diff --git a/docker/host.yml b/docker/host.yml
index bb3dffa..a88ff2f 100644
--- a/docker/host.yml
+++ b/docker/host.yml
@@ -6,6 +6,7 @@
   docker:
     host:
       pkgs:
+        - containerd.io
         - docker-ce
         - python-docker
       experimental: true
diff --git a/jenkins/client/job/deploy/update/init.yml b/jenkins/client/job/deploy/update/init.yml
index 3866d26..a05b1ad 100644
--- a/jenkins/client/job/deploy/update/init.yml
+++ b/jenkins/client/job/deploy/update/init.yml
@@ -3,6 +3,7 @@
   - system.jenkins.client.job.deploy.update.config
   - system.jenkins.client.job.deploy.update.saltenv
   - system.jenkins.client.job.deploy.update.update_mirror_image
+  - system.jenkins.client.job.deploy.update.update_ceph
   - system.jenkins.client.job.deploy.update.upgrade
   - system.jenkins.client.job.deploy.update.upgrade_compute
   - system.jenkins.client.job.deploy.update.upgrade_mcp_release
diff --git a/jenkins/client/job/deploy/update/update_ceph.yml b/jenkins/client/job/deploy/update/update_ceph.yml
new file mode 100644
index 0000000..dd8bf58
--- /dev/null
+++ b/jenkins/client/job/deploy/update/update_ceph.yml
@@ -0,0 +1,37 @@
+#
+# Jobs to run given states on given Salt master environment's
+#
+parameters:
+  _param:
+    jenkins_salt_api_url: "http://${_param:salt_master_host}:6969"
+  jenkins:
+    client:
+      job:
+        ceph-update:
+          type: workflow-scm
+          concurrent: true
+          discard:
+            build:
+              keep_num: 10
+            artifact:
+              keep_num: 10
+          display_name: "Update ceph packages"
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
+            credentials: "gerrit"
+            script: update-ceph.groovy
+          param:
+            SALT_MASTER_URL:
+              type: string
+              default: "${_param:jenkins_salt_api_url}"
+              description: Full Salt API address [https://10.10.10.1:8000].
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+              description: Credentials to the Salt API.
+            TARGET_SERVERS:
+              type: string
+              default: "*"
+              description: Salt compound target to match nodes to be updated [*, G@osfamily:debian].
diff --git a/jenkins/slave/docker.yml b/jenkins/slave/docker.yml
index 227dd51..169cb08 100644
--- a/jenkins/slave/docker.yml
+++ b/jenkins/slave/docker.yml
@@ -17,5 +17,7 @@
             commands:
             - /usr/bin/docker
       package:
+        containerd.io:
+          version: latest
         docker-ce:
           version: latest
diff --git a/keystone/client/service/radosgw-swift.yml b/keystone/client/service/radosgw-swift.yml
index e3f8157..cd495ee 100644
--- a/keystone/client/service/radosgw-swift.yml
+++ b/keystone/client/service/radosgw-swift.yml
@@ -31,12 +31,12 @@
                   public_address: ${_param:cluster_public_host}
                   public_protocol: ${_param:cluster_public_protocol}
                   public_port: ${_param:radosgw_swift_cluster_port}
-                  public_path: '/swift/v1' # /$(project_id)s
+                  public_path: '/swift/v1/AUTH_%(tenant_id)s'
                   internal_address: ${_param:radosgw_service_host}
                   internal_port: ${_param:radosgw_swift_cluster_port}
-                  internal_path: '/swift/v1'
+                  internal_path: '/swift/v1/AUTH_%(tenant_id)s'
                   internal_protocol: ${_param:radosgw_service_protocol}
                   admin_protocol: ${_param:radosgw_service_protocol}
                   admin_address: ${_param:radosgw_service_host}
                   admin_port: ${_param:radosgw_swift_cluster_port}
-                  admin_path: '/swift/v1'
+                  admin_path: '/swift/v1/AUTH_%(tenant_id)s'
diff --git a/keystone/client/v3/service/radosgw-swift.yml b/keystone/client/v3/service/radosgw-swift.yml
index b9fadc8..d1acce3 100644
--- a/keystone/client/v3/service/radosgw-swift.yml
+++ b/keystone/client/v3/service/radosgw-swift.yml
@@ -30,13 +30,13 @@
               endpoints:
                 radosgw-swift_public:
                   interface: 'public'
-                  url: ${_param:cluster_public_protocol}://${_param:cluster_public_host}:${_param:radosgw_swift_cluster_port}/swift/v1
+                  url: ${_param:cluster_public_protocol}://${_param:cluster_public_host}:${_param:radosgw_swift_cluster_port}/swift/v1/AUTH_%(tenant_id)s
                   region: ${_param:openstack_region}
                 radosgw-swift_internal:
                   interface: 'internal'
-                  url: ${_param:radosgw_service_protocol}://${_param:radosgw_service_host}:${_param:radosgw_swift_cluster_port}/swift/v1
+                  url: ${_param:radosgw_service_protocol}://${_param:radosgw_service_host}:${_param:radosgw_swift_cluster_port}/swift/v1/AUTH_%(tenant_id)s
                   region: ${_param:openstack_region}
                 radosgw-swift_admin:
                   interface: 'admin'
-                  url: ${_param:radosgw_service_protocol}://${_param:radosgw_service_host}:${_param:radosgw_swift_cluster_port}/swift/v1
+                  url: ${_param:radosgw_service_protocol}://${_param:radosgw_service_host}:${_param:radosgw_swift_cluster_port}/swift/v1/AUTH_%(tenant_id)s
                   region: ${_param:openstack_region}
diff --git a/kubernetes/common/init.yml b/kubernetes/common/init.yml
index 0c69c9e..c9f83c8 100644
--- a/kubernetes/common/init.yml
+++ b/kubernetes/common/init.yml
@@ -24,6 +24,7 @@
     kubernetes_containerd_repo: https://github.com/kubernetes-sigs/cri-tools/releases/download
     kubernetes_openstack_provider_repo: ${_param:mcp_binary_registry}/mirantis/kubernetes/cloud-provider-openstack
     kubernetes_metrics_server_repo: k8s.gcr.io
+    kubernetes_helm_tiller_repo: gcr.io/kubernetes-helm
 
     # component images/binaries
     kubernetes_calico_image: ${_param:kubernetes_calico_repo}/node:v3.3.2
@@ -71,6 +72,7 @@
     kubernetes_calico_calicoctl_image: ${_param:mcp_docker_registry}/mirantis/projectcalico/calico/ctl:v3.3.2
     kubernetes_containerd_package: containerd.io=1.2.1-1~u16.04+mcp
     kubernetes_metrics_server_image: ${_param:kubernetes_metrics_server_repo}/metrics-server-amd64:v0.3.1
+    kubernetes_helm_tiller_image: ${_param:kubernetes_helm_tiller_repo}/tiller:v2.12.2
 
     kubernetes_opencontrail_controller_image: ${_param:kubernetes_contrail_registry}/opencontrail-controller:${_param:mcp_version}
     kubernetes_opencontrail_analyticsdb_image: ${_param:kubernetes_contrail_registry}/opencontrail-analyticsdb:${_param:mcp_version}
@@ -95,6 +97,7 @@
     kubernetes_ingressnginx_enabled: false
     kubernetes_containerd_enabled: true
     kubernetes_metrics_server_enabled: false
+    kubernetes_helm_tiller_enabled: false
 
     kubernetes_ingressnginx_controller_replicas: 1
 
@@ -242,6 +245,9 @@
         metrics-server:
           enabled: ${_param:kubernetes_metrics_server_enabled}
           controller_image: ${_param:kubernetes_metrics_server_image}
+        helm:
+          enabled: ${_param:kubernetes_helm_tiller_enabled}
+          tiller_image: ${_param:kubernetes_helm_tiller_image}
     pool:
       enabled: false
       kubelet: