diff --git a/.zuul.yaml b/.zuul.yaml
index 92d2f7c..ecc9284 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -433,6 +433,7 @@
       - opendev.org/openstack/senlin-tempest-plugin
       - opendev.org/openstack/solum-tempest-plugin
       - opendev.org/x/tap-as-a-service
+      - opendev.org/x/tap-as-a-service-tempest-plugin
       - opendev.org/openstack/telemetry-tempest-plugin
       - opendev.org/openstack/tempest-horizon
       - opendev.org/x/tobiko
@@ -443,6 +444,7 @@
       - opendev.org/openstack/vitrage-tempest-plugin
       - opendev.org/x/vmware-nsx-tempest-plugin
       - opendev.org/openstack/watcher-tempest-plugin
+      - opendev.org/x/whitebox-tempest-plugin
       - opendev.org/openstack/zaqar-tempest-plugin
       - opendev.org/openstack/zun-tempest-plugin
 
diff --git a/README.rst b/README.rst
index e8206ee..841fae6 100644
--- a/README.rst
+++ b/README.rst
@@ -119,6 +119,17 @@
    will run the same set of tests as the default gate jobs. Or you can
    use `unittest`_ compatible test runners such as `testr`_, `pytest`_ etc.
 
+   Tox also contains several existing job configurations. For example::
+
+    $ tox -e full
+
+   which will run the same set of tests as the OpenStack gate. (it's exactly how
+   the gate invokes Tempest) Or::
+
+    $ tox -e smoke
+
+   to run the tests tagged as smoke.
+
 .. _unittest: https://docs.python.org/3/library/unittest.html
 .. _testr: https://testrepository.readthedocs.org/en/latest/MANUAL.html
 .. _stestr: https://stestr.readthedocs.org/en/latest/MANUAL.html
@@ -270,14 +281,3 @@
 To run one single test serially ::
 
     $ testr run tempest.api.compute.servers.test_servers_negative.ServersNegativeTestJSON.test_reboot_non_existent_server
-
-Tox also contains several existing job configurations. For example::
-
-    $ tox -e full
-
-which will run the same set of tests as the OpenStack gate. (it's exactly how
-the gate invokes Tempest) Or::
-
-    $ tox -e smoke
-
-to run the tests tagged as smoke.
diff --git a/doc/source/data/tempest-blacklisted-plugins-registry.header b/doc/source/data/tempest-blacklisted-plugins-registry.header
new file mode 100644
index 0000000..6b6af11
--- /dev/null
+++ b/doc/source/data/tempest-blacklisted-plugins-registry.header
@@ -0,0 +1,7 @@
+Blacklisted Plugins
+===================
+
+List of Tempest plugin projects that are stale or unmaintained for a long
+time (6 months or more). They can be moved out of blacklist state once one
+of the relevant patches gets merged:
+https://review.opendev.org/#/q/topic:tempest-sanity-gate+%28status:open%29
diff --git a/releasenotes/notes/bug-1647999-7aeda50a8d082d4c.yaml b/releasenotes/notes/bug-1647999-7aeda50a8d082d4c.yaml
new file mode 100644
index 0000000..384f916
--- /dev/null
+++ b/releasenotes/notes/bug-1647999-7aeda50a8d082d4c.yaml
@@ -0,0 +1,8 @@
+---
+features:
+  - |
+    A new parameter, compute/compute_volume_common_az is introduced to
+    specify availability zone where tempest creates instances and volumes
+    for scenario tests, to allow us to run scenario tests in the deployment
+    which has multiple availability zones and cinder/cross_az_attach in
+    nova.conf is set to False.
diff --git a/releasenotes/notes/config_image_certificate_compute_feature-c56efb520d54aff5.yaml b/releasenotes/notes/config_image_certificate_compute_feature-c56efb520d54aff5.yaml
new file mode 100644
index 0000000..8475f50
--- /dev/null
+++ b/releasenotes/notes/config_image_certificate_compute_feature-c56efb520d54aff5.yaml
@@ -0,0 +1,8 @@
+---
+other:
+  - |
+    New configuration options ``[compute]/certified_image_ref`` and
+    ``[compute]/certified_image_trusted_certs`` have been introduced. These
+    are required in order to run the ``ServerShowV263Test`` test and allow a
+    signed image with the required img_signature_* properties set along
+    with a list of trusted certificates to be used during the test.
diff --git a/releasenotes/notes/remove-some-deprecated-auth-and-identity-options-xa1xd9b8fb948g4f.yaml b/releasenotes/notes/remove-some-deprecated-auth-and-identity-options-xa1xd9b8fb948g4f.yaml
new file mode 100644
index 0000000..fa21afd
--- /dev/null
+++ b/releasenotes/notes/remove-some-deprecated-auth-and-identity-options-xa1xd9b8fb948g4f.yaml
@@ -0,0 +1,8 @@
+upgrade:
+  - |
+    Remove deprecated config option ``endpoint_type`` from
+    ``identity`` group. Use ``v2_public_endpoint_type`` from
+    ``identity`` group instead.
+    Remove deprecated config option ``tenant_isolation_domain_name``
+    from ``auth`` group. Use ``default_credentials_domain_name`` from
+    ``auth`` group instead.
diff --git a/releasenotes/notes/remove-some-deprecated-identity-options-0ffxd1b8db928e43.yaml b/releasenotes/notes/remove-some-deprecated-identity-options-0ffxd1b8db928e43.yaml
new file mode 100644
index 0000000..e9e9444
--- /dev/null
+++ b/releasenotes/notes/remove-some-deprecated-identity-options-0ffxd1b8db928e43.yaml
@@ -0,0 +1,11 @@
+upgrade:
+  - |
+    Remove deprecated config option ``admin_username`` from
+    ``identity`` groups. Use ``admin_username`` from ``auth`` instead.
+    Remove deprecated config option ``admin_tenant_name`` from
+    ``auth`` and ``identity`` groups. Use ``admin_project_name`` from
+    ``auth`` instead.
+    Remove deprecated config option ``admin_password`` from
+    ``identity`` groups. Use ``admin_password`` from ``auth`` instead.
+    Remove deprecated config option ``admin_domain_name`` from
+    ``identity`` groups. Use ``admin_domain_name`` from ``auth`` instead.
\ No newline at end of file
diff --git a/tempest/api/compute/base.py b/tempest/api/compute/base.py
index e71e642..aaf7a5a 100644
--- a/tempest/api/compute/base.py
+++ b/tempest/api/compute/base.py
@@ -487,6 +487,9 @@
             kwargs['display_name'] = vol_name
         if image_ref is not None:
             kwargs['imageRef'] = image_ref
+        if CONF.compute.compute_volume_common_az:
+            kwargs.setdefault('availability_zone',
+                              CONF.compute.compute_volume_common_az)
         volume = cls.volumes_client.create_volume(**kwargs)['volume']
         cls.addClassResourceCleanup(
             cls.volumes_client.wait_for_resource_deletion, volume['id'])
diff --git a/tempest/api/compute/servers/test_novnc.py b/tempest/api/compute/servers/test_novnc.py
index daf6a06..50ffb21 100644
--- a/tempest/api/compute/servers/test_novnc.py
+++ b/tempest/api/compute/servers/test_novnc.py
@@ -16,6 +16,7 @@
 import struct
 
 import six
+import six.moves.urllib.parse as urlparse
 import urllib3
 
 from tempest.api.compute import base
@@ -73,8 +74,9 @@
                          'initial call: ' + six.text_type(resp.status))
         # Do some basic validation to make sure it is an expected HTML document
         resp_data = resp.data.decode()
-        self.assertIn('<html>', resp_data,
-                      'Not a valid html document in the response.')
+        # This is needed in the case of example: <html lang="en">
+        self.assertRegex(resp_data, '<html.*>',
+                         'Not a valid html document in the response.')
         self.assertIn('</html>', resp_data,
                       'Not a valid html document in the response.')
         # Just try to make sure we got JavaScript back for noVNC, since we
@@ -204,7 +206,18 @@
                                                type='novnc')['console']
         self.assertEqual('novnc', body['type'])
         # Do the WebSockify HTTP Request to novncproxy with a bad token
-        url = body['url'].replace('token=', 'token=bad')
+        parts = urlparse.urlparse(body['url'])
+        qparams = urlparse.parse_qs(parts.query)
+        if 'path' in qparams:
+            qparams['path'] = urlparse.unquote(qparams['path'][0]).replace(
+                'token=', 'token=bad')
+        elif 'token' in qparams:
+            qparams['token'] = 'bad' + qparams['token'][0]
+        new_query = urlparse.urlencode(qparams)
+        new_parts = urlparse.ParseResult(parts.scheme, parts.netloc,
+                                         parts.path, parts.params, new_query,
+                                         parts.fragment)
+        url = urlparse.urlunparse(new_parts)
         self._websocket = compute.create_websocket(url)
         # Make sure the novncproxy rejected the connection and closed it
         data = self._websocket.receive_frame()
diff --git a/tempest/api/compute/servers/test_servers.py b/tempest/api/compute/servers/test_servers.py
index e8b1161..91ebbc0 100644
--- a/tempest/api/compute/servers/test_servers.py
+++ b/tempest/api/compute/servers/test_servers.py
@@ -186,10 +186,17 @@
     min_microversion = '2.63'
     max_microversion = 'latest'
 
+    @testtools.skipUnless(CONF.compute.certified_image_ref,
+                          '``[compute]/certified_image_ref`` required to test '
+                          'image certificate validation.')
+    @testtools.skipUnless(CONF.compute.certified_image_trusted_certs,
+                          '``[compute]/certified_image_trusted_certs`` '
+                          'required to test image certificate validation.')
     @decorators.idempotent_id('71b8e3d5-11d2-494f-b917-b094a4afed3c')
     def test_show_update_rebuild_list_server(self):
-        trusted_certs = ['test-cert-1', 'test-cert-2']
+        trusted_certs = CONF.compute.certified_image_trusted_certs
         server = self.create_test_server(
+            imageRef=CONF.compute.certified_image_ref,
             trusted_image_certificates=trusted_certs,
             wait_until='ACTIVE')
 
diff --git a/tempest/api/identity/admin/v3/test_endpoints.py b/tempest/api/identity/admin/v3/test_endpoints.py
index 2cd8906..366d6a0 100644
--- a/tempest/api/identity/admin/v3/test_endpoints.py
+++ b/tempest/api/identity/admin/v3/test_endpoints.py
@@ -44,11 +44,14 @@
             cls.addClassResourceCleanup(
                 cls.services_client.delete_service, service['id'])
 
-            region = data_utils.rand_name('region')
+            region_name = data_utils.rand_name('region')
             url = data_utils.rand_url()
             endpoint = cls.client.create_endpoint(
                 service_id=cls.service_ids[i], interface=interfaces[i],
-                url=url, region=region, enabled=True)['endpoint']
+                url=url, region=region_name, enabled=True)['endpoint']
+            region = cls.regions_client.show_region(region_name)['region']
+            cls.addClassResourceCleanup(
+                cls.regions_client.delete_region, region['id'])
             cls.addClassResourceCleanup(
                 cls.client.delete_endpoint, endpoint['id'])
             cls.setup_endpoint_ids.append(endpoint['id'])
@@ -108,17 +111,19 @@
 
     @decorators.idempotent_id('0e2446d2-c1fd-461b-a729-b9e73e3e3b37')
     def test_create_list_show_delete_endpoint(self):
-        region = data_utils.rand_name('region')
+        region_name = data_utils.rand_name('region')
         url = data_utils.rand_url()
         interface = 'public'
         endpoint = self.client.create_endpoint(service_id=self.service_ids[0],
                                                interface=interface,
-                                               url=url, region=region,
+                                               url=url, region=region_name,
                                                enabled=True)['endpoint']
+        region = self.regions_client.show_region(region_name)['region']
+        self.addCleanup(self.regions_client.delete_region, region['id'])
         self.addCleanup(test_utils.call_and_ignore_notfound_exc,
                         self.client.delete_endpoint, endpoint['id'])
         # Asserting Create Endpoint response body
-        self.assertEqual(region, endpoint['region'])
+        self.assertEqual(region_name, endpoint['region'])
         self.assertEqual(url, endpoint['url'])
 
         # Checking if created endpoint is present in the list of endpoints
@@ -133,7 +138,7 @@
         self.assertEqual(self.service_ids[0], fetched_endpoint['service_id'])
         self.assertEqual(interface, fetched_endpoint['interface'])
         self.assertEqual(url, fetched_endpoint['url'])
-        self.assertEqual(region, fetched_endpoint['region'])
+        self.assertEqual(region_name, fetched_endpoint['region'])
         self.assertEqual(True, fetched_endpoint['enabled'])
 
         # Deleting the endpoint created in this method
@@ -161,28 +166,33 @@
         self.addCleanup(self.services_client.delete_service, service2['id'])
 
         # Creating an endpoint so as to check update endpoint with new values
-        region1 = data_utils.rand_name('region')
+        region1_name = data_utils.rand_name('region')
         url1 = data_utils.rand_url()
         interface1 = 'public'
         endpoint_for_update = (
             self.client.create_endpoint(service_id=self.service_ids[0],
                                         interface=interface1,
-                                        url=url1, region=region1,
+                                        url=url1, region=region1_name,
                                         enabled=True)['endpoint'])
-        self.addCleanup(self.client.delete_endpoint, endpoint_for_update['id'])
+        region1 = self.regions_client.show_region(region1_name)['region']
+        self.addCleanup(self.regions_client.delete_region, region1['id'])
 
         # Updating endpoint with new values
-        region2 = data_utils.rand_name('region')
+        region2_name = data_utils.rand_name('region')
         url2 = data_utils.rand_url()
         interface2 = 'internal'
         endpoint = self.client.update_endpoint(endpoint_for_update['id'],
                                                service_id=service2['id'],
                                                interface=interface2,
-                                               url=url2, region=region2,
+                                               url=url2, region=region2_name,
                                                enabled=False)['endpoint']
+        region2 = self.regions_client.show_region(region2_name)['region']
+        self.addCleanup(self.regions_client.delete_region, region2['id'])
+        self.addCleanup(self.client.delete_endpoint, endpoint_for_update['id'])
+
         # Asserting if the attributes of endpoint are updated
         self.assertEqual(service2['id'], endpoint['service_id'])
         self.assertEqual(interface2, endpoint['interface'])
         self.assertEqual(url2, endpoint['url'])
-        self.assertEqual(region2, endpoint['region'])
+        self.assertEqual(region2_name, endpoint['region'])
         self.assertEqual(False, endpoint['enabled'])
diff --git a/tempest/api/identity/admin/v3/test_endpoints_negative.py b/tempest/api/identity/admin/v3/test_endpoints_negative.py
index 4c3eb1c..164b577 100644
--- a/tempest/api/identity/admin/v3/test_endpoints_negative.py
+++ b/tempest/api/identity/admin/v3/test_endpoints_negative.py
@@ -70,14 +70,16 @@
     def _assert_update_raises_bad_request(self, enabled):
 
         # Create an endpoint
-        region1 = data_utils.rand_name('region')
+        region1_name = data_utils.rand_name('region')
         url1 = data_utils.rand_url()
         interface1 = 'public'
         endpoint_for_update = (
             self.client.create_endpoint(service_id=self.service_id,
                                         interface=interface1,
-                                        url=url1, region=region1,
+                                        url=url1, region=region1_name,
                                         enabled=True)['endpoint'])
+        region1 = self.regions_client.show_region(region1_name)['region']
+        self.addCleanup(self.regions_client.delete_region, region1['id'])
         self.addCleanup(self.client.delete_endpoint, endpoint_for_update['id'])
 
         self.assertRaises(lib_exc.BadRequest, self.client.update_endpoint,
diff --git a/tempest/api/identity/v2/test_users.py b/tempest/api/identity/v2/test_users.py
index 158dfb3..2eea860 100644
--- a/tempest/api/identity/v2/test_users.py
+++ b/tempest/api/identity/v2/test_users.py
@@ -15,6 +15,8 @@
 
 import time
 
+import testtools
+
 from tempest.api.identity import base
 from tempest import config
 from tempest.lib.common.utils import data_utils
@@ -78,6 +80,10 @@
         self.non_admin_users_client.auth_provider.set_auth()
 
     @decorators.idempotent_id('165859c9-277f-4124-9479-a7d1627b0ca7')
+    @testtools.skipIf(CONF.identity_feature_enabled.immutable_user_source,
+                      'Skipped because environment has an '
+                      'immutable user source and solely '
+                      'provides read-only access to users.')
     def test_user_update_own_password(self):
         old_pass = self.creds.password
         old_token = self.non_admin_users_client.token
diff --git a/tempest/api/identity/v3/test_users.py b/tempest/api/identity/v3/test_users.py
index 13b5161..d4e7612 100644
--- a/tempest/api/identity/v3/test_users.py
+++ b/tempest/api/identity/v3/test_users.py
@@ -77,6 +77,10 @@
         self.non_admin_users_client.auth_provider.set_auth()
 
     @decorators.idempotent_id('ad71bd23-12ad-426b-bb8b-195d2b635f27')
+    @testtools.skipIf(CONF.identity_feature_enabled.immutable_user_source,
+                      'Skipped because environment has an '
+                      'immutable user source and solely '
+                      'provides read-only access to users.')
     def test_user_update_own_password(self):
         old_pass = self.creds.password
         old_token = self.non_admin_client.token
@@ -102,6 +106,10 @@
     @testtools.skipUnless(CONF.identity_feature_enabled.security_compliance,
                           'Security compliance not available.')
     @decorators.idempotent_id('941784ee-5342-4571-959b-b80dd2cea516')
+    @testtools.skipIf(CONF.identity_feature_enabled.immutable_user_source,
+                      'Skipped because environment has an '
+                      'immutable user source and solely '
+                      'provides read-only access to users.')
     def test_password_history_check_self_service_api(self):
         old_pass = self.creds.password
         new_pass1 = data_utils.rand_password()
diff --git a/tempest/api/network/test_security_groups.py b/tempest/api/network/test_security_groups.py
index ea68005..ef19122 100644
--- a/tempest/api/network/test_security_groups.py
+++ b/tempest/api/network/test_security_groups.py
@@ -175,7 +175,14 @@
 
         sg_id = group_create_body['security_group']['id']
         direction = 'ingress'
-        protocol = 'icmp'
+        # The Neutron API accepts 'icmp', 'icmpv6' and 'ipv6-icmp' for
+        # IPv6 ICMP protocol names, but the latter is preferred and the
+        # others considered "legacy".  Use 'ipv6-icmp' as the API could
+        # change to return only that value, see
+        # https://review.opendev.org/#/c/453346/
+        # The neutron-tempest-plugin API tests pass all three and verify
+        # the output, so there is no need to duplicate that here.
+        protocol = 'ipv6-icmp' if self._ip_version == 6 else 'icmp'
         icmp_type_codes = [(3, 2), (3, 0), (8, 0), (0, 0), (11, None)]
         for icmp_type, icmp_code in icmp_type_codes:
             self._create_verify_security_group_rule(sg_id, direction,
diff --git a/tempest/api/volume/base.py b/tempest/api/volume/base.py
index 64fe29a..1bfd075 100644
--- a/tempest/api/volume/base.py
+++ b/tempest/api/volume/base.py
@@ -124,6 +124,10 @@
             name = data_utils.rand_name(cls.__name__ + '-Volume')
             kwargs['name'] = name
 
+        if CONF.compute.compute_volume_common_az:
+            kwargs.setdefault('availability_zone',
+                              CONF.compute.compute_volume_common_az)
+
         volume = cls.volumes_client.create_volume(**kwargs)['volume']
         cls.addClassResourceCleanup(test_utils.call_and_ignore_notfound_exc,
                                     cls.delete_volume, cls.volumes_client,
diff --git a/tempest/api/volume/test_volumes_extend.py b/tempest/api/volume/test_volumes_extend.py
index ac9a9c7..c3f44e2 100644
--- a/tempest/api/volume/test_volumes_extend.py
+++ b/tempest/api/volume/test_volumes_extend.py
@@ -32,7 +32,7 @@
     @decorators.idempotent_id('9a36df71-a257-43a5-9555-dc7c88e66e0e')
     def test_volume_extend(self):
         # Extend Volume Test.
-        volume = self.create_volume(image_ref=self.image_ref)
+        volume = self.create_volume(imageRef=self.image_ref)
         extend_size = volume['size'] * 2
         self.volumes_client.extend_volume(volume['id'],
                                           new_size=extend_size)
diff --git a/tempest/api/volume/test_volumes_snapshots.py b/tempest/api/volume/test_volumes_snapshots.py
index 1855386..72e7290 100644
--- a/tempest/api/volume/test_volumes_snapshots.py
+++ b/tempest/api/volume/test_volumes_snapshots.py
@@ -44,7 +44,7 @@
         server = self.create_server()
         # NOTE(zhufl) Here we create volume from self.image_ref for adding
         # coverage for "creating snapshot from non-blank volume".
-        volume = self.create_volume(image_ref=self.image_ref)
+        volume = self.create_volume(imageRef=self.image_ref)
         self.attach_volume(server['id'], volume['id'])
 
         # Snapshot a volume which attached to an instance with force=False
diff --git a/tempest/cmd/cleanup.py b/tempest/cmd/cleanup.py
index e6db2e9..f0d7264 100644
--- a/tempest/cmd/cleanup.py
+++ b/tempest/cmd/cleanup.py
@@ -94,6 +94,8 @@
 
 class TempestCleanup(command.Command):
 
+    GOT_EXCEPTIONS = []
+
     def take_action(self, parsed_args):
         try:
             self.init(parsed_args)
@@ -103,6 +105,8 @@
             LOG.exception("Failure during cleanup")
             traceback.print_exc()
             raise
+        if self.GOT_EXCEPTIONS:
+            raise Exception(self.GOT_EXCEPTIONS)
 
     def init(self, parsed_args):
         cleanup_service.init_conf()
@@ -159,7 +163,8 @@
                   'is_dry_run': is_dry_run,
                   'saved_state_json': self.json_data,
                   'is_preserve': is_preserve,
-                  'is_save_state': is_save_state}
+                  'is_save_state': is_save_state,
+                  'got_exceptions': self.GOT_EXCEPTIONS}
         for service in self.global_services:
             svc = service(admin_mgr, **kwargs)
             svc.run()
@@ -200,7 +205,8 @@
                   'saved_state_json': self.json_data,
                   'is_preserve': is_preserve,
                   'is_save_state': False,
-                  'project_id': project_id}
+                  'project_id': project_id,
+                  'got_exceptions': self.GOT_EXCEPTIONS}
         for service in self.project_services:
             svc = service(mgr, **kwargs)
             svc.run()
@@ -300,7 +306,8 @@
                   'is_dry_run': False,
                   'saved_state_json': data,
                   'is_preserve': False,
-                  'is_save_state': True}
+                  'is_save_state': True,
+                  'got_exceptions': self.GOT_EXCEPTIONS}
         for service in self.global_services:
             svc = service(admin_mgr, **kwargs)
             svc.run()
diff --git a/tempest/cmd/cleanup_service.py b/tempest/cmd/cleanup_service.py
index 104958a..ccceb34 100644
--- a/tempest/cmd/cleanup_service.py
+++ b/tempest/cmd/cleanup_service.py
@@ -22,6 +22,7 @@
 from tempest.common import utils
 from tempest.common.utils import net_info
 from tempest import config
+from tempest.lib import exceptions
 
 LOG = logging.getLogger(__name__)
 CONF = config.CONF
@@ -127,12 +128,23 @@
         pass
 
     def run(self):
-        if self.is_dry_run:
-            self.dry_run()
-        elif self.is_save_state:
-            self.save_state()
-        else:
-            self.delete()
+        try:
+            if self.is_dry_run:
+                self.dry_run()
+            elif self.is_save_state:
+                self.save_state()
+            else:
+                self.delete()
+        except exceptions.NotImplemented as exc:
+            # Many OpenStack services use extensions logic to implement the
+            # features or resources. Tempest cleanup tries to clean up the test
+            # resources without having much logic of extensions checks etc.
+            # If any of the extension is missing then, service will return
+            # NotImplemented error.
+            msg = ("Got NotImplemented error in %s, full exception: %s" %
+                   (str(self.__class__), str(exc)))
+            LOG.exception(msg)
+            self.got_exceptions.append(msg)
 
 
 class SnapshotService(BaseService):
diff --git a/tempest/common/compute.py b/tempest/common/compute.py
index 1489e60..cd85ede 100644
--- a/tempest/common/compute.py
+++ b/tempest/common/compute.py
@@ -167,6 +167,9 @@
         params = {'name': volume_name,
                   'imageRef': image_id,
                   'size': CONF.volume.volume_size}
+        if CONF.compute.compute_volume_common_az:
+            params.setdefault('availability_zone',
+                              CONF.compute.compute_volume_common_az)
         volume = volumes_client.create_volume(**params)
         try:
             waiters.wait_for_volume_resource_status(volumes_client,
@@ -193,6 +196,9 @@
         # to be specified.
         image_id = ''
 
+    if CONF.compute.compute_volume_common_az:
+        kwargs.setdefault('availability_zone',
+                          CONF.compute.compute_volume_common_az)
     body = clients.servers_client.create_server(name=name, imageRef=image_id,
                                                 flavorRef=flavor,
                                                 **kwargs)
@@ -392,8 +398,11 @@
 
     def _upgrade(self, url):
         """Upgrade the HTTP connection to a WebSocket and verify."""
-        # The real request goes to the /websockify URI always
-        reqdata = 'GET /websockify HTTP/1.1\r\n'
+        # It is possible to pass the path as a query parameter in the request,
+        # so use it if present
+        qparams = urlparse.parse_qs(url.query)
+        path = qparams['path'][0] if 'path' in qparams else '/websockify'
+        reqdata = 'GET %s HTTP/1.1\r\n' % path
         reqdata += 'Host: %s' % url.hostname
         # Add port only if we have one specified
         if url.port:
@@ -402,7 +411,7 @@
         reqdata += '\r\n'
         # Tell the HTTP Server to Upgrade the connection to a WebSocket
         reqdata += 'Upgrade: websocket\r\nConnection: Upgrade\r\n'
-        # The token=xxx is sent as a Cookie not in the URI
+        # The token=xxx is sent as a Cookie not in the URI for noVNC < v1.1.0
         reqdata += 'Cookie: %s\r\n' % url.query
         # Use a hard-coded WebSocket key since a test program
         reqdata += 'Sec-WebSocket-Key: x3JJHMbDL1EzLkh9GBhXDw==\r\n'
diff --git a/tempest/common/waiters.py b/tempest/common/waiters.py
index 77ec0f8..11f3bf9 100644
--- a/tempest/common/waiters.py
+++ b/tempest/common/waiters.py
@@ -121,7 +121,9 @@
                      '/'.join((server_status, str(task_state))),
                      time.time() - start_time)
         if server_status == 'ERROR' and not ignore_error:
-            raise lib_exc.DeleteErrorException(resource_id=server_id)
+            raise lib_exc.DeleteErrorException(
+                "Server %s failed to delete and is in ERROR status" %
+                server_id)
 
         if int(time.time()) - start_time >= client.build_timeout:
             raise lib_exc.TimeoutException
@@ -202,6 +204,8 @@
                 resource_name=resource_name, resource_id=resource_id)
         if resource_name == 'volume' and resource_status == 'error_restoring':
             raise exceptions.VolumeRestoreErrorException(volume_id=resource_id)
+        if resource_status == 'error_extending' and resource_status != status:
+            raise exceptions.VolumeExtendErrorException(volume_id=resource_id)
 
         if int(time.time()) - start >= client.build_timeout:
             message = ('%s %s failed to reach %s status (current %s) '
diff --git a/tempest/config.py b/tempest/config.py
index eea5993..4f0774f 100644
--- a/tempest/config.py
+++ b/tempest/config.py
@@ -69,10 +69,7 @@
     cfg.StrOpt('default_credentials_domain_name',
                default='Default',
                help="Default domain used when getting v3 credentials. "
-                    "This is the name keystone uses for v2 compatibility.",
-               deprecated_opts=[cfg.DeprecatedOpt(
-                                'tenant_isolation_domain_name',
-                                group='auth')]),
+                    "This is the name keystone uses for v2 compatibility."),
     cfg.BoolOpt('create_isolated_networks',
                 default=True,
                 help="If use_dynamic_credentials is set to True and Neutron "
@@ -84,27 +81,20 @@
     cfg.StrOpt('admin_username',
                help="Username for an administrative user. This is needed for "
                     "authenticating requests made by project isolation to "
-                    "create users and projects",
-               deprecated_group='identity'),
+                    "create users and projects"),
     cfg.StrOpt('admin_project_name',
                help="Project name to use for an administrative user. This is "
                     "needed for authenticating requests made by project "
-                    "isolation to create users and projects",
-               deprecated_opts=[cfg.DeprecatedOpt('admin_tenant_name',
-                                                  group='auth'),
-                                cfg.DeprecatedOpt('admin_tenant_name',
-                                                  group='identity')]),
+                    "isolation to create users and projects"),
     cfg.StrOpt('admin_password',
                help="Password to use for an administrative user. This is "
                     "needed for authenticating requests made by project "
                     "isolation to create users and projects",
-               secret=True,
-               deprecated_group='identity'),
+               secret=True),
     cfg.StrOpt('admin_domain_name',
                default='Default',
                help="Admin domain name for authentication (Keystone V3). "
-                    "The same domain applies to user and project",
-               deprecated_group='identity'),
+                    "The same domain applies to user and project"),
 ]
 
 identity_group = cfg.OptGroup(name='identity',
@@ -146,9 +136,7 @@
                choices=['public', 'admin', 'internal',
                         'publicURL', 'adminURL', 'internalURL'],
                help="The public endpoint type to use for OpenStack Identity "
-                    "(Keystone) API v2",
-               deprecated_opts=[cfg.DeprecatedOpt('endpoint_type',
-                                                  group='identity')]),
+                    "(Keystone) API v2"),
     cfg.StrOpt('v3_endpoint_type',
                default='adminURL',
                choices=['public', 'admin', 'internal',
@@ -283,6 +271,17 @@
                help="Valid secondary image reference to be used in tests. "
                     "This is a required option, but if only one image is "
                     "available duplicate the value of image_ref above"),
+    cfg.StrOpt('certified_image_ref',
+               help="Valid image reference to be used in image certificate "
+                    "validation tests when enabled. This image must also "
+                    "have the required img_signature_* properties set. "
+                    "Additional details available within the following Nova "
+                    "documentation: https://docs.openstack.org/nova/latest/"
+                    "user/certificate-validation.html"),
+    cfg.ListOpt('certified_image_trusted_certs',
+                help="A list of trusted certificates to be used when the "
+                     "image certificate validation compute feature is "
+                     "enabled."),
     cfg.StrOpt('flavor_ref',
                default="1",
                help="Valid primary flavor to use in tests."),
@@ -364,6 +363,19 @@
                     "If both values are not specified, Tempest avoids tests "
                     "which require a microversion. Valid values are string "
                     "with format 'X.Y' or string 'latest'"),
+    cfg.StrOpt('compute_volume_common_az',
+               default=None,
+               help='AZ to be used for Cinder and Nova. Set this parameter '
+                    'when the cloud has nova.conf: cinder.cross_az_attach '
+                    'set to false. Which means volumes attached to an '
+                    'instance must be in the same availability zone in Cinder '
+                    'as the instance availability zone in Nova. Set the '
+                    'common availability zone in this config which will be '
+                    'used to boot an instance as well as creating a volume. '
+                    'NOTE: If that AZ is not in Cinder (or '
+                    'allow_availability_zone_fallback=False in cinder.conf), '
+                    'the volume create request will fail and the instance '
+                    'will fail the build request.'),
 ]
 
 placement_group = cfg.OptGroup(name='placement',
diff --git a/tempest/exceptions.py b/tempest/exceptions.py
old mode 100644
new mode 100755
index a430d5d..c05e7a6
--- a/tempest/exceptions.py
+++ b/tempest/exceptions.py
@@ -42,6 +42,11 @@
     message = "Volume %(volume_id)s failed to restore and is in ERROR status"
 
 
+class VolumeExtendErrorException(exceptions.TempestException):
+    message = ("Volume %(volume_id)s failed to extend and "
+               "is in error_extending status")
+
+
 class StackBuildErrorException(exceptions.TempestException):
     message = ("Stack %(stack_identifier)s is in %(stack_status)s status "
                "due to '%(stack_status_reason)s'")
diff --git a/tempest/lib/services/volume/v3/volumes_client.py b/tempest/lib/services/volume/v3/volumes_client.py
index 2dbdd11..a93c76e 100644
--- a/tempest/lib/services/volume/v3/volumes_client.py
+++ b/tempest/lib/services/volume/v3/volumes_client.py
@@ -212,7 +212,9 @@
         except lib_exc.NotFound:
             return True
         if volume["volume"]["status"] == "error_deleting":
-            raise lib_exc.DeleteErrorException(resource_id=id)
+            raise lib_exc.DeleteErrorException(
+                "Volume %s failed to delete and is in error_deleting status" %
+                volume['id'])
         return False
 
     @property
diff --git a/tempest/scenario/manager.py b/tempest/scenario/manager.py
index da41d62..1252f09 100644
--- a/tempest/scenario/manager.py
+++ b/tempest/scenario/manager.py
@@ -274,6 +274,10 @@
 
         tenant_network = self.get_tenant_network()
 
+        if CONF.compute.compute_volume_common_az:
+            kwargs.setdefault('availability_zone',
+                              CONF.compute.compute_volume_common_az)
+
         body, _ = compute.create_test_server(
             clients,
             tenant_network=tenant_network,
@@ -307,6 +311,11 @@
                   'imageRef': imageRef,
                   'volume_type': volume_type,
                   'size': size}
+
+        if CONF.compute.compute_volume_common_az:
+            kwargs.setdefault('availability_zone',
+                              CONF.compute.compute_volume_common_az)
+
         volume = self.volumes_client.create_volume(**kwargs)['volume']
 
         self.addCleanup(self.volumes_client.wait_for_resource_deletion,
diff --git a/tempest/tests/cmd/test_cleanup.py b/tempest/tests/cmd/test_cleanup.py
index b47da0b..1618df9 100644
--- a/tempest/tests/cmd/test_cleanup.py
+++ b/tempest/tests/cmd/test_cleanup.py
@@ -12,6 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import mock
+
 from tempest.cmd import cleanup
 from tempest.tests import base
 
@@ -24,3 +26,17 @@
         test_saved_json = 'tempest/tests/cmd/test_saved_state_json.json'
         # test if the file is loaded without any issues/exceptions
         c._load_json(test_saved_json)
+
+    @mock.patch('tempest.cmd.cleanup.TempestCleanup.init')
+    @mock.patch('tempest.cmd.cleanup.TempestCleanup._cleanup')
+    def test_take_action_got_exception(self, mock_cleanup, mock_init):
+        c = cleanup.TempestCleanup(None, None, 'test')
+        c.GOT_EXCEPTIONS.append('exception')
+        mock_cleanup.return_value = True
+        mock_init.return_value = True
+        try:
+            c.take_action(mock.Mock())
+        except Exception as exc:
+            self.assertEqual(str(exc), '[\'exception\']')
+            return
+        assert False
diff --git a/tempest/tests/cmd/test_cleanup_services.py b/tempest/tests/cmd/test_cleanup_services.py
index 3262b1c..de0dbec 100644
--- a/tempest/tests/cmd/test_cleanup_services.py
+++ b/tempest/tests/cmd/test_cleanup_services.py
@@ -19,6 +19,7 @@
 from tempest import clients
 from tempest.cmd import cleanup_service
 from tempest import config
+from tempest.lib import exceptions
 from tempest.tests import base
 from tempest.tests import fake_config
 from tempest.tests.lib import fake_credentials
@@ -27,13 +28,24 @@
 
 class TestBaseService(base.TestCase):
 
+    class TestException(cleanup_service.BaseService):
+        def delete(self):
+            raise exceptions.NotImplemented
+
+        def dry_run(self):
+            raise exceptions.NotImplemented
+
+        def save_state(self):
+            raise exceptions.NotImplemented
+
     def test_base_service_init(self):
         kwargs = {'data': {'data': 'test'},
                   'is_dry_run': False,
                   'saved_state_json': {'saved': 'data'},
                   'is_preserve': False,
                   'is_save_state': True,
-                  'tenant_id': 'project_id'}
+                  'tenant_id': 'project_id',
+                  'got_exceptions': []}
         base = cleanup_service.BaseService(kwargs)
         self.assertEqual(base.data, kwargs['data'])
         self.assertFalse(base.is_dry_run)
@@ -41,6 +53,28 @@
         self.assertFalse(base.is_preserve)
         self.assertTrue(base.is_save_state)
         self.assertEqual(base.tenant_filter['project_id'], kwargs['tenant_id'])
+        self.assertEqual(base.got_exceptions, kwargs['got_exceptions'])
+
+    def test_not_implemented_ex(self):
+        kwargs = {'data': {'data': 'test'},
+                  'is_dry_run': False,
+                  'saved_state_json': {'saved': 'data'},
+                  'is_preserve': False,
+                  'is_save_state': False,
+                  'tenant_id': 'project_id',
+                  'got_exceptions': []}
+        base = self.TestException(kwargs)
+        # delete
+        base.run()
+        self.assertEqual(len(base.got_exceptions), 1)
+        # save_state
+        base.save_state = True
+        base.run()
+        self.assertEqual(len(base.got_exceptions), 2)
+        # dry_run
+        base.is_dry_run = True
+        base.run()
+        self.assertEqual(len(base.got_exceptions), 3)
 
 
 class MockFunctionsBase(base.TestCase):
diff --git a/tempest/tests/common/test_waiters.py b/tempest/tests/common/test_waiters.py
old mode 100644
new mode 100755
index d56e8a4..02e1c99
--- a/tempest/tests/common/test_waiters.py
+++ b/tempest/tests/common/test_waiters.py
@@ -73,6 +73,25 @@
                                     mock.call(volume_id)])
         mock_sleep.assert_called_once_with(1)
 
+    @mock.patch.object(time, 'sleep')
+    def test_wait_for_volume_status_error_extending(self, mock_sleep):
+        # Tests that the wait method raises VolumeExtendErrorException if
+        # the volume status is 'error_extending'.
+        client = mock.Mock(spec=volumes_client.VolumesClient,
+                           resource_type="volume",
+                           build_interval=1)
+        volume1 = {'volume': {'status': 'extending'}}
+        volume2 = {'volume': {'status': 'error_extending'}}
+        mock_show = mock.Mock(side_effect=(volume1, volume2))
+        client.show_volume = mock_show
+        volume_id = '7532b91e-aa0a-4e06-b3e5-20c0c5ee1caa'
+        self.assertRaises(exceptions.VolumeExtendErrorException,
+                          waiters.wait_for_volume_resource_status,
+                          client, volume_id, 'available')
+        mock_show.assert_has_calls([mock.call(volume_id),
+                                    mock.call(volume_id)])
+        mock_sleep.assert_called_once_with(1)
+
 
 class TestInterfaceWaiters(base.TestCase):
 
diff --git a/tools/generate-tempest-plugins-list.py b/tools/generate-tempest-plugins-list.py
index 746cb34..35b1144 100644
--- a/tools/generate-tempest-plugins-list.py
+++ b/tools/generate-tempest-plugins-list.py
@@ -25,6 +25,7 @@
 
 import json
 import re
+import sys
 
 try:
     # For Python 3.0 and later
@@ -35,6 +36,25 @@
     import urllib2 as urllib
     from urllib2 import HTTPError
 
+# List of projects having tempest plugin stale or unmaintained for a long time
+# (6 months or more)
+# TODO(masayukig): Some of these can be removed from BLACKLIST in the future
+# when the patches are merged.
+BLACKLIST = [
+    'barbican-tempest-plugin',  # https://review.opendev.org/#/c/634631/
+    'cyborg-tempest-plugin',  # https://review.opendev.org/659687
+    'intel-nfv-ci-tests',  # https://review.opendev.org/#/c/634640/
+    'networking-ansible',  # https://review.opendev.org/#/c/634647/
+    'networking-generic-switch',  # https://review.opendev.org/#/c/634846/
+    'networking-l2gw-tempest-plugin',  # https://review.opendev.org/#/c/635093/
+    'networking-midonet',  # https://review.opendev.org/#/c/635096/
+    'networking-plumgrid',  # https://review.opendev.org/#/c/635096/
+    'networking-spp',  # https://review.opendev.org/#/c/635098/
+    'neutron-dynamic-routing',  # https://review.opendev.org/#/c/637718/
+    'neutron-vpnaas',  # https://review.opendev.org/#/c/637719/
+    'nova-lxd',  # https://review.opendev.org/#/c/638334/
+    'valet',  # https://review.opendev.org/#/c/638339/
+]
 
 url = 'https://review.opendev.org/projects/'
 
@@ -47,15 +67,10 @@
 '''
 
 
-def is_in_openstack_namespace(proj):
-    return proj.startswith('openstack/')
-
 # Rather than returning a 404 for a nonexistent file, cgit delivers a
 # 0-byte response to a GET request.  It also does not provide a
 # Content-Length in a HEAD response, so the way we tell if a file exists
 # is to check the length of the entire GET response body.
-
-
 def has_tempest_plugin(proj):
     try:
         r = urllib.urlopen(
@@ -71,24 +86,45 @@
         False
 
 
+if len(sys.argv) > 1 and sys.argv[1] == 'blacklist':
+    for black_plugin in BLACKLIST:
+        print(black_plugin)
+    # We just need BLACKLIST when we use this `blacklist` option.
+    # So, this exits here.
+    sys.exit()
+
 r = urllib.urlopen(url)
 # Gerrit prepends 4 garbage octets to the JSON, in order to counter
 # cross-site scripting attacks.  Therefore we must discard it so the
 # json library won't choke.
 content = r.read().decode('utf-8')[4:]
-projects = sorted(filter(is_in_openstack_namespace, json.loads(content)))
+projects = sorted(json.loads(content))
 
-# Retrieve projects having no deb, puppet, ui or spec namespace as those
+# Retrieve projects having no deployment tool repo (such as deb,
+# puppet, ansible, etc.), infra repos, ui or spec namespace as those
 # namespaces do not contains tempest plugins.
 projects_list = [i for i in projects if not (
+    i.startswith('openstack-dev/') or
+    i.startswith('openstack-infra/') or
+    i.startswith('openstack/ansible-') or
+    i.startswith('openstack/charm-') or
+    i.startswith('openstack/cookbook-openstack-') or
+    i.startswith('openstack/devstack-') or
+    i.startswith('openstack/fuel-') or
     i.startswith('openstack/deb-') or
     i.startswith('openstack/puppet-') or
+    i.startswith('openstack/openstack-ansible-') or
+    i.startswith('x/deb-') or
+    i.startswith('x/fuel-') or
+    i.startswith('x/python-') or
+    i.startswith('zuul/') or
     i.endswith('-ui') or
     i.endswith('-specs'))]
 
 found_plugins = list(filter(has_tempest_plugin, projects_list))
 
-# Every element of the found_plugins list begins with "openstack/".
-# We drop those initial 10 octets when printing the list.
+# We have tempest plugins not only in 'openstack/' namespace but also the
+# other name spaces such as 'airship/', 'x/', etc.
+# So, we print all of them here.
 for project in found_plugins:
-    print(project[10:])
+    print(project)
diff --git a/tools/generate-tempest-plugins-list.sh b/tools/generate-tempest-plugins-list.sh
index b4e5430..6e473b7 100755
--- a/tools/generate-tempest-plugins-list.sh
+++ b/tools/generate-tempest-plugins-list.sh
@@ -61,20 +61,37 @@
     printf " ===\n"
 }
 
+function print_plugin_table() {
+    title_underline ${name_col_len}
+    printf "%-3s %-${name_col_len}s %s\n" "SR" "Plugin Name" "URL"
+    title_underline ${name_col_len}
+
+    i=0
+    for plugin in $1; do
+        i=$((i+1))
+        giturl="https://opendev.org/openstack/${plugin}"
+        printf "%-3s %-${name_col_len}s %s\n" "$i" "${plugin}" "${giturl}"
+    done
+
+    title_underline ${name_col_len}
+}
+
 printf "\n\n"
-title_underline ${name_col_len}
-printf "%-3s %-${name_col_len}s %s\n" "SR" "Plugin Name" "URL"
-title_underline ${name_col_len}
+print_plugin_table "${sorted_plugins}"
 
-i=0
-for plugin in ${sorted_plugins}; do
-    i=$((i+1))
-    giturl="https://opendev.org/openstack/${plugin}"
-    gitlink="https://opendev.org/openstack/${plugin}"
-    printf "%-3s %-${name_col_len}s %s\n" "$i" "${plugin}" "\`${giturl} <${gitlink}>\`__"
-done
+printf "\n\n"
 
-title_underline ${name_col_len}
+# Print BLACKLIST
+if [[ -r doc/source/data/tempest-blacklisted-plugins-registry.header ]]; then
+    cat doc/source/data/tempest-blacklisted-plugins-registry.header
+fi
+
+blacklist=$(python tools/generate-tempest-plugins-list.py blacklist)
+name_col_len=$(echo "${blacklist}" | wc -L)
+name_col_len=$(( name_col_len + 20 ))
+
+printf "\n\n"
+print_plugin_table "${blacklist}"
 
 printf "\n\n"
 
diff --git a/tools/tempest-plugin-sanity.sh b/tools/tempest-plugin-sanity.sh
index b291fcc..b652369 100644
--- a/tools/tempest-plugin-sanity.sh
+++ b/tools/tempest-plugin-sanity.sh
@@ -43,49 +43,19 @@
 
 # retrieve a list of projects having tempest plugins
 PROJECT_LIST="$(python tools/generate-tempest-plugins-list.py)"
-# List of projects having tempest plugin stale or unmaintained for a long time
-# (6 months or more)
-# TODO(masayukig): Some of these can be removed from BLACKLIST in the future.
-# barbican-tempest-plugin: https://review.opendev.org/#/c/634631/
-# cyborg-tempest-plugin: https://review.opendev.org/659687
-# intel-nfv-ci-tests: https://review.opendev.org/#/c/634640/
-# networking-ansible: https://review.opendev.org/#/c/634647/
-# networking-generic-switch: https://review.opendev.org/#/c/634846/
-# networking-l2gw-tempest-plugin: https://review.opendev.org/#/c/635093/
-# networking-midonet: https://review.opendev.org/#/c/635096/
-# networking-plumgrid: https://review.opendev.org/#/c/635096/
-# networking-spp: https://review.opendev.org/#/c/635098/
-# neutron-dynamic-routing: https://review.opendev.org/#/c/637718/
-# neutron-vpnaas: https://review.opendev.org/#/c/637719/
-# nova-lxd: https://review.opendev.org/#/c/638334/
-# valet: https://review.opendev.org/#/c/638339/
 
-BLACKLIST="
-barbican-tempest-plugin
-cyborg-tempest-plugin
-intel-nfv-ci-tests
-networking-ansible
-networking-generic-switch
-networking-l2gw-tempest-plugin
-networking-midonet
-networking-plumgrid
-networking-spp
-neutron-dynamic-routing
-neutron-vpnaas
-nova-lxd
-valet
-"
+BLACKLIST="$(python tools/generate-tempest-plugins-list.py blacklist)"
 
 # Function to clone project using zuul-cloner or from git
 function clone_project() {
     if [ -e /usr/zuul-env/bin/zuul-cloner ]; then
         /usr/zuul-env/bin/zuul-cloner --cache-dir /opt/git \
         https://opendev.org \
-        openstack/"$1"
+        "$1"
 
     elif [ -e /usr/bin/git ]; then
-        /usr/bin/git clone https://opendev.org/openstack/"$1" \
-        openstack/"$1"
+        /usr/bin/git clone https://opendev.org/"$1" \
+        "$1"
 
     fi
 }
@@ -103,10 +73,10 @@
 
 # Function to install project
 function install_project() {
-    "$TVENV" pip install "$SANITY_DIR"/openstack/"$1"
+    "$TVENV" pip install "$SANITY_DIR"/"$1"
     # Check for test-requirements.txt file in a project then install it.
-    if [ -e "$SANITY_DIR"/openstack/"$1"/test-requirements.txt ]; then
-        "$TVENV" pip install -r "$SANITY_DIR"/openstack/"$1"/test-requirements.txt
+    if [ -e "$SANITY_DIR"/"$1"/test-requirements.txt ]; then
+        "$TVENV" pip install -r "$SANITY_DIR"/"$1"/test-requirements.txt
     fi
 }
 
@@ -124,7 +94,7 @@
     # Remove the sanity workspace in case of remaining
     rm -fr "$SANITY_DIR"/tempest_sanity
     # Remove the project directory after sanity run
-    rm -fr "$SANITY_DIR"/openstack/"$1"
+    rm -fr "$SANITY_DIR"/"$1"
 
     return $retval
 }
@@ -151,8 +121,10 @@
     fi
 done
 
+echo "Passed Plugins: $passed_plugin"
+echo "Failed Plugins: $failed_plugin"
+
 # Check for failed status
 if [[ -n $failed_plugin ]]; then
-    echo "Failed Plugins: $failed_plugin"
     exit 1
 fi
diff --git a/tox.ini b/tox.ini
index 48a2baa..291d899 100644
--- a/tox.ini
+++ b/tox.ini
@@ -62,7 +62,7 @@
 deps = {[tempestenv]deps}
 commands =
     find . -type f -name "*.pyc" -delete
-    tempest run --regex {posargs}
+    tempest run --regex {posargs:''}
 
 [testenv:all-plugin]
 # DEPRECATED
@@ -82,7 +82,7 @@
     echo "WARNING: The all-plugin env is deprecated and will be removed"
     echo "WARNING  Please use the 'all' environment for Tempest plugins."
     find . -type f -name "*.pyc" -delete
-    tempest run --regex {posargs}
+    tempest run --regex {posargs:''}
 
 [testenv:all-site-packages]
 sitepackages = True
@@ -93,7 +93,7 @@
 deps = {[tempestenv]deps}
 commands =
     find . -type f -name "*.pyc" -delete
-    tempest run --regex {posargs}
+    tempest run --regex {posargs:''}
 
 [testenv:full]
 envdir = .tox/tempest