diff --git a/HACKING.rst b/HACKING.rst
index dbb758b..e5f45ac 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -2,7 +2,7 @@
 ====================
 
 - Step 1: Read the OpenStack Style Commandments
-  http://docs.openstack.org/developer/hacking/
+  https://docs.openstack.org/hacking/latest/
 - Step 2: Read on
 
 Tempest Specific Commandments
@@ -102,20 +102,20 @@
 Service Tagging
 ---------------
 Service tagging is used to specify which services are exercised by a particular
-test method. You specify the services with the tempest.test.services decorator.
-For example:
+test method. You specify the services with the ``tempest.test.services``
+decorator. For example:
 
 @services('compute', 'image')
 
 Valid service tag names are the same as the list of directories in tempest.api
 that have tests.
 
-For scenario tests having a service tag is required. For the api tests service
-tags are only needed if the test method makes an api call (either directly or
+For scenario tests having a service tag is required. For the API tests service
+tags are only needed if the test method makes an API call (either directly or
 indirectly through another service) that differs from the parent directory
-name. For example, any test that make an api call to a service other than nova
-in tempest.api.compute would require a service tag for those services, however
-they do not need to be tagged as compute.
+name. For example, any test that make an API call to a service other than Nova
+in ``tempest.api.compute`` would require a service tag for those services,
+however they do not need to be tagged as ``compute``.
 
 Test fixtures and resources
 ---------------------------
@@ -198,7 +198,7 @@
 Test skips because of Known Bugs
 --------------------------------
 If a test is broken because of a bug it is appropriate to skip the test until
-bug has been fixed. You should use the skip_because decorator so that
+bug has been fixed. You should use the ``skip_because`` decorator so that
 Tempest's skip tracking tool can watch the bug status.
 
 Example::
@@ -229,7 +229,7 @@
   require admin privileges are outside of projects.
 
 - Races between methods in the same class are not a problem because
-  parallelization in tempest is at the test class level, but if there is a json
+  parallelization in Tempest is at the test class level, but if there is a json
   and xml version of the same test class there could still be a race between
   methods.
 
@@ -238,8 +238,8 @@
   avoided to prevent resource conflicts.
 
 - If the execution of a set of tests is required to be serialized then locking
-  can be used to perform this. See AggregatesAdminTest in
-  tempest.api.compute.admin for an example of using locking.
+  can be used to perform this. See usage of ``LockFixture`` for examples of
+  using locking.
 
 Sample Configuration File
 -------------------------
@@ -251,7 +251,7 @@
 
 Unit Tests
 ----------
-Unit tests are a separate class of tests in tempest. They verify tempest
+Unit tests are a separate class of tests in Tempest. They verify Tempest
 itself, and thus have a different set of guidelines around them:
 
 1. They can not require anything running externally. All you should need to
@@ -321,8 +321,8 @@
 
 Tempest.lib includes a ``check-uuid`` tool that will test for the existence
 and uniqueness of idempotent_id metadata for every test. If you have
-tempest installed you run the tool against Tempest by calling from the
-tempest repo::
+Tempest installed you run the tool against Tempest by calling from the
+Tempest repo::
 
     check-uuid
 
@@ -337,7 +337,7 @@
 
     check-uuid --fix
 
-The ``check-uuid`` tool is used as part of the tempest gate job
+The ``check-uuid`` tool is used as part of the Tempest gate job
 to ensure that all tests have an ``idempotent_id`` decorator.
 
 Branchless Tempest Considerations
@@ -350,7 +350,7 @@
 proposed commits to Tempest must work against both the master and all the
 currently supported stable branches of the projects. As such there are a few
 special considerations that have to be accounted for when pushing new changes
-to tempest.
+to Tempest.
 
 1. New Tests for new features
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
@@ -370,14 +370,22 @@
 When trying to land a bug fix which changes a tested API you'll have to use the
 following procedure::
 
-    - Propose change to the project, get a +2 on the change even with failing
-    - Propose skip on Tempest which will only be approved after the
+    1. Propose change to the project, get a +2 on the change even with failing
+    2. Propose skip on Tempest which will only be approved after the
       corresponding change in the project has a +2 on change
-    - Land project change in master and all open stable branches (if required)
-    - Land changed test in Tempest
+    3. Land project change in master and all open stable branches (if required)
+    4. Land changed test in Tempest
 
 Otherwise the bug fix won't be able to land in the project.
 
+Handily, `Zuul’s cross-repository dependencies
+<https://docs.openstack.org/infra/zuul/gating.html#cross-repository-dependencies>`_.
+can be leveraged to do without step 2 and to have steps 3 and 4 happen
+"atomically". To do that, make the patch written in step 1 to depend (refer to
+Zuul's documentation above) on the patch written in step 4. The commit message
+for the Tempest change should have a link to the Gerrit review that justifies
+that change.
+
 3. New Tests for existing features
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
diff --git a/README.rst b/README.rst
index ac93992..2e13fec 100644
--- a/README.rst
+++ b/README.rst
@@ -11,7 +11,7 @@
 ==============================================
 
 The documentation for Tempest is officially hosted at:
-http://docs.openstack.org/developer/tempest/
+https://docs.openstack.org/tempest/latest/
 
 This is a set of integration tests to be run against a live OpenStack
 cluster. Tempest has batteries of tests for OpenStack API validation,
@@ -23,7 +23,7 @@
 Tempest Design Principles that we strive to live by.
 
 - Tempest should be able to run against any OpenStack cloud, be it a
-  one node devstack install, a 20 node lxc cloud, or a 1000 node kvm
+  one node DevStack install, a 20 node LXC cloud, or a 1000 node KVM
   cloud.
 - Tempest should be explicit in testing features. It is easy to auto
   discover features of a cloud incorrectly, and give people an
@@ -65,13 +65,13 @@
     $ pip install tempest/
 
    This can be done within a venv, but the assumption for this guide is that
-   the Tempest cli entry point will be in your shell's PATH.
+   the Tempest CLI entry point will be in your shell's PATH.
 
-#. Installing Tempest may create a /etc/tempest dir, however if one isn't
-   created you can create one or use ~/.tempest/etc or ~/.config/tempest in
-   place of /etc/tempest. If none of these dirs are created tempest will create
-   ~/.tempest/etc when it's needed. The contents of this dir will always
-   automatically be copied to all etc/ dirs in local workspaces as an initial
+#. Installing Tempest may create a ``/etc/tempest dir``, however if one isn't
+   created you can create one or use ``~/.tempest/etc`` or ``~/.config/tempest`` in
+   place of ``/etc/tempest``. If none of these dirs are created Tempest will create
+   ``~/.tempest/etc`` when it's needed. The contents of this dir will always
+   automatically be copied to all ``etc/`` dirs in local workspaces as an initial
    setup step. So if there is any common configuration you'd like to be shared
    between local Tempest workspaces it's recommended that you pre-populate it
    before running ``tempest init``.
@@ -90,12 +90,12 @@
    is that you'll create a new working directory for each to maintain separate
    configuration files and local artifact storage for each.
 
-#. Then cd into the newly created working dir and also modify the local
-   config files located in the etc/ subdir created by the ``tempest init``
-   command. Tempest is expecting a tempest.conf file in etc/ so if only a
+#. Then ``cd`` into the newly created working dir and also modify the local
+   config files located in the ``etc/`` subdir created by the ``tempest init``
+   command. Tempest is expecting a ``tempest.conf`` file in etc/ so if only a
    sample exists you must rename or copy it to tempest.conf before making
    any changes to it otherwise Tempest will not know how to load it. For
-   details on configuring tempest refer to the :ref:`tempest-configuration`.
+   details on configuring Tempest refer to the :ref:`tempest-configuration`.
 
 #. Once the configuration is done you're now ready to run Tempest. This can
    be done using the :ref:`tempest_run` command. This can be done by either
@@ -117,15 +117,15 @@
    will run the same set of tests as the default gate jobs.
 
 .. _testr: https://testrepository.readthedocs.org/en/latest/MANUAL.html
-.. _ostestr: http://docs.openstack.org/developer/os-testr/
+.. _ostestr: https://docs.openstack.org/os-testr/latest/
 
 Library
 -------
 Tempest exposes a library interface. This interface is a stable interface and
 should be backwards compatible (including backwards compatibility with the
 old tempest-lib package, with the exception of the import). If you plan to
-directly consume tempest in your project you should only import code from the
-tempest library interface, other pieces of tempest do not have the same
+directly consume Tempest in your project you should only import code from the
+Tempest library interface, other pieces of Tempest do not have the same
 stable interface and there are no guarantees on the Python API unless otherwise
 stated.
 
@@ -137,7 +137,7 @@
 shows what changes have been released on each version.
 
 Tempest's released versions are broken into 2 sets of information. Depending on
-how you intend to consume tempest you might need
+how you intend to consume Tempest you might need
 
 The version is a set of 3 numbers:
 
@@ -146,12 +146,12 @@
 While this is almost `semver`_ like, the way versioning is handled is slightly
 different:
 
-X is used to represent the supported OpenStack releases for tempest tests
-in-tree, and to signify major feature changes to tempest. It's a monotonically
+X is used to represent the supported OpenStack releases for Tempest tests
+in-tree, and to signify major feature changes to Tempest. It's a monotonically
 increasing integer where each version either indicates a new supported OpenStack
 release, the drop of support for an OpenStack release (which will coincide with
 the upstream stable branch going EOL), or a major feature lands (or is removed)
-from tempest.
+from Tempest.
 
 Y.Z is used to represent library interface changes. This is treated the same
 way as minor and patch versions from `semver`_ but only for the library
@@ -166,16 +166,16 @@
 
 Detailed configuration of Tempest is beyond the scope of this
 document see :ref:`tempest-configuration` for more details on configuring
-Tempest. The etc/tempest.conf.sample attempts to be a self-documenting version
-of the configuration.
+Tempest. The ``etc/tempest.conf.sample`` attempts to be a self-documenting
+version of the configuration.
 
 You can generate a new sample tempest.conf file, run the following
 command from the top level of the Tempest directory::
 
     $ tox -e genconfig
 
-The most important pieces that are needed are the user ids, openstack
-endpoint, and basic flavors and images needed to run tests.
+The most important pieces that are needed are the user ids, OpenStack
+endpoints, and basic flavors and images needed to run tests.
 
 Unit Tests
 ----------
@@ -190,13 +190,13 @@
 is OS_TEST_PATH=./tempest/test_discover which will only run test discover on the
 Tempest suite.
 
-Alternatively, there are the py27 and py34 tox jobs which will run the unit
+Alternatively, there are the py27 and py35 tox jobs which will run the unit
 tests with the corresponding version of python.
 
 Python 2.6
 ----------
 
-Starting in the kilo release the OpenStack services dropped all support for
+Starting in the Kilo release the OpenStack services dropped all support for
 python 2.6. This change has been mirrored in Tempest, starting after the
 tempest-2 tag. This means that proposed changes to Tempest which only fix
 python 2.6 compatibility will be rejected, and moving forward more features not
@@ -208,8 +208,8 @@
 Python 3.x
 ----------
 
-Starting during the Pike cycle Tempest has a gating CI job that runs tempest
-with Python 3. Any tempest release after 15.0.0 should fully support running
+Starting during the Pike cycle Tempest has a gating CI job that runs Tempest
+with Python 3. Any Tempest release after 15.0.0 should fully support running
 under Python 3 as well as Python 2.7.
 
 Legacy run method
@@ -239,10 +239,10 @@
 
 .. note::
 
-    If you have a running devstack environment, Tempest will be
+    If you have a running DevStack environment, Tempest will be
     automatically configured and placed in ``/opt/stack/tempest``. It
     will have a configuration file already set up to work with your
-    devstack installation.
+    DevStack installation.
 
 Tempest is not tied to any single test runner, but `testr`_ is the most commonly
 used tool. Also, the nosetests test runner is **not** recommended to run Tempest.
diff --git a/REVIEWING.rst b/REVIEWING.rst
index 9b272bb..7d28320 100644
--- a/REVIEWING.rst
+++ b/REVIEWING.rst
@@ -21,6 +21,15 @@
 to a Gerrit review.
 
 
+Execution time
+--------------
+While checking in the job logs that a new test is actually executed, also
+pay attention to the execution time of that test. Keep in mind that each test
+is going to be executed hundreds of time each day, because Tempest tests
+run in many OpenStack projects. It's worth considering how important/critical
+the feature under test is with how costly the new test is.
+
+
 Unit Tests
 ----------
 
@@ -48,6 +57,17 @@
 abstract the duplicated code into a function or method.
 
 
+Tests overlap
+-------------
+When a new test is being proposed, question whether this feature is not already
+tested with Tempest. Tempest has more than 1200 tests, spread amongst many
+directories, so it's easy to introduce test duplication. For example, testing
+volume attachment to a server could be a compute test or a volume test, depending
+on how you see it. So one must look carefully in the entire code base for possible
+overlap. As a rule of thumb, the older a feature is, the more likely it's
+already tested.
+
+
 Being explicit
 --------------
 When tests are being added that depend on a configurable feature or extension,
@@ -60,8 +80,8 @@
 
 Configuration Options
 ---------------------
-With the introduction of the tempest external test plugin interface we needed
-to provide a stable contract for tempest's configuration options. This means
+With the introduction of the Tempest external test plugin interface we needed
+to provide a stable contract for Tempest's configuration options. This means
 we can no longer simply remove a configuration option when it's no longer used.
 Patches proposed that remove options without a deprecation cycle should not
 be approved. Similarly when changing default values with configuration we need
@@ -91,7 +111,7 @@
 anything backwards incompatible or would require a user to take note or do
 something extra.
 
-.. _reno: http://docs.openstack.org/developer/reno/
+.. _reno: https://docs.openstack.org/reno/latest/
 
 Deprecated Code
 ---------------
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 4accd94..8f2865a 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -28,7 +28,7 @@
 - Run tests for admin APIs
 - Generate test credentials on the fly (see `Dynamic Credentials`_)
 
-When keystone uses a policy that requires domain scoped tokens for admin
+When Keystone uses a policy that requires domain scoped tokens for admin
 actions, the flag ``admin_domain_scope`` must be set to ``True``.
 The admin user configured, if any, must have a role assigned to the domain to
 be usable.
@@ -39,7 +39,7 @@
 number of users available to run tests with.
 You can specify the location of the file in the ``auth`` section in the
 tempest.conf file. To see the specific format used in the file please refer to
-the accounts.yaml.sample file included in Tempest.
+the ``accounts.yaml.sample`` file included in Tempest.
 
 Keystone Connection Info
 ^^^^^^^^^^^^^^^^^^^^^^^^
@@ -47,18 +47,17 @@
 to provide it with information about how it communicates with keystone.
 This involves configuring the following options in the ``identity`` section:
 
- #. ``auth_version``
- #. ``uri``
- #. ``uri_v3``
+ - ``auth_version``
+ - ``uri``
+ - ``uri_v3``
 
 The ``auth_version`` option is used to tell Tempest whether it should be using
-keystone's v2 or v3 api for communicating with keystone. The two uri options are
+Keystone's v2 or v3 api for communicating with Keystone. The two uri options are
 used to tell Tempest the url of the keystone endpoint. The ``uri`` option is
-used for keystone v2 request and ``uri_v3`` is used for keystone v3. You want to
+used for Keystone v2 request and ``uri_v3`` is used for Keystone v3. You want to
 ensure that which ever version you set for ``auth_version`` has its uri option
 defined.
 
-
 Credential Provider Mechanisms
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
@@ -95,7 +94,7 @@
 When the ``admin_domain_scope`` option is set to ``True``, provisioned admin
 accounts will be assigned a role on domain configured in
 ``default_credentials_domain_name``. This will make the accounts provisioned
-usable in a cloud where domain scoped tokens are required by keystone for
+usable in a cloud where domain scoped tokens are required by Keystone for
 admin operations. Note that the initial pre-provision admin accounts,
 configured in tempest.conf, must have a role on the same domain as well, for
 Dynamic Credentials to work.
@@ -140,10 +139,10 @@
 tenants it's using are empty and may sporadically fail if there are unexpected
 resources present.
 
-When the keystone in the target cloud requires domain scoped tokens to
+When the Keystone in the target cloud requires domain scoped tokens to
 perform admin actions, all pre-provisioned admin users must have a role
 assigned on the domain where test accounts a provisioned.
-The option ``admin_domain_scope`` is used to tell tempest that domain scoped
+The option ``admin_domain_scope`` is used to tell Tempest that domain scoped
 tokens shall be used. ``default_credentials_domain_name`` is the domain where
 test accounts are expected to be provisioned if no domain is specified.
 
@@ -167,7 +166,7 @@
  #. ``flavor_ref_alt``
 
 Both of these options are in the ``compute`` section of the config file and take
-in the flavor id (not the name) from nova. The ``flavor_ref`` option is what
+in the flavor id (not the name) from Nova. The ``flavor_ref`` option is what
 will be used for booting almost all of the guests; ``flavor_ref_alt`` is only
 used in tests where two different-sized servers are required (for example, a
 resize test).
@@ -185,7 +184,7 @@
  #. ``image_ref``
  #. ``image_ref_alt``
 
-Both options are expecting an image id (not name) from nova. The ``image_ref``
+Both options are expecting an image id (not name) from Nova. The ``image_ref``
 option is what will be used for booting the majority of servers in Tempest.
 ``image_ref_alt`` is used for tests that require two images such as rebuild. If
 two images are not available you can set both options to the same image id and
@@ -224,7 +223,7 @@
 Networking
 ----------
 OpenStack has a myriad of different networking configurations possible and
-depending on which of the two network backends, nova-network or neutron, you are
+depending on which of the two network backends, nova-network or Neutron, you are
 using things can vary drastically. Due to this complexity Tempest has to provide
 a certain level of flexibility in its configuration to ensure it will work
 against any cloud. This ends up causing a large number of permutations in
@@ -302,21 +301,21 @@
 server with multiple networks. If this is not the case for your cloud then using
 an accounts file is recommended because it provides the necessary flexibility to
 describe your configuration. Dynamic credentials is not able to dynamically
-allocate things as necessary if neutron is not enabled.
+allocate things as necessary if Neutron is not enabled.
 
-With neutron and dynamic credentials enabled there should not be any additional
+With Neutron and dynamic credentials enabled there should not be any additional
 configuration necessary to enable Tempest to create servers with working
 networking, assuming you have properly configured the ``network`` section to
-work for your cloud. Tempest will dynamically create the neutron resources
+work for your cloud. Tempest will dynamically create the Neutron resources
 necessary to enable using servers with that network. Also, just as with the
-accounts file, if you specify a fixed network name while using neutron and
+accounts file, if you specify a fixed network name while using Neutron and
 dynamic credentials it will enable running tests which require a static network
 and it will additionally be used as a fallback for server creation. However,
 unlike accounts.yaml this should never be triggered.
 
 However, there is an option ``create_isolated_networks`` to disable dynamic
 credentials's automatic provisioning of network resources. If this option is set
-to False you will have to either rely on there only being a single/default
+to ``False`` you will have to either rely on there only being a single/default
 network available for the server creation, or use ``fixed_network_name`` to
 inform Tempest which network to use.
 
@@ -336,16 +335,16 @@
 
 The ``run_validation`` is used to enable or disable ssh connectivity for
 all tests (with the exception of scenario tests which do not have a flag for
-enabling or disabling ssh) To enable ssh connectivity this needs be set to ``true``.
+enabling or disabling ssh) To enable ssh connectivity this needs be set to ``True``.
 
-The ``connect_method`` option is used to tell tempest what kind of IP to use for
+The ``connect_method`` option is used to tell Tempest what kind of IP to use for
 establishing a connection to the server. Two methods are available: ``fixed``
 and ``floating``, the later being set by default. If this is set to floating
-tempest will create a floating ip for the server before attempted to connect
+Tempest will create a floating ip for the server before attempted to connect
 to it. The IP for the floating ip is what is used for the connection.
 
 For the ``auth_method`` option there is currently, only one valid option,
-``keypair``. With this set to ``keypair`` tempest will create an ssh keypair
+``keypair``. With this set to ``keypair`` Tempest will create an ssh keypair
 and use that for authenticating against the created server.
 
 Configuring Available Services
@@ -359,8 +358,8 @@
 
 The ``service_available`` section of the config file is used to set which
 services are available. It contains a boolean option for each service (except
-for keystone which is a hard requirement) set it to True if the service is
-available or False if it is not.
+for Keystone which is a hard requirement) set it to ``True`` if the service is
+available or ``False`` if it is not.
 
 Service Catalog
 ^^^^^^^^^^^^^^^
@@ -382,17 +381,18 @@
 service you can set the ``region`` option in that service's section.
 
 It should also be noted that the default values for these options are set
-to what devstack uses (which is a de facto standard for service catalog
+to what DevStack uses (which is a de facto standard for service catalog
 entries). So often nothing actually needs to be set on these options to enable
 communication to a particular service. It is only if you are either not using
-the same ``catalog_type`` as devstack or you want Tempest to talk to a different
-endpoint type instead of publicURL for a service that these need to be changed.
+the same ``catalog_type`` as DevStack or you want Tempest to talk to a different
+endpoint type instead of ``publicURL`` for a service that these need to be
+changed.
 
 .. note::
 
     Tempest does not serve all kinds of fancy URLs in the service catalog.  The
     service catalog should be in a standard format (which is going to be
-    standardized at the keystone level).
+    standardized at the Keystone level).
     Tempest expects URLs in the Service catalog in the following format:
 
     * ``http://example.com:1234/<version-info>``
@@ -420,7 +420,7 @@
 configured as to which optional features are enabled. This is in order to
 prevent bugs in the discovery mechanisms from masking failures.
 
-The service feature-enabled config sections are how Tempest addresses the
+The service ``feature-enabled`` config sections are how Tempest addresses the
 optional feature question. Each service that has tests for optional features
 contains one of these sections. The only options in it are boolean options
 with the name of a feature which is used. If it is set to false any test which
@@ -431,7 +431,7 @@
 API Extensions
 ^^^^^^^^^^^^^^
 The service feature-enabled sections often contain an ``api-extensions`` option
-(or in the case of swift a ``discoverable_apis`` option). This is used to tell
+(or in the case of Swift a ``discoverable_apis`` option). This is used to tell
 Tempest which api extensions (or configurable middleware) is used in your
 deployment. It has two valid config states: either it contains a single value
 ``all`` (which is the default) which means that every api extension is assumed
diff --git a/doc/source/library.rst b/doc/source/library.rst
index 29248d1..a461a0f 100644
--- a/doc/source/library.rst
+++ b/doc/source/library.rst
@@ -68,3 +68,4 @@
    library/api_microversion_testing
    library/auth
    library/clients
+   library/credential_providers
diff --git a/doc/source/library/credential_providers.rst b/doc/source/library/credential_providers.rst
new file mode 100644
index 0000000..6e14296
--- /dev/null
+++ b/doc/source/library/credential_providers.rst
@@ -0,0 +1,23 @@
+.. _cred_providers:
+
+Credential Providers
+====================
+
+These library interfaces are used to deal with allocating credentials on demand
+either dynamically by calling keystone to allocate new credentials, or from
+a list of preprovisioned credentials.
+
+
+------------------------------
+The dynamic credentials module
+------------------------------
+
+.. automodule:: tempest.lib.common.dynamic_creds
+   :members:
+
+--------------------------------------
+The pre-provisioned credentials module
+--------------------------------------
+
+.. automodule:: tempest.lib.common.preprov_creds
+   :members:
diff --git a/doc/source/microversion_testing.rst b/doc/source/microversion_testing.rst
index d6d90ba..60f4f36 100644
--- a/doc/source/microversion_testing.rst
+++ b/doc/source/microversion_testing.rst
@@ -111,7 +111,7 @@
 This document explains how to implement Microversion tests using those
 interfaces.
 
-.. _API Microversion testing Framework: http://docs.openstack.org/developer/tempest/library/api_microversion_testing.html
+.. _API Microversion testing Framework: https://docs.openstack.org/tempest/latest/library/api_microversion_testing.html
 
 
 Step1: Add skip logic based on configured Microversion range
@@ -296,46 +296,46 @@
 
  * `2.1`_
 
- .. _2.1:  http://docs.openstack.org/developer/nova/api_microversion_history.html#id1
+ .. _2.1:  https://docs.openstack.org/nova/latest/api_microversion_history.html#id1
 
  * `2.2`_
 
- .. _2.2: http://docs.openstack.org/developer/nova/api_microversion_history.html#id2
+ .. _2.2: http://docs.openstack.org/nova/latest/api_microversion_history.html#id2
 
  * `2.10`_
 
- .. _2.10: http://docs.openstack.org/developer/nova/api_microversion_history.html#id9
+ .. _2.10: http://docs.openstack.org/nova/latest/api_microversion_history.html#id9
 
  * `2.20`_
 
- .. _2.20: http://docs.openstack.org/developer/nova/api_microversion_history.html#id18
+ .. _2.20: http://docs.openstack.org/nova/latest/api_microversion_history.html#id18
 
  * `2.25`_
 
- .. _2.25: http://docs.openstack.org/developer/nova/api_microversion_history.html#maximum-in-mitaka
+ .. _2.25: http://docs.openstack.org/nova/latest/api_microversion_history.html#maximum-in-mitaka
 
  * `2.32`_
 
- .. _2.32: http://docs.openstack.org/developer/nova/api_microversion_history.html#id29
+ .. _2.32: http://docs.openstack.org/nova/latest/api_microversion_history.html#id29
 
  * `2.37`_
 
- .. _2.37: http://docs.openstack.org/developer/nova/api_microversion_history.html#id34
+ .. _2.37: http://docs.openstack.org/nova/latest/api_microversion_history.html#id34
 
  * `2.42`_
 
- .. _2.42: http://docs.openstack.org/developer/nova/api_microversion_history.html#maximum-in-ocata
+ .. _2.42: http://docs.openstack.org/nova/latest/api_microversion_history.html#maximum-in-ocata
 
  * `2.47`_
 
- .. _2.47: http://docs.openstack.org/developer/nova/api_microversion_history.html#id42
+ .. _2.47: http://docs.openstack.org/nova/latest/api_microversion_history.html#id42
 
  * `2.48`_
 
- .. _2.48: http://docs.openstack.org/developer/nova/api_microversion_history.html#id43
+ .. _2.48: http://docs.openstack.org/nova/latest/api_microversion_history.html#id43
 
 * Volume
 
  * `3.3`_
 
- .. _3.3:  https://docs.openstack.org/developer/cinder/devref/api_microversion_history.html#id4
+ .. _3.3:  https://docs.openstack.org/cinder/latest/devref/api_microversion_history.html#id4
diff --git a/doc/source/test_removal.rst b/doc/source/test_removal.rst
index d06e4ba..07c3046 100644
--- a/doc/source/test_removal.rst
+++ b/doc/source/test_removal.rst
@@ -171,7 +171,7 @@
 `tempest plugin mechanism`_
 to maintain continuity after migrating the tests out of tempest.
 
-.. _tempest plugin mechanism: http://docs.openstack.org/developer/tempest/plugin.html
+.. _tempest plugin mechanism: https://docs.openstack.org/tempest/latest/plugin.html
 
 API Compatibility
 """""""""""""""""
diff --git a/doc/source/write_tests.rst b/doc/source/write_tests.rst
index 4e3bfa2..aec55e9 100644
--- a/doc/source/write_tests.rst
+++ b/doc/source/write_tests.rst
@@ -6,13 +6,13 @@
 This guide serves as a starting point for developers working on writing new
 Tempest tests. At a high level tests in Tempest are just tests that conform to
 the standard python `unit test`_ framework. But there are several aspects of
-that are unique to tempest and it's role as an integration test suite running
+that are unique to Tempest and its role as an integration test suite running
 against a real cloud.
 
 .. _unit test: https://docs.python.org/3.6/library/unittest.html
 
-.. note:: This guide is for writing tests in the tempest repository. While many
-          parts of this guide are also applicable to tempest plugins, not all
+.. note:: This guide is for writing tests in the Tempest repository. While many
+          parts of this guide are also applicable to Tempest plugins, not all
           the APIs mentioned are considered stable or recommended for use in
           plugins. Please refer to :ref:`tempest_plugin` for details about
           writing plugins
@@ -24,8 +24,8 @@
 The base unit of testing in Tempest is the `TestCase`_ (also called the test
 class). Each TestCase contains test methods which are the individual tests that
 will be executed by the test runner. But, the TestCase is the smallest self
-contained unit for tests from the tempest perspective. It's also the level at
-which tempest is parallel safe. In other words, multiple TestCases can be
+contained unit for tests from the Tempest perspective. It's also the level at
+which Tempest is parallel safe. In other words, multiple TestCases can be
 executed in parallel, but individual test methods in the same TestCase can not.
 Also, all test methods within a TestCase are assumed to be executed serially. As
 such you can use the test case to store variables that are shared between
@@ -151,7 +151,7 @@
 You can also specify credentials with specific roles assigned. This is useful
 for cases where there are specific RBAC requirements hard coded into an API.
 The canonical example of this are swift tests which often want to test swift's
-concepts of operator and reseller_admin. An actual example from tempest on how
+concepts of operator and reseller_admin. An actual example from Tempest on how
 to do this is::
 
     class PublicObjectTest(base.BaseObjectTest):
@@ -187,7 +187,7 @@
 | [$label, $role]   | cls.os_roles_$label |
 +-------------------+---------------------+
 
-By default cls.os_primary is available since it is allocated in the base tempest test
+By default cls.os_primary is available since it is allocated in the base Tempest test
 class (located in tempest/test.py). If your TestCase inherits from a different
 direct parent class (it'll still inherit from the BaseTestCase, just not
 directly) be sure to check if that class overrides allocated credentials.
@@ -195,8 +195,8 @@
 Dealing with Network Allocation
 '''''''''''''''''''''''''''''''
 
-When neutron is enabled and a testing requires networking this isn't normally
-automatically setup when a tenant is created. Since tempest needs isolated
+When Neutron is enabled and a testing requires networking this isn't normally
+automatically setup when a tenant is created. Since Tempest needs isolated
 tenants to function properly it also needs to handle network allocation. By
 default the base test class will allocate a network, subnet, and router
 automatically (this depends on the configured credential provider, for more
diff --git a/releasenotes/notes/10/10.0.0-Tempest-library-interface-0eb680b810139a50.yaml b/releasenotes/notes/10/10.0.0-Tempest-library-interface-0eb680b810139a50.yaml
index 0ed3130..c1edd63 100644
--- a/releasenotes/notes/10/10.0.0-Tempest-library-interface-0eb680b810139a50.yaml
+++ b/releasenotes/notes/10/10.0.0-Tempest-library-interface-0eb680b810139a50.yaml
@@ -5,7 +5,7 @@
     it lives directly in the tempest project. For more information refer to
     the `library docs`_.
 
-    .. _library docs: http://docs.openstack.org/developer/tempest/library.html#library
+    .. _library docs: https://docs.openstack.org/tempest/latest/library.html#current-library-apis
 
 features:
   - Tempest library interface
diff --git a/releasenotes/notes/migrate-dynamic-creds-ecebb47528080761.yaml b/releasenotes/notes/migrate-dynamic-creds-ecebb47528080761.yaml
new file mode 100644
index 0000000..c20cbc6
--- /dev/null
+++ b/releasenotes/notes/migrate-dynamic-creds-ecebb47528080761.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    The tempest module tempest.common.dynamic creds which is used for
+    dynamically allocating credentials has been migrated into tempest lib.
diff --git a/releasenotes/notes/migrate-preprov-creds-ef61a046ee1ec604.yaml b/releasenotes/notes/migrate-preprov-creds-ef61a046ee1ec604.yaml
new file mode 100644
index 0000000..aa5f71a
--- /dev/null
+++ b/releasenotes/notes/migrate-preprov-creds-ef61a046ee1ec604.yaml
@@ -0,0 +1,11 @@
+---
+features:
+  - The tempest module tempest.common.preprov_creds which is used to provide
+    credentials from a list of preprovisioned resources has been migrated into
+    tempest lib at tempest.lib.common.preprov_creds.
+  - The InvalidTestResource exception class from tempest.exceptions has been
+    migrated into tempest.lib.exceptions
+  - The tempest module tempest.common.fixed_network which provided utilities for
+    finding fixed networks by and helpers for picking the network to use when
+    multiple tenant networks are available has been migrated into tempest lib
+    at tempest.lib.common.fixed_network.
diff --git a/setup.cfg b/setup.cfg
index b292970..f52137e 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -5,7 +5,7 @@
     README.rst
 author = OpenStack
 author-email = openstack-dev@lists.openstack.org
-home-page = http://docs.openstack.org/developer/tempest/
+home-page = https://docs.openstack.org/tempest/latest/
 classifier =
     Intended Audience :: Information Technology
     Intended Audience :: System Administrators
diff --git a/tempest/README.rst b/tempest/README.rst
index 0feec41..663653e 100644
--- a/tempest/README.rst
+++ b/tempest/README.rst
@@ -9,12 +9,13 @@
 OpenStack clouds.
 
 As such Tempest tests come in many flavors, each with their own rules
-and guidelines. Below is the proposed Havana restructuring for Tempest
+and guidelines. Below is the overview of the Tempest respository structure
 to make this clear.
 
 | tempest/
 |    api/ - API tests
 |    scenario/ - complex scenario tests
+|    tests/ - unit tests for Tempest internals
 
 Each of these directories contains different types of tests. What
 belongs in each directory, the rules and examples for good tests, are
@@ -24,8 +25,8 @@
 ----------------------
 
 API tests are validation tests for the OpenStack API. They should not
-use the existing python clients for OpenStack, but should instead use
-the tempest implementations of clients. Having raw clients let us
+use the existing Python clients for OpenStack, but should instead use
+the Tempest implementations of clients. Having raw clients let us
 pass invalid JSON to the APIs and see the results, something we could
 not get with the native clients.
 
@@ -41,14 +42,14 @@
 functionality. They are typically a series of steps where complicated
 state requiring multiple services is set up exercised, and torn down.
 
-Scenario tests should not use the existing python clients for OpenStack,
-but should instead use the tempest implementations of clients.
+Scenario tests should not use the existing Python clients for OpenStack,
+but should instead use the Tempest implementations of clients.
 
 
 :ref:`unit_tests_field_guide`
 -----------------------------
 
 Unit tests are the self checks for Tempest. They provide functional
-verification and regression checking for the internal components of tempest.
-They should be used to just verify that the individual pieces of tempest are
+verification and regression checking for the internal components of Tempest.
+They should be used to just verify that the individual pieces of Tempest are
 working as expected.
diff --git a/tempest/api/README.rst b/tempest/api/README.rst
index 91e6ad6..a796922 100644
--- a/tempest/api/README.rst
+++ b/tempest/api/README.rst
@@ -13,7 +13,8 @@
 
 It's also important to test not only the expected positive path on
 APIs, but also to provide them with invalid data to ensure they fail
-in expected and documented ways. Over the course of the OpenStack
+in expected and documented ways. The latter type of tests is called
+``negative tests`` in Tempest source code. Over the course of the OpenStack
 project Tempest has discovered many fundamental bugs by doing just
 this.
 
@@ -22,7 +23,7 @@
 spinning up a server, image, etc, then operating on it.
 
 
-Why are these tests in tempest?
+Why are these tests in Tempest?
 -------------------------------
 
 This is one of the core missions for the Tempest project, and where it
diff --git a/tempest/api/compute/admin/test_servers.py b/tempest/api/compute/admin/test_servers.py
index 0521cca..d9a7800 100644
--- a/tempest/api/compute/admin/test_servers.py
+++ b/tempest/api/compute/admin/test_servers.py
@@ -14,8 +14,8 @@
 
 from tempest.api.compute import base
 from tempest.common import compute
-from tempest.common import fixed_network
 from tempest.common import waiters
+from tempest.lib.common import fixed_network
 from tempest.lib.common.utils import data_utils
 from tempest.lib import decorators
 
diff --git a/tempest/api/compute/servers/test_create_server.py b/tempest/api/compute/servers/test_create_server.py
index 09479c6..aa5c43d 100644
--- a/tempest/api/compute/servers/test_create_server.py
+++ b/tempest/api/compute/servers/test_create_server.py
@@ -28,6 +28,7 @@
 
 class ServersTestJSON(base.BaseV2ComputeTest):
     disk_config = 'AUTO'
+    volume_backed = False
 
     @classmethod
     def setup_credentials(cls):
@@ -57,7 +58,8 @@
             accessIPv4=cls.accessIPv4,
             accessIPv6=cls.accessIPv6,
             disk_config=disk_config,
-            adminPass=cls.password)
+            adminPass=cls.password,
+            volume_backed=cls.volume_backed)
         cls.server = (cls.client.show_server(server_initial['id'])
                       ['server'])
 
@@ -71,7 +73,11 @@
         self.assertEqual(self.server['accessIPv6'],
                          str(netaddr.IPAddress(self.accessIPv6)))
         self.assertEqual(self.name, self.server['name'])
-        self.assertEqual(self.image_ref, self.server['image']['id'])
+        if self.volume_backed:
+            # Image is an empty string as per documentation
+            self.assertEqual("", self.server['image'])
+        else:
+            self.assertEqual(self.image_ref, self.server['image']['id'])
         self.assertEqual(self.flavor_ref, self.server['flavor']['id'])
         self.assertEqual(self.meta, self.server['metadata'])
 
@@ -152,3 +158,15 @@
         if not CONF.compute_feature_enabled.disk_config:
             msg = "DiskConfig extension not enabled."
             raise cls.skipException(msg)
+
+
+class ServersTestBootFromVolume(ServersTestJSON):
+    """Run the `ServersTestJSON` tests with a volume backed VM"""
+    volume_backed = True
+
+    @classmethod
+    def skip_checks(cls):
+        super(ServersTestBootFromVolume, cls).skip_checks()
+        if not test.get_service_list()['volume']:
+            msg = "Volume service not enabled."
+            raise cls.skipException(msg)
diff --git a/tempest/api/compute/servers/test_list_server_filters.py b/tempest/api/compute/servers/test_list_server_filters.py
index 921b7da..a4ed8e1 100644
--- a/tempest/api/compute/servers/test_list_server_filters.py
+++ b/tempest/api/compute/servers/test_list_server_filters.py
@@ -15,9 +15,9 @@
 import testtools
 
 from tempest.api.compute import base
-from tempest.common import fixed_network
 from tempest.common import waiters
 from tempest import config
+from tempest.lib.common import fixed_network
 from tempest.lib.common.utils import data_utils
 from tempest.lib import decorators
 
diff --git a/tempest/cmd/account_generator.py b/tempest/cmd/account_generator.py
index 172d9e1..8636405 100755
--- a/tempest/cmd/account_generator.py
+++ b/tempest/cmd/account_generator.py
@@ -102,8 +102,8 @@
 import yaml
 
 from tempest.common import credentials_factory
-from tempest.common import dynamic_creds
 from tempest import config
+from tempest.lib.common import dynamic_creds
 
 
 LOG = None
@@ -141,18 +141,10 @@
     admin_creds = credentials_factory.get_credentials(
         fill_in=False, identity_version=identity_version, **admin_creds_dict)
     return dynamic_creds.DynamicCredentialProvider(
-        identity_version=identity_version,
         name=opts.tag,
         network_resources=network_resources,
-        neutron_available=CONF.service_available.neutron,
-        create_networks=CONF.auth.create_isolated_networks,
-        identity_admin_role=CONF.identity.admin_role,
-        identity_admin_domain_scope=CONF.identity.admin_domain_scope,
-        project_network_cidr=CONF.network.project_network_cidr,
-        project_network_mask_bits=CONF.network.project_network_mask_bits,
-        public_network_id=CONF.network.public_network_id,
-        admin_creds=admin_creds,
-        **credentials_factory.get_dynamic_provider_params())
+        **credentials_factory.get_dynamic_provider_params(
+            identity_version, admin_creds=admin_creds))
 
 
 def generate_resources(cred_provider, admin):
diff --git a/tempest/common/compute.py b/tempest/common/compute.py
index 9f467fe..e3fbfb8 100644
--- a/tempest/common/compute.py
+++ b/tempest/common/compute.py
@@ -25,9 +25,9 @@
 from oslo_log import log as logging
 from oslo_utils import excutils
 
-from tempest.common import fixed_network
 from tempest.common import waiters
 from tempest import config
+from tempest.lib.common import fixed_network
 from tempest.lib.common import rest_client
 from tempest.lib.common.utils import data_utils
 
diff --git a/tempest/common/credentials_factory.py b/tempest/common/credentials_factory.py
index e6b46ed..a4cf009 100644
--- a/tempest/common/credentials_factory.py
+++ b/tempest/common/credentials_factory.py
@@ -14,10 +14,10 @@
 from oslo_concurrency import lockutils
 
 from tempest import clients
-from tempest.common import dynamic_creds
-from tempest.common import preprov_creds
 from tempest import config
 from tempest.lib import auth
+from tempest.lib.common import dynamic_creds
+from tempest.lib.common import preprov_creds
 from tempest.lib import exceptions
 
 CONF = config.CONF
@@ -39,19 +39,66 @@
 
 
 # Subset of the parameters of credential providers that depend on configuration
-def get_common_provider_params():
+def _get_common_provider_params(identity_version):
+    if identity_version == 'v3':
+        identity_uri = CONF.identity.uri_v3
+    elif identity_version == 'v2':
+        identity_uri = CONF.identity.uri
     return {
+        'identity_version': identity_version,
+        'identity_uri': identity_uri,
         'credentials_domain': CONF.auth.default_credentials_domain_name,
         'admin_role': CONF.identity.admin_role
     }
 
 
-def get_dynamic_provider_params():
-    return get_common_provider_params()
+def get_dynamic_provider_params(identity_version, admin_creds=None):
+    """Dynamic provider parameters setup from config
+
+    This helper returns a dict of parameter that can be used to initialise
+    a `DynamicCredentialProvider` according to tempest configuration.
+    Parameters that are not configuration specific (name, network_resources)
+    are not returned.
+
+    :param identity_version: 'v2' or 'v3'
+    :param admin_creds: An object of type `auth.Credentials`. If None, it
+                        is built from the configuration file as well.
+    :returns A dict with the parameters
+    """
+    _common_params = _get_common_provider_params(identity_version)
+    admin_creds = admin_creds or get_configured_admin_credentials(
+        fill_in=True, identity_version=identity_version)
+    if identity_version == 'v3':
+        endpoint_type = CONF.identity.v3_endpoint_type
+    elif identity_version == 'v2':
+        endpoint_type = CONF.identity.v2_admin_endpoint_type
+    return dict(_common_params, **dict([
+        ('admin_creds', admin_creds),
+        ('identity_admin_domain_scope', CONF.identity.admin_domain_scope),
+        ('identity_admin_role', CONF.identity.admin_role),
+        ('extra_roles', CONF.auth.tempest_roles),
+        ('neutron_available', CONF.service_available.neutron),
+        ('project_network_cidr', CONF.network.project_network_cidr),
+        ('project_network_mask_bits', CONF.network.project_network_mask_bits),
+        ('public_network_id', CONF.network.public_network_id),
+        ('create_networks', (CONF.auth.create_isolated_networks and not
+                             CONF.network.shared_physical_network)),
+        ('resource_prefix', CONF.resources_prefix),
+        ('identity_admin_endpoint_type', endpoint_type)
+    ]))
 
 
-def get_preprov_provider_params():
-    _common_params = get_common_provider_params()
+def get_preprov_provider_params(identity_version):
+    """Pre-provisioned provider parameters setup from config
+
+    This helper returns a dict of parameter that can be used to initialise
+    a `PreProvisionedCredentialProvider` according to tempest configuration.
+    Parameters that are not configuration specific (name) are not returned.
+
+    :param identity_version: 'v2' or 'v3'
+    :returns A dict with the parameters
+    """
+    _common_params = _get_common_provider_params(identity_version)
     reseller_admin_role = CONF.object_storage.reseller_admin_role
     return dict(_common_params, **dict([
         ('accounts_lock_dir', lockutils.get_lock_path(CONF)),
@@ -61,42 +108,40 @@
     ]))
 
 
-# Return the right implementation of CredentialProvider based on config
-# Dropping interface and password, as they are never used anyways
-# TODO(andreaf) Drop them from the CredentialsProvider interface completely
 def get_credentials_provider(name, network_resources=None,
                              force_tenant_isolation=False,
                              identity_version=None):
+    """Return the right implementation of CredentialProvider based on config
+
+    This helper returns the right implementation of CredentialProvider based on
+    config and on the value of force_tenant_isolation.
+
+    :param name: When provided, it makes it possible to associate credential
+                 artifacts back to the owner (test class).
+    :param network_resources: Dictionary of network resources to be allocated
+                              for each test account. Only valid for the dynamic
+                              credentials provider.
+    :param force_tenant_isolation: Always return a `DynamicCredentialProvider`,
+                                   regardless of the configuration.
+    :param identity_version: Use the specified identity API version, regardless
+                             of the configuration. Valid values are 'v2', 'v3'.
+    """
     # If a test requires a new account to work, it can have it via forcing
     # dynamic credentials. A new account will be produced only for that test.
     # In case admin credentials are not available for the account creation,
     # the test should be skipped else it would fail.
     identity_version = identity_version or CONF.identity.auth_version
     if CONF.auth.use_dynamic_credentials or force_tenant_isolation:
-        admin_creds = get_configured_admin_credentials(
-            fill_in=True, identity_version=identity_version)
         return dynamic_creds.DynamicCredentialProvider(
             name=name,
             network_resources=network_resources,
-            identity_version=identity_version,
-            admin_creds=admin_creds,
-            identity_admin_domain_scope=CONF.identity.admin_domain_scope,
-            identity_admin_role=CONF.identity.admin_role,
-            extra_roles=CONF.auth.tempest_roles,
-            neutron_available=CONF.service_available.neutron,
-            project_network_cidr=CONF.network.project_network_cidr,
-            project_network_mask_bits=CONF.network.project_network_mask_bits,
-            public_network_id=CONF.network.public_network_id,
-            create_networks=(CONF.auth.create_isolated_networks and not
-                             CONF.network.shared_physical_network),
-            resource_prefix=CONF.resources_prefix,
-            **get_dynamic_provider_params())
+            **get_dynamic_provider_params(identity_version))
     else:
         if CONF.auth.test_accounts_file:
             # Most params are not relevant for pre-created accounts
             return preprov_creds.PreProvisionedCredentialProvider(
-                name=name, identity_version=identity_version,
-                **get_preprov_provider_params())
+                name=name,
+                **get_preprov_provider_params(identity_version))
         else:
             raise exceptions.InvalidConfiguration(
                 'A valid credential provider is needed')
@@ -115,8 +160,8 @@
     # Check whether test accounts file has the admin specified or not
     elif CONF.auth.test_accounts_file:
         check_accounts = preprov_creds.PreProvisionedCredentialProvider(
-            identity_version=identity_version, name='check_admin',
-            **get_preprov_provider_params())
+            name='check_admin',
+            **get_preprov_provider_params(identity_version))
         if not check_accounts.admin_available():
             is_admin = False
     else:
@@ -140,8 +185,8 @@
     # Check whether test accounts file has the admin specified or not
     if CONF.auth.test_accounts_file:
         check_accounts = preprov_creds.PreProvisionedCredentialProvider(
-            identity_version=identity_version, name='check_alt',
-            **get_preprov_provider_params())
+            name='check_alt',
+            **get_preprov_provider_params(identity_version))
     else:
         raise exceptions.InvalidConfiguration(
             'A valid credential provider is needed')
diff --git a/tempest/exceptions.py b/tempest/exceptions.py
index a437761..b5b2d71 100644
--- a/tempest/exceptions.py
+++ b/tempest/exceptions.py
@@ -52,12 +52,5 @@
                "the configured network")
 
 
-# NOTE(andreaf) This exception is added here to facilitate the migration
-# of get_network_from_name and preprov_creds to tempest.lib, and it should
-# be migrated along with them
-class InvalidTestResource(exceptions.TempestException):
-    message = "%(name)s is not a valid %(type)s, or the name is ambiguous"
-
-
 class RFCViolation(exceptions.RestClientException):
     message = "RFC Violation"
diff --git a/tempest/lib/common/cred_provider.py b/tempest/lib/common/cred_provider.py
index 1b450ab..42ed41b 100644
--- a/tempest/lib/common/cred_provider.py
+++ b/tempest/lib/common/cred_provider.py
@@ -22,8 +22,9 @@
 
 @six.add_metaclass(abc.ABCMeta)
 class CredentialProvider(object):
-    def __init__(self, identity_version, name=None, network_resources=None,
-                 credentials_domain=None, admin_role=None):
+    def __init__(self, identity_version, name=None,
+                 network_resources=None, credentials_domain=None,
+                 admin_role=None, identity_uri=None):
         """A CredentialProvider supplies credentials to test classes.
 
         :param identity_version: Identity version of the credentials provided
@@ -33,8 +34,11 @@
                                   credentials
         :param credentials_domain: Domain credentials belong to
         :param admin_role: Name of the role of the admin account
+        :param identity_uri: Identity URI of the target cloud. This *must* be
+                             specified for anything to work.
         """
         self.identity_version = identity_version
+        self.identity_uri = identity_uri
         self.name = name or "test_creds"
         self.network_resources = network_resources
         self.credentials_domain = credentials_domain or 'Default'
diff --git a/tempest/common/dynamic_creds.py b/tempest/lib/common/dynamic_creds.py
similarity index 90%
rename from tempest/common/dynamic_creds.py
rename to tempest/lib/common/dynamic_creds.py
index 1e040e6..90e67b4 100644
--- a/tempest/common/dynamic_creds.py
+++ b/tempest/lib/common/dynamic_creds.py
@@ -18,11 +18,11 @@
 from oslo_log import log as logging
 import six
 
-from tempest import clients
 from tempest.lib.common import cred_client
 from tempest.lib.common import cred_provider
 from tempest.lib.common.utils import data_utils
 from tempest.lib import exceptions as lib_exc
+from tempest.lib.services import clients
 
 LOG = logging.getLogger(__name__)
 
@@ -35,7 +35,8 @@
                  identity_admin_role='admin', extra_roles=None,
                  neutron_available=False, create_networks=True,
                  project_network_cidr=None, project_network_mask_bits=None,
-                 public_network_id=None, resource_prefix=None):
+                 public_network_id=None, resource_prefix=None,
+                 identity_admin_endpoint_type='public', identity_uri=None):
         """Creates credentials dynamically for tests
 
         A credential provider that, based on an initial set of
@@ -69,10 +70,14 @@
         :param project_network_mask_bits: The network mask bits to use for
                                           created project networks
         :param public_network_id: The id for the public network to use
+        :param identity_admin_endpoint_type: The endpoint type for identity
+                                             admin clients. Defaults to public.
+        :param identity_uri: Identity URI of the target cloud
         """
         super(DynamicCredentialProvider, self).__init__(
-            identity_version=identity_version, admin_role=admin_role,
-            name=name, credentials_domain=credentials_domain,
+            identity_version=identity_version, identity_uri=identity_uri,
+            admin_role=admin_role, name=name,
+            credentials_domain=credentials_domain,
             network_resources=network_resources)
         self.network_resources = network_resources
         self._creds = {}
@@ -86,6 +91,7 @@
         self.default_admin_creds = admin_creds
         self.identity_admin_domain_scope = identity_admin_domain_scope
         self.identity_admin_role = identity_admin_role or 'admin'
+        self.identity_admin_endpoint_type = identity_admin_endpoint_type
         self.extra_roles = extra_roles or []
         (self.identity_admin_client,
          self.tenants_admin_client,
@@ -96,7 +102,8 @@
          self.routers_admin_client,
          self.subnets_admin_client,
          self.ports_admin_client,
-         self.security_groups_admin_client) = self._get_admin_clients()
+         self.security_groups_admin_client) = self._get_admin_clients(
+            identity_admin_endpoint_type)
         # Domain where isolated credentials are provisioned (v3 only).
         # Use that of the admin account is None is configured.
         self.creds_domain_name = None
@@ -112,32 +119,43 @@
             self.domains_admin_client,
             self.creds_domain_name)
 
-    def _get_admin_clients(self):
+    def _get_admin_clients(self, endpoint_type):
         """Returns a tuple with instances of the following admin clients
 
         (in this order):
             identity
             network
         """
-        os = clients.Manager(self.default_admin_creds)
+        os = clients.ServiceClients(self.default_admin_creds,
+                                    self.identity_uri)
+        params = {'endpoint_type': endpoint_type}
         if self.identity_version == 'v2':
-            return (os.identity_client, os.tenants_client, os.users_client,
-                    os.roles_client, None,
-                    os.networks_client, os.routers_client, os.subnets_client,
-                    os.ports_client, os.security_groups_client)
+            return (os.identity_v2.IdentityClient(**params),
+                    os.identity_v2.TenantsClient(**params),
+                    os.identity_v2.UsersClient(**params),
+                    os.identity_v2.RolesClient(**params), None,
+                    os.network.NetworksClient(),
+                    os.network.RoutersClient(),
+                    os.network.SubnetsClient(),
+                    os.network.PortsClient(),
+                    os.network.SecurityGroupsClient())
         else:
             # We use a dedicated client manager for identity client in case we
             # need a different token scope for them.
             scope = 'domain' if self.identity_admin_domain_scope else 'project'
-            identity_os = clients.Manager(self.default_admin_creds,
-                                          scope=scope)
-            return (identity_os.identity_v3_client,
-                    identity_os.projects_client,
-                    identity_os.users_v3_client, identity_os.roles_v3_client,
-                    identity_os.domains_client,
-                    os.networks_client, os.routers_client,
-                    os.subnets_client, os.ports_client,
-                    os.security_groups_client)
+            identity_os = clients.ServiceClients(self.default_admin_creds,
+                                                 self.identity_uri,
+                                                 scope=scope)
+            return (identity_os.identity_v3.IdentityClient(**params),
+                    identity_os.identity_v3.ProjectsClient(**params),
+                    identity_os.identity_v3.UsersClient(**params),
+                    identity_os.identity_v3.RolesClient(**params),
+                    identity_os.identity_v3.DomainsClient(**params),
+                    os.network.NetworksClient(),
+                    os.network.RoutersClient(),
+                    os.network.SubnetsClient(),
+                    os.network.PortsClient(),
+                    os.network.SecurityGroupsClient())
 
     def _create_creds(self, admin=False, roles=None):
         """Create credentials with random name.
diff --git a/tempest/common/fixed_network.py b/tempest/lib/common/fixed_network.py
similarity index 99%
rename from tempest/common/fixed_network.py
rename to tempest/lib/common/fixed_network.py
index 4032c90..e2054a4 100644
--- a/tempest/common/fixed_network.py
+++ b/tempest/lib/common/fixed_network.py
@@ -14,8 +14,8 @@
 
 from oslo_log import log as logging
 
-from tempest import exceptions
 from tempest.lib.common.utils import test_utils
+from tempest.lib import exceptions
 
 LOG = logging.getLogger(__name__)
 
diff --git a/tempest/common/preprov_creds.py b/tempest/lib/common/preprov_creds.py
similarity index 96%
rename from tempest/common/preprov_creds.py
rename to tempest/lib/common/preprov_creds.py
index 8053cac..cd3a10e 100644
--- a/tempest/common/preprov_creds.py
+++ b/tempest/lib/common/preprov_creds.py
@@ -20,12 +20,11 @@
 import six
 import yaml
 
-from tempest import clients
-from tempest.common import fixed_network
-from tempest import exceptions
 from tempest.lib import auth
 from tempest.lib.common import cred_provider
+from tempest.lib.common import fixed_network
 from tempest.lib import exceptions as lib_exc
+from tempest.lib.services import clients
 
 LOG = logging.getLogger(__name__)
 
@@ -51,7 +50,7 @@
     def __init__(self, identity_version, test_accounts_file,
                  accounts_lock_dir, name=None, credentials_domain=None,
                  admin_role=None, object_storage_operator_role=None,
-                 object_storage_reseller_admin_role=None):
+                 object_storage_reseller_admin_role=None, identity_uri=None):
         """Credentials provider using pre-provisioned accounts
 
         This credentials provider loads the details of pre-provisioned
@@ -79,10 +78,12 @@
                                    (if no domain is configured)
         :param object_storage_operator_role: name of the role
         :param object_storage_reseller_admin_role: name of the role
+        :param identity_uri: Identity URI of the target cloud
         """
         super(PreProvisionedCredentialProvider, self).__init__(
             identity_version=identity_version, name=name,
-            admin_role=admin_role, credentials_domain=credentials_domain)
+            admin_role=admin_role, credentials_domain=credentials_domain,
+            identity_uri=identity_uri)
         self.test_accounts_file = test_accounts_file
         if test_accounts_file:
             accounts = read_accounts_yaml(self.test_accounts_file)
@@ -341,13 +342,14 @@
             auth_url=None, fill_in=False,
             identity_version=self.identity_version, **creds_dict)
         net_creds = cred_provider.TestResources(credential)
-        net_clients = clients.Manager(credentials=credential)
-        compute_network_client = net_clients.compute_networks_client
+        net_clients = clients.ServiceClients(credentials=credential,
+                                             identity_uri=self.identity_uri)
+        compute_network_client = net_clients.compute.NetworksClient()
         net_name = self.hash_dict['networks'].get(hash, None)
         try:
             network = fixed_network.get_network_from_name(
                 net_name, compute_network_client)
-        except exceptions.InvalidTestResource:
+        except lib_exc.InvalidTestResource:
             network = {}
         net_creds.set_resources(network=network)
         return net_creds
diff --git a/tempest/lib/exceptions.py b/tempest/lib/exceptions.py
index 68ce57a..cdb8be9 100644
--- a/tempest/lib/exceptions.py
+++ b/tempest/lib/exceptions.py
@@ -269,3 +269,7 @@
 class DeleteErrorException(TempestException):
     message = ("Resource %(resource_id)s failed to delete "
                "and is in ERROR status")
+
+
+class InvalidTestResource(TempestException):
+    message = "%(name)s is not a valid %(type)s, or the name is ambiguous"
diff --git a/tempest/scenario/README.rst b/tempest/scenario/README.rst
index 38e0de9..c1dcccc 100644
--- a/tempest/scenario/README.rst
+++ b/tempest/scenario/README.rst
@@ -21,9 +21,9 @@
     4. create a snapshot of the vm
 
 
-Why are these tests in tempest?
+Why are these tests in Tempest?
 -------------------------------
-This is one of tempests core purposes, testing the integration between
+This is one of Tempest's core purposes, testing the integration between
 projects.
 
 
@@ -43,7 +43,7 @@
 specific in your interactions. A giant "this is my data center" smoke
 test is hard to debug when it goes wrong.
 
-A flow of interactions between glance and nova, like in the
+A flow of interactions between Glance and Nova, like in the
 introduction, is a good example. Especially if it involves a repeated
 interaction when a resource is setup, modified, detached, and then
 reused later again.
diff --git a/tempest/services/object_storage/bulk_middleware_client.py b/tempest/services/object_storage/bulk_middleware_client.py
index 4e8d629..c11a105 100644
--- a/tempest/services/object_storage/bulk_middleware_client.py
+++ b/tempest/services/object_storage/bulk_middleware_client.py
@@ -24,7 +24,7 @@
 
         To extract containers and objects on Swift cluster from
         uploaded archived file. For More information please check:
-        http://docs.openstack.org/developer/swift/middleware.html#module-swift.common.middleware.bulk
+        https://docs.openstack.org/swift/latest/middleware.html#module-swift.common.middleware.bulk
         """
         url = '%s?extract-archive=%s' % (upload_path, archive_file_format)
         if headers is None:
@@ -37,7 +37,7 @@
         """Delete multiple objects or containers from their account.
 
         For More information please check:
-        http://docs.openstack.org/developer/swift/middleware.html#module-swift.common.middleware.bulk
+        https://docs.openstack.org/swift/latest/middleware.html#module-swift.common.middleware.bulk
         """
         url = '?bulk-delete'
 
@@ -51,7 +51,7 @@
         """Delete multiple objects or containers with POST request.
 
         For More information please check:
-        http://docs.openstack.org/developer/swift/middleware.html#module-swift.common.middleware.bulk
+        https://docs.openstack.org/swift/latest/middleware.html#module-swift.common.middleware.bulk
         """
         url = '?bulk-delete'
 
diff --git a/tempest/test.py b/tempest/test.py
index fc846ff..317c0a7 100644
--- a/tempest/test.py
+++ b/tempest/test.py
@@ -26,10 +26,10 @@
 
 from tempest import clients
 from tempest.common import credentials_factory as credentials
-from tempest.common import fixed_network
 import tempest.common.validation_resources as vresources
 from tempest import config
 from tempest.lib.common import cred_client
+from tempest.lib.common import fixed_network
 from tempest.lib import decorators
 from tempest.lib import exceptions as lib_exc
 
diff --git a/tempest/tests/README.rst b/tempest/tests/README.rst
index e54d4c0..0587e7b 100644
--- a/tempest/tests/README.rst
+++ b/tempest/tests/README.rst
@@ -7,16 +7,16 @@
 ---------------------
 
 Unit tests are the self checks for Tempest. They provide functional
-verification and regression checking for the internal components of tempest.
-They should be used to just verify that the individual pieces of tempest are
+verification and regression checking for the internal components of Tempest.
+They should be used to just verify that the individual pieces of Tempest are
 working as expected. They should not require an external service to be running
-and should be able to run solely from the tempest tree.
+and should be able to run solely from the Tempest tree.
 
-Why are these tests in tempest?
+Why are these tests in Tempest?
 -------------------------------
 These tests exist to make sure that the mechanisms that we use inside of
-tempest to are valid and remain functional. They are only here for self
-validation of tempest.
+Tempest are valid and remain functional. They are only here for self
+validation of Tempest.
 
 
 Scope of these tests
diff --git a/tempest/tests/cmd/test_account_generator.py b/tempest/tests/cmd/test_account_generator.py
index 6773b2f..f907bd0 100644
--- a/tempest/tests/cmd/test_account_generator.py
+++ b/tempest/tests/cmd/test_account_generator.py
@@ -20,7 +20,6 @@
 from tempest import config
 from tempest.tests import base
 from tempest.tests import fake_config
-from tempest.tests.lib import fake_identity
 
 
 class FakeOpts(object):
@@ -85,14 +84,10 @@
 class TestAccountGeneratorV2(base.TestCase, MockHelpersMixin):
 
     identity_version = 2
-    identity_response = fake_identity._fake_v2_response
 
     def setUp(self):
         super(TestAccountGeneratorV2, self).setUp()
         self.mock_config_and_opts(self.identity_version)
-        self.useFixture(fixtures.MockPatch(
-            'tempest.lib.auth.AuthProvider.set_auth',
-            return_value=self.identity_response))
 
     def test_get_credential_provider(self):
         cp = account_generator.get_credential_provider(self.opts)
@@ -115,7 +110,6 @@
 class TestAccountGeneratorV3(TestAccountGeneratorV2):
 
     identity_version = 3
-    identity_response = fake_identity._fake_v3_response
 
     def setUp(self):
         super(TestAccountGeneratorV3, self).setUp()
@@ -145,16 +139,13 @@
 class TestGenerateResourcesV2(base.TestCase, MockHelpersMixin):
 
     identity_version = 2
-    identity_response = fake_identity._fake_v2_response
     cred_client = 'tempest.lib.common.cred_client.V2CredsClient'
-    dynamic_creds = 'tempest.common.dynamic_creds.DynamicCredentialProvider'
+    dynamic_creds = ('tempest.lib.common.dynamic_creds.'
+                     'DynamicCredentialProvider')
 
     def setUp(self):
         super(TestGenerateResourcesV2, self).setUp()
         self.mock_config_and_opts(self.identity_version)
-        self.useFixture(fixtures.MockPatch(
-            'tempest.lib.auth.AuthProvider.set_auth',
-            return_value=self.identity_response))
         self.cred_provider = account_generator.get_credential_provider(
             self.opts)
         self.mock_resource_creation()
@@ -244,7 +235,6 @@
 class TestGenerateResourcesV3(TestGenerateResourcesV2):
 
     identity_version = 3
-    identity_response = fake_identity._fake_v3_response
     cred_client = 'tempest.lib.common.cred_client.V3CredsClient'
 
     def setUp(self):
@@ -255,17 +245,14 @@
 class TestDumpAccountsV2(base.TestCase, MockHelpersMixin):
 
     identity_version = 2
-    identity_response = fake_identity._fake_v2_response
     cred_client = 'tempest.lib.common.cred_client.V2CredsClient'
-    dynamic_creds = 'tempest.common.dynamic_creds.DynamicCredentialProvider'
+    dynamic_creds = ('tempest.lib.common.dynamic_creds.'
+                     'DynamicCredentialProvider')
     domain_is_in = False
 
     def setUp(self):
         super(TestDumpAccountsV2, self).setUp()
         self.mock_config_and_opts(self.identity_version)
-        self.useFixture(fixtures.MockPatch(
-            'tempest.lib.auth.AuthProvider.set_auth',
-            return_value=self.identity_response))
         self.cred_provider = account_generator.get_credential_provider(
             self.opts)
         self.mock_resource_creation()
@@ -337,7 +324,6 @@
 class TestDumpAccountsV3(TestDumpAccountsV2):
 
     identity_version = 3
-    identity_response = fake_identity._fake_v3_response
     cred_client = 'tempest.lib.common.cred_client.V3CredsClient'
     domain_is_in = True
 
diff --git a/tempest/tests/common/test_admin_available.py b/tempest/tests/common/test_admin_available.py
index c3d248c..7b3b1b0 100644
--- a/tempest/tests/common/test_admin_available.py
+++ b/tempest/tests/common/test_admin_available.py
@@ -53,7 +53,7 @@
                                  'password': 'p',
                                  'types': ['admin']})
             self.useFixture(fixtures.MockPatch(
-                'tempest.common.preprov_creds.read_accounts_yaml',
+                'tempest.lib.common.preprov_creds.read_accounts_yaml',
                 return_value=accounts))
             cfg.CONF.set_default('test_accounts_file',
                                  use_accounts_file, group='auth')
diff --git a/tempest/tests/common/test_alt_available.py b/tempest/tests/common/test_alt_available.py
index b9a8967..a425bb8 100644
--- a/tempest/tests/common/test_alt_available.py
+++ b/tempest/tests/common/test_alt_available.py
@@ -40,7 +40,7 @@
                              project_name="t%s" % ii,
                              password="p") for ii in creds]
             self.useFixture(fixtures.MockPatch(
-                'tempest.common.preprov_creds.read_accounts_yaml',
+                'tempest.lib.common.preprov_creds.read_accounts_yaml',
                 return_value=accounts))
             cfg.CONF.set_default('test_accounts_file',
                                  use_accounts_file, group='auth')
diff --git a/tempest/tests/common/test_dynamic_creds.py b/tempest/tests/lib/common/test_dynamic_creds.py
similarity index 98%
rename from tempest/tests/common/test_dynamic_creds.py
rename to tempest/tests/lib/common/test_dynamic_creds.py
index c739619..6aa7a42 100644
--- a/tempest/tests/common/test_dynamic_creds.py
+++ b/tempest/tests/lib/common/test_dynamic_creds.py
@@ -17,8 +17,8 @@
 from oslo_config import cfg
 
 from tempest.common import credentials_factory as credentials
-from tempest.common import dynamic_creds
 from tempest import config
+from tempest.lib.common import dynamic_creds
 from tempest.lib.common import rest_client
 from tempest.lib import exceptions as lib_exc
 from tempest.lib.services.identity.v2 import identity_client as v2_iden_client
@@ -46,7 +46,8 @@
 
     fixed_params = {'name': 'test class',
                     'identity_version': 'v2',
-                    'admin_role': 'admin'}
+                    'admin_role': 'admin',
+                    'identity_uri': 'fake_uri'}
 
     token_client = v2_token_client
     iden_client = v2_iden_client
@@ -619,7 +620,8 @@
 
     fixed_params = {'name': 'test class',
                     'identity_version': 'v3',
-                    'admin_role': 'admin'}
+                    'admin_role': 'admin',
+                    'identity_uri': 'fake_uri'}
 
     token_client = v3_token_client
     iden_client = v3_iden_client
@@ -657,7 +659,7 @@
         creds = dynamic_creds.DynamicCredentialProvider(**self.fixed_params)
         creds.creds_client = mock.MagicMock()
         creds.creds_client.create_user_role.side_effect = lib_exc.Conflict
-        with mock.patch('tempest.common.dynamic_creds.LOG') as log_mock:
+        with mock.patch('tempest.lib.common.dynamic_creds.LOG') as log_mock:
             creds._create_creds()
             log_mock.warning.assert_called_once_with(
                 "Member role already exists, ignoring conflict.")
diff --git a/tempest/tests/common/test_preprov_creds.py b/tempest/tests/lib/common/test_preprov_creds.py
similarity index 96%
rename from tempest/tests/common/test_preprov_creds.py
rename to tempest/tests/lib/common/test_preprov_creds.py
index 414b106..5402e47 100644
--- a/tempest/tests/common/test_preprov_creds.py
+++ b/tempest/tests/lib/common/test_preprov_creds.py
@@ -24,10 +24,10 @@
 from oslo_concurrency.fixture import lockutils as lockutils_fixtures
 from oslo_config import cfg
 
-from tempest.common import preprov_creds
 from tempest import config
 from tempest.lib import auth
 from tempest.lib.common import cred_provider
+from tempest.lib.common import preprov_creds
 from tempest.lib import exceptions as lib_exc
 from tempest.tests import base
 from tempest.tests import fake_config
@@ -38,6 +38,7 @@
 
     fixed_params = {'name': 'test class',
                     'identity_version': 'v2',
+                    'identity_uri': 'fake_uri',
                     'test_accounts_file': 'fake_accounts_file',
                     'accounts_lock_dir': 'fake_locks_dir',
                     'admin_role': 'admin',
@@ -87,10 +88,13 @@
         self.useFixture(lockutils_fixtures.ExternalLockFixture())
         self.test_accounts = self._fake_accounts(cfg.CONF.identity.admin_role)
         self.accounts_mock = self.useFixture(fixtures.MockPatch(
-            'tempest.common.preprov_creds.read_accounts_yaml',
+            'tempest.lib.common.preprov_creds.read_accounts_yaml',
             return_value=self.test_accounts))
         self.useFixture(fixtures.MockPatch(
             'os.path.isfile', return_value=True))
+        # NOTE(andreaf) Ensure config is loaded so service clients are
+        # registered in the registry before tests
+        config.service_client_config()
 
     def tearDown(self):
         super(TestPreProvisionedCredentials, self).tearDown()
@@ -267,7 +271,7 @@
     def test_is_not_multi_user(self):
         self.test_accounts = [self.test_accounts[0]]
         self.useFixture(fixtures.MockPatch(
-            'tempest.common.preprov_creds.read_accounts_yaml',
+            'tempest.lib.common.preprov_creds.read_accounts_yaml',
             return_value=self.test_accounts))
         test_accounts_class = preprov_creds.PreProvisionedCredentialProvider(
             **self.fixed_params)
@@ -331,7 +335,7 @@
              'password': 'p', 'roles': ['role-7', 'role-11'],
              'resources': {'network': 'network-2'}}]
         self.useFixture(fixtures.MockPatch(
-            'tempest.common.preprov_creds.read_accounts_yaml',
+            'tempest.lib.common.preprov_creds.read_accounts_yaml',
             return_value=test_accounts))
         test_accounts_class = preprov_creds.PreProvisionedCredentialProvider(
             **self.fixed_params)
@@ -359,7 +363,7 @@
         admin_accounts = [x for x in self.test_accounts if 'test_admin'
                           in x['username']]
         self.useFixture(fixtures.MockPatch(
-            'tempest.common.preprov_creds.read_accounts_yaml',
+            'tempest.lib.common.preprov_creds.read_accounts_yaml',
             return_value=admin_accounts))
         test_accounts_class = preprov_creds.PreProvisionedCredentialProvider(
             **self.fixed_params)
@@ -377,7 +381,7 @@
         admin_accounts = [x for x in self.test_accounts if 'test_admin'
                           in x['username']]
         self.useFixture(fixtures.MockPatch(
-            'tempest.common.preprov_creds.read_accounts_yaml',
+            'tempest.lib.common.preprov_creds.read_accounts_yaml',
             return_value=admin_accounts))
         test_accounts_class = preprov_creds.PreProvisionedCredentialProvider(
             **self.fixed_params)
@@ -398,7 +402,7 @@
             {'username': 'test_admin1', 'tenant_name': 'test_tenant11',
              'password': 'p', 'types': ['admin']}]
         self.useFixture(fixtures.MockPatch(
-            'tempest.common.preprov_creds.read_accounts_yaml',
+            'tempest.lib.common.preprov_creds.read_accounts_yaml',
             return_value=test_accounts))
         test_accounts_class = preprov_creds.PreProvisionedCredentialProvider(
             **self.fixed_params)
@@ -412,7 +416,7 @@
             {'username': 'test_admin1', 'tenant_name': 'test_tenant11',
              'password': 'p', 'roles': [cfg.CONF.identity.admin_role]}]
         self.useFixture(fixtures.MockPatch(
-            'tempest.common.preprov_creds.read_accounts_yaml',
+            'tempest.lib.common.preprov_creds.read_accounts_yaml',
             return_value=test_accounts))
         test_accounts_class = preprov_creds.PreProvisionedCredentialProvider(
             **self.fixed_params)
@@ -423,7 +427,7 @@
         non_admin_accounts = [x for x in self.test_accounts if 'test_admin'
                               not in x['username']]
         self.useFixture(fixtures.MockPatch(
-            'tempest.common.preprov_creds.read_accounts_yaml',
+            'tempest.lib.common.preprov_creds.read_accounts_yaml',
             return_value=non_admin_accounts))
         test_accounts_class = preprov_creds.PreProvisionedCredentialProvider(
             **self.fixed_params)
@@ -436,6 +440,7 @@
 
     fixed_params = {'name': 'test class',
                     'identity_version': 'v3',
+                    'identity_uri': 'fake_uri',
                     'test_accounts_file': 'fake_accounts_file',
                     'accounts_lock_dir': 'fake_locks_dir_v3',
                     'admin_role': 'admin',
diff --git a/tempest/tests/lib/services/volume/v2/test_snapshot_manage_client.py b/tempest/tests/lib/services/volume/v2/test_snapshot_manage_client.py
new file mode 100644
index 0000000..3fe8970
--- /dev/null
+++ b/tempest/tests/lib/services/volume/v2/test_snapshot_manage_client.py
@@ -0,0 +1,83 @@
+# Copyright 2017 FiberHome Telecommunication Technologies CO.,LTD
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import mock
+
+from oslo_serialization import jsonutils as json
+
+from tempest.lib.services.volume.v2 import snapshot_manage_client
+from tempest.tests.lib import fake_auth_provider
+from tempest.tests.lib.services import base
+
+
+class TestSnapshotManageClient(base.BaseServiceTest):
+
+    SNAPSHOT_MANAGE_REQUEST = {
+        "snapshot": {
+            "description": "snapshot-manage-description",
+            "metadata": None,
+            "ref": {
+                "source-name": "_snapshot-22b71da0-94f9-4aca-ad45-7522b3fa96bb"
+            },
+            "name": "snapshot-managed",
+            "volume_id": "7c064b34-1e4b-40bd-93ca-4ac5a973661b"
+        }
+    }
+
+    SNAPSHOT_MANAGE_RESPONSE = {
+        "snapshot": {
+            "status": "creating",
+            "description": "snapshot-manage-description",
+            "updated_at": None,
+            "volume_id": "32bafcc8-7109-42cd-8342-70d8de2bedef",
+            "id": "8fd6eb9d-0a82-456d-b1ec-dea4ac7f1ee2",
+            "size": 1,
+            "name": "snapshot-managed",
+            "created_at": "2017-07-11T10:07:58.000000",
+            "metadata": {}
+        }
+    }
+
+    def setUp(self):
+        super(TestSnapshotManageClient, self).setUp()
+        fake_auth = fake_auth_provider.FakeAuthProvider()
+        self.client = snapshot_manage_client.SnapshotManageClient(fake_auth,
+                                                                  'volume',
+                                                                  'regionOne')
+
+    def _test_manage_snapshot(self, bytes_body=False):
+        payload = json.dumps(self.SNAPSHOT_MANAGE_REQUEST, sort_keys=True)
+        json_dumps = json.dumps
+
+        # NOTE: Use sort_keys for json.dumps so that the expected and actual
+        # payloads are guaranteed to be identical for mock_args assert check.
+        with mock.patch.object(snapshot_manage_client.json,
+                               'dumps') as mock_dumps:
+            mock_dumps.side_effect = lambda d: json_dumps(d, sort_keys=True)
+
+            self.check_service_client_function(
+                self.client.manage_snapshot,
+                'tempest.lib.common.rest_client.RestClient.post',
+                self.SNAPSHOT_MANAGE_RESPONSE,
+                to_utf=bytes_body,
+                status=202,
+                mock_args=['os-snapshot-manage', payload],
+                **self.SNAPSHOT_MANAGE_REQUEST['snapshot'])
+
+    def test_manage_snapshot_with_str_body(self):
+        self._test_manage_snapshot()
+
+    def test_manage_snapshot_with_bytes_body(self):
+        self._test_manage_snapshot(bytes_body=True)
diff --git a/tempest/tests/lib/services/volume/v2/test_volume_manage_client.py b/tempest/tests/lib/services/volume/v2/test_volume_manage_client.py
new file mode 100644
index 0000000..ea4a9f9
--- /dev/null
+++ b/tempest/tests/lib/services/volume/v2/test_volume_manage_client.py
@@ -0,0 +1,111 @@
+# Copyright 2017 FiberHome Telecommunication Technologies CO.,LTD
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import mock
+
+from oslo_serialization import jsonutils as json
+
+from tempest.lib.services.volume.v2 import volume_manage_client
+from tempest.tests.lib import fake_auth_provider
+from tempest.tests.lib.services import base
+
+
+class TestVolumeManageClient(base.BaseServiceTest):
+
+    VOLUME_MANAGE_REQUEST = {
+        "volume": {
+            "host": "controller1@rbd#rbd",
+            "name": "volume-managed",
+            "availability_zone": "nova",
+            "bootable": False,
+            "metadata": None,
+            "ref": {
+                "source-name": "volume-2ce6ca46-e6c1-4fe5-8268-3a1c536fcbf3"
+            },
+            "volume_type": None,
+            "description": "volume-manage-description"
+        }
+    }
+
+    VOLUME_MANAGE_RESPONSE = {
+        "volume": {
+            "migration_status": None,
+            "attachments": [],
+            "links": [
+                {
+                    "href": "fake-url-1",
+                    "rel": "self"
+                },
+                {
+                    "href": "fake-url-2",
+                    "rel": "bookmark"
+                }
+            ],
+            "availability_zone": "nova",
+            "os-vol-host-attr:host": "controller1@rbd#rbd",
+            "encrypted": False,
+            "updated_at": None,
+            "replication_status": None,
+            "snapshot_id": None,
+            "id": "c07cd4a4-b52b-4511-a176-fbaa2011a227",
+            "size": 0,
+            "user_id": "142d8663efce464c89811c63e45bd82e",
+            "os-vol-tenant-attr:tenant_id": "f21a9c86d7114bf99c711f4874d80474",
+            "os-vol-mig-status-attr:migstat": None,
+            "metadata": {},
+            "status": "creating",
+            "description": "volume-manage-description",
+            "multiattach": False,
+            "source_volid": None,
+            "consistencygroup_id": None,
+            "os-vol-mig-status-attr:name_id": None,
+            "name": "volume-managed",
+            "bootable": "false",
+            "created_at": "2017-07-11T09:14:01.000000",
+            "volume_type": None
+        }
+    }
+
+    def setUp(self):
+        super(TestVolumeManageClient, self).setUp()
+        fake_auth = fake_auth_provider.FakeAuthProvider()
+        self.client = volume_manage_client.VolumeManageClient(fake_auth,
+                                                              'volume',
+                                                              'regionOne')
+
+    def _test_manage_volume(self, bytes_body=False):
+        payload = json.dumps(self.VOLUME_MANAGE_REQUEST, sort_keys=True)
+        json_dumps = json.dumps
+
+        # NOTE: Use sort_keys for json.dumps so that the expected and actual
+        # payloads are guaranteed to be identical for mock_args assert check.
+        with mock.patch.object(volume_manage_client.json,
+                               'dumps') as mock_dumps:
+            mock_dumps.side_effect = lambda d: json_dumps(d, sort_keys=True)
+
+            self.check_service_client_function(
+                self.client.manage_volume,
+                'tempest.lib.common.rest_client.RestClient.post',
+                self.VOLUME_MANAGE_RESPONSE,
+                to_utf=bytes_body,
+                status=202,
+                mock_args=['os-volume-manage', payload],
+                **self.VOLUME_MANAGE_REQUEST['volume'])
+
+    def test_manage_volume_with_str_body(self):
+        self._test_manage_volume()
+
+    def test_manage_volume_with_bytes_body(self):
+        self._test_manage_volume(bytes_body=True)
diff --git a/tempest/tests/test_base_test.py b/tempest/tests/test_base_test.py
index 01b8a72..6c6f612 100644
--- a/tempest/tests/test_base_test.py
+++ b/tempest/tests/test_base_test.py
@@ -16,8 +16,8 @@
 
 from tempest import clients
 from tempest.common import credentials_factory as credentials
-from tempest.common import fixed_network
 from tempest import config
+from tempest.lib.common import fixed_network
 from tempest import test
 from tempest.tests import base
 from tempest.tests import fake_config