diff --git a/devstack/plugin.sh b/devstack/plugin.sh
index 1f666f2..10d13f6 100644
--- a/devstack/plugin.sh
+++ b/devstack/plugin.sh
@@ -18,8 +18,8 @@
             RBAC_TEST_ROLE="Member"
         fi
 
-        iniset $TEMPEST_CONFIG rbac enable_rbac True
-        iniset $TEMPEST_CONFIG rbac rbac_test_role $RBAC_TEST_ROLE
+        iniset $TEMPEST_CONFIG patrole enable_rbac True
+        iniset $TEMPEST_CONFIG patrole rbac_test_role $RBAC_TEST_ROLE
     fi
 }
 
diff --git a/doc/source/usage.rst b/doc/source/usage.rst
index dff43f2..14c2cc7 100644
--- a/doc/source/usage.rst
+++ b/doc/source/usage.rst
@@ -4,8 +4,8 @@
 Usage
 ========
 
-RBAC (API) Tests
-================
+Patrole (API) Tests
+===================
 
 If Patrole is installed correctly, then the RBAC tests can be executed
 from inside the tempest root directory as follows::
@@ -28,7 +28,7 @@
 ..
 
 To change the role that the patrole tests are being run as, edit
-``rbac_test_role`` in the ``rbac`` section of tempest.conf: ::
+``rbac_test_role`` in the ``patrole`` section of tempest.conf: ::
 
     [patrole]
     rbac_test_role = Member
diff --git a/etc/patrole.conf.sample b/etc/patrole.conf.sample
index 370ca8d..cafdf8a 100644
--- a/etc/patrole.conf.sample
+++ b/etc/patrole.conf.sample
@@ -14,11 +14,17 @@
 # Enables RBAC tests. (boolean value)
 #enable_rbac = true
 
-# If true, throws RbacParsingException for policies which
+# DEPRECATED: If true, throws RbacParsingException for policies which
 # don't exist or are not included in the service's policy file. If
 # false, throws
 # skipException. (boolean value)
-#strict_policy_check = false
+# This option is deprecated for removal.
+# Its value may be silently ignored in the future.
+# Reason: This option allows for the possibility
+# of false positives. As a testing framework, Patrole should fail any
+# test that
+# passes in an invalid policy.
+#strict_policy_check = true
 
 # List of the paths to search for policy files. Each
 # policy path assumes that the service name is included in the path
@@ -32,46 +38,6 @@
 #  (list value)
 #custom_policy_files = /etc/%s/policy.json
 
-# DEPRECATED: Location of the Cinder policy file. Assumed to be on
-# the same host as Patrole. (string value)
-# This option is deprecated for removal.
-# Its value may be silently ignored in the future.
-# Reason: It is better to use `custom_policy_files` which supports any
-# OpenStack service.
-#cinder_policy_file = /etc/cinder/policy.json
-
-# DEPRECATED: Location of the Glance policy file. Assumed to be on
-# the same host as Patrole. (string value)
-# This option is deprecated for removal.
-# Its value may be silently ignored in the future.
-# Reason: It is better to use `custom_policy_files` which supports any
-# OpenStack service.
-#glance_policy_file = /etc/glance/policy.json
-
-# DEPRECATED: Location of the custom Keystone policy file. Assumed to
-# be on the same host as Patrole. (string value)
-# This option is deprecated for removal.
-# Its value may be silently ignored in the future.
-# Reason: It is better to use `custom_policy_files` which supports any
-# OpenStack service.
-#keystone_policy_file = /etc/keystone/policy.json
-
-# DEPRECATED: Location of the Neutron policy file. Assumed to be on
-# the same host as Patrole. (string value)
-# This option is deprecated for removal.
-# Its value may be silently ignored in the future.
-# Reason: It is better to use `custom_policy_files` which supports any
-# OpenStack service.
-#neutron_policy_file = /etc/neutron/policy.json
-
-# DEPRECATED: Location of the custom Nova policy file. Assumed to be
-# on the same host as Patrole. (string value)
-# This option is deprecated for removal.
-# Its value may be silently ignored in the future.
-# Reason: It is better to use `custom_policy_files` which supports any
-# OpenStack service.
-#nova_policy_file = /etc/nova/policy.json
-
 #
 # This option determines whether Patrole should run against a
 # `custom_requirements_file` which defines RBAC requirements. The
@@ -146,131 +112,3 @@
 # is logged. This is combined withreport_log_name to generate the full
 # path. (string value)
 #report_log_path = .
-
-
-[rbac]
-# This group is deprecated and will be removed in the next release.
-# Use the [patrole] group instead.
-
-#
-# From patrole.config
-#
-
-# The current RBAC role against which to run Patrole
-# tests. (string value)
-#rbac_test_role = admin
-
-# Enables RBAC tests. (boolean value)
-#enable_rbac = true
-
-# If true, throws RbacParsingException for policies which
-# don't exist or are not included in the service's policy file. If
-# false, throws
-# skipException. (boolean value)
-#strict_policy_check = false
-
-# List of the paths to search for policy files. Each
-# policy path assumes that the service name is included in the path
-# once. Also
-# assumes Patrole is on the same host as the policy files. The paths
-# should be
-# ordered by precedence, with high-priority paths before low-priority
-# paths. The
-# first path that is found to contain the service's policy file will
-# be used.
-#  (list value)
-#custom_policy_files = /etc/%s/policy.json
-
-# DEPRECATED: Location of the Cinder policy file. Assumed to be on
-# the same host as Patrole. (string value)
-# This option is deprecated for removal.
-# Its value may be silently ignored in the future.
-# Reason: It is better to use `custom_policy_files` which supports any
-# OpenStack service.
-#cinder_policy_file = /etc/cinder/policy.json
-
-# DEPRECATED: Location of the Glance policy file. Assumed to be on
-# the same host as Patrole. (string value)
-# This option is deprecated for removal.
-# Its value may be silently ignored in the future.
-# Reason: It is better to use `custom_policy_files` which supports any
-# OpenStack service.
-#glance_policy_file = /etc/glance/policy.json
-
-# DEPRECATED: Location of the custom Keystone policy file. Assumed to
-# be on the same host as Patrole. (string value)
-# This option is deprecated for removal.
-# Its value may be silently ignored in the future.
-# Reason: It is better to use `custom_policy_files` which supports any
-# OpenStack service.
-#keystone_policy_file = /etc/keystone/policy.json
-
-# DEPRECATED: Location of the Neutron policy file. Assumed to be on
-# the same host as Patrole. (string value)
-# This option is deprecated for removal.
-# Its value may be silently ignored in the future.
-# Reason: It is better to use `custom_policy_files` which supports any
-# OpenStack service.
-#neutron_policy_file = /etc/neutron/policy.json
-
-# DEPRECATED: Location of the custom Nova policy file. Assumed to be
-# on the same host as Patrole. (string value)
-# This option is deprecated for removal.
-# Its value may be silently ignored in the future.
-# Reason: It is better to use `custom_policy_files` which supports any
-# OpenStack service.
-#nova_policy_file = /etc/nova/policy.json
-
-#
-# This option determines whether Patrole should run against a
-# `custom_requirements_file` which defines RBAC requirements. The
-# purpose of setting this flag to True is to verify that RBAC policy
-# is in accordance to requirements. The idea is that the
-# `custom_requirements_file` perfectly defines what the RBAC
-# requirements are.
-#
-# Here are the possible outcomes when running the Patrole tests
-# against
-# a `custom_requirements_file`:
-#
-# YAML definition: allowed
-# test run: allowed
-# test result: pass
-#
-# YAML definition: allowed
-# test run: not allowed
-# test result: fail (under-permission)
-#
-# YAML definition: not allowed
-# test run: allowed
-# test result: fail (over-permission)
-#  (boolean value)
-#test_custom_requirements = false
-
-#
-# File path of the yaml file that defines your RBAC requirements. This
-# file must be located on the same host that Patrole runs on. The yaml
-# file should be written as follows:
-#
-# ```
-# <service>:
-#   <api_action>:
-#     - <allowed_role>
-#     - <allowed_role>
-#     - <allowed_role>
-#   <api_action>:
-#     - <allowed_role>
-#     - <allowed_role>
-# <service>
-#   <api_action>:
-#     - <allowed_role>
-# ```
-# Where:
-# service = the service that is being tested (cinder, nova, etc)
-# api_action = the policy action that is being tested. Examples:
-#              - volume:create
-#              - os_compute_api:servers:start
-#              - add_image
-# allowed_role = the Keystone role that is allowed to perform the API
-#  (string value)
-#custom_requirements_file = <None>
diff --git a/patrole_tempest_plugin/config.py b/patrole_tempest_plugin/config.py
index 7966247..8ac2a20 100644
--- a/patrole_tempest_plugin/config.py
+++ b/patrole_tempest_plugin/config.py
@@ -22,16 +22,13 @@
 PatroleGroup = [
     cfg.StrOpt('rbac_test_role',
                default='admin',
-               deprecated_group='rbac',
                help="""The current RBAC role against which to run Patrole
 tests."""),
     cfg.BoolOpt('enable_rbac',
                 default=True,
-                deprecated_group='rbac',
                 help="Enables RBAC tests."),
     cfg.BoolOpt('strict_policy_check',
                 default=True,
-                deprecated_group='rbac',
                 deprecated_for_removal=True,
                 deprecated_reason="""This option allows for the possibility
 of false positives. As a testing framework, Patrole should fail any test that
@@ -43,7 +40,6 @@
     # other hosts. It may be possible to leverage the v3 identity policy API.
     cfg.ListOpt('custom_policy_files',
                 default=['/etc/%s/policy.json'],
-                deprecated_group='rbac',
                 help="""List of the paths to search for policy files. Each
 policy path assumes that the service name is included in the path once. Also
 assumes Patrole is on the same host as the policy files. The paths should be
@@ -52,7 +48,6 @@
 """),
     cfg.BoolOpt('test_custom_requirements',
                 default=False,
-                deprecated_group='rbac',
                 help="""
 This option determines whether Patrole should run against a
 `custom_requirements_file` which defines RBAC requirements. The
@@ -76,7 +71,6 @@
 test result: fail (over-permission)
 """),
     cfg.StrOpt('custom_requirements_file',
-               deprecated_group='rbac',
                help="""
 File path of the yaml file that defines your RBAC requirements. This
 file must be located on the same host that Patrole runs on. The yaml
@@ -106,12 +100,6 @@
 ]
 
 
-rbac_group = cfg.OptGroup(name='rbac',
-                          title='RBAC testing options',
-                          help="This group is deprecated and will be removed "
-                               "in the next release. Use the [patrole] group "
-                               "instead.")
-
 patrole_log_group = cfg.OptGroup(
     name='patrole_log', title='Patrole Logging Options')
 
@@ -141,8 +129,7 @@
     """
     opt_list = [
         (patrole_group, PatroleGroup),
-        (patrole_log_group, PatroleLogGroup),
-        (rbac_group, PatroleGroup)
+        (patrole_log_group, PatroleLogGroup)
     ]
 
     return opt_list
diff --git a/patrole_tempest_plugin/plugin.py b/patrole_tempest_plugin/plugin.py
index b7717ea..a214892 100644
--- a/patrole_tempest_plugin/plugin.py
+++ b/patrole_tempest_plugin/plugin.py
@@ -62,12 +62,6 @@
         RBACLOG.addHandler(rbac_report_handler)
 
     def register_opts(self, conf):
-        # TODO(fmontei): Remove ``rbac_group`` in a future release as it is
-        # currently deprecated.
-        config.register_opt_group(
-            conf,
-            project_config.rbac_group,
-            project_config.PatroleGroup)
         config.register_opt_group(
             conf,
             project_config.patrole_group,
diff --git a/patrole_tempest_plugin/rbac_utils.py b/patrole_tempest_plugin/rbac_utils.py
index 9fa3740..2bb9eed 100644
--- a/patrole_tempest_plugin/rbac_utils.py
+++ b/patrole_tempest_plugin/rbac_utils.py
@@ -107,7 +107,7 @@
             # passing the second boundary before attempting to authenticate.
             # Only sleep if a token revocation occurred as a result of role
             # switching. This will optimize test runtime in the case where
-            # ``[identity] admin_role`` == ``[rbac] rbac_test_role``.
+            # ``[identity] admin_role`` == ``[patrole] rbac_test_role``.
             if not role_already_present:
                 time.sleep(1)
             test_obj.os_primary.auth_provider.set_auth()
diff --git a/patrole_tempest_plugin/tests/api/volume/test_groups_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_groups_rbac.py
index 236e927..e1c0910 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_groups_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_groups_rbac.py
@@ -27,6 +27,14 @@
     min_microversion = '3.14'
     max_microversion = 'latest'
 
+    credentials = ['primary', 'admin']
+
+    @classmethod
+    def setup_clients(cls):
+        super(GroupsV3RbacTest, cls).setup_clients()
+        cls.admin_groups_client = cls.os_admin.groups_v3_client
+        cls.admin_volumes_client = cls.os_admin.volumes_v3_client
+
     def setUp(self):
         super(GroupsV3RbacTest, self).setUp()
         self.volume_type_id = self.create_volume_type()['id']
@@ -37,20 +45,25 @@
             self.__class__.__name__ + '-Group')
         group = self.groups_client.create_group(name=group_name, **kwargs)[
             'group']
-        waiters.wait_for_volume_resource_status(
-            self.groups_client, group['id'], 'available')
-
         if ignore_notfound:
             self.addCleanup(test_utils.call_and_ignore_notfound_exc,
                             self._delete_group, group['id'])
         else:
             self.addCleanup(self._delete_group, group['id'])
-
+        waiters.wait_for_volume_resource_status(
+            self.admin_groups_client, group['id'], 'available')
         return group
 
-    def _delete_group(self, group_id, delete_volumes=True):
-        self.groups_client.delete_group(group_id, delete_volumes)
-        self.groups_client.wait_for_resource_deletion(group_id)
+    def _delete_group(self, group_id):
+        self.groups_client.delete_group(group_id, delete_volumes=True)
+        self.admin_groups_client.wait_for_resource_deletion(group_id)
+
+        vols = self.admin_volumes_client.list_volumes(
+            detail=True, params={'all_tenants': True})['volumes']
+        for vol in vols:
+            if vol['group_id'] == group_id:
+                self.admin_volumes_client.wait_for_resource_deletion(
+                    vol['id'])
 
     @decorators.idempotent_id('43235328-66ae-424f-bc7f-f709c0ca268c')
     @rbac_rule_validation.action(
@@ -111,7 +124,7 @@
                                    volume_types=[self.volume_type_id])
 
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.groups_client.delete_group(group['id'])
+        self._delete_group(group['id'])
 
 
 class GroupTypesV3RbacTest(rbac_base.BaseVolumeRbacTest):
diff --git a/patrole_tempest_plugin/tests/api/volume/test_volume_metadata_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_volume_metadata_rbac.py
index 671ac19..5866934 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_volume_metadata_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_volume_metadata_rbac.py
@@ -14,6 +14,7 @@
 #    under the License.
 
 from tempest import config
+from tempest.lib.common.utils import test_utils
 from tempest.lib import decorators
 
 from patrole_tempest_plugin import rbac_rule_validation
@@ -66,17 +67,6 @@
         self.volumes_client.delete_volume_metadata_item(self.volume['id'],
                                                         "key1")
 
-    @decorators.idempotent_id('a41c8eed-2051-4a25-b401-df036faacbdc')
-    @rbac_rule_validation.action(
-        service="cinder",
-        rule="volume:delete_volume_metadata")
-    def test_delete_volume_image_metadata(self):
-        self.volumes_client.update_volume_image_metadata(
-            self.volume['id'], image_id=self.image_id)
-        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.volumes_client.delete_volume_image_metadata(self.volume['id'],
-                                                         'image_id')
-
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume:update_volume_metadata")
     @decorators.idempotent_id('8ce2ff80-99ba-49ae-9bb1-7e96729ee5af')
@@ -98,8 +88,25 @@
     @decorators.idempotent_id('a9d9e825-5ea3-42e6-96f3-7ac4e97b2ed0')
     @rbac_rule_validation.action(
         service="cinder",
-        rule="volume:update_volume_metadata")
+        rule="volume_extension:volume_image_metadata")
     def test_update_volume_image_metadata(self):
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
         self.volumes_client.update_volume_image_metadata(
             self.volume['id'], image_id=self.image_id)
+        self.addCleanup(self.volumes_client.delete_volume_image_metadata,
+                        self.volume['id'], 'image_id')
+
+    @decorators.idempotent_id('a41c8eed-2051-4a25-b401-df036faacbdc')
+    @rbac_rule_validation.action(
+        service="cinder",
+        rule="volume_extension:volume_image_metadata")
+    def test_delete_volume_image_metadata(self):
+        self.volumes_client.update_volume_image_metadata(
+            self.volume['id'], image_id=self.image_id)
+        self.addCleanup(test_utils.call_and_ignore_notfound_exc,
+                        self.volumes_client.delete_volume_image_metadata,
+                        self.volume['id'], 'image_id')
+
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.volumes_client.delete_volume_image_metadata(self.volume['id'],
+                                                         'image_id')
diff --git a/patrole_tempest_plugin/tests/api/volume/test_volume_quotas_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_volume_quotas_rbac.py
index 01f8203..6a79345 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_volume_quotas_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_volume_quotas_rbac.py
@@ -18,6 +18,9 @@
 from patrole_tempest_plugin import rbac_rule_validation
 from patrole_tempest_plugin.tests.api.volume import rbac_base
 
+QUOTA_KEYS = ['gigabytes', 'snapshots', 'volumes', 'backups',
+              'backup_gigabytes', 'per_volume_gigabytes']
+
 
 class VolumeQuotasV3RbacTest(rbac_base.BaseVolumeRbacTest):
 
@@ -31,23 +34,56 @@
         super(VolumeQuotasV3RbacTest, cls).setup_clients()
         cls.quotas_client = cls.os_primary.volume_quotas_v2_client
 
+    def _restore_default_quota_set(self):
+        default_quota_set = self.quotas_client.show_default_quota_set(
+            self.demo_tenant_id)['quota_set']
+        cleanup_quota_set = dict(
+            (k, v) for k, v in default_quota_set.items()
+            if k in QUOTA_KEYS)
+        self.addCleanup(self.quotas_client.update_quota_set,
+                        self.demo_tenant_id, **cleanup_quota_set)
+
+    @decorators.idempotent_id('427c9f0c-982e-403d-ae45-c05f4d6322ff')
+    @rbac_rule_validation.action(service="cinder",
+                                 rule="volume_extension:quotas:show")
+    def test_list_quotas(self):
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.quotas_client.show_quota_set(self.demo_tenant_id)
+
+    @decorators.idempotent_id('e47cf444-2753-4983-be6d-fc0d6523720f')
+    @rbac_rule_validation.action(service="cinder",
+                                 rule="volume_extension:quotas:show")
+    def test_list_quotas_usage_true(self):
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.quotas_client.show_quota_set(self.demo_tenant_id,
+                                          params={'usage': True})
+
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume_extension:quotas:show")
     @decorators.idempotent_id('b3c7177e-b6b1-4d0f-810a-fc95606964dd')
     def test_list_default_quotas(self):
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
         self.quotas_client.show_default_quota_set(
-            self.demo_tenant_id)['quota_set']
+            self.demo_tenant_id)
 
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume_extension:quotas:update")
     @decorators.idempotent_id('60f8f421-1630-4953-b449-b22af32265c7')
-    def test_update_all_quota_resources_for_tenant(self):
+    def test_update_quota_set(self):
+        self._restore_default_quota_set()
         new_quota_set = {'gigabytes': 1009,
                          'volumes': 11,
                          'snapshots': 11}
-        # Update limits for all quota resources
+        # Update limits for all quota resources.
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
         self.quotas_client.update_quota_set(
-            self.demo_tenant_id,
-            **new_quota_set)['quota_set']
+            self.demo_tenant_id, **new_quota_set)
+
+    @decorators.idempotent_id('329bdb88-5132-4810-b1fc-350d181577e3')
+    @rbac_rule_validation.action(service="cinder",
+                                 rule="volume_extension:quotas:delete")
+    def test_delete_quota_set(self):
+        self._restore_default_quota_set()
+
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.quotas_client.delete_quota_set(self.demo_tenant_id)
diff --git a/patrole_tempest_plugin/tests/unit/test_patrole.py b/patrole_tempest_plugin/tests/unit/test_patrole.py
deleted file mode 100644
index 9b8e88c..0000000
--- a/patrole_tempest_plugin/tests/unit/test_patrole.py
+++ /dev/null
@@ -1,36 +0,0 @@
-# Copyright 2017 AT&T Corporation.
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-"""
-Tests for `patrole` module.
-"""
-
-from tempest import config
-
-from patrole_tempest_plugin.tests.unit import base
-
-CONF = config.CONF
-
-
-class TestPatrole(base.TestCase):
-
-    def test_rbac_group_backwards_compatability(self):
-        """Validate that the deprecated group [rbac] is available and has the
-        same options and option values as [patrole] group, which is current.
-        """
-        self.assertTrue(hasattr(CONF, 'patrole'))
-        self.assertTrue(hasattr(CONF, 'rbac'))
-        # Validate that both groups are identical.
-        self.assertEqual(CONF.patrole.items(), CONF.rbac.items())
diff --git a/releasenotes/notes/remove-rbac-config-group-097c200f3db99fad.yaml b/releasenotes/notes/remove-rbac-config-group-097c200f3db99fad.yaml
new file mode 100644
index 0000000..fba7dd3
--- /dev/null
+++ b/releasenotes/notes/remove-rbac-config-group-097c200f3db99fad.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    The ``[rbac]`` config group has been removed. Use the ``[patrole]`` group
+    instead which contains the exact same options.