diff --git a/README.rst b/README.rst
index 94a5352..af24569 100644
--- a/README.rst
+++ b/README.rst
@@ -117,8 +117,8 @@
 Tempest suite.
 
 Alternatively, you can use the run_tests.sh script which will create a venv and
-run the unit tests. There are also the py26, py27, or py33 tox jobs which will
-run the unit tests with the corresponding version of python.
+run the unit tests. There are also the py27 and py34 tox jobs which will run
+the unit tests with the corresponding version of python.
 
 Python 2.6
 ----------
@@ -131,3 +131,16 @@
 on an earlier release with python 2.6 you can easily run Tempest against it
 from a remote system running python 2.7. (or deploy a cloud guest in your cloud
 that has python 2.7)
+
+Python 3.4
+----------
+
+Starting during the Liberty release development cycle work began on enabling
+Tempest to run under both Python 2.7 and Python 3.4. Tempest strives to fully
+support running with Python 3.4. A gating unit test job was added to also run
+Tempest's unit tests under Python 3.4. This means that the Tempest code at
+least imports under Python 3.4 and things that have unit test coverage will
+work on Python 3.4. However, because large parts of Tempest are self verifying
+there might be uncaught issues running on Python 3.4. So until there is a gating
+job which does a full Tempest run using Python 3.4 there isn't any guarantee
+that running Tempest under Python 3.4 is bug free.
diff --git a/etc/tempest.conf.sample b/etc/tempest.conf.sample
index 3f9e70e..5b15c5e 100644
--- a/etc/tempest.conf.sample
+++ b/etc/tempest.conf.sample
@@ -1171,3 +1171,7 @@
 
 # Is the v2 volume API enabled (boolean value)
 #api_v2 = true
+
+# Update bootable status of a volume Not implemented on icehouse
+# (boolean value)
+#bootable = false
diff --git a/setup.cfg b/setup.cfg
index 2de9f34..3a14bba 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -15,6 +15,8 @@
     Programming Language :: Python
     Programming Language :: Python :: 2
     Programming Language :: Python :: 2.7
+    Programming Language :: Python :: 3
+    Programming Language :: Python :: 3.4
 
 [entry_points]
 console_scripts =
@@ -22,6 +24,7 @@
     javelin2 = tempest.cmd.javelin:main
     run-tempest-stress = tempest.cmd.run_stress:main
     tempest-cleanup = tempest.cmd.cleanup:main
+    tempest-account-generator = tempest.cmd.account_generator:main
 
 oslo.config.opts =
     tempest.config = tempest.config:list_opts
diff --git a/tempest/api/compute/servers/test_servers.py b/tempest/api/compute/servers/test_servers.py
index b333122..31078e3 100644
--- a/tempest/api/compute/servers/test_servers.py
+++ b/tempest/api/compute/servers/test_servers.py
@@ -64,6 +64,7 @@
 
         key_name = data_utils.rand_name('key')
         self.keypairs_client.create_keypair(key_name)
+        self.addCleanup(self.keypairs_client.delete_keypair, key_name)
         self.keypairs_client.list_keypairs()
         server = self.create_test_server(key_name=key_name)
         self.client.wait_for_server_status(server['id'], 'ACTIVE')
diff --git a/tempest/api/identity/base.py b/tempest/api/identity/base.py
index 5d66b9c..878ff6d 100644
--- a/tempest/api/identity/base.py
+++ b/tempest/api/identity/base.py
@@ -66,16 +66,9 @@
 
     credentials = ['primary']
 
-    @classmethod
-    def setup_credentials(cls):
-        super(BaseIdentityV2Test, cls).setup_credentials()
-        cls.os = cls.get_client_manager(identity_version='v2')
-
-    @classmethod
-    def skip_checks(cls):
-        super(BaseIdentityV2Test, cls).skip_checks()
-        if not CONF.identity_feature_enabled.api_v2:
-            raise cls.skipException("Identity api v2 is not enabled")
+    # identity v2 tests should obtain tokens and create accounts via v2
+    # regardless of the configured CONF.identity.auth_version
+    identity_version = 'v2'
 
     @classmethod
     def setup_clients(cls):
@@ -94,7 +87,7 @@
 
 class BaseIdentityV2AdminTest(BaseIdentityV2Test):
 
-    credentials = ['admin']
+    credentials = ['primary', 'admin']
 
     @classmethod
     def setup_clients(cls):
@@ -117,16 +110,9 @@
 
     credentials = ['primary']
 
-    @classmethod
-    def setup_credentials(cls):
-        super(BaseIdentityV3Test, cls).setup_credentials()
-        cls.os = cls.get_client_manager(identity_version='v3')
-
-    @classmethod
-    def skip_checks(cls):
-        super(BaseIdentityV3Test, cls).skip_checks()
-        if not CONF.identity_feature_enabled.api_v3:
-            raise cls.skipException("Identity api v3 is not enabled")
+    # identity v3 tests should obtain tokens and create accounts via v3
+    # regardless of the configured CONF.identity.auth_version
+    identity_version = 'v3'
 
     @classmethod
     def setup_clients(cls):
@@ -146,7 +132,7 @@
 
 class BaseIdentityV3AdminTest(BaseIdentityV3Test):
 
-    credentials = ['admin']
+    credentials = ['primary', 'admin']
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/api/object_storage/base.py b/tempest/api/object_storage/base.py
index 0c7fa6b..41a7d65 100644
--- a/tempest/api/object_storage/base.py
+++ b/tempest/api/object_storage/base.py
@@ -24,6 +24,8 @@
 
 class BaseObjectTest(tempest.test.BaseTestCase):
 
+    credentials = [['operator', CONF.object_storage.operator_role]]
+
     @classmethod
     def skip_checks(cls):
         super(BaseObjectTest, cls).skip_checks()
@@ -35,8 +37,9 @@
     def setup_credentials(cls):
         cls.set_network_resources()
         super(BaseObjectTest, cls).setup_credentials()
-        operator_role = CONF.object_storage.operator_role
-        cls.os = cls.get_client_manager(roles=[operator_role])
+        # credentials may be overwritten by children classes
+        if hasattr(cls, 'os_roles_operator'):
+            cls.os = cls.os_roles_operator
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/api/object_storage/test_account_quotas.py b/tempest/api/object_storage/test_account_quotas.py
index 04bfee4..bbdf367 100644
--- a/tempest/api/object_storage/test_account_quotas.py
+++ b/tempest/api/object_storage/test_account_quotas.py
@@ -23,12 +23,14 @@
 
 class AccountQuotasTest(base.BaseObjectTest):
 
+    credentials = [['operator', CONF.object_storage.operator_role],
+                   ['reseller', CONF.object_storage.reseller_admin_role]]
+
     @classmethod
     def setup_credentials(cls):
         super(AccountQuotasTest, cls).setup_credentials()
-        reseller_admin_role = CONF.object_storage.reseller_admin_role
-        cls.os_reselleradmin = cls.get_client_manager(
-            roles=[reseller_admin_role])
+        cls.os = cls.os_roles_operator
+        cls.os_reselleradmin = cls.os_roles_reseller
 
     @classmethod
     def resource_setup(cls):
diff --git a/tempest/api/object_storage/test_account_quotas_negative.py b/tempest/api/object_storage/test_account_quotas_negative.py
index a11b407..e945e1e 100644
--- a/tempest/api/object_storage/test_account_quotas_negative.py
+++ b/tempest/api/object_storage/test_account_quotas_negative.py
@@ -25,12 +25,14 @@
 
 class AccountQuotasNegativeTest(base.BaseObjectTest):
 
+    credentials = [['operator', CONF.object_storage.operator_role],
+                   ['reseller', CONF.object_storage.reseller_admin_role]]
+
     @classmethod
     def setup_credentials(cls):
         super(AccountQuotasNegativeTest, cls).setup_credentials()
-        reseller_admin_role = CONF.object_storage.reseller_admin_role
-        cls.os_reselleradmin = cls.get_client_manager(
-            roles=[reseller_admin_role])
+        cls.os = cls.os_roles_operator
+        cls.os_reselleradmin = cls.os_roles_reseller
 
     @classmethod
     def resource_setup(cls):
diff --git a/tempest/api/object_storage/test_account_services.py b/tempest/api/object_storage/test_account_services.py
index c28a3e0..ac41148 100644
--- a/tempest/api/object_storage/test_account_services.py
+++ b/tempest/api/object_storage/test_account_services.py
@@ -29,13 +29,15 @@
 
 class AccountTest(base.BaseObjectTest):
 
+    credentials = [['operator', CONF.object_storage.operator_role],
+                   ['operator_alt', CONF.object_storage.operator_role]]
     containers = []
 
     @classmethod
     def setup_credentials(cls):
         super(AccountTest, cls).setup_credentials()
-        cls.os_operator = cls.get_client_manager(
-            roles=[CONF.object_storage.operator_role], force_new=True)
+        cls.os = cls.os_roles_operator
+        cls.os_operator = cls.os_roles_operator_alt
 
     @classmethod
     def resource_setup(cls):
diff --git a/tempest/api/object_storage/test_account_services_negative.py b/tempest/api/object_storage/test_account_services_negative.py
index dfc5dfa..998c2bd 100644
--- a/tempest/api/object_storage/test_account_services_negative.py
+++ b/tempest/api/object_storage/test_account_services_negative.py
@@ -23,11 +23,14 @@
 
 class AccountNegativeTest(base.BaseObjectTest):
 
+    credentials = [['operator', CONF.object_storage.operator_role],
+                   ['operator_alt', CONF.object_storage.operator_role]]
+
     @classmethod
     def setup_credentials(cls):
         super(AccountNegativeTest, cls).setup_credentials()
-        cls.os_operator = cls.get_client_manager(
-            roles=[CONF.object_storage.operator_role], force_new=True)
+        cls.os = cls.os_roles_operator
+        cls.os_operator = cls.os_roles_operator_alt
 
     @test.attr(type=['negative'])
     @test.idempotent_id('070e6aca-6152-4867-868d-1118d68fb38c')
diff --git a/tempest/api/object_storage/test_container_acl.py b/tempest/api/object_storage/test_container_acl.py
index 25dac6b..4df813d 100644
--- a/tempest/api/object_storage/test_container_acl.py
+++ b/tempest/api/object_storage/test_container_acl.py
@@ -24,11 +24,14 @@
 
 class ObjectTestACLs(base.BaseObjectTest):
 
+    credentials = [['operator', CONF.object_storage.operator_role],
+                   ['operator_alt', CONF.object_storage.operator_role]]
+
     @classmethod
     def setup_credentials(cls):
         super(ObjectTestACLs, cls).setup_credentials()
-        cls.os_operator = cls.get_client_manager(
-            roles=[CONF.object_storage.operator_role], force_new=True)
+        cls.os = cls.os_roles_operator
+        cls.os_operator = cls.os_roles_operator_alt
 
     @classmethod
     def resource_setup(cls):
diff --git a/tempest/api/object_storage/test_container_acl_negative.py b/tempest/api/object_storage/test_container_acl_negative.py
index 31c301a..1c42e97 100644
--- a/tempest/api/object_storage/test_container_acl_negative.py
+++ b/tempest/api/object_storage/test_container_acl_negative.py
@@ -24,11 +24,14 @@
 
 class ObjectACLsNegativeTest(base.BaseObjectTest):
 
+    credentials = [['operator', CONF.object_storage.operator_role],
+                   ['operator_alt', CONF.object_storage.operator_role]]
+
     @classmethod
     def setup_credentials(cls):
         super(ObjectACLsNegativeTest, cls).setup_credentials()
-        cls.os_operator = cls.get_client_manager(
-            roles=[CONF.object_storage.operator_role], force_new=True)
+        cls.os = cls.os_roles_operator
+        cls.os_operator = cls.os_roles_operator_alt
 
     @classmethod
     def resource_setup(cls):
diff --git a/tempest/api/object_storage/test_container_sync.py b/tempest/api/object_storage/test_container_sync.py
index 4c0723d..06e700b 100644
--- a/tempest/api/object_storage/test_container_sync.py
+++ b/tempest/api/object_storage/test_container_sync.py
@@ -37,11 +37,14 @@
 class ContainerSyncTest(base.BaseObjectTest):
     clients = {}
 
+    credentials = [['operator', CONF.object_storage.operator_role],
+                   ['operator_alt', CONF.object_storage.operator_role]]
+
     @classmethod
     def setup_credentials(cls):
         super(ContainerSyncTest, cls).setup_credentials()
-        cls.os_alt = cls.get_client_manager(
-            roles=[CONF.object_storage.operator_role], force_new=True)
+        cls.os = cls.os_roles_operator
+        cls.os_alt = cls.os_roles_operator_alt
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/api/object_storage/test_object_services.py b/tempest/api/object_storage/test_object_services.py
index b02f178..627895e 100644
--- a/tempest/api/object_storage/test_object_services.py
+++ b/tempest/api/object_storage/test_object_services.py
@@ -989,11 +989,14 @@
 
 class PublicObjectTest(base.BaseObjectTest):
 
+    credentials = [['operator', CONF.object_storage.operator_role],
+                   ['operator_alt', CONF.object_storage.operator_role]]
+
     @classmethod
     def setup_credentials(cls):
         super(PublicObjectTest, cls).setup_credentials()
-        cls.os_alt = cls.get_client_manager(
-            roles=[CONF.object_storage.operator_role], force_new=True)
+        cls.os = cls.os_roles_operator
+        cls.os_alt = cls.os_roles_operator_alt
 
     @classmethod
     def setup_clients(cls):
diff --git a/tempest/api/volume/test_volumes_actions.py b/tempest/api/volume/test_volumes_actions.py
index f571f2d..375d34a 100644
--- a/tempest/api/volume/test_volumes_actions.py
+++ b/tempest/api/volume/test_volumes_actions.py
@@ -18,6 +18,7 @@
 from tempest.api.volume import base
 from tempest import config
 from tempest import test
+import testtools
 
 CONF = config.CONF
 
@@ -69,6 +70,18 @@
         self.client.detach_volume(self.volume['id'])
         self.client.wait_for_volume_status(self.volume['id'], 'available')
 
+    @test.idempotent_id('63e21b4c-0a0c-41f6-bfc3-7c2816815599')
+    @testtools.skipUnless(CONF.volume_feature_enabled.bootable,
+                          'Update bootable status of a volume is not enabled.')
+    def test_volume_bootable(self):
+        # Verify that a volume bootable flag is retrieved
+        for bool_bootable in [True, False]:
+            self.client.set_bootable_volume(self.volume['id'], bool_bootable)
+            fetched_volume = self.client.show_volume(self.volume['id'])
+            # Get Volume information
+            bool_flag = self._is_true(fetched_volume['bootable'])
+            self.assertEqual(bool_bootable, bool_flag)
+
     @test.idempotent_id('9516a2c8-9135-488c-8dd6-5677a7e5f371')
     @test.stresstest(class_setup_per='process')
     @test.services('compute')
diff --git a/tempest/clients.py b/tempest/clients.py
index a0c9471..9f6a9bb 100644
--- a/tempest/clients.py
+++ b/tempest/clients.py
@@ -22,6 +22,7 @@
 from tempest.common import cred_provider
 from tempest.common import negative_rest_client
 from tempest import config
+from tempest import exceptions
 from tempest import manager
 from tempest.services.baremetal.v1.json.baremetal_client import \
     BaremetalClientJSON
@@ -343,11 +344,22 @@
         self.credentials_client = CredentialsClientJSON(self.auth_provider,
                                                         **params)
         # Token clients do not use the catalog. They only need default_params.
-        self.token_client = TokenClientJSON(CONF.identity.uri,
-                                            **self.default_params)
+        # They read auth_url, so they should only be set if the corresponding
+        # API version is marked as enabled
+        if CONF.identity_feature_enabled.api_v2:
+            if CONF.identity.uri:
+                self.token_client = TokenClientJSON(
+                    CONF.identity.uri, **self.default_params)
+            else:
+                msg = 'Identity v2 API enabled, but no identity.uri set'
+                raise exceptions.InvalidConfiguration(msg)
         if CONF.identity_feature_enabled.api_v3:
-            self.token_v3_client = V3TokenClientJSON(CONF.identity.uri_v3,
-                                                     **self.default_params)
+            if CONF.identity.uri_v3:
+                self.token_v3_client = V3TokenClientJSON(
+                    CONF.identity.uri_v3, **self.default_params)
+            else:
+                msg = 'Identity v3 API enabled, but no identity.uri_v3 set'
+                raise exceptions.InvalidConfiguration(msg)
 
     def _set_volume_clients(self):
         params = {
diff --git a/tempest/cmd/account_generator.py b/tempest/cmd/account_generator.py
new file mode 100755
index 0000000..0a48b8d
--- /dev/null
+++ b/tempest/cmd/account_generator.py
@@ -0,0 +1,266 @@
+#!/usr/bin/env python
+
+# Copyright 2015 Mirantis, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import argparse
+import os
+
+from oslo_log import log as logging
+import yaml
+
+from tempest import config
+from tempest import exceptions
+from tempest.services.identity.v2.json import identity_client
+import tempest_lib.auth
+from tempest_lib.common.utils import data_utils
+import tempest_lib.exceptions
+
+LOG = None
+CONF = config.CONF
+
+
+def setup_logging():
+    global LOG
+    logging.setup(CONF, __name__)
+    LOG = logging.getLogger(__name__)
+
+
+def keystone_admin(opts):
+    _creds = tempest_lib.auth.KeystoneV2Credentials(
+        username=opts.os_username,
+        password=opts.os_password,
+        tenant_name=opts.os_tenant_name)
+    auth_params = {
+        'disable_ssl_certificate_validation':
+            CONF.identity.disable_ssl_certificate_validation,
+        'ca_certs': CONF.identity.ca_certificates_file,
+        'trace_requests': CONF.debug.trace_requests
+    }
+    _auth = tempest_lib.auth.KeystoneV2AuthProvider(
+        _creds, CONF.identity.uri, **auth_params)
+    params = {
+        'disable_ssl_certificate_validation':
+            CONF.identity.disable_ssl_certificate_validation,
+        'ca_certs': CONF.identity.ca_certificates_file,
+        'trace_requests': CONF.debug.trace_requests,
+        'build_interval': CONF.compute.build_interval,
+        'build_timeout': CONF.compute.build_timeout
+    }
+    return identity_client.IdentityClientJSON(
+        _auth,
+        CONF.identity.catalog_type,
+        CONF.identity.region,
+        endpoint_type='adminURL',
+        **params
+    )
+
+
+def create_resources(opts, resources):
+    admin = keystone_admin(opts)
+    roles = admin.list_roles()
+    for u in resources['users']:
+        u['role_ids'] = []
+        for r in u.get('roles', ()):
+            try:
+                role = filter(lambda r_: r_['name'] == r, roles)[0]
+                u['role_ids'] += [role['id']]
+            except IndexError:
+                raise exceptions.TempestException(
+                    "Role: %s - doesn't exist" % r
+                )
+    existing = [x['name'] for x in admin.list_tenants()]
+    for tenant in resources['tenants']:
+        if tenant not in existing:
+            admin.create_tenant(tenant)
+        else:
+            LOG.warn("Tenant '%s' already exists in this environment" % tenant)
+    LOG.info('Tenants created')
+    for u in resources['users']:
+        try:
+            tenant = admin.get_tenant_by_name(u['tenant'])
+        except tempest_lib.exceptions.NotFound:
+            LOG.error("Tenant: %s - not found" % u['tenant'])
+            continue
+        while True:
+            try:
+                admin.get_user_by_username(tenant['id'], u['name'])
+            except tempest_lib.exceptions.NotFound:
+                admin.create_user(
+                    u['name'], u['pass'], tenant['id'],
+                    "%s@%s" % (u['name'], tenant['id']),
+                    enabled=True)
+                break
+            else:
+                LOG.warn("User '%s' already exists in this environment. "
+                         "New name generated" % u['name'])
+                u['name'] = random_user_name(opts.tag, u['prefix'])
+
+    LOG.info('Users created')
+    for u in resources['users']:
+        try:
+            tenant = admin.get_tenant_by_name(u['tenant'])
+        except tempest_lib.exceptions.NotFound:
+            LOG.error("Tenant: %s - not found" % u['tenant'])
+            continue
+        try:
+            user = admin.get_user_by_username(tenant['id'],
+                                              u['name'])
+        except tempest_lib.exceptions.NotFound:
+            LOG.error("User: %s - not found" % u['user'])
+            continue
+        for r in u['role_ids']:
+            try:
+                admin.assign_user_role(tenant['id'], user['id'], r)
+            except tempest_lib.exceptions.Conflict:
+                # don't care if it's already assigned
+                pass
+    LOG.info('Roles assigned')
+    LOG.info('Resources deployed successfully!')
+
+
+def random_user_name(tag, prefix):
+    if tag:
+        return data_utils.rand_name('-'.join((tag, prefix)))
+    else:
+        return data_utils.rand_name(prefix)
+
+
+def generate_resources(opts):
+    spec = [{'number': 1,
+             'prefix': 'primary',
+             'roles': (CONF.auth.tempest_roles +
+                       [CONF.object_storage.operator_role])},
+            {'number': 1,
+             'prefix': 'alt',
+             'roles': (CONF.auth.tempest_roles +
+                       [CONF.object_storage.operator_role])},
+            {'number': 1,
+             'prefix': 'swift_admin',
+             'roles': (CONF.auth.tempest_roles +
+                       [CONF.object_storage.operator_role,
+                        CONF.object_storage.reseller_admin_role])},
+            {'number': 1,
+             'prefix': 'stack_owner',
+             'roles': (CONF.auth.tempest_roles +
+                       [CONF.orchestration.stack_owner_role])},
+            ]
+    if opts.admin:
+        spec.append({
+            'number': 1,
+            'prefix': 'admin',
+            'roles': (CONF.auth.tempest_roles +
+                      [CONF.identity.admin_role])
+        })
+    resources = {'tenants': [],
+                 'users': []}
+    for count in range(opts.concurrency):
+        for user_group in spec:
+            users = [random_user_name(opts.tag, user_group['prefix'])
+                     for _ in range(user_group['number'])]
+            for user in users:
+                tenant = '-'.join((user, 'tenant'))
+                resources['tenants'].append(tenant)
+                resources['users'].append({
+                    'tenant': tenant,
+                    'name': user,
+                    'pass': data_utils.rand_name(),
+                    'prefix': user_group['prefix'],
+                    'roles': user_group['roles']
+                })
+    return resources
+
+
+def dump_accounts(opts, resources):
+    accounts = []
+    for user in resources['users']:
+        accounts.append({
+            'username': user['name'],
+            'tenant_name': user['tenant'],
+            'password': user['pass'],
+            'roles': user['roles']
+        })
+    if os.path.exists(opts.accounts):
+        os.rename(opts.accounts, '.'.join((opts.accounts, 'bak')))
+    with open(opts.accounts, 'w') as f:
+        yaml.dump(accounts, f, default_flow_style=False)
+    LOG.info('%s generated successfully!' % opts.accounts)
+
+
+def get_options():
+    usage_string = ('account_generator [-h] <ARG> ...\n\n'
+                    'To see help on specific argument, do:\n'
+                    'account_generator <ARG> -h')
+    parser = argparse.ArgumentParser(
+        description='Create accounts.yaml file for concurrent test runs. '
+                    'One primary user, one alt user, '
+                    'one swift admin, one stack owner '
+                    'and one admin (optionally) will be created '
+                    'for each concurrent thread.',
+        formatter_class=argparse.ArgumentDefaultsHelpFormatter,
+        usage=usage_string
+    )
+
+    parser.add_argument('-c', '--config-file',
+                        metavar='/etc/tempest.conf',
+                        help='path to tempest config file')
+    parser.add_argument('--os-username',
+                        metavar='<auth-user-name>',
+                        default=os.environ.get('OS_USERNAME'),
+                        help='User should have permitions '
+                             'to create new user accounts and '
+                             'tenants. Defaults to env[OS_USERNAME].')
+    parser.add_argument('--os-password',
+                        metavar='<auth-password>',
+                        default=os.environ.get('OS_PASSWORD'),
+                        help='Defaults to env[OS_PASSWORD].')
+    parser.add_argument('--os-tenant-name',
+                        metavar='<auth-tenant-name>',
+                        default=os.environ.get('OS_TENANT_NAME'),
+                        help='Defaults to env[OS_TENANT_NAME].')
+    parser.add_argument('--tag',
+                        default='',
+                        required=False,
+                        dest='tag',
+                        help='Resources tag')
+    parser.add_argument('-r', '--concurrency',
+                        default=1,
+                        type=int,
+                        required=True,
+                        dest='concurrency',
+                        help='Concurrency count')
+    parser.add_argument('--with-admin',
+                        action='store_true',
+                        dest='admin',
+                        help='Create admin in every tenant')
+    parser.add_argument('accounts',
+                        metavar='accounts_file.yaml',
+                        help='Output accounts yaml file')
+
+    opts = parser.parse_args()
+    if opts.config_file:
+        config.CONF.set_config_path(opts.config_file)
+    return opts
+
+
+def main(opts=None):
+    if not opts:
+        opts = get_options()
+    setup_logging()
+    resources = generate_resources(opts)
+    create_resources(opts, resources)
+    dump_accounts(opts, resources)
+
+if __name__ == "__main__":
+    main()
diff --git a/tempest/cmd/cleanup_service.py b/tempest/cmd/cleanup_service.py
index 1ad12eb..eb6f143 100644
--- a/tempest/cmd/cleanup_service.py
+++ b/tempest/cmd/cleanup_service.py
@@ -343,6 +343,44 @@
         self.data['volumes'] = vols
 
 
+class VolumeQuotaService(BaseService):
+    def __init__(self, manager, **kwargs):
+        super(VolumeQuotaService, self).__init__(kwargs)
+        self.client = manager.volume_quotas_client
+
+    def delete(self):
+        client = self.client
+        try:
+            client.delete_quota_set(self.tenant_id)
+        except Exception as e:
+            LOG.exception("Delete Volume Quotas exception: %s" % e)
+            pass
+
+    def dry_run(self):
+        quotas = self.client.show_quota_usage(self.tenant_id)
+        self.data['volume_quotas'] = quotas
+
+
+class NovaQuotaService(BaseService):
+    def __init__(self, manager, **kwargs):
+        super(NovaQuotaService, self).__init__(kwargs)
+        self.client = manager.quotas_client
+        self.limits_client = manager.limits_client
+
+    def delete(self):
+        client = self.client
+        try:
+            client.delete_quota_set(self.tenant_id)
+        except Exception as e:
+            LOG.exception("Delete Quotas exception: %s" % e)
+            pass
+
+    def dry_run(self):
+        client = self.limits_client
+        quotas = client.get_absolute_limits()
+        self.data['compute_quotas'] = quotas
+
+
 # Begin network service classes
 class NetworkService(BaseService):
     def __init__(self, manager, **kwargs):
@@ -667,7 +705,7 @@
         self.data['pools'] = pools
 
 
-class NetworMeteringLabelRuleService(NetworkService):
+class NetworkMeteringLabelRuleService(NetworkService):
 
     def list(self):
         client = self.client
@@ -692,7 +730,7 @@
         self.data['rules'] = rules
 
 
-class NetworMeteringLabelService(NetworkService):
+class NetworkMeteringLabelService(NetworkService):
 
     def list(self):
         client = self.client
@@ -1052,6 +1090,7 @@
         tenant_services.append(ServerGroupService)
         if not IS_NEUTRON:
             tenant_services.append(FloatingIpService)
+        tenant_services.append(NovaQuotaService)
     if IS_HEAT:
         tenant_services.append(StackService)
     if IS_NEUTRON:
@@ -1068,8 +1107,8 @@
             tenant_services.append(NetworkVipService)
             tenant_services.append(NetworkPoolService)
         if test.is_extension_enabled('metering', 'network'):
-            tenant_services.append(NetworMeteringLabelRuleService)
-            tenant_services.append(NetworMeteringLabelService)
+            tenant_services.append(NetworkMeteringLabelRuleService)
+            tenant_services.append(NetworkMeteringLabelService)
         tenant_services.append(NetworkRouterService)
         tenant_services.append(NetworkFloatingIpService)
         tenant_services.append(NetworkPortService)
@@ -1078,6 +1117,7 @@
     if IS_CINDER:
         tenant_services.append(SnapshotService)
         tenant_services.append(VolumeService)
+        tenant_services.append(VolumeQuotaService)
     return tenant_services
 
 
diff --git a/tempest/config.py b/tempest/config.py
index 3f3e7e7..bdbf942 100644
--- a/tempest/config.py
+++ b/tempest/config.py
@@ -657,6 +657,10 @@
     cfg.BoolOpt('api_v2',
                 default=True,
                 help="Is the v2 volume API enabled"),
+    cfg.BoolOpt('bootable',
+                default=False,
+                help='Update bootable status of a volume '
+                     'Not implemented on icehouse ')
 ]
 
 
diff --git a/tempest/services/volume/json/volumes_client.py b/tempest/services/volume/json/volumes_client.py
index 9a08bbd..65aa0f4 100644
--- a/tempest/services/volume/json/volumes_client.py
+++ b/tempest/services/volume/json/volumes_client.py
@@ -123,6 +123,15 @@
         self.expected_success(202, resp.status)
         return service_client.ResponseBody(resp, body)
 
+    def set_bootable_volume(self, volume_id, bootable):
+        """set a bootable flag for a volume - true or false."""
+        post_body = {"bootable": bootable}
+        post_body = json.dumps({'os-set_bootable': post_body})
+        url = 'volumes/%s/action' % (volume_id)
+        resp, body = self.post(url, post_body)
+        self.expected_success(200, resp.status)
+        return service_client.ResponseBody(resp, body)
+
     def detach_volume(self, volume_id):
         """Detaches a volume from an instance."""
         post_body = {}
diff --git a/tempest/test.py b/tempest/test.py
index d80e478..675071b 100644
--- a/tempest/test.py
+++ b/tempest/test.py
@@ -230,7 +230,9 @@
     _service = None
 
     # NOTE(andreaf) credentials holds a list of the credentials to be allocated
-    # at class setup time. Credential types can be 'primary', 'alt' or 'admin'
+    # at class setup time. Credential types can be 'primary', 'alt', 'admin' or
+    # a list of roles - the first element of the list being a label, and the
+    # rest the actual roles
     credentials = []
     # Resources required to validate a server using ssh
     validation_resources = {}
@@ -325,6 +327,13 @@
         if 'alt' is cls.credentials and not credentials.is_alt_available():
             msg = "Missing a 2nd set of API credentials in configuration."
             raise cls.skipException(msg)
+        if hasattr(cls, 'identity_version'):
+            if cls.identity_version == 'v2':
+                if not CONF.identity_feature_enabled.api_v2:
+                    raise cls.skipException("Identity api v2 is not enabled")
+            elif cls.identity_version == 'v3':
+                if not CONF.identity_feature_enabled.api_v3:
+                    raise cls.skipException("Identity api v3 is not enabled")
 
     @classmethod
     def setup_credentials(cls):
@@ -337,19 +346,24 @@
             # This may raise an exception in case credentials are not available
             # In that case we want to let the exception through and the test
             # fail accordingly
-            manager = cls.get_client_manager(
-                credential_type=credentials_type)
-            setattr(cls, 'os_%s' % credentials_type, manager)
-            # Setup some common aliases
-            # TODO(andreaf) The aliases below are a temporary hack
-            # to avoid changing too much code in one patch. They should
-            # be removed eventually
-            if credentials_type == 'primary':
-                cls.os = cls.manager = cls.os_primary
-            if credentials_type == 'admin':
-                cls.os_adm = cls.admin_manager = cls.os_admin
-            if credentials_type == 'alt':
-                cls.alt_manager = cls.os_alt
+            if isinstance(credentials_type, six.string_types):
+                manager = cls.get_client_manager(
+                    credential_type=credentials_type)
+                setattr(cls, 'os_%s' % credentials_type, manager)
+                # Setup some common aliases
+                # TODO(andreaf) The aliases below are a temporary hack
+                # to avoid changing too much code in one patch. They should
+                # be removed eventually
+                if credentials_type == 'primary':
+                    cls.os = cls.manager = cls.os_primary
+                if credentials_type == 'admin':
+                    cls.os_adm = cls.admin_manager = cls.os_admin
+                if credentials_type == 'alt':
+                    cls.alt_manager = cls.os_alt
+            elif isinstance(credentials_type, list):
+                manager = cls.get_client_manager(roles=credentials_type[1:],
+                                                 force_new=True)
+                setattr(cls, 'os_roles_%s' % credentials_type[0], manager)
 
     @classmethod
     def setup_clients(cls):
@@ -439,14 +453,13 @@
         return cls._creds_provider
 
     @classmethod
-    def get_client_manager(cls, identity_version=None,
-                           credential_type=None, roles=None, force_new=None):
+    def get_client_manager(cls, credential_type=None, roles=None,
+                           force_new=None):
         """Returns an OpenStack client manager
 
         Returns an OpenStack client manager based on either credential_type
         or a list of roles. If neither is specified, it defaults to
         credential_type 'primary'
-        :param identity_version: string - v2 or v3
         :param credential_type: string - primary, alt or admin
         :param roles: list of roles
 
@@ -458,7 +471,6 @@
             raise ValueError(msg)
         if not any([roles, credential_type]):
             credential_type = 'primary'
-        cls.identity_version = identity_version
         cred_provider = cls._get_credentials_provider()
         if roles:
             for role in roles:
@@ -486,7 +498,7 @@
         """
         Clears isolated creds if set
         """
-        if hasattr(cls, '_cred_provider'):
+        if hasattr(cls, '_creds_provider'):
             cls._creds_provider.clear_isolated_creds()
 
     @classmethod
diff --git a/tempest/tests/cmd/test_javelin.py b/tempest/tests/cmd/test_javelin.py
new file mode 100644
index 0000000..860599b
--- /dev/null
+++ b/tempest/tests/cmd/test_javelin.py
@@ -0,0 +1,233 @@
+#!/usr/bin/env python
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import mock
+from oslotest import mockpatch
+from tempest_lib import exceptions as lib_exc
+
+from tempest.cmd import javelin
+from tempest.tests import base
+
+
+class JavelinUnitTest(base.TestCase):
+
+    def setUp(self):
+        super(JavelinUnitTest, self).setUp()
+        javelin.setup_logging()
+        self.fake_client = mock.MagicMock()
+        self.fake_object = mock.MagicMock()
+
+
+class TestCreateResources(JavelinUnitTest):
+    def test_create_tenants(self):
+
+        self.fake_client.identity.list_tenants.return_value = []
+        self.useFixture(mockpatch.PatchObject(javelin, "keystone_admin",
+                                              return_value=self.fake_client))
+
+        javelin.create_tenants([self.fake_object['name']])
+
+        mocked_function = self.fake_client.identity.create_tenant
+        mocked_function.assert_called_once_with(self.fake_object['name'])
+
+    def test_create_duplicate_tenant(self):
+        self.fake_client.identity.list_tenants.return_value = [
+            {'name': self.fake_object['name']}]
+        self.useFixture(mockpatch.PatchObject(javelin, "keystone_admin",
+                                              return_value=self.fake_client))
+
+        javelin.create_tenants([self.fake_object['name']])
+
+        mocked_function = self.fake_client.identity.create_tenant
+        self.assertFalse(mocked_function.called)
+
+    def test_create_users(self):
+        self.fake_client.identity.get_tenant_by_name.return_value = \
+            self.fake_object['tenant']
+        self.fake_client.identity.get_user_by_username.side_effect = \
+            lib_exc.NotFound()
+        self.useFixture(mockpatch.PatchObject(javelin, "keystone_admin",
+                                              return_value=self.fake_client))
+
+        javelin.create_users([self.fake_object])
+
+        fake_tenant_id = self.fake_object['tenant']['id']
+        fake_email = "%s@%s" % (self.fake_object['user'], fake_tenant_id)
+        mocked_function = self.fake_client.identity.create_user
+        mocked_function.assert_called_once_with(self.fake_object['name'],
+                                                self.fake_object['password'],
+                                                fake_tenant_id,
+                                                fake_email,
+                                                enabled=True)
+
+    def test_create_user_missing_tenant(self):
+        self.fake_client.identity.get_tenant_by_name.side_effect = \
+            lib_exc.NotFound()
+        self.useFixture(mockpatch.PatchObject(javelin, "keystone_admin",
+                                              return_value=self.fake_client))
+
+        javelin.create_users([self.fake_object])
+
+        mocked_function = self.fake_client.identity.create_user
+        self.assertFalse(mocked_function.called)
+
+    def test_create_objects(self):
+
+        self.useFixture(mockpatch.PatchObject(javelin, "client_for_user",
+                                              return_value=self.fake_client))
+        self.useFixture(mockpatch.PatchObject(javelin, "_assign_swift_role"))
+        self.useFixture(mockpatch.PatchObject(javelin, "_file_contents",
+                        return_value=self.fake_object.content))
+
+        javelin.create_objects([self.fake_object])
+
+        mocked_function = self.fake_client.containers.create_container
+        mocked_function.assert_called_once_with(self.fake_object['container'])
+        mocked_function = self.fake_client.objects.create_object
+        mocked_function.assert_called_once_with(self.fake_object['container'],
+                                                self.fake_object['name'],
+                                                self.fake_object.content)
+
+    def test_create_images(self):
+        self.fake_client.images.create_image.return_value = \
+            self.fake_object['body']
+
+        self.useFixture(mockpatch.PatchObject(javelin, "client_for_user",
+                                              return_value=self.fake_client))
+        self.useFixture(mockpatch.PatchObject(javelin, "_get_image_by_name",
+                                              return_value=[]))
+        self.useFixture(mockpatch.PatchObject(javelin, "_resolve_image",
+                                              return_value=(None, None)))
+
+        with mock.patch('six.moves.builtins.open', mock.mock_open(),
+                        create=True) as open_mock:
+            javelin.create_images([self.fake_object])
+
+        mocked_function = self.fake_client.images.create_image
+        mocked_function.assert_called_once_with(self.fake_object['name'],
+                                                self.fake_object['format'],
+                                                self.fake_object['format'])
+
+        mocked_function = self.fake_client.images.store_image
+        fake_image_id = self.fake_object['body'].get('id')
+        mocked_function.assert_called_once_with(fake_image_id, open_mock())
+
+    def test_create_networks(self):
+        self.fake_client.networks.list_networks.return_value = {
+            'networks': []}
+
+        self.useFixture(mockpatch.PatchObject(javelin, "client_for_user",
+                                              return_value=self.fake_client))
+
+        javelin.create_networks([self.fake_object])
+
+        mocked_function = self.fake_client.networks.create_network
+        mocked_function.assert_called_once_with(name=self.fake_object['name'])
+
+    def test_create_subnet(self):
+
+        fake_network = self.fake_object['network']
+
+        self.useFixture(mockpatch.PatchObject(javelin, "client_for_user",
+                                              return_value=self.fake_client))
+        self.useFixture(mockpatch.PatchObject(javelin, "_get_resource_by_name",
+                                              return_value=fake_network))
+
+        fake_netaddr = mock.MagicMock()
+        self.useFixture(mockpatch.PatchObject(javelin, "netaddr",
+                                              return_value=fake_netaddr))
+        fake_version = javelin.netaddr.IPNetwork().version
+
+        javelin.create_subnets([self.fake_object])
+
+        mocked_function = self.fake_client.networks.create_subnet
+        mocked_function.assert_called_once_with(network_id=fake_network['id'],
+                                                cidr=self.fake_object['range'],
+                                                name=self.fake_object['name'],
+                                                ip_version=fake_version)
+
+
+class TestDestroyResources(JavelinUnitTest):
+
+    def test_destroy_tenants(self):
+
+        fake_tenant = self.fake_object['tenant']
+
+        fake_auth = mock.MagicMock()
+        fake_auth.identity.get_tenant_by_name.return_value = fake_tenant
+
+        self.useFixture(mockpatch.PatchObject(javelin, "keystone_admin",
+                                              return_value=fake_auth))
+        javelin.destroy_tenants([fake_tenant])
+
+        mocked_function = fake_auth.identity.delete_tenant
+        mocked_function.assert_called_once_with(fake_tenant['id'])
+
+    def test_destroy_users(self):
+
+        fake_user = self.fake_object['user']
+        fake_tenant = self.fake_object['tenant']
+
+        fake_auth = mock.MagicMock()
+        fake_auth.identity.get_tenant_by_name.return_value = fake_tenant
+        fake_auth.identity.get_user_by_username.return_value = fake_user
+
+        self.useFixture(mockpatch.PatchObject(javelin, "keystone_admin",
+                                              return_value=fake_auth))
+
+        javelin.destroy_users([fake_user])
+
+        mocked_function = fake_auth.identity.delete_user
+        mocked_function.assert_called_once_with(fake_user['id'])
+
+    def test_destroy_objects(self):
+
+        fake_client = mock.MagicMock()
+        fake_client.objects.delete_object.return_value = {'status': "200"}, ""
+        self.useFixture(mockpatch.PatchObject(javelin, "client_for_user",
+                                              return_value=fake_client))
+        javelin.destroy_objects([self.fake_object])
+
+        mocked_function = fake_client.objects.delete_object
+        mocked_function.asswert_called_once(self.fake_object['container'],
+                                            self.fake_object['name'])
+
+    def test_destroy_images(self):
+
+        fake_client = mock.MagicMock()
+        self.useFixture(mockpatch.PatchObject(javelin, "client_for_user",
+                                              return_value=fake_client))
+        self.useFixture(mockpatch.PatchObject(javelin, "_get_image_by_name",
+                        return_value=self.fake_object['image']))
+
+        javelin.destroy_images([self.fake_object])
+
+        mocked_function = fake_client.images.delete_image
+        mocked_function.assert_called_once_with(
+            self.fake_object['image']['id'])
+
+    def test_destroy_networks(self):
+
+        fake_client = mock.MagicMock()
+        self.useFixture(mockpatch.PatchObject(javelin, "client_for_user",
+                                              return_value=fake_client))
+        self.useFixture(mockpatch.PatchObject(
+            javelin, "_get_resource_by_name",
+            return_value=self.fake_object['resource']))
+
+        javelin.destroy_networks([self.fake_object])
+
+        mocked_function = fake_client.networks.delete_network
+        mocked_function.assert_called_once_with(
+            self.fake_object['resource']['id'])
diff --git a/tox.ini b/tox.ini
index 88d1302..2d2ed38 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-envlist = pep8,py27
+envlist = pep8,py27,py34
 minversion = 1.6
 skipsdist = True