diff --git a/defaults/docker_images.yml b/defaults/docker_images.yml
index ad876e2..bd82083 100644
--- a/defaults/docker_images.yml
+++ b/defaults/docker_images.yml
@@ -25,7 +25,7 @@
     docker_image_operations_api: "${_param:mcp_docker_registry}/mirantis/model-generator/operations-api:2019.2.6"
     docker_image_operations_ui: "${_param:mcp_docker_registry}/mirantis/model-generator/operations-ui:2019.2.6"
     # OpenContrail
-    opencontrail_docker_image_tag: "2019.2.11"
+    opencontrail_docker_image_tag: "2019.2.12"
     # stacklight
     # locally forked v7.4.4, updated 2020-08-06
     docker_image_alerta: "${_param:mcp_docker_registry}/openstack-docker/alerta:2019.2.11"
@@ -37,7 +37,7 @@
     docker_image_prometheus_gainsight_elasticsearch: "${_param:mcp_docker_registry}/openstack-docker/gainsight_elasticsearch:2019.2.6"
     docker_image_prometheus_relay: "${_param:mcp_docker_registry}/openstack-docker/prometheus-relay:2019.2.11"
     docker_image_pushgateway: "${_param:mcp_docker_registry}/openstack-docker/pushgateway:2019.2.6"
-    docker_image_remote_agent: "${_param:mcp_docker_registry}/openstack-docker/telegraf:2019.2.11"
+    docker_image_remote_agent: "${_param:mcp_docker_registry}/openstack-docker/telegraf:2019.2.12"
     docker_image_remote_collector: "${_param:mcp_docker_registry}/openstack-docker/heka:2019.2.6"
     docker_image_remote_storage_adapter: "${_param:mcp_docker_registry}/openstack-docker/remote_storage_adapter:2019.2.6"
     docker_image_sf_notifier: "${_param:mcp_docker_registry}/openstack-docker/sf_notifier:2019.2.4"
@@ -47,7 +47,7 @@
     docker_image_keycloak_server: "${_param:mcp_docker_registry}/mirantis/external/jboss/keycloak:4.5.0.Final"
     docker_image_keycloak_proxy: "${_param:mcp_docker_registry}/mirantis/external/jboss/keycloak:3.4.2.Final"
     # CVP
-    docker_image_cvp_sanity_checks: "${_param:mcp_docker_registry}/mirantis/cvp/cvp-sanity-checks:2019.2.11"
+    docker_image_cvp_sanity_checks: "${_param:mcp_docker_registry}/mirantis/cvp/cvp-sanity-checks:2019.2.12"
     docker_image_cvp_tempest: "${_param:mcp_docker_registry}/mirantis/cicd/ci-tempest:${_param:openstack_version}"
     docker_image_cvp_shaker_checks: "${_param:mcp_docker_registry}/mirantis/cvp/cvp-shaker:2019.2.3"
     docker_image_cvp_rally: "${_param:mcp_docker_registry}/mirantis/cvp/cvp-rally:2019.2.5"
@@ -133,7 +133,7 @@
           name: sf-reporter:2019.2.9
         - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
-          name: telegraf:2019.2.11
+          name: telegraf:2019.2.12
         - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
           name: remote_storage_adapter:2019.2.6
@@ -182,7 +182,7 @@
           name: cvp-shaker:2019.2.3
         - registry: ${_param:mcp_docker_registry}/mirantis/cvp
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/cvp
-          name: cvp-sanity-checks:2019.2.11
+          name: cvp-sanity-checks:2019.2.12
         - registry: ${_param:mcp_docker_registry}/mirantis/external/xrally
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/external/xrally
           name: xrally-openstack:0.11.2
diff --git a/docker/swarm/stack/monitoring/alerta.yml b/docker/swarm/stack/monitoring/alerta.yml
index ac16a2b..bec608c 100644
--- a/docker/swarm/stack/monitoring/alerta.yml
+++ b/docker/swarm/stack/monitoring/alerta.yml
@@ -27,8 +27,10 @@
                 - ${prometheus:alerta:config_dir}/alerta.conf:/web/config.js
                 - ${prometheus:alerta:config_dir}/alertad.conf:/app/alertad.conf
               environment:
+                ADMIN_KEY: ${_param:alerta_admin_key}
                 ADMIN_USERS: ${_param:alerta_admin_username}
                 ADMIN_PASSWORD_FILE: "/run/secrets/alerta"
+                AUTH_REQUIRED: "True"
                 MONGO_URI: ${_param:alerta_mongodb_uri}
                 PLUGINS: ""
               secrets:
diff --git a/fluentd/label/notifications/input_rabbitmq.yml b/fluentd/label/notifications/input_rabbitmq.yml
index 7f97648..6f846ac 100644
--- a/fluentd/label/notifications/input_rabbitmq.yml
+++ b/fluentd/label/notifications/input_rabbitmq.yml
@@ -83,7 +83,7 @@
                 enable_ruby: true
                 record:
                   - name: notification_type
-                    value: '${fluentd:dollar}{ record["payload"]["eventType"] && record["payload"]["eventTime"] ? "audit" : "notification" }'
+                    value: '${fluentd:dollar}{ record["payload"].key?("eventType") && record["payload"].key?("eventTime") ? "audit" : "notification" }'
             match:
               rewrite_message_tag:
                 tag: raw_notifications
diff --git a/galera/server/cluster.yml b/galera/server/cluster.yml
index a4b3f0a..2dd5962 100644
--- a/galera/server/cluster.yml
+++ b/galera/server/cluster.yml
@@ -3,3 +3,4 @@
 - system.haproxy.proxy.listen.openstack.galera
 - system.keepalived.cluster.instance.galera_vip
 - system.galera.upgrade
+- system.galera.server.clustercheck
diff --git a/glance/client/image/octavia.yml b/glance/client/image/octavia.yml
index 2a00375..c09af34 100644
--- a/glance/client/image/octavia.yml
+++ b/glance/client/image/octavia.yml
@@ -25,3 +25,7 @@
           glanceng.get_image_owner_id:
             - ${_param:amphora_image_name}
             - 'admin_identity'
+          octavia_amphora_image:
+            mine_function: glancev2.image_get_details
+            name: ${_param:amphora_image_name}
+            cloud_name: 'admin_identity'
diff --git a/haproxy/proxy/listen/openstack/galera/init.yml b/haproxy/proxy/listen/openstack/galera/init.yml
index 1dd1a1c..9f210d4 100644
--- a/haproxy/proxy/listen/openstack/galera/init.yml
+++ b/haproxy/proxy/listen/openstack/galera/init.yml
@@ -1,6 +1,6 @@
 parameters:
   _param:
-    haproxy_params_check: 'check'
+    haproxy_params_check: 'check port 9200'
   haproxy:
     proxy:
       listen:
@@ -15,12 +15,16 @@
           - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 3306
-            params: ${_param:haproxy_params_check} inter 20s fastinter 2s downinter 2s rise 3 fall 3
+            params: ${_param:haproxy_params_check} inter 20s fastinter 2s downinter 2s rise 3 fall 3 on-marked-down shutdown-sessions
           - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 3306
-            params: backup ${_param:haproxy_params_check} inter 20s fastinter 2s downinter 2s rise 3 fall 3
+            params: backup ${_param:haproxy_params_check} inter 20s fastinter 2s downinter 2s rise 3 fall 3 on-marked-down shutdown-sessions
           - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 3306
-            params: backup ${_param:haproxy_params_check} inter 20s fastinter 2s downinter 2s rise 3 fall 3
+            params: backup ${_param:haproxy_params_check} inter 20s fastinter 2s downinter 2s rise 3 fall 3 on-marked-down shutdown-sessions
+          health-check:
+            mysql:
+              enabled: False
+
diff --git a/horizon/server/iptables.yml b/horizon/server/iptables.yml
index 4836feb..e25fad8 100644
--- a/horizon/server/iptables.yml
+++ b/horizon/server/iptables.yml
@@ -36,7 +36,7 @@
                   action: REJECT
                 501:
                   # 501-503 disable private networks
-                  rule: --dst 10.0.0.0/16
+                  rule: --dst 10.0.0.0/8
                   action: REJECT
                 502:
                   rule: --dst 172.16.0.0/12
diff --git a/jenkins/client/job/deploy/backupninja_backup.yml b/jenkins/client/job/deploy/backupninja_backup.yml
index 1089cfa..5473c1f 100644
--- a/jenkins/client/job/deploy/backupninja_backup.yml
+++ b/jenkins/client/job/deploy/backupninja_backup.yml
@@ -32,6 +32,9 @@
             BACKUP_DOGTAG:
               type: boolean
               default: 'true'
+            BACKUP_KEYSTONE_CREDENTIAL_KEYS:
+              type: boolean
+              default: 'true'
           trigger:
             timer:
               enabled: false
diff --git a/jenkins/client/job/deploy/backupninja_restore.yml b/jenkins/client/job/deploy/backupninja_restore.yml
index 76a594e..14c28ac 100644
--- a/jenkins/client/job/deploy/backupninja_restore.yml
+++ b/jenkins/client/job/deploy/backupninja_restore.yml
@@ -30,3 +30,6 @@
             RESTORE_DOGTAG:
               type: boolean
               default: 'true'
+            RESTORE_KEYSTONE_CREDENTIAL_KEYS:
+              type: boolean
+              default: 'true'
diff --git a/jenkins/client/job/deploy/cleanup.yml b/jenkins/client/job/deploy/cleanup.yml
new file mode 100644
index 0000000..1d0a2b6
--- /dev/null
+++ b/jenkins/client/job/deploy/cleanup.yml
@@ -0,0 +1,25 @@
+parameters:
+  jenkins:
+    client:
+      job:
+        openstack_database_cleanup:
+          type: workflow-scm
+          name: openstack-database-cleanup
+          display_name: "Deploy - Openstack Database Cleanup"
+          discard:
+            build:
+              keep_num: 50
+          concurrent: true
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
+            credentials: ${_param:jenkins_gerrit_credentials}
+            script: openstack-database-cleanup.groovy
+          param:
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+            SALT_MASTER_URL:
+              type: string
+              default: "${_param:jenkins_salt_api_url}"
diff --git a/jenkins/client/job/deploy/update/init.yml b/jenkins/client/job/deploy/update/init.yml
index 7abffec..c0dc152 100644
--- a/jenkins/client/job/deploy/update/init.yml
+++ b/jenkins/client/job/deploy/update/init.yml
@@ -26,3 +26,4 @@
   - system.jenkins.client.job.deploy.update.update_glusterfs_servers
   - system.jenkins.client.job.deploy.update.update_glusterfs_clients
   - system.jenkins.client.job.deploy.update.update_glusterfs_cluster_op_version
+  - system.jenkins.client.job.deploy.cleanup
diff --git a/keystone/server/fernet_rotation/cluster.yml b/keystone/server/fernet_rotation/cluster.yml
index cf7b328..4db82cc 100644
--- a/keystone/server/fernet_rotation/cluster.yml
+++ b/keystone/server/fernet_rotation/cluster.yml
@@ -1,9 +1,17 @@
+classes:
+- system.backupninja.client.single
+- system.openssh.client.root
 parameters:
   _param:
     fernet_rotation_driver: 'rsync'
     credential_rotation_driver: 'rsync'
+    openstack_control_node01_hostname: ctl01
   keystone:
     server:
+      initial_data:
+        home_dir: /srv/volumes/backup/backupninja
+        host: ${_param:openstack_control_node01_hostname}.${_param:cluster_domain}
+        source: ${_param:infra_kvm_node03_address}
       tokens:
         fernet_sync_nodes_list:
           sync_node01:
@@ -44,3 +52,10 @@
           user: keystone
           hour: 0
           minute: 0
+  backupninja:
+    client:
+      target:
+        home_dir: /srv/volumes/backup/backupninja
+        engine: rsync
+        engine_opts: "-av --delete --recursive --safe-links"
+        host: ${_param:infra_kvm_node03_address}
diff --git a/keystone/server/fernet_rotation/single.yml b/keystone/server/fernet_rotation/single.yml
index 7514086..4bd09e9 100644
--- a/keystone/server/fernet_rotation/single.yml
+++ b/keystone/server/fernet_rotation/single.yml
@@ -1,9 +1,17 @@
+classes:
+- system.backupninja.client.single
+- system.openssh.client.root
 parameters:
   _param:
+    openstack_control_node01_hostname: ctl01
     fernet_rotation_driver: 'rsync'
     credential_rotation_driver: 'rsync'
   keystone:
     server:
+      initial_data:
+        home_dir: /srv/volumes/backup/backupninja
+        host: ${_param:openstack_control_node01_hostname}.${_param:cluster_domain}
+        source: ${_param:infra_kvm_node03_address}
       tokens:
         fernet_rotation_driver: ${_param:fernet_rotation_driver}
       credential:
@@ -30,3 +38,10 @@
           user: keystone
           hour: 0
           minute: 0
+  backupninja:
+    client:
+      target:
+        home_dir: /srv/volumes/backup/backupninja
+        engine: rsync
+        engine_opts: "-av --delete --recursive --safe-links"
+        host: ${_param:infra_kvm_node03_address}
diff --git a/openssh/server/team/members/srudyka.yml b/openssh/server/team/members/srudyka.yml
new file mode 100644
index 0000000..0321ea4
--- /dev/null
+++ b/openssh/server/team/members/srudyka.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        srudyka:
+          email: srudyka@mirantis.com
+          enabled: true
+          full_name: Sergii Rudyka
+          home: /home/srudyka
+          name: srudyka
+          email: srudyka@mirantis.com
+          sudo: ${_param:linux_system_user_sudo}
+  openssh:
+    server:
+      user:
+        srudyka:
+          enabled: true
+          public_keys:
+          - key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGps6KXDEuWoTRAMkCPQI/sDaLcPwnq0fDgKSTjqBd1N 
+          user: ${linux:system:user:srudyka}
diff --git a/openssh/server/team/members/vdrok.yml b/openssh/server/team/members/vdrok.yml
index 6f6cbba..3c2485b 100644
--- a/openssh/server/team/members/vdrok.yml
+++ b/openssh/server/team/members/vdrok.yml
@@ -16,4 +16,5 @@
           enabled: true
           public_keys:
           - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCpnn6IyistbIGnzeV3DOWR+u/QLl1cuQspwuvcl1FxeZljkdIgLXcNVzFaFHSX+rOgrOLpcFf3X+dwnB55EoUDj85IOwKz1tVoD5Df42xZMnmjnvOaAScVTStrdcWxzpB6bWt/+GWpt1br3pLpTjqZxa1YipT7tz6bs7cNKplvQuBaoYeG/x9ycRhLIhYXFYOtHD/lxwTRqHnvpwdNKRYPtfakR/kaeZEaYQoJlVcAq0AKzws8l87InoWnjGo/NrBJTvgiLQPYw6uJ9mf17p2GVv1JGCbEpPKnRLyIitdwCFjYEwAKoSsisf2TdH9iY1DWwJEuPzsvjM2ZCPcc7baV vlad@carbon
+          - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDULwqMj/zuO7sETzoX/t5vZ+lkiwTcu9hDikoA3g7iHD6iycbFuiq+n6tmSmEZGgxUEn/rxmq1BblsIHKhk3WN72eJeh95AELJQhErqFNFH8JqwN6oQVRQXWVdJnrmfffGNrHTiR/jyhCx7TEYcMbfhr4maGNwVS7CPXjKGjCe5AeHQf+esBTFekFCCX3Mh1W/ddzfF3K8ud+6pxjC0XxvebaldGNkf5tPTZIiiQZbe250k4OPknicQ3gmjyAEQM4vSEUp81hOuDbqFWET0XZqX4VjWnV5ZqxDktD9jx/vMtt8MHXirMiylt1NmyDw5dpcBmevIksSurpaSG2CYTZWzTnAaPsddxhL0Dx3ld36MbIaeCMeeEbLBus5xhdUmxgsdkcscAxsDTTpO74EmZ6MSXbHFp106mXsQca7wIuTLT4GCcODSTRxPD065c8CogbI1eSNyUmgINXc/wv24r1Q+bpvmWoojCv6IqkoYAsr+U8OMZ5Mq9aERn/9kX508c0= vdrok@Vladyslavs-MacBook-Pro.local
           user: ${linux:system:user:vdrok}
diff --git a/openssh/server/team/services.yml b/openssh/server/team/services.yml
index 1cd16bc..3a2a2d3 100644
--- a/openssh/server/team/services.yml
+++ b/openssh/server/team/services.yml
@@ -19,6 +19,7 @@
 - system.openssh.server.team.members.vkuspits
 - system.openssh.server.team.members.yisakov
 - system.openssh.server.team.members.wnawrot
+- system.openssh.server.team.members.srudyka
 parameters:
   _param:
     linux_system_user_sudo: true
diff --git a/prometheus/alerta/init.yml b/prometheus/alerta/init.yml
index 6e16b63..2e82f44 100644
--- a/prometheus/alerta/init.yml
+++ b/prometheus/alerta/init.yml
@@ -1,5 +1,5 @@
 classes:
-  - service.prometheus.alerta
+- service.prometheus.alerta
 parameters:
   prometheus:
     alerta:
diff --git a/prometheus/alertmanager/notification/alerta.yml b/prometheus/alertmanager/notification/alerta.yml
index 816aaf6..729aa26 100644
--- a/prometheus/alertmanager/notification/alerta.yml
+++ b/prometheus/alertmanager/notification/alerta.yml
@@ -16,5 +16,5 @@
             enabled: true
             webhook_configs:
               alerta:
-                url: "http://${_param:alertmanager_notification_alerta_host}:${_param:alertmanager_notification_alerta_port}/api/webhooks/prometheus"
+                url: "http://${_param:alertmanager_notification_alerta_host}:${_param:alertmanager_notification_alerta_port}/api/webhooks/prometheus?api-key=${_param:alerta_admin_key}"
                 send_resolved: true
diff --git a/prometheus/gainsight/query/openstack.yml b/prometheus/gainsight/query/openstack.yml
index daed58e..838b814 100644
--- a/prometheus/gainsight/query/openstack.yml
+++ b/prometheus/gainsight/query/openstack.yml
@@ -2,15 +2,15 @@
   prometheus:
     gainsight:
       queries:
-        vcpu_used: "'vCPU Used','avg(sum(avg_over_time(openstack_nova_used_vcpus[24h])) by (instance))'"
-        vcpu_free: "'vCPU Free','avg(sum(avg_over_time(openstack_nova_free_vcpus[24h])) by (instance))'"
-        vstorage_used: "'vStorage Used','avg(sum(avg_over_time(openstack_nova_used_disk[24h])) by (instance))'"
-        vstorage_free: "'vStorage Free','avg(sum(avg_over_time(openstack_nova_free_disk[24h])) by (instance))'"
-        vram_used: "'vRAM Used','avg(sum(avg_over_time(openstack_nova_used_ram[24h])) by (instance))'"
-        vram_free: "'vRAM Free','avg(sum(avg_over_time(openstack_nova_free_ram[24h])) by (instance))'"
-        instances: "'Instances','avg(sum(avg_over_time(openstack_nova_instances{state=\"active\"}[24h])) by (instance))'"
-        compute_nodes: "'Compute Nodes','avg(sum(openstack_nova_services{binary=~\"nova.compute\"}) by (instance))'"
-        tenants: "'Tenants','avg(sum(avg_over_time(openstack_keystone_tenants_total[24h])) by (instance))'"
+        vcpu_used: "'vCPU Used','max(sum by (instance) (avg_over_time(openstack_nova_used_vcpus[24h]) and on (hostname) (openstack_nova_service_status == 1 and openstack_nova_service_state == 1)))'"
+        vcpu_free: "'vCPU Free','max(sum by (instance) (avg_over_time(openstack_nova_free_vcpus[24h]) and on (hostname) (openstack_nova_service_status == 1 and openstack_nova_service_state == 1)))'"
+        vstorage_used: "'vStorage Used','max(sum by (instance) (avg_over_time(openstack_nova_used_disk[24h]) and on (hostname) (openstack_nova_service_status == 1 and openstack_nova_service_state == 1)))'"
+        vstorage_free: "'vStorage Free','max(sum by (instance) (avg_over_time(openstack_nova_free_disk[24h]) and on (hostname) (openstack_nova_service_status == 1 and openstack_nova_service_state == 1)))'"
+        vram_used: "'vRAM Used','max(sum by (instance) (avg_over_time(openstack_nova_used_ram[24h]) and on (hostname) (openstack_nova_service_status == 1 and openstack_nova_service_state == 1)))'"
+        vram_free: "'vRAM Free','max(sum by (instance) (avg_over_time(openstack_nova_free_ram[24h]) and on (hostname) (openstack_nova_service_status == 1 and openstack_nova_service_state == 1)))'"
+        instances: "'Instances','ceil(max(avg_over_time(openstack_nova_instances{state=\"active\"}[24h])))'"
+        compute_nodes: "'Compute Nodes','max(sum by (instance) (openstack_nova_services{binary=~\"nova.compute\"}))'"
+        tenants: "'Tenants','ceil(max(avg_over_time(openstack_keystone_tenants_total[24h])))'"
         cinder_api: "'Cinder API','avg_over_time(service_name:openstack_api_check_status:avg5m:for5m:ceil:avg5m:floor{service_name=\"cinderv2\"}[24h]) * 100'"
         nova_api: "'Nova API','avg_over_time(service_name:openstack_api_check_status:avg5m:for5m:ceil:avg5m:floor{service_name=\"nova\"}[24h]) * 100'"
         keystone_api: "'Keystone API','avg_over_time(service_name:openstack_api_check_status:avg5m:for5m:ceil:avg5m:floor{service_name=\"keystone\"}[24h]) * 100'"