diff --git a/tempest/api/compute/servers/test_create_server.py b/tempest/api/compute/servers/test_create_server.py
index 4f0dbad..846f3be 100644
--- a/tempest/api/compute/servers/test_create_server.py
+++ b/tempest/api/compute/servers/test_create_server.py
@@ -162,6 +162,12 @@
     @classmethod
     def skip_checks(cls):
         super(ServersTestBootFromVolume, cls).skip_checks()
+        msg = None
         if not utils.get_service_list()['volume']:
             msg = "Volume service not enabled."
+        # The tests are not launched in upstream and not working with Ironic
+        if (hasattr(CONF.service_available, 'ironic') and
+            CONF.service_available.ironic):
+            msg = "Volume tests are not available for ironic."
+        if msg is not None:
             raise cls.skipException(msg)
diff --git a/tempest/api/compute/servers/test_server_actions.py b/tempest/api/compute/servers/test_server_actions.py
index f6494b5..901a391 100644
--- a/tempest/api/compute/servers/test_server_actions.py
+++ b/tempest/api/compute/servers/test_server_actions.py
@@ -608,6 +608,8 @@
     @decorators.idempotent_id('77eba8e0-036e-4635-944b-f7a8f3b78dc9')
     @testtools.skipUnless(CONF.compute_feature_enabled.shelve,
                           'Shelve is not available.')
+    @testtools.skipIf(getattr(CONF.service_available, 'barbican', False),
+                      'Barbican service is enabled, unshelve will not work')
     @utils.services('image')
     def test_shelve_unshelve_server(self):
         if CONF.image_feature_enabled.api_v2:
diff --git a/tempest/api/compute/servers/test_servers_negative.py b/tempest/api/compute/servers/test_servers_negative.py
index 0c1c05c..602f3be 100644
--- a/tempest/api/compute/servers/test_servers_negative.py
+++ b/tempest/api/compute/servers/test_servers_negative.py
@@ -475,6 +475,8 @@
     @decorators.idempotent_id('443e4f9b-e6bf-4389-b601-3a710f15fddd')
     @testtools.skipUnless(CONF.compute_feature_enabled.shelve,
                           'Shelve is not available.')
+    @testtools.skipIf(getattr(CONF.service_available, 'barbican', False),
+                      'Barbican service is enabled, unshelve will not work')
     @decorators.attr(type=['negative'])
     def test_shelve_shelved_server(self):
         # shelve a shelved server.
diff --git a/tempest/api/compute/volumes/test_attach_volume.py b/tempest/api/compute/volumes/test_attach_volume.py
index caa445d..f1869a9 100644
--- a/tempest/api/compute/volumes/test_attach_volume.py
+++ b/tempest/api/compute/volumes/test_attach_volume.py
@@ -221,6 +221,8 @@
             self.assertEqual(number_of_volumes, counted_volumes)
 
     @decorators.idempotent_id('13a940b6-3474-4c3c-b03f-29b89112bfee')
+    @testtools.skipIf(getattr(CONF.service_available, 'barbican', False),
+                      'Barbican service is enabled, unshelve will not work')
     def test_attach_volume_shelved_or_offload_server(self):
         # Create server, count number of volumes on it, shelve
         # server and attach pre-created volume to shelved server
@@ -246,6 +248,8 @@
         self.assertIsNotNone(volume_attachment['device'])
 
     @decorators.idempotent_id('b54e86dd-a070-49c4-9c07-59ae6dae15aa')
+    @testtools.skipIf(getattr(CONF.service_available, 'barbican', False),
+                      'Barbican service is enabled, unshelve will not work')
     def test_detach_volume_shelved_or_offload_server(self):
         # Count number of volumes on instance, shelve
         # server and attach pre-created volume to shelved server
diff --git a/tempest/common/waiters.py b/tempest/common/waiters.py
index 0e86f05..9fa2e7f 100644
--- a/tempest/common/waiters.py
+++ b/tempest/common/waiters.py
@@ -14,6 +14,7 @@
 import time
 
 from oslo_log import log as logging
+import six
 
 from tempest.common import image as common_image
 from tempest import config
@@ -265,13 +266,16 @@
 
 
 def wait_for_interface_status(client, server_id, port_id, status):
-    """Waits for an interface to reach a given status."""
+    """Waits for an interface to reach a (one of) given status(es)."""
+    if isinstance(status, six.string_types):
+        status = [status]
+
     body = (client.show_interface(server_id, port_id)
             ['interfaceAttachment'])
     interface_status = body['port_state']
     start = int(time.time())
 
-    while(interface_status != status):
+    while(interface_status not in status):
         time.sleep(client.build_interval)
         body = (client.show_interface(server_id, port_id)
                 ['interfaceAttachment'])
@@ -279,8 +283,8 @@
 
         timed_out = int(time.time()) - start >= client.build_timeout
 
-        if interface_status != status and timed_out:
-            message = ('Interface %s failed to reach %s status '
+        if interface_status not in status and timed_out:
+            message = ('Interface %s failed to reach either of %s statuses '
                        '(current %s) within the required time (%s s).' %
                        (port_id, status, interface_status,
                         client.build_timeout))
diff --git a/tempest/scenario/manager.py b/tempest/scenario/manager.py
index cdc30b9..3fa1667 100644
--- a/tempest/scenario/manager.py
+++ b/tempest/scenario/manager.py
@@ -820,8 +820,14 @@
             ports = self.os_admin.ports_client.list_ports(
                 device_id=server['id'])['ports']
         # A port can have more than one IP address in some cases.
-        # If the network is dual-stack (IPv4 + IPv6), this port is associated
-        # with 2 subnets
+        # If the network is dual-stack (IPv4 + IPv6), this port
+        # is associated with 2 subnets
+        port_map = [{"id": p["id"],
+                     "ip": fxip["ip_address"],
+                     "status": p["status"]}
+                    for p in ports
+                    for fxip in p["fixed_ips"]
+                    if netutils.is_valid_ipv4(fxip["ip_address"])]
         p_status = ['ACTIVE']
         # NOTE(vsaienko) With Ironic, instances live on separate hardware
         # servers. Neutron does not bind ports for Ironic instances, as a
@@ -829,22 +835,31 @@
         # TODO(vsaienko) remove once bug: #1599836 is resolved.
         if getattr(CONF.service_available, 'ironic', False):
             p_status.append('DOWN')
-        port_map = [(p["id"], fxip["ip_address"])
-                    for p in ports
-                    for fxip in p["fixed_ips"]
-                    if (netutils.is_valid_ipv4(fxip["ip_address"]) and
-                        p['status'] in p_status)]
-        inactive = [p for p in ports if p['status'] != 'ACTIVE']
+        # TODO(pas-ha) add a new waiter that will wait for all/at least one
+        # port on instance at once, and use it here
+        for pm in port_map:
+            try:
+                port = waiters.wait_for_interface_status(self.interface_client,
+                                                         server['id'],
+                                                         pm["id"], p_status)
+                pm["status"] = port['port_state']
+            except lib_exc.TimeoutException:
+                # NOTE(pas-ha) as server might have several IPv4 ports
+                # we need at least one of them to be in appropriate state
+                # so just ignore timeouts and deal with it later
+                pass
+        port_map = [p for p in port_map if p["status"] in p_status]
+        inactive = [p for p in port_map if p["status"] != 'ACTIVE']
         if inactive:
-            LOG.warning("Instance has ports that are not ACTIVE: %s", inactive)
-
+            LOG.warning("Instance has port that are not ACTIVE: %s", inactive)
         self.assertNotEmpty(port_map,
                             "No IPv4 addresses found in: %s" % ports)
         self.assertEqual(len(port_map), 1,
                          "Found multiple IPv4 addresses: %s. "
                          "Unable to determine which port to target."
                          % port_map)
-        return port_map[0]
+
+        return port_map[0]["id"], port_map[0]["ip"]
 
     def _get_network_by_name(self, network_name):
         net = self.os_admin.networks_client.list_networks(
diff --git a/tempest/scenario/test_encrypted_cinder_volumes.py b/tempest/scenario/test_encrypted_cinder_volumes.py
index 8c210d5..e2e54d2 100644
--- a/tempest/scenario/test_encrypted_cinder_volumes.py
+++ b/tempest/scenario/test_encrypted_cinder_volumes.py
@@ -13,6 +13,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import testtools
+
 from tempest.common import utils
 from tempest import config
 from tempest.lib import decorators
@@ -54,6 +56,8 @@
 
     @decorators.idempotent_id('79165fb4-5534-4b9d-8429-97ccffb8f86e')
     @decorators.attr(type='slow')
+    @testtools.skipIf(getattr(CONF.service_available, 'barbican', False),
+                      'Image Signature Verification enabled')
     @utils.services('compute', 'volume', 'image')
     def test_encrypted_cinder_volumes_luks(self):
         server = self.launch_instance()
@@ -63,6 +67,8 @@
 
     @decorators.idempotent_id('cbc752ed-b716-4717-910f-956cce965722')
     @decorators.attr(type='slow')
+    @testtools.skipIf(getattr(CONF.service_available, 'barbican', False),
+                      'Image Signature Verification enabled')
     @utils.services('compute', 'volume', 'image')
     def test_encrypted_cinder_volumes_cryptsetup(self):
         server = self.launch_instance()
diff --git a/tempest/scenario/test_minimum_basic.py b/tempest/scenario/test_minimum_basic.py
index 2b35e45..5ecef44 100644
--- a/tempest/scenario/test_minimum_basic.py
+++ b/tempest/scenario/test_minimum_basic.py
@@ -13,6 +13,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import testtools
+
 from tempest.common import custom_matchers
 from tempest.common import utils
 from tempest.common import waiters
@@ -99,6 +101,8 @@
                     return address
 
     @decorators.idempotent_id('bdbb5441-9204-419d-a225-b4fdbfb1a1a8')
+    @testtools.skipIf(getattr(CONF.service_available, 'barbican', False),
+                      'Image Signature Verification enabled')
     @utils.services('compute', 'volume', 'image', 'network')
     def test_minimum_basic_scenario(self):
         image = self.glance_image_create()
diff --git a/tempest/scenario/test_server_multinode.py b/tempest/scenario/test_server_multinode.py
index fdf875c..16202a1 100644
--- a/tempest/scenario/test_server_multinode.py
+++ b/tempest/scenario/test_server_multinode.py
@@ -33,6 +33,9 @@
         if CONF.compute.min_compute_nodes < 2:
             raise cls.skipException(
                 "Less than 2 compute nodes, skipping multinode tests.")
+        if getattr(CONF.service_available, 'ironic', False):
+            raise cls.skipException(
+                "Does not work for hybrid cloud")
 
     @decorators.idempotent_id('9cecbe35-b9d4-48da-a37e-7ce70aa43d30')
     @decorators.attr(type='smoke')
diff --git a/tempest/scenario/test_shelve_instance.py b/tempest/scenario/test_shelve_instance.py
index d6b6d14..49c92bd 100644
--- a/tempest/scenario/test_shelve_instance.py
+++ b/tempest/scenario/test_shelve_instance.py
@@ -80,6 +80,8 @@
     @decorators.idempotent_id('1164e700-0af0-4a4c-8792-35909a88743c')
     @testtools.skipUnless(CONF.network.public_network_id,
                           'The public_network_id option must be specified.')
+    @testtools.skipIf(getattr(CONF.service_available, 'barbican', False),
+                      'Barbican service is enabled, unshelve will not work')
     @utils.services('compute', 'network', 'image')
     def test_shelve_instance(self):
         self._create_server_then_shelve_and_unshelve()
@@ -88,6 +90,8 @@
     @decorators.idempotent_id('c1b6318c-b9da-490b-9c67-9339b627271f')
     @testtools.skipUnless(CONF.network.public_network_id,
                           'The public_network_id option must be specified.')
+    @testtools.skipIf(getattr(CONF.service_available, 'barbican', False),
+                      'Barbican service is enabled, unshelve will not work')
     @utils.services('compute', 'volume', 'network', 'image')
     def test_shelve_volume_backed_instance(self):
         self._create_server_then_shelve_and_unshelve(boot_from_volume=True)
diff --git a/tempest/scenario/test_snapshot_pattern.py b/tempest/scenario/test_snapshot_pattern.py
index a33d4d4..5b62242 100644
--- a/tempest/scenario/test_snapshot_pattern.py
+++ b/tempest/scenario/test_snapshot_pattern.py
@@ -44,6 +44,8 @@
     @decorators.attr(type='slow')
     @testtools.skipUnless(CONF.network.public_network_id,
                           'The public_network_id option must be specified.')
+    @testtools.skipIf(getattr(CONF.service_available, 'barbican', False),
+                      'Image Signature Verification enabled')
     @utils.services('compute', 'network', 'image')
     def test_snapshot_pattern(self):
         # prepare for booting an instance