diff --git a/cinder/volume/local.yml b/cinder/volume/local.yml
new file mode 100644
index 0000000..794a33e
--- /dev/null
+++ b/cinder/volume/local.yml
@@ -0,0 +1,14 @@
+classes:
+- service.cinder.volume.local
+parameters:
+  cinder:
+    volume:
+      enabled: True
+      database:
+        host: ${_param:single_address}
+      glance:
+        host: ${_param:single_address}
+      message_queue:
+        host: ${_param:single_address}
+      identity:
+        host: ${_param:single_address}
diff --git a/docker/swarm/service/monitoring/prometheus_alertmanager.yml b/docker/swarm/service/monitoring/prometheus_alertmanager.yml
deleted file mode 100644
index 942fa42..0000000
--- a/docker/swarm/service/monitoring/prometheus_alertmanager.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-classes:
-- service.prometheus.alertmanager.container
-parameters:
-  docker:
-    client:
-      service:
-        prometheus_alertmanager:
-          network: monitoring
-          replicas: 2
-          environment:
-            config_dir: /opt/alertmanager/config
-            bind_port: ${prometheus:alertmanager:bind:port}
-            bind_address: ${prometheus:alertmanager:bind:address}
-            discovery_domain: 'prometheus_alertmanager'
-          restart:
-            condition: any
-          image: ${_param:docker_image_alertmanager}
-          ports:
-            - 15011:${prometheus:alertmanager:bind:port}
-          volume:
-            site:
-              type: bind
-              source: /srv/volumes/prometheus
-              destination: /opt/alertmanager/config
diff --git a/docker/swarm/service/monitoring/prometheus_pushgateway.yml b/docker/swarm/service/monitoring/prometheus_pushgateway.yml
deleted file mode 100644
index 850f66e..0000000
--- a/docker/swarm/service/monitoring/prometheus_pushgateway.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-classes:
-- service.prometheus.pushgateway.container
-parameters:
-  docker:
-    client:
-      service:
-        prometheus_pushgateway:
-          network: monitoring
-          replicas: 2
-          environment:
-            bind_port: ${prometheus:pushgateway:bind:port}
-            bind_address: ${prometheus:pushgateway:bind:address}
-          restart:
-            condition: any
-          image: ${_param:docker_image_pushgateway}
-          ports:
-            - 15012:${prometheus:pushgateway:bind:port}
diff --git a/docker/swarm/service/monitoring/prometheus_server.yml b/docker/swarm/service/monitoring/prometheus_server.yml
deleted file mode 100644
index 5c0a480..0000000
--- a/docker/swarm/service/monitoring/prometheus_server.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-classes:
-- service.prometheus.server.container
-parameters:
-  docker:
-    client:
-      service:
-        prometheus_server:
-          network: monitoring
-          replicas: 1
-          environment:
-            config_dir: /opt/prometheus/config
-            bind_port: ${prometheus:server:bind:port}
-            bind_address: ${prometheus:server:bind:address}
-            alertmanager_port: ${prometheus:alertmanager:bind:port}
-            storage_local_engine: ${prometheus:server:storage:local:engine}
-            storage_local_retention: ${prometheus:server:storage:local:retention}
-            storage_local_memory_chunks: ${prometheus:server:storage:local:memory_chunks}
-            storage_local_max_chunks_to_persist: ${prometheus:server:storage:local:max_chunks_to_persist}
-            storage_local_num_fingerprint_mutexes: ${prometheus:server:storage:local:num_fingerprint_mutexes}
-            discovery_domain: 'prometheus_alertmanager'
-          restart:
-            condition: any
-          image: ${_param:docker_image_prometheus}
-          ports:
-            - 15010:${prometheus:server:bind:port}
-          volume:
-            site:
-              type: bind
-              source: /srv/volumes/prometheus
-              destination: /opt/prometheus/config
diff --git a/docker/swarm/stack/monitoring.yml b/docker/swarm/stack/monitoring.yml
index bbc2d24..091add5 100644
--- a/docker/swarm/stack/monitoring.yml
+++ b/docker/swarm/stack/monitoring.yml
@@ -2,6 +2,8 @@
 - service.prometheus.server.container
 - service.prometheus.alertmanager.container
 - service.prometheus.pushgateway.container
+- system.prometheus.server
+- system.prometheus.alertmanager
 parameters:
   docker:
     client:
@@ -18,15 +20,21 @@
                 - monitoring
               deploy:
                 replicas: 2
+                labels:
+                  com.mirantis.monitoring: "alertmanager"
                 restart_policy:
                   condition: any
+              labels:
+                com.mirantis.monitoring: "alertmanager"
               image: ${_param:docker_image_alertmanager}
               ports:
                 - 15011:${prometheus:alertmanager:bind:port}
               volumes:
-                - /srv/volumes/prometheus:/opt/alertmanager/config
+                - ${prometheus:alertmanager:dir:config}:${_param:prometheus_alertmanager_config_directory}
+                - ${prometheus:alertmanager:dir:data}:${_param:prometheus_alertmanager_data_directory}
               environment:
-                config_dir: /opt/alertmanager/config
+                config_dir: ${_param:prometheus_alertmanager_config_directory}
+                data_dir: ${_param:prometheus_alertmanager_data_directory}
                 bind_port: ${prometheus:alertmanager:bind:port}
                 bind_address: ${prometheus:alertmanager:bind:address}
                 discovery_domain: 'monitoring_alertmanager'
@@ -35,11 +43,15 @@
                 - monitoring
               deploy:
                 replicas: 2
+                labels:
+                  com.mirantis.monitoring: "pushgateway"
                 restart_policy:
                   condition: any
               environment:
                 bind_port: ${prometheus:pushgateway:bind:port}
                 bind_address: ${prometheus:pushgateway:bind:address}
+              labels:
+                com.mirantis.monitoring: "pushgateway"
               image: ${_param:docker_image_pushgateway}
               ports:
                 - 15012:${prometheus:pushgateway:bind:port}
@@ -48,15 +60,21 @@
                 - monitoring
               deploy:
                 replicas: 1
+                labels:
+                  com.mirantis.monitoring: "prometheus"
                 restart_policy:
                   condition: any
+              labels:
+                com.mirantis.monitoring: "prometheus"
               image: ${_param:docker_image_prometheus}
               ports:
                 - 15010:${prometheus:server:bind:port}
               volumes:
-                - /srv/volumes/prometheus:/opt/prometheus/config
+                - ${prometheus:server:dir:config}:${_param:prometheus_server_config_directory}
+                - ${prometheus:server:dir:data}:${_param:prometheus_server_data_directory}
               environment:
-                config_dir: /opt/prometheus/config
+                config_dir: ${_param:prometheus_server_config_directory}
+                data_dir: ${_param:prometheus_server_data_directory}
                 bind_port: ${prometheus:server:bind:port}
                 bind_address: ${prometheus:server:bind:address}
                 alertmanager_port: ${prometheus:alertmanager:bind:port}
diff --git a/jenkins/client/approved_scripts.yml b/jenkins/client/approved_scripts.yml
index d3a5291..f9e01b8 100644
--- a/jenkins/client/approved_scripts.yml
+++ b/jenkins/client/approved_scripts.yml
@@ -103,4 +103,8 @@
         - staticMethod java.lang.Math min int int
         - method hudson.model.Job getBuildByNumber int
         - new java.io.IOException java.lang.String
-        - method org.jenkinsci.plugins.workflow.job.WorkflowRun finish hudson.model.Result java.lang.Throwable
\ No newline at end of file
+        - method org.jenkinsci.plugins.workflow.job.WorkflowRun finish hudson.model.Result java.lang.Throwable
+        - new groovy.json.JsonBuilder
+        - new java.lang.RuntimeException java.lang.String
+        - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods takeRight java.util.List int
+        - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List groovy.lang.Range
diff --git a/jenkins/client/job/debian/packages/extra.yml b/jenkins/client/job/debian/packages/extra.yml
index 298452e..b7de941 100644
--- a/jenkins/client/job/debian/packages/extra.yml
+++ b/jenkins/client/job/debian/packages/extra.yml
@@ -137,6 +137,10 @@
               dist: xenial
               build: telegraf
               branch: release-1.2
+            - package: libvirt-exporter
+              dist: xenial
+              build: libvirt-exporter
+              branch: master
           template:
             type: workflow-scm
             concurrent: false
@@ -150,7 +154,7 @@
                 project:
                   debian/{{package}}:
                     branches:
-                      - debian/{{dist}}
+                      - "{{branch}}"
                 message:
                   build_successful: "Build successful"
                   build_unstable: "Build unstable"
diff --git a/jenkins/client/job/deploy/lab/cicd.yml b/jenkins/client/job/deploy/lab/cicd.yml
index 0aa442e..7f53d29 100644
--- a/jenkins/client/job/deploy/lab/cicd.yml
+++ b/jenkins/client/job/deploy/lab/cicd.yml
@@ -75,3 +75,9 @@
               OPENSTACK_API_VERSION:
                 type: string
                 default: "2"
+              OPENSTACK_API_PROJECT_DOMAIN_ID:
+                type: string
+                default: "default"
+              OPENSTACK_API_USER_DOMAIN_ID:
+                type: string
+                default: "default"
diff --git a/jenkins/client/job/deploy/lab/init.yml b/jenkins/client/job/deploy/lab/init.yml
index 5fc4401..e700325 100644
--- a/jenkins/client/job/deploy/lab/init.yml
+++ b/jenkins/client/job/deploy/lab/init.yml
@@ -2,6 +2,7 @@
   - system.jenkins.client.job.deploy.lab.mk.physical
   - system.jenkins.client.job.deploy.lab.mk.virtual
   - system.jenkins.client.job.deploy.lab.mk.cleanup
+  - system.jenkins.client.job.deploy.lab.mk.cloud
   - system.jenkins.client.job.deploy.lab.cicd
   - system.jenkins.client.job.deploy.lab.demo
 
diff --git a/jenkins/client/job/deploy/lab/mk/cleanup.yml b/jenkins/client/job/deploy/lab/mk/cleanup.yml
index c2b32cc..8658eec 100644
--- a/jenkins/client/job/deploy/lab/mk/cleanup.yml
+++ b/jenkins/client/job/deploy/lab/mk/cleanup.yml
@@ -31,6 +31,12 @@
             OPENSTACK_API_VERSION:
               type: string
               default: "2"
+            OPENSTACK_API_PROJECT_DOMAIN_ID:
+              type: string
+              default: "default"
+            OPENSTACK_API_USER_DOMAIN_ID:
+              type: string
+              default: "default"
             # heat
             HEAT_STACK_NAME:
               type: string
@@ -66,4 +72,10 @@
               default: "liberty"
             OPENSTACK_API_VERSION:
               type: string
-              default: "2"
\ No newline at end of file
+              default: "2"
+            OPENSTACK_API_PROJECT_DOMAIN_ID:
+              type: string
+              default: "default"
+            OPENSTACK_API_USER_DOMAIN_ID:
+              type: string
+              default: "default"
diff --git a/jenkins/client/job/deploy/lab/mk/cloud.yml b/jenkins/client/job/deploy/lab/mk/cloud.yml
new file mode 100644
index 0000000..cbbcd34
--- /dev/null
+++ b/jenkins/client/job/deploy/lab/mk/cloud.yml
@@ -0,0 +1,134 @@
+parameters:
+  _param:
+    jenkins_cloud_deploy_pipelines:
+      - stack_name: k8s_calico
+        stack_type: heat
+        stack_install: core,k8s
+        job_timer: ""
+      - stack_name: k8s_calico
+        stack_type: aws
+        stack_install: core,k8s
+        job_timer: ""
+  jenkins:
+    client:
+      job_template:
+        cloud_deploy_heat_template:
+          name: cloud-deploy-{{stack_type}}-{{stack_name}}
+          jobs: ${_param:jenkins_cloud_deploy_pipelines}
+          template:
+            type: workflow-scm
+            discard:
+              build:
+                keep_num: 20
+            concurrent: true
+            display_name: "Deploy {{stack_type}} {{stack_name}} stack"
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              credentials: "gerrit"
+              script: cloud-deploy-pipeline.groovy
+            trigger:
+              timer:
+                spec: "{{job_timer}}"
+            param:
+              # deployments and test settings
+              STACK_NAME:
+                type: string
+                description: Heat stack name. Will be generated if missing.
+              STACK_TEMPLATE:
+                type: string
+                default: "{{stack_name}}"
+              STACK_TYPE:
+                type: string
+                default: "{{stack_type}}"
+              STACK_INSTALL:
+                type: string
+                default: "{{stack_install}}"
+              STACK_TEST:
+                type: string
+                default: ""
+              STACK_DELETE:
+                type: boolean
+                default: 'true'
+                description: "Don't enable it if you need to use the lab after"
+              STACK_REUSE:
+                type: boolean
+                default: 'false'
+
+              STACK_TEMPLATE_URL:
+                type: string
+                default: "${_param:jenkins_gerrit_url}/mk/heat-templates"
+              STACK_TEMPLATE_CREDENTIALS:
+                type: string
+                default: "gerrit"
+              STACK_TEMPLATE_BRANCH:
+                type: string
+                default: "master"
+
+              # salt master
+              SALT_MASTER_CREDENTIALS:
+                type: string
+                default: "salt-qa-credentials"
+              SALT_MASTER_URL:
+                type: string
+                default: ""
+
+              # openstack api
+              AWS_STACK_REGION:
+                type: string
+                default: "us-west-2"
+              AWS_API_CREDENTIALS:
+                type: string
+                default: "aws-qa-credentials"
+
+              # openstack api
+              OPENSTACK_API_URL:
+                type: string
+                default: "https://vpc.tcpisek.cz:5000/v2.0"
+              OPENSTACK_API_CREDENTIALS:
+                type: string
+                default: "openstack-qa-credentials"
+              OPENSTACK_API_PROJECT:
+                type: string
+                default: "mirantis_mk20_qa"
+              OPENSTACK_API_CLIENT:
+                type: string
+                default: "liberty"
+              OPENSTACK_API_VERSION:
+                type: string
+                default: "2"
+              OPENSTACK_API_PROJECT_DOMAIN_ID:
+                type: string
+                default: "default"
+              OPENSTACK_API_USER_DOMAIN_ID:
+                type: string
+                default: "default"
+
+              # heat
+              HEAT_STACK_ENVIRONMENT:
+                type: string
+                default: "tcpisek"
+              HEAT_STACK_ZONE:
+                type: string
+                default: "workshop-sunnyvale"
+              HEAT_STACK_PUBLIC_NET:
+                type: string
+                default: "mirantis-private"
+
+              # k8s setttings
+              K8S_API_SERVER:
+                type: string
+                default: "http://127.0.0.1:8080"
+              K8S_CONFORMANCE_IMAGE:
+                type: string
+                default: "docker-dev-virtual.docker.mirantis.net/mirantis/kubernetes/k8s-conformance:v1.5.1-3_1482332392819"
+
+              # Tempest settings
+              TEMPEST_IMAGE_LINK:
+                type: string
+                default: "sandbox-docker-prod-local.docker.mirantis.net/mirantis/rally_tempest:0.1"
+
+              ASK_ON_ERROR:
+                type: boolean
+                default: 'false'
+
diff --git a/jenkins/client/job/deploy/lab/mk/init.yml b/jenkins/client/job/deploy/lab/mk/init.yml
index 2a32dc6..fba15ef 100644
--- a/jenkins/client/job/deploy/lab/mk/init.yml
+++ b/jenkins/client/job/deploy/lab/mk/init.yml
@@ -91,6 +91,12 @@
               OPENSTACK_API_VERSION:
                 type: string
                 default: "2"
+              OPENSTACK_API_PROJECT_DOMAIN_ID:
+                type: string
+                default: "default"
+              OPENSTACK_API_USER_DOMAIN_ID:
+                type: string
+                default: "default"
 
               # k8s setttings
               K8S_API_SERVER:
diff --git a/jenkins/client/job/deploy/lab/mk/virtual.yml b/jenkins/client/job/deploy/lab/mk/virtual.yml
index 337d93d..e615408 100644
--- a/jenkins/client/job/deploy/lab/mk/virtual.yml
+++ b/jenkins/client/job/deploy/lab/mk/virtual.yml
@@ -9,72 +9,86 @@
         stack_type: heat
         test: openstack
         timer: ""
+        extra_formulas: ""
       - lab: virtual_mk20_basic
         install: core,openstack
         stack_type: heat
         test: openstack
         timer: ""
+        extra_formulas: ""
       # mk22
       - lab: virtual_mk22_advanced
         install: core,openstack
         stack_type: heat
         test: openstack
         timer: ""
+        extra_formulas: ""
       - lab: virtual_mk22_basic
         install: core,openstack
         stack_type: heat
         test: openstack
         timer: ""
+        extra_formulas: ""
       # mcp05
       - lab: virtual_mcp05_dvr
         install: core,openstack,dvr
         stack_type: heat
         test: openstack
         timer: ""
+        extra_formulas: ""
       - lab: virtual_mcp05_ovs
         install: core,openstack,ovs
         stack_type: heat
         test: openstack
         timer: ""
+        extra_formulas: ""
       # mcp10
       - lab: virtual_mcp10_contrail
         install: core,openstack,contrail
         stack_type: heat
         test: openstack
         timer: "H H(0-6) * * *"
+        extra_formulas: ""
       - lab: virtual_mcp10_dvr
         install: core,openstack,dvr
         stack_type: heat
         test: openstack
         timer: "H H(0-6) * * *"
+        extra_formulas: ""
       - lab: virtual_mcp10_ovs
         install: core,openstack,ovs
         stack_type: heat
         test: openstack
         timer: "H H(0-6) * * *"
+        extra_formulas: ""
       # mcp11
       - lab: virtual_mcp11_contrail
         install: core,openstack,contrail
         stack_type: heat
         test: openstack
+        extra_formulas: ""
         timer: ""
       - lab: virtual_mcp11_dvr
         install: core,openstack,dvr
         stack_type: heat
         test: openstack
         timer: ""
+        extra_formulas: ""
       - lab: virtual_mcp11_ovs
         install: core,openstack,ovs
         stack_type: heat
         test: openstack
         timer: ""
+        extra_formulas: ""
       - lab: virtual_mcp11_k8s_calico
         install: core,k8s,calico
         stack_type: heat
         test: k8s
         timer: "H H(0-6) * * *"
+        extra_formulas: ""
       - lab: virtual_mcp11_k8s_contrail
         install: core,k8s,contrail
         stack_type: heat
         test: k8s
         timer: "H H(0-6) * * *"
+        extra_formulas: ""
diff --git a/jenkins/client/job/deploy/update/upgrade.yml b/jenkins/client/job/deploy/update/upgrade.yml
index 81a7b16..efbd153 100644
--- a/jenkins/client/job/deploy/update/upgrade.yml
+++ b/jenkins/client/job/deploy/update/upgrade.yml
@@ -23,3 +23,15 @@
             SALT_MASTER_CREDENTIALS:
               type: string
               default: "salt"
+            STAGE_TEST_UPGRADE:
+              type: boolean
+              default: 'true'
+              description: "Test if syncdb and APIs succeed"
+            STAGE_REAL_UPGRADE:
+              type: boolean
+              default: 'true'
+              description: "Run real control upgrade"
+            STAGE_ROLLBACK_UPGRADE:
+              type: boolean
+              default: 'true'
+              description: "Rollback if control upgrade fails"
diff --git a/jenkins/client/job/docker/aptly.yml b/jenkins/client/job/docker/aptly.yml
deleted file mode 100644
index 98ef8af..0000000
--- a/jenkins/client/job/docker/aptly.yml
+++ /dev/null
@@ -1,48 +0,0 @@
-parameters:
-  jenkins:
-    client:
-      job:
-        docker-build-images-aptly:
-          name: docker-build-images-aptly
-          discard:
-            build:
-              keep_num: 25
-            artifact:
-              keep_num: 25
-          type: workflow-scm
-          concurrent: true
-          scm:
-            type: git
-            url: "${_param:jenkins_gerrit_url}/mk/docker-aptly"
-            credentials: "gerrit"
-          trigger:
-            gerrit:
-              project:
-                "mk/docker-aptly":
-                  branches:
-                    - master
-              event:
-                ref:
-                  - updated: {}
-          param:
-            IMAGE_GIT_URL:
-              type: string
-              default: "${_param:jenkins_gerrit_url}/mk/docker-aptly"
-            IMAGE_BRANCH:
-              type: string
-              default: "master"
-            IMAGE_CREDENTIALS_ID:
-              type: string
-              default: "gerrit"
-            IMAGE_TAGS:
-              type: string
-              default: "latest"
-            REGISTRY_URL:
-              type: string
-              default: ""
-            REGISTRY_CREDENTIALS_ID:
-              type: string
-              default: "dockerhub"
-            DOCKER_GIT_TAG:
-              type: boolean
-              default: "true"
diff --git a/jenkins/client/job/docker/build-images.yml b/jenkins/client/job/docker/build-images.yml
new file mode 100644
index 0000000..1cc3709
--- /dev/null
+++ b/jenkins/client/job/docker/build-images.yml
@@ -0,0 +1,52 @@
+parameters:
+  jenkins:
+    client:
+      job:
+        docker-build-images:
+          name: "docker-build-images-{{name}}"
+          jobs:
+            - name: aptly
+            - name: ci
+          template:
+            discard:
+              build:
+                keep_num: 25
+              artifact:
+                keep_num: 25
+            type: workflow-scm
+            concurrent: true
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/mk/docker-{{name}}"
+              credentials: "gerrit"
+            trigger:
+              gerrit:
+                project:
+                  "mk/docker-{{name}}":
+                    branches:
+                      - master
+                event:
+                  ref:
+                    - updated: {}
+            param:
+              IMAGE_GIT_URL:
+                type: string
+                default: "${_param:jenkins_gerrit_url}/mk/docker-{{name}}"
+              IMAGE_BRANCH:
+                type: string
+                default: "master"
+              IMAGE_CREDENTIALS_ID:
+                type: string
+                default: "gerrit"
+              IMAGE_TAGS:
+                type: string
+                default: "latest"
+              REGISTRY_URL:
+                type: string
+                default: ""
+              REGISTRY_CREDENTIALS_ID:
+                type: string
+                default: "dockerhub"
+              DOCKER_GIT_TAG:
+                type: boolean
+                default: "true"
diff --git a/jenkins/client/job/git-mirrors/downstream/debian-packages.yml b/jenkins/client/job/git-mirrors/downstream/debian-packages.yml
index 9708d9f..dde7d9a 100644
--- a/jenkins/client/job/git-mirrors/downstream/debian-packages.yml
+++ b/jenkins/client/job/git-mirrors/downstream/debian-packages.yml
@@ -7,6 +7,10 @@
         downstream: debian/telegraf
         upstream: "https://github.com/influxdata/telegraf.git"
         branches: master
+      - name: libvirt-exporter
+        downstream: debian/libvirt-exporter
+        upstream: "https://github.com/kumina/libvirt_exporter.git"
+        branches: master
       - name: debian-gophercloud
         downstream: debian/gophercloud
         upstream: "https://github.com/gophercloud/gophercloud.git"
diff --git a/jenkins/client/job/git-mirrors/downstream/salt_formulas_utils.yml b/jenkins/client/job/git-mirrors/downstream/salt_formulas_utils.yml
new file mode 100644
index 0000000..dfbdb60
--- /dev/null
+++ b/jenkins/client/job/git-mirrors/downstream/salt_formulas_utils.yml
@@ -0,0 +1,9 @@
+classes:
+  - system.jenkins.client.job.git-mirrors.downstream
+parameters:
+  _param:
+    jenkins_git_mirror_downstream_jobs:
+      - name: salt-formulas
+        downstream: salt-formulas/salt-formulas
+        upstream: "https://github.com/salt-formulas/salt-formulas"
+        branches: master
\ No newline at end of file
diff --git a/jenkins/client/job/git-mirrors/downstream/templates.yml b/jenkins/client/job/git-mirrors/downstream/templates.yml
index ef504af..1c34f37 100644
--- a/jenkins/client/job/git-mirrors/downstream/templates.yml
+++ b/jenkins/client/job/git-mirrors/downstream/templates.yml
@@ -6,7 +6,7 @@
       - name: cookiecutter-templates
         downstream: mk/cookiecutter-templates
         upstream: "git@github.com:Mirantis/mk2x-cookiecutter-reclass-model"
-        branches: master
+        branches: master,mcp10
       - name: heat-templates
         downstream: mk/heat-templates
         upstream: "git@github.com:Mirantis/mk-lab-heat-templates"
diff --git a/jenkins/client/job/git-mirrors/upstream/salt_formulas_utils.yml b/jenkins/client/job/git-mirrors/upstream/salt_formulas_utils.yml
new file mode 100644
index 0000000..c86cda5
--- /dev/null
+++ b/jenkins/client/job/git-mirrors/upstream/salt_formulas_utils.yml
@@ -0,0 +1,9 @@
+classes:
+  - system.jenkins.client.job.git-mirrors.upstream
+parameters:
+  _param:
+    jenkins_git_mirror_upstream_jobs:
+      - name: salt-formulas
+        downstream: salt-formulas/salt-formulas
+        upstream: "git@github.com:salt-formulas/salt-formulas.git"
+        branches: master
diff --git a/jenkins/client/job/git-mirrors/upstream/templates.yml b/jenkins/client/job/git-mirrors/upstream/templates.yml
index 12e4a9a..5ffaa43 100644
--- a/jenkins/client/job/git-mirrors/upstream/templates.yml
+++ b/jenkins/client/job/git-mirrors/upstream/templates.yml
@@ -6,7 +6,7 @@
       - name: cookiecutter-templates
         downstream: mk/cookiecutter-templates
         upstream: "git@github.com:Mirantis/mk2x-cookiecutter-reclass-model"
-        branches: master
+        branches: master,mcp10
       - name: heat-templates
         downstream: mk/heat-templates
         upstream: "git@github.com:Mirantis/mk-lab-heat-templates"
diff --git a/jenkins/client/job/opencontrail/build/dpdk-extra.yml b/jenkins/client/job/opencontrail/build/dpdk-extra.yml
index f250a8c..5b128a2 100644
--- a/jenkins/client/job/opencontrail/build/dpdk-extra.yml
+++ b/jenkins/client/job/opencontrail/build/dpdk-extra.yml
@@ -21,6 +21,10 @@
               dist: xenial
               branch_name: mitaka
               branch_real_name: mitaka
+            - os: ubuntu
+              dist: xenial
+              branch_name: newton
+              branch_real_name: newton
           template:
             discard:
              build:
diff --git a/jenkins/client/job/opencontrail/git-mirrors/2way.yml b/jenkins/client/job/opencontrail/git-mirrors/2way.yml
index 0ecb83f..349dad5 100644
--- a/jenkins/client/job/opencontrail/git-mirrors/2way.yml
+++ b/jenkins/client/job/opencontrail/git-mirrors/2way.yml
@@ -3,31 +3,79 @@
     jenkins_pollscm_spec: "H/60 * * * *"
   jenkins:
     client:
-      job:
-        git-mirror-2way-contrail-kubernetes:
-          type: workflow-scm
-          concurrent: false
-          scm:
-            type: git
-            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
-            credentials: "gerrit"
-            script: git-mirror-2way-pipeline.groovy
-            github:
-              url: "https://github.com/Mirantis/contrail-kubernetes"
-          trigger:
-            github:
-            pollscm:
-              spec: ${_param:jenkins_pollscm_spec}
-          param:
-            SOURCE_URL:
-              type: string
-              default: "${_param:jenkins_gerrit_url}/contrail/contrail-kubernetes.git"
-            TARGET_URL:
-              type: string
-              default: "https://github.com/Mirantis/contrail-kubernetes.git"
-            CREDENTIALS_ID:
-              type: string
-              default: "gerrit"
-            BRANCHES:
-              type: string
-              default: ${_param:contrail_kubernetes_branches}
+      job_template:
+        git-mirror-2way:
+          name: git-mirror-2way-{{name}}
+          jobs:
+            - name: contrail-build
+              branches: ${_param:contrail_branches}
+            - name: contrail-pipeline
+              branches: ${_param:contrail_branches}
+            - name: contrail-controller
+              branches: ${_param:contrail_branches}
+            - name: contrail-vrouter
+              branches: ${_param:contrail_branches}
+            - name: contrail-third-party
+              branches: ${_param:contrail_branches}
+            - name: contrail-generateDS
+              branches: ${_param:contrail_branches}
+            - name: contrail-sandesh
+              branches: ${_param:contrail_branches}
+            - name: contrail-packages
+              branches: ${_param:contrail_branches}
+            - name: contrail-nova-vif-driver
+              branches: ${_param:contrail_branches}
+            - name: contrail-neutron-plugin
+              branches: ${_param:contrail_branches}
+            - name: contrail-nova-extensions
+              branches: ${_param:contrail_branches}
+            - name: contrail-ceilometer-plugin
+              branches: ${_param:contrail_ceilometer_plugin_branches}
+            - name: contrail-heat
+              branches: ${_param:contrail_branches}
+            - name: contrail-web-storage
+              branches: ${_param:contrail_branches}
+            - name: contrail-web-server-manager
+              branches: ${_param:contrail_branches}
+            - name: contrail-web-controller
+              branches: ${_param:contrail_branches}
+            - name: contrail-web-core
+              branches: ${_param:contrail_branches}
+            - name: contrail-webui-third-party
+              branches: ${_param:contrail_branches}
+            - name: contrail-dpdk-extra-packages
+              branches: ${_param:contrail_dpdk_extra_branches}
+            - name: contrail-dpdk
+              branches: ${_param:contrail_dpdk_branches}
+          template:
+            discard:
+              build:
+                keep_num: 10
+              artifact:
+                keep_num: 10
+            type: workflow-scm
+            concurrent: false
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              credentials: "gerrit"
+              script: git-mirror-2way-pipeline.groovy
+              github:
+                url: "https://github.com/Mirantis/{{name}}"
+            trigger:
+              github:
+              pollscm:
+                spec: ${_param:jenkins_pollscm_spec}
+            param:
+              SOURCE_URL:
+                type: string
+                default: "${_param:jenkins_gerrit_url}/contrail/{{name}}.git"
+              TARGET_URL:
+                type: string
+                default: "https://github.com/Mirantis/{{name}}.git"
+              CREDENTIALS_ID:
+                type: string
+                default: "gerrit"
+              BRANCHES:
+                type: string
+                default: "{{branches}}"
diff --git a/jenkins/client/job/opencontrail/init.yml b/jenkins/client/job/opencontrail/init.yml
index 2d38d5a..e76b322 100644
--- a/jenkins/client/job/opencontrail/init.yml
+++ b/jenkins/client/job/opencontrail/init.yml
@@ -5,7 +5,7 @@
   _param:
     contrail_branches: "R3.0.2.x,R3.0.3.x,R3.1,R3.1.1.x,R3.2,R4.0,master"
     contrail_kubernetes_branches: "master,release-1.2"
-    contrail_dpdk_extra_branches: "mitaka,kilo,liberty-multiqueue"
+    contrail_dpdk_extra_branches: "mitaka,kilo,liberty-multiqueue,newton"
     contrail_ceilometer_plugin_branches: "master,R4.0"
     contrail_kubernetes_branches: "master,origin-1.1,origin-1.1.3,release-1.1,release-1.2"
     contrail_dpdk_branches: "master,R3.0.2.x,R3.0.3.x,R3.1,R3.1.1.x,R3.2,R4.0,contrail_dpdk_17_02,contrail_dpdk_1_7,contrail_dpdk_2_0,contrail_dpdk_2_1"
diff --git a/jenkins/client/job/salt-models/tests.yml b/jenkins/client/job/salt-models/tests.yml
index e491da4..e4b573d 100644
--- a/jenkins/client/job/salt-models/tests.yml
+++ b/jenkins/client/job/salt-models/tests.yml
@@ -5,14 +5,19 @@
       job_template:
         test_salt_model:
           name: test-salt-model-{{name}}
-          param:
-            name:
-              - mcp-baremetal-lab
-              - mcp-virtual-lab
-              - mk-ci
-              - qa
-              - stacklight
-              - training
+          jobs:
+            - name: mcp-baremetal-lab
+              extra_formulas: ""
+            - name: mcp-virtual-lab
+              extra_formulas: "prometheus"
+            - name: mk-ci
+              extra_formulas: ""
+            - name: qa
+              extra_formulas: ""
+            - name: stacklight
+              extra_formulas: ""
+            - name: training
+              extra_formulas: ""
           template:
             type: workflow-scm
             scm:
@@ -53,6 +58,10 @@
               PARALLEL_NODE_GROUP_SIZE:
                 type: string
                 default: "3"
+              # Salt master setup extra formulas
+              EXTRA_FORMULAS:
+                type: string
+                default: "{{extra_formulas}}"
         test_system_reclass:
           name: test-salt-model-{{name}}
           jobs:
diff --git a/jenkins/client/job/test_devops_portal.yml b/jenkins/client/job/test_devops_portal.yml
index 711f42a..41be263 100644
--- a/jenkins/client/job/test_devops_portal.yml
+++ b/jenkins/client/job/test_devops_portal.yml
@@ -32,9 +32,15 @@
                   - addedContains:
                       commentAddedCommentContains: '(recheck|reverify)'
           param:
+            COMPOSE_PATH:
+              type: string
+              default: "docker/stack/docker-compose.yml"
             CREDENTIALS_ID:
               type: string
               default: "gerrit"
+            JSON_CONFIG:
+              type: string
+              default: '{"services": {"elasticsearch": {"endpoint": "http://elasticsearch:9200"}}}'
             NODE_IMAGE:
               type: string
               default: "docker-sandbox.sandbox.mirantis.net/ikharin/ci/node-firefox:6.10"
diff --git a/opencontrail/control/analytics.yml b/opencontrail/control/analytics.yml
index 8cbd166..8065742 100644
--- a/opencontrail/control/analytics.yml
+++ b/opencontrail/control/analytics.yml
@@ -14,6 +14,9 @@
         python-kafka:
           version: 1.0.1-0contrail1
           hold: true
+      kernel:
+        modules:
+        - nf_conntrack_ipv4
   opencontrail:
     common:
       identity:
diff --git a/opencontrail/control/cluster.yml b/opencontrail/control/cluster.yml
index 4ffe081..a4126d6 100644
--- a/opencontrail/control/cluster.yml
+++ b/opencontrail/control/cluster.yml
@@ -13,8 +13,9 @@
           version: 0.9.0-0contrail0
         python-kafka:
           version: 1.0.1-0contrail1
-        contrail-api-cli:
-          version: latest
+      kernel:
+        modules:
+        - nf_conntrack_ipv4
   opencontrail:
     web:
       database:
diff --git a/opencontrail/control/control.yml b/opencontrail/control/control.yml
index 9c1d905..fdc4f7d 100644
--- a/opencontrail/control/control.yml
+++ b/opencontrail/control/control.yml
@@ -38,3 +38,8 @@
         port: 9042
       network:
         host: ${_param:cluster_vip_address}
+  linux:
+    system:
+      kernel:
+        modules:
+        - nf_conntrack_ipv4
diff --git a/opencontrail/control/single.yml b/opencontrail/control/single.yml
index efdc267..064418e 100644
--- a/opencontrail/control/single.yml
+++ b/opencontrail/control/single.yml
@@ -12,6 +12,9 @@
           version: 1.0.1-0contrail1
         contrail-api-cli:
           version: latest
+      kernel:
+        modules:
+        - nf_conntrack_ipv4
   haproxy:
     proxy:
       listen:
diff --git a/openssh/server/team/stacklight.yml b/openssh/server/team/stacklight.yml
index ac7fd25..6d55bee 100644
--- a/openssh/server/team/stacklight.yml
+++ b/openssh/server/team/stacklight.yml
@@ -79,6 +79,20 @@
           full_name: Ildar Svetlov
           home: /home/isvetlov
           email: isvetlov@mirantis.com
+        akholkin:
+          enabled: true
+          name: akholkin
+          sudo: true
+          full_name: Aleksandr Kholkin
+          home: /home/akholkin
+          email: akholkin@mirantis.com
+        kszukielojc:
+          enabled: true
+          name: kszukielojc
+          sudo: true
+          full_name: Krzysztof Szukiełojć
+          home: /home/kszukielojc
+          email: kszukielojc@mirantis.com
   openssh:
     client:
       enabled: true
@@ -140,6 +154,16 @@
           public_keys:
           - ${public_keys:isvetlov}
           user: ${linux:system:user:isvetlov}
+        akholkin:
+          enable: true
+          public_keys:
+          - ${public_keys:akholkin}
+          user: ${linux:system:user:akholkin}
+        kszukielojc:
+          enable: true
+          public_keys:
+          - ${public_keys:kszukielojc}
+          user: ${linux:system:user:kszukielojc}
   public_keys:
     newt:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3odU+3V2uDA2ptAFL9hrJRPNEEdAyztWOZFQ5Oyd9oerTGOU3p4xmrgWWjfKFKbYGhiiIUcYAol5PkTfKukGEkkjCHYA1t023soCaaAj85wCZCnw2zQNAziwxTYmAzTqgxiSvtZNMMrtJvFHRIRDzJ3M1lV0prWNWkMM1/3FAd4W49y6VT3fkMCo8uqG7CfGdgR2DgBCxf9KaNPfW5eDEPOgmE5lK8tVSEI6T+Cg7hbcTf4lFYnlFBnlQgp/0JstsM4Vbwb4B34LOpOsf2S8rrWk2xQMjwaMHXkc2s/E8iW3F5nVFuyEXYISFQIiAHw8dzC6CHgLcyHUVWwznKawZ newt@newt-dev1
@@ -163,3 +187,7 @@
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDLTkl8X9HIJxruAHkmGNQTovy7DCr256pH68xh2DHWinPKUW4ccsCBbqJeF56aEA41OKJlEVOYzD3gQJkDAAbDdy9BlI14oEtzmk3yAtgBwwUzUNMq7oCPrbt4xNg5U26JSb26j69r5vQ4vXA2hf0bCQ68vb3VDqMMaMbneI3rP3qSaq7dauR8sEjx1XAtNen5SygLE46k0pCObJmahGkg39HisoJ/gkjoi/xvQn1JzrYSxWObrBfUbtQN3JbCRozSp/0Env0hMbXj7cS3J/uY68zAWc7GAEFKSmPAol4d/93sRknFUSQKqZjsDaLfiGLte/7oFwLquaz6AJw+mwP ityaptin@ityaptin.local
     isvetlov:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDflz5rJEC6+yKOteNG2uzObQCtV/c/Rnu9Aku1AJWLMMlouID7RaCUrP642xH2z11kZE+sZk/4c3515M5SPQFVKhjGceftbnI9I7DI1KF4OJwMCSfmACDHM3bJcld8eiKTRBxtk32i6YPdNi6m9unHvPultTIBJCxRP/KVyxOOnQparsSSBhBj2t3Kis+3dnDZNBUJJDWyo69FD0RvAOaWZdogwes0nCl+3JJSNWsATqyS+bi4ojqJimHFKiW2sz8qMX3cMzu9uTx1OWvJWJRgOV5/tPsuuNVt75zPAOsfJnIqQJtpkdZAb4SYK+0jLFcLvB6GBgXY3aHk9nHu9MHr isvetlov@ubuntu
+    akholkin:
+      key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDjpy9RI6iEDH/04eOOwreDa+R32USZiWxyFiKHa8zoDAlOfwaZVg6mZWepOxzwxCJPYusPGXCwQ6Zw9tHxVWOCgtzzPpsCCfhUU4v+99Wh08//W8d/s/WFka+5vqyskAO5Z8Ekk+kQU+jpUBG8/gMxAPBjj0fFc5BNeqDY9r9nmMNK6N2RVjvA6wZ8G5hLGxL9bn5Prhf/+avui1NAfy6gsT/mRt1W+eHWTvpijyNGm+m83jU34dQO6gE48n6WdSylLh/fY/p31rzAURaq1V/AZhdbSuZ8aJYDnfHevpK5+hMjoOop3v3hb7WHEmybGujQfW5HVaaWmG7SFlHeKGE/gZ2P9T+bQ+SgO+PmEAw4LayiBkzTPAHdZ2UGZe+3BI5gdM/ayovK2WVO1jS5FNlNGIvEQW+ws9V+ph+S1jL4jobDJEjs358iXrAYpf4JL+LvxFHiuj6EL51tbo8EU22z5mmgRQQ5eFrDzBuVLhcim651A3a5iSlmCeAQ5rTmHX/Op/PbK+3vAtI8vnlK4AhycLvWQ3kK2DRx+Uhzrlk5v6E14SopAhvpGOHqrLgmoHwHp1xt/9M1JgxkOUK5gccFKTQduxLHoTNBaNcP60IOG/MjqUPcOXSBcAN4Y1RDBg+pwXe4PFgOzwKdFoYeuhvtm8y185S0IvvfCHLCD8pNfQ== akholkin@mirantis.com
+    kszukielojc:
+      key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCiUm3Z3W3t4v7oe143rCNM/hbg9NU2bYUmQXek8DJPA4c3Xm6u0q+RL9kEXME+3zcj2HKqMxKsCBLXXdFIsgdUbOBV8AYiuySE220FTnEKRmdxsEnfSaBhXxFyIBNoew4gI7URSqAOclt5WuPJTqRM7K4VhbtzwEgeWVd/NUhxMCCtgkdJCYTSmycxmxs7R6V8vMr9Mb8DOqKkSpOu6f3JkR0lwnFN9zGGC4V/60FlJSDzvvI5Tn40ANPHITivs8xME0znsx7t0bF4vQUimvhYn1mumQCY1NwIaxJ/QqasD6Ag9Sn5dxSg9b3SeLn0JM6qKoIqZtfPYVuCp9gmlH0fyzJUdqu4lKKb2wBw/H5lK6icH4+owMawkav55rbvinHQOqmVCr/Bg/rTfc35ycVqjTXH/5J7OhzioKjU0yFkXFS2X/s8gpyxp3beJ+Ea4faoX+kcs0gyhMYzqC7/DOamrau7aVyEAjKYJNy60xRfjCQzjqiurbxVFh+3Fi64UUn7Bl1QV8VEiU3ztJ118psEI7zA+x2VROLZ1jrtaBYZTYB118JZicaFDycEVgg3+BHX3pFH/QSOjLsA4SK+HJjSz8CFKvWwaO6QJv1/3KHpcGEacMvmqKxwpQK0E4WpjWhglZRMPObQ0dBaGClOujgoOIHXtFGILEpWy2SdzDQkHw== kszukielojc@w541
diff --git a/postgresql/client/security_monkey.yml b/postgresql/client/security_monkey.yml
index 65f1de2..428753d 100644
--- a/postgresql/client/security_monkey.yml
+++ b/postgresql/client/security_monkey.yml
@@ -24,3 +24,9 @@
                 host: ${_param:secmonkey_db_host}
                 createdb: true
                 rights: all privileges
+              init:
+                maintenance_db: pushkin
+                force: true
+                queries:
+                - INSERT INTO login VALUES (11, 1) ON CONFLICT (id) DO UPDATE SET id = excluded.id;
+                - INSERT INTO device VALUES (1, 11, 42, 'security_audit_service', NULL, 1, NULL) ON CONFLICT (id) DO UPDATE SET id = excluded.id;
diff --git a/prometheus/alertmanager/init.yml b/prometheus/alertmanager/init.yml
new file mode 100644
index 0000000..b00a4b9
--- /dev/null
+++ b/prometheus/alertmanager/init.yml
@@ -0,0 +1,4 @@
+parameters:
+  _param:
+    prometheus_alertmanager_config_directory: /srv/alertmanager
+    prometheus_alertmanager_data_directory: /data
diff --git a/prometheus/server/init.yml b/prometheus/server/init.yml
new file mode 100644
index 0000000..0ecea17
--- /dev/null
+++ b/prometheus/server/init.yml
@@ -0,0 +1,4 @@
+parameters:
+  _param:
+    prometheus_server_config_directory: /srv/prometheus
+    prometheus_server_data_directory: /data
diff --git a/prometheus/server/target/dns.yml b/prometheus/server/target/dns.yml
index 14d5da3..7bbf92e 100644
--- a/prometheus/server/target/dns.yml
+++ b/prometheus/server/target/dns.yml
@@ -1,7 +1,3 @@
-classes:
-- service.prometheus.server.container
-- service.prometheus.alertmanager.container
-- service.prometheus.pushgateway.container
 parameters:
   prometheus:
     server:
diff --git a/prometheus/server/target/etcd.yml b/prometheus/server/target/etcd.yml
index 4cd04bf..0ac3310 100644
--- a/prometheus/server/target/etcd.yml
+++ b/prometheus/server/target/etcd.yml
@@ -8,6 +8,6 @@
             scheme: https
             tls_config:
               skip_verify: true
-              ssl_dir: /opt/prometheus/config
+              ssl_dir: ${_param:prometheus_server_config_directory}
               cert_name: prometheus-server.crt
               key_name: prometheus-server.key
diff --git a/prometheus/server/target/kubernetes.yml b/prometheus/server/target/kubernetes.yml
index d7ba3d6..60ca1e0 100644
--- a/prometheus/server/target/kubernetes.yml
+++ b/prometheus/server/target/kubernetes.yml
@@ -5,6 +5,6 @@
         kubernetes:
           enabled: true
           api_ip: ${_param:kubernetes_control_address}
-          ssl_dir: /opt/prometheus/config
+          ssl_dir: ${_param:prometheus_server_config_directory}
           cert_name: prometheus-server.crt
           key_name: prometheus-server.key
diff --git a/salt/minion/cert/prometheus_server.yml b/salt/minion/cert/prometheus_server.yml
index 23c4abf..30a0711 100644
--- a/salt/minion/cert/prometheus_server.yml
+++ b/salt/minion/cert/prometheus_server.yml
@@ -5,8 +5,8 @@
         prometheus_server:
           host: ${_param:salt_minion_ca_host}
           authority: ${_param:salt_minion_ca_authority}
-          key_file: /srv/volumes/prometheus/prometheus-server.key
-          cert_file: /srv/volumes/prometheus/prometheus-server.crt
+          key_file: ${prometheus:server:dir:config}/prometheus-server.key
+          cert_file: ${prometheus:server:dir:config}/prometheus-server.crt
           common_name: prometheus-server
           signing_policy: cert_client
           alternative_names: IP:${_param:cluster_vip_address},IP:${_param:cluster_node01_address},IP:${_param:cluster_node02_address},IP:${_param:cluster_node03_address},IP:${_param:kubernetes_internal_api_address}