diff --git a/classes/cluster/os-ha-ovs-syndic/.env b/classes/cluster/os-ha-ovs-syndic/.env
new file mode 100644
index 0000000..b8847b6
--- /dev/null
+++ b/classes/cluster/os-ha-ovs-syndic/.env
@@ -0,0 +1 @@
+EXTRA_FORMULAS="nginx"
diff --git a/classes/cluster/virtual-mcp11-k8s-contrail/.env b/classes/cluster/virtual-mcp11-k8s-contrail/.env
new file mode 100644
index 0000000..e5922db
--- /dev/null
+++ b/classes/cluster/virtual-mcp11-k8s-contrail/.env
@@ -0,0 +1 @@
+EXTRA_FORMULAS="heka"
diff --git a/classes/cluster/virtual-mcp11-ovs-ironic/init.yml b/classes/cluster/virtual-mcp11-ovs-ironic/init.yml
index 8bc1323..daf6489 100644
--- a/classes/cluster/virtual-mcp11-ovs-ironic/init.yml
+++ b/classes/cluster/virtual-mcp11-ovs-ironic/init.yml
@@ -48,4 +48,3 @@
           source: ${_param:linux_system_repo}
           architectures: amd64
           clean_file: true
-
diff --git a/classes/cluster/virtual-mcp11-ovs-ironic/openstack/baremetal.yml b/classes/cluster/virtual-mcp11-ovs-ironic/openstack/baremetal.yml
index 7120c15..b361ff2 100644
--- a/classes/cluster/virtual-mcp11-ovs-ironic/openstack/baremetal.yml
+++ b/classes/cluster/virtual-mcp11-ovs-ironic/openstack/baremetal.yml
@@ -13,6 +13,7 @@
 - system.neutron.gateway.ironic
 - system.neutron.client.service.ironic
 - service.baremetal_simulator.simulator
+- service.baremetal_simulator.nodes_flat
 - service.baremetal_simulator.network.ovs
 - cluster.virtual-mcp11-ovs-ironic
 parameters:
@@ -105,3 +106,20 @@
           - ${_param:external_interface}
           use_ovs_ports:
           - float-to-ex
+  ironic:
+    api:
+      message_queue:
+        port: ${_param:rabbitmq_port}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
+      database:
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
+    conductor:
+      message_queue:
+        port: ${_param:rabbitmq_port}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
+      database:
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
diff --git a/classes/cluster/virtual-mcp11-ovs-ironic/openstack/control.yml b/classes/cluster/virtual-mcp11-ovs-ironic/openstack/control.yml
index 0a88de2..c217e9e 100644
--- a/classes/cluster/virtual-mcp11-ovs-ironic/openstack/control.yml
+++ b/classes/cluster/virtual-mcp11-ovs-ironic/openstack/control.yml
@@ -4,8 +4,11 @@
 - system.linux.system.repo.mcp.openstack
 - system.linux.system.repo.mcp.extra
 - system.linux.system.repo.saltstack.xenial
+- system.salt.minion.cert.mysql.server
+- system.salt.minion.cert.rabbitmq_server
 - system.memcached.server.single
 - system.rabbitmq.server.cluster
+- service.rabbitmq.server.ssl
 - system.rabbitmq.server.vhost.openstack
 - system.keystone.server.wsgi
 - system.keystone.server.cluster
@@ -24,6 +27,7 @@
 - system.haproxy.proxy.listen.openstack.nova-placement
 - system.heat.server.cluster
 - system.galera.server.cluster
+- service.galera.ssl
 - system.galera.server.database.ceilometer
 - system.galera.server.database.cinder
 - system.galera.server.database.glance
@@ -40,6 +44,7 @@
     keepalived_vip_interface: ens4
     cluster_vip_address: ${_param:openstack_control_address}
     cluster_local_address: ${_param:single_address}
+    salt_minion_ca_host: cfg01.${linux:system:domain}
   linux:
     system:
       package:
@@ -107,3 +112,12 @@
       notification:
         driver: messagingv2
         topics: "notifications,${_param:stacklight_notification_topic}"
+  ironic:
+    api:
+      message_queue:
+        port: ${_param:rabbitmq_port}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
+      database:
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
diff --git a/classes/cluster/virtual-mcp11-ovs-ironic/openstack/init.yml b/classes/cluster/virtual-mcp11-ovs-ironic/openstack/init.yml
index 255c179..46dc8ce 100644
--- a/classes/cluster/virtual-mcp11-ovs-ironic/openstack/init.yml
+++ b/classes/cluster/virtual-mcp11-ovs-ironic/openstack/init.yml
@@ -95,6 +95,9 @@
     mongodb_admin_password: cloudlab
     mongodb_shared_key: eoTh1AwahlahqueingeejooLughah4tei9feing0eeVaephooDi2li1TaeV1ooth
     linux_system_repo: 'deb [arch=amd64] http://mirror.fuel-infra.org/mcp-repos/ocata/xenial ocata main'
+    galera_ssl_enabled: true
+    rabbitmq_ssl_enabled: true
+    rabbitmq_port: 5671 # for non-ssl use 5672
   linux:
     network:
       purge_hosts: true
@@ -149,3 +152,7 @@
         root:
           name: root
           password: false
+  salt:
+    minion:
+      trusted_ca_minions:
+        -  cfg01.${linux:system:domain}
diff --git a/classes/system b/classes/system
index 4648fd5..1ddaca1 160000
--- a/classes/system
+++ b/classes/system
@@ -1 +1 @@
-Subproject commit 4648fd5808962af295497d0fa9b41bfdf9f5e25f
+Subproject commit 1ddaca160ad1b181562cbe2592ec55974024d46c