diff --git a/.kitchen.yml b/.kitchen.yml
new file mode 100644
index 0000000..7df4724
--- /dev/null
+++ b/.kitchen.yml
@@ -0,0 +1,41 @@
+---
+driver:
+  name: docker
+  use_sudo: false
+  volume:
+    - <%= ENV['PWD'] %>:/tmp/kitchen
+
+provisioner:
+  name: shell
+  script: verify.sh
+
+platforms:
+  <% `find classes/cluster -maxdepth 1 -mindepth 1 -type d | tr '_' '-' |sort -u`.split().each do |cluster| %>
+  <% cluster=cluster.split('/')[2] %>
+  - name: <%= cluster %>
+    driver_config:
+      #image: ubuntu:16.04
+      image: tcpcloud/salt-models-testing # With preinstalled dependencies (faster)
+      platform: ubuntu
+      hostname: cfg01.<%= cluster %>.local
+      provision_command:
+        - apt-get update
+        - apt-get install -y git curl python-pip
+        - git clone https://github.com/salt-formulas/salt-formulas-scripts /srv/salt/scripts
+        - cd /srv/salt/scripts; git pull -r; cd -
+        # NOTE: Configure ENV options as needed, example:
+        - echo "
+            export BOOTSTRAP=1;\n
+            export CLUSTER_NAME=<%= cluster %>;\n
+            export FORMULAS_SOURCE=pkg;\n
+            export RECLASS_VERSION=dev;\n
+            export RECLASS_IGNORE_CLASS_NOTFOUND=True;\n
+            export EXTRA_FORMULAS="";\n
+          " > /kitchen.env
+          #export RECLASS_SOURCE_PATH=/usr/lib/python2.7/site-packages/reclass;\n
+          #export PYTHONPATH=$RECLASS_SOURCE_PATH:$PYTHONPATH;\n
+  <% end %>
+
+suites:
+  - name: cluster
+
diff --git a/classes/cluster/aaa-ha-freeipa/infra/config.yml b/classes/cluster/aaa-ha-freeipa/infra/config.yml
index e69242a..bd29e36 100644
--- a/classes/cluster/aaa-ha-freeipa/infra/config.yml
+++ b/classes/cluster/aaa-ha-freeipa/infra/config.yml
@@ -2,7 +2,7 @@
 - system.linux.system.repo.ubuntu
 - system.openssh.client.lab
 - system.salt.master.single
-- system.salt.master.pkg
+- system.salt.master.git
 - system.salt.minion.ca.salt_master
 - system.salt.master.api
 - system.mysql.client
@@ -13,7 +13,7 @@
 - cluster.aaa-ha-freeipa
 parameters:
   _param:
-    salt_master_base_environment: prd
+    salt_master_base_environment: dev
     reclass_data_repository: "https://gerrit.mcp.mirantis.net/salt-models/mcp-virtual-lab.git"
     reclass_data_revision: master
     reclass_config_master: ${_param:infra_config_deploy_address}
@@ -22,10 +22,25 @@
     salt_api_password_hash: "$6$WV0P1shnoDh2gI/Z$22/Bcd7ffMv0jDlFpT63cAU4PiXHz9pjXwngToKwqAsgoeK4HNR3PiKaushjxp3JsQ8hNoJmAC6TxzVqfV8WH/"
     salt_master_host: 127.0.0.1
   salt:
+    #minion:
+    #  source:
+    #    engine: none
     master:
+      #source:
+      #  # TEMP: avoid to install salt packages (as we preinstall development version)
+      #  engine: none
       reactor:
         reclass/minion/classify:
         - salt://reclass/reactor/node_register.sls
+      environment:
+        dev:
+          formula:
+            salt:
+              #source: pkg
+              #name: salt-formula-salt
+              source: git
+              address: 'https://github.com/epcim/salt-formula-salt.git'
+              revision: 'review/petr_michalec/allow-multiple-ext-pillars-and-reclass-options'
 
   reclass:
     storage:
@@ -34,7 +49,7 @@
           expression: all
           node_param:
             single_address:
-              value_template: <<node_ip>>
+              value_template: <<node_control_ip>>
             linux_system_codename:
               value_template: <<node_os>>
             salt_master_host:
@@ -43,14 +58,14 @@
           expression: <<node_hostname>>__startswith__cfg
           cluster_param:
             infra_config_address:
-              value_template: <<node_ip>>
+              value_template: <<node_control_ip>>
             infra_config_deploy_address:
-              value_template: <<node_ip>>
+              value_template: <<node_deploy_ip>>
         identity_control01:
           expression: <<node_hostname>>__equals__idm01
           cluster_param:
             identity_control_node01_address:
-              value_template: <<node_ip>>
+              value_template: <<node_control_ip>>
           node_class:
             value_template:
               #- system.linux.system.repo.saltstack.rhel7
@@ -59,7 +74,7 @@
           expression: <<node_hostname>>__equals__idm02
           cluster_param:
             identity_control_node02_address:
-              value_template: <<node_ip>>
+              value_template: <<node_control_ip>>
           node_class:
             value_template:
               #- system.linux.system.repo.saltstack.rhel7
@@ -68,7 +83,7 @@
           expression: <<node_hostname>>__equals__idm03
           cluster_param:
             identity_control_node03_address:
-              value_template: <<node_ip>>
+              value_template: <<node_control_ip>>
           node_class:
             value_template:
               #- system.linux.system.repo.saltstack.rhel7
diff --git a/classes/cluster/drivetrain-ha-clusters/cicd/control/init.yml b/classes/cluster/drivetrain-ha-clusters/cicd/control/init.yml
index 0122cf9..2ce0ac6 100644
--- a/classes/cluster/drivetrain-ha-clusters/cicd/control/init.yml
+++ b/classes/cluster/drivetrain-ha-clusters/cicd/control/init.yml
@@ -49,6 +49,7 @@
   - system.docker.swarm.stack.security_monkey
   # Docker networks
   - system.docker.swarm.network.runbook
+  - system.docker.swarm.network.oss_backend
 
   # Aptly
   # We need aptly-publisher.yml on each node for our Jenkins slaves in docker
diff --git a/classes/cluster/drivetrain-ha-clusters/cicd/init.yml b/classes/cluster/drivetrain-ha-clusters/cicd/init.yml
index 053a652..9d81f5d 100644
--- a/classes/cluster/drivetrain-ha-clusters/cicd/init.yml
+++ b/classes/cluster/drivetrain-ha-clusters/cicd/init.yml
@@ -3,11 +3,11 @@
     cicd_control_hostname: cid
     cicd_control_address: 172.16.10.252
     cicd_control_node01_hostname: cid01
-    cicd_control_node01_address: 172.16.10.11
+    cicd_control_node01_address: 172.16.10.90
     cicd_control_node02_hostname: cid02
-    cicd_control_node02_address: 172.16.10.12
+    cicd_control_node02_address: 172.16.10.91
     cicd_control_node03_hostname: cid03
-    cicd_control_node03_address: 172.16.10.13
+    cicd_control_node03_address: 172.16.10.92
 
     # CI/CD control infrastructure
     control_node01_address: ${_param:cicd_control_node01_address}
diff --git a/classes/cluster/drivetrain-ha/cicd/control/init.yml b/classes/cluster/drivetrain-ha/cicd/control/init.yml
index 9c87f6e..52b6079 100644
--- a/classes/cluster/drivetrain-ha/cicd/control/init.yml
+++ b/classes/cluster/drivetrain-ha/cicd/control/init.yml
@@ -49,6 +49,7 @@
   - system.docker.swarm.stack.security_monkey
   # Docker networks
   - system.docker.swarm.network.runbook
+  - system.docker.swarm.network.oss_backend
 
   # Aptly
   # We need aptly-publisher.yml on each node for our Jenkins slaves in docker
diff --git a/classes/cluster/drivetrain-ha/cicd/init.yml b/classes/cluster/drivetrain-ha/cicd/init.yml
index 9b736f2..b8f307d 100644
--- a/classes/cluster/drivetrain-ha/cicd/init.yml
+++ b/classes/cluster/drivetrain-ha/cicd/init.yml
@@ -6,9 +6,9 @@
     cicd_control_node01_hostname: cid01
     cicd_control_node02_hostname: cid02
     cicd_control_node03_hostname: cid03
-    cicd_control_node01_address: 172.16.10.11
-    cicd_control_node02_address: 172.16.10.12
-    cicd_control_node03_address: 172.16.10.13
+    cicd_control_node01_address: 172.16.10.90
+    cicd_control_node02_address: 172.16.10.91
+    cicd_control_node03_address: 172.16.10.92
 
     # CI/CD control infrastructure
     control_node01_address: ${_param:cicd_control_node01_address}
diff --git a/verify.sh b/verify.sh
new file mode 100755
index 0000000..f1f9739
--- /dev/null
+++ b/verify.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+#export HOSTNAME=${`hostname -s`}
+#export DOMAIN=${`hostname -d`}
+cd /srv/salt/scripts; git pull -r || true; source bootstrap.sh || exit 1
+
+# BOOTSTRAP
+if [[ $BOOTSTRAP =~ ^(True|true|1|yes)$ ]]; then
+  # workarounds for kitchen
+  test ! -e /tmp/kitchen  || (mkdir -p /srv/salt/reclass; rsync -avh /tmp/kitchen/ /srv/salt/reclass)
+  cd /srv/salt/reclass
+  # clone latest system-level if missing
+  if [[ -e .gitmodules ]] && [[ ! -e classes/system/linux ]]; then
+    git submodule update --init --recursive --remote || true
+  fi
+  source_local_envs
+  /srv/salt/scripts/bootstrap.sh
+  if [[ -e /tmp/kitchen ]]; then sed -i '/export BOOTSTRAP=/d' /kitchen.env; fi
+fi
+
+# VERIFY
+export RECLASS_IGNORE_CLASS_NOTFOUND=False
+cd /srv/salt/reclass &&\
+if [[ -z "$1" ]] ; then
+  verify_salt_master &&\
+  verify_salt_minions
+else
+  verify_salt_minion "$1"
+fi