diff --git a/apache/server/proxy/init.yml b/apache/server/proxy/init.yml
new file mode 100644
index 0000000..06921f8
--- /dev/null
+++ b/apache/server/proxy/init.yml
@@ -0,0 +1,7 @@
+parameters:
+  apache:
+    server:
+      modules:
+        - proxy
+        - proxy_http
+        - headers
diff --git a/apache/server/site/manila.yml b/apache/server/site/manila.yml
index cecf1d4..3080d1d 100644
--- a/apache/server/site/manila.yml
+++ b/apache/server/site/manila.yml
@@ -12,6 +12,8 @@
     server:
       enabled: true
       default_mpm: event
+      modules:
+        - wsgi
       site:
         manila:
           enabled: false
diff --git a/barbican/server/cluster.yml b/barbican/server/cluster.yml
index 972c05d..aac0400 100644
--- a/barbican/server/cluster.yml
+++ b/barbican/server/cluster.yml
@@ -1,9 +1,12 @@
 classes:
 - service.barbican.server.cluster
 - system.haproxy.proxy.listen.openstack.barbican
+- system.salt.minion.cert.mysql.clients.openstack.barbican
 parameters:
   _param:
     cluster_internal_protocol: 'http'
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   barbican:
     server:
       role: ${_param:openstack_node_role}
@@ -11,6 +14,13 @@
         protocol: ${_param:cluster_internal_protocol}
       database:
         host: ${_param:openstack_database_address}
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_barbican_ssl_ca_file}
+          key_file: ${_param:mysql_barbican_client_ssl_key_file}
+          cert_file: ${_param:mysql_barbican_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
   linux:
     system:
       package:
diff --git a/barbican/server/single.yml b/barbican/server/single.yml
index 207957f..6bed260 100644
--- a/barbican/server/single.yml
+++ b/barbican/server/single.yml
@@ -1,10 +1,21 @@
 classes:
 - service.barbican.server.single
+- system.salt.minion.cert.mysql.clients.openstack.barbican
 parameters:
   _param:
     internal_protocol: 'http'
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   barbican:
     server:
+      database:
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_barbican_ssl_ca_file}
+          key_file: ${_param:mysql_barbican_client_ssl_key_file}
+          cert_file: ${_param:mysql_barbican_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
       role: ${_param:openstack_node_role}
       identity:
         protocol: ${_param:internal_protocol}
diff --git a/cinder/control/cluster.yml b/cinder/control/cluster.yml
index 5bc5c75..503537e 100644
--- a/cinder/control/cluster.yml
+++ b/cinder/control/cluster.yml
@@ -4,11 +4,14 @@
 - service.keepalived.cluster.single
 - system.haproxy.proxy.listen.openstack.cinder
 - system.salt.minion.cert.mysql.clients.openstack.cinder
+- system.salt.minion.cert.rabbitmq.clients.openstack.cinder
 parameters:
   _param:
     cluster_internal_protocol: 'http'
     openstack_mysql_x509_enabled: False
     galera_ssl_enabled: False
+    openstack_rabbitmq_x509_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -67,6 +70,13 @@
         user: openstack
         password: ${_param:rabbitmq_openstack_password}
         virtual_host: '/openstack'
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_cinder_ssl_ca_file}
+          key_file: ${_param:rabbitmq_cinder_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_cinder_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
       cache:
         engine: memcached
         members:
diff --git a/cinder/control/single.yml b/cinder/control/single.yml
index f38cfb4..ce01579 100644
--- a/cinder/control/single.yml
+++ b/cinder/control/single.yml
@@ -1,11 +1,14 @@
 classes:
 - service.cinder.control.single
 - system.salt.minion.cert.mysql.clients.openstack.cinder
+- system.salt.minion.cert.rabbitmq.clients.openstack.cinder
 parameters:
   _param:
     internal_protocol: 'http'
     openstack_mysql_x509_enabled: False
     galera_ssl_enabled: False
+    openstack_rabbitmq_x509_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -31,4 +34,12 @@
       identity:
         protocol: ${_param:internal_protocol}
         region: ${_param:openstack_region}
+      message_queue:
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_cinder_ssl_ca_file}
+          key_file: ${_param:rabbitmq_cinder_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_cinder_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
 
diff --git a/cinder/volume/local.yml b/cinder/volume/local.yml
index 51c3ba8..d1634d0 100644
--- a/cinder/volume/local.yml
+++ b/cinder/volume/local.yml
@@ -1,10 +1,13 @@
 classes:
 - service.cinder.volume.local
 - system.salt.minion.cert.mysql.clients.openstack.cinder
+- system.salt.minion.cert.rabbitmq.clients.openstack.cinder
 parameters:
   _param:
     openstack_mysql_x509_enabled: False
     galera_ssl_enabled: False
+    openstack_rabbitmq_x509_enabled: False
+    rabbitmq_ssl_enabled: False
   cinder:
     volume:
       enabled: True
@@ -21,6 +24,13 @@
         host: ${_param:single_address}
       message_queue:
         host: ${_param:single_address}
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_cinder_ssl_ca_file}
+          key_file: ${_param:rabbitmq_cinder_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_cinder_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
       identity:
         host: ${_param:single_address}
         region: ${_param:openstack_region}
diff --git a/cinder/volume/single.yml b/cinder/volume/single.yml
index f6d4503..637e45a 100644
--- a/cinder/volume/single.yml
+++ b/cinder/volume/single.yml
@@ -1,11 +1,14 @@
 classes:
 - service.cinder.volume.single
 - system.salt.minion.cert.mysql.clients.openstack.cinder
+- system.salt.minion.cert.rabbitmq.clients.openstack.cinder
 parameters:
   _param:
     cluster_internal_protocol: 'http'
     openstack_mysql_x509_enabled: False
     galera_ssl_enabled: False
+    openstack_rabbitmq_x509_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -32,6 +35,13 @@
           - host: ${_param:openstack_message_queue_node01_address}
           - host: ${_param:openstack_message_queue_node02_address}
           - host: ${_param:openstack_message_queue_node03_address}
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_cinder_ssl_ca_file}
+          key_file: ${_param:rabbitmq_cinder_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_cinder_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
       identity:
         host: ${_param:openstack_control_address}
         protocol: ${_param:cluster_internal_protocol}
diff --git a/designate/server/cluster/default.yml b/designate/server/cluster/default.yml
index de2eb43..112d953 100644
--- a/designate/server/cluster/default.yml
+++ b/designate/server/cluster/default.yml
@@ -3,10 +3,13 @@
 - service.haproxy.proxy.single
 - system.haproxy.proxy.listen.openstack.designate
 - service.designate.server.cluster
+- system.salt.minion.cert.mysql.clients.openstack.designate
 parameters:
   _param:
     designate_admin_api_enabled: false
     cluster_internal_protocol: 'http'
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   linux:
     system:
       package:
@@ -36,6 +39,13 @@
           pool_manager: designate_pool_manager
         user: designate
         password: ${_param:mysql_designate_password}
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_designate_ssl_ca_file}
+          key_file: ${_param:mysql_designate_client_ssl_key_file}
+          cert_file: ${_param:mysql_designate_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
       identity:
         engine: keystone
         host: ${_param:openstack_control_address}
@@ -56,4 +66,4 @@
         - host: ${_param:openstack_message_queue_node03_address}
         user: openstack
         password: ${_param:rabbitmq_openstack_password}
-        virtual_host: '/openstack'
\ No newline at end of file
+        virtual_host: '/openstack'
diff --git a/galera/server/database/manila.yml b/galera/server/database/manila.yml
index 3339b83..d233ce9 100644
--- a/galera/server/database/manila.yml
+++ b/galera/server/database/manila.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_manila_ssl_option: []
   mysql:
     server:
       database:
@@ -9,7 +11,9 @@
             password: ${_param:mysql_manila_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_manila_ssl_option}
           - name: manila
             password: ${_param:mysql_manila_password}
             host: ${_param:cluster_local_address}
             rights: all
+            ssl_option: ${_param:mysql_manila_ssl_option}
diff --git a/galera/server/database/ssl/barbican.yml b/galera/server/database/ssl/barbican.yml
new file mode 100644
index 0000000..1b1c7c1
--- /dev/null
+++ b/galera/server/database/ssl/barbican.yml
@@ -0,0 +1,4 @@
+parameters:
+  _param:
+    mysql_barbican_ssl_option:
+      - SSL: True
\ No newline at end of file
diff --git a/galera/server/database/ssl/gnocchi.yml b/galera/server/database/ssl/gnocchi.yml
new file mode 100644
index 0000000..c1bb459
--- /dev/null
+++ b/galera/server/database/ssl/gnocchi.yml
@@ -0,0 +1,4 @@
+parameters:
+  _param:
+    mysql_gnocchi_ssl_option:
+      - SSL: True
\ No newline at end of file
diff --git a/galera/server/database/ssl/ironic.yaml b/galera/server/database/ssl/ironic.yaml
new file mode 100644
index 0000000..eeb9dbb
--- /dev/null
+++ b/galera/server/database/ssl/ironic.yaml
@@ -0,0 +1,4 @@
+parameters:
+  _param:
+    mysql_ironic_ssl_option:
+      - SSL: True
\ No newline at end of file
diff --git a/galera/server/database/ssl/manila.yml b/galera/server/database/ssl/manila.yml
new file mode 100644
index 0000000..c3b30dd
--- /dev/null
+++ b/galera/server/database/ssl/manila.yml
@@ -0,0 +1,4 @@
+parameters:
+  _param:
+    mysql_manila_ssl_option:
+      - SSL: True
\ No newline at end of file
diff --git a/galera/server/database/ssl/panko.yml b/galera/server/database/ssl/panko.yml
new file mode 100644
index 0000000..ce1c504
--- /dev/null
+++ b/galera/server/database/ssl/panko.yml
@@ -0,0 +1,4 @@
+parameters:
+  _param:
+    mysql_panko_ssl_option:
+      - SSL: True
\ No newline at end of file
diff --git a/galera/server/database/x509/barbican.yml b/galera/server/database/x509/barbican.yml
new file mode 100644
index 0000000..ae1865f
--- /dev/null
+++ b/galera/server/database/x509/barbican.yml
@@ -0,0 +1,7 @@
+parameters:
+  _param:
+    mysql_barbican_client_ssl_x509_subject: '/C=cz/CN=mysql-barbican-client/L=Prague/O=Mirantis'
+    mysql_barbican_client_ssl_x509_issuer: '/C=cz/CN=Salt Master CA/L=Prague/O=Mirantis'
+    mysql_barbican_ssl_option:
+      - SUBJECT: ${_param:mysql_barbican_client_ssl_x509_subject}
+      - ISSUER: ${_param:mysql_barbican_client_ssl_x509_issuer}
\ No newline at end of file
diff --git a/galera/server/database/x509/gnocchi.yml b/galera/server/database/x509/gnocchi.yml
new file mode 100644
index 0000000..5cb3c58
--- /dev/null
+++ b/galera/server/database/x509/gnocchi.yml
@@ -0,0 +1,7 @@
+parameters:
+  _param:
+    mysql_gnocchi_client_ssl_x509_subject: '/C=cz/CN=mysql-gnocchi-client/L=Prague/O=Mirantis'
+    mysql_gnocchi_client_ssl_x509_issuer: '/C=cz/CN=Salt Master CA/L=Prague/O=Mirantis'
+    mysql_gnocchi_ssl_option:
+      - SUBJECT: ${_param:mysql_gnocchi_client_ssl_x509_subject}
+      - ISSUER: ${_param:mysql_gnocchi_client_ssl_x509_issuer}
\ No newline at end of file
diff --git a/galera/server/database/x509/ironic.yml b/galera/server/database/x509/ironic.yml
new file mode 100644
index 0000000..85082f5
--- /dev/null
+++ b/galera/server/database/x509/ironic.yml
@@ -0,0 +1,7 @@
+parameters:
+  _param:
+    mysql_ironic_client_ssl_x509_subject: '/C=cz/CN=mysql-ironic-client/L=Prague/O=Mirantis'
+    mysql_ironic_client_ssl_x509_issuer: '/C=cz/CN=Salt Master CA/L=Prague/O=Mirantis'
+    mysql_ironic_ssl_option:
+      - SUBJECT: ${_param:mysql_ironic_client_ssl_x509_subject}
+      - ISSUER: ${_param:mysql_ironic_client_ssl_x509_issuer}
\ No newline at end of file
diff --git a/galera/server/database/x509/manila.yml b/galera/server/database/x509/manila.yml
new file mode 100644
index 0000000..15e6c88
--- /dev/null
+++ b/galera/server/database/x509/manila.yml
@@ -0,0 +1,7 @@
+parameters:
+  _param:
+    mysql_manila_client_ssl_x509_subject: '/C=cz/CN=mysql-manila-client/L=Prague/O=Mirantis'
+    mysql_manila_client_ssl_x509_issuer: '/C=cz/CN=Salt Master CA/L=Prague/O=Mirantis'
+    mysql_manila_ssl_option:
+      - SUBJECT: ${_param:mysql_manila_client_ssl_x509_subject}
+      - ISSUER: ${_param:mysql_manila_client_ssl_x509_issuer}
\ No newline at end of file
diff --git a/galera/server/database/x509/panko.yml b/galera/server/database/x509/panko.yml
new file mode 100644
index 0000000..15c37bf
--- /dev/null
+++ b/galera/server/database/x509/panko.yml
@@ -0,0 +1,7 @@
+parameters:
+  _param:
+    mysql_panko_client_ssl_x509_subject: '/C=cz/CN=mysql-panko-client/L=Prague/O=Mirantis'
+    mysql_panko_client_ssl_x509_issuer: '/C=cz/CN=Salt Master CA/L=Prague/O=Mirantis'
+    mysql_panko_ssl_option:
+      - SUBJECT: ${_param:mysql_panko_client_ssl_x509_subject}
+      - ISSUER: ${_param:mysql_panko_client_ssl_x509_issuer}
\ No newline at end of file
diff --git a/glance/control/cluster.yml b/glance/control/cluster.yml
index a9181de..4f0992d 100644
--- a/glance/control/cluster.yml
+++ b/glance/control/cluster.yml
@@ -4,10 +4,13 @@
 - service.haproxy.proxy.single
 - system.haproxy.proxy.listen.openstack.glance
 - system.salt.minion.cert.mysql.clients.openstack.glance
+- system.salt.minion.cert.rabbitmq.clients.openstack.glance
 parameters:
   _param:
     openstack_mysql_x509_enabled: False
     galera_ssl_enabled: False
+    openstack_rabbitmq_x509_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       cron:
@@ -62,6 +65,13 @@
           - host: ${_param:openstack_message_queue_node01_address}
           - host: ${_param:openstack_message_queue_node02_address}
           - host: ${_param:openstack_message_queue_node03_address}
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_glance_ssl_ca_file}
+          key_file: ${_param:rabbitmq_glance_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_glance_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
       storage:
         engine: file
       images: []
diff --git a/glance/control/single.yml b/glance/control/single.yml
index a036077..c233120 100644
--- a/glance/control/single.yml
+++ b/glance/control/single.yml
@@ -1,10 +1,13 @@
 classes:
 - service.glance.control.single
 - system.salt.minion.cert.mysql.clients.openstack.glance
+- system.salt.minion.cert.rabbitmq.clients.openstack.glance
 parameters:
   _param:
     openstack_mysql_x509_enabled: False
     galera_ssl_enabled: False
+    openstack_rabbitmq_x509_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       cron:
@@ -30,3 +33,11 @@
       identity:
         region: ${_param:openstack_region}
       show_multiple_locations: True
+      message_queue:
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_glance_ssl_ca_file}
+          key_file: ${_param:rabbitmq_glance_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_glance_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
diff --git a/glusterfs/server/cluster.yml b/glusterfs/server/cluster.yml
index 16453c9..f7c520e 100644
--- a/glusterfs/server/cluster.yml
+++ b/glusterfs/server/cluster.yml
@@ -8,6 +8,7 @@
       iptables:
         enabled: false
     server:
+      role: ${_param:glusterfs_node_role}
       peers:
       - ${_param:cluster_node01_address}
       - ${_param:cluster_node02_address}
diff --git a/gnocchi/common/cluster.yml b/gnocchi/common/cluster.yml
new file mode 100644
index 0000000..8d7ae5e
--- /dev/null
+++ b/gnocchi/common/cluster.yml
@@ -0,0 +1,17 @@
+classes:
+- service.gnocchi.common.cluster
+- system.salt.minion.cert.mysql.clients.openstack.gnocchi
+parameters:
+  _param:
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
+  gnocchi:
+    common:
+      database:
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_gnocchi_ssl_ca_file}
+          key_file: ${_param:mysql_gnocchi_client_ssl_key_file}
+          cert_file: ${_param:mysql_gnocchi_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
diff --git a/gnocchi/common/single.yml b/gnocchi/common/single.yml
new file mode 100644
index 0000000..1f68f5c
--- /dev/null
+++ b/gnocchi/common/single.yml
@@ -0,0 +1,17 @@
+classes:
+- service.gnocchi.common.single
+- system.salt.minion.cert.mysql.clients.openstack.gnocchi
+parameters:
+  _param:
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
+  gnocchi:
+    common:
+      database:
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_gnocchi_ssl_ca_file}
+          key_file: ${_param:mysql_gnocchi_client_ssl_key_file}
+          cert_file: ${_param:mysql_gnocchi_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
diff --git a/grafana/client/datasource/gnocchi.yml b/grafana/client/datasource/gnocchi.yml
new file mode 100644
index 0000000..4266fe7
--- /dev/null
+++ b/grafana/client/datasource/gnocchi.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    grafana_gnocchi_is_default: false
+    grafana_gnocchi_ds_name: gnocchi
+    grafana_gnocchi_address: ${_param:gnocchi_public_host}
+    keystone_public_url_path: /identity
+    keystone_gnocchi_user: gnocchi
+    grafana_gnocchi_domain: default
+    grafana_gnocchi_project: service
+  grafana:
+    client:
+      datasource:
+        gnocchi:
+          type: gnocchixyz-gnocchi-datasource
+          name: ${_param:grafana_gnocchi_ds_name}
+          host: ${_param:grafana_gnocchi_address}
+          url_path: ${_param:keystone_public_url_path}
+          mode: keystone
+          domain: ${_param:grafana_gnocchi_domain}
+          project: ${_param:grafana_gnocchi_project}
+          user: ${_param:keystone_gnocchi_user}
+          password: ${_param:keystone_gnocchi_password}
+          is_default: ${_param:grafana_gnocchi_is_default}
diff --git a/grafana/client/datasource/influxdb.yml b/grafana/client/datasource/influxdb.yml
index 7abe22f..7e2a459 100644
--- a/grafana/client/datasource/influxdb.yml
+++ b/grafana/client/datasource/influxdb.yml
@@ -14,4 +14,3 @@
           password: ${_param:grafana_influxdb_password}
           database: ${_param:grafana_influxdb_database}
           is_default: ${_param:grafana_influxdb_is_default}
-
diff --git a/heat/server/cluster.yml b/heat/server/cluster.yml
index 7bbc2ac..4504e89 100644
--- a/heat/server/cluster.yml
+++ b/heat/server/cluster.yml
@@ -4,12 +4,15 @@
 - service.keepalived.cluster.single
 - system.haproxy.proxy.listen.openstack.heat
 - system.salt.minion.cert.mysql.clients.openstack.heat
+- system.salt.minion.cert.rabbitmq.clients.openstack.heat
 parameters:
   _param:
     cluster_public_protocol: 'https'
     cluster_internal_protocol: 'http'
     openstack_mysql_x509_enabled: False
+    openstack_rabbitmq_x509_enabled: False
     galera_ssl_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -77,3 +80,10 @@
           - host: ${_param:openstack_message_queue_node01_address}
           - host: ${_param:openstack_message_queue_node02_address}
           - host: ${_param:openstack_message_queue_node03_address}
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_heat_ssl_ca_file}
+          key_file: ${_param:rabbitmq_heat_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_heat_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
diff --git a/heat/server/single.yml b/heat/server/single.yml
index 208bdf0..9ef10c9 100644
--- a/heat/server/single.yml
+++ b/heat/server/single.yml
@@ -1,10 +1,13 @@
 classes:
 - service.heat.server.single
 - system.salt.minion.cert.mysql.clients.openstack.heat
+- system.salt.minion.cert.rabbitmq.clients.openstack.heat
 parameters:
   _param:
     openstack_mysql_x509_enabled: False
+    openstack_rabbitmq_x509_enabled: False
     galera_ssl_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -32,4 +35,13 @@
           key_file: ${_param:mysql_heat_client_ssl_key_file}
           cert_file: ${_param:mysql_heat_client_ssl_cert_file}
         ssl:
-          enabled: ${_param:galera_ssl_enabled}
\ No newline at end of file
+          enabled: ${_param:galera_ssl_enabled}
+      message_queue:
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_heat_ssl_ca_file}
+          key_file: ${_param:rabbitmq_heat_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_heat_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
+
diff --git a/ironic/api/cluster.yml b/ironic/api/cluster.yml
index b0bb69f..acf635e 100644
--- a/ironic/api/cluster.yml
+++ b/ironic/api/cluster.yml
@@ -1,6 +1,10 @@
 classes:
+- system.salt.minion.cert.mysql.clients.openstack.ironic
 - service.ironic.api.cluster
 parameters:
+  _param:
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   linux:
     system:
       package:
@@ -14,3 +18,11 @@
       role: ${_param:openstack_node_role}
       bind:
         address: ${_param:cluster_baremetal_local_address}
+      database:
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_ironic_ssl_ca_file}
+          key_file: ${_param:mysql_ironic_client_ssl_key_file}
+          cert_file: ${_param:mysql_ironic_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
diff --git a/ironic/api/single.yml b/ironic/api/single.yml
index 51c3f9c..0d4ae09 100644
--- a/ironic/api/single.yml
+++ b/ironic/api/single.yml
@@ -1,6 +1,10 @@
 classes:
+- system.salt.minion.cert.mysql.clients.openstack.ironic
 - service.ironic.api.single
 parameters:
+  _param:
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   linux:
     system:
       package:
@@ -12,3 +16,11 @@
       role: ${_param:openstack_node_role}
       bind:
         address: ${_param:single_address}
+      database:
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_ironic_ssl_ca_file}
+          key_file: ${_param:mysql_ironic_client_ssl_key_file}
+          cert_file: ${_param:mysql_ironic_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
diff --git a/ironic/conductor/cluster.yml b/ironic/conductor/cluster.yml
index 063719c..c97624b 100644
--- a/ironic/conductor/cluster.yml
+++ b/ironic/conductor/cluster.yml
@@ -1,6 +1,10 @@
 classes:
+- system.salt.minion.cert.mysql.clients.openstack.ironic
 - service.ironic.conductor.cluster
 parameters:
+  _param:
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   linux:
     system:
       package:
@@ -10,3 +14,11 @@
   ironic:
     conductor:
       api_url: 'http://${_param:cluster_baremetal_vip_address}:6385'
+      database:
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_ironic_ssl_ca_file}
+          key_file: ${_param:mysql_ironic_client_ssl_key_file}
+          cert_file: ${_param:mysql_ironic_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
diff --git a/ironic/conductor/single.yml b/ironic/conductor/single.yml
index d827129..80215a5 100644
--- a/ironic/conductor/single.yml
+++ b/ironic/conductor/single.yml
@@ -1,6 +1,10 @@
 classes:
+- system.salt.minion.cert.mysql.clients.openstack.ironic
 - service.ironic.conductor.single
 parameters:
+  _param:
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   linux:
     system:
       package:
@@ -11,3 +15,11 @@
     conductor:
       enabled: true
       version: ${_param:ironic_version}
+      database:
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_ironic_ssl_ca_file}
+          key_file: ${_param:mysql_ironic_client_ssl_key_file}
+          cert_file: ${_param:mysql_ironic_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
diff --git a/jenkins/client/job/deploy/lab/deploy.yml b/jenkins/client/job/deploy/lab/deploy.yml
index b1deafa..f5d34f6 100644
--- a/jenkins/client/job/deploy/lab/deploy.yml
+++ b/jenkins/client/job/deploy/lab/deploy.yml
@@ -117,9 +117,6 @@
                 type: string
                 default: ""
                 description: "Formulas revision to install on Salt Master bootstrap stage"
-              EXTRA_FORMULAS:
-                type: string
-                default: ""
               STATIC_MGMT_NETWORK:
                   type: boolean
                   default: 'false'
diff --git a/jenkins/client/job/deploy/update/upgrade.yml b/jenkins/client/job/deploy/update/upgrade.yml
index 01fdf2a..f4f5630 100644
--- a/jenkins/client/job/deploy/update/upgrade.yml
+++ b/jenkins/client/job/deploy/update/upgrade.yml
@@ -29,27 +29,19 @@
             SALT_MASTER_CREDENTIALS:
               type: string
               default: "salt"
-            STAGE_TEST_UPGRADE:
-              type: boolean
-              default: 'true'
-              description: "Test if syncdb and APIs succeed"
-            STAGE_REAL_UPGRADE:
-              type: boolean
-              default: 'true'
-              description: "Run real control upgrade"
-            STAGE_ROLLBACK_UPGRADE:
-              type: boolean
-              default: 'true'
-              description: "Rollback if control upgrade fails"
-            OPERATING_SYSTEM_RELEASE_UPGRADE:
+            OS_DIST_UPGRADE:
               type: boolean
               default: 'false'
-              description: "Set to true if operating system release upgrade is desired. For ex. from Ubuntu 14.04 currently running on ctl and prx nodes to Ubuntu 16.04"
-            SKIP_VM_RELAUNCH:
+              description: "Upgrade system packages including kernel (apt-get dist-upgrade)"
+            OS_UPGRADE:
               type: boolean
               default: 'false'
-              description: "Set to true if vms should not be recreated"
+              description: "Upgrade all installed applications (apt-get upgrade)"
             INTERACTIVE:
               type: boolean
               default: 'true'
               description: "Ask interactive questions during pipeline run (bool)"
+            TARGET_SERVERS:
+              type: string
+              default: 'ctl*'
+              description: "Salt compound expression to get control servers to upgrade."
diff --git a/jenkins/client/job/deploy/update/upgrade_compute.yml b/jenkins/client/job/deploy/update/upgrade_compute.yml
index 706863d..b4628fa 100644
--- a/jenkins/client/job/deploy/update/upgrade_compute.yml
+++ b/jenkins/client/job/deploy/update/upgrade_compute.yml
@@ -21,7 +21,7 @@
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
             branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
-            script: openstack-compute-upgrade.groovy
+            script: openstack-data-upgrade.groovy
           param:
             SALT_MASTER_URL:
               type: string
@@ -29,18 +29,19 @@
             SALT_MASTER_CREDENTIALS:
               type: string
               default: "salt"
-            TARGET_SERVERS:
-              type: string
-              default: "cmp*"
-              description: Salt compound target to match nodes to be updated [*, G@osfamily:debian].
-            TARGET_SUBSET_TEST:
-              type: string
-              description: Number of nodes to list package updates, empty string means all targetted nodes.
-            TARGET_SUBSET_LIVE:
-              type: string
-              default: '1'
-              description: Number of selected nodes to live apply upgrade.
+            OS_DIST_UPGRADE:
+              type: boolean
+              default: 'false'
+              description: "Upgrade system packages including kernel (apt-get dist-upgrade)"
+            OS_UPGRADE:
+              type: boolean
+              default: 'false'
+              description: "Upgrade all installed applications (apt-get upgrade)"
             INTERACTIVE:
               type: boolean
               default: 'true'
               description: "Ask interactive questions during pipeline run (bool)"
+            TARGET_SERVERS:
+              type: string
+              default: 'cmp*'
+              description: "Salt compound expression to get control servers to upgrade."
diff --git a/jenkins/client/job/deploy/update/upgrade_ovs_gateway.yml b/jenkins/client/job/deploy/update/upgrade_ovs_gateway.yml
index b0c92b7..76bf436 100644
--- a/jenkins/client/job/deploy/update/upgrade_ovs_gateway.yml
+++ b/jenkins/client/job/deploy/update/upgrade_ovs_gateway.yml
@@ -21,7 +21,7 @@
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
             branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
-            script: ovs-gateway-upgrade.groovy
+            script: openstack-data-upgrade.groovy
           param:
             SALT_MASTER_URL:
               type: string
@@ -29,18 +29,19 @@
             SALT_MASTER_CREDENTIALS:
               type: string
               default: "salt"
-            TARGET_SERVERS:
-              type: string
-              default: "gtw*"
-              description: Salt compound target to match nodes to be updated [*, G@osfamily:debian].
-            TARGET_SUBSET_TEST:
-              type: string
-              description: Number of nodes to list package updates, empty string means all targetted nodes.
-            TARGET_SUBSET_LIVE:
-              type: string
-              default: '1'
-              description: Number of selected nodes to live apply upgrade.
+            OS_DIST_UPGRADE:
+              type: boolean
+              default: 'false'
+              description: "Upgrade system packages including kernel (apt-get dist-upgrade)"
+            OS_UPGRADE:
+              type: boolean
+              default: 'false'
+              description: "Upgrade all installed applications (apt-get upgrade)"
             INTERACTIVE:
               type: boolean
               default: 'true'
               description: "Ask interactive questions during pipeline run (bool)"
+            TARGET_SERVERS:
+              type: string
+              default: 'gtw*'
+              description: "Salt compound expression to get control servers to upgrade."
diff --git a/jenkins/client/job/git-mirrors/2way.yml b/jenkins/client/job/git-mirrors/2way.yml
index 36e07d4..71d8f9a 100644
--- a/jenkins/client/job/git-mirrors/2way.yml
+++ b/jenkins/client/job/git-mirrors/2way.yml
@@ -24,6 +24,10 @@
               source: mcp/mcp-drivetrain-model
               target: Mirantis/mcp-drivetrain-model
               branches: "master"
+            - name: model-manager
+              source: python-apps/model-manager
+              target: salt-formulas/django-model-manager
+              branches: "master"
           template:
             description: ${_param:job_description_2way}
             discard:
diff --git a/jenkins/client/job/git-mirrors/upstream/pipelines.yml b/jenkins/client/job/git-mirrors/upstream/pipelines.yml
index 20f7eb6..9e82f80 100644
--- a/jenkins/client/job/git-mirrors/upstream/pipelines.yml
+++ b/jenkins/client/job/git-mirrors/upstream/pipelines.yml
@@ -6,8 +6,8 @@
       - name: pipeline-library
         downstream: mcp-ci/pipeline-library
         upstream: "git@github.com:Mirantis/pipeline-library.git"
-        branches: master
+        branches: master,release/2018.8.1
       - name: mk-pipelines
         downstream: mk/mk-pipelines
         upstream: "git@github.com:Mirantis/mk-pipelines.git"
-        branches: master
+        branches: master,release/2018.8.1
diff --git a/jenkins/client/job/k8s-test/init.yml b/jenkins/client/job/k8s-test/init.yml
index c26bfce..537cd3c 100644
--- a/jenkins/client/job/k8s-test/init.yml
+++ b/jenkins/client/job/k8s-test/init.yml
@@ -5,4 +5,6 @@
 - system.jenkins.client.job.k8s-test.mcp-k8s-dashboard-merge-pipeline
 - system.jenkins.client.job.k8s-test.mcp-k8s-metallb-test-pipeline
 - system.jenkins.client.job.k8s-test.mcp-k8s-metallb-merge-pipeline
+- system.jenkins.client.job.k8s-test.mcp-k8s-coredns-test-pipeline
+- system.jenkins.client.job.k8s-test.mcp-k8s-coredns-merge-pipeline
 - system.jenkins.client.job.k8s-test.mcp-k8s-formula-test-pipeline
diff --git a/jenkins/client/job/k8s-test/mcp-k8s-coredns-merge-pipeline.yml b/jenkins/client/job/k8s-test/mcp-k8s-coredns-merge-pipeline.yml
new file mode 100644
index 0000000..10fe045
--- /dev/null
+++ b/jenkins/client/job/k8s-test/mcp-k8s-coredns-merge-pipeline.yml
@@ -0,0 +1,43 @@
+parameters:
+  _param:
+    mcp_docker_registry: 'docker-dev-local.docker.mirantis.net'
+    mcp_prod_docker_registry: 'docker-prod-local.docker.mirantis.net'
+  jenkins:
+    client:
+      job:
+        mcp_k8s_coredns_merge_pipeline:
+          type: workflow-scm
+          name: mcp-k8s-coredns-merge-pipeline
+          display_name: "CoreDNS merge pipeline"
+          discard:
+            build:
+              keep_num: 20
+          concurrent: false
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/kubernetes-ci/kubernetes-pipelines"
+            credentials: "gerrit"
+            script: pipelines/mcp-k8s-coredns-pipeline.groovy
+          trigger:
+            gerrit:
+              project:
+                kubernetes/coredns:
+                  branches:
+                    - compare_type: "ANT"
+                      name: "**mcp**"
+              message:
+                build_successful: "Build successful"
+                build_unstable: "Build unstable"
+                build_failure: "Build failed"
+              event:
+                change:
+                  - merged
+          param:
+            KUBE_DOCKER_REGISTRY:
+              type: string
+              default: ${_param:mcp_docker_registry}
+              description: 'Docker registry for binaries and images'
+            KUBE_PROD_DOCKER_REGISTRY:
+              type: string
+              default: ${_param:mcp_prod_docker_registry}
+              description: 'Prod docker registry for binaries and images'
diff --git a/jenkins/client/job/k8s-test/mcp-k8s-coredns-test-pipeline.yml b/jenkins/client/job/k8s-test/mcp-k8s-coredns-test-pipeline.yml
new file mode 100644
index 0000000..1f0e190
--- /dev/null
+++ b/jenkins/client/job/k8s-test/mcp-k8s-coredns-test-pipeline.yml
@@ -0,0 +1,48 @@
+parameters:
+  _param:
+    mcp_docker_registry: 'docker-dev-local.docker.mirantis.net'
+  jenkins:
+    client:
+      job:
+        mcp_k8s_coredns_test_pipeline:
+          type: workflow-scm
+          name: mcp-k8s-coredns-test-pipeline
+          display_name: "CoreDNS tests pipeline"
+          discard:
+            build:
+              keep_num: 50
+          concurrent: true
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/kubernetes-ci/kubernetes-pipelines"
+            credentials: "gerrit"
+            script: pipelines/mcp-k8s-coredns-pipeline.groovy
+          trigger:
+            gerrit:
+              project:
+                kubernetes/coredns:
+                  branches:
+                    - compare_type: "ANT"
+                      name: "**"
+              message:
+                build_successful: "Build successful"
+                build_unstable: "Build unstable"
+                build_failure: "Build failed"
+              event:
+                patchset:
+                  - created:
+                      excludeDrafts: false
+                      excludeTrivialRebase: false
+                      excludeNoCodeChange: false
+                comment:
+                  - addedContains:
+                      commentAddedCommentContains: '(recheck|reverify)'
+              override-votes:
+                gerritBuildUnstableVerifiedValue: 1
+                gerritBuildUnstableCodeReviewValue: 1
+          param:
+            KUBE_DOCKER_REGISTRY:
+              type: string
+              default: ${_param:mcp_docker_registry}
+              description: 'Docker registry for binaries and images'
+
diff --git a/jenkins/client/job/oscore/cookiecutter.yml b/jenkins/client/job/oscore/cookiecutter.yml
index 5ffe289..3dd9e73 100644
--- a/jenkins/client/job/oscore/cookiecutter.yml
+++ b/jenkins/client/job/oscore/cookiecutter.yml
@@ -35,6 +35,7 @@
                 - openstack-ovs-core-manila-pike
                 - openstack-ovs-core-telemetry-pike
                 - openstack-ovs-core-queens
+                - openstack-ovs-core-ssl-queens
             STACK_INSTALL:
               type: string
               default: 'core,openstack,ovs'
@@ -42,6 +43,16 @@
               type: boolean
               description: "Delete Heat stack when finished (bool)"
               default: 'false'
+            OPENSTACK_ENVIRONMENT:
+              type: choice
+              description: "Target openstack environment."
+              choices:
+                - devcloud
+                - presales
+                - oscore_devcloud
+            OPENSTACK_API_CREDENTIALS:
+              type: string
+              description: "Credentials to the OpenStack API"
             OPENSTACK_API_PROJECT:
               type: string
               default: "mcp-oscore"
@@ -113,6 +124,16 @@
               type: string
               default: "gerrit"
               description: "ID of jenkins credentials to be used when connecting to gerrit."
+            OPENSTACK_ENVIRONMENT:
+              type: choice
+              description: "Target openstack environment."
+              choices:
+                - devcloud
+                - presales
+                - oscore_devcloud
+            OPENSTACK_API_CREDENTIALS:
+              type: string
+              description: "Credentials to the OpenStack API"
             OPENSTACK_API_PROJECT:
               type: string
               default: "mcp-oscore-ci"
diff --git a/jenkins/client/job/oscore/release.yml b/jenkins/client/job/oscore/release.yml
index f73bd22..e471e9d 100644
--- a/jenkins/client/job/oscore/release.yml
+++ b/jenkins/client/job/oscore/release.yml
@@ -59,6 +59,10 @@
                 type: string
                 default: "{{test_scheme}}"
                 description: "Structure which defines parameters of deployment jobs"
+              TEST_MILESTONE:
+                type: string
+                description: Product milestone
+                default: "{{test_milestone}}"
               MIRROR_HOST:
                 type: string
                 default: "mirror.mirantis.com"
diff --git a/jenkins/client/job/oscore/test_upgrades.yml b/jenkins/client/job/oscore/test_upgrades.yml
index 26a9960..b97855a 100644
--- a/jenkins/client/job/oscore/test_upgrades.yml
+++ b/jenkins/client/job/oscore/test_upgrades.yml
@@ -19,17 +19,30 @@
               credentials: "gerrit"
               branch: 'master'
               script: test-openstack-upgrade-pipeline.groovy
+            trigger:
+              timer:
+               spec: "H 22 * * *"
             param:
               CREDENTIALS_ID:
                 type: string
                 description: "ID of jenkins credentials to be used when connecting to gerrit."
                 default: "gerrit"
+              OPENSTACK_ENVIRONMENT:
+                type: choice
+                description: "Target openstack environment."
+                choices:
+                  - devcloud
+                  - presales
+                  - oscore_devcloud
+              OPENSTACK_API_CREDENTIALS:
+                type: string
+                description: "Credentials to the OpenStack API"
               OPENSTACK_API_PROJECT:
                 type: string
-                default: "mcp-oscore"
+                default: "mcp-oscore-ci"
               HEAT_STACK_ZONE:
                 type: string
-                default: "mcp-oscore"
+                default: "mcp-oscore-ci"
               FLAVOR_PREFIX:
                 type: string
                 default: 'dev'
@@ -40,7 +53,7 @@
               TEST_SCHEME:
                 type: string
                 description: "Yaml based scheme to be applied in testing"
-                default: '{"old": {"context_file_name": "openstack-ovs-core-{{openstack_version_old}}","extra_context": {"default_context": {"openstack_version": "{{openstack_version_old}}"}}}, "new": {"extra_context": {"default_context": {"openstack_version": "{{openstack_version_new}}"}}}}'
+                default: '{"old": {"run_smoke": True, "context_file_name": "openstack-ovs-core-{{openstack_version_old}}","extra_context": {"default_context": {"openstack_version": "{{openstack_version_old}}"}}}, "new": {"run_smoke": True, "extra_context": {"default_context": {"openstack_version": "{{openstack_version_new}}"}}}}'
       job:
         oscore-test-adjust-cluster-model:
           display_name: oscore-test-adjust-cluster-model
diff --git a/jenkins/client/job/salt-models/tests.yml b/jenkins/client/job/salt-models/tests.yml
index 983a88b..c6bd2e1 100644
--- a/jenkins/client/job/salt-models/tests.yml
+++ b/jenkins/client/job/salt-models/tests.yml
@@ -48,10 +48,6 @@
               PARALLEL_NODE_GROUP_SIZE:
                 type: string
                 default: "9"
-              # Salt master setup extra formulas
-              EXTRA_FORMULAS:
-                type: string
-                default: "{{extra_formulas}}"
               FORMULAS_SOURCE:
                 type: string
                 default: "{{formulas_src}}"
@@ -158,10 +154,6 @@
               PARALLEL_NODE_GROUP_SIZE:
                 type: string
                 default: "9"
-              # Salt master setup extra formulas
-              EXTRA_FORMULAS:
-                type: string
-                default: "{{extra_formulas}}"
               FORMULAS_SOURCE:
                 type: string
                 default: "{{formulas_src}}"
@@ -272,37 +264,36 @@
               COOKIECUTTER_TEMPLATE_URL:
                 type: string
                 default: "${_param:jenkins_gerrit_url}/mk/{{cookiecutter_template}}"
-              CREDENTIALS_ID:
-                type: string
-                default: gerrit
               COOKIECUTTER_TEMPLATE_BRANCH:
                 type: string
                 default: master
-              RECLASS_MODEL_URL:
+                description: "Those variable will be ignored, in case gerritTrigger=>GERRIT_BRANCH"
+              COOKIECUTTER_TEMPLATE_REF:
+                type: string
+                default: ""
+                description: "Example: refs/changes/49/25549/1"
+              RECLASS_SYSTEM_URL:
                 type: string
                 default: "${_param:jenkins_gerrit_url}/salt-models/reclass-system"
-              RECLASS_MODEL_BRANCH:
+              RECLASS_SYSTEM_BRANCH:
                 type: string
                 default: master
+                description: "Those variable will be ignored, in case gerritTrigger=>GERRIT_BRANCH"
+              RECLASS_SYSTEM_GIT_REF:
+                type: string
+                default: ""
+                description: "Example: refs/changes/49/25549/1"
               DISTRIB_REVISION:
                 type: string
                 default: 'nightly'
-              SYSTEM_GIT_URL:
-                type: string
-                default: ""
-              SYSTEM_GIT_REF:
-                type: string
-                default: ""
-              PARALLEL_NODE_GROUP_SIZE:
-                type: string
-                default: "1"
-              EXTRA_FORMULAS:
-                type: string
-                default: "aptly artifactory auditd backupninja collectd devops-portal docker elasticsearch fluentd freeipa gerrit glusterfs grafana haproxy heka horizon influxdb jenkins keepalived kibana libvirt maas memcached mysql nginx ntp openldap openssh postfix prometheus rsync rsyslog rundeck sensu sphinx telegraf xtrabackup watchdog logrotate"
+                description: "Those variable will be ignored, in case gerritTrigger=>GERRIT_BRANCH. Version of bin-artifacts,passed to test-env"
               RECLASS_VERSION:
                 type: string
                 default: 'v1.5.4'
-                description: "Version (branch) of Reclass we will use"
+                description: "Version (branch) of reclass PACKAGE we will use"
+              CREDENTIALS_ID:
+                type: string
+                default: gerrit
       job:
         test-salt-model-node:
           name: test-salt-model-node
@@ -341,9 +332,6 @@
             CREDENTIALS_ID:
               type: string
               default: "gerrit"
-            EXTRA_FORMULAS:
-              type: string
-              default: ""
             FORMULAS_SOURCE:
               type: string
               default: "pkg"
@@ -385,7 +373,7 @@
             build:
               keep_num: 300
             artifact:
-              keep_num: 30
+              keep_num: 300
           type: workflow-scm
           concurrent: true
           plugin_properties:
@@ -402,5 +390,5 @@
             script: test-cookiecutter-reclass-chunk.groovy
           param:
             EXTRA_VARIABLES_YAML:
-              type: string
+              type: text
               default: ""
diff --git a/jenkins/client/job/stacklight/cookiecutter.yml b/jenkins/client/job/stacklight/cookiecutter.yml
index 0a2c6ed..0f40403 100644
--- a/jenkins/client/job/stacklight/cookiecutter.yml
+++ b/jenkins/client/job/stacklight/cookiecutter.yml
@@ -31,6 +31,16 @@
               type: string
               description: "Context for cookiecutter template specified as filename"
               default: 'stacklight-openstack-ovs-core-pike'
+            OPENSTACK_ENVIRONMENT:
+              type: choice
+              description: "Target openstack environment"
+              choices:
+                - devcloud
+                - presales
+                - oscore_devcloud
+            OPENSTACK_API_CREDENTIALS:
+              type: string
+              description: "Credentials to the OpenStack API"
             OPENSTACK_API_PROJECT:
               type: string
               default: "mcp-stacklight"
diff --git a/keepalived/cluster/instance/openstack_manila_vip.yml b/keepalived/cluster/instance/openstack_manila_vip.yml
new file mode 100644
index 0000000..d8330c4
--- /dev/null
+++ b/keepalived/cluster/instance/openstack_manila_vip.yml
@@ -0,0 +1,11 @@
+classes:
+- service.keepalived.cluster.single
+parameters:
+  _param:
+    keepalived_openstack_manila_vip_address: ${_param:cluster_vip_address}
+    keepalived_openstack_manila_vip_password: password
+    keepalived_openstack_manila_vip_interface: eth1
+    keepalived_vip_virtual_router_id: 235
+    keepalived_vip_address: ${_param:keepalived_openstack_manila_vip_address}
+    keepalived_vip_password: ${_param:keepalived_openstack_manila_vip_password}
+    keepalived_vip_interface: ${_param:keepalived_openstack_manila_vip_interface}
diff --git a/keystone/client/service/gnocchi.yml b/keystone/client/service/gnocchi.yml
index 27d38b0..1d1b075 100644
--- a/keystone/client/service/gnocchi.yml
+++ b/keystone/client/service/gnocchi.yml
@@ -5,6 +5,8 @@
     cluster_public_protocol: https
     gnocchi_service_protocol: http
     gnocchi_public_host: ${_param:cluster_public_host}
+    gnocchi_public_port: 8041
+    gnocchi_public_path: '/'
   keystone:
     client:
       server:
@@ -24,8 +26,8 @@
               - region: ${_param:openstack_region}
                 public_address: ${_param:gnocchi_public_host}
                 public_protocol: ${_param:cluster_public_protocol}
-                public_port: 8041
-                public_path: '/'
+                public_port: ${_param:gnocchi_public_port}
+                public_path: ${_param:gnocchi_public_path}
                 internal_address: ${_param:gnocchi_service_host}
                 internal_port: 8041
                 internal_path: '/'
diff --git a/keystone/client/service/keystone.yml b/keystone/client/service/keystone.yml
index 0cfa963..53e7cd1 100644
--- a/keystone/client/service/keystone.yml
+++ b/keystone/client/service/keystone.yml
@@ -7,6 +7,8 @@
     keystone_public_path: "/v2.0"
     keystone_internal_path: "/v2.0"
     keystone_admin_path: "/v2.0"
+    keystone_public_address: ${_param:cluster_public_host}
+    keystone_public_port: 5000
   keystone:
     client:
       server:
@@ -17,9 +19,9 @@
               description: OpenStack Identity Service
               endpoints:
               - region: ${_param:openstack_region}
-                public_address: ${_param:cluster_public_host}
+                public_address: ${_param:keystone_public_address}
                 public_protocol: ${_param:cluster_public_protocol}
-                public_port: 5000
+                public_port: ${_param:keystone_public_port}
                 public_path: ${_param:keystone_public_path}
                 internal_address: ${_param:keystone_service_host}
                 internal_port: 5000
diff --git a/keystone/server/cluster.yml b/keystone/server/cluster.yml
index 24840fe..1a5f4a3 100644
--- a/keystone/server/cluster.yml
+++ b/keystone/server/cluster.yml
@@ -6,12 +6,15 @@
 - system.linux.system.users.keystone
 - system.keystone.server.fernet_rotation.cluster
 - system.salt.minion.cert.mysql.clients.openstack.keystone
+- system.salt.minion.cert.rabbitmq.clients.openstack.keystone
 parameters:
   _param:
     keystone_tokens_expiration: 3600
     openstack_node_role: primary
     openstack_mysql_x509_enabled: False
+    openstack_rabbitmq_x509_enabled: False
     galera_ssl_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -69,6 +72,13 @@
         password: ${_param:rabbitmq_openstack_password}
         virtual_host: '/openstack'
         ha_queues: true
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_keystone_ssl_ca_file}
+          key_file: ${_param:rabbitmq_keystone_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_keystone_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
       auth_methods:
       - password
       - token
diff --git a/keystone/server/single.yml b/keystone/server/single.yml
index d926c0d..03cd75d 100644
--- a/keystone/server/single.yml
+++ b/keystone/server/single.yml
@@ -3,6 +3,7 @@
 - system.linux.system.users.keystone
 - system.keystone.server.fernet_rotation.single
 - system.salt.minion.cert.mysql.clients.openstack.keystone
+- system.salt.minion.cert.rabbitmq.clients.openstack.keystone
 parameters:
   _param:
     keystone_service_token: token
@@ -13,7 +14,9 @@
     keystone_tokens_expiration: 3600
     openstack_node_role: primary
     openstack_mysql_x509_enabled: False
+    openstack_rabbitmq_x509_enabled: False
     galera_ssl_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -65,6 +68,13 @@
         password: ${_param:rabbitmq_openstack_password}
         virtual_host: '/openstack'
         ha_queues: true
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_keystone_ssl_ca_file}
+          key_file: ${_param:rabbitmq_keystone_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_keystone_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
       roles:
         - admin
         - Member
diff --git a/kubernetes/common.yml b/kubernetes/common.yml
index bf5886b..82b3ad3 100644
--- a/kubernetes/common.yml
+++ b/kubernetes/common.yml
@@ -15,7 +15,7 @@
     kubernetes_externaldns_repo: mirantis
     kubernetes_genie_repo: https://docker-prod-local.artifactory.mirantis.com/artifactory/binary-prod-local/mirantis/kubernetes/cni-genie
     kubernetes_flannel_repo: quay.io/coreos
-    kubernetes_metallb_repo: metallb
+    kubernetes_metallb_repo: ${_param:mcp_docker_registry}/mirantis/metallb
     kubernetes_sriov_repo: https://docker-prod-local.artifactory.mirantis.com/artifactory/binary-prod-local/mirantis/kubernetes/sriov-cni
     kubernetes_cniplugins_repo: https://docker-prod-local.artifactory.mirantis.com/artifactory/binary-prod-local/mirantis/kubernetes/containernetworking-plugins
     kubernetes_dashboard_repo: ${_param:mcp_docker_registry}/mirantis/kubernetes
@@ -44,8 +44,8 @@
     kubernetes_genie_source: ${_param:kubernetes_genie_repo}/genie_v1.0-138-gbf5dbaa
     kubernetes_genie_source_hash: md5=b024052ed4ecb1d5354e0cc8f51afaca
     kubernetes_flannel_image: ${_param:kubernetes_flannel_repo}/flannel:v0.10.0-amd64
-    kubernetes_metallb_controller_image: ${_param:kubernetes_metallb_repo}/controller:v0.7.3
-    kubernetes_metallb_speaker_image: ${_param:kubernetes_metallb_repo}/speaker:v0.7.3
+    kubernetes_metallb_controller_image: ${_param:kubernetes_metallb_repo}/controller:v0.7.3-2
+    kubernetes_metallb_speaker_image: ${_param:kubernetes_metallb_repo}/speaker:v0.7.3-2
     kubernetes_sriov_source: ${_param:kubernetes_sriov_repo}/sriov_v0.3-8-g8b7ed98
     kubernetes_sriov_source_hash: md5=c0cc33202afd02e4cc44b977a8faf6e7
     kubernetes_cniplugins_source: ${_param:kubernetes_cniplugins_repo}/cni-plugins_v0.7.1-48-g696b1f9.tar.gz
@@ -258,6 +258,8 @@
           criproxy_source: ${_param:kubernetes_criproxy_checksum}
         metallb:
           enabled: ${_param:kubernetes_metallb_enabled}
+          controller_image: ${_param:kubernetes_metallb_controller_image}
+          speaker_image: ${_param:kubernetes_metallb_speaker_image}
     pool:
       enabled: false
       kubelet:
diff --git a/manila/common/cluster.yml b/manila/common/cluster.yml
index d71364e..5c34bd6 100644
--- a/manila/common/cluster.yml
+++ b/manila/common/cluster.yml
@@ -1,8 +1,13 @@
 classes:
- - service.manila.common.cluster
- - service.haproxy.proxy.single
- - system.haproxy.proxy.listen.openstack.manila
+- service.manila.common.cluster
+- service.haproxy.proxy.single
+- system.haproxy.proxy.listen.openstack.manila
+- system.salt.minion.cert.mysql.clients.openstack.manila
 parameters:
+  _param:
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
+    manila_cluster_vip_address: ${_param:cluster_vip_address}
   manila:
     common:
       version: ${_param:openstack_version}
@@ -20,10 +25,17 @@
         name: manila
         user: manila
         password: ${_param:mysql_manila_password}
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_manila_ssl_ca_file}
+          key_file: ${_param:mysql_manila_client_ssl_key_file}
+          cert_file: ${_param:mysql_manila_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
       identity:
         engine: keystone
         region: ${_param:openstack_region}
-        host: ${_param:cluster_vip_address}
+        host: ${_param:manila_cluster_vip_address}
         port: 35357
         user: manila
         password: ${_param:keystone_manila_password}
diff --git a/manila/common/single.yml b/manila/common/single.yml
index 1b139c2..f9d8c6e 100644
--- a/manila/common/single.yml
+++ b/manila/common/single.yml
@@ -1,6 +1,10 @@
 classes:
- - service.manila.common.single
+- service.manila.common.single
+- system.salt.minion.cert.mysql.clients.openstack.manila
 parameters:
+  _param:
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   manila:
     common:
       version: ${_param:openstack_version}
@@ -18,6 +22,13 @@
         name: manila
         user: manila
         password: ${_param:mysql_manila_password}
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_manila_ssl_ca_file}
+          key_file: ${_param:mysql_manila_client_ssl_key_file}
+          cert_file: ${_param:mysql_manila_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
       identity:
         engine: keystone
         region: ${_param:openstack_region}
diff --git a/manila/control/single.yml b/manila/control/single.yml
index 262a158..9d5f9f6 100644
--- a/manila/control/single.yml
+++ b/manila/control/single.yml
@@ -1,15 +1,18 @@
 classes:
- - system.manila.common.cluster
+ - system.manila.common.single
  - system.apache.server.site.manila
 parameters:
+  _param:
+    openstack_node_role: primary
   manila:
     common:
       dhss: false
+      default_share_type: default
       version: ${_param:openstack_version}
     api:
+      role: ${_param:openstack_node_role}
       enabled: true
       version: ${_param:openstack_version}
-      role: ${_param:openstack_node_role}
     scheduler:
       enabled: true
       version: ${_param:openstack_version}
diff --git a/manila/share/backend/lvm.yml b/manila/share/backend/lvm.yml
index fe709da..9f5c660 100644
--- a/manila/share/backend/lvm.yml
+++ b/manila/share/backend/lvm.yml
@@ -1,12 +1,13 @@
 parameters:
   _param:
     manila_share_address: ${_param:single_address}
+    manila_lvm_volume_name: manila-volume
   linux:
     storage:
       lvm:
         manila-vg:
           enabled: true
-          name: manila-volume
+          name: ${_param:manila_lvm_volume_name}
           devices: ${_param:manila_lvm_devices}
     system:
       package:
@@ -25,4 +26,4 @@
             - "${_param:manila_share_address}"
           dhss: false
           share_driver: manila.share.drivers.lvm.LVMShareDriver
-          lvm_share_volume_group: manila-volume
+          lvm_share_volume_group: ${_param:manila_lvm_volume_name}
diff --git a/neutron/control/openvswitch/single.yml b/neutron/control/openvswitch/single.yml
index baa710e..da8dee0 100644
--- a/neutron/control/openvswitch/single.yml
+++ b/neutron/control/openvswitch/single.yml
@@ -13,8 +13,10 @@
     neutron_enable_bgp_vpn: False
     neutron_bgp_vpn_driver: bagpipe
     internal_protocol: 'http'
+    openstack_node_role: primary
   neutron:
     server:
+      role: ${_param:openstack_node_role}
       global_physnet_mtu: ${_param:neutron_global_physnet_mtu}
       l3_ha: ${_param:neutron_l3_ha}
       dvr: ${_param:neutron_control_dvr}
diff --git a/openscap/server/init.yml b/openscap/server/init.yml
new file mode 100644
index 0000000..0f2a76f
--- /dev/null
+++ b/openscap/server/init.yml
@@ -0,0 +1,2 @@
+classes:
+- service.openscap.cis
diff --git a/openssh/server/team/members/alis.yml b/openssh/server/team/members/alis.yml
new file mode 100644
index 0000000..2714198
--- /dev/null
+++ b/openssh/server/team/members/alis.yml
@@ -0,0 +1,19 @@
+parameters:
+  linux:
+    system:
+      user:
+        alis:
+          enabled: true
+          name: alis
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Adam Lis
+          home: /home/alis
+          email: alis@mirantis.com
+  openssh:
+    server:
+      user:
+        alis:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDW3VR61NPwpwW0PGAaIuimtOtQjXIp3zAE15KphEejPEciceE/AJeKTsBpvKmP23pCJYhoCJOSQxxxWIiLHPoUEr2aGgy8+wLnResqEOtobpbtGHYzvsAUY/Uc+1Vk6S6Ho9ysrhlpY+Ih4yuSzTaZKqMFXx47/L0HZLNZmCbPD/siki0X3tnCS09RS8KSaTJdZ/Sd/PnUEb6JGg5taid9VNkUUOcgYoudNWPJS3Pjrtijiczq9IZ0cArueEVx4NCkKEb+dDUls4BRVGfNUt3iZY2LrGTd4FeyrWV7IGoPTxyiaJdtpcjDHe4omqsY705LRvBQs6de6enG0PMpQ9KR adamlis@tuchiegu
+          user: ${linux:system:user:alis}
diff --git a/openssh/server/team/services.yml b/openssh/server/team/services.yml
index 3116d90..21ccba7 100644
--- a/openssh/server/team/services.yml
+++ b/openssh/server/team/services.yml
@@ -20,6 +20,7 @@
 - system.openssh.server.team.members.mchernik
 - system.openssh.server.team.members.hkraemer
 - system.openssh.server.team.members.pbasov
+- system.openssh.server.team.members.alis
 parameters:
   _param:
     linux_system_user_sudo: true
diff --git a/panko/server/cluster.yml b/panko/server/cluster.yml
index 3a4cb65..9715456 100644
--- a/panko/server/cluster.yml
+++ b/panko/server/cluster.yml
@@ -4,6 +4,7 @@
 - system.apache.server.site.panko
 - system.haproxy.proxy.listen.openstack.panko
 - system.keepalived.cluster.instance.openstack_telemetry_vip
+- system.salt.minion.cert.mysql.clients.openstack.panko
 parameters:
   _param:
     panko_memcached_node01_address: ${_param:cluster_node01_address}
@@ -11,6 +12,8 @@
     panko_memcached_node03_address: ${_param:cluster_node03_address}
     # Keep events in database for 30 days
     panko_event_time_to_live: 2592000
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   linux:
     system:
       cron:
@@ -25,6 +28,13 @@
         host: ${_param:openstack_control_address}
       database:
         host: ${_param:openstack_database_address}
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_panko_ssl_ca_file}
+          key_file: ${_param:mysql_panko_client_ssl_key_file}
+          cert_file: ${_param:mysql_panko_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
       cache:
         engine: memcached
         members:
diff --git a/panko/server/single.yml b/panko/server/single.yml
index 4ba2787..cb1a449 100644
--- a/panko/server/single.yml
+++ b/panko/server/single.yml
@@ -1,10 +1,13 @@
 classes:
 - service.panko.server.single
 - system.apache.server.site.panko
+- system.salt.minion.cert.mysql.clients.openstack.panko
 parameters:
   _param:
     # Keep events in database for 30 days
     panko_event_time_to_live: 2592000
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   linux:
     system:
       cron:
@@ -13,6 +16,14 @@
             enabled: true
   panko:
     server:
+      database:
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_panko_ssl_ca_file}
+          key_file: ${_param:mysql_panko_client_ssl_key_file}
+          cert_file: ${_param:mysql_panko_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
       role: ${_param:openstack_node_role}
       event_time_to_live: ${_param:panko_event_time_to_live}
       # Check for expired events every day at 2 AM
diff --git a/rabbitmq/server/ssl/init.yml b/rabbitmq/server/ssl/init.yml
index 7fefae7..71cc1a7 100644
--- a/rabbitmq/server/ssl/init.yml
+++ b/rabbitmq/server/ssl/init.yml
@@ -4,8 +4,11 @@
 parameters:
   _param:
     rabbitmq_ssl_enabled: true
+    openstack_rabbitmq_x509_enabled: false
     rabbitmq_port: 5671 # for non-ssl use 5672 / for ssl 5671
   rabbitmq:
     server:
       ssl:
         enabled: ${_param:rabbitmq_ssl_enabled}
+      x509:
+        enabled: ${_param:openstack_rabbitmq_x509_enabled}
diff --git a/reclass/storage/system/cicd_control_cluster.yml b/reclass/storage/system/cicd_control_cluster.yml
index bc31944..34f0de1 100644
--- a/reclass/storage/system/cicd_control_cluster.yml
+++ b/reclass/storage/system/cicd_control_cluster.yml
@@ -18,6 +18,7 @@
             single_address: ${_param:cicd_control_node01_address}
             keepalived_vip_priority: 103
             cicd_database_id: 1
+            glusterfs_node_role: primary
         cicd_control_node02:
           name: ${_param:cicd_control_node02_hostname}
           domain: ${_param:cluster_domain}
@@ -29,6 +30,7 @@
             single_address: ${_param:cicd_control_node02_address}
             keepalived_vip_priority: 102
             cicd_database_id: 2
+            glusterfs_node_role: secondary
         cicd_control_node03:
           name: ${_param:cicd_control_node03_hostname}
           domain: ${_param:cluster_domain}
@@ -40,3 +42,4 @@
             single_address: ${_param:cicd_control_node03_address}
             keepalived_vip_priority: 101
             cicd_database_id: 3
+            glusterfs_node_role: secondary
diff --git a/reclass/storage/system/openstack_control_cluster.yml b/reclass/storage/system/openstack_control_cluster.yml
index e05b3e9..cf21437 100644
--- a/reclass/storage/system/openstack_control_cluster.yml
+++ b/reclass/storage/system/openstack_control_cluster.yml
@@ -20,6 +20,7 @@
             opencontrail_database_id: 1
             rabbitmq_cluster_role: master
             openstack_node_role: primary
+            glusterfs_node_role: primary
         openstack_control_node02:
           name: ${_param:openstack_control_node02_hostname}
           domain: ${_param:cluster_domain}
@@ -33,6 +34,7 @@
             opencontrail_database_id: 2
             rabbitmq_cluster_role: slave
             openstack_node_role: secondary
+            glusterfs_node_role: secondary
         openstack_control_node03:
           name: ${_param:openstack_control_node03_hostname}
           domain: ${_param:cluster_domain}
@@ -46,3 +48,4 @@
             opencontrail_database_id: 3
             rabbitmq_cluster_role: slave
             openstack_node_role: secondary
+            glusterfs_node_role: secondary
diff --git a/reclass/storage/system/openstack_control_large.yml b/reclass/storage/system/openstack_control_large.yml
index 4ad2e90..f02b24c 100644
--- a/reclass/storage/system/openstack_control_large.yml
+++ b/reclass/storage/system/openstack_control_large.yml
@@ -20,6 +20,7 @@
             single_address: ${_param:openstack_control_node01_address}
             keepalived_vip_priority: 105
             openstack_node_role: primary
+            glusterfs_node_role: primary
         openstack_control_node02:
           name: ${_param:openstack_control_node02_hostname}
           domain: ${_param:cluster_domain}
@@ -31,6 +32,7 @@
             single_address: ${_param:openstack_control_node02_address}
             keepalived_vip_priority: 104
             openstack_node_role: secondary
+            glusterfs_node_role: secondary
         openstack_control_node03:
           name: ${_param:openstack_control_node03_hostname}
           domain: ${_param:cluster_domain}
@@ -42,6 +44,7 @@
             single_address: ${_param:openstack_control_node03_address}
             keepalived_vip_priority: 103
             openstack_node_role: secondary
+            glusterfs_node_role: secondary
         openstack_control_node04:
           name: ${_param:openstack_control_node04_hostname}
           domain: ${_param:cluster_domain}
@@ -53,6 +56,7 @@
             single_address: ${_param:openstack_control_node04_address}
             keepalived_vip_priority: 102
             openstack_node_role: secondary
+            glusterfs_node_role: secondary
         openstack_control_node05:
           name: ${_param:openstack_control_node05_hostname}
           domain: ${_param:cluster_domain}
@@ -64,3 +68,4 @@
             single_address: ${_param:openstack_control_node05_address}
             keepalived_vip_priority: 101
             openstack_node_role: secondary
+            glusterfs_node_role: secondary
diff --git a/reclass/storage/system/openstack_control_upgrade_single.yml b/reclass/storage/system/openstack_control_upgrade_single.yml
index b00cc81..a48c9a3 100644
--- a/reclass/storage/system/openstack_control_upgrade_single.yml
+++ b/reclass/storage/system/openstack_control_upgrade_single.yml
@@ -15,3 +15,4 @@
             linux_system_codename: ${_param:openstack_upgrade_system_codename}
             single_address: ${_param:openstack_upgrade_node01_address}
             openstack_node_role: primary
+            glusterfs_node_role: primary
diff --git a/reclass/storage/system/openstack_share_multi.yml b/reclass/storage/system/openstack_share_multi.yml
index a70af28..abc52ce 100644
--- a/reclass/storage/system/openstack_share_multi.yml
+++ b/reclass/storage/system/openstack_share_multi.yml
@@ -20,6 +20,8 @@
             linux_system_codename: ${_param:linux_system_codename}
             single_address: ${_param:openstack_share_node01_address}
             manila_share_address: ${_param:openstack_share_node01_share_address}
+            keepalived_vip_priority: 103
+            openstack_node_role: primary
         openstack_share_node02:
           name: ${_param:openstack_share_node02_hostname}
           domain: ${_param:cluster_domain}
@@ -30,6 +32,8 @@
             linux_system_codename: ${_param:linux_system_codename}
             single_address: ${_param:openstack_share_node02_address}
             manila_share_address: ${_param:openstack_share_node02_share_address}
+            keepalived_vip_priority: 102
+            openstack_node_role: secondary
         openstack_share_node03:
           name: ${_param:openstack_share_node03_hostname}
           domain: ${_param:cluster_domain}
@@ -40,3 +44,5 @@
             linux_system_codename: ${_param:linux_system_codename}
             single_address: ${_param:openstack_share_node03_address}
             manila_share_address: ${_param:openstack_share_node03_share_address}
+            keepalived_vip_priority: 101
+            openstack_node_role: secondary
diff --git a/reclass/storage/system/openstack_telemetry_cluster.yml b/reclass/storage/system/openstack_telemetry_cluster.yml
index 4c688a8..198c356 100644
--- a/reclass/storage/system/openstack_telemetry_cluster.yml
+++ b/reclass/storage/system/openstack_telemetry_cluster.yml
@@ -18,6 +18,7 @@
             single_address: ${_param:openstack_telemetry_node01_address}
             keepalived_vip_priority: 103
             openstack_node_role: primary
+            glusterfs_node_role: primary
             ceilometer_create_gnocchi_resources: true
             redis_cluster_role: 'master'
         openstack_telemetry_node02:
@@ -31,6 +32,7 @@
             single_address: ${_param:openstack_telemetry_node02_address}
             keepalived_vip_priority: 102
             openstack_node_role: secondary
+            glusterfs_node_role: secondary
             redis_cluster_role: 'slave'
         openstack_telemetry_node03:
           name: ${_param:openstack_telemetry_node03_hostname}
@@ -43,4 +45,5 @@
             single_address: ${_param:openstack_telemetry_node03_address}
             keepalived_vip_priority: 101
             openstack_node_role: secondary
+            glusterfs_node_role: secondary
             redis_cluster_role: 'slave'
diff --git a/reclass/storage/system/oss_cluster.yml b/reclass/storage/system/oss_cluster.yml
index 71d42ce..784d8a7 100644
--- a/reclass/storage/system/oss_cluster.yml
+++ b/reclass/storage/system/oss_cluster.yml
@@ -19,6 +19,7 @@
             linux_system_codename: ${_param:oss_system_codename}
             single_address: ${_param:oss_node01_address}
             keepalived_vip_priority: 103
+            glusterfs_node_role: primary
         stacklight_server_node02:
           name: ${_param:oss_node02_hostname}
           domain: ${_param:cluster_domain}
@@ -30,6 +31,7 @@
             linux_system_codename: ${_param:oss_system_codename}
             single_address: ${_param:oss_node02_address}
             keepalived_vip_priority: 102
+            glusterfs_node_role: secondary
         stacklight_server_node03:
           name: ${_param:oss_node03_hostname}
           domain: ${_param:cluster_domain}
@@ -41,3 +43,4 @@
             linux_system_codename: ${_param:oss_system_codename}
             single_address: ${_param:oss_node03_address}
             keepalived_vip_priority: 101
+            glusterfs_node_role: secondary
diff --git a/reclass/storage/system/physical_control_cluster.yml b/reclass/storage/system/physical_control_cluster.yml
index ebd0eb0..1621a4c 100644
--- a/reclass/storage/system/physical_control_cluster.yml
+++ b/reclass/storage/system/physical_control_cluster.yml
@@ -32,6 +32,7 @@
             deploy_address: ${_param:infra_kvm_node01_deploy_address}
             public_address: ${_param:infra_kvm_node01_public_address}
             storage_address: ${_param:infra_kvm_node01_storage_address}
+            glusterfs_node_role: primary
         infra_kvm_node02:
           name: ${_param:infra_kvm_node02_hostname}
           domain: ${_param:cluster_domain}
@@ -44,6 +45,7 @@
             deploy_address: ${_param:infra_kvm_node02_deploy_address}
             public_address: ${_param:infra_kvm_node02_public_address}
             storage_address: ${_param:infra_kvm_node02_storage_address}
+            glusterfs_node_role: secondary
         infra_kvm_node03:
           name: ${_param:infra_kvm_node03_hostname}
           domain: ${_param:cluster_domain}
@@ -56,3 +58,4 @@
             deploy_address: ${_param:infra_kvm_node03_deploy_address}
             public_address: ${_param:infra_kvm_node03_public_address}
             storage_address: ${_param:infra_kvm_node03_storage_address}
+            glusterfs_node_role: secondary
diff --git a/reclass/storage/system/physical_control_full.yml b/reclass/storage/system/physical_control_full.yml
index 1bdd345..7c3b030 100644
--- a/reclass/storage/system/physical_control_full.yml
+++ b/reclass/storage/system/physical_control_full.yml
@@ -57,6 +57,7 @@
             deploy_address: ${_param:infra_kvm_node01_deploy_address}
             public_address: ${_param:infra_kvm_node01_public_address}
             storage_address: ${_param:infra_kvm_node01_storage_address}
+            glusterfs_node_role: primary
         infra_kvm_node02:
           name: ${_param:infra_kvm_node02_hostname}
           domain: ${_param:cluster_domain}
@@ -69,6 +70,7 @@
             deploy_address: ${_param:infra_kvm_node02_deploy_address}
             public_address: ${_param:infra_kvm_node02_public_address}
             storage_address: ${_param:infra_kvm_node02_storage_address}
+            glusterfs_node_role: secondary
         infra_kvm_node03:
           name: ${_param:infra_kvm_node03_hostname}
           domain: ${_param:cluster_domain}
@@ -81,6 +83,7 @@
             deploy_address: ${_param:infra_kvm_node03_deploy_address}
             public_address: ${_param:infra_kvm_node03_public_address}
             storage_address: ${_param:infra_kvm_node03_storage_address}
+            glusterfs_node_role: secondary
         infra_kvm_node04:
           name: ${_param:infra_kvm_node04_hostname}
           domain: ${_param:cluster_domain}
diff --git a/reclass/storage/system/physical_control_large.yml b/reclass/storage/system/physical_control_large.yml
index 1070f47..93cc565 100644
--- a/reclass/storage/system/physical_control_large.yml
+++ b/reclass/storage/system/physical_control_large.yml
@@ -81,6 +81,7 @@
             deploy_address: ${_param:infra_kvm_node01_deploy_address}
             public_address: ${_param:infra_kvm_node01_public_address}
             storage_address: ${_param:infra_kvm_node01_storage_address}
+            glusterfs_node_role: primary
         infra_kvm_node02:
           name: ${_param:infra_kvm_node02_hostname}
           domain: ${_param:cluster_domain}
@@ -93,6 +94,7 @@
             deploy_address: ${_param:infra_kvm_node02_deploy_address}
             public_address: ${_param:infra_kvm_node02_public_address}
             storage_address: ${_param:infra_kvm_node02_storage_address}
+            glusterfs_node_role: secondary
         infra_kvm_node03:
           name: ${_param:infra_kvm_node03_hostname}
           domain: ${_param:cluster_domain}
@@ -105,6 +107,7 @@
             deploy_address: ${_param:infra_kvm_node03_deploy_address}
             public_address: ${_param:infra_kvm_node03_public_address}
             storage_address: ${_param:infra_kvm_node03_storage_address}
+            glusterfs_node_role: secondary
         infra_kvm_node04:
           name: ${_param:infra_kvm_node04_hostname}
           domain: ${_param:cluster_domain}
diff --git a/reclass/storage/system/physical_control_medium.yml b/reclass/storage/system/physical_control_medium.yml
index 5ad7d24..70d7313 100644
--- a/reclass/storage/system/physical_control_medium.yml
+++ b/reclass/storage/system/physical_control_medium.yml
@@ -69,6 +69,7 @@
             deploy_address: ${_param:infra_kvm_node01_deploy_address}
             public_address: ${_param:infra_kvm_node01_public_address}
             storage_address: ${_param:infra_kvm_node01_storage_address}
+            glusterfs_node_role: primary
         infra_kvm_node02:
           name: ${_param:infra_kvm_node02_hostname}
           domain: ${_param:cluster_domain}
@@ -81,6 +82,7 @@
             deploy_address: ${_param:infra_kvm_node02_deploy_address}
             public_address: ${_param:infra_kvm_node02_public_address}
             storage_address: ${_param:infra_kvm_node02_storage_address}
+            glusterfs_node_role: secondary
         infra_kvm_node03:
           name: ${_param:infra_kvm_node03_hostname}
           domain: ${_param:cluster_domain}
@@ -93,6 +95,7 @@
             deploy_address: ${_param:infra_kvm_node03_deploy_address}
             public_address: ${_param:infra_kvm_node03_public_address}
             storage_address: ${_param:infra_kvm_node03_storage_address}
+            glusterfs_node_role: secondary
         infra_kvm_node04:
           name: ${_param:infra_kvm_node04_hostname}
           domain: ${_param:cluster_domain}
diff --git a/reclass/storage/system/physical_control_small.yml b/reclass/storage/system/physical_control_small.yml
index 4ce3759..5727dd6 100644
--- a/reclass/storage/system/physical_control_small.yml
+++ b/reclass/storage/system/physical_control_small.yml
@@ -45,6 +45,7 @@
             deploy_address: ${_param:infra_kvm_node01_deploy_address}
             public_address: ${_param:infra_kvm_node01_public_address}
             storage_address: ${_param:infra_kvm_node01_storage_address}
+            glusterfs_node_role: primary
         infra_kvm_node02:
           name: ${_param:infra_kvm_node02_hostname}
           domain: ${_param:cluster_domain}
@@ -57,6 +58,7 @@
             deploy_address: ${_param:infra_kvm_node02_deploy_address}
             public_address: ${_param:infra_kvm_node02_public_address}
             storage_address: ${_param:infra_kvm_node02_storage_address}
+            glusterfs_node_role: secondary
         infra_kvm_node03:
           name: ${_param:infra_kvm_node03_hostname}
           domain: ${_param:cluster_domain}
@@ -69,6 +71,7 @@
             deploy_address: ${_param:infra_kvm_node03_deploy_address}
             public_address: ${_param:infra_kvm_node03_public_address}
             storage_address: ${_param:infra_kvm_node03_storage_address}
+            glusterfs_node_role: secondary
         infra_kvm_node04:
           name: ${_param:infra_kvm_node04_hostname}
           domain: ${_param:cluster_domain}
diff --git a/salt/control/cluster/ceph_mon_cluster.yml b/salt/control/cluster/ceph_mon_cluster.yml
index bccec01..39cee29 100644
--- a/salt/control/cluster/ceph_mon_cluster.yml
+++ b/salt/control/cluster/ceph_mon_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    ceph_mon_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:ceph_mon_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:ceph_mon_backend_image}
               size: ceph.mon
             cmn02:
               name: ${_param:ceph_mon_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:ceph_mon_backend_image}
               size: ceph.mon
             cmn03:
               name: ${_param:ceph_mon_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
-              size: ceph.mon
\ No newline at end of file
+              backend: ${_param:ceph_mon_backend_image}
+              size: ceph.mon
diff --git a/salt/control/cluster/ceph_rgw_cluster.yml b/salt/control/cluster/ceph_rgw_cluster.yml
index 6f24819..e0109db 100644
--- a/salt/control/cluster/ceph_rgw_cluster.yml
+++ b/salt/control/cluster/ceph_rgw_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    ceph_rgw_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:ceph_rgw_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:ceph_rgw_backend_image}
               size: ceph.rgw
             rgw02:
               name: ${_param:ceph_rgw_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:ceph_rgw_backend_image}
               size: ceph.rgw
             rgw03:
               name: ${_param:ceph_rgw_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
-              size: ceph.rgw
\ No newline at end of file
+              backend: ${_param:ceph_rgw_backend_image}
+              size: ceph.rgw
diff --git a/salt/control/cluster/cicd_control_cluster.yml b/salt/control/cluster/cicd_control_cluster.yml
index 82366a8..33945e2 100644
--- a/salt/control/cluster/cicd_control_cluster.yml
+++ b/salt/control/cluster/cicd_control_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    cicd_control_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:cicd_control_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               size: cicd.control
             cid02:
               name: ${_param:cicd_control_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               size: cicd.control
             cid03:
               name: ${_param:cicd_control_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               size: cicd.control
diff --git a/salt/control/cluster/infra_idm_cluster.yml b/salt/control/cluster/infra_idm_cluster.yml
index ff135a1..f322910 100644
--- a/salt/control/cluster/infra_idm_cluster.yml
+++ b/salt/control/cluster/infra_idm_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_centos7_image_backend: /var/lib/libvirt/images/backends/centos7.qcow2
+    infra_idm_backend_image: ${_param:salt_control_centos7_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:infra_idm_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_centos7_image}
+              backend: ${_param:infra_idm_backend_image}
               size: infra.idm
             idm02:
               name: ${_param:infra_idm_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_centos7_image}
+              backend: ${_param:infra_idm_backend_image}
               size: infra.idm
             idm03:
               name: ${_param:infra_idm_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_centos7_image}
+              backend: ${_param:infra_idm_backend_image}
               size: infra.idm
diff --git a/salt/control/cluster/infra_integration_single.yml b/salt/control/cluster/infra_integration_single.yml
index 66de895..0c774ab 100644
--- a/salt/control/cluster/infra_integration_single.yml
+++ b/salt/control/cluster/infra_integration_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    infra_integration_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,4 +19,5 @@
               name: ${_param:cicd_control_node01_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:infra_integration_backend_image}
               size: infra.integration
diff --git a/salt/control/cluster/infra_maas_single.yml b/salt/control/cluster/infra_maas_single.yml
index d8675e8..9bd4fe2 100644
--- a/salt/control/cluster/infra_maas_single.yml
+++ b/salt/control/cluster/infra_maas_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    infra_maas_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,5 +19,6 @@
               name: ${_param:infra_maas_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:infra_maas_backend_image}
               size: infra.maas
 
diff --git a/salt/control/cluster/infra_proxy_cluster.yml b/salt/control/cluster/infra_proxy_cluster.yml
index f3453ff..00c9679 100644
--- a/salt/control/cluster/infra_proxy_cluster.yml
+++ b/salt/control/cluster/infra_proxy_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
+    infra_proxy_backend_image: ${_param:salt_control_trusty_image_backend}
   salt:
     control:
       size:
@@ -16,9 +19,11 @@
               name: ${_param:openstack_proxy_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:infra_proxy_backend_image}
               size: infra.proxy
             prx02:
               name: ${_param:openstack_proxy_node01_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:infra_proxy_backend_image}
               size: infra.proxy
diff --git a/salt/control/cluster/infra_proxy_single.yml b/salt/control/cluster/infra_proxy_single.yml
index 7d092fa..483b2d4 100644
--- a/salt/control/cluster/infra_proxy_single.yml
+++ b/salt/control/cluster/infra_proxy_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
+    infra_proxy_backend_image: ${_param:salt_control_trusty_image_backend}
   salt:
     control:
       size:
@@ -16,4 +19,5 @@
               name: ${_param:openstack_proxy_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:infra_proxy_backend_image}
               size: infra.proxy
diff --git a/salt/control/cluster/infra_storage_single.yml b/salt/control/cluster/infra_storage_single.yml
index ca8ce26..b6c0a85 100644
--- a/salt/control/cluster/infra_storage_single.yml
+++ b/salt/control/cluster/infra_storage_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    infra_storage_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -15,4 +18,5 @@
             sto01:
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:infra_storage_backend_image}
               size: infra.storage
diff --git a/salt/control/cluster/infra_version_control_single.yml b/salt/control/cluster/infra_version_control_single.yml
index 10e01ab..d7e02d5 100644
--- a/salt/control/cluster/infra_version_control_single.yml
+++ b/salt/control/cluster/infra_version_control_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    infra_version_control_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -15,4 +18,5 @@
             git01:
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:infra_version_control_backend_image}
               size: infra.version_control
diff --git a/salt/control/cluster/kubernetes_control_cluster.yml b/salt/control/cluster/kubernetes_control_cluster.yml
index c3049ec..252ccbf 100644
--- a/salt/control/cluster/kubernetes_control_cluster.yml
+++ b/salt/control/cluster/kubernetes_control_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    kubernetes_control_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:kubernetes_control_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:kubernetes_control_backend_image}
               size: kubernetes.control
             ctl02:
               name: ${_param:kubernetes_control_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:kubernetes_control_backend_image}
               size: kubernetes.control
             ctl03:
               name: ${_param:kubernetes_control_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:kubernetes_control_backend_image}
               size: kubernetes.control
diff --git a/salt/control/cluster/kubernetes_proxy_cluster.yml b/salt/control/cluster/kubernetes_proxy_cluster.yml
index 379a333..0a47f39 100644
--- a/salt/control/cluster/kubernetes_proxy_cluster.yml
+++ b/salt/control/cluster/kubernetes_proxy_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    kubernetes_proxy_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,10 +19,12 @@
               name: ${_param:kubernetes_proxy_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:kubernetes_proxy_backend_image}
               size: kubernetes.proxy
             prx02:
               name: ${_param:kubernetes_proxy_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:kubernetes_proxy_backend_image}
               size: kubernetes.proxy
 
diff --git a/salt/control/cluster/opencontrail_analytics_cluster.yml b/salt/control/cluster/opencontrail_analytics_cluster.yml
index 37fb60a..b4e7b75 100644
--- a/salt/control/cluster/opencontrail_analytics_cluster.yml
+++ b/salt/control/cluster/opencontrail_analytics_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
+    opencontrail_analytics_backend_image: ${_param:salt_control_trusty_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:opencontrail_analytics_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               size: opencontrail.analytics
             nal02:
               name: ${_param:opencontrail_analytics_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               size: opencontrail.analytics
             nal03:
               name: ${_param:opencontrail_analytics_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               size: opencontrail.analytics
diff --git a/salt/control/cluster/opencontrail_control_cluster.yml b/salt/control/cluster/opencontrail_control_cluster.yml
index 10ddf5e..9d2fbb9 100644
--- a/salt/control/cluster/opencontrail_control_cluster.yml
+++ b/salt/control/cluster/opencontrail_control_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
+    opencontrail_control_backend_image: ${_param:salt_control_trusty_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:opencontrail_control_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:opencontrail_control_backend_image}
               size: opencontrail.control
             ntw02:
               name: ${_param:opencontrail_control_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:opencontrail_control_backend_image}
               size: opencontrail.control
             ntw03:
               name: ${_param:opencontrail_control_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:opencontrail_control_backend_image}
               size: opencontrail.control
diff --git a/salt/control/cluster/openstack_barbican_cluster.yml b/salt/control/cluster/openstack_barbican_cluster.yml
index cfa7ba6..b24c0fa 100644
--- a/salt/control/cluster/openstack_barbican_cluster.yml
+++ b/salt/control/cluster/openstack_barbican_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_barbican_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:openstack_barbican_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_barbican_backend_image}
               size: openstack.barbican
             kmn02:
               name: ${_param:openstack_barbican_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_barbican_backend_image}
               size: openstack.barbican
             kmn03:
               name: ${_param:openstack_barbican_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_barbican_backend_image}
               size: openstack.barbican
diff --git a/salt/control/cluster/openstack_baremetal_cluster.yml b/salt/control/cluster/openstack_baremetal_cluster.yml
index 4dd62e4..f166484 100644
--- a/salt/control/cluster/openstack_baremetal_cluster.yml
+++ b/salt/control/cluster/openstack_baremetal_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_baremetal_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:openstack_baremetal_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_baremetal_backend_image}
               size: openstack.baremetal
             bmt02:
               name: ${_param:openstack_baremetal_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_baremetal_backend_image}
               size: openstack.baremetal
             bmt03:
               name: ${_param:openstack_baremetal_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_baremetal_backend_image}
               size: openstack.baremetal
diff --git a/salt/control/cluster/openstack_baremetal_single.yml b/salt/control/cluster/openstack_baremetal_single.yml
index f0aa319..853f45e 100644
--- a/salt/control/cluster/openstack_baremetal_single.yml
+++ b/salt/control/cluster/openstack_baremetal_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_baremetal_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,4 +19,5 @@
               name: ${_param:openstack_baremetal_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_baremetal_backend_image}
               size: openstack.baremetal
diff --git a/salt/control/cluster/openstack_benchmark_single.yml b/salt/control/cluster/openstack_benchmark_single.yml
index ea10fc3..83c18f5 100644
--- a/salt/control/cluster/openstack_benchmark_single.yml
+++ b/salt/control/cluster/openstack_benchmark_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
+    openstack_benchmark_backend_image: ${_param:salt_control_trusty_image_backend}
   salt:
     control:
       size:
@@ -16,4 +19,5 @@
               name: ${_param:openstack_benchmark_node01_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_benchmark_backend_image}
               size: openstack.benchmark
diff --git a/salt/control/cluster/openstack_billing_single.yml b/salt/control/cluster/openstack_billing_single.yml
index f8dacf7..36f9824 100644
--- a/salt/control/cluster/openstack_billing_single.yml
+++ b/salt/control/cluster/openstack_billing_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
+    openstack_billing_backend_image: ${_param:salt_control_trusty_image_backend}
   salt:
     control:
       size:
@@ -15,4 +18,5 @@
             bil01:
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_billing_backend_image}
               size: openstack.control
diff --git a/salt/control/cluster/openstack_control_cluster.yml b/salt/control/cluster/openstack_control_cluster.yml
index f28a7d0..328cfd0 100644
--- a/salt/control/cluster/openstack_control_cluster.yml
+++ b/salt/control/cluster/openstack_control_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
+    openstack_control_backend_image: ${_param:salt_control_trusty_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:openstack_control_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_control_backend_image}
               size: openstack.control
             ctl02:
               name: ${_param:openstack_control_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_control_backend_image}
               size: openstack.control
             ctl03:
               name: ${_param:openstack_control_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_control_backend_image}
               size: openstack.control
diff --git a/salt/control/cluster/openstack_database_cluster.yml b/salt/control/cluster/openstack_database_cluster.yml
index 2a00308..acbcc36 100644
--- a/salt/control/cluster/openstack_database_cluster.yml
+++ b/salt/control/cluster/openstack_database_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
+    openstack_database_backend_image: ${_param:salt_control_trusty_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:openstack_database_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_database_backend_image}
               size: openstack.database
             dbs02:
               name: ${_param:openstack_database_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_database_backend_image}
               size: openstack.database
             dbs03:
               name: ${_param:openstack_database_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_database_backend_image}
               size: openstack.database
diff --git a/salt/control/cluster/openstack_dns_cluster.yml b/salt/control/cluster/openstack_dns_cluster.yml
index 7f1dbb8..6fcc546 100644
--- a/salt/control/cluster/openstack_dns_cluster.yml
+++ b/salt/control/cluster/openstack_dns_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_dns_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,9 +19,11 @@
               name: ${_param:openstack_dns_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_dns_backend_image}
               size: openstack.dns
             dns02:
               name: ${_param:openstack_dns_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_dns_backend_image}
               size: openstack.dns
diff --git a/salt/control/cluster/openstack_gateway_cluster.yml b/salt/control/cluster/openstack_gateway_cluster.yml
index 1a7e06b..8475004 100644
--- a/salt/control/cluster/openstack_gateway_cluster.yml
+++ b/salt/control/cluster/openstack_gateway_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_gateway_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:openstack_gateway_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               size: openstack.gateway
             gtw02:
               name: ${_param:openstack_gateway_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               size: openstack.gateway
             gtw03:
               name: ${_param:openstack_gateway_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               size: openstack.gateway
diff --git a/salt/control/cluster/openstack_gateway_single.yml b/salt/control/cluster/openstack_gateway_single.yml
index 801ee0c..e240d12 100644
--- a/salt/control/cluster/openstack_gateway_single.yml
+++ b/salt/control/cluster/openstack_gateway_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_gateway_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,4 +19,5 @@
               name: ${_param:openstack_gateway_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               size: openstack.gateway
diff --git a/salt/control/cluster/openstack_manila_cluster.yml b/salt/control/cluster/openstack_manila_cluster.yml
index feb1d4f..477d6ca 100644
--- a/salt/control/cluster/openstack_manila_cluster.yml
+++ b/salt/control/cluster/openstack_manila_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_manila_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:openstack_share_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_manila_backend_image}
               size: openstack.manila
             share02:
               name: ${_param:openstack_share_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_manila_backend_image}
               size: openstack.manila
             share03:
               name: ${_param:openstack_share_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_manila_backend_image}
               size: openstack.manila
diff --git a/salt/control/cluster/openstack_message_queue_cluster.yml b/salt/control/cluster/openstack_message_queue_cluster.yml
index cab5adb..f91faf6 100644
--- a/salt/control/cluster/openstack_message_queue_cluster.yml
+++ b/salt/control/cluster/openstack_message_queue_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
+    openstack_message_queue_backend_image: ${_param:salt_control_trusty_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:openstack_message_queue_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               size: openstack.message_queue
             msg02:
               name: ${_param:openstack_message_queue_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               size: openstack.message_queue
             msg03:
               name: ${_param:openstack_message_queue_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               size: openstack.message_queue
diff --git a/salt/control/cluster/openstack_proxy_cluster.yml b/salt/control/cluster/openstack_proxy_cluster.yml
index 628dcd8..87a5176 100644
--- a/salt/control/cluster/openstack_proxy_cluster.yml
+++ b/salt/control/cluster/openstack_proxy_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
+    openstack_proxy_backend_image: ${_param:salt_control_trusty_image_backend}
   salt:
     control:
       size:
@@ -16,10 +19,12 @@
               name: ${_param:openstack_proxy_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_proxy_backend_image}
               size: openstack.proxy
             prx02:
               name: ${_param:openstack_proxy_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_proxy_backend_image}
               size: openstack.proxy
 
diff --git a/salt/control/cluster/openstack_proxy_single.yml b/salt/control/cluster/openstack_proxy_single.yml
index 8ad0baf..ca5c751 100644
--- a/salt/control/cluster/openstack_proxy_single.yml
+++ b/salt/control/cluster/openstack_proxy_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
+    openstack_proxy_backend_image: ${_param:salt_control_trusty_image_backend}
   salt:
     control:
       size:
@@ -16,4 +19,5 @@
               name: ${_param:openstack_proxy_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_proxy_backend_image}
               size: openstack.proxy
diff --git a/salt/control/cluster/openstack_telemetry_cluster.yml b/salt/control/cluster/openstack_telemetry_cluster.yml
index 633b984..bbf6fd1 100644
--- a/salt/control/cluster/openstack_telemetry_cluster.yml
+++ b/salt/control/cluster/openstack_telemetry_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
+    openstack_telemetry_backend_image: ${_param:salt_control_trusty_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:openstack_telemetry_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_telemetry_backend_image}
               size: openstack.telemetry
             mdb02:
               name: ${_param:openstack_telemetry_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_telemetry_backend_image}
               size: openstack.telemetry
             mdb03:
               name: ${_param:openstack_telemetry_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_trusty_image}
+              backend: ${_param:openstack_telemetry_backend_image}
               size: openstack.telemetry
diff --git a/salt/control/cluster/openstack_upgrade_single.yml b/salt/control/cluster/openstack_upgrade_single.yml
index 3189f3e..0b5e0fb 100644
--- a/salt/control/cluster/openstack_upgrade_single.yml
+++ b/salt/control/cluster/openstack_upgrade_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_upgrade_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -15,4 +18,5 @@
             upg01:
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_upgrade_backend_image}
               size: openstack.upgrade
diff --git a/salt/control/cluster/rsyslog_single.yml b/salt/control/cluster/rsyslog_single.yml
index 72e6c86..dd64869 100644
--- a/salt/control/cluster/rsyslog_single.yml
+++ b/salt/control/cluster/rsyslog_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    rsyslog_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,4 +19,5 @@
               name: ${_param:rsyslog_node01_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:rsyslog_backend_image}
               size: infra.rsyslog
diff --git a/salt/control/cluster/stacklight_log_cluster.yml b/salt/control/cluster/stacklight_log_cluster.yml
index e4c08b6..6d3dba9 100644
--- a/salt/control/cluster/stacklight_log_cluster.yml
+++ b/salt/control/cluster/stacklight_log_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    stacklight_log_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:stacklight_log_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               size: stacklight.log
             log02:
               name: ${_param:stacklight_log_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               size: stacklight.log
             log03:
               name: ${_param:stacklight_log_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               size: stacklight.log
diff --git a/salt/control/cluster/stacklight_server_cluster.yml b/salt/control/cluster/stacklight_server_cluster.yml
index 6e7da61..8ab6a9d 100644
--- a/salt/control/cluster/stacklight_server_cluster.yml
+++ b/salt/control/cluster/stacklight_server_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    stacklight_server_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:stacklight_monitor_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_server_backend_image}
               size: stacklight.server
             mon02:
               name: ${_param:stacklight_monitor_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_server_backend_image}
               size: stacklight.server
             mon03:
               name: ${_param:stacklight_monitor_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_server_backend_image}
               size: stacklight.server
diff --git a/salt/control/cluster/stacklight_telemetry_cluster.yml b/salt/control/cluster/stacklight_telemetry_cluster.yml
index 1b39b61..4a58a23 100644
--- a/salt/control/cluster/stacklight_telemetry_cluster.yml
+++ b/salt/control/cluster/stacklight_telemetry_cluster.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    stacklight_telemetry_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,14 +19,17 @@
               name: ${_param:stacklight_telemetry_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               size: stacklight.telemetry
             mtr02:
               name: ${_param:stacklight_telemetry_node02_hostname}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               size: stacklight.telemetry
             mtr03:
               name: ${_param:stacklight_telemetry_node03_hostname}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               size: stacklight.telemetry
diff --git a/salt/control/cluster/stacklight_telemetry_single.yml b/salt/control/cluster/stacklight_telemetry_single.yml
index 81fd6fb..3012dc6 100644
--- a/salt/control/cluster/stacklight_telemetry_single.yml
+++ b/salt/control/cluster/stacklight_telemetry_single.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    stacklight_telemetry_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       size:
@@ -16,4 +19,5 @@
               name: ${_param:stacklight_telemetry_node01_hostname}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               size: stacklight.telemetry
diff --git a/salt/control/placement/cicd/compact.yml b/salt/control/placement/cicd/compact.yml
index 9bdf4a4..9f700f1 100644
--- a/salt/control/placement/cicd/compact.yml
+++ b/salt/control/placement/cicd/compact.yml
@@ -6,6 +6,8 @@
     cicd_control_node01_hostname: cid01
     cicd_control_node02_hostname: cid02
     cicd_control_node03_hostname: cid03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    cicd_control_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -14,15 +16,18 @@
             cid01:
               name: ${_param:cicd_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: cicd.control
             cid02:
               name: ${_param:cicd_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: cicd.control
             cid03:
               name: ${_param:cicd_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: cicd.control
\ No newline at end of file
+              size: cicd.control
diff --git a/salt/control/placement/cicd/large.yml b/salt/control/placement/cicd/large.yml
index 9bdf4a4..9f700f1 100644
--- a/salt/control/placement/cicd/large.yml
+++ b/salt/control/placement/cicd/large.yml
@@ -6,6 +6,8 @@
     cicd_control_node01_hostname: cid01
     cicd_control_node02_hostname: cid02
     cicd_control_node03_hostname: cid03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    cicd_control_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -14,15 +16,18 @@
             cid01:
               name: ${_param:cicd_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: cicd.control
             cid02:
               name: ${_param:cicd_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: cicd.control
             cid03:
               name: ${_param:cicd_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: cicd.control
\ No newline at end of file
+              size: cicd.control
diff --git a/salt/control/placement/cicd/medium.yml b/salt/control/placement/cicd/medium.yml
index 9bdf4a4..9f700f1 100644
--- a/salt/control/placement/cicd/medium.yml
+++ b/salt/control/placement/cicd/medium.yml
@@ -6,6 +6,8 @@
     cicd_control_node01_hostname: cid01
     cicd_control_node02_hostname: cid02
     cicd_control_node03_hostname: cid03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    cicd_control_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -14,15 +16,18 @@
             cid01:
               name: ${_param:cicd_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: cicd.control
             cid02:
               name: ${_param:cicd_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: cicd.control
             cid03:
               name: ${_param:cicd_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: cicd.control
\ No newline at end of file
+              size: cicd.control
diff --git a/salt/control/placement/cicd/minimal.yml b/salt/control/placement/cicd/minimal.yml
index 9bdf4a4..9f700f1 100644
--- a/salt/control/placement/cicd/minimal.yml
+++ b/salt/control/placement/cicd/minimal.yml
@@ -6,6 +6,8 @@
     cicd_control_node01_hostname: cid01
     cicd_control_node02_hostname: cid02
     cicd_control_node03_hostname: cid03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    cicd_control_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -14,15 +16,18 @@
             cid01:
               name: ${_param:cicd_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: cicd.control
             cid02:
               name: ${_param:cicd_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: cicd.control
             cid03:
               name: ${_param:cicd_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: cicd.control
\ No newline at end of file
+              size: cicd.control
diff --git a/salt/control/placement/cicd/small.yml b/salt/control/placement/cicd/small.yml
index 9bdf4a4..9f700f1 100644
--- a/salt/control/placement/cicd/small.yml
+++ b/salt/control/placement/cicd/small.yml
@@ -6,6 +6,8 @@
     cicd_control_node01_hostname: cid01
     cicd_control_node02_hostname: cid02
     cicd_control_node03_hostname: cid03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    cicd_control_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -14,15 +16,18 @@
             cid01:
               name: ${_param:cicd_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: cicd.control
             cid02:
               name: ${_param:cicd_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: cicd.control
             cid03:
               name: ${_param:cicd_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:cicd_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: cicd.control
\ No newline at end of file
+              size: cicd.control
diff --git a/salt/control/placement/opencontrail/compact.yml b/salt/control/placement/opencontrail/compact.yml
index a619956..584b65e 100644
--- a/salt/control/placement/opencontrail/compact.yml
+++ b/salt/control/placement/opencontrail/compact.yml
@@ -9,6 +9,9 @@
     opencontrail_analytics_node01_hostname: nal01
     opencontrail_analytics_node02_hostname: nal02
     opencontrail_analytics_node03_hostname: nal03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    opencontrail_control_backend_image: ${_param:salt_control_xenial_image_backend}
+    opencontrail_analytics_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -17,30 +20,36 @@
             ntw01:
               name: ${_param:opencontrail_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             ntw02:
               name: ${_param:opencontrail_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             ntw03:
               name: ${_param:opencontrail_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             nal01:
               name: ${_param:opencontrail_analytics_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: opencontrail.analytics
             nal02:
               name: ${_param:opencontrail_analytics_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: opencontrail.analytics
             nal03:
               name: ${_param:opencontrail_analytics_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: opencontrail.analytics
\ No newline at end of file
+              size: opencontrail.analytics
diff --git a/salt/control/placement/opencontrail/large.yml b/salt/control/placement/opencontrail/large.yml
index 1aabd0d..d7e662c 100644
--- a/salt/control/placement/opencontrail/large.yml
+++ b/salt/control/placement/opencontrail/large.yml
@@ -9,6 +9,9 @@
     opencontrail_analytics_node01_hostname: nal01
     opencontrail_analytics_node02_hostname: nal02
     opencontrail_analytics_node03_hostname: nal03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    opencontrail_control_backend_image: ${_param:salt_control_xenial_image_backend}
+    opencontrail_analytics_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -17,30 +20,36 @@
             ntw01:
               name: ${_param:opencontrail_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node10_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             ntw02:
               name: ${_param:opencontrail_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node11_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             ntw03:
               name: ${_param:opencontrail_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node12_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             nal01:
               name: ${_param:opencontrail_analytics_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node10_hostname}.${_param:cluster_domain}
               size: opencontrail.analytics
             nal02:
               name: ${_param:opencontrail_analytics_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node11_hostname}.${_param:cluster_domain}
               size: opencontrail.analytics
             nal03:
               name: ${_param:opencontrail_analytics_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node12_hostname}.${_param:cluster_domain}
-              size: opencontrail.analytics
\ No newline at end of file
+              size: opencontrail.analytics
diff --git a/salt/control/placement/opencontrail/medium.yml b/salt/control/placement/opencontrail/medium.yml
index dfc32f3..448cd23 100644
--- a/salt/control/placement/opencontrail/medium.yml
+++ b/salt/control/placement/opencontrail/medium.yml
@@ -9,6 +9,9 @@
     opencontrail_analytics_node01_hostname: nal01
     opencontrail_analytics_node02_hostname: nal02
     opencontrail_analytics_node03_hostname: nal03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    opencontrail_control_backend_image: ${_param:salt_control_xenial_image_backend}
+    opencontrail_analytics_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -17,30 +20,36 @@
             ntw01:
               name: ${_param:opencontrail_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node07_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             ntw02:
               name: ${_param:opencontrail_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node08_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             ntw03:
               name: ${_param:opencontrail_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node09_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             nal01:
               name: ${_param:opencontrail_analytics_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node07_hostname}.${_param:cluster_domain}
               size: opencontrail.analytics
             nal02:
               name: ${_param:opencontrail_analytics_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node08_hostname}.${_param:cluster_domain}
               size: opencontrail.analytics
             nal03:
               name: ${_param:opencontrail_analytics_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node09_hostname}.${_param:cluster_domain}
-              size: opencontrail.analytics
\ No newline at end of file
+              size: opencontrail.analytics
diff --git a/salt/control/placement/opencontrail/minimal.yml b/salt/control/placement/opencontrail/minimal.yml
index a619956..584b65e 100644
--- a/salt/control/placement/opencontrail/minimal.yml
+++ b/salt/control/placement/opencontrail/minimal.yml
@@ -9,6 +9,9 @@
     opencontrail_analytics_node01_hostname: nal01
     opencontrail_analytics_node02_hostname: nal02
     opencontrail_analytics_node03_hostname: nal03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    opencontrail_control_backend_image: ${_param:salt_control_xenial_image_backend}
+    opencontrail_analytics_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -17,30 +20,36 @@
             ntw01:
               name: ${_param:opencontrail_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             ntw02:
               name: ${_param:opencontrail_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             ntw03:
               name: ${_param:opencontrail_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             nal01:
               name: ${_param:opencontrail_analytics_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: opencontrail.analytics
             nal02:
               name: ${_param:opencontrail_analytics_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: opencontrail.analytics
             nal03:
               name: ${_param:opencontrail_analytics_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: opencontrail.analytics
\ No newline at end of file
+              size: opencontrail.analytics
diff --git a/salt/control/placement/opencontrail/small.yml b/salt/control/placement/opencontrail/small.yml
index a619956..584b65e 100644
--- a/salt/control/placement/opencontrail/small.yml
+++ b/salt/control/placement/opencontrail/small.yml
@@ -9,6 +9,9 @@
     opencontrail_analytics_node01_hostname: nal01
     opencontrail_analytics_node02_hostname: nal02
     opencontrail_analytics_node03_hostname: nal03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    opencontrail_control_backend_image: ${_param:salt_control_xenial_image_backend}
+    opencontrail_analytics_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -17,30 +20,36 @@
             ntw01:
               name: ${_param:opencontrail_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             ntw02:
               name: ${_param:opencontrail_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             ntw03:
               name: ${_param:opencontrail_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: opencontrail.control
             nal01:
               name: ${_param:opencontrail_analytics_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: opencontrail.analytics
             nal02:
               name: ${_param:opencontrail_analytics_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: opencontrail.analytics
             nal03:
               name: ${_param:opencontrail_analytics_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:opencontrail_analytics_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: opencontrail.analytics
\ No newline at end of file
+              size: opencontrail.analytics
diff --git a/salt/control/placement/openstack/compact.yml b/salt/control/placement/openstack/compact.yml
index 8c62e28..83f2254 100644
--- a/salt/control/placement/openstack/compact.yml
+++ b/salt/control/placement/openstack/compact.yml
@@ -14,6 +14,11 @@
     openstack_message_queue_node03_hostname: msg03
     openstack_proxy_node01_hostname: prx01
     openstack_proxy_node02_hostname: prx02
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_control_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_database_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_message_queue_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_proxy_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -22,55 +27,66 @@
             ctl01:
               name: ${_param:openstack_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.control
             ctl02:
               name: ${_param:openstack_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.control
             ctl03:
               name: ${_param:openstack_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.control
             dbs01:
               name: ${_param:openstack_database_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.database
             dbs02:
               name: ${_param:openstack_database_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.database
             dbs03:
               name: ${_param:openstack_database_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.database
             msg01:
               name: ${_param:openstack_message_queue_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             msg02:
               name: ${_param:openstack_message_queue_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             msg03:
               name: ${_param:openstack_message_queue_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             prx01:
               name: ${_param:openstack_proxy_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_proxy_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.proxy
             prx02:
               name: ${_param:openstack_proxy_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_proxy_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.proxy
diff --git a/salt/control/placement/openstack/large.yml b/salt/control/placement/openstack/large.yml
index cb056dd..f09d3f6 100644
--- a/salt/control/placement/openstack/large.yml
+++ b/salt/control/placement/openstack/large.yml
@@ -21,6 +21,11 @@
     openstack_message_queue_node03_hostname: msg03
     openstack_proxy_node01_hostname: prx01
     openstack_proxy_node02_hostname: prx02
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_control_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_database_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_message_queue_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_proxy_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -29,65 +34,78 @@
             ctl01:
               name: ${_param:openstack_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.control
             ctl02:
               name: ${_param:openstack_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.control
             ctl03:
               name: ${_param:openstack_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node04_hostname}.${_param:cluster_domain}
               size: openstack.control
             ctl04:
               name: ${_param:openstack_control_node04_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node05_hostname}.${_param:cluster_domain}
               size: openstack.control
             ctl05:
               name: ${_param:openstack_control_node05_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node06_hostname}.${_param:cluster_domain}
               size: openstack.control
             dbs01:
               name: ${_param:openstack_database_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node04_hostname}.${_param:cluster_domain}
               size: openstack.database
             dbs02:
               name: ${_param:openstack_database_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node05_hostname}.${_param:cluster_domain}
               size: openstack.database
             dbs03:
               name: ${_param:openstack_database_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node06_hostname}.${_param:cluster_domain}
               size: openstack.database
             msg01:
               name: ${_param:openstack_message_queue_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node07_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             msg02:
               name: ${_param:openstack_message_queue_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node08_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             msg03:
               name: ${_param:openstack_message_queue_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node09_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             prx01:
               name: ${_param:openstack_proxy_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_proxy_backend_image}
               provider: ${_param:infra_kvm_node07_hostname}.${_param:cluster_domain}
               size: openstack.proxy
             prx02:
               name: ${_param:openstack_proxy_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_proxy_backend_image}
               provider: ${_param:infra_kvm_node08_hostname}.${_param:cluster_domain}
               size: openstack.proxy
diff --git a/salt/control/placement/openstack/medium.yml b/salt/control/placement/openstack/medium.yml
index 7d0e166..2419c74 100644
--- a/salt/control/placement/openstack/medium.yml
+++ b/salt/control/placement/openstack/medium.yml
@@ -17,6 +17,11 @@
     openstack_message_queue_node03_hostname: msg03
     openstack_proxy_node01_hostname: prx01
     openstack_proxy_node02_hostname: prx02
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_control_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_database_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_message_queue_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_proxy_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -25,55 +30,66 @@
             ctl01:
               name: ${_param:openstack_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.control
             ctl02:
               name: ${_param:openstack_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.control
             ctl03:
               name: ${_param:openstack_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.control
             dbs01:
               name: ${_param:openstack_database_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.database
             dbs02:
               name: ${_param:openstack_database_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.database
             dbs03:
               name: ${_param:openstack_database_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.database
             msg01:
               name: ${_param:openstack_message_queue_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node04_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             msg02:
               name: ${_param:openstack_message_queue_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node05_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             msg03:
               name: ${_param:openstack_message_queue_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node06_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             prx01:
               name: ${_param:openstack_proxy_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_proxy_backend_image}
               provider: ${_param:infra_kvm_node04_hostname}.${_param:cluster_domain}
               size: openstack.proxy
             prx02:
               name: ${_param:openstack_proxy_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_proxy_backend_image}
               provider: ${_param:infra_kvm_node05_hostname}.${_param:cluster_domain}
               size: openstack.proxy
diff --git a/salt/control/placement/openstack/minimal.yml b/salt/control/placement/openstack/minimal.yml
index 8c62e28..83f2254 100644
--- a/salt/control/placement/openstack/minimal.yml
+++ b/salt/control/placement/openstack/minimal.yml
@@ -14,6 +14,11 @@
     openstack_message_queue_node03_hostname: msg03
     openstack_proxy_node01_hostname: prx01
     openstack_proxy_node02_hostname: prx02
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_control_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_database_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_message_queue_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_proxy_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -22,55 +27,66 @@
             ctl01:
               name: ${_param:openstack_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.control
             ctl02:
               name: ${_param:openstack_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.control
             ctl03:
               name: ${_param:openstack_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.control
             dbs01:
               name: ${_param:openstack_database_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.database
             dbs02:
               name: ${_param:openstack_database_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.database
             dbs03:
               name: ${_param:openstack_database_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.database
             msg01:
               name: ${_param:openstack_message_queue_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             msg02:
               name: ${_param:openstack_message_queue_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             msg03:
               name: ${_param:openstack_message_queue_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             prx01:
               name: ${_param:openstack_proxy_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_proxy_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.proxy
             prx02:
               name: ${_param:openstack_proxy_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_proxy_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.proxy
diff --git a/salt/control/placement/openstack/small.yml b/salt/control/placement/openstack/small.yml
index 8c62e28..83f2254 100644
--- a/salt/control/placement/openstack/small.yml
+++ b/salt/control/placement/openstack/small.yml
@@ -14,6 +14,11 @@
     openstack_message_queue_node03_hostname: msg03
     openstack_proxy_node01_hostname: prx01
     openstack_proxy_node02_hostname: prx02
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_control_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_database_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_message_queue_backend_image: ${_param:salt_control_xenial_image_backend}
+    openstack_proxy_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -22,55 +27,66 @@
             ctl01:
               name: ${_param:openstack_control_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.control
             ctl02:
               name: ${_param:openstack_control_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.control
             ctl03:
               name: ${_param:openstack_control_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_control_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.control
             dbs01:
               name: ${_param:openstack_database_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.database
             dbs02:
               name: ${_param:openstack_database_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.database
             dbs03:
               name: ${_param:openstack_database_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_database_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.database
             msg01:
               name: ${_param:openstack_message_queue_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             msg02:
               name: ${_param:openstack_message_queue_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             msg03:
               name: ${_param:openstack_message_queue_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_message_queue_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.message_queue
             prx01:
               name: ${_param:openstack_proxy_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_proxy_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.proxy
             prx02:
               name: ${_param:openstack_proxy_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_proxy_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: openstack.proxy
diff --git a/salt/control/placement/ovs/compact.yml b/salt/control/placement/ovs/compact.yml
index 3102b3e..de0569c 100644
--- a/salt/control/placement/ovs/compact.yml
+++ b/salt/control/placement/ovs/compact.yml
@@ -6,6 +6,8 @@
     openstack_gateway_node01_hostname: gtw01
     openstack_gateway_node02_hostname: gtw02
     openstack_gateway_node03_hostname: gtw03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_gateway_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -14,15 +16,18 @@
             gtw01:
               name: ${_param:openstack_gateway_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.gateway
             gtw02:
               name: ${_param:openstack_gateway_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.gateway
             gtw03:
               name: ${_param:openstack_gateway_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: openstack.gateway
\ No newline at end of file
+              size: openstack.gateway
diff --git a/salt/control/placement/ovs/minimal.yml b/salt/control/placement/ovs/minimal.yml
index 3102b3e..de0569c 100644
--- a/salt/control/placement/ovs/minimal.yml
+++ b/salt/control/placement/ovs/minimal.yml
@@ -6,6 +6,8 @@
     openstack_gateway_node01_hostname: gtw01
     openstack_gateway_node02_hostname: gtw02
     openstack_gateway_node03_hostname: gtw03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_gateway_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -14,15 +16,18 @@
             gtw01:
               name: ${_param:openstack_gateway_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.gateway
             gtw02:
               name: ${_param:openstack_gateway_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.gateway
             gtw03:
               name: ${_param:openstack_gateway_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: openstack.gateway
\ No newline at end of file
+              size: openstack.gateway
diff --git a/salt/control/placement/ovs/small.yml b/salt/control/placement/ovs/small.yml
index 3102b3e..de0569c 100644
--- a/salt/control/placement/ovs/small.yml
+++ b/salt/control/placement/ovs/small.yml
@@ -6,6 +6,8 @@
     openstack_gateway_node01_hostname: gtw01
     openstack_gateway_node02_hostname: gtw02
     openstack_gateway_node03_hostname: gtw03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    openstack_gateway_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -14,15 +16,18 @@
             gtw01:
               name: ${_param:openstack_gateway_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: openstack.gateway
             gtw02:
               name: ${_param:openstack_gateway_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: openstack.gateway
             gtw03:
               name: ${_param:openstack_gateway_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:openstack_gateway_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: openstack.gateway
\ No newline at end of file
+              size: openstack.gateway
diff --git a/salt/control/placement/stacklight/compact.yml b/salt/control/placement/stacklight/compact.yml
index 2cde570..e03ea85 100644
--- a/salt/control/placement/stacklight/compact.yml
+++ b/salt/control/placement/stacklight/compact.yml
@@ -12,6 +12,10 @@
     stacklight_telemetry_node01_hostname: mtr01
     stacklight_telemetry_node02_hostname: mtr02
     stacklight_telemetry_node03_hostname: mtr03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    stacklight_log_backend_image: ${_param:salt_control_xenial_image_backend}
+    stacklight_monitor_backend_image: ${_param:salt_control_xenial_image_backend}
+    stacklight_telemetry_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -20,45 +24,54 @@
             mtr01:
               name: ${_param:stacklight_telemetry_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             mtr02:
               name: ${_param:stacklight_telemetry_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             mtr03:
               name: ${_param:stacklight_telemetry_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             log01:
               name: ${_param:stacklight_log_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: stacklight.log
             log02:
               name: ${_param:stacklight_log_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: stacklight.log
             log03:
               name: ${_param:stacklight_log_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: stacklight.log
             mon01:
               name: ${_param:stacklight_monitor_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: stacklight.server
             mon02:
               name: ${_param:stacklight_monitor_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: stacklight.server
             mon03:
               name: ${_param:stacklight_monitor_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: stacklight.server
\ No newline at end of file
+              size: stacklight.server
diff --git a/salt/control/placement/stacklight/large.yml b/salt/control/placement/stacklight/large.yml
index 7b380d8..7b1f716 100644
--- a/salt/control/placement/stacklight/large.yml
+++ b/salt/control/placement/stacklight/large.yml
@@ -12,6 +12,10 @@
     stacklight_telemetry_node01_hostname: mtr01
     stacklight_telemetry_node02_hostname: mtr02
     stacklight_telemetry_node03_hostname: mtr03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    stacklight_log_backend_image: ${_param:salt_control_xenial_image_backend}
+    stacklight_monitor_backend_image: ${_param:salt_control_xenial_image_backend}
+    stacklight_telemetry_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -20,45 +24,54 @@
             mtr01:
               name: ${_param:stacklight_telemetry_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node13_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             mtr02:
               name: ${_param:stacklight_telemetry_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node14_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             mtr03:
               name: ${_param:stacklight_telemetry_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node15_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             log01:
               name: ${_param:stacklight_log_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node13_hostname}.${_param:cluster_domain}
               size: stacklight.log
             log02:
               name: ${_param:stacklight_log_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node14_hostname}.${_param:cluster_domain}
               size: stacklight.log
             log03:
               name: ${_param:stacklight_log_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node15_hostname}.${_param:cluster_domain}
               size: stacklight.log
             mon01:
               name: ${_param:stacklight_monitor_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node13_hostname}.${_param:cluster_domain}
               size: stacklight.server
             mon02:
               name: ${_param:stacklight_monitor_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node14_hostname}.${_param:cluster_domain}
               size: stacklight.server
             mon03:
               name: ${_param:stacklight_monitor_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node15_hostname}.${_param:cluster_domain}
-              size: stacklight.server
\ No newline at end of file
+              size: stacklight.server
diff --git a/salt/control/placement/stacklight/medium.yml b/salt/control/placement/stacklight/medium.yml
index 7f54f4d..a9643fe 100644
--- a/salt/control/placement/stacklight/medium.yml
+++ b/salt/control/placement/stacklight/medium.yml
@@ -12,6 +12,10 @@
     stacklight_telemetry_node01_hostname: mtr01
     stacklight_telemetry_node02_hostname: mtr02
     stacklight_telemetry_node03_hostname: mtr03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    stacklight_log_backend_image: ${_param:salt_control_xenial_image_backend}
+    stacklight_monitor_backend_image: ${_param:salt_control_xenial_image_backend}
+    stacklight_telemetry_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -20,45 +24,54 @@
             mtr01:
               name: ${_param:stacklight_telemetry_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node10_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             mtr02:
               name: ${_param:stacklight_telemetry_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node11_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             mtr03:
               name: ${_param:stacklight_telemetry_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node12_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             log01:
               name: ${_param:stacklight_log_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node10_hostname}.${_param:cluster_domain}
               size: stacklight.log
-            lop02:
+            log02:
               name: ${_param:stacklight_log_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node11_hostname}.${_param:cluster_domain}
               size: stacklight.log
             log03:
               name: ${_param:stacklight_log_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node12_hostname}.${_param:cluster_domain}
               size: stacklight.log
             mon01:
               name: ${_param:stacklight_monitor_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node10_hostname}.${_param:cluster_domain}
               size: stacklight.server
             mon02:
               name: ${_param:stacklight_monitor_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node11_hostname}.${_param:cluster_domain}
               size: stacklight.server
             mon03:
               name: ${_param:stacklight_monitor_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node12_hostname}.${_param:cluster_domain}
-              size: stacklight.server
\ No newline at end of file
+              size: stacklight.server
diff --git a/salt/control/placement/stacklight/minimal.yml b/salt/control/placement/stacklight/minimal.yml
index 2cde570..e03ea85 100644
--- a/salt/control/placement/stacklight/minimal.yml
+++ b/salt/control/placement/stacklight/minimal.yml
@@ -12,6 +12,10 @@
     stacklight_telemetry_node01_hostname: mtr01
     stacklight_telemetry_node02_hostname: mtr02
     stacklight_telemetry_node03_hostname: mtr03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    stacklight_log_backend_image: ${_param:salt_control_xenial_image_backend}
+    stacklight_monitor_backend_image: ${_param:salt_control_xenial_image_backend}
+    stacklight_telemetry_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -20,45 +24,54 @@
             mtr01:
               name: ${_param:stacklight_telemetry_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             mtr02:
               name: ${_param:stacklight_telemetry_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             mtr03:
               name: ${_param:stacklight_telemetry_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             log01:
               name: ${_param:stacklight_log_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: stacklight.log
             log02:
               name: ${_param:stacklight_log_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: stacklight.log
             log03:
               name: ${_param:stacklight_log_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
               size: stacklight.log
             mon01:
               name: ${_param:stacklight_monitor_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
               size: stacklight.server
             mon02:
               name: ${_param:stacklight_monitor_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node02_hostname}.${_param:cluster_domain}
               size: stacklight.server
             mon03:
               name: ${_param:stacklight_monitor_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node03_hostname}.${_param:cluster_domain}
-              size: stacklight.server
\ No newline at end of file
+              size: stacklight.server
diff --git a/salt/control/placement/stacklight/small.yml b/salt/control/placement/stacklight/small.yml
index e16a7cb..fec0fbf 100644
--- a/salt/control/placement/stacklight/small.yml
+++ b/salt/control/placement/stacklight/small.yml
@@ -12,6 +12,10 @@
     stacklight_telemetry_node01_hostname: mtr01
     stacklight_telemetry_node02_hostname: mtr02
     stacklight_telemetry_node03_hostname: mtr03
+    salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
+    stacklight_log_backend_image: ${_param:salt_control_xenial_image_backend}
+    stacklight_monitor_backend_image: ${_param:salt_control_xenial_image_backend}
+    stacklight_telemetry_backend_image: ${_param:salt_control_xenial_image_backend}
   salt:
     control:
       cluster:
@@ -20,45 +24,54 @@
             mtr01:
               name: ${_param:stacklight_telemetry_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node04_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             mtr02:
               name: ${_param:stacklight_telemetry_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node05_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             mtr03:
               name: ${_param:stacklight_telemetry_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_telemetry_backend_image}
               provider: ${_param:infra_kvm_node06_hostname}.${_param:cluster_domain}
               size: stacklight.telemetry
             log01:
               name: ${_param:stacklight_log_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node04_hostname}.${_param:cluster_domain}
               size: stacklight.log
             log02:
               name: ${_param:stacklight_log_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node05_hostname}.${_param:cluster_domain}
               size: stacklight.log
             log03:
               name: ${_param:stacklight_log_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_log_backend_image}
               provider: ${_param:infra_kvm_node06_hostname}.${_param:cluster_domain}
               size: stacklight.log
             mon01:
               name: ${_param:stacklight_monitor_node01_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node04_hostname}.${_param:cluster_domain}
               size: stacklight.server
             mon02:
               name: ${_param:stacklight_monitor_node02_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node05_hostname}.${_param:cluster_domain}
               size: stacklight.server
             mon03:
               name: ${_param:stacklight_monitor_node03_hostname}
               image: ${_param:salt_control_xenial_image}
+              backend: ${_param:stacklight_monitor_backend_image}
               provider: ${_param:infra_kvm_node06_hostname}.${_param:cluster_domain}
-              size: stacklight.server
\ No newline at end of file
+              size: stacklight.server
diff --git a/salt/master/formula/git/openscap.yml b/salt/master/formula/git/openscap.yml
new file mode 100644
index 0000000..a091ffe
--- /dev/null
+++ b/salt/master/formula/git/openscap.yml
@@ -0,0 +1,10 @@
+parameters:
+  salt:
+    master:
+      environment:
+        dev:
+          formula:
+            openscap:
+              source: git
+              address: '${_param:salt_master_environment_repository}/salt-formula-openscap.git'
+              revision: ${_param:salt_master_environment_revision}
diff --git a/salt/master/formula/pkg/openscap.yml b/salt/master/formula/pkg/openscap.yml
new file mode 100644
index 0000000..ebb6e86
--- /dev/null
+++ b/salt/master/formula/pkg/openscap.yml
@@ -0,0 +1,9 @@
+parameters:
+  salt:
+    master:
+      environment:
+        prd:
+          formula:
+            openscap:
+              source: pkg
+              name: salt-formula-openscap
diff --git a/salt/minion/cert/mysql/clients/openstack/barbican.yml b/salt/minion/cert/mysql/clients/openstack/barbican.yml
new file mode 100644
index 0000000..8d158ee
--- /dev/null
+++ b/salt/minion/cert/mysql/clients/openstack/barbican.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    mysql_barbican_client_ssl_key_file: /etc/barbican/ssl/mysql/client-key.pem
+    mysql_barbican_client_ssl_cert_file: /etc/barbican/ssl/mysql/client-cert.pem
+    mysql_barbican_ssl_ca_file: /etc/barbican/ssl/mysql/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        mysql-barbican-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: mysql-barbican-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:mysql_barbican_client_ssl_key_file}
+          cert_file: ${_param:mysql_barbican_client_ssl_cert_file}
+          ca_file: ${_param:mysql_barbican_ssl_ca_file}
+          user: barbican
+          group: barbican
+          mode: 640
diff --git a/salt/minion/cert/mysql/clients/openstack/gnocchi.yml b/salt/minion/cert/mysql/clients/openstack/gnocchi.yml
new file mode 100644
index 0000000..1aa31c9
--- /dev/null
+++ b/salt/minion/cert/mysql/clients/openstack/gnocchi.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    mysql_gnocchi_client_ssl_key_file: /etc/gnocchi/ssl/mysql/client-key.pem
+    mysql_gnocchi_client_ssl_cert_file: /etc/gnocchi/ssl/mysql/client-cert.pem
+    mysql_gnocchi_ssl_ca_file: /etc/gnocchi/ssl/mysql/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        mysql-gnocchi-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: mysql-gnocchi-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:mysql_gnocchi_client_ssl_key_file}
+          cert_file: ${_param:mysql_gnocchi_client_ssl_cert_file}
+          ca_file: ${_param:mysql_gnocchi_ssl_ca_file}
+          user: gnocchi
+          group: gnocchi
+          mode: 640
diff --git a/salt/minion/cert/mysql/clients/openstack/ironic.yml b/salt/minion/cert/mysql/clients/openstack/ironic.yml
new file mode 100644
index 0000000..fe4aa19
--- /dev/null
+++ b/salt/minion/cert/mysql/clients/openstack/ironic.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    mysql_ironic_client_ssl_key_file: /etc/ironic/ssl/mysql/client-key.pem
+    mysql_ironic_client_ssl_cert_file: /etc/ironic/ssl/mysql/client-cert.pem
+    mysql_ironic_ssl_ca_file: /etc/ironic/ssl/mysql/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        mysql-ironic-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: mysql-ironic-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:mysql_ironic_client_ssl_key_file}
+          cert_file: ${_param:mysql_ironic_client_ssl_cert_file}
+          ca_file: ${_param:mysql_ironic_ssl_ca_file}
+          user: ironic
+          group: ironic
+          mode: 640
diff --git a/salt/minion/cert/mysql/clients/openstack/manila.yml b/salt/minion/cert/mysql/clients/openstack/manila.yml
new file mode 100644
index 0000000..a1ca797
--- /dev/null
+++ b/salt/minion/cert/mysql/clients/openstack/manila.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    mysql_manila_client_ssl_key_file: /etc/manila/ssl/mysql/client-key.pem
+    mysql_manila_client_ssl_cert_file: /etc/manila/ssl/mysql/client-cert.pem
+    mysql_manila_ssl_ca_file: /etc/manila/ssl/mysql/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        mysql-manila-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: mysql-manila-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:mysql_manila_client_ssl_key_file}
+          cert_file: ${_param:mysql_manila_client_ssl_cert_file}
+          ca_file: ${_param:mysql_manila_ssl_ca_file}
+          user: manila
+          group: manila
+          mode: 640
diff --git a/salt/minion/cert/mysql/clients/openstack/panko.yml b/salt/minion/cert/mysql/clients/openstack/panko.yml
new file mode 100644
index 0000000..0593ae2
--- /dev/null
+++ b/salt/minion/cert/mysql/clients/openstack/panko.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    mysql_panko_client_ssl_key_file: /etc/panko/ssl/mysql/client-key.pem
+    mysql_panko_client_ssl_cert_file: /etc/panko/ssl/mysql/client-cert.pem
+    mysql_panko_ssl_ca_file: /etc/panko/ssl/mysql/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        mysql-panko-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: mysql-panko-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:mysql_panko_client_ssl_key_file}
+          cert_file: ${_param:mysql_panko_client_ssl_cert_file}
+          ca_file: ${_param:mysql_panko_ssl_ca_file}
+          user: panko
+          group: panko
+          mode: 640
diff --git a/salt/minion/cert/rabbitmq/clients/openstack/cinder.yml b/salt/minion/cert/rabbitmq/clients/openstack/cinder.yml
new file mode 100644
index 0000000..576c135
--- /dev/null
+++ b/salt/minion/cert/rabbitmq/clients/openstack/cinder.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    rabbitmq_cinder_client_ssl_key_file: /etc/cinder/ssl/rabbitmq/client-key.pem
+    rabbitmq_cinder_client_ssl_cert_file: /etc/cinder/ssl/rabbitmq/client-cert.pem
+    rabbitmq_cinder_ssl_ca_file: /etc/cinder/ssl/rabbitmq/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        rabbitmq-cinder-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: rabbitmq-cinder-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:rabbitmq_cinder_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_cinder_client_ssl_cert_file}
+          ca_file: ${_param:rabbitmq_cinder_ssl_ca_file}
+          user: cinder
+          group: cinder
+          mode: 640
diff --git a/salt/minion/cert/rabbitmq/clients/openstack/glance.yml b/salt/minion/cert/rabbitmq/clients/openstack/glance.yml
new file mode 100644
index 0000000..94749ae
--- /dev/null
+++ b/salt/minion/cert/rabbitmq/clients/openstack/glance.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    rabbitmq_glance_client_ssl_key_file: /etc/glance/ssl/rabbitmq/client-key.pem
+    rabbitmq_glance_client_ssl_cert_file: /etc/glance/ssl/rabbitmq/client-cert.pem
+    rabbitmq_glance_ssl_ca_file: /etc/glance/ssl/rabbitmq/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        rabbitmq-glance-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: rabbitmq-glance-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:rabbitmq_glance_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_glance_client_ssl_cert_file}
+          ca_file: ${_param:rabbitmq_glance_ssl_ca_file}
+          user: glance
+          group: glance
+          mode: 640
diff --git a/salt/minion/cert/rabbitmq/clients/openstack/heat.yml b/salt/minion/cert/rabbitmq/clients/openstack/heat.yml
new file mode 100644
index 0000000..e69ab14
--- /dev/null
+++ b/salt/minion/cert/rabbitmq/clients/openstack/heat.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    rabbitmq_heat_client_ssl_key_file: /etc/heat/ssl/rabbitmq/client-key.pem
+    rabbitmq_heat_client_ssl_cert_file: /etc/heat/ssl/rabbitmq/client-cert.pem
+    rabbitmq_heat_ssl_ca_file: /etc/heat/ssl/rabbitmq/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        rabbitmq-heat-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: rabbitmq-heat-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:rabbitmq_heat_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_heat_client_ssl_cert_file}
+          ca_file: ${_param:rabbitmq_heat_ssl_ca_file}
+          user: heat
+          group: heat
+          mode: 640
diff --git a/salt/minion/cert/rabbitmq/clients/openstack/keystone.yml b/salt/minion/cert/rabbitmq/clients/openstack/keystone.yml
new file mode 100644
index 0000000..8261f73
--- /dev/null
+++ b/salt/minion/cert/rabbitmq/clients/openstack/keystone.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    rabbitmq_keystone_client_ssl_key_file: /etc/keystone/ssl/rabbitmq/client-key.pem
+    rabbitmq_keystone_client_ssl_cert_file: /etc/keystone/ssl/rabbitmq/client-cert.pem
+    rabbitmq_keystone_ssl_ca_file: /etc/keystone/ssl/rabbitmq/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        rabbitmq-keystone-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: rabbitmq-keystone-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:rabbitmq_keystone_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_keystone_client_ssl_cert_file}
+          ca_file: ${_param:rabbitmq_keystone_ssl_ca_file}
+          user: keystone
+          group: keystone
+          mode: 640