vars:
-      subnode:
-        devstack_localrc:
-          USE_PYTHON3: True
-    branches: ^(?!stable/rocky).*$
-
-- job:
-    name: neutron-tempest-plugin-dvr-multinode-scenario-stein
-    parent: neutron-tempest-plugin-dvr-multinode-scenario
-    override-checkout: stable/stein
-    vars:
-      network_api_extensions_common: *api_extensions_stein
-      branch_override: stable/stein
-
-- job:
-    name: neutron-tempest-plugin-dvr-multinode-scenario-train
-    parent: neutron-tempest-plugin-dvr-multinode-scenario
-    override-checkout: stable/train
-    vars:
-      network_api_extensions_common: *api_extensions_train
-      branch_override: stable/train
-
-- job:
-    name: neutron-tempest-plugin-designate-scenario
-    parent: neutron-tempest-plugin-scenario
-    description: Neutron designate integration scenario
-    required-projects:
-      - openstack/designate
-      - openstack/designate-dashboard
-      - openstack/designate-tempest-plugin
-    timeout: 3600
-    vars:
-      devstack_localrc:
-        DESIGNATE_BACKEND_DRIVER: bind9
-        Q_AGENT: openvswitch
-        # In this job advanced image is not needed, so it's name should be
-        # empty
-        ADVANCED_IMAGE_NAME: ""
-      devstack_local_conf:
-        post-config:
-          $NEUTRON_CONF:
-            DEFAULT:
-              enable_dvr: false
-          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
-          # devstack-tempest job will be switched to use lib/neutron instead of
-          # lib/neutron-legacy
-          /$NEUTRON_CORE_PLUGIN_CONF:
-            agent:
-              tunnel_types: vxlan,gre
-            ovs:
-              tunnel_bridge: br-tun
-              bridge_mappings: public:br-ex
-      devstack_plugins:
-        designate: https://opendev.org/openstack/designate.git
-      devstack_services:
-        cinder: false
-        designate: true
-      tempest_plugins:
-        - designate-tempest-plugin
-        - neutron-tempest-plugin
-      tempest_test_regex: ^neutron_tempest_plugin\.scenario\.test_dns_integration
-    irrelevant-files: *tempest-irrelevant-files
-
-- job:
-    name: neutron-tempest-plugin-designate-scenario-queens
-    parent: neutron-tempest-plugin-designate-scenario
-    nodeset: openstack-single-node-xenial
-    override-checkout: stable/queens
-    required-projects:
-      - openstack/devstack-gate
-      - openstack/neutron
-      - name: openstack/neutron-tempest-plugin
-        override-checkout: 0.3.0
-      - name: openstack/designate-tempest-plugin
-        override-checkout: 0.7.0
-      - openstack/tempest
-    vars:
-      branch_override: stable/queens
-      network_api_extensions_common: *api_extensions_queens
-      # NOTE(bcafarel): remove DNS test as queens pinned version does not have
-      # fix for https://bugs.launchpad.net/neutron/+bug/1826419
-      tempest_black_regex: "\
-          (^neutron_tempest_plugin.scenario.test_internal_dns.InternalDNSTest.test_dns_domain_and_name)"
-      devstack_localrc:
-        USE_PYTHON3: false
-        TEMPEST_PLUGINS: '"/opt/stack/designate-tempest-plugin /opt/stack/neutron-tempest-plugin"'
-
-- job:
-    name: neutron-tempest-plugin-designate-scenario-rocky
-    parent: neutron-tempest-plugin-designate-scenario
-    description: |
-      This job run on py2 for stable/rocky gate.
-    nodeset: openstack-single-node-xenial
-    override-checkout: stable/rocky
-    required-projects:
-      - openstack/devstack-gate
-      - openstack/neutron
-      - name: openstack/neutron-tempest-plugin
-        override-checkout: 0.9.0
-      - name: openstack/designate-tempest-plugin
-        override-checkout: 0.7.0
-      - openstack/tempest
-    vars: &designate_scenario_vars_rocky
-      branch_override: stable/rocky
-      network_api_extensions_common: *api_extensions_rocky
-      devstack_localrc:
-        USE_PYTHON3: false
-        TEMPEST_PLUGINS: '"/opt/stack/designate-tempest-plugin /opt/stack/neutron-tempest-plugin"'
-    branches:
-      - stable/rocky
-
-- job:
-    name: neutron-tempest-plugin-designate-scenario-rocky
-    parent: neutron-tempest-plugin-designate-scenario
-    nodeset: openstack-single-node-xenial
-    description: |
-      This job run on py3 for other than stable/rocky gate
-      which is nothing but neutron-tempest-plugin master gate.
-    override-checkout: stable/rocky
-    required-projects: *required-projects-rocky
-    vars:
-      <<: *designate_scenario_vars_rocky
-      devstack_localrc:
-        USE_PYTHON3: True
-    branches: ^(?!stable/rocky).*$
-
-- job:
-    name: neutron-tempest-plugin-designate-scenario-stein
-    parent: neutron-tempest-plugin-designate-scenario
-    override-checkout: stable/stein
-    required-projects:
-      - openstack/devstack-gate
-      - openstack/neutron
-      - openstack/neutron-tempest-plugin
-      - name: openstack/designate-tempest-plugin
-        override-checkout: 0.7.0
-      - openstack/tempest
-    vars:
-      branch_override: stable/stein
-      network_api_extensions_common: *api_extensions_stein
-
-- job:
-    name: neutron-tempest-plugin-designate-scenario-train
-    parent: neutron-tempest-plugin-designate-scenario
-    override-checkout: stable/train
-    vars:
-      branch_override: stable/train
-      network_api_extensions_common: *api_extensions_train
-
-- job:
-    name: neutron-tempest-plugin-sfc
-    parent: neutron-tempest-plugin
-    timeout: 10800
-    required-projects:
-      - openstack/devstack-gate
-      - openstack/networking-sfc
-      - openstack/neutron
-      - openstack/neutron-tempest-plugin
-      - openstack/tempest
-    vars:
-      tempest_test_regex: ^neutron_tempest_plugin\.sfc
-      tox_envlist: all-plugin
-      devstack_plugins:
-        networking-sfc: https://opendev.org/openstack/networking-sfc
-        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin
-      network_api_extensions_sfc:
-        - flow_classifier
-        - sfc
-      devstack_localrc:
-        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_sfc) | join(',') }}"
-      # TODO(bcafarel): tests still fail from time to time in parallel
-      # https://bugs.launchpad.net/neutron/+bug/1851500
-      # https://bugs.launchpad.net/networking-sfc/+bug/1660366
-      tempest_concurrency: 1
-
-- job:
-    name: neutron-tempest-plugin-sfc-train
-    parent: neutron-tempest-plugin-sfc
-    override-checkout: stable/train
-    vars:
-      branch_override: stable/train
-      network_api_extensions_common: *api_extensions_train
-
-- job:
-    name: neutron-tempest-plugin-bgpvpn-bagpipe
-    parent: neutron-tempest-plugin
-    required-projects:
-      - openstack/networking-bagpipe
-      - openstack/networking-bgpvpn
-    vars:
-      tempest_test_regex: ^neutron_tempest_plugin\.bgpvpn
-      network_api_extensions: *api_extensions_master
-      network_api_extensions_bgpvpn:
-        - bgpvpn
-        - bgpvpn-routes-control
-      devstack_localrc:
-        NETWORKING_BGPVPN_DRIVER: "BGPVPN:BaGPipe:networking_bgpvpn.neutron.services.service_drivers.bagpipe.bagpipe_v2.BaGPipeBGPVPNDriver:default"
-        BAGPIPE_DATAPLANE_DRIVER_IPVPN: "ovs"
-        BAGPIPE_BGP_PEERS: "-"
-        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions + network_api_extensions_bgpvpn) | join(',') }}"
-      devstack_plugins:
-        networking-bgpvpn: https://git.openstack.org/openstack/networking-bgpvpn
-        networking-bagpipe: https://git.openstack.org/openstack/networking-bagpipe
-
-- job:
-    name: neutron-tempest-plugin-bgpvpn-bagpipe-train
-    parent: neutron-tempest-plugin-bgpvpn-bagpipe
-    override-checkout: stable/train
-    vars:
-      branch_override: stable/train
-      network_api_extensions: *api_extensions_train
-
-- job:
-    name: neutron-tempest-plugin-fwaas
-    parent: neutron-tempest-plugin
-    timeout: 10800
-    required-projects:
-      - openstack/devstack-gate
-      - openstack/neutron-fwaas
-      - openstack/neutron
-      - openstack/neutron-tempest-plugin
-      - openstack/tempest
-    vars:
-      tempest_test_regex: ^neutron_tempest_plugin\.fwaas
-      tox_envlist: all-plugin
-      devstack_plugins:
-        neutron-fwaas: https://opendev.org/openstack/neutron-fwaas.git
-        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin.git
-      network_api_extensions_common: *api_extensions_master
-      network_api_extensions_fwaas:
-        - fwaas_v2
-      devstack_localrc:
-        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_fwaas) | join(',') }}"
-
-- job:
-    name: neutron-tempest-plugin-fwaas-train
-    parent: neutron-tempest-plugin-fwaas
-    override-checkout: stable/train
-    vars:
-      branch_override: stable/train
-      network_api_extensions_common: *api_extensions_train
-
-- job:
-    name: neutron-tempest-plugin-dynamic-routing
-    parent: neutron-tempest-plugin
-    description: |
-      Perform setup common to all Neutron dynamic routing tempest tests
-    required-projects:
-      - openstack/neutron
-      - openstack/neutron-dynamic-routing
-      - openstack/os-ken
-      - openstack/tempest
-    pre-run: playbooks/dynamic-routing-pre-run.yaml
-    vars:
-      devstack_plugins:
-        neutron-dynamic-routing: https://opendev.org/openstack/neutron-dynamic-routing
-        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin
-      network_api_extensions_common: *api_extensions_master
-      network_api_extensions_bgp:
-        - bgp
-        - bgp_dragent_scheduler
-        - bgp_4byte_asn
-      devstack_localrc:
-        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_bgp) | join(',') }}"
-      devstack_services:
-        neutron-dr: true
-        neutron-dr-agent: true
-        q-l3: true
-      tempest_concurrency: 1
-      tempest_test_regex: ^neutron_tempest_plugin\.neutron_dynamic_routing
-
-- job:
-    name: neutron-tempest-plugin-vpnaas
-    parent: neutron-tempest-plugin
-    timeout: 3900
-    required-projects:
-      - openstack/devstack-gate
-      - openstack/neutron
-      - openstack/neutron-vpnaas
-      - openstack/neutron-tempest-plugin
-      - openstack/tempest
-    vars:
-      tempest_test_regex: ^neutron_tempest_plugin\.vpnaas
-      tox_envlist: all-plugin
-      devstack_plugins:
-        neutron-vpnaas: https://opendev.org/openstack/neutron-vpnaas.git
-        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin.git
-      network_api_extensions_common: *api_extensions_master
-      network_api_extensions_vpnaas:
-        - vpnaas
-      devstack_localrc:
-        IPSEC_PACKAGE: strongswan
-        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_vpnaas) | join(',') }}"
-    irrelevant-files:
-      - ^.*\.rst$
-      - ^doc/.*$
-      - ^neutron_vpnaas/tests/unit/.*$
-      - ^releasenotes/.*$
-
-- project-template:
-    name: neutron-tempest-plugin-jobs
-    check:
-      jobs:
-        - neutron-tempest-plugin-api
-        - neutron-tempest-plugin-designate-scenario
-        - neutron-tempest-plugin-dvr-multinode-scenario
-        - neutron-tempest-plugin-scenario-linuxbridge
-        - neutron-tempest-plugin-scenario-openvswitch
-        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
-    gate:
-      jobs:
-        - neutron-tempest-plugin-api
-        - neutron-tempest-plugin-scenario-linuxbridge
-        - neutron-tempest-plugin-scenario-openvswitch
-        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
-
-- project-template:
-    name: neutron-tempest-plugin-jobs-queens
-    check:
-      jobs:
-        - neutron-tempest-plugin-api-queens
-        - neutron-tempest-plugin-designate-scenario-queens
-        - neutron-tempest-plugin-dvr-multinode-scenario-queens
-        - neutron-tempest-plugin-scenario-linuxbridge-queens
-        - neutron-tempest-plugin-scenario-openvswitch-queens
-    gate:
-      jobs:
-        - neutron-tempest-plugin-api-queens
-
-- project-template:
-    name: neutron-tempest-plugin-jobs-rocky
-    check:
-      jobs:
-        - neutron-tempest-plugin-api-rocky
-        - neutron-tempest-plugin-designate-scenario-rocky
-        - neutron-tempest-plugin-dvr-multinode-scenario-rocky
-        - neutron-tempest-plugin-scenario-linuxbridge-rocky
-        - neutron-tempest-plugin-scenario-openvswitch-rocky
-        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-rocky
-    gate:
-      jobs:
-        - neutron-tempest-plugin-api-rocky
-
-- project-template:
-    name: neutron-tempest-plugin-jobs-stein
-    check:
-      jobs:
-        - neutron-tempest-plugin-api-stein
-        - neutron-tempest-plugin-designate-scenario-stein
-        - neutron-tempest-plugin-dvr-multinode-scenario-stein
-        - neutron-tempest-plugin-scenario-linuxbridge-stein
-        - neutron-tempest-plugin-scenario-openvswitch-stein
-        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-stein
-    gate:
-      jobs:
-        - neutron-tempest-plugin-api-stein
-
-- project-template:
-    name: neutron-tempest-plugin-jobs-train
-    check:
-      jobs:
-        - neutron-tempest-plugin-api-train
-        - neutron-tempest-plugin-designate-scenario-train
-        - neutron-tempest-plugin-dvr-multinode-scenario-train
-        - neutron-tempest-plugin-scenario-linuxbridge-train
-        - neutron-tempest-plugin-scenario-openvswitch-train
-        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-train
-    gate:
-      jobs:
-        - neutron-tempest-plugin-api-train
-
-- project:
-    templates:
-      - build-openstack-docs-pti
-      - neutron-tempest-plugin-jobs
-      - neutron-tempest-plugin-jobs-stein
-      - neutron-tempest-plugin-jobs-train
-      - check-requirements
-      - tempest-plugin-jobs
-      - release-notes-jobs-python3
-    check:
-      jobs:
-        - neutron-tempest-plugin-sfc
-        - neutron-tempest-plugin-sfc-train
-        - neutron-tempest-plugin-bgpvpn-bagpipe
-        - neutron-tempest-plugin-bgpvpn-bagpipe-train
-        - neutron-tempest-plugin-fwaas:
-            # TODO(slaweq): switch it to be voting when bug
-            # https://bugs.launchpad.net/neutron/+bug/1858645 will be fixed
-            voting: false
-        - neutron-tempest-plugin-fwaas-train:
-            # TODO(slaweq): switch it to be voting when bug
-            # https://bugs.launchpad.net/neutron/+bug/1858645 will be fixed
-            voting: false
-        - neutron-tempest-plugin-dynamic-routing
-        - neutron-tempest-plugin-vpnaas
-
-    gate:
-      jobs:
-        - neutron-tempest-plugin-sfc
-        - neutron-tempest-plugin-bgpvpn-bagpipe
-        # TODO(slaweq): bring it back to gate queue
-        # https://bugs.launchpad.net/neutron/+bug/1858645 will be fixed
-        # - neutron-tempest-plugin-fwaas
-        - neutron-tempest-plugin-dynamic-routing
diff --git a/devstack/plugin.sh b/devstack/plugin.sh
index 25cfba6..7a46014 100644
--- a/devstack/plugin.sh
+++ b/devstack/plugin.sh
@@ -12,8 +12,10 @@
 if [[ "$1" == "stack" ]]; then
     case "$2" in
         install)
-            echo_summary "Installing neutron-tempest-plugin"
-            install_neutron_tempest_plugin
+            if [[ "$INSTALL_TEMPEST" == "True" ]]; then
+                echo_summary "Installing neutron-tempest-plugin"
+                install_neutron_tempest_plugin
+            fi
             ;;
         test-config)
             echo_summary "Configuring neutron-tempest-plugin tempest options"
diff --git a/neutron_tempest_plugin/api/admin/test_external_network_extension.py b/neutron_tempest_plugin/api/admin/test_external_network_extension.py
index a713492..cf6c44d 100644
--- a/neutron_tempest_plugin/api/admin/test_external_network_extension.py
+++ b/neutron_tempest_plugin/api/admin/test_external_network_extension.py
@@ -35,9 +35,18 @@
             post_body['router:external'] = external
         body = self.admin_client.create_network(**post_body)
         network = body['network']
-        self.addCleanup(self.admin_client.delete_network, network['id'])
+        self.addCleanup(self._delete_network, network['id'])
         return network
 
+    def _delete_network(self, net_id):
+        try:
+            self.admin_client.delete_network(net_id)
+        except lib_exc.Conflict:
+            ports = self.admin_client.list_ports(network_id=net_id)['ports']
+            for port in ports:
+                self.admin_client.delete_port(port['id'])
+            self.admin_client.delete_network(net_id)
+
     @decorators.idempotent_id('afd8f1b7-a81e-4629-bca8-a367b3a144bb')
     def test_regular_client_shares_with_another(self):
         net = self.create_network()
diff --git a/neutron_tempest_plugin/api/admin/test_ports.py b/neutron_tempest_plugin/api/admin/test_ports.py
index bdb66ef..9c94322 100644
--- a/neutron_tempest_plugin/api/admin/test_ports.py
+++ b/neutron_tempest_plugin/api/admin/test_ports.py
@@ -89,9 +89,7 @@
 
         cls.vnic_type = 'normal'
 
-        # Note(lajoskatona): to avoid creating provider network use vxlan
-        # as provider network type:
-        cls.network = cls.create_network(provider_network_type='vxlan')
+        cls.network = cls.create_network()
         cls.physnet_name = CONF.neutron_plugin_options.provider_vlans[0]
         base_segm = CONF.neutron_plugin_options.provider_net_base_segm_id
         cls.prov_network = cls.create_provider_network(
diff --git a/neutron_tempest_plugin/api/base.py b/neutron_tempest_plugin/api/base.py
index f8cb339..1b02211 100644
--- a/neutron_tempest_plugin/api/base.py
+++ b/neutron_tempest_plugin/api/base.py
@@ -789,12 +789,15 @@
         return body['address_scope']
 
     @classmethod
-    def create_subnetpool(cls, name, is_admin=False, **kwargs):
+    def create_subnetpool(cls, name, is_admin=False, client=None, **kwargs):
+        if client is None:
+            client = cls.admin_client if is_admin else cls.client
+
         if is_admin:
-            body = cls.admin_client.create_subnetpool(name, **kwargs)
+            body = client.create_subnetpool(name, **kwargs)
             cls.admin_subnetpools.append(body['subnetpool'])
         else:
-            body = cls.client.create_subnetpool(name, **kwargs)
+            body = client.create_subnetpool(name, **kwargs)
             cls.subnetpools.append(body['subnetpool'])
         return body['subnetpool']
 
diff --git a/neutron_tempest_plugin/api/test_address_scopes.py b/neutron_tempest_plugin/api/test_address_scopes.py
index 6cf0885..b8c143a 100644
--- a/neutron_tempest_plugin/api/test_address_scopes.py
+++ b/neutron_tempest_plugin/api/test_address_scopes.py
@@ -11,6 +11,7 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
+import testtools
 
 from tempest.common import utils
 from tempest.lib.common.utils import data_utils
@@ -115,3 +116,141 @@
         address_scope = self._test_update_address_scope_helper(is_admin=True,
                                                                shared=True)
         self.assertTrue(address_scope['shared'])
+
+
+class RbacAddressScopeTest(AddressScopeTestBase):
+
+    force_tenant_isolation = True
+    credentials = ['primary', 'alt', 'admin']
+    required_extensions = ['address-scope', 'rbac-address-scope']
+
+    @classmethod
+    def resource_setup(cls):
+        super(RbacAddressScopeTest, cls).resource_setup()
+        cls.client2 = cls.os_alt.network_client
+
+    def _make_admin_as_shared_to_project_id(self, project_id):
+        a_s = self._create_address_scope(ip_version=4, is_admin=True)
+        rbac_policy = self.admin_client.create_rbac_policy(
+            object_type='address_scope',
+            object_id=a_s['id'],
+            action='access_as_shared',
+            target_tenant=project_id,
+        )['rbac_policy']
+        return {'address_scope': a_s, 'rbac_policy': rbac_policy}
+
+    @decorators.idempotent_id('038e999b-cd4b-4021-a9ff-ebb734f6e056')
+    def test_policy_target_update(self):
+        res = self._make_admin_as_shared_to_project_id(
+            self.client.tenant_id)
+        # change to client2
+        update_res = self.admin_client.update_rbac_policy(
+                res['rbac_policy']['id'], target_tenant=self.client2.tenant_id)
+        self.assertEqual(self.client2.tenant_id,
+                         update_res['rbac_policy']['target_tenant'])
+        # make sure everything else stayed the same
+        res['rbac_policy'].pop('target_tenant')
+        update_res['rbac_policy'].pop('target_tenant')
+        self.assertEqual(res['rbac_policy'], update_res['rbac_policy'])
+
+    @decorators.idempotent_id('798ac6c6-96cc-49ce-ba5c-c6eced7a09d3')
+    def test_subnet_pool_presence_prevents_rbac_policy_deletion(self):
+        res = self._make_admin_as_shared_to_project_id(
+            self.client2.tenant_id)
+        snp = self.create_subnetpool(
+            data_utils.rand_name("rbac-address-scope"),
+            default_prefixlen=24, prefixes=['10.0.0.0/8'],
+            address_scope_id=res['address_scope']['id'],
+            client=self.client2
+        )
+        self.addCleanup(
+            self.admin_client.delete_rbac_policy,
+            res['rbac_policy']['id']
+        )
+        self.addCleanup(self.client2.delete_subnetpool, snp['id'])
+
+        # a port with shared sg should prevent the deletion of an
+        # rbac-policy required for it to be shared
+        with testtools.ExpectedException(lib_exc.Conflict):
+            self.admin_client.delete_rbac_policy(res['rbac_policy']['id'])
+
+    @decorators.idempotent_id('57da6ba2-6329-49c8-974c-9858fe187136')
+    def test_regular_client_shares_to_another_regular_client(self):
+        # owned by self.admin_client
+        a_s = self._create_address_scope(ip_version=4, is_admin=True)
+        with testtools.ExpectedException(lib_exc.NotFound):
+            self.client.show_address_scope(a_s['id'])
+        rbac_policy = self.admin_client.create_rbac_policy(
+            object_type='address_scope', object_id=a_s['id'],
+            action='access_as_shared',
+            target_tenant=self.client.tenant_id)['rbac_policy']
+        self.client.show_address_scope(a_s['id'])
+
+        self.assertIn(rbac_policy,
+                      self.admin_client.list_rbac_policies()['rbac_policies'])
+        # ensure that 'client2' can't see the rbac-policy sharing the
+        # as to it because the rbac-policy belongs to 'client'
+        self.assertNotIn(rbac_policy['id'], [p['id'] for p in
+                         self.client2.list_rbac_policies()['rbac_policies']])
+
+    @decorators.idempotent_id('051248e7-d66f-4c69-9022-2b73ee5b9e73')
+    def test_filter_fields(self):
+        a_s = self._create_address_scope(ip_version=4)
+        self.admin_client.create_rbac_policy(
+            object_type='address_scope', object_id=a_s['id'],
+            action='access_as_shared', target_tenant=self.client2.tenant_id)
+        field_args = (('id',), ('id', 'action'), ('object_type', 'object_id'),
+                      ('project_id', 'target_tenant'))
+        for fields in field_args:
+            res = self.admin_client.list_rbac_policies(fields=fields)
+            self.assertEqual(set(fields), set(res['rbac_policies'][0].keys()))
+
+    @decorators.idempotent_id('19cbd62e-c6c3-4495-98b9-b9c6c6c9c127')
+    def test_rbac_policy_show(self):
+        res = self._make_admin_as_shared_to_project_id(
+            self.client.tenant_id)
+        p1 = res['rbac_policy']
+        p2 = self.admin_client.create_rbac_policy(
+            object_type='address_scope',
+            object_id=res['address_scope']['id'],
+            action='access_as_shared',
+            target_tenant='*')['rbac_policy']
+
+        self.assertEqual(
+            p1, self.admin_client.show_rbac_policy(p1['id'])['rbac_policy'])
+        self.assertEqual(
+            p2, self.admin_client.show_rbac_policy(p2['id'])['rbac_policy'])
+
+    @decorators.idempotent_id('88852ba0-8546-4ce7-8f79-4a9c840c881d')
+    def test_filter_rbac_policies(self):
+        a_s = self._create_address_scope(ip_version=4)
+        rbac_pol1 = self.admin_client.create_rbac_policy(
+            object_type='address_scope', object_id=a_s['id'],
+            action='access_as_shared',
+            target_tenant=self.client2.tenant_id)['rbac_policy']
+        rbac_pol2 = self.admin_client.create_rbac_policy(
+            object_type='address_scope', object_id=a_s['id'],
+            action='access_as_shared',
+            target_tenant=self.admin_client.tenant_id)['rbac_policy']
+        res1 = self.admin_client.list_rbac_policies(id=rbac_pol1['id'])[
+            'rbac_policies']
+        res2 = self.admin_client.list_rbac_policies(id=rbac_pol2['id'])[
+            'rbac_policies']
+        self.assertEqual(1, len(res1))
+        self.assertEqual(1, len(res2))
+        self.assertEqual(rbac_pol1['id'], res1[0]['id'])
+        self.assertEqual(rbac_pol2['id'], res2[0]['id'])
+
+    @decorators.idempotent_id('222a638d-819e-41a7-a3fe-550265c06e79')
+    def test_regular_client_blocked_from_sharing_anothers_policy(self):
+        a_s = self._make_admin_as_shared_to_project_id(
+            self.client.tenant_id)['address_scope']
+        with testtools.ExpectedException(lib_exc.BadRequest):
+            self.client.create_rbac_policy(
+                object_type='address_scope', object_id=a_s['id'],
+                action='access_as_shared',
+                target_tenant=self.client2.tenant_id)
+
+        # make sure the rbac-policy is invisible to the tenant for which it's
+        # being shared
+        self.assertFalse(self.client.list_rbac_policies()['rbac_policies'])
diff --git a/neutron_tempest_plugin/api/test_ports.py b/neutron_tempest_plugin/api/test_ports.py
index 52783b9..8867eee 100644
--- a/neutron_tempest_plugin/api/test_ports.py
+++ b/neutron_tempest_plugin/api/test_ports.py
@@ -13,6 +13,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import copy
+
 from tempest.common import utils
 from tempest.lib import decorators
 
@@ -203,3 +205,62 @@
     @decorators.idempotent_id('74293e59-d794-4a93-be09-38667199ef68')
     def test_list_pagination_page_reverse_with_href_links(self):
         self._test_list_pagination_page_reverse_with_href_links()
+
+
+class PortsTaggingOnCreationTestJSON(base.BaseNetworkTest):
+
+    _tags = [
+        ['tag-1', 'tag-2', 'tag-3'],
+        ['tag-1', 'tag-2'],
+        ['tag-1', 'tag-3'],
+        []
+    ]
+
+    @classmethod
+    def resource_setup(cls):
+        super(PortsTaggingOnCreationTestJSON, cls).resource_setup()
+        cls.network = cls.create_network()
+
+    def _create_ports_in_bulk(self, ports):
+        body = self.client.create_bulk_port(ports)
+        for port in body['ports']:
+            self.ports.append(port)
+        return body
+
+    def _create_ports_list(self):
+        num_ports = len(self._tags)
+        net_id = self.network['id']
+        port = {'port': {'network_id': net_id,
+                         'admin_state_up': True}}
+        return [copy.deepcopy(port) for x in range(num_ports)]
+
+    @decorators.idempotent_id('5cf26014-fdd3-4a6d-b94d-a05f0c55da89')
+    @utils.requires_ext(extension="tag-ports-during-bulk-creation",
+                        service="network")
+    def test_tagging_ports_during_bulk_creation(self):
+        ports = self._create_ports_list()
+        ports_tags_map = {}
+        for port, tags in zip(ports, self._tags):
+            port['port']['tags'] = tags
+            port['port']['name'] = '-'.join(tags)
+            ports_tags_map[port['port']['name']] = tags
+        body = self._create_ports_in_bulk(ports)
+        for port in body['ports']:
+            self.assertEqual(ports_tags_map[port['name']], port['tags'])
+
+    @decorators.idempotent_id('33eda785-a08a-44a0-1bbb-fb50a2f1cd78')
+    @utils.requires_ext(extension="tag-ports-during-bulk-creation",
+                        service="network")
+    def test_tagging_ports_during_bulk_creation_no_tags(self):
+        ports = self._create_ports_list()
+        body = self._create_ports_in_bulk(ports)
+        for port in body['ports']:
+            self.assertFalse(port['tags'])
+
+    @decorators.idempotent_id('6baa43bf-88fb-8bca-6051-97ea1a5e8f4f')
+    @utils.requires_ext(extension="tag-ports-during-bulk-creation",
+                        service="network")
+    def test_tagging_ports_during_creation(self):
+        port = {'name': 'port', 'tags': self._tags[0]}
+        body = self.create_port(self.network, **port)
+        self.assertEqual(self._tags[0], body['tags'])
diff --git a/neutron_tempest_plugin/api/test_security_groups.py b/neutron_tempest_plugin/api/test_security_groups.py
index 0221e79..dd1597c 100644
--- a/neutron_tempest_plugin/api/test_security_groups.py
+++ b/neutron_tempest_plugin/api/test_security_groups.py
@@ -17,6 +17,7 @@
 
 from neutron_lib import constants
 from tempest.lib.common.utils import data_utils
+from tempest.lib.common.utils import test_utils
 from tempest.lib import decorators
 from tempest.lib import exceptions
 import testtools
@@ -144,13 +145,15 @@
         sg_quota = self._get_sg_quota()
         new_sg_quota = 2 * sg_quota
         self._set_sg_quota(new_sg_quota)
-        return new_sg_quota
+        self.assertEqual(self._get_sg_quota(), new_sg_quota,
+                         "Security group quota wasn't changed correctly")
 
     def _decrease_sg_quota(self):
         sg_quota = self._get_sg_quota()
         new_sg_quota = sg_quota // 2
         self._set_sg_quota(new_sg_quota)
-        return new_sg_quota
+        self.assertEqual(self._get_sg_quota(), new_sg_quota,
+                         "Security group quota wasn't changed correctly")
 
     def _set_sg_quota(self, val):
         sg_quota = self._get_sg_quota()
@@ -191,19 +194,15 @@
     @decorators.idempotent_id('623d909c-6ef8-43d6-93ee-97086e2651e8')
     def test_sg_quota_increased(self):
         self._create_max_allowed_sg_amount()
-        new_quota = self._increase_sg_quota()
+        self._increase_sg_quota()
         self._create_max_allowed_sg_amount()
-        quota_set = self._get_sg_quota()
-        self.assertEqual(quota_set, new_quota,
-                         "Security group quota was not changed correctly")
-        self.assertEqual(quota_set, self._get_sg_amount(),
+        self.assertEqual(self._get_sg_quota(), self._get_sg_amount(),
                          "Amount of security groups doesn't match quota")
 
     @decorators.idempotent_id('ba95676c-8d9a-4482-b4ec-74d51a4602a6')
     def test_sg_quota_decrease_less_than_created(self):
         self._create_max_allowed_sg_amount()
-        new_quota = self._decrease_sg_quota()
-        self.assertEqual(self._get_sg_quota(), new_quota)
+        self._decrease_sg_quota()
 
     @decorators.idempotent_id('d43cf1a7-aa7e-4c41-9340-627a1a6ab961')
     def test_create_sg_when_quota_disabled(self):
@@ -222,11 +221,11 @@
         sg_rules_to_create = sg_rules_quota - sg_rules_amount
         port_index += sg_rules_to_create
         self._create_security_group_rules(sg_rules_to_create,
-                                         port_index=port_index)
+                                          port_index=port_index)
 
     def _create_security_group_rules(self, amount, port_index=1):
         for i in range(amount):
-            self.create_security_group_rules(**{
+            self.create_security_group_rule(**{
                 'project_id': self.client.tenant_id,
                 'direction': 'ingress',
                 'port_range_max': port_index + i,
@@ -237,6 +236,8 @@
         sg_rules_quota = self._get_sg_rules_quota()
         new_sg_rules_quota = 2 * sg_rules_quota
         self._set_sg_rules_quota(new_sg_rules_quota)
+        self.assertGreater(self._get_sg_rules_quota(), sg_rules_quota,
+                           "Security group rule quota wasnt changed correctly")
         return new_sg_rules_quota
 
     def _decrease_sg_rules_quota(self):
@@ -264,6 +265,63 @@
         return len(security_group_rules['security_group_rules'])
 
 
+class SecGroupRulesQuotaTest(BaseSecGroupRulesQuota):
+
+    credentials = ['primary', 'admin']
+    required_extensions = ['security-group', 'quotas']
+
+    def setUp(self):
+        super(SecGroupRulesQuotaTest, self).setUp()
+        self.addCleanup(test_utils.call_and_ignore_notfound_exc,
+                        self.admin_client.reset_quotas, self.client.tenant_id)
+        self._set_sg_rules_quota(10)
+
+    @decorators.idempotent_id('77ec038c-5638-11ea-8e2d-0242ac130003')
+    def test_sg_rules_quota_increased(self):
+        """Test security group rules quota increased.
+
+        This test checks if it is possible to increase the SG rules Quota
+        value and creates security group rules according to new quota value.
+        """
+        self._create_max_allowed_sg_rules_amount()
+        new_quota = self._increase_sg_rules_quota()
+        port_index = new_quota
+        self._create_max_allowed_sg_rules_amount(port_index)
+        quota_set = self._get_sg_rules_quota()
+        self.assertEqual(quota_set, self._get_sg_rules_amount(),
+                         "Amount of security groups rules doesn't match quota")
+
+    @decorators.idempotent_id('37508c8d-270b-4b93-8007-72876a1fec38')
+    def test_sg_rules_quota_values(self):
+        """Test security group rules quota values.
+
+        This test checks if it is possible to change the SG rules Quota
+        values, different values.
+        """
+        sg_rules_quota = self._get_sg_rules_quota()
+        project_id = self.client.tenant_id
+        self.addCleanup(self.admin_client.update_quotas,
+                        project_id, **{'security_group_rule': sg_rules_quota})
+        values = [-1, 0, 10, 2147483647]
+        for value in values:
+            self._set_sg_rules_quota(value)
+            self.assertEqual(value, self._get_sg_rules_quota())
+
+    @decorators.idempotent_id('4459e066-d9c8-4a13-9e98-018f95ce2dbf')
+    def test_create_sg_rules_when_quota_disabled(self):
+        sg_rules_amount = self._get_sg_rules_amount()
+        self._set_sg_rules_quota(-1)
+        self._create_security_group_rules(10, port_index=100)
+        new_sg_rules_amount = self._get_sg_rules_amount()
+        self.assertGreater(new_sg_rules_amount, sg_rules_amount)
+
+    @decorators.idempotent_id('3fc39bd6-3132-4e6f-a09c-456fb18d600c')
+    def test_sg_rules_quota_decrease_less_than_created(self):
+        self._create_max_allowed_sg_rules_amount()
+        new_quota = self._decrease_sg_rules_quota()
+        self.assertEqual(self._get_sg_rules_quota(), new_quota)
+
+
 class SecGroupProtocolTest(base.BaseNetworkTest):
 
     protocol_names = base_security_groups.V4_PROTOCOL_NAMES
diff --git a/neutron_tempest_plugin/api/test_security_groups_negative.py b/neutron_tempest_plugin/api/test_security_groups_negative.py
index 24e2289..7efa70e 100644
--- a/neutron_tempest_plugin/api/test_security_groups_negative.py
+++ b/neutron_tempest_plugin/api/test_security_groups_negative.py
@@ -16,6 +16,7 @@
 from neutron_lib import constants
 from neutron_lib.db import constants as db_const
 from tempest.lib.common.utils import data_utils
+from tempest.lib.common.utils import test_utils
 from tempest.lib import decorators
 from tempest.lib import exceptions as lib_exc
 
@@ -170,3 +171,21 @@
         values = [-2, 2147483648, "value"]
         for value in values:
             self.assertRaises(lib_exc.BadRequest, self._set_sg_quota, value)
+
+
+class NegativeSecGroupRulesQuotaTest(
+        test_security_groups.BaseSecGroupRulesQuota):
+
+    credentials = ['primary', 'admin']
+    required_extensions = ['security-group', 'quotas']
+
+    def setUp(self):
+        super(NegativeSecGroupRulesQuotaTest, self).setUp()
+        self.addCleanup(test_utils.call_and_ignore_notfound_exc,
+                        self.admin_client.reset_quotas, self.client.tenant_id)
+        self._set_sg_rules_quota(10)
+
+    @decorators.idempotent_id('8336e6ea-2e0a-4a1a-8673-a6f81b577d57')
+    def test_sg_creation_with_insufficient_sg_rules_quota(self):
+        self._set_sg_rules_quota(0)
+        self.assertRaises(lib_exc.Conflict, self.create_security_group)
diff --git a/neutron_tempest_plugin/api/test_subnetpools.py b/neutron_tempest_plugin/api/test_subnetpools.py
index 9d927cf..38c721f 100644
--- a/neutron_tempest_plugin/api/test_subnetpools.py
+++ b/neutron_tempest_plugin/api/test_subnetpools.py
@@ -12,10 +12,12 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
+import testtools
 
 from tempest.common import utils
 from tempest.lib.common.utils import data_utils
 from tempest.lib import decorators
+from tempest.lib import exceptions as lib_exc
 
 from neutron_tempest_plugin.api import base
 
@@ -418,3 +420,171 @@
         self._test_list_validation_filters(self.list_kwargs)
         self._test_list_validation_filters({
             'unknown_filter': 'value'}, filter_is_valid=False)
+
+
+class RbacSubnetPoolTest(SubnetPoolsTestBase):
+
+    force_tenant_isolation = True
+    credentials = ['primary', 'alt', 'admin']
+    required_extensions = ['rbac-subnetpool']
+
+    @classmethod
+    def resource_setup(cls):
+        super(RbacSubnetPoolTest, cls).resource_setup()
+        cls.client2 = cls.os_alt.network_client
+
+    def _make_admin_snp_shared_to_project_id(self, project_id):
+        snp = self._create_subnetpool(is_admin=True)
+        rbac_policy = self.admin_client.create_rbac_policy(
+            object_type='subnetpool',
+            object_id=snp['id'],
+            action='access_as_shared',
+            target_tenant=project_id,
+        )['rbac_policy']
+        return {'subnetpool': snp, 'rbac_policy': rbac_policy}
+
+    @decorators.idempotent_id('71b35ad0-51cd-40da-985d-89a51c95ec6a')
+    def test_policy_target_update(self):
+        res = self._make_admin_snp_shared_to_project_id(
+            self.client.tenant_id)
+        # change to client2
+        update_res = self.admin_client.update_rbac_policy(
+                res['rbac_policy']['id'], target_tenant=self.client2.tenant_id)
+        self.assertEqual(self.client2.tenant_id,
+                         update_res['rbac_policy']['target_tenant'])
+        # make sure everything else stayed the same
+        res['rbac_policy'].pop('target_tenant')
+        update_res['rbac_policy'].pop('target_tenant')
+        self.assertEqual(res['rbac_policy'], update_res['rbac_policy'])
+
+    @decorators.idempotent_id('451d9d38-65a0-4916-a805-1460d6a938d1')
+    def test_subnet_presence_prevents_rbac_policy_deletion(self):
+        res = self._make_admin_snp_shared_to_project_id(
+            self.client2.tenant_id)
+        network = self.create_network(client=self.client2)
+        subnet = self.client2.create_subnet(
+            network_id=network['id'],
+            ip_version=4,
+            subnetpool_id=res['subnetpool']['id'],
+            name=data_utils.rand_name("rbac-subnetpool"),
+        )["subnet"]
+        self.addCleanup(self.client2.delete_network, network['id'])
+        self.addCleanup(
+            self.admin_client.delete_subnetpool,
+            res['subnetpool']['id']
+        )
+        self.addCleanup(self.client2.delete_subnet, subnet['id'])
+
+        # a port with shared sg should prevent the deletion of an
+        # rbac-policy required for it to be shared
+        with testtools.ExpectedException(lib_exc.Conflict):
+            self.admin_client.delete_rbac_policy(res['rbac_policy']['id'])
+
+    @decorators.idempotent_id('f74a71de-9abf-49c6-8199-4ac7f53e383b')
+    @utils.requires_ext(extension='rbac-address-scope', service='network')
+    def test_cannot_share_if_no_access_to_address_scope(self):
+        # Create Address Scope shared only to client but not to client2
+        a_s = self.admin_client.create_address_scope(
+            name=data_utils.rand_name("rbac-subnetpool"),
+            ip_version=4
+        )["address_scope"]
+        rbac_policy = self.admin_client.create_rbac_policy(
+            object_type='address_scope', object_id=a_s['id'],
+            action='access_as_shared',
+            target_tenant=self.client.tenant_id)['rbac_policy']
+
+        # Create subnet pool owned by client with shared AS
+        snp = self._create_subnetpool(address_scope_id=a_s["id"])
+
+        with testtools.ExpectedException(lib_exc.BadRequest):
+            self.client.create_rbac_policy(
+                object_type='subnetpool', object_id=snp['id'],
+                action='access_as_shared',
+                target_tenant=self.client2.tenant_id
+            )
+
+        # cleanup
+        self.client.delete_subnetpool(snp["id"])
+        self.admin_client.delete_rbac_policy(rbac_policy['id'])
+        self.admin_client.delete_address_scope(a_s['id'])
+
+    @decorators.idempotent_id('9cf8bba5-0163-4083-9397-678bb9b5f5a2')
+    def test_regular_client_shares_to_another_regular_client(self):
+        # owned by self.admin_client
+        snp = self._create_subnetpool(is_admin=True)
+        with testtools.ExpectedException(lib_exc.NotFound):
+            self.client.show_subnetpool(snp['id'])
+        rbac_policy = self.admin_client.create_rbac_policy(
+            object_type='subnetpool', object_id=snp['id'],
+            action='access_as_shared',
+            target_tenant=self.client.tenant_id)['rbac_policy']
+        self.client.show_subnetpool(snp['id'])
+
+        self.assertIn(rbac_policy,
+                      self.admin_client.list_rbac_policies()['rbac_policies'])
+        # ensure that 'client2' can't see the rbac-policy sharing the
+        # as to it because the rbac-policy belongs to 'client'
+        self.assertNotIn(rbac_policy['id'], [p['id'] for p in
+                         self.client2.list_rbac_policies()['rbac_policies']])
+
+    @decorators.idempotent_id('17b2b437-a5fa-4340-ad98-912a986d0d7c')
+    def test_filter_fields(self):
+        snp = self._create_subnetpool()
+        self.admin_client.create_rbac_policy(
+            object_type='subnetpool', object_id=snp['id'],
+            action='access_as_shared', target_tenant=self.client2.tenant_id)
+        field_args = (('id',), ('id', 'action'), ('object_type', 'object_id'),
+                      ('project_id', 'target_tenant'))
+        for fields in field_args:
+            res = self.admin_client.list_rbac_policies(fields=fields)
+            self.assertEqual(set(fields), set(res['rbac_policies'][0].keys()))
+
+    @decorators.idempotent_id('e59e4502-4e6a-4e49-b446-a5d5642bbd69')
+    def test_rbac_policy_show(self):
+        res = self._make_admin_snp_shared_to_project_id(
+            self.client.tenant_id)
+        p1 = res['rbac_policy']
+        p2 = self.admin_client.create_rbac_policy(
+            object_type='subnetpool',
+            object_id=res['subnetpool']['id'],
+            action='access_as_shared',
+            target_tenant='*')['rbac_policy']
+
+        self.assertEqual(
+            p1, self.admin_client.show_rbac_policy(p1['id'])['rbac_policy'])
+        self.assertEqual(
+            p2, self.admin_client.show_rbac_policy(p2['id'])['rbac_policy'])
+
+    @decorators.idempotent_id('1c24c28c-eb1e-466e-af29-255cf127653a')
+    def test_filter_rbac_policies(self):
+        snp = self._create_subnetpool()
+        rbac_pol1 = self.admin_client.create_rbac_policy(
+            object_type='subnetpool', object_id=snp['id'],
+            action='access_as_shared',
+            target_tenant=self.client2.tenant_id)['rbac_policy']
+        rbac_pol2 = self.admin_client.create_rbac_policy(
+            object_type='subnetpool', object_id=snp['id'],
+            action='access_as_shared',
+            target_tenant=self.admin_client.tenant_id)['rbac_policy']
+        res1 = self.admin_client.list_rbac_policies(id=rbac_pol1['id'])[
+            'rbac_policies']
+        res2 = self.admin_client.list_rbac_policies(id=rbac_pol2['id'])[
+            'rbac_policies']
+        self.assertEqual(1, len(res1))
+        self.assertEqual(1, len(res2))
+        self.assertEqual(rbac_pol1['id'], res1[0]['id'])
+        self.assertEqual(rbac_pol2['id'], res2[0]['id'])
+
+    @decorators.idempotent_id('63d9acbe-403c-4e77-9ffd-80e636a4621e')
+    def test_regular_client_blocked_from_sharing_anothers_policy(self):
+        snp = self._make_admin_snp_shared_to_project_id(
+            self.client.tenant_id)['subnetpool']
+        with testtools.ExpectedException(lib_exc.BadRequest):
+            self.client.create_rbac_policy(
+                object_type='subnetpool', object_id=snp['id'],
+                action='access_as_shared',
+                target_tenant=self.client2.tenant_id)
+
+        # make sure the rbac-policy is invisible to the tenant for which it's
+        # being shared
+        self.assertFalse(self.client.list_rbac_policies()['rbac_policies'])
diff --git a/neutron_tempest_plugin/api/test_subnetpools_negative.py b/neutron_tempest_plugin/api/test_subnetpools_negative.py
index 214a012..1e222df 100644
--- a/neutron_tempest_plugin/api/test_subnetpools_negative.py
+++ b/neutron_tempest_plugin/api/test_subnetpools_negative.py
@@ -12,6 +12,7 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
+import testtools
 
 import netaddr
 from oslo_utils import uuidutils
@@ -171,6 +172,10 @@
 
     @decorators.attr(type='negative')
     @decorators.idempotent_id('3396ec6c-cb80-4ebe-b897-84e904580bdf')
+    @testtools.skipIf(
+        utils.is_extension_enabled('rbac-address-scope', 'network'),
+        reason="Test is outdated starting from Ussuri release."
+    )
     @utils.requires_ext(extension='address-scope', service='network')
     def test_tenant_create_subnetpool_associate_shared_address_scope(self):
         address_scope = self.create_address_scope(
diff --git a/neutron_tempest_plugin/api/test_trunk.py b/neutron_tempest_plugin/api/test_trunk.py
index 823a95d..1f83bd8 100644
--- a/neutron_tempest_plugin/api/test_trunk.py
+++ b/neutron_tempest_plugin/api/test_trunk.py
@@ -235,7 +235,9 @@
                               'segmentation_id': segmentation_id2}]
 
         # Validate that subport got segmentation details from the network
-        self.assertEqual(expected_subports, trunk['sub_ports'])
+        self.assertEqual(
+            sorted(expected_subports, key=lambda subport: subport['port_id']),
+            sorted(trunk['sub_ports'], key=lambda subport: subport['port_id']))
 
 
 class TrunkTestMtusJSONBase(TrunkTestJSONBase):
diff --git a/neutron_tempest_plugin/common/utils.py b/neutron_tempest_plugin/common/utils.py
index c8ff194..34e7464 100644
--- a/neutron_tempest_plugin/common/utils.py
+++ b/neutron_tempest_plugin/common/utils.py
@@ -117,6 +117,14 @@
         pass
 
 
+def process_is_running(ssh_client, process_name):
+    try:
+        ssh_client.exec_command("pidof %s" % process_name)
+        return True
+    except exceptions.SSHExecCommandFailed:
+        return False
+
+
 def spawn_http_server(ssh_client, port, message):
     cmd = ("(echo -e 'HTTP/1.1 200 OK\r\n'; echo '%(msg)s') "
            "| sudo nc -lp %(port)d &" % {'msg': message, 'port': port})
diff --git a/neutron_tempest_plugin/config.py b/neutron_tempest_plugin/config.py
index 28d6b76..2290d0f 100644
--- a/neutron_tempest_plugin/config.py
+++ b/neutron_tempest_plugin/config.py
@@ -60,6 +60,10 @@
     cfg.IntOpt('max_mtu',
                default=1500,
                help='Max mtu value of default deployments".'),
+    cfg.StrOpt('global_ip_address',
+               default='',
+               help='An IP address in the Internet that can be used in '
+                    'a connectivity test'),
     cfg.StrOpt('q_agent',
                default=None,
                choices=['None', 'linuxbridge', 'ovs', 'sriov'],
diff --git a/neutron_tempest_plugin/fwaas/common/fwaas_v2_client.py b/neutron_tempest_plugin/fwaas/common/fwaas_v2_client.py
index 44b0952..84d6432 100644
--- a/neutron_tempest_plugin/fwaas/common/fwaas_v2_client.py
+++ b/neutron_tempest_plugin/fwaas/common/fwaas_v2_client.py
@@ -121,6 +121,11 @@
             firewall_rule_id=firewall_rule_id)
         self._wait_firewall_group_ready(firewall_group_id)
 
+    def update_firewall_group_and_wait(self, firewall_group_id, **kwargs):
+        self.firewall_groups_client.update_firewall_group(
+            firewall_group_id, **kwargs)
+        self._wait_firewall_group_ready(firewall_group_id)
+
     @staticmethod
     def _call_and_ignore_exceptions(exc_list, func, *args, **kwargs):
         """Call the given function and pass if a given exception is raised."""
diff --git a/neutron_tempest_plugin/fwaas/scenario/test_fwaas_v2.py b/neutron_tempest_plugin/fwaas/scenario/test_fwaas_v2.py
index e9dad0b..4681b88 100644
--- a/neutron_tempest_plugin/fwaas/scenario/test_fwaas_v2.py
+++ b/neutron_tempest_plugin/fwaas/scenario/test_fwaas_v2.py
@@ -299,5 +299,4 @@
             should_connect=False)
 
         # Disassociate ports of this firewall group for cleanup resources
-        self.firewall_groups_client.update_firewall_group(
-            fw_group['id'], ports=[])
+        self.update_firewall_group_and_wait(fw_group['id'], ports=[])
diff --git a/neutron_tempest_plugin/scenario/base.py b/neutron_tempest_plugin/scenario/base.py
index 7b66494..f7e7ec8 100644
--- a/neutron_tempest_plugin/scenario/base.py
+++ b/neutron_tempest_plugin/scenario/base.py
@@ -31,6 +31,7 @@
 from neutron_tempest_plugin.common import ip as ip_utils
 from neutron_tempest_plugin.common import shell
 from neutron_tempest_plugin.common import ssh
+from neutron_tempest_plugin.common import utils
 from neutron_tempest_plugin import config
 from neutron_tempest_plugin import exceptions
 from neutron_tempest_plugin.scenario import constants
@@ -53,16 +54,19 @@
     return distutils.version.StrictVersion(m.group(1) if m else '7.60')
 
 
-def get_ncat_server_cmd(port, protocol, msg):
+def get_ncat_server_cmd(port, protocol, msg=None):
     udp = ''
     if protocol.lower() == neutron_lib_constants.PROTO_NAME_UDP:
         udp = '-u'
     cmd = "nc %(udp)s -p %(port)s -lk " % {
         'udp': udp, 'port': port}
-    if CONF.neutron_plugin_options.default_image_is_advanced:
-        cmd += "-c 'echo %s' &" % msg
+    if msg:
+        if CONF.neutron_plugin_options.default_image_is_advanced:
+            cmd += "-c 'echo %s' &" % msg
+        else:
+            cmd += "-e echo %s &" % msg
     else:
-        cmd += "-e echo %s &" % msg
+        cmd += "< /dev/zero &"
     return cmd
 
 
@@ -273,6 +277,11 @@
             servers = self.os_primary.servers_client.list_servers()
             servers = servers['servers']
         for server in servers:
+            # NOTE(slaweq): sometimes servers are passed in dictionary with
+            # "server" key as first level key and in other cases it may be that
+            # it is just the "inner" dict without "server" key. Lets try to
+            # handle both cases
+            server = server.get("server") or server
             try:
                 console_output = (
                     self.os_primary.servers_client.get_console_output(
@@ -327,7 +336,7 @@
                     mtu=mtu, ip_version=ip_version))
             if pattern:
                 cmd += ' -p {pattern}'.format(pattern=pattern)
-            cmd += ' -c{0} -w{0} -s{1} {2}'.format(count, size, host)
+            cmd += ' -c{0} -W{0} -s{1} {2}'.format(count, size, host)
             return source.exec_command(cmd)
 
         def ping_remote():
@@ -463,7 +472,20 @@
                 self._log_console_output(servers)
             raise
 
-    def nc_listen(self, server, ssh_client, port, protocol, echo_msg):
+    def ensure_nc_listen(self, ssh_client, port, protocol, echo_msg=None,
+                         servers=None):
+        """Ensure that nc server listening on the given TCP/UDP port is up.
+
+        Listener is created always on remote host.
+        """
+        def spawn_and_check_process():
+            self.nc_listen(ssh_client, port, protocol, echo_msg, servers)
+            return utils.process_is_running(ssh_client, "nc")
+
+        utils.wait_until_true(spawn_and_check_process)
+
+    def nc_listen(self, ssh_client, port, protocol, echo_msg=None,
+                  servers=None):
         """Create nc server listening on the given TCP/UDP port.
 
         Listener is created always on remote host.
@@ -474,7 +496,7 @@
                 become_root=True)
         except lib_exc.SSHTimeout as ssh_e:
             LOG.debug(ssh_e)
-            self._log_console_output([server])
+            self._log_console_output(servers)
             raise
 
     def nc_client(self, ip_address, port, protocol):
diff --git a/neutron_tempest_plugin/scenario/test_basic.py b/neutron_tempest_plugin/scenario/test_basic.py
index d825e15..38bc40b 100644
--- a/neutron_tempest_plugin/scenario/test_basic.py
+++ b/neutron_tempest_plugin/scenario/test_basic.py
@@ -12,8 +12,11 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
+import testtools
+
 from tempest.lib import decorators
 
+from neutron_tempest_plugin.common import ssh
 from neutron_tempest_plugin import config
 from neutron_tempest_plugin.scenario import base
 
@@ -33,3 +36,17 @@
         self.check_connectivity(self.fip['floating_ip_address'],
                                 CONF.validation.image_ssh_user,
                                 self.keypair['private_key'])
+
+    @testtools.skipUnless(
+        CONF.neutron_plugin_options.global_ip_address,
+        'Global IP address is not defined.')
+    @decorators.idempotent_id('49609189-3a0e-43c7-832e-a7e114aad1c9')
+    def test_ping_global_ip_from_vm_with_fip(self):
+        self.setup_network_and_server()
+        server_ssh_client = ssh.Client(self.fip['floating_ip_address'],
+                                       CONF.validation.image_ssh_user,
+                                       pkey=self.keypair['private_key'])
+        self.check_remote_connectivity(
+            server_ssh_client,
+            CONF.neutron_plugin_options.global_ip_address,
+            ping_count=1)
diff --git a/neutron_tempest_plugin/scenario/test_floatingip.py b/neutron_tempest_plugin/scenario/test_floatingip.py
index 37df5be..2a137b5 100644
--- a/neutron_tempest_plugin/scenario/test_floatingip.py
+++ b/neutron_tempest_plugin/scenario/test_floatingip.py
@@ -25,6 +25,7 @@
 from tempest.lib import exceptions
 import testscenarios
 from testscenarios.scenarios import multiply_scenarios
+import testtools
 
 from neutron_tempest_plugin.api import base as base_api
 from neutron_tempest_plugin.common import ssh
@@ -378,7 +379,6 @@
             self.fip['id'])['floatingip']
         self.assertEqual(policy_id, fip['qos_policy_id'])
 
-        self._create_file_for_bw_tests(ssh_client)
         common_utils.wait_until_true(lambda: self._check_bw(
             ssh_client,
             self.fip['floating_ip_address'],
@@ -441,3 +441,124 @@
             self.fail(
                 "Server %s is not accessible via its floating ip %s" % (
                     servers[-1]['id'], self.fip['id']))
+
+
+class FloatingIpMultipleRoutersTest(base.BaseTempestTestCase):
+    credentials = ['primary', 'admin']
+
+    @classmethod
+    @utils.requires_ext(extension="router", service="network")
+    def skip_checks(cls):
+        super(FloatingIpMultipleRoutersTest, cls).skip_checks()
+
+    def _create_keypair_and_secgroup(self):
+        self.keypair = self.create_keypair()
+        self.secgroup = self.create_security_group()
+        self.create_loginable_secgroup_rule(
+            secgroup_id=self.secgroup['id'])
+        self.create_pingable_secgroup_rule(
+            secgroup_id=self.secgroup['id'])
+
+    def _create_network_and_servers(self, servers_num=1, fip_addresses=None):
+        if fip_addresses:
+            self.assertEqual(servers_num, len(fip_addresses),
+                             ('Number of specified fip addresses '
+                              'does not match the number of servers'))
+        network = self.create_network()
+        subnet = self.create_subnet(network)
+        router = self.create_router_by_client()
+        self.create_router_interface(router['id'], subnet['id'])
+
+        fips = []
+        for server in range(servers_num):
+            fip = fip_addresses[server] if fip_addresses else None
+            fips.append(
+                self._create_server_and_fip(
+                    network=network, fip_address=fip))
+        return fips
+
+    def _create_server_and_fip(self, network, fip_address=None):
+        server = self.create_server(
+            flavor_ref=CONF.compute.flavor_ref,
+            image_ref=CONF.compute.image_ref,
+            key_name=self.keypair['name'],
+            networks=[{'uuid': network['id']}],
+            security_groups=[{'name': self.secgroup['name']}])
+        waiters.wait_for_server_status(self.os_primary.servers_client,
+                                       server['server']['id'],
+                                       constants.SERVER_STATUS_ACTIVE)
+        port = self.client.list_ports(
+            network_id=network['id'],
+            device_id=server['server']['id'])['ports'][0]
+
+        if fip_address:
+            fip = self.create_floatingip(
+                floating_ip_address=fip_address,
+                client=self.os_admin.network_client,
+                port=port)
+            self.addCleanup(
+                self.delete_floatingip, fip, self.os_admin.network_client)
+        else:
+            fip = self.create_floatingip(port=port)
+        return fip
+
+    def _check_fips_connectivity(self, mutable_fip, permanent_fip):
+        for fip in [mutable_fip, permanent_fip]:
+            fip['ssh_client'] = ssh.Client(fip['floating_ip_address'],
+                                           CONF.validation.image_ssh_user,
+                                           pkey=self.keypair['private_key'])
+        self.check_remote_connectivity(
+            permanent_fip['ssh_client'], mutable_fip['floating_ip_address'])
+        self.check_remote_connectivity(
+            mutable_fip['ssh_client'], permanent_fip['floating_ip_address'])
+
+    @testtools.skipUnless(CONF.network.public_network_id,
+                          'The public_network_id option must be specified.')
+    @decorators.idempotent_id('b0382ab3-3c86-4415-84e3-649a8b040dab')
+    def test_reuse_ip_address_with_other_fip_on_other_router(self):
+        """Reuse IP address by another floating IP on another router
+
+        Scenario:
+            1. Create and connect a router to the external network.
+            2. Create and connect an internal network to the router.
+            3. Create and connect 2 VMs to the internal network.
+            4. Create FIPs in the external network for the VMs.
+            5. Make sure that VM1 can ping VM2 FIP address.
+            6. Delete VM2 FIP but save IP address that it used.
+            7. Create and connect one more router to the external network.
+            8. Create and connect an internal network to the second router.
+            9. Create and connect a VM (VM3) to the internal network of
+               the second router.
+            10. Create a FIP for the VM3 in the external network with
+               the same IP address that was used for VM2.
+            11. Make sure that now VM1 is able to reach VM3 using the FIP.
+
+        Note, the scenario passes only in case corresponding
+        ARP update was sent to the external network when reusing same IP
+        address for another FIP.
+        """
+
+        self._create_keypair_and_secgroup()
+        [mutable_fip, permanent_fip] = (
+            self._create_network_and_servers(servers_num=2))
+        self._check_fips_connectivity(mutable_fip, permanent_fip)
+        ip_address = mutable_fip['floating_ip_address']
+        self.delete_floatingip(mutable_fip)
+
+        def _fip_is_free():
+            fips = self.os_admin.network_client.list_floatingips(
+                    )['floatingips']
+            for fip in fips:
+                if ip_address == fip['floating_ip_address']:
+                    return False
+            return True
+
+        try:
+            common_utils.wait_until_true(lambda: _fip_is_free(),
+                                         timeout=30, sleep=5)
+        except common_utils.WaitTimeout:
+            self.fail("Can't reuse IP address because it is not free")
+
+        [mutable_fip] = self._create_network_and_servers(
+            servers_num=1, fip_addresses=[ip_address])
+        self._check_fips_connectivity(mutable_fip, permanent_fip)
diff --git a/neutron_tempest_plugin/scenario/test_multicast.py b/neutron_tempest_plugin/scenario/test_multicast.py
index 566ac95..b2ea8ae 100644
--- a/neutron_tempest_plugin/scenario/test_multicast.py
+++ b/neutron_tempest_plugin/scenario/test_multicast.py
@@ -224,7 +224,7 @@
             message=self.multicast_message,
             result_file=self.sender_output_file)
         server['ssh_client'].execute_script(
-            'echo "%s" > ~/multicast_traffic_sender.py' % check_script)
+            'echo "%s" > /tmp/multicast_traffic_sender.py' % check_script)
 
     def _prepare_receiver(self, server, mcast_address):
         check_script = get_receiver_script(
@@ -238,7 +238,7 @@
         self._check_cmd_installed_on_server(ssh_client, server['id'],
                                             PYTHON3_BIN)
         server['ssh_client'].execute_script(
-            'echo "%s" > ~/multicast_traffic_receiver.py' % check_script)
+            'echo "%s" > /tmp/multicast_traffic_receiver.py' % check_script)
 
     def _prepare_unregistered(self, server, mcast_address):
         check_script = get_unregistered_script(
@@ -250,7 +250,7 @@
         self._check_cmd_installed_on_server(ssh_client, server['id'],
                                             'tcpdump')
         server['ssh_client'].execute_script(
-            'echo "%s" > ~/unregistered_traffic_receiver.sh' % check_script)
+            'echo "%s" > /tmp/unregistered_traffic_receiver.sh' % check_script)
 
     @test.unstable_test("bug 1850288")
     @decorators.idempotent_id('113486fc-24c9-4be4-8361-03b1c9892867')
@@ -259,6 +259,8 @@
 
         [Sender server] -> (Multicast network) -> [Receiver server]
         """
+        LOG.debug("IGMP snooping enabled: %s",
+                  CONF.neutron_plugin_options.is_igmp_snooping_enabled)
         sender = self._create_server()
         receivers = [self._create_server() for _ in range(1)]
         # Sender can be also receiver of multicast traffic
@@ -279,7 +281,7 @@
 
         [0] https://tools.ietf.org/html/rfc4541 (See section 2.1.2)
         """
-        return (mcast_address.startswith('224.0.0') or not
+        return (str(mcast_address).startswith('224.0.0') or not
                 CONF.neutron_plugin_options.is_igmp_snooping_enabled)
 
     def _check_multicast_conectivity(self, sender, receivers, unregistered):
@@ -300,14 +302,14 @@
 
         # Run the unregistered node script
         unregistered['ssh_client'].execute_script(
-            "bash ~/unregistered_traffic_receiver.sh", become_root=True)
+            "bash /tmp/unregistered_traffic_receiver.sh", become_root=True)
 
         self._prepare_sender(sender, mcast_address)
         receiver_ids = []
         for receiver in receivers:
             self._prepare_receiver(receiver, mcast_address)
             receiver['ssh_client'].execute_script(
-                "%s ~/multicast_traffic_receiver.py &" % PYTHON3_BIN,
+                "%s /tmp/multicast_traffic_receiver.py &" % PYTHON3_BIN,
                 shell="bash")
             utils.wait_until_true(
                 lambda: _message_received(
@@ -321,7 +323,7 @@
 
         # Now lets run scripts on sender
         sender['ssh_client'].execute_script(
-            "%s ~/multicast_traffic_sender.py" % PYTHON3_BIN)
+            "%s /tmp/multicast_traffic_sender.py" % PYTHON3_BIN)
 
         # And check if message was received
         for receiver in receivers:
@@ -348,9 +350,11 @@
         unregistered_result = unregistered['ssh_client'].execute_script(
             "cat {path} || echo '{path} not exists yet'".format(
                 path=self.unregistered_output_file))
-        num_of_pckt = (1 if self._is_multicast_traffic_expected(mcast_address)
-                       else 0)
-        self.assertIn('%d packets captured' % num_of_pckt, unregistered_result)
+        LOG.debug("Unregistered VM result: %s", unregistered_result)
+        expected_result = '0 packets captured'
+        if self._is_multicast_traffic_expected(mcast_address):
+            expected_result = '1 packet captured'
+        self.assertIn(expected_result, unregistered_result)
 
 
 class MulticastTestIPv4(BaseMulticastTest, base.BaseTempestTestCase):
diff --git a/neutron_tempest_plugin/scenario/test_port_forwardings.py b/neutron_tempest_plugin/scenario/test_port_forwardings.py
index 2d77b65..ab04050 100644
--- a/neutron_tempest_plugin/scenario/test_port_forwardings.py
+++ b/neutron_tempest_plugin/scenario/test_port_forwardings.py
@@ -83,11 +83,11 @@
     def _test_udp_port_forwarding(self, servers):
 
         def _message_received(server, ssh_client, expected_msg):
-            self.nc_listen(server,
-                           ssh_client,
+            self.nc_listen(ssh_client,
                            server['port_forwarding_udp']['internal_port'],
                            constants.PROTO_NAME_UDP,
-                           expected_msg)
+                           expected_msg,
+                           [server])
             received_msg = self.nc_client(
                 self.fip['floating_ip_address'],
                 server['port_forwarding_udp']['external_port'],
diff --git a/neutron_tempest_plugin/scenario/test_qos.py b/neutron_tempest_plugin/scenario/test_qos.py
index f8f1b03..938d2b0 100644
--- a/neutron_tempest_plugin/scenario/test_qos.py
+++ b/neutron_tempest_plugin/scenario/test_qos.py
@@ -19,6 +19,7 @@
 from neutron_lib.services.qos import constants as qos_consts
 from oslo_log import log as logging
 from tempest.common import utils as tutils
+from tempest.common import waiters
 from tempest.lib import decorators
 
 from neutron_tempest_plugin.api import base as base_api
@@ -69,41 +70,26 @@
     credentials = ['primary', 'admin']
     force_tenant_isolation = False
 
-    FILE_SIZE = 1024 * 1024
     TOLERANCE_FACTOR = 1.5
     BUFFER_SIZE = 512
-    COUNT = FILE_SIZE / BUFFER_SIZE
     LIMIT_BYTES_SEC = (constants.LIMIT_KILO_BITS_PER_SECOND * 1024 *
                        TOLERANCE_FACTOR / 8.0)
-    FILE_PATH = "/tmp/img"
-
     NC_PORT = 1234
-    FILE_DOWNLOAD_TIMEOUT = 120
-
-    def _create_file_for_bw_tests(self, ssh_client):
-        cmd = ("(dd if=/dev/zero bs=%(bs)d count=%(count)d of=%(file_path)s) "
-               % {'bs': self.BUFFER_SIZE, 'count': self.COUNT,
-               'file_path': self.FILE_PATH})
-        ssh_client.exec_command(cmd, timeout=5)
-        cmd = "stat -c %%s %s" % self.FILE_PATH
-        filesize = ssh_client.exec_command(cmd, timeout=5)
-        if int(filesize.strip()) != self.FILE_SIZE:
-            raise sc_exceptions.FileCreationFailedException(
-                file=self.FILE_PATH)
+    DOWNLOAD_DURATION = 5
+    # NOTE(mjozefcz): This makes around 10 retries.
+    CHECK_TIMEOUT = DOWNLOAD_DURATION * 10
 
     def _check_bw(self, ssh_client, host, port, expected_bw=LIMIT_BYTES_SEC):
         utils.kill_nc_process(ssh_client)
-        cmd = ("(nc -ll -p %(port)d < %(file_path)s > /dev/null &)" % {
-                'port': port, 'file_path': self.FILE_PATH})
-        ssh_client.exec_command(cmd, timeout=5)
+        self.ensure_nc_listen(ssh_client, port, "tcp")
 
         # Open TCP socket to remote VM and download big file
         start_time = time.time()
-        socket_timeout = self.FILE_SIZE * self.TOLERANCE_FACTOR / expected_bw
-        client_socket = _connect_socket(host, port, socket_timeout)
+        client_socket = _connect_socket(
+            host, port, constants.SOCKET_CONNECT_TIMEOUT)
         total_bytes_read = 0
         try:
-            while total_bytes_read < self.FILE_SIZE:
+            while time.time() - start_time < self.DOWNLOAD_DURATION:
                 data = client_socket.recv(self.BUFFER_SIZE)
                 total_bytes_read += len(data)
 
@@ -113,10 +99,12 @@
 
             LOG.debug("time_elapsed = %(time_elapsed).16f, "
                       "total_bytes_read = %(total_bytes_read)d, "
-                      "bytes_per_second = %(bytes_per_second)d",
+                      "bytes_per_second = %(bytes_per_second)d, "
+                      "expected_bw = %(expected_bw)d.",
                       {'time_elapsed': time_elapsed,
                        'total_bytes_read': total_bytes_read,
-                       'bytes_per_second': bytes_per_second})
+                       'bytes_per_second': bytes_per_second,
+                       'expected_bw': expected_bw})
             return bytes_per_second <= expected_bw
         except socket.timeout:
             LOG.warning('Socket timeout while reading the remote file, bytes '
@@ -151,6 +139,47 @@
                                         shared=True)
         return policy['policy']['id']
 
+    def _create_server_by_port(self, port=None):
+        """Launch an instance using a port interface;
+
+        In case that the given port is None, a new port is created,
+        activated and configured with inbound SSH and TCP connection.
+        """
+        # Create and activate the port that will be assign to the instance.
+        if port is None:
+            secgroup = self.create_security_group()
+            self.create_loginable_secgroup_rule(
+                secgroup_id=secgroup['id'])
+
+            secgroup_rules = [{'protocol': 'tcp',
+                               'direction': 'ingress',
+                               'port_range_min': self.NC_PORT,
+                               'port_range_max': self.NC_PORT,
+                               'remote_ip_prefix': '0.0.0.0/0'}]
+
+            self.create_secgroup_rules(secgroup_rules,
+                                       secgroup['id'])
+
+            port = self.create_port(self.network,
+                                    security_groups=[secgroup['id']])
+            self.fip = self.create_floatingip(port=port)
+
+        keypair = self.create_keypair()
+
+        server_kwargs = {
+            'flavor_ref': CONF.compute.flavor_ref,
+            'image_ref': CONF.compute.image_ref,
+            'key_name': keypair['name'],
+            'networks': [{'port': port['id']}],
+        }
+
+        server = self.create_server(**server_kwargs)
+        self.wait_for_server_active(server['server'])
+        self.check_connectivity(self.fip['floating_ip_address'],
+                                CONF.validation.image_ssh_user,
+                                keypair['private_key'])
+        return server, port
+
 
 class QoSTest(QoSTestMixin, base.BaseTempestTestCase):
     @classmethod
@@ -207,16 +236,13 @@
         self.os_admin.network_client.update_network(
             self.network['id'], qos_policy_id=bw_limit_policy_id)
 
-        # Create file on VM
-        self._create_file_for_bw_tests(ssh_client)
-
         # Basic test, Check that actual BW while downloading file
         # is as expected (Original BW)
         utils.wait_until_true(lambda: self._check_bw(
             ssh_client,
             self.fip['floating_ip_address'],
             port=self.NC_PORT),
-            timeout=self.FILE_DOWNLOAD_TIMEOUT,
+            timeout=self.CHECK_TIMEOUT,
             sleep=1)
 
         # As admin user update QoS rule
@@ -233,7 +259,7 @@
             self.fip['floating_ip_address'],
             port=self.NC_PORT,
             expected_bw=QoSTest.LIMIT_BYTES_SEC * 2),
-            timeout=self.FILE_DOWNLOAD_TIMEOUT,
+            timeout=self.CHECK_TIMEOUT,
             sleep=1)
 
         # Create a new QoS policy
@@ -256,7 +282,7 @@
             ssh_client,
             self.fip['floating_ip_address'],
             port=self.NC_PORT),
-            timeout=self.FILE_DOWNLOAD_TIMEOUT,
+            timeout=self.CHECK_TIMEOUT,
             sleep=1)
 
         # As admin user update QoS rule
@@ -271,6 +297,98 @@
         utils.wait_until_true(lambda: self._check_bw(
             ssh_client,
             self.fip['floating_ip_address'],
-            port=self.NC_PORT, expected_bw=QoSTest.LIMIT_BYTES_SEC * 3),
-            timeout=self.FILE_DOWNLOAD_TIMEOUT,
+            port=self.NC_PORT,
+            expected_bw=QoSTest.LIMIT_BYTES_SEC * 3),
+            timeout=self.CHECK_TIMEOUT,
             sleep=1)
+
+    @decorators.idempotent_id('66e5673e-0522-11ea-8d71-362b9e155667')
+    def test_attach_previously_used_port_to_new_instance(self):
+        """The test spawns new instance using port with QoS policy.
+
+        Ports with attached QoS policy could be used multiple times.
+        The policy rules have to be enforced on the new machines.
+        """
+        self.network = self.create_network()
+        self.subnet = self.create_subnet(self.network)
+        self.router = self.create_router_by_client()
+        self.create_router_interface(self.router['id'], self.subnet['id'])
+
+        vm, vm_port = self._create_server_by_port()
+
+        port_policy = self.os_admin.network_client.create_qos_policy(
+            name='port-policy',
+            description='policy for attach',
+            shared=False)['policy']
+
+        rule = self.os_admin.network_client.create_bandwidth_limit_rule(
+            policy_id=port_policy['id'],
+            max_kbps=constants.LIMIT_KILO_BITS_PER_SECOND,
+            max_burst_kbps=constants.LIMIT_KILO_BITS_PER_SECOND)[
+                    'bandwidth_limit_rule']
+
+        self.os_admin.network_client.update_port(
+            vm_port['id'], qos_policy_id=port_policy['id'])
+
+        self.os_primary.servers_client.delete_server(vm['server']['id'])
+        waiters.wait_for_server_termination(
+            self.os_primary.servers_client,
+            vm['server']['id'])
+
+        # Launch a new server using the same port with attached policy
+        self._create_server_by_port(port=vm_port)
+
+        retrieved_port = self.os_admin.network_client.show_port(
+            vm_port['id'])
+        self.assertEqual(port_policy['id'],
+                         retrieved_port['port']['qos_policy_id'],
+                         """The expected policy ID is {0},
+                         the actual value is {1}""".
+                         format(port_policy['id'],
+                                retrieved_port['port']['qos_policy_id']))
+
+        retrieved_policy = self.os_admin.network_client.show_qos_policy(
+                           retrieved_port['port']['qos_policy_id'])
+
+        retrieved_rule_id = retrieved_policy['policy']['rules'][0]['id']
+        self.assertEqual(rule['id'],
+                         retrieved_rule_id,
+                         """The expected rule ID is {0},
+                         the actual value is {1}""".
+                         format(rule['id'], retrieved_rule_id))
+
+    @decorators.idempotent_id('4eee64da-5646-11ea-82b4-0242ac130003')
+    def test_create_instance_using_network_with_existing_policy(self):
+        network = self.create_network()
+
+        qos_policy = self.os_admin.network_client.create_qos_policy(
+            name='network-policy',
+            shared=False)['policy']
+
+        rule = self.os_admin.network_client.create_bandwidth_limit_rule(
+            policy_id=qos_policy['id'],
+            max_kbps=constants.LIMIT_KILO_BITS_PER_SECOND,
+            max_burst_kbps=constants.LIMIT_KILO_BITS_PER_SECOND)
+
+        network = self.os_admin.network_client.update_network(
+                  network['id'],
+                  qos_policy_id=qos_policy['id'])['network']
+        self.setup_network_and_server(network=network)
+        retrieved_net = self.client.show_network(network['id'])
+        self.assertEqual(qos_policy['id'],
+                         retrieved_net['network']['qos_policy_id'],
+                         """The expected policy ID is {0},
+                         the actual value is {1}""".
+                         format(qos_policy['id'],
+                                retrieved_net['network']['qos_policy_id']))
+
+        retrieved_policy = self.os_admin.network_client.show_qos_policy(
+                           retrieved_net['network']['qos_policy_id'])
+        retrieved_rule_id = retrieved_policy['policy']['rules'][0]['id']
+
+        self.assertEqual(rule['bandwidth_limit_rule']['id'],
+                         retrieved_rule_id,
+                         """The expected rule ID is {0},
+                         the actual value is {1}""".
+                         format(rule['bandwidth_limit_rule']['id'],
+                                retrieved_rule_id))
diff --git a/neutron_tempest_plugin/scenario/test_trunk.py b/neutron_tempest_plugin/scenario/test_trunk.py
index 7fd6c52..585af06 100644
--- a/neutron_tempest_plugin/scenario/test_trunk.py
+++ b/neutron_tempest_plugin/scenario/test_trunk.py
@@ -39,7 +39,7 @@
 
 
 class TrunkTest(base.BaseTempestTestCase):
-    credentials = ['primary']
+    credentials = ['primary', 'admin']
     force_tenant_isolation = False
 
     @classmethod
@@ -279,12 +279,73 @@
             should_succeed=False)
 
         # allow intra-security-group traffic
-        self.create_pingable_secgroup_rule(self.security_group['id'])
+        sg_rule = self.create_pingable_secgroup_rule(self.security_group['id'])
+        self.addCleanup(
+                self.os_primary.network_client.delete_security_group_rule,
+                sg_rule['id'])
         self.check_remote_connectivity(
             vm1.ssh_client,
             vm2.subport['fixed_ips'][0]['ip_address'],
             servers=[vm1, vm2])
 
+    @testtools.skipUnless(CONF.compute_feature_enabled.cold_migration,
+                          'Cold migration is not available.')
+    @testtools.skipUnless(CONF.compute.min_compute_nodes > 1,
+                          'Less than 2 compute nodes, skipping multinode '
+                          'tests.')
+    @testtools.skipUnless(
+        (CONF.neutron_plugin_options.advanced_image_ref or
+         CONF.neutron_plugin_options.default_image_is_advanced),
+        "Advanced image is required to run this test.")
+    @decorators.attr(type='slow')
+    @decorators.idempotent_id('ecd7de30-1c90-4280-b97c-1bed776d5d07')
+    def test_trunk_vm_migration(self):
+        '''Test connectivity after migration of the server with trunk
+
+        A successfully migrated server shows a VERIFY_RESIZE status that
+        requires confirmation. Need to reconfigure VLAN interface on server
+        side after migration is finished as the configuration doesn't survive
+        the reboot.
+        '''
+        vlan_tag = 10
+        vlan_network = self.create_network()
+        vlan_subnet = self.create_subnet(vlan_network)
+        sg_rule = self.create_pingable_secgroup_rule(self.security_group['id'])
+        self.addCleanup(
+                self.os_primary.network_client.delete_security_group_rule,
+                sg_rule['id'])
+
+        use_advanced_image = (
+            not CONF.neutron_plugin_options.default_image_is_advanced)
+        servers = {}
+        for role in ['migrate', 'connection_test']:
+            servers[role] = self._create_server_with_trunk_port(
+                                subport_network=vlan_network,
+                                segmentation_id=vlan_tag,
+                                use_advanced_image=use_advanced_image)
+        for role in ['migrate', 'connection_test']:
+            self.wait_for_server_active(servers[role].server)
+            self._configure_vlan_subport(vm=servers[role],
+                                         vlan_tag=vlan_tag,
+                                         vlan_subnet=vlan_subnet)
+
+        self.check_remote_connectivity(
+                servers['connection_test'].ssh_client,
+                servers['migrate'].subport['fixed_ips'][0]['ip_address'])
+
+        client = self.os_admin.compute.ServersClient()
+        client.migrate_server(servers['migrate'].server['id'])
+        self.wait_for_server_status(servers['migrate'].server,
+                                    'VERIFY_RESIZE')
+        client.confirm_resize_server(servers['migrate'].server['id'])
+        self._configure_vlan_subport(vm=servers['migrate'],
+                                     vlan_tag=vlan_tag,
+                                     vlan_subnet=vlan_subnet)
+
+        self.check_remote_connectivity(
+                servers['connection_test'].ssh_client,
+                servers['migrate'].subport['fixed_ips'][0]['ip_address'])
+
     @testtools.skipUnless(
         (CONF.neutron_plugin_options.advanced_image_ref or
          CONF.neutron_plugin_options.default_image_is_advanced),
@@ -318,7 +379,10 @@
             self.wait_for_server_active(vm.server)
 
         # allow ICMP traffic
-        self.create_pingable_secgroup_rule(self.security_group['id'])
+        sg_rule = self.create_pingable_secgroup_rule(self.security_group['id'])
+        self.addCleanup(
+                self.os_primary.network_client.delete_security_group_rule,
+                sg_rule['id'])
 
         # Ping from trunk_network_server to normal_network_server
         # via parent port
diff --git a/neutron_tempest_plugin/services/network/json/network_client.py b/neutron_tempest_plugin/services/network/json/network_client.py
index ddb6f95..f056c7f 100644
--- a/neutron_tempest_plugin/services/network/json/network_client.py
+++ b/neutron_tempest_plugin/services/network/json/network_client.py
@@ -951,6 +951,17 @@
         body = jsonutils.loads(body)
         return service_client.ResponseBody(resp, body)
 
+    def list_floatingips(self, **kwargs):
+        post_body = {'floatingips': kwargs}
+        body = jsonutils.dumps(post_body)
+        uri = '%s/floatingips' % self.uri_prefix
+        if kwargs:
+            uri += '?' + urlparse.urlencode(kwargs, doseq=1)
+        resp, body = self.get(uri)
+        self.expected_success(200, resp.status)
+        body = jsonutils.loads(body)
+        return service_client.ResponseBody(resp, body)
+
     def create_floatingip(self, floating_network_id, **kwargs):
         post_body = {'floatingip': {
             'floating_network_id': floating_network_id}}
diff --git a/requirements.txt b/requirements.txt
index d3fa3eb..3edf7dc 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -15,6 +15,7 @@
 tempest>=17.1.0 # Apache-2.0
 tenacity>=3.2.1 # Apache-2.0
 ddt>=1.0.1 # MIT
+nose>=1.3.7 # LGPL
 testtools>=2.2.0 # MIT
 testscenarios>=0.4 # Apache-2.0/BSD
 eventlet!=0.18.3,!=0.20.1,>=0.18.2 # MIT
diff --git a/setup.cfg b/setup.cfg
index 1ac729c..544ea90 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -6,7 +6,7 @@
 author = OpenStack
 author-email = openstack-discuss@lists.openstack.org
 home-page = https://opendev.org/openstack/neutron-tempest-plugin
-requires-python = >=3.6
+python-requires = >=3.6
 classifier =
     Environment :: OpenStack
     Intended Audience :: Information Technology
@@ -21,29 +21,6 @@
 packages =
     neutron_tempest_plugin
 
-[build_sphinx]
-all-files = 1
-warning-is-error = 1
-source-dir = doc/source
-build-dir = doc/build
-
-[upload_sphinx]
-upload-dir = doc/build/html
-
-[compile_catalog]
-directory = neutron_tempest_plugin/locale
-domain = neutron-tempest-plugin
-
-[update_catalog]
-domain = neutron-tempest-plugin
-output_dir = neutron_tempest_plugin/locale
-input_file = neutron_tempest_plugin/locale/neutron_tempest_plugin.pot
-
-[extract_messages]
-keywords = _ gettext ngettext l_ lazy_gettext
-mapping_file = babel.cfg
-output_file = neutron_tempest_plugin/locale/neutron_tempest_plugin.pot
-
 [entry_points]
 tempest.test_plugins =
     neutron_tests = neutron_tempest_plugin.plugin:NeutronTempestPlugin
diff --git a/test-requirements.txt b/test-requirements.txt
index 905420c..6cff185 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -7,10 +7,10 @@
 coverage!=4.4,>=4.0 # Apache-2.0
 flake8-import-order==0.12 # LGPLv3
 python-subunit>=1.0.0 # Apache-2.0/BSD
-sphinx!=1.6.6,!=1.6.7,!=2.1.0,>=1.6.2  # BSD
+sphinx>=2.0.0,!=2.1.0 # BSD
 oslotest>=3.2.0 # Apache-2.0
 stestr>=1.0.0 # Apache-2.0
 testtools>=2.2.0 # MIT
-openstackdocstheme>=1.20.0 # Apache-2.0
+openstackdocstheme>=2.0.0 # Apache-2.0
 # releasenotes
 reno>=2.5.0 # Apache-2.0
diff --git a/tox.ini b/tox.ini
index 19e006a..760cc47 100644
--- a/tox.ini
+++ b/tox.ini
@@ -13,8 +13,6 @@
    OS_LOG_CAPTURE={env:OS_LOG_CAPTURE:true}
    OS_STDOUT_CAPTURE={env:OS_STDOUT_CAPTURE:true}
    OS_STDERR_CAPTURE={env:OS_STDERR_CAPTURE:true}
-install_command =
-  pip install {opts} {packages}
 deps =
   -c{env:UPPER_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
   -r{toxinidir}/test-requirements.txt
@@ -41,7 +39,7 @@
     coverage xml -o cover/coverage.xml
 
 [testenv:docs]
-commands = python setup.py build_sphinx
+commands = sphinx-build -W -b html doc/source doc/build/html
 
 [testenv:releasenotes]
 commands =
diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml
new file mode 100644
index 0000000..b6d9f90
--- /dev/null
+++ b/zuul.d/base.yaml
@@ -0,0 +1,108 @@
+- job:
+    name: neutron-tempest-plugin-base
+    parent: devstack-tempest
+    abstract: true
+    description: |
+      Perform setup common to all Neutron tempest tests
+    roles:
+      - zuul: openstack/devstack
+    required-projects:
+      - openstack/devstack-gate
+      - openstack/neutron
+      - openstack/neutron-tempest-plugin
+      - openstack/tempest
+    vars:
+      tempest_concurrency: 4
+      tox_envlist: all
+      devstack_localrc:
+        USE_PYTHON3: true
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
+      devstack_plugins:
+        neutron: https://opendev.org/openstack/neutron.git
+        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin.git
+      tempest_plugins:
+        - neutron-tempest-plugin
+      devstack_services:
+        tls-proxy: false
+        tempest: true
+        neutron-dns: true
+        neutron-qos: true
+        neutron-segments: true
+        neutron-trunk: true
+        neutron-uplink-status-propagation: true
+        neutron-network-segment-range: true
+        neutron-port-forwarding: true
+        neutron-conntrack-helper: true
+        neutron-tag-ports-during-bulk-creation: true
+      devstack_local_conf:
+        post-config:
+          $NEUTRON_CONF:
+            QUOTAS:
+              quota_router: 100
+              quota_floatingip: 500
+              quota_security_group: 150
+              quota_security_group_rule: 1000
+          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
+          # devstack-tempest job will be switched to use lib/neutron instead of
+          # lib/neutron-legacy
+          /$NEUTRON_CORE_PLUGIN_CONF:
+            ml2:
+              type_drivers: flat,geneve,vlan,gre,local,vxlan
+            ml2_type_vlan:
+              network_vlan_ranges: foo:1:10
+            ml2_type_vxlan:
+              vni_ranges: 1:2000
+            ml2_type_gre:
+              tunnel_id_ranges: 1:1000
+          $NEUTRON_L3_CONF:
+            agent:
+              availability_zone: nova
+          $NEUTRON_DHCP_CONF:
+            agent:
+              availability_zone: nova
+          /etc/neutron/api-paste.ini:
+            composite:neutronapi_v2_0:
+              use: call:neutron.auth:pipeline_factory
+              noauth: cors request_id catch_errors osprofiler extensions neutronapiapp_v2_0
+              keystone: cors request_id catch_errors osprofiler authtoken keystonecontext extensions neutronapiapp_v2_0
+        test-config:
+          $TEMPEST_CONFIG:
+            neutron_plugin_options:
+              provider_vlans: foo,
+              agent_availability_zone: nova
+              image_is_advanced: true
+              available_type_drivers: flat,geneve,vlan,gre,local,vxlan
+              provider_net_base_segm_id: 1
+    irrelevant-files: &tempest-irrelevant-files
+      - ^(test-|)requirements.txt$
+      - ^releasenotes/.*$
+      - ^doc/.*$
+      - ^setup.cfg$
+      - ^.*\.rst$
+      - ^neutron/locale/.*$
+      - ^neutron/tests/unit/.*$
+      - ^tools/.*$
+      - ^tox.ini$
+
+- job:
+    name: neutron-tempest-plugin-scenario
+    parent: neutron-tempest-plugin-base
+    abstract: true
+    description: |
+      Perform setup common to all tempest scenario test jobs.
+    vars:
+      # NOTE(slaweq): in case of some tests, which requires advanced image,
+      # default test timeout set to 1200 seconds may be not enough if job is
+      # run on slow node
+      tempest_test_timeout: 2400
+      tempest_test_regex: ^neutron_tempest_plugin\.scenario
+      devstack_localrc:
+        PHYSICAL_NETWORK: default
+        IMAGE_URLS: https://cloud-images.ubuntu.com/releases/xenial/release/ubuntu-16.04-server-cloudimg-amd64-disk1.img
+        ADVANCED_IMAGE_NAME: ubuntu-16.04-server-cloudimg-amd64-disk1
+        ADVANCED_INSTANCE_TYPE: ds512M
+        ADVANCED_INSTANCE_USER: ubuntu
+        BUILD_TIMEOUT: 784
+      devstack_services:
+        cinder: true
+
diff --git a/zuul.d/master_jobs.yaml b/zuul.d/master_jobs.yaml
new file mode 100644
index 0000000..b20b02d
--- /dev/null
+++ b/zuul.d/master_jobs.yaml
@@ -0,0 +1,495 @@
+- job:
+    name: neutron-tempest-plugin-api
+    parent: neutron-tempest-plugin-base
+    vars:
+      # TODO(slaweq): find a way to put this list of extensions in
+      # neutron repository and keep it different per branch,
+      # then it could be removed from here
+      network_api_extensions_common: &api_extensions
+        - address-scope
+        - agent
+        - allowed-address-pairs
+        - auto-allocated-topology
+        - availability_zone
+        - binding
+        - default-subnetpools
+        - dhcp_agent_scheduler
+        - dns-domain-ports
+        - dns-integration
+        - empty-string-filtering
+        - expose-port-forwarding-in-fip
+        - expose-l3-conntrack-helper
+        - ext-gw-mode
+        - external-net
+        - extra_dhcp_opt
+        - extraroute
+        - extraroute-atomic
+        - filter-validation
+        - fip-port-details
+        - flavors
+        - floating-ip-port-forwarding
+        - floatingip-pools
+        - ip-substring-filtering
+        - l3-conntrack-helper
+        - l3-flavors
+        - l3-ha
+        - l3_agent_scheduler
+        - logging
+        - metering
+        - multi-provider
+        - net-mtu
+        - net-mtu-writable
+        - network-ip-availability
+        - network_availability_zone
+        - network-segment-range
+        - pagination
+        - port-resource-request
+        - port-mac-address-regenerate
+        - port-security
+        - port-security-groups-filtering
+        - project-id
+        - provider
+        - qos
+        - qos-bw-minimum-ingress
+        - qos-fip
+        - quotas
+        - quota_details
+        - rbac-address-scope
+        - rbac-policies
+        - rbac-security-groups
+        - rbac-subnetpool
+        - router
+        - router-admin-state-down-before-update
+        - router_availability_zone
+        - security-group
+        - segment
+        - service-type
+        - sorting
+        - standard-attr-description
+        - standard-attr-revisions
+        - standard-attr-segment
+        - standard-attr-tag
+        - standard-attr-timestamp
+        - subnet_allocation
+        - subnet-dns-publish-fixed-ip
+        - subnetpool-prefix-ops
+        - tag-ports-during-bulk-creation
+        - trunk
+        - trunk-details
+        - uplink-status-propagation
+      network_api_extensions_tempest:
+        - dvr
+      tempest_test_regex: ^neutron_tempest_plugin\.api
+      devstack_services:
+        neutron-log: true
+      devstack_local_conf:
+        post-config:
+          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
+          # devstack-tempest job will be switched to use lib/neutron instead of
+          # lib/neutron-legacy
+          /$NEUTRON_CORE_PLUGIN_CONF:
+            AGENT:
+              tunnel_types: gre,vxlan
+            network_log:
+              local_output_log_base: /tmp/test_log.log
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch
+    parent: neutron-tempest-plugin-scenario
+    timeout: 10000
+    vars:
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        Q_AGENT: openvswitch
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+      devstack_local_conf:
+        post-config:
+          $NEUTRON_CONF:
+            DEFAULT:
+              enable_dvr: false
+          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
+          # devstack-tempest job will be switched to use lib/neutron instead of
+          # lib/neutron-legacy
+          /$NEUTRON_CORE_PLUGIN_CONF:
+            agent:
+              tunnel_types: vxlan,gre
+            ovs:
+              tunnel_bridge: br-tun
+              bridge_mappings: public:br-ex
+        test-config:
+          $TEMPEST_CONFIG:
+            neutron_plugin_options:
+              available_type_drivers: flat,vlan,local,vxlan
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
+    parent: neutron-tempest-plugin-scenario
+    timeout: 10000
+    vars:
+      network_api_extensions: *api_extensions
+      # TODO(slaweq): remove trunks subport_connectivity test from blacklist
+      # when bug https://bugs.launchpad.net/neutron/+bug/1838760 will be fixed
+      tempest_black_regex: "(^neutron_tempest_plugin.scenario.test_trunk.TrunkTest.test_subport_connectivity)"
+      devstack_localrc:
+        Q_AGENT: openvswitch
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+      devstack_local_conf:
+        post-config:
+          $NEUTRON_CONF:
+            DEFAULT:
+              enable_dvr: false
+          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
+          # devstack-tempest job will be switched to use lib/neutron instead of
+          # lib/neutron-legacy
+          /$NEUTRON_CORE_PLUGIN_CONF:
+            agent:
+              tunnel_types: vxlan,gre
+            ovs:
+              tunnel_bridge: br-tun
+              bridge_mappings: public:br-ex
+            securitygroup:
+              firewall_driver: iptables_hybrid
+        test-config:
+          $TEMPEST_CONFIG:
+            neutron_plugin_options:
+              available_type_drivers: flat,vlan,local,vxlan
+
+- job:
+    name: neutron-tempest-plugin-scenario-linuxbridge
+    parent: neutron-tempest-plugin-scenario
+    timeout: 10000
+    vars:
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        Q_AGENT: linuxbridge
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+      devstack_local_conf:
+        post-config:
+          $NEUTRON_CONF:
+            DEFAULT:
+              enable_dvr: false
+            AGENT:
+              debug_iptables_rules: true
+          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
+          # devstack-tempest job will be switched to use lib/neutron instead of
+          # lib/neutron-legacy
+          /$NEUTRON_CORE_PLUGIN_CONF:
+            ml2:
+              type_drivers: flat,vlan,local,vxlan
+        test-config:
+          $TEMPEST_CONFIG:
+            neutron_plugin_options:
+              available_type_drivers: flat,vlan,local,vxlan
+              q_agent: linuxbridge
+
+- job:
+    name: neutron-tempest-plugin-dvr-multinode-scenario
+    parent: tempest-multinode-full
+    description: |
+        Perform setup for Neutron tempest tests in multinode with DVR scenario
+    roles:
+      - zuul: openstack/devstack
+    required-projects:
+      - openstack/devstack-gate
+      - openstack/neutron
+      - openstack/neutron-tempest-plugin
+      - openstack/tempest
+    pre-run: playbooks/dvr-multinode-scenario-pre-run.yaml
+    voting: false
+    vars:
+      tempest_concurrency: 4
+      tox_envlist: all
+      tempest_test_regex: ^neutron_tempest_plugin\.scenario
+      # NOTE(slaweq): in case of some tests, which requires advanced image,
+      # default test timeout set to 1200 seconds may be not enough if job is
+      # run on slow node
+      tempest_test_timeout: 2400
+      network_api_extensions_common: *api_extensions
+      network_api_extensions_dvr:
+        - dvr
+      devstack_localrc:
+        USE_PYTHON3: true
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_dvr) | join(',') }}"
+        PHYSICAL_NETWORK: default
+        IMAGE_URLS: https://cloud-images.ubuntu.com/releases/xenial/release/ubuntu-16.04-server-cloudimg-amd64-disk1.img
+        ADVANCED_IMAGE_NAME: ubuntu-16.04-server-cloudimg-amd64-disk1
+        ADVANCED_INSTANCE_TYPE: ds512M
+        ADVANCED_INSTANCE_USER: ubuntu
+        BUILD_TIMEOUT: 784
+      devstack_plugins:
+        neutron: https://opendev.org/openstack/neutron.git
+        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin.git
+      tempest_plugins:
+        - neutron-tempest-plugin
+      devstack_services:
+        tls-proxy: false
+        tempest: true
+        neutron-dns: true
+        neutron-qos: true
+        neutron-segments: true
+        neutron-trunk: true
+        neutron-log: true
+        neutron-port-forwarding: true
+        cinder: true
+      devstack_local_conf:
+        post-config:
+          $NEUTRON_CONF:
+            quotas:
+              quota_router: 100
+              quota_floatingip: 500
+              quota_security_group: 100
+              quota_security_group_rule: 1000
+            DEFAULT:
+              router_distributed: True
+          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
+          # devstack-tempest job will be switched to use lib/neutron instead of
+          # lib/neutron-legacy
+          "/$NEUTRON_CORE_PLUGIN_CONF":
+            ml2:
+              type_drivers: flat,geneve,vlan,gre,local,vxlan
+              mechanism_drivers: openvswitch,l2population
+            ml2_type_vlan:
+              network_vlan_ranges: foo:1:10
+            ml2_type_vxlan:
+              vni_ranges: 1:2000
+            ml2_type_gre:
+              tunnel_id_ranges: 1:1000
+            agent:
+              enable_distributed_routing: True
+              l2_population: True
+              tunnel_types: vxlan,gre
+            ovs:
+              tunnel_bridge: br-tun
+              bridge_mappings: public:br-ex
+          $NEUTRON_L3_CONF:
+            DEFAULT:
+              agent_mode: dvr_snat
+            agent:
+              availability_zone: nova
+          $NEUTRON_DHCP_CONF:
+            agent:
+              availability_zone: nova
+          "/etc/neutron/api-paste.ini":
+            "composite:neutronapi_v2_0":
+              use: "call:neutron.auth:pipeline_factory"
+              noauth: "cors request_id catch_errors osprofiler extensions neutronapiapp_v2_0"
+              keystone: "cors request_id catch_errors osprofiler authtoken keystonecontext extensions neutronapiapp_v2_0"
+        test-config:
+          $TEMPEST_CONFIG:
+            neutron_plugin_options:
+              provider_vlans: foo,
+              agent_availability_zone: nova
+              image_is_advanced: true
+              available_type_drivers: flat,geneve,vlan,gre,local,vxlan
+              l3_agent_mode: dvr_snat
+    group-vars:
+      subnode:
+        devstack_services:
+          tls-proxy: false
+          q-agt: true
+          q-l3: true
+          q-meta: true
+          neutron-qos: true
+          neutron-trunk: true
+          neutron-log: true
+          neutron-port-forwarding: true
+        devstack_localrc:
+          USE_PYTHON3: true
+        devstack_local_conf:
+          post-config:
+            $NEUTRON_CONF:
+              DEFAULT:
+                router_distributed: True
+            # NOTE(slaweq): We can get rid of this hardcoded absolute path when
+            # devstack-tempest job will be switched to use lib/neutron instead of
+            # lib/neutron-legacy
+            "/$NEUTRON_CORE_PLUGIN_CONF":
+              agent:
+                enable_distributed_routing: True
+                l2_population: True
+                tunnel_types: vxlan,gre
+              ovs:
+                tunnel_bridge: br-tun
+                bridge_mappings: public:br-ex
+            $NEUTRON_L3_CONF:
+              DEFAULT:
+                agent_mode: dvr_snat
+              agent:
+                availability_zone: nova
+    irrelevant-files: &tempest-irrelevant-files
+      - ^(test-|)requirements.txt$
+      - ^releasenotes/.*$
+      - ^doc/.*$
+      - ^setup.cfg$
+      - ^.*\.rst$
+      - ^neutron/locale/.*$
+      - ^neutron/tests/unit/.*$
+      - ^tools/.*$
+      - ^tox.ini$
+
+- job:
+    name: neutron-tempest-plugin-designate-scenario
+    parent: neutron-tempest-plugin-scenario
+    description: Neutron designate integration scenario
+    required-projects:
+      - openstack/designate
+      - openstack/designate-dashboard
+      - openstack/designate-tempest-plugin
+    timeout: 3600
+    vars:
+      network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        DESIGNATE_BACKEND_DRIVER: bind9
+        Q_AGENT: openvswitch
+        # In this job advanced image is not needed, so it's name should be
+        # empty
+        ADVANCED_IMAGE_NAME: ""
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions_common | join(',') }}"
+      devstack_local_conf:
+        post-config:
+          $NEUTRON_CONF:
+            DEFAULT:
+              enable_dvr: false
+          # NOTE(slaweq): We can get rid of this hardcoded absolute path when
+          # devstack-tempest job will be switched to use lib/neutron instead of
+          # lib/neutron-legacy
+          /$NEUTRON_CORE_PLUGIN_CONF:
+            agent:
+              tunnel_types: vxlan,gre
+            ovs:
+              tunnel_bridge: br-tun
+              bridge_mappings: public:br-ex
+      devstack_plugins:
+        designate: https://opendev.org/openstack/designate.git
+      devstack_services:
+        cinder: false
+        designate: true
+      tempest_plugins:
+        - designate-tempest-plugin
+        - neutron-tempest-plugin
+      tempest_test_regex: ^neutron_tempest_plugin\.scenario\.test_dns_integration
+    irrelevant-files: *tempest-irrelevant-files
+
+- job:
+    name: neutron-tempest-plugin-sfc
+    parent: neutron-tempest-plugin-base
+    timeout: 10800
+    required-projects:
+      - openstack/devstack-gate
+      - openstack/networking-sfc
+      - openstack/neutron
+      - openstack/neutron-tempest-plugin
+      - openstack/tempest
+    vars:
+      network_api_extensions_common: *api_extensions
+      tempest_test_regex: ^neutron_tempest_plugin\.sfc
+      devstack_plugins:
+        networking-sfc: https://opendev.org/openstack/networking-sfc
+        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin
+      network_api_extensions_sfc:
+        - flow_classifier
+        - sfc
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_sfc) | join(',') }}"
+      # TODO(bcafarel): tests still fail from time to time in parallel
+      # https://bugs.launchpad.net/neutron/+bug/1851500
+      # https://bugs.launchpad.net/networking-sfc/+bug/1660366
+      tempest_concurrency: 1
+
+- job:
+    name: neutron-tempest-plugin-bgpvpn-bagpipe
+    parent: neutron-tempest-plugin-base
+    required-projects:
+      - openstack/networking-bagpipe
+      - openstack/networking-bgpvpn
+    vars:
+      tempest_test_regex: ^neutron_tempest_plugin\.bgpvpn
+      network_api_extensions: *api_extensions
+      network_api_extensions_bgpvpn:
+        - bgpvpn
+        - bgpvpn-routes-control
+      devstack_localrc:
+        NETWORKING_BGPVPN_DRIVER: "BGPVPN:BaGPipe:networking_bgpvpn.neutron.services.service_drivers.bagpipe.bagpipe_v2.BaGPipeBGPVPNDriver:default"
+        BAGPIPE_DATAPLANE_DRIVER_IPVPN: "ovs"
+        BAGPIPE_BGP_PEERS: "-"
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions + network_api_extensions_bgpvpn) | join(',') }}"
+      devstack_plugins:
+        networking-bgpvpn: https://git.openstack.org/openstack/networking-bgpvpn
+        networking-bagpipe: https://git.openstack.org/openstack/networking-bagpipe
+
+- job:
+    name: neutron-tempest-plugin-fwaas
+    parent: neutron-tempest-plugin-base
+    timeout: 10800
+    required-projects:
+      - openstack/devstack-gate
+      - openstack/neutron-fwaas
+      - openstack/neutron
+      - openstack/neutron-tempest-plugin
+      - openstack/tempest
+    vars:
+      tempest_test_regex: ^neutron_tempest_plugin\.fwaas
+      devstack_plugins:
+        neutron-fwaas: https://opendev.org/openstack/neutron-fwaas.git
+        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin.git
+      network_api_extensions_common: *api_extensions
+      network_api_extensions_fwaas:
+        - fwaas_v2
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_fwaas) | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-dynamic-routing
+    parent: neutron-tempest-plugin-base
+    description: |
+      Perform setup common to all Neutron dynamic routing tempest tests
+    required-projects:
+      - openstack/neutron
+      - openstack/neutron-dynamic-routing
+      - openstack/os-ken
+      - openstack/tempest
+    pre-run: playbooks/dynamic-routing-pre-run.yaml
+    vars:
+      devstack_plugins:
+        neutron-dynamic-routing: https://opendev.org/openstack/neutron-dynamic-routing
+        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin
+      network_api_extensions_common: *api_extensions
+      network_api_extensions_bgp:
+        - bgp
+        - bgp_dragent_scheduler
+        - bgp_4byte_asn
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_bgp) | join(',') }}"
+      devstack_services:
+        neutron-dr: true
+        neutron-dr-agent: true
+        q-l3: true
+      tempest_concurrency: 1
+      tempest_test_regex: ^neutron_tempest_plugin\.neutron_dynamic_routing
+
+- job:
+    name: neutron-tempest-plugin-vpnaas
+    parent: neutron-tempest-plugin-base
+    timeout: 3900
+    required-projects:
+      - openstack/devstack-gate
+      - openstack/neutron
+      - openstack/neutron-vpnaas
+      - openstack/neutron-tempest-plugin
+      - openstack/tempest
+    vars:
+      tempest_test_regex: ^neutron_tempest_plugin\.vpnaas
+      devstack_plugins:
+        neutron-vpnaas: https://opendev.org/openstack/neutron-vpnaas.git
+        neutron-tempest-plugin: https://opendev.org/openstack/neutron-tempest-plugin.git
+      network_api_extensions_common: *api_extensions
+      network_api_extensions_vpnaas:
+        - vpnaas
+      devstack_localrc:
+        IPSEC_PACKAGE: strongswan
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_vpnaas) | join(',') }}"
+    irrelevant-files:
+      - ^.*\.rst$
+      - ^doc/.*$
+      - ^neutron_vpnaas/tests/unit/.*$
+      - ^releasenotes/.*$
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
new file mode 100644
index 0000000..c6bf1a0
--- /dev/null
+++ b/zuul.d/project.yaml
@@ -0,0 +1,129 @@
+- project-template:
+    name: neutron-tempest-plugin-jobs
+    check:
+      jobs:
+        - neutron-tempest-plugin-api
+        - neutron-tempest-plugin-designate-scenario
+        - neutron-tempest-plugin-dvr-multinode-scenario
+        - neutron-tempest-plugin-scenario-linuxbridge
+        - neutron-tempest-plugin-scenario-openvswitch
+        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
+    gate:
+      jobs:
+        - neutron-tempest-plugin-api
+        - neutron-tempest-plugin-scenario-linuxbridge
+        - neutron-tempest-plugin-scenario-openvswitch
+        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
+
+- project-template:
+    name: neutron-tempest-plugin-jobs-queens
+    check:
+      jobs:
+        - neutron-tempest-plugin-api-queens
+        - neutron-tempest-plugin-designate-scenario-queens
+        - neutron-tempest-plugin-dvr-multinode-scenario-queens
+        - neutron-tempest-plugin-scenario-linuxbridge-queens
+        - neutron-tempest-plugin-scenario-openvswitch-queens
+    gate:
+      jobs:
+        - neutron-tempest-plugin-api-queens
+
+- project-template:
+    name: neutron-tempest-plugin-jobs-rocky
+    check:
+      jobs:
+        - neutron-tempest-plugin-api-rocky
+        - neutron-tempest-plugin-designate-scenario-rocky
+        - neutron-tempest-plugin-dvr-multinode-scenario-rocky
+        - neutron-tempest-plugin-scenario-linuxbridge-rocky
+        - neutron-tempest-plugin-scenario-openvswitch-rocky
+        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-rocky
+    gate:
+      jobs:
+        - neutron-tempest-plugin-api-rocky
+
+- project-template:
+    name: neutron-tempest-plugin-jobs-stein
+    check:
+      jobs:
+        - neutron-tempest-plugin-api-stein
+        - neutron-tempest-plugin-designate-scenario-stein
+        - neutron-tempest-plugin-dvr-multinode-scenario-stein
+        - neutron-tempest-plugin-scenario-linuxbridge-stein
+        - neutron-tempest-plugin-scenario-openvswitch-stein
+        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-stein
+    gate:
+      jobs:
+        - neutron-tempest-plugin-api-stein
+
+- project-template:
+    name: neutron-tempest-plugin-jobs-train
+    check:
+      jobs:
+        - neutron-tempest-plugin-api-train
+        - neutron-tempest-plugin-designate-scenario-train
+        - neutron-tempest-plugin-dvr-multinode-scenario-train
+        - neutron-tempest-plugin-scenario-linuxbridge-train
+        - neutron-tempest-plugin-scenario-openvswitch-train
+        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-train
+    gate:
+      jobs:
+        - neutron-tempest-plugin-api-train
+
+- project-template:
+    name: neutron-tempest-plugin-jobs-ussuri
+    check:
+      jobs:
+        - neutron-tempest-plugin-api-ussuri
+        - neutron-tempest-plugin-designate-scenario-ussuri
+        - neutron-tempest-plugin-dvr-multinode-scenario-ussuri
+        - neutron-tempest-plugin-scenario-linuxbridge-ussuri
+        - neutron-tempest-plugin-scenario-openvswitch-ussuri
+        - neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-ussuri
+    gate:
+      jobs:
+        - neutron-tempest-plugin-api-ussuri
+
+- project:
+    templates:
+      - build-openstack-docs-pti
+      - neutron-tempest-plugin-jobs
+      - neutron-tempest-plugin-jobs-stein
+      - neutron-tempest-plugin-jobs-train
+      - neutron-tempest-plugin-jobs-ussuri
+      - check-requirements
+      - tempest-plugin-jobs
+      - release-notes-jobs-python3
+    check:
+      jobs:
+        - neutron-tempest-plugin-sfc
+        - neutron-tempest-plugin-sfc-train
+        - neutron-tempest-plugin-sfc-ussuri
+        - neutron-tempest-plugin-bgpvpn-bagpipe
+        - neutron-tempest-plugin-bgpvpn-bagpipe-train
+        - neutron-tempest-plugin-bgpvpn-bagpipe-ussuri
+        - neutron-tempest-plugin-fwaas:
+            # TODO(slaweq): switch it to be voting when bug
+            # https://bugs.launchpad.net/neutron/+bug/1858645 will be fixed
+            voting: false
+        - neutron-tempest-plugin-fwaas-train:
+            # TODO(slaweq): switch it to be voting when bug
+            # https://bugs.launchpad.net/neutron/+bug/1858645 will be fixed
+            voting: false
+        - neutron-tempest-plugin-fwaas-ussuri:
+            # TODO(slaweq): switch it to be voting when bug
+            # https://bugs.launchpad.net/neutron/+bug/1858645 will be fixed
+            voting: false
+        - neutron-tempest-plugin-dynamic-routing
+        - neutron-tempest-plugin-dynamic-routing-ussuri
+        - neutron-tempest-plugin-vpnaas
+        - neutron-tempest-plugin-vpnaas-ussuri
+
+    gate:
+      jobs:
+        - neutron-tempest-plugin-sfc
+        - neutron-tempest-plugin-bgpvpn-bagpipe
+        # TODO(slaweq): bring it back to gate queue
+        # https://bugs.launchpad.net/neutron/+bug/1858645 will be fixed
+        # - neutron-tempest-plugin-fwaas
+        - neutron-tempest-plugin-dynamic-routing
diff --git a/zuul.d/queens_jobs.yaml b/zuul.d/queens_jobs.yaml
new file mode 100644
index 0000000..2b52978
--- /dev/null
+++ b/zuul.d/queens_jobs.yaml
@@ -0,0 +1,179 @@
+- job:
+    name: neutron-tempest-plugin-api-queens
+    nodeset: openstack-single-node-xenial
+    parent: neutron-tempest-plugin-api
+    override-checkout: stable/queens
+    required-projects:
+      - openstack/devstack-gate
+      - openstack/neutron
+      - name: openstack/neutron-tempest-plugin
+        override-checkout: 0.3.0
+      - openstack/tempest
+    vars:
+      branch_override: stable/queens
+      # TODO(slaweq): find a way to put this list of extensions in
+      # neutron repository and keep it different per branch,
+      # then it could be removed from here
+      network_api_extensions_common: &api_extensions
+        - address-scope
+        - agent
+        - allowed-address-pairs
+        - auto-allocated-topology
+        - availability_zone
+        - binding
+        - default-subnetpools
+        - dhcp_agent_scheduler
+        - dns-domain-ports
+        - dns-integration
+        - ext-gw-mode
+        - external-net
+        - extra_dhcp_opt
+        - extraroute
+        - flavors
+        - ip-substring-filtering
+        - l3-flavors
+        - l3-ha
+        - l3_agent_scheduler
+        - logging
+        - metering
+        - multi-provider
+        - net-mtu
+        - net-mtu-writable
+        - network-ip-availability
+        - network_availability_zone
+        - pagination
+        - port-security
+        - project-id
+        - provider
+        - qos
+        - qos-fip
+        - quotas
+        - quota_details
+        - rbac-policies
+        - router
+        - router_availability_zone
+        - security-group
+        - segment
+        - service-type
+        - sorting
+        - standard-attr-description
+        - standard-attr-revisions
+        - standard-attr-timestamp
+        - standard-attr-tag
+        - subnet_allocation
+        - trunk
+        - trunk-details
+      network_api_extensions_tempest:
+        - dvr
+      devstack_localrc:
+        USE_PYTHON3: false
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
+        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
+
+
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-queens
+    parent: neutron-tempest-plugin-scenario-openvswitch
+    nodeset: openstack-single-node-xenial
+    override-checkout: stable/queens
+    required-projects:
+      - openstack/devstack-gate
+      - openstack/neutron
+      - name: openstack/neutron-tempest-plugin
+        override-checkout: 0.3.0
+      - openstack/tempest
+    vars:
+      branch_override: stable/queens
+      network_api_extensions: *api_extensions
+      # TODO(slaweq): remove trunks subport_connectivity test from blacklist
+      # when bug https://bugs.launchpad.net/neutron/+bug/1838760 will be fixed
+      # NOTE(bcafarel): remove DNS test as queens pinned version does not have
+      # fix for https://bugs.launchpad.net/neutron/+bug/1826419
+      tempest_black_regex: "\
+          (^neutron_tempest_plugin.scenario.test_trunk.TrunkTest.test_subport_connectivity)|\
+          (^neutron_tempest_plugin.scenario.test_internal_dns.InternalDNSTest.test_dns_domain_and_name)"
+      devstack_localrc:
+        USE_PYTHON3: false
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
+
+- job:
+    name: neutron-tempest-plugin-scenario-linuxbridge-queens
+    parent: neutron-tempest-plugin-scenario-linuxbridge
+    nodeset: openstack-single-node-xenial
+    override-checkout: stable/queens
+    required-projects:
+      - openstack/devstack-gate
+      - openstack/neutron
+      - name: openstack/neutron-tempest-plugin
+        override-checkout: 0.3.0
+      - openstack/tempest
+    vars:
+      branch_override: stable/queens
+      network_api_extensions: *api_extensions
+      # NOTE(bcafarel): remove DNS test as queens pinned version does not have
+      # fix for https://bugs.launchpad.net/neutron/+bug/1826419
+      tempest_black_regex: "\
+          (^neutron_tempest_plugin.scenario.test_internal_dns.InternalDNSTest.test_dns_domain_and_name)"
+      devstack_localrc:
+        USE_PYTHON3: false
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
+      devstack_local_conf:
+        test-config:
+          # NOTE: ignores linux bridge's trunk delete on bound port test
+          # for queens branch (as https://review.opendev.org/#/c/605589/
+          # fix will not apply for queens branch)
+          $TEMPEST_CONFIG:
+            neutron_plugin_options:
+              q_agent: None
+
+- job:
+    name: neutron-tempest-plugin-dvr-multinode-scenario-queens
+    parent: neutron-tempest-plugin-dvr-multinode-scenario
+    nodeset: openstack-two-node-xenial
+    override-checkout: stable/queens
+    required-projects:
+      - openstack/devstack-gate
+      - openstack/neutron
+      - name: openstack/neutron-tempest-plugin
+        override-checkout: 0.3.0
+      - openstack/tempest
+    vars:
+      branch_override: stable/queens
+      network_api_extensions_common: *api_extensions
+      # TODO(slaweq): remove trunks subport_connectivity test from blacklist
+      # when bug https://bugs.launchpad.net/neutron/+bug/1838760 will be fixed
+      # NOTE(bcafarel): remove DNS test as queens pinned version does not have
+      # fix for https://bugs.launchpad.net/neutron/+bug/1826419
+      tempest_black_regex: "\
+          (^neutron_tempest_plugin.scenario.test_trunk.TrunkTest.test_subport_connectivity)|\
+          (^neutron_tempest_plugin.scenario.test_internal_dns.InternalDNSTest.test_dns_domain_and_name)"
+      devstack_localrc:
+        USE_PYTHON3: false
+        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
+
+- job:
+    name: neutron-tempest-plugin-designate-scenario-queens
+    parent: neutron-tempest-plugin-designate-scenario
+    nodeset: openstack-single-node-xenial
+    override-checkout: stable/queens
+    required-projects:
+      - openstack/devstack-gate
+      - openstack/neutron
+      - name: openstack/neutron-tempest-plugin
+        override-checkout: 0.3.0
+      - name: openstack/designate-tempest-plugin
+        override-checkout: 0.7.0
+      - openstack/tempest
+    vars:
+      branch_override: stable/queens
+      network_api_extensions_common: *api_extensions
+      # NOTE(bcafarel): remove DNS test as queens pinned version does not have
+      # fix for https://bugs.launchpad.net/neutron/+bug/1826419
+      tempest_black_regex: "\
+          (^neutron_tempest_plugin.scenario.test_internal_dns.InternalDNSTest.test_dns_domain_and_name)"
+      devstack_localrc:
+        USE_PYTHON3: false
+        TEMPEST_PLUGINS: '"/opt/stack/designate-tempest-plugin /opt/stack/neutron-tempest-plugin"'
diff --git a/zuul.d/rocky_jobs.yaml b/zuul.d/rocky_jobs.yaml
new file mode 100644
index 0000000..a45cae8
--- /dev/null
+++ b/zuul.d/rocky_jobs.yaml
@@ -0,0 +1,299 @@
+- job:
+    name: neutron-tempest-plugin-api-rocky
+    nodeset: openstack-single-node-xenial
+    parent: neutron-tempest-plugin-api
+    description: |
+      This job run on py2 for stable/rocky gate.
+    override-checkout: stable/rocky
+    required-projects: &required-projects-rocky
+      - openstack/devstack-gate
+      - openstack/neutron
+      - name: openstack/neutron-tempest-plugin
+        override-checkout: 0.9.0
+      - openstack/tempest
+    vars: &api_vars_rocky
+      branch_override: stable/rocky
+      # TODO(slaweq): find a way to put this list of extensions in
+      # neutron repository and keep it different per branch,
+      # then it could be removed from here
+      network_api_extensions_common: &api_extensions
+        - address-scope
+        - agent
+        - allowed-address-pairs
+        - auto-allocated-topology
+        - availability_zone
+        - binding
+        - default-subnetpools
+        - dhcp_agent_scheduler
+        - dns-domain-ports
+        - dns-integration
+        - empty-string-filtering
+        - expose-port-forwarding-in-fip
+        - ext-gw-mode
+        - external-net
+        - extra_dhcp_opt
+        - extraroute
+        - fip-port-details
+        - flavors
+        - floating-ip-port-forwarding
+        - ip-substring-filtering
+        - l3-flavors
+        - l3-ha
+        - l3_agent_scheduler
+        - logging
+        - metering
+        - multi-provider
+        - net-mtu
+        - net-mtu-writable
+        - network-ip-availability
+        - network_availability_zone
+        - pagination
+        - port-mac-address-regenerate
+        - port-security
+        - port-security-groups-filtering
+        - project-id
+        - provider
+        - qos
+        - qos-fip
+        - quotas
+        - quota_details
+        - rbac-policies
+        - router
+        - router_availability_zone
+        - security-group
+        - segment
+        - service-type
+        - sorting
+        - standard-attr-description
+        - standard-attr-revisions
+        - standard-attr-segment
+        - standard-attr-timestamp
+        - standard-attr-tag
+        - subnet_allocation
+        - trunk
+        - trunk-details
+      network_api_extensions_tempest:
+        - dvr
+      devstack_localrc:
+        USE_PYTHON3: false
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
+        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
+    # NOTE(gmann): This job run on py2 for stable/rocky gate.
+    branches:
+      - stable/rocky
+
+- job:
+    name: neutron-tempest-plugin-api-rocky
+    nodeset: openstack-single-node-xenial
+    parent: neutron-tempest-plugin-api
+    description: |
+      This job run on py3 for other than stable/rocky gate
+      which is nothing but neutron-tempest-pluign master gate.
+    override-checkout: stable/rocky
+    required-projects: *required-projects-rocky
+    vars:
+      <<: *api_vars_rocky
+      devstack_localrc:
+        USE_PYTHON3: True
+    branches: ^(?!stable/rocky).*$
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-rocky
+    parent: neutron-tempest-plugin-scenario-openvswitch
+    description: |
+      This job run on py2 for stable/rocky gate.
+    nodeset: openstack-single-node-xenial
+    override-checkout: stable/rocky
+    required-projects: *required-projects-rocky
+    vars: &scenario_vars_rocky
+      branch_override: stable/rocky
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        USE_PYTHON3: false
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
+      # NOTE(bcafarel): newer tests, unstable on rocky branch
+      tempest_black_regex: "\
+          (^neutron_tempest_plugin.scenario.test_port_forwardings.PortForwardingTestJSON.test_port_forwarding_to_2_servers)|\
+          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)"
+    branches:
+      - stable/rocky
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-rocky
+    parent: neutron-tempest-plugin-scenario-openvswitch
+    nodeset: openstack-single-node-xenial
+    description: |
+      This job run on py3 for other than stable/rocky gate
+      which is nothing but neutron-tempest-pluign master gate.
+    override-checkout: stable/rocky
+    required-projects: *required-projects-rocky
+    vars:
+      <<: *scenario_vars_rocky
+      devstack_localrc:
+        USE_PYTHON3: True
+    branches: ^(?!stable/rocky).*$
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-rocky
+    parent: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
+    nodeset: openstack-single-node-xenial
+    description: |
+      This job run on py2 for stable/rocky gate.
+    override-checkout: stable/rocky
+    required-projects: *required-projects-rocky
+    vars: &openvswitch_vars_rocky
+      branch_override: stable/rocky
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        USE_PYTHON3: false
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
+      # TODO(bcafarel): remove trunks subport_connectivity test from blacklist
+      # when bug https://bugs.launchpad.net/neutron/+bug/1838760 will be fixed
+      # NOTE(bcafarel): other are newer tests, unstable on rocky branch
+      tempest_black_regex: "\
+          (^neutron_tempest_plugin.scenario.test_trunk.TrunkTest.test_subport_connectivity)|\
+          (^neutron_tempest_plugin.scenario.test_port_forwardings.PortForwardingTestJSON.test_port_forwarding_to_2_servers)|\
+          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)"
+    branches:
+      - stable/rocky
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-rocky
+    parent: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
+    nodeset: openstack-single-node-xenial
+    description: |
+      This job run on py3 for other than stable/rocky gate
+      which is nothing but neutron-tempest-pluign master gate.
+    override-checkout: stable/rocky
+    required-projects: *required-projects-rocky
+    vars:
+      <<: *openvswitch_vars_rocky
+      devstack_localrc:
+        USE_PYTHON3: True
+    branches: ^(?!stable/rocky).*$
+
+- job:
+    name: neutron-tempest-plugin-scenario-linuxbridge-rocky
+    parent: neutron-tempest-plugin-scenario-linuxbridge
+    description: |
+      This job run on py2 for stable/rocky gate.
+    nodeset: openstack-single-node-xenial
+    override-checkout: stable/rocky
+    required-projects: *required-projects-rocky
+    vars: &linuxbridge_vars_rocky
+      branch_override: stable/rocky
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        USE_PYTHON3: false
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
+      devstack_local_conf:
+        test-config:
+          # NOTE: ignores linux bridge's trunk delete on bound port test
+          # for rocky branch (as https://review.opendev.org/#/c/605589/
+          # fix will not apply for rocky branch)
+          $TEMPEST_CONFIG:
+            neutron_plugin_options:
+              q_agent: None
+      # NOTE(bcafarel): newer tests, unstable on rocky branch
+      tempest_black_regex: "\
+          (^neutron_tempest_plugin.scenario.test_port_forwardings.PortForwardingTestJSON.test_port_forwarding_to_2_servers)|\
+          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)"
+    branches:
+      - stable/rocky
+
+- job:
+    name: neutron-tempest-plugin-scenario-linuxbridge-rocky
+    parent: neutron-tempest-plugin-scenario-linuxbridge
+    nodeset: openstack-single-node-xenial
+    description: |
+      This job run on py3 for other than stable/rocky gate
+      which is nothing but neutron-tempest-pluign master gate.
+    override-checkout: stable/rocky
+    required-projects: *required-projects-rocky
+    vars:
+      <<: *linuxbridge_vars_rocky
+      devstack_localrc:
+        USE_PYTHON3: True
+    branches: ^(?!stable/rocky).*$
+
+- job:
+    name: neutron-tempest-plugin-dvr-multinode-scenario-rocky
+    parent: neutron-tempest-plugin-dvr-multinode-scenario
+    description: |
+      This job run on py2 for stable/rocky gate.
+    nodeset: openstack-two-node-xenial
+    override-checkout: stable/rocky
+    required-projects: *required-projects-rocky
+    vars: &multinode_scenario_vars_rocky
+      branch_override: stable/rocky
+      network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        USE_PYTHON3: false
+        TEMPEST_PLUGINS: /opt/stack/neutron-tempest-plugin
+      # NOTE(bcafarel): newer tests, unstable on rocky branch
+      tempest_black_regex: "\
+          (^neutron_tempest_plugin.scenario.test_port_forwardings.PortForwardingTestJSON.test_port_forwarding_to_2_servers)|\
+          (^neutron_tempest_plugin.scenario.test_security_groups.NetworkSecGroupTest.test_multiple_ports_portrange_remote)"
+    branches:
+      - stable/rocky
+
+- job:
+    name: neutron-tempest-plugin-dvr-multinode-scenario-rocky
+    parent: neutron-tempest-plugin-dvr-multinode-scenario
+    nodeset: openstack-two-node-xenial
+    description: |
+      This job run on py3 for other than stable/rocky gate
+      which is nothing but neutron-tempest-pluign master gate.
+    override-checkout: stable/rocky
+    vars:
+      <<: *multinode_scenario_vars_rocky
+      devstack_localrc:
+        USE_PYTHON3: True
+    required-projects: *required-projects-rocky
+    group-vars:
+      subnode:
+        devstack_localrc:
+          USE_PYTHON3: True
+    branches: ^(?!stable/rocky).*$
+
+- job:
+    name: neutron-tempest-plugin-designate-scenario-rocky
+    parent: neutron-tempest-plugin-designate-scenario
+    description: |
+      This job run on py2 for stable/rocky gate.
+    nodeset: openstack-single-node-xenial
+    override-checkout: stable/rocky
+    required-projects:
+      - openstack/devstack-gate
+      - openstack/neutron
+      - name: openstack/neutron-tempest-plugin
+        override-checkout: 0.9.0
+      - name: openstack/designate-tempest-plugin
+        override-checkout: 0.7.0
+      - openstack/tempest
+    vars: &designate_scenario_vars_rocky
+      branch_override: stable/rocky
+      network_api_extensions_common: *api_extensions
+      devstack_localrc:
+        USE_PYTHON3: false
+        TEMPEST_PLUGINS: '"/opt/stack/designate-tempest-plugin /opt/stack/neutron-tempest-plugin"'
+    branches:
+      - stable/rocky
+
+- job:
+    name: neutron-tempest-plugin-designate-scenario-rocky
+    parent: neutron-tempest-plugin-designate-scenario
+    nodeset: openstack-single-node-xenial
+    description: |
+      This job run on py3 for other than stable/rocky gate
+      which is nothing but neutron-tempest-plugin master gate.
+    override-checkout: stable/rocky
+    required-projects: *required-projects-rocky
+    vars:
+      <<: *designate_scenario_vars_rocky
+      devstack_localrc:
+        USE_PYTHON3: True
+    branches: ^(?!stable/rocky).*$
diff --git a/zuul.d/stein_jobs.yaml b/zuul.d/stein_jobs.yaml
new file mode 100644
index 0000000..1c9e299
--- /dev/null
+++ b/zuul.d/stein_jobs.yaml
@@ -0,0 +1,129 @@
+- job:
+    name: neutron-tempest-plugin-api-stein
+    parent: neutron-tempest-plugin-api
+    override-checkout: stable/stein
+    vars:
+      branch_override: stable/stein
+      # TODO(slaweq): find a way to put this list of extensions in
+      # neutron repository and keep it different per branch,
+      # then it could be removed from here
+      network_api_extensions_common: &api_extensions
+        - address-scope
+        - agent
+        - allowed-address-pairs
+        - auto-allocated-topology
+        - availability_zone
+        - binding
+        - default-subnetpools
+        - dhcp_agent_scheduler
+        - dns-domain-ports
+        - dns-integration
+        - empty-string-filtering
+        - expose-port-forwarding-in-fip
+        - ext-gw-mode
+        - external-net
+        - extra_dhcp_opt
+        - extraroute
+        - filter-validation
+        - fip-port-details
+        - flavors
+        - floatingip-pools
+        - floating-ip-port-forwarding
+        - ip-substring-filtering
+        - l3-flavors
+        - l3-ha
+        - l3_agent_scheduler
+        - logging
+        - metering
+        - multi-provider
+        - net-mtu
+        - net-mtu-writable
+        - network-ip-availability
+        - network_availability_zone
+        - network-segment-range
+        - pagination
+        - port-resource-request
+        - port-mac-address-regenerate
+        - port-security
+        - port-security-groups-filtering
+        - project-id
+        - provider
+        - qos
+        - qos-bw-minimum-ingress
+        - qos-fip
+        - quotas
+        - quota_details
+        - rbac-policies
+        - rbac-security-groups
+        - router
+        - router_availability_zone
+        - security-group
+        - segment
+        - service-type
+        - sorting
+        - standard-attr-description
+        - standard-attr-revisions
+        - standard-attr-segment
+        - standard-attr-tag
+        - standard-attr-timestamp
+        - subnet_allocation
+        - trunk
+        - trunk-details
+        - uplink-status-propagation
+      network_api_extensions_tempest:
+        - dvr
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-stein
+    parent: neutron-tempest-plugin-scenario-openvswitch
+    override-checkout: stable/stein
+    vars:
+      branch_override: stable/stein
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-stein
+    parent: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
+    override-checkout: stable/stein
+    vars:
+      branch_override: stable/stein
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-scenario-linuxbridge-stein
+    parent: neutron-tempest-plugin-scenario-linuxbridge
+    override-checkout: stable/stein
+    vars:
+      branch_override: stable/stein
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-dvr-multinode-scenario-stein
+    parent: neutron-tempest-plugin-dvr-multinode-scenario
+    override-checkout: stable/stein
+    vars:
+      network_api_extensions_common: *api_extensions
+      branch_override: stable/stein
+
+- job:
+    name: neutron-tempest-plugin-designate-scenario-stein
+    parent: neutron-tempest-plugin-designate-scenario
+    override-checkout: stable/stein
+    required-projects:
+      - openstack/devstack-gate
+      - openstack/neutron
+      - openstack/neutron-tempest-plugin
+      - name: openstack/designate-tempest-plugin
+        override-checkout: 0.7.0
+      - openstack/tempest
+    vars:
+      branch_override: stable/stein
+      network_api_extensions_common: *api_extensions
diff --git a/zuul.d/train_jobs.yaml b/zuul.d/train_jobs.yaml
new file mode 100644
index 0000000..f2dd6b7
--- /dev/null
+++ b/zuul.d/train_jobs.yaml
@@ -0,0 +1,151 @@
+- job:
+    name: neutron-tempest-plugin-api-train
+    parent: neutron-tempest-plugin-api
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      # TODO(slaweq): find a way to put this list of extensions in
+      # neutron repository and keep it different per branch,
+      # then it could be removed from here
+      network_api_extensions_common: &api_extensions
+        - address-scope
+        - agent
+        - allowed-address-pairs
+        - auto-allocated-topology
+        - availability_zone
+        - binding
+        - default-subnetpools
+        - dhcp_agent_scheduler
+        - dns-domain-ports
+        - dns-integration
+        - empty-string-filtering
+        - expose-port-forwarding-in-fip
+        - expose-l3-conntrack-helper
+        - ext-gw-mode
+        - external-net
+        - extra_dhcp_opt
+        - extraroute
+        - extraroute-atomic
+        - filter-validation
+        - fip-port-details
+        - flavors
+        - floating-ip-port-forwarding
+        - floatingip-pools
+        - ip-substring-filtering
+        - l3-conntrack-helper
+        - l3-flavors
+        - l3-ha
+        - l3_agent_scheduler
+        - logging
+        - metering
+        - multi-provider
+        - net-mtu
+        - net-mtu-writable
+        - network-ip-availability
+        - network_availability_zone
+        - network-segment-range
+        - pagination
+        - port-resource-request
+        - port-mac-address-regenerate
+        - port-security
+        - port-security-groups-filtering
+        - project-id
+        - provider
+        - qos
+        - qos-bw-minimum-ingress
+        - qos-fip
+        - quotas
+        - quota_details
+        - rbac-policies
+        - rbac-security-groups
+        - router
+        - router-admin-state-down-before-update
+        - router_availability_zone
+        - security-group
+        - segment
+        - service-type
+        - sorting
+        - standard-attr-description
+        - standard-attr-revisions
+        - standard-attr-segment
+        - standard-attr-tag
+        - standard-attr-timestamp
+        - subnet_allocation
+        - subnetpool-prefix-ops
+        - trunk
+        - trunk-details
+        - uplink-status-propagation
+      network_api_extensions_tempest:
+        - dvr
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-train
+    parent: neutron-tempest-plugin-scenario-openvswitch
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-train
+    parent: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-scenario-linuxbridge-train
+    parent: neutron-tempest-plugin-scenario-linuxbridge
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-dvr-multinode-scenario-train
+    parent: neutron-tempest-plugin-dvr-multinode-scenario
+    override-checkout: stable/train
+    vars:
+      network_api_extensions_common: *api_extensions
+      branch_override: stable/train
+
+- job:
+    name: neutron-tempest-plugin-designate-scenario-train
+    parent: neutron-tempest-plugin-designate-scenario
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions_common: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-sfc-train
+    parent: neutron-tempest-plugin-sfc
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions_common: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-bgpvpn-bagpipe-train
+    parent: neutron-tempest-plugin-bgpvpn-bagpipe
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-fwaas-train
+    parent: neutron-tempest-plugin-fwaas
+    override-checkout: stable/train
+    vars:
+      branch_override: stable/train
+      network_api_extensions_common: *api_extensions
diff --git a/zuul.d/ussuri_jobs.yaml b/zuul.d/ussuri_jobs.yaml
new file mode 100644
index 0000000..a9c369f
--- /dev/null
+++ b/zuul.d/ussuri_jobs.yaml
@@ -0,0 +1,171 @@
+- job:
+    name: neutron-tempest-plugin-api-ussuri
+    parent: neutron-tempest-plugin-api
+    override-checkout: stable/ussuri
+    vars:
+      branch_override: stable/ussuri
+      # TODO(slaweq): find a way to put this list of extensions in
+      # neutron repository and keep it different per branch,
+      # then it could be removed from here
+      network_api_extensions_common: &api_extensions
+        - address-scope
+        - agent
+        - allowed-address-pairs
+        - auto-allocated-topology
+        - availability_zone
+        - binding
+        - default-subnetpools
+        - dhcp_agent_scheduler
+        - dns-domain-ports
+        - dns-integration
+        - empty-string-filtering
+        - expose-port-forwarding-in-fip
+        - expose-l3-conntrack-helper
+        - ext-gw-mode
+        - external-net
+        - extra_dhcp_opt
+        - extraroute
+        - extraroute-atomic
+        - filter-validation
+        - fip-port-details
+        - flavors
+        - floating-ip-port-forwarding
+        - floatingip-pools
+        - ip-substring-filtering
+        - l3-conntrack-helper
+        - l3-flavors
+        - l3-ha
+        - l3_agent_scheduler
+        - logging
+        - metering
+        - multi-provider
+        - net-mtu
+        - net-mtu-writable
+        - network-ip-availability
+        - network_availability_zone
+        - network-segment-range
+        - pagination
+        - port-resource-request
+        - port-mac-address-regenerate
+        - port-security
+        - port-security-groups-filtering
+        - project-id
+        - provider
+        - qos
+        - qos-bw-minimum-ingress
+        - qos-fip
+        - quotas
+        - quota_details
+        - rbac-address-scope
+        - rbac-policies
+        - rbac-security-groups
+        - rbac-subnetpool
+        - router
+        - router-admin-state-down-before-update
+        - router_availability_zone
+        - security-group
+        - segment
+        - service-type
+        - sorting
+        - standard-attr-description
+        - standard-attr-revisions
+        - standard-attr-segment
+        - standard-attr-tag
+        - standard-attr-timestamp
+        - subnet_allocation
+        - subnet-dns-publish-fixed-ip
+        - subnetpool-prefix-ops
+        - tag-ports-during-bulk-creation
+        - trunk
+        - trunk-details
+        - uplink-status-propagation
+      network_api_extensions_tempest:
+        - dvr
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ (network_api_extensions_common + network_api_extensions_tempest) | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-ussuri
+    parent: neutron-tempest-plugin-scenario-openvswitch
+    override-checkout: stable/ussuri
+    vars:
+      branch_override: stable/ussuri
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid-ussuri
+    parent: neutron-tempest-plugin-scenario-openvswitch-iptables_hybrid
+    override-checkout: stable-ussuri
+    vars:
+      branch_override: stable-ussuri
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-scenario-linuxbridge-ussuri
+    parent: neutron-tempest-plugin-scenario-linuxbridge
+    override-checkout: stable/ussuri
+    vars:
+      branch_override: stable/ussuri
+      network_api_extensions: *api_extensions
+      devstack_localrc:
+        NETWORK_API_EXTENSIONS: "{{ network_api_extensions | join(',') }}"
+
+- job:
+    name: neutron-tempest-plugin-dvr-multinode-scenario-ussuri
+    parent: neutron-tempest-plugin-dvr-multinode-scenario
+    override-checkout: stable/ussuri
+    vars:
+      network_api_extensions_common: *api_extensions
+      branch_override: stable/ussuri
+
+- job:
+    name: neutron-tempest-plugin-designate-scenario-ussuri
+    parent: neutron-tempest-plugin-designate-scenario
+    override-checkout: stable/ussuri
+    vars:
+      branch_override: stable/ussuri
+      network_api_extensions_common: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-sfc-ussuri
+    parent: neutron-tempest-plugin-sfc
+    override-checkout: stable/ussuri
+    vars:
+      branch_override: stable/ussuri
+      network_api_extensions_common: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-bgpvpn-bagpipe-ussuri
+    parent: neutron-tempest-plugin-bgpvpn-bagpipe
+    override-checkout: stable/ussuri
+    vars:
+      branch_override: stable/ussuri
+      network_api_extensions: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-fwaas-ussuri
+    parent: neutron-tempest-plugin-fwaas
+    override-checkout: stable/ussuri
+    vars:
+      branch_override: stable/ussuri
+      network_api_extensions_common: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-dynamic-routing-ussuri
+    parent: neutron-tempest-plugin-dynamic-routing
+    override-checkout: stable/ussuri
+    vars:
+      branch_override: stable/ussuri
+      network_api_extensions_common: *api_extensions
+
+- job:
+    name: neutron-tempest-plugin-vpnaas-ussuri
+    parent: neutron-tempest-plugin-vpnaas
+    override-checkout: stable/ussuri
+    vars:
+      branch_override: stable/ussuri
+      network_api_extensions_common: *api_extensions