diff --git a/ceph/rgw/keystone.yml b/ceph/rgw/keystone.yml
index 4340d62..01eda59 100644
--- a/ceph/rgw/keystone.yml
+++ b/ceph/rgw/keystone.yml
@@ -18,3 +18,4 @@
         tenant: ${_param:ceph_radosgw_keystone_project}
         project: ${_param:ceph_radosgw_keystone_project}
         domain: ${_param:ceph_radosgw_keystone_domain}
+        protocol: ${_param:cluster_internal_protocol}
diff --git a/debmirror/mirror_mirantis_com/elasticsearch-5.x/xenial.yml b/debmirror/mirror_mirantis_com/elasticsearch-5.x/xenial.yml
index 7fdb6d7..97d2cd3 100644
--- a/debmirror/mirror_mirantis_com/elasticsearch-5.x/xenial.yml
+++ b/debmirror/mirror_mirantis_com/elasticsearch-5.x/xenial.yml
@@ -17,5 +17,5 @@
           dist: [ stable ]
           section: [ main ]
           filter:
-            # drop all versions below 5.6.11
-            001: --exclude='(_|-)5\.([0-5]\.|6\.([0-9]|10)(-|\.))'
+            # drop all versions below 5.6.12
+            001: --exclude='(_|-)5\.([0-5]\.|6\.([0-9]|10|11)(-|\.))'
diff --git a/debmirror/mirror_mirantis_com/elasticsearch-6.x/xenial.yml b/debmirror/mirror_mirantis_com/elasticsearch-6.x/xenial.yml
new file mode 100644
index 0000000..2c60c82
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/elasticsearch-6.x/xenial.yml
@@ -0,0 +1,22 @@
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_elasticsearch_6_x_xenial:
+          enabled: true
+          force: ${_param:mirror_mirantis_com_elasticsearch_6_x_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "rsync"
+          arch: [ 'amd64' ]
+          mirror_host: "mirror.mirantis.com"
+          mirror_root: ":mirror/${_param:mcp_version}/elasticsearch-6.x/xenial/"
+          target_dir: "${_param:debmirror_mirrors_base_target_dir}/elasticsearch-6.x/xenial/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_elasticsearch_6_x_xenial.log"
+          dist: [ stable ]
+          section: [ main ]
+          filter:
+#            # drop all versions below 6.5.2
+            001: --exclude='(_|-)6\.([0-4]\.|[0-5]\.[0-1])'
+
diff --git a/debmirror/mirror_mirantis_com/extra/xenial.yml b/debmirror/mirror_mirantis_com/extra/xenial.yml
index 9fec707..f5ed991 100644
--- a/debmirror/mirror_mirantis_com/extra/xenial.yml
+++ b/debmirror/mirror_mirantis_com/extra/xenial.yml
@@ -15,3 +15,5 @@
           log_file: "/var/log/debmirror/mirror_mirantis_com_extra_xenial.log"
           dist: [ xenial ]
           section: [ main ]
+          filter:
+            001: --exclude='(-|_)dbg(_|-)'
diff --git a/debmirror/mirror_mirantis_com/init.yml b/debmirror/mirror_mirantis_com/init.yml
index bf7858a..68f7530 100644
--- a/debmirror/mirror_mirantis_com/init.yml
+++ b/debmirror/mirror_mirantis_com/init.yml
@@ -3,6 +3,7 @@
 - system.debmirror.mirror_mirantis_com.ceph-luminous.xenial
 - system.debmirror.mirror_mirantis_com.docker.xenial
 - system.debmirror.mirror_mirantis_com.elasticsearch-5.x.xenial
+- system.debmirror.mirror_mirantis_com.elasticsearch-6.x.xenial
 - system.debmirror.mirror_mirantis_com.elasticsearch-curator-5.xenial
 - system.debmirror.mirror_mirantis_com.extra.xenial
 - system.debmirror.mirror_mirantis_com.glusterfs-3.8.xenial
@@ -10,6 +11,7 @@
 - system.debmirror.mirror_mirantis_com.openstack-pike.xenial
 - system.debmirror.mirror_mirantis_com.openstack-queens.xenial
 - system.debmirror.mirror_mirantis_com.percona.xenial
+- system.debmirror.mirror_mirantis_com.salt-formulas.xenial
 - system.debmirror.mirror_mirantis_com.saltstack-2017.7.xenial
 - system.debmirror.mirror_mirantis_com.td-agent.xenial
 - system.debmirror.mirror_mirantis_com.ubuntu.xenial
diff --git a/debmirror/mirror_mirantis_com/opencontrail-4.0/xenial.yml b/debmirror/mirror_mirantis_com/opencontrail-4.0/xenial.yml
new file mode 100644
index 0000000..38b13b1
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/opencontrail-4.0/xenial.yml
@@ -0,0 +1,19 @@
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_oc40_xenial:
+          force: ${_param:mirror_mirantis_com_oc40_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "rsync"
+          arch: [ 'amd64' ]
+          mirror_host: "mirror.mirantis.com"
+          mirror_root: ":mirror/${_param:mcp_version}/opencontrail-4.0/xenial/"
+          target_dir: "${_param:debmirror_mirrors_base_target_dir}/opencontrail-4.0/xenial/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_oc40_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
+          filter:
+            001: "--exclude='(-dbg_|-dbg-)'"
diff --git a/debmirror/mirror_mirantis_com/opencontrail-4.1/xenial.yml b/debmirror/mirror_mirantis_com/opencontrail-4.1/xenial.yml
new file mode 100644
index 0000000..e7d6b2b
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/opencontrail-4.1/xenial.yml
@@ -0,0 +1,19 @@
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_oc41_xenial:
+          force: ${_param:mirror_mirantis_com_oc41_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "rsync"
+          arch: [ 'amd64' ]
+          mirror_host: "mirror.mirantis.com"
+          mirror_root: ":mirror/${_param:mcp_version}/opencontrail-4.1/xenial/"
+          target_dir: "${_param:debmirror_mirrors_base_target_dir}/opencontrail-4.1/xenial/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_oc41_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
+          filter:
+            001: "--exclude='(-dbg_|-dbg-)'"
diff --git a/debmirror/mirror_mirantis_com/percona/xenial.yml b/debmirror/mirror_mirantis_com/percona/xenial.yml
index 1464dcc..87746e0 100644
--- a/debmirror/mirror_mirantis_com/percona/xenial.yml
+++ b/debmirror/mirror_mirantis_com/percona/xenial.yml
@@ -16,7 +16,7 @@
           dist: [ xenial ]
           section: [ main ]
           filter:
-            001: "--exclude='(-dbg_|-dbg-)'"
+            001: --exclude='(-|_)dbg(_|-)'
             002: "--exclude='/percona-server-5.(5|6)'"
             003: "--exclude='/percona-server-mongodb'"
             004: "--exclude='/(percona-xtradb-cluster|percona-server-5|percona-xtradb-cluster)'"
diff --git a/debmirror/mirror_mirantis_com/salt-formulas/xenial.yml b/debmirror/mirror_mirantis_com/salt-formulas/xenial.yml
new file mode 100644
index 0000000..c7f8523
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/salt-formulas/xenial.yml
@@ -0,0 +1,17 @@
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_salt-formulas_xenial:
+          force: ${_param:mirror_mirantis_com_salt-formulas_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "rsync"
+          arch: [ 'amd64' ]
+          mirror_host: "mirror.mirantis.com"
+          mirror_root: ":mirror/${_param:mcp_version}/salt-formulas/xenial/"
+          target_dir: "${_param:debmirror_mirrors_base_target_dir}/salt-formulas/xenial/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_salt-formulas_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/ubuntu/xenial.yml b/debmirror/mirror_mirantis_com/ubuntu/xenial.yml
index 95806ad..30fbea5 100644
--- a/debmirror/mirror_mirantis_com/ubuntu/xenial.yml
+++ b/debmirror/mirror_mirantis_com/ubuntu/xenial.yml
@@ -16,6 +16,7 @@
           log_file: "/var/log/debmirror/mirror_mirantis_com_ubuntu_xenial.log"
           dist: [ xenial , xenial-security, xenial-updates ]
           section: [ main , restricted, universe ]
+          cache_dir: "${_param:debmirror_mirrors_base_target_dir}/../.cache/ubuntu"
           # Don't exclude main/x11 - its required for many pkgs.
           exclude_deb_section:
           - Xfce
@@ -132,8 +133,10 @@
             306: '--exclude="main/l/linux.*/linux-.*4\.10\.0-(([0-3][0-9])|(4[0-1]))"'
             # Hwe 4.13: Old - if minor in 0-39, < 44
             307: '--exclude="main/l/linux.*/linux-.*4\.13\.0-(([0-3][0-9])|(4[0-4]))"'
-            # Hwe 4.15: Old - if minor in 0-19, < 34
-            308: '--exclude="main/l/linux.*/linux-.*4\.15\.0-(([0-1][0-9])|([0-3][0-3]))"'
+            # Hwe 4.15.0: Old - if minor in 0-39, < 43
+            308: --exclude='main/l/linux.*/linux-.*4\.15\.0-(([0-3][0-9])|(4[0-2]))'
+            # Old 4.4.0
+            309: --exclude='main/l/linux.*/linux-.*4\.4\.0-'
             # List of packages, that should be fetched from fresh ppa or other mirror
             # So,removing them from upstream mirror.
             500: "--exclude='/main/m/maas/'"
diff --git a/defaults/debmirror.yml b/defaults/debmirror.yml
index 3995118..b572dcc 100644
--- a/defaults/debmirror.yml
+++ b/defaults/debmirror.yml
@@ -7,13 +7,17 @@
     mirror_mirantis_com_ceph_luminous_xenial_force: False
     mirror_mirantis_com_docker_xenial_force: False
     mirror_mirantis_com_elasticsearch_5_x_xenial_force: False
+    mirror_mirantis_com_elasticsearch_6_x_xenial_force: False
     mirror_mirantis_com_elasticsearch_curator_5_xenial_force: False
     mirror_mirantis_com_extra_xenial_force: False
     mirror_mirantis_com_glusterfs_3_8_xenial_force: False
     mirror_mirantis_com_maas_xenial_force: False
+    mirror_mirantis_com_oc40_xenial_force: False
+    mirror_mirantis_com_oc41_xenial_force: False
     mirror_mirantis_com_openstack_pike_xenial_force: False
     mirror_mirantis_com_openstack_queens_xenial_force: False
     mirror_mirantis_com_percona_xenial_force: False
+    mirror_mirantis_com_salt-formulas_xenial_force: True
     mirror_mirantis_com_saltstack_2016_3_xenial_force: False
     mirror_mirantis_com_saltstack_2017_7_xenial_force: False
     mirror_mirantis_com_td_agent_xenial_force: False
diff --git a/defaults/docker_images.yml b/defaults/docker_images.yml
index 2dede15..60d2bb9 100644
--- a/defaults/docker_images.yml
+++ b/defaults/docker_images.yml
@@ -46,3 +46,98 @@
       base: "${_param:mcp_docker_registry}/mirantis/cicd/aptly:${_param:mcp_version}"
       public: "${_param:mcp_docker_registry}/mirantis/cicd/aptly-public:${_param:mcp_version}"
       publisher: "${_param:mcp_docker_registry}/mirantis/cicd/aptly-publisher:${_param:mcp_version}"
+
+    # List of images, to be placed into offline image, during separate image build process
+    # WARNING: registry|target_registry and names - must be exactly same as list above!
+    local_registry_mirror_image_list:
+       # CI/CD
+      - registry: ${_param:mcp_docker_registry}/mirantis/external
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/external
+        name: registry:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/mirantis/external
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/external
+        name: visualizer:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/mirantis/external/docker
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/external/docker
+        name: compose:1.17.1
+      - registry: ${_param:mcp_docker_registry}/mirantis/external/osixia
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/external/osixia
+        name: openldap:1.1.8
+      - registry: ${_param:mcp_docker_registry}/mirantis/external/library
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/external/library
+        name: postgresql:9.6.10
+      - registry: ${_param:mcp_docker_registry}/mirantis/cicd
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/cicd
+        name: phpldapadmin:${_param:apt_mk_version}
+
+      - registry: ${_param:mcp_docker_registry}/mirantis/cicd
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/cicd
+        name: aptly:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/mirantis/cicd
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/cicd
+        name: aptly-public:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/mirantis/cicd
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/cicd
+        name: aptly-publisher:${_param:apt_mk_version}
+
+      - registry: ${_param:mcp_docker_registry}/mirantis/cicd
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/cicd
+        name: jnlp-slave:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/mirantis/cicd
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/cicd
+        name: jenkins:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/mirantis/cicd
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/cicd
+        name: gerrit:${_param:apt_mk_version}
+        # stacklight
+      - registry: ${_param:mcp_docker_registry}/openstack-docker
+        target_registry: ${_param:local_docker_client_registry_target_registry}/openstack-docker
+        name: alertmanager:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/mirantis/external
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/external
+        name: alerta-web:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/openstack-docker
+        target_registry: ${_param:local_docker_client_registry_target_registry}/openstack-docker
+        name: pushgateway:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/openstack-docker
+        target_registry: ${_param:local_docker_client_registry_target_registry}/openstack-docker
+        name: prometheus:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/openstack-docker
+        target_registry: ${_param:local_docker_client_registry_target_registry}/openstack-docker
+        name: gainsight:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/openstack-docker
+        target_registry: ${_param:local_docker_client_registry_target_registry}/openstack-docker
+        name: telegraf:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/openstack-docker
+        target_registry: ${_param:local_docker_client_registry_target_registry}/openstack-docker
+        name: remote_storage_adapter:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/openstack-docker
+        target_registry: ${_param:local_docker_client_registry_target_registry}/openstack-docker
+        name: prometheus_relay:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/openstack-docker
+        target_registry: ${_param:local_docker_client_registry_target_registry}/openstack-docker
+        name: grafana:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/openstack-docker
+        target_registry: ${_param:local_docker_client_registry_target_registry}/openstack-docker
+        name: heka:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/mirantis/external
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/external
+        name: elasticsearch:${_param:apt_mk_version}
+      # QA\CVP tool-set's
+      - registry: ${_param:mcp_docker_registry}/mirantis/oss
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/oss
+        name: qa-tools:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/mirantis/cvp
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/cvp
+        name: cvp-rally:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/mirantis/cvp
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/cvp
+        name: cvp-spt:${_param:apt_mk_version}
+      - registry: ${_param:mcp_docker_registry}/mirantis/cvp
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/cvp
+        name: cvp-sanity-checks:${_param:apt_mk_version}
+        #
+      - registry: ${_param:mcp_docker_registry}/mirantis/cicd
+        target_registry: ${_param:local_docker_client_registry_target_registry}/mirantis/cicd
+        name: mysql:${_param:apt_mk_version}
+
diff --git a/defaults/init.yml b/defaults/init.yml
index 9b2b6cf..fcfc064 100644
--- a/defaults/init.yml
+++ b/defaults/init.yml
@@ -42,3 +42,5 @@
     # Make sure this global variable is defined everywhere, where used it is already set on cluster level
     cluster_public_host: '127.0.0.1'
     single_address: '127.0.0.1'
+    # Stub parameter, to render target local_registry_mirror_image_list
+    local_docker_client_registry_target_registry: "apt:5000"
diff --git a/jenkins/client/job/deploy/galera_verify_restore.yml b/jenkins/client/job/deploy/galera_verify_restore.yml
new file mode 100644
index 0000000..3b9127e
--- /dev/null
+++ b/jenkins/client/job/deploy/galera_verify_restore.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    jenkins_salt_api_url: "http://${_param:salt_master_host}:6969"
+  jenkins:
+    client:
+      job:
+        galera_verify_restore:
+          type: workflow-scm
+          name: galera-verify-restore
+          display_name: "Verify and Restore Galera cluster"
+          discard:
+            build:
+              keep_num: 50
+          concurrent: true
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
+            credentials: "gerrit"
+            script: galera-cluster-verify-restore.groovy
+          param:
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+            SALT_MASTER_URL:
+              type: string
+              default: "${_param:jenkins_salt_api_url}"
diff --git a/jenkins/client/job/validate.yml b/jenkins/client/job/validate.yml
index 3003ebb..eed3084 100644
--- a/jenkins/client/job/validate.yml
+++ b/jenkins/client/job/validate.yml
@@ -1,7 +1,6 @@
 parameters:
   _param:
     jenkins_salt_api_url: "http://${_param:salt_master_host}:6969"
-    cvp_sanity_default_repo: "https://github.com/Mirantis/cvp-sanity-checks"
   jenkins:
     client:
       view:
@@ -214,7 +213,7 @@
               default: "salt"
             TESTS_REPO:
               type: string
-              default: "${_param:cvp_sanity_default_repo}"
+              default: ""
               description: Url for cvp-sanity-checks
             TESTS_SETTINGS:
               type: string
@@ -222,7 +221,7 @@
               description: e.g. skipped_nodes=nal01.local.com,ntw01.local.com
             TESTS_SET:
               type: string
-              default: "cvp_checks/tests/"
+              default: "cvp-sanity/cvp_checks/tests"
               description: "Leave as is for full run or add a filename, e.g. _default_path_/test_mtu.py"
             PROXY:
               type: string
@@ -484,7 +483,7 @@
               default: "salt"
             TESTS_REPO:
               type: string
-              default: "https://github.com/Mirantis/cvp-spt"
+              default: ""
               description: Url for cvp-spt repository
             TESTS_SETTINGS:
               type: string
@@ -492,7 +491,7 @@
               description: "Additional environment variables to export, e.g. image_name, networks, HW_NODES"
             TESTS_SET:
               type: string
-              default: "cvp_spt/tests/"
+              default: "cvp-spt/cvp_spt/tests"
               description: "Leave as is for full run or add a filename, e.g. _default_path_/test_glance.py"
             PROXY:
               type: string
diff --git a/kubernetes/common/init.yml b/kubernetes/common/init.yml
index 5d73cf9..fcca6b6 100644
--- a/kubernetes/common/init.yml
+++ b/kubernetes/common/init.yml
@@ -58,7 +58,7 @@
     kubernetes_sriov_source_hash: md5=cd9ea01e80d260218260314447c23b30
     kubernetes_cniplugins_source: ${_param:kubernetes_cniplugins_repo}/containernetworking-plugins_v0.7.2-151-g1d23302.tar.gz
     kubernetes_cniplugins_source_hash: md5=bb42444166a89ef6832529e9e39d000d
-    kubernetes_dashboard_image: ${_param:kubernetes_dashboard_repo}/kubernetes-dashboard-amd64:v1.10.0-4
+    kubernetes_dashboard_image: ${_param:kubernetes_dashboard_repo}/kubernetes-dashboard-amd64:v1.10.1-2
     kubernetes_telegraf_image: ${_param:mcp_docker_registry}/openstack-docker/telegraf:2018.8.0
     kubernetes_coredns_image: ${_param:kubernetes_coredns_repo}/coredns:v1.2.6-4
     kubernetes_ingressnginx_controller_image: ${_param:kubernetes_ingressnginx_repo}/nginx-ingress-controller-amd64:nginx-0.21.0-3
diff --git a/linux/system/repo/mcp/apt_mirantis/ceph.yml b/linux/system/repo/mcp/apt_mirantis/ceph.yml
index 6c578a9..0ab91fe 100644
--- a/linux/system/repo/mcp/apt_mirantis/ceph.yml
+++ b/linux/system/repo/mcp/apt_mirantis/ceph.yml
@@ -9,10 +9,6 @@
           key: ${_param:linux_system_repo_mirror_mirantis_key}
           architectures: amd64
           clean_file: true
-          pin:
-          - pin: 'release o=Mirantis'
-            priority: 1100
-            package: '*'
 # Deprecated since 2018.11+
 #parameters:
 #  _param:
diff --git a/linux/system/repo/mcp/apt_mirantis/extra.yml b/linux/system/repo/mcp/apt_mirantis/extra.yml
index 94c1d14..94a47dd 100644
--- a/linux/system/repo/mcp/apt_mirantis/extra.yml
+++ b/linux/system/repo/mcp/apt_mirantis/extra.yml
@@ -9,7 +9,3 @@
           key: ${_param:linux_system_repo_mirror_mirantis_key}
           architectures: ${_param:linux_system_architecture}
           clean_file: true
-          pin:
-          - pin: 'release o=Mirantis'
-            priority: 1100
-            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/hotfix/openstack.yml b/linux/system/repo/mcp/apt_mirantis/hotfix/openstack.yml
index 7f1f668..055cbf4 100644
--- a/linux/system/repo/mcp/apt_mirantis/hotfix/openstack.yml
+++ b/linux/system/repo/mcp/apt_mirantis/hotfix/openstack.yml
@@ -9,7 +9,3 @@
           key: ${_param:linux_system_repo_mirror_mirantis_key}
           architectures: ${_param:linux_system_architecture}
           clean_file: true
-          pin:
-          - pin: 'release o=Mirantis'
-            priority: 1100
-            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/hotfix/salt-formulas.yml b/linux/system/repo/mcp/apt_mirantis/hotfix/salt-formulas.yml
index f4219ca..850eece 100644
--- a/linux/system/repo/mcp/apt_mirantis/hotfix/salt-formulas.yml
+++ b/linux/system/repo/mcp/apt_mirantis/hotfix/salt-formulas.yml
@@ -9,7 +9,3 @@
           key: ${_param:linux_system_repo_mirror_mirantis_key}
           architectures: amd64
           clean_file: true
-          pin:
-          - pin: 'release o=Mirantis'
-            priority: 1100
-            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/mirantis_pining.yml b/linux/system/repo/mcp/apt_mirantis/mirantis_pining.yml
new file mode 100644
index 0000000..02b3a8d
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/mirantis_pining.yml
@@ -0,0 +1,17 @@
+# This is global pin rule for all packages, provided by Mirantis.
+# Quoting official man of apt:
+# `Preferences are a strong power in the hands of a system administrator but they can become also their biggest nightmare if used without care!`
+# aka, don't change and dont' add any new rules, w\o extra neccecity.
+parameters:
+  linux:
+    system:
+      apt:
+        preferences:
+          enabled: true
+          rules:
+            100:
+              enabled: true
+              name: 'Mirantis origin'
+              pin: 'release o=Mirantis'
+              priority: 1100
+              package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/openstack.yml b/linux/system/repo/mcp/apt_mirantis/openstack.yml
index 381e37b..f9140a7 100644
--- a/linux/system/repo/mcp/apt_mirantis/openstack.yml
+++ b/linux/system/repo/mcp/apt_mirantis/openstack.yml
@@ -9,10 +9,6 @@
           key: ${_param:linux_system_repo_mirror_mirantis_key}
           architectures: ${_param:linux_system_architecture}
           clean_file: true
-          pin:
-          - pin: 'release o=Mirantis'
-            priority: 1100
-            package: '*'
 # DEPRECATED since 2018.10+ release.
 #parameters:
 #  _param:
diff --git a/linux/system/repo/mcp/apt_mirantis/salt-formulas.yml b/linux/system/repo/mcp/apt_mirantis/salt-formulas.yml
index 289e15c..df9fbeb 100644
--- a/linux/system/repo/mcp/apt_mirantis/salt-formulas.yml
+++ b/linux/system/repo/mcp/apt_mirantis/salt-formulas.yml
@@ -9,7 +9,3 @@
           key: ${_param:linux_system_repo_mirror_mirantis_key}
           architectures: amd64
           clean_file: true
-          pin:
-          - pin: 'release o=Mirantis'
-            priority: 1100
-            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/update/openstack.yml b/linux/system/repo/mcp/apt_mirantis/update/openstack.yml
index 199873e..924f73f 100644
--- a/linux/system/repo/mcp/apt_mirantis/update/openstack.yml
+++ b/linux/system/repo/mcp/apt_mirantis/update/openstack.yml
@@ -9,7 +9,3 @@
           key: ${_param:linux_system_repo_mirror_mirantis_key}
           architectures: ${_param:linux_system_architecture}
           clean_file: true
-          pin:
-          - pin: 'release o=Mirantis'
-            priority: 1100
-            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/update/salt-formulas.yml b/linux/system/repo/mcp/apt_mirantis/update/salt-formulas.yml
index ab9e05a..74868d5 100644
--- a/linux/system/repo/mcp/apt_mirantis/update/salt-formulas.yml
+++ b/linux/system/repo/mcp/apt_mirantis/update/salt-formulas.yml
@@ -9,7 +9,3 @@
           key: ${_param:linux_system_repo_mirror_mirantis_key}
           architectures: amd64
           clean_file: true
-          pin:
-          - pin: 'release o=Mirantis'
-            priority: 1100
-            package: '*'
diff --git a/linux/system/single/mcp.yml b/linux/system/single/mcp.yml
index 850a7ac..a77459d 100644
--- a/linux/system/single/mcp.yml
+++ b/linux/system/single/mcp.yml
@@ -1,5 +1,6 @@
 classes:
 - system.linux.system.single.simple
+- system.linux.system.repo.mcp.apt_mirantis.mirantis_pining
 parameters:
   linux:
     system: