diff --git a/artifactory/client/init.yml b/artifactory/client/init.yml
index 0148879..ef43633 100644
--- a/artifactory/client/init.yml
+++ b/artifactory/client/init.yml
@@ -15,12 +15,121 @@
           ldap_searchFilter: ${_param:artifactory_security_ldap_searchFilter}
           ssl_verify: False
         repo:
-          local_artifactory_repo:
-            name: local_artifactory_repo
-            package_type: generic
+          _genericRepository-local:
+            description: "Used by Jimbo"
             repo_type: local
-          remote_artifactory_repo:
-            name: remote_artifactory_repo
             package_type: generic
+          binary-dev-local:
+            description: "None"
+            repo_type: local
+            package_type: generic
+          binary-prod-local:
+            repo_type: local
+            package_type: generic
+          docker-dev-local:
+            repo_type: local
+            package_type: docker
+          docker-prod-local:
+            repo_type: local
+            package_type: docker
+          k8s-tests-images:
+            repo_type: local
+            package_type: docker
+          maven-local:
+            description: "Hosts Java libraries needed to build Docker images"
+            repo_type: local
+            package_type: maven
+          mcp-ci-images:
+            repo_type: local
+            package_type: docker
+          vm-images:
+            repo_type: local
+            package_type: generic
+          _genericRepository-remote:
+            description: "Used by Jimbo"
             repo_type: remote
-            url: "http://artifactory.mcp.mirantis.net/"
+            package_type: generic
+            url: http://localhost
+          apk-remote:
+            repo_type: remote
+            package_type: generic
+            url: http://dl-cdn.alpinelinux.org/alpine/
+          apt-docker-project:
+            repo_type: remote
+            package_type: debian
+            url: https://apt.dockerproject.org/repo
+          artifactory-pro-debian:
+            repo_type: remote
+            package_type: debian
+            url: https://jfrog.bintray.com/artifactory-pro-debs
+          debian-mariadb-remote:
+            repo_type: remote
+            package_type: debian
+            url: http://sfo1.mirrors.digitalocean.com/mariadb/repo/10.1/debian/
+          debian-nginx:
+            repo_type: remote
+            package_type: debian
+            url: http://nginx.org/packages/debian/
+          debian-percona-remote:
+            repo_type: remote
+            package_type: debian
+            url: http://repo.percona.com/apt
+          debian-rabbitmq-remote:
+            repo_type: remote
+            package_type: debian
+            url: http://www.rabbitmq.com/debian/
+          debian-remote:
+            repo_type: remote
+            package_type: debian
+            url: http://ftp.us.debian.org/debian
+          debian-security-remote:
+            repo_type: remote
+            package_type: debian
+            url: http://security.debian.org/
+          docker-remote:
+            description: "Remote repository for DockerHub"
+            repo_type: remote
+            package_type: docker
+            url: https://registry-1.docker.io/
+          gcs-remote:
+            description: "Has zero downloads. Can be removed."
+            repo_type: remote
+            package_type: generic
+            url: https://storage.googleapis.com
+          gerrit-plugins:
+            description: "Overlaps with maven-local. We should resolve overlap and remove this repo."
+            repo_type: remote
+            package_type: generic
+            url: http://builds.quelltextlich.at/gerrit/nightly
+          jcenter:
+            repo_type: remote
+            package_type: maven
+            url: https://jcenter.bintray.com
+          jenkins-deb-pkgs:
+            repo_type: remote
+            package_type: generic
+            url: https://pkg.jenkins.io/debian-stable/binary
+          jenkins-plugins:
+            repo_type: remote
+            package_type: generic
+            url: http://mirrors.jenkins-ci.org/plugins
+          jenkins-plugins-jars:
+            repo_type: remote
+            package_type: maven
+            url: https://repo.jenkins-ci.org/releases/org/jenkins-ci/plugins/
+          jenkins-updates:
+            repo_type: remote
+            package_type: generic
+            url: https://updates.jenkins.io/
+          mysql-connector-java:
+            repo_type: remote
+            package_type: maven
+            url: http://repo.jfrog.org/artifactory/remote-repos/mysql/mysql-connector-java/
+          pypi-remote:
+            repo_type: remote
+            package_type: pypi
+            url: https://pypi.python.org
+          ubuntu-remote:
+            repo_type: remote
+            package_type: debian
+            url: http://us.archive.ubuntu.com/ubuntu/
diff --git a/ceph/mon/cluster.yml b/ceph/mon/cluster.yml
new file mode 100644
index 0000000..35d5596
--- /dev/null
+++ b/ceph/mon/cluster.yml
@@ -0,0 +1,2 @@
+classes:
+- service.ceph.mon.cluster
diff --git a/ceph/osd/cluster.yml b/ceph/osd/cluster.yml
new file mode 100644
index 0000000..9e98f91
--- /dev/null
+++ b/ceph/osd/cluster.yml
@@ -0,0 +1,2 @@
+classes:
+- service.ceph.osd.cluster
diff --git a/cinder/control/cluster.yml b/cinder/control/cluster.yml
index 868b71e..c130e97 100644
--- a/cinder/control/cluster.yml
+++ b/cinder/control/cluster.yml
@@ -4,6 +4,12 @@
 - service.keepalived.cluster.single
 - system.haproxy.proxy.listen.openstack.cinder
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   cinder:      
     volume:
       enabled: false
diff --git a/cinder/control/single.yml b/cinder/control/single.yml
index 58156cb..2d7f179 100644
--- a/cinder/control/single.yml
+++ b/cinder/control/single.yml
@@ -1,6 +1,12 @@
 classes:
 - service.cinder.control.single
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   cinder:
     volume:
       enabled: false
diff --git a/cinder/volume/single.yml b/cinder/volume/single.yml
index 9c8f7c2..de468ba 100644
--- a/cinder/volume/single.yml
+++ b/cinder/volume/single.yml
@@ -1,6 +1,12 @@
 classes:
 - service.cinder.volume.single
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   cinder:
     volume:
       enabled: True
diff --git a/designate/server/cluster.yml b/designate/server/cluster.yml
index 33eb632..eb6a5b6 100644
--- a/designate/server/cluster.yml
+++ b/designate/server/cluster.yml
@@ -4,6 +4,12 @@
 - system.haproxy.proxy.listen.openstack.designate
 - service.haproxy.proxy.single
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   designate:
     _support:
       sensu:
diff --git a/designate/server/single.yml b/designate/server/single.yml
index 623c357..b658f8b 100644
--- a/designate/server/single.yml
+++ b/designate/server/single.yml
@@ -1,6 +1,12 @@
 classes:
 - service.designate.server.single
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   designate:
     server:
       enabled: true
diff --git a/docker/swarm/manager.yml b/docker/swarm/manager.yml
index 4bbc22b..12bfc0c 100644
--- a/docker/swarm/manager.yml
+++ b/docker/swarm/manager.yml
@@ -3,10 +3,11 @@
 parameters:
   _param:
     docker_gwbridge_subnet: 10.20.0.0/16
+    docker_swarm_master_port: 2377
   docker:
     swarm:
       role: manager
       advertise_addr: ${_param:single_address}
       master:
         host: ${_param:cluster_node01_address}
-        port: 2377
+        port: ${_param:docker_swarm_master_port}
diff --git a/docker/swarm/stack/monitoring/init.yml b/docker/swarm/stack/monitoring/init.yml
index 97b9ac3..347319a 100644
--- a/docker/swarm/stack/monitoring/init.yml
+++ b/docker/swarm/stack/monitoring/init.yml
@@ -32,6 +32,7 @@
               environment:
                 bind_port: ${prometheus:remote_storage_adapter:bind:port}
                 bind_address: ${prometheus:remote_storage_adapter:bind:address}
+                influxdb_retention_policy: 'lma'
                 influxdb_url: ${_param:prometheus_influxdb_url}
                 influxdb_db: ${_param:prometheus_influxdb_db}
                 influxdb_username: ${_param:prometheus_influxdb_username}
diff --git a/docker/swarm/worker.yml b/docker/swarm/worker.yml
index 643b207..4bed790 100644
--- a/docker/swarm/worker.yml
+++ b/docker/swarm/worker.yml
@@ -3,9 +3,11 @@
 parameters:
   _param:
     docker_gwbridge_subnet: 10.20.0.0/16
+    docker_swarm_master_port: 2377
   docker:
     swarm:
       role: worker
       advertise_addr: ${_param:single_address}
       master:
         host: ${_param:cluster_node01_address}
+        port: ${_param:docker_swarm_master_port}
diff --git a/glance/control/cluster.yml b/glance/control/cluster.yml
index 6402721..bb87f16 100644
--- a/glance/control/cluster.yml
+++ b/glance/control/cluster.yml
@@ -4,6 +4,12 @@
 - service.haproxy.proxy.single
 - system.haproxy.proxy.listen.openstack.glance
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   glance:
     server:
       enabled: true
diff --git a/glance/control/single.yml b/glance/control/single.yml
index 458cd37..b285d38 100644
--- a/glance/control/single.yml
+++ b/glance/control/single.yml
@@ -1,6 +1,12 @@
 classes:
 - service.glance.control.single
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   glance:
     server:
       database:
diff --git a/haproxy/proxy/listen/cicd/aptly.yml b/haproxy/proxy/listen/cicd/aptly.yml
index fb24c1f..35ae3d6 100644
--- a/haproxy/proxy/listen/cicd/aptly.yml
+++ b/haproxy/proxy/listen/cicd/aptly.yml
@@ -14,6 +14,9 @@
             - httpclose
             - httplog
           balance: source
+          timeout:
+            server: 10m
+            client: 10m
           binds:
             - address: ${_param:haproxy_aptly_api_bind_host}
               port: ${_param:haproxy_aptly_api_bind_port}
diff --git a/haproxy/proxy/listen/openstack/nova.yml b/haproxy/proxy/listen/openstack/nova.yml
index 3865a82..efffee0 100644
--- a/haproxy/proxy/listen/openstack/nova.yml
+++ b/haproxy/proxy/listen/openstack/nova.yml
@@ -2,26 +2,6 @@
   haproxy:
     proxy:
       listen:
-        nova_ec2_api:
-          type: general-service
-          service_name: nova
-          check: false
-          binds:
-          - address: ${_param:cluster_vip_address}
-            port: 8773
-          servers:
-          - name: ctl01
-            host: ${_param:cluster_node01_address}
-            port: 8773
-            params: check
-          - name: ctl02
-            host: ${_param:cluster_node02_address}
-            port: 8773
-            params: check
-          - name: ctl03
-            host: ${_param:cluster_node03_address}
-            port: 8773
-            params: check
         nova_api:
           type: openstack-service
           service_name: nova
diff --git a/haproxy/proxy/listen/radosgw.yml b/haproxy/proxy/listen/radosgw.yml
index 369306b..ecdeb6b 100644
--- a/haproxy/proxy/listen/radosgw.yml
+++ b/haproxy/proxy/listen/radosgw.yml
@@ -19,8 +19,8 @@
             - name: ${_param:cluster_node02_hostname}
               host: ${_param:cluster_node02_address}
               port: ${_param:haproxy_radosgw_source_port}
-              params: backup check
+              params: check
             - name: ${_param:cluster_node03_hostname}
               host: ${_param:cluster_node03_address}
               port: ${_param:haproxy_radosgw_source_port}
-              params: backup check
+              params: check
diff --git a/heat/server/cluster.yml b/heat/server/cluster.yml
index ee5df33..8e38f4f 100644
--- a/heat/server/cluster.yml
+++ b/heat/server/cluster.yml
@@ -6,6 +6,12 @@
 parameters:
   _param:
     cluster_public_protocol: https
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   heat:
     server:
       stack_domain_admin:
diff --git a/heat/server/single.yml b/heat/server/single.yml
index d097605..cd548bf 100644
--- a/heat/server/single.yml
+++ b/heat/server/single.yml
@@ -1,6 +1,12 @@
 classes:
 - service.heat.server.single
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   heat:
     server:
       stack_domain_admin:
diff --git a/influxdb/client/database/ceilometer.yml b/influxdb/client/database/ceilometer.yml
index 52aebae..88d6a07 100644
--- a/influxdb/client/database/ceilometer.yml
+++ b/influxdb/client/database/ceilometer.yml
@@ -8,7 +8,7 @@
           enabled: true
           name: ceilometer
           retention_policy:
-            - name: ceilometer_default
+            - name: ceilometer
               is_default: true
               duration: ${_param:influxdb_ceilometer_rp_duration}
               replication: 1
diff --git a/influxdb/client/database/prometheus.yml b/influxdb/client/database/prometheus.yml
new file mode 100644
index 0000000..991fbd2
--- /dev/null
+++ b/influxdb/client/database/prometheus.yml
@@ -0,0 +1,25 @@
+parameters:
+  _param:
+    influxdb_prometheus_rp_duration: 30d
+  influxdb:
+    client:
+      database:
+        prometheus:
+          enabled: true
+          name: prometheus
+          retention_policy:
+          - name: lma
+            is_default: true
+            duration: ${_param:influxdb_prometheus_rp_duration}
+            replication: 1
+      user:
+        lma:
+          enabled: true
+          name: lma
+          password: ${_param:influxdb_stacklight_password}
+      grant:
+        lma_all_on_prometheus:
+          enabled: true
+          user: lma
+          database: prometheus
+          privilege: all
diff --git a/influxdb/client/database/stacklight.yml b/influxdb/client/database/stacklight.yml
index d07d0b8..76b8e60 100644
--- a/influxdb/client/database/stacklight.yml
+++ b/influxdb/client/database/stacklight.yml
@@ -8,9 +8,9 @@
           enabled: true
           name: lma
           retention_policy:
-          - name: lma_default
+          - name: lma
             is_default: true
-            duration: ${_param:influxdb_stacklight_password}
+            duration: ${_param:influxdb_stacklight_rp_duration}
             replication: 1
       user:
         lma:
@@ -18,7 +18,7 @@
           name: lma
           password: ${_param:influxdb_stacklight_password}
       grant:
-        lma_all:
+        lma_all_on_lma:
           enabled: true
           user: lma
           database: lma
diff --git a/influxdb/database/prometheus.yml b/influxdb/database/prometheus.yml
new file mode 100644
index 0000000..3e3d63b
--- /dev/null
+++ b/influxdb/database/prometheus.yml
@@ -0,0 +1,25 @@
+parameters:
+  _param:
+    influxdb_prometheus_database_retention: 30d
+  influxdb:
+    server:
+      database:
+        prometheus:
+          enabled: true
+          name: prometheus
+          retention_policy:
+          - name: lma
+            is_default: true
+            duration: ${_param:influxdb_prometheus_database_retention}
+            replication: 1
+      user:
+        lma:
+          enabled: true
+          name: lma
+          password: ${_param:influxdb_stacklight_password}
+      grant:
+        grant_lma_all_on_prometheus:
+          enabled: true
+          user: lma
+          database: prometheus
+          privilege: all
diff --git a/influxdb/database/stacklight.yml b/influxdb/database/stacklight.yml
index d741380..9eb2eb0 100644
--- a/influxdb/database/stacklight.yml
+++ b/influxdb/database/stacklight.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    influxdb_lma_database_retention: 30d
   influxdb:
     server:
       database:
@@ -8,7 +10,7 @@
           retention_policy:
           - name: lma
             is_default: true
-            duration: 30d
+            duration: ${_param:influxdb_lma_database_retention}
             replication: 1
       user:
         lma:
@@ -16,7 +18,7 @@
           name: lma
           password: ${_param:influxdb_stacklight_password}
       grant:
-        grant_lma_all:
+        grant_lma_all_on_lma:
           enabled: true
           user: lma
           database: lma
diff --git a/ironic/api/cluster.yml b/ironic/api/cluster.yml
index c3a7901..5522f3f 100644
--- a/ironic/api/cluster.yml
+++ b/ironic/api/cluster.yml
@@ -1,6 +1,12 @@
 classes:
 - service.ironic.api.cluster
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   ironic:
     api:
       enabled: true
diff --git a/ironic/api/single.yml b/ironic/api/single.yml
index 0800579..ed73e90 100644
--- a/ironic/api/single.yml
+++ b/ironic/api/single.yml
@@ -1,6 +1,12 @@
 classes:
 - service.ironic.api.single
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   ironic:
     api:
       bind:
diff --git a/ironic/conductor/cluster.yml b/ironic/conductor/cluster.yml
index ba0c538..063719c 100644
--- a/ironic/conductor/cluster.yml
+++ b/ironic/conductor/cluster.yml
@@ -1,6 +1,12 @@
 classes:
 - service.ironic.conductor.cluster
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   ironic:
     conductor:
       api_url: 'http://${_param:cluster_baremetal_vip_address}:6385'
diff --git a/ironic/conductor/single.yml b/ironic/conductor/single.yml
index 69e6c20..d827129 100644
--- a/ironic/conductor/single.yml
+++ b/ironic/conductor/single.yml
@@ -1,6 +1,12 @@
 classes:
 - service.ironic.conductor.single
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   ironic:
     conductor:
       enabled: true
diff --git a/jenkins/client/approved_scripts.yml b/jenkins/client/approved_scripts.yml
index 5d9a140..9be62af 100644
--- a/jenkins/client/approved_scripts.yml
+++ b/jenkins/client/approved_scripts.yml
@@ -82,6 +82,7 @@
         - new java.util.HashMap
         - staticField groovy.io.FileType FILES
         - staticMethod com.cloudbees.plugins.credentials.CredentialsProvider lookupCredentials java.lang.Class hudson.model.ItemGroup
+        - staticMethod java.lang.Double parseDouble java.lang.String
         - staticMethod java.lang.Integer valueOf int
         - staticMethod java.lang.Integer valueOf java.lang.String
         - staticMethod java.lang.Math min int int
diff --git a/jenkins/client/job/deploy/lab/cicd.yml b/jenkins/client/job/deploy/lab/cicd.yml
index 260e7b1..9002c9c 100644
--- a/jenkins/client/job/deploy/lab/cicd.yml
+++ b/jenkins/client/job/deploy/lab/cicd.yml
@@ -63,10 +63,6 @@
               OPENSTACK_API_URL:
                 type: string
                 default: "https://cloud-cz.bud.mirantis.net:5000"
-              TARGET_OPENSTACK_IP:
-                type: string
-                default: "${_param:oss_target_openstack_ip}"
-                description: "IP address of the OpenStack deployment, managed by OSS tooling"
               OPENSTACK_API_CREDENTIALS:
                 type: string
                 default: "openstack-devcloud-credentials"
diff --git a/jenkins/client/job/deploy/lab/component/aaa.yml b/jenkins/client/job/deploy/lab/component/aaa.yml
index 61d0b60..1c640d5 100644
--- a/jenkins/client/job/deploy/lab/component/aaa.yml
+++ b/jenkins/client/job/deploy/lab/component/aaa.yml
@@ -4,6 +4,7 @@
   _param:
     jenkins_deploy_jobs:
       - stack_name: aaa_ha_freeipa
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,aaa
         stack_test: ""
diff --git a/jenkins/client/job/deploy/lab/component/ceph.yml b/jenkins/client/job/deploy/lab/component/ceph.yml
index 0d84374..b0b3af1 100644
--- a/jenkins/client/job/deploy/lab/component/ceph.yml
+++ b/jenkins/client/job/deploy/lab/component/ceph.yml
@@ -4,6 +4,7 @@
   _param:
     jenkins_deploy_jobs:
       - stack_name: ceph_ha
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,ceph
         stack_test: "ceph"
diff --git a/jenkins/client/job/deploy/lab/component/drivetrain.yml b/jenkins/client/job/deploy/lab/component/drivetrain.yml
index e9e00e7..945ac4a 100644
--- a/jenkins/client/job/deploy/lab/component/drivetrain.yml
+++ b/jenkins/client/job/deploy/lab/component/drivetrain.yml
@@ -4,11 +4,13 @@
   _param:
     jenkins_deploy_jobs:
       - stack_name: drivetrain_ha
+        stack_env: devcloud
         stack_type: heat
         stack_install: core
         stack_test: ""
         job_timer: ""
       - stack_name: drivetrain_ha_clusters
+        stack_env: devcloud
         stack_type: heat
         stack_install: core
         stack_test: ""
diff --git a/jenkins/client/job/deploy/lab/component/kubernetes.yml b/jenkins/client/job/deploy/lab/component/kubernetes.yml
index 9e80c64..5ef3bd9 100644
--- a/jenkins/client/job/deploy/lab/component/kubernetes.yml
+++ b/jenkins/client/job/deploy/lab/component/kubernetes.yml
@@ -4,26 +4,31 @@
   _param:
     jenkins_deploy_jobs:
       - stack_name: k8s_aio_calico
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,k8s,calico
         stack_test: ""
         job_timer: ""
       - stack_name: k8s_aio_contrail
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,k8s,contrail
         stack_test: ""
         job_timer: ""
       - stack_name: k8s_ha_calico
+        stack_env: devcloud
         stack_type: aws
         stack_install: core,k8s,calico
         stack_test: ""
         job_timer: "H H(0-6) * * *"
       - stack_name: k8s_ha_calico
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,k8s,calico
         stack_test: ""
         job_timer: "H H(0-6) * * *"
       - stack_name: k8s_ha_contrail
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,k8s,contrail
         stack_test: ""
diff --git a/jenkins/client/job/deploy/lab/component/openstack.yml b/jenkins/client/job/deploy/lab/component/openstack.yml
index 33c03f3..1e1d334 100644
--- a/jenkins/client/job/deploy/lab/component/openstack.yml
+++ b/jenkins/client/job/deploy/lab/component/openstack.yml
@@ -4,20 +4,24 @@
   _param:
     jenkins_deploy_jobs:
       - stack_name: os_aio_contrail
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,openstack,contrail
         stack_test: ""
         job_timer: ""
       - stack_name: os_aio_ovs
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,openstack,ovs
         job_timer: ""
       - stack_name: os_ha_contrail
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,openstack,contrail
         stack_test: ""
         job_timer: "H H(0-6) * * *"
       - stack_name: os_ha_ovs
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,openstack,ovs
         stack_test: ""
diff --git a/jenkins/client/job/deploy/lab/component/stacklight.yml b/jenkins/client/job/deploy/lab/component/stacklight.yml
index 2802e13..94ccce2 100644
--- a/jenkins/client/job/deploy/lab/component/stacklight.yml
+++ b/jenkins/client/job/deploy/lab/component/stacklight.yml
@@ -4,16 +4,19 @@
   _param:
     jenkins_deploy_jobs:
       - stack_name: stacklight_k8s_calico
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,k8s,calico,stacklight
         stack_test: ""
         job_timer: "H H(0-6) * * *"
       - stack_name: stacklight_os_contrail
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,openstack,contrail,stacklight
         stack_test: ""
         job_timer: "H H(0-6) * * *"
       - stack_name: stacklight_os_ovs
+        stack_env: devcloud
         stack_type: heat
         stack_install: core,openstack,ovs,stacklight
         stack_test: ""
diff --git a/jenkins/client/job/deploy/lab/deploy.yml b/jenkins/client/job/deploy/lab/deploy.yml
index 5d87340..75bab43 100644
--- a/jenkins/client/job/deploy/lab/deploy.yml
+++ b/jenkins/client/job/deploy/lab/deploy.yml
@@ -94,7 +94,7 @@
               # heat
               HEAT_STACK_ENVIRONMENT:
                 type: string
-                default: "devcloud"
+                default: "{{stack_env}}"
               HEAT_STACK_ZONE:
                 type: string
                 default: "mcp-mk"
diff --git a/jenkins/client/job/deploy/lab/init.yml b/jenkins/client/job/deploy/lab/init.yml
index 881e425..860e55f 100644
--- a/jenkins/client/job/deploy/lab/init.yml
+++ b/jenkins/client/job/deploy/lab/init.yml
@@ -1,6 +1,6 @@
 classes:
   - system.jenkins.client.job.deploy.lab.cicd
-  - system.jenkins.client.job.deploy.lab.test-cicd
+  - system.jenkins.client.job.deploy.lab.test-devops-portal-cicd
   - system.jenkins.client.job.deploy.lab.demo
   - system.jenkins.client.job.deploy.lab.cleanup
   - system.jenkins.client.job.deploy.lab.release.mcp05
diff --git a/jenkins/client/job/deploy/lab/release/mcp05.yml b/jenkins/client/job/deploy/lab/release/mcp05.yml
index 3dbc25f..5ec2787 100644
--- a/jenkins/client/job/deploy/lab/release/mcp05.yml
+++ b/jenkins/client/job/deploy/lab/release/mcp05.yml
@@ -4,11 +4,13 @@
   _param:
     jenkins_deploy_jobs:
       - stack_name: virtual_mcp05_dvr
+        stack_env: virtual_mcp05_dvr/devcloud
         stack_install: core,openstack,dvr
         stack_type: heat
         stack_test: ""
         job_timer: ""
       - stack_name: virtual_mcp05_ovs
+        stack_env: virtual_mcp05_ovs/devcloud
         stack_install: core,openstack,ovs
         stack_type: heat
         stack_test: ""
diff --git a/jenkins/client/job/deploy/lab/release/mcp10.yml b/jenkins/client/job/deploy/lab/release/mcp10.yml
index e8905ac..516d533 100644
--- a/jenkins/client/job/deploy/lab/release/mcp10.yml
+++ b/jenkins/client/job/deploy/lab/release/mcp10.yml
@@ -5,21 +5,25 @@
     jenkins_deploy_jobs:
       # physical
       - stack_name: mcp10_contrail
+        stack_env: mcp10_contrail/devcloud
         stack_install: core,kvm,openstack,contrail
         stack_type: physical
         stack_test: openstack
         job_timer: ""
       - stack_name: mcp10_opencontrail_nfv
+        stack_env: mcp10_opencontrail_nfv/devcloud
         stack_install: core,kvm,openstack,nfv
         stack_type: physical
         stack_test: openstack
         job_timer: ""
       - stack_name: mcp10_dvr
+        stack_env: mcp10_dvr/devcloud
         stack_install: core,kvm,openstack,dvr
         stack_type: physical
         stack_test: openstack
         job_timer: ""
       - stack_name: mcp10_non_dvr
+        stack_env: mcp10_non_dvr/devcloud
         stack_install: core,kvm,openstack
         stack_type: physical
         stack_test: openstack
@@ -27,16 +31,19 @@
 
       # virtual
       - stack_name: virtual_mcp10_contrail
+        stack_env: virtual_mcp10_contrail/devcloud
         stack_install: core,openstack,contrail
         stack_type: heat
         stack_test: ""
         job_timer: "H H(0-6) * * *"
       - stack_name: virtual_mcp10_dvr
+        stack_env: virtual_mcp10_dvr/devcloud
         stack_install: core,openstack,dvr
         stack_type: heat
         stack_test: ""
         job_timer: "H H(0-6) * * *"
       - stack_name: virtual_mcp10_ovs
+        stack_env: virtual_mcp10_ovs/devcloud
         stack_install: core,openstack,ovs
         stack_type: heat
         stack_test: ""
diff --git a/jenkins/client/job/deploy/lab/release/mcp11.yml b/jenkins/client/job/deploy/lab/release/mcp11.yml
index 98c8a5c..27f2184 100644
--- a/jenkins/client/job/deploy/lab/release/mcp11.yml
+++ b/jenkins/client/job/deploy/lab/release/mcp11.yml
@@ -4,46 +4,55 @@
   _param:
     jenkins_deploy_jobs:
       - stack_name: virtual_mcp11_contrail
+        stack_env: virtual_mcp11_contrail/devcloud
         stack_install: core,openstack,contrail
         stack_type: heat
         stack_test: ""
         job_timer: ""
       - stack_name: virtual_mcp11_dvr
+        stack_env: virtual_mcp11_dvr/devcloud
         stack_install: core,openstack,dvr
         stack_type: heat
         stack_test: ""
         job_timer: ""
       - stack_name: virtual_mcp11_ovs
+        stack_env: virtual_mcp11_ovs/devcloud
         stack_install: core,openstack,ovs
         stack_type: heat
         stack_test: ""
         job_timer: ""
       - stack_name: virtual_mcp11_ironic_small
+        stack_env: virtual_mcp11_ironic_small/devcloud
         stack_install: core,openstack
         stack_type: heat
         stack_test: ""
         job_timer: ""
       - stack_name: virtual_mcp11_aio
+        stack_env: virtual_mcp11_aio/devcloud
         stack_install: core,openstack
         stack_type: heat
         stack_test: ""
         job_timer: ""
       - stack_name: virtual_mcp11_k8s_calico
+        stack_env: virtual_mcp11_k8s_calico/devcloud
         stack_install: core,k8s,calico
         stack_type: heat
         stack_test: k8s
         job_timer: "H H(0-6) * * *"
       - stack_name: virtual_mcp11_k8s_contrail
+        stack_env: virtual_mcp11_k8s_contrail/devcloud
         stack_install: core,k8s,contrail
         stack_type: heat
         stack_test: k8s
         job_timer: "H H(0-6) * * *"
       - stack_name: virtual_mcp11_contrail_nfv
+        stack_env: virtual_mcp11_contrail_nfv/devcloud
         stack_install: core,openstack,contrail
         stack_type: heat
         stack_test: ""
         job_timer: "H H(0-6) * * *"
       - stack_name: virtual_mcp11_ovs_dpdk
+        stack_env: virtual_mcp11_ovs_dpdk/devcloud
         stack_install: core,openstack,ovs
         stack_type: heat
         stack_test: ""
diff --git a/jenkins/client/job/deploy/lab/release/mk.yml b/jenkins/client/job/deploy/lab/release/mk.yml
index 4fce1c5..1be1057 100644
--- a/jenkins/client/job/deploy/lab/release/mk.yml
+++ b/jenkins/client/job/deploy/lab/release/mk.yml
@@ -5,22 +5,26 @@
     jenkins_deploy_jobs:
       # mk20
       - stack_name: virtual_mk20_advanced
+        stack_env: virtual_mk20_advanced/devcloud
         stack_install: core,openstack
         stack_type: heat
         stack_test: ""
         job_timer: ""
       - stack_name: virtual_mk20_basic
+        stack_env: virtual_mk20_basic/devcloud
         stack_install: core,openstack
         stack_type: heat
         stack_test: ""
         job_timer: ""
       # mk22
       - stack_name: virtual_mk22_advanced
+        stack_env: virtual_mk22_advanced/devcloud
         stack_install: core,openstack
         stack_type: heat
         stack_test: ""
         job_timer: ""
       - stack_name: virtual_mk22_basic
+        stack_env: virtual_mk22_basic/devcloud
         stack_install: core,openstack
         stack_type: heat
         stack_test: ""
diff --git a/jenkins/client/job/deploy/lab/test-cicd.yml b/jenkins/client/job/deploy/lab/test-devops-portal-cicd.yml
similarity index 92%
rename from jenkins/client/job/deploy/lab/test-cicd.yml
rename to jenkins/client/job/deploy/lab/test-devops-portal-cicd.yml
index 0205223..8dfc70e 100644
--- a/jenkins/client/job/deploy/lab/test-cicd.yml
+++ b/jenkins/client/job/deploy/lab/test-devops-portal-cicd.yml
@@ -13,11 +13,23 @@
             display_name: "Deploy {{name}} heat stack"
             scm:
               type: git
-              url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              url: "${_param:jenkins_gerrit_url}/oss/jenkins/pipelines"
               credentials: "gerrit"
-              script: cicd-lab-pipeline.groovy
+              script: test-func-devops-portal-pipeline.groovy
             param:
               # heat
+              HEAT_STACK_DELETE:
+                type: boolean
+                default: 'true'
+                description: "Delete heat stack at the end of job"
+              HEAT_STACK_REUSE:
+                type: boolean
+                default: 'false'
+                description: "Reuse existing stack and only orchestrate deployment"
+              HEAT_STACK_KEEP_INTACT:
+                type: boolean
+                default: 'false'
+                description: "Save current deployment status without re-orchestrating"
               HEAT_TEMPLATE_URL:
                 type: string
                 default: "${_param:jenkins_gerrit_url}/mk/heat-templates"
@@ -42,14 +54,6 @@
               HEAT_STACK_PUBLIC_NET:
                 type: string
                 default: "public"
-              HEAT_STACK_DELETE:
-                type: boolean
-                default: 'true'
-                description: "Delete heat stack at the end of job"
-              HEAT_STACK_REUSE:
-                type: boolean
-                default: 'false'
-                description: "Reuse existing stack and only orchestrate deployment"
 
               # salt master
               SALT_MASTER_CREDENTIALS:
diff --git a/jenkins/client/job/deploy/test.yml b/jenkins/client/job/deploy/test.yml
new file mode 100644
index 0000000..0b5d541
--- /dev/null
+++ b/jenkins/client/job/deploy/test.yml
@@ -0,0 +1,59 @@
+parameters:
+  jenkins:
+    client:
+      job:
+        test_service_job:
+          name: deploy-test-service
+          type: workflow-scm
+          discard:
+            build:
+              keep_num: 20
+          concurrent: true
+          display_name: "Deploy - Test services in environment"
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            credentials: "gerrit"
+            script: test-service.groovy
+          param:
+
+            # salt
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt-qa-credentials"
+            SALT_MASTER_URL:
+              type: string
+              default: ""
+
+            # test
+            TEST_K8S_API_SERVER:
+              type: string
+              default: "http://127.0.0.1:8080"
+            TEST_K8S_CONFORMANCE_IMAGE:
+              type: string
+              default: "docker-dev-virtual.docker.mirantis.net/mirantis/kubernetes/k8s-conformance:v1.5.1-3_1482332392819"
+
+            TEST_TEMPEST_IMAGE:
+              type: string
+              description: "Tempest docker image"
+              default: "obutenko/rally_tempest_docker"
+            TEST_TEMPEST_TARGET:
+              type: string
+              description: "Node to run tests. use FQDN for ctl01 e.g. ctl01.deploy-heat-os_ha_contrail-17.bud-mk.local"
+              default: ""
+            TEST_DOCKER_INSTALL:
+              type: boolean
+              description: "Install docker on the target if true"
+              default: "true"
+            TEST_TEMPEST_PATTERN:
+              type: string
+              description: "Run tests matched to pattern only e.g. tempest.api.identity"
+              default: "false"
+            TEST_SERVICE:
+              type: string
+              description: "openstack or k8s"
+              default: "openstack"
+            TEST_JUNIT_RATIO:
+              type: string
+              description: "The amplification factor to apply to test failures when computing the test result contribution to the build health score."
+              default: "1.0"
diff --git a/jenkins/client/job/deploy/update/package.yml b/jenkins/client/job/deploy/update/package.yml
index a4e7fc0..55a9ef0 100644
--- a/jenkins/client/job/deploy/update/package.yml
+++ b/jenkins/client/job/deploy/update/package.yml
@@ -29,7 +29,7 @@
               description: Salt compound target to match nodes to be updated [*, G@osfamily:debian].
             TARGET_PACKAGES:
               type: string
-              description: Space delimited list of packages to be updates [package1=version package2=version], empty string means all updating all packages to the latest version.
+              description: Space delimited list of packages to be updated, empty string means updating all packages to the latest version e.g. [package1=version package2=version] or [package1 package2].
             TARGET_SUBSET_TEST:
               type: string
               description: Number of nodes to list package updates, empty string means all targetted nodes.
diff --git a/jenkins/client/job/docker/oss/janitor-monkey-docker.yml b/jenkins/client/job/docker/oss/janitor-monkey-docker.yml
index 083d086..78167bd 100644
--- a/jenkins/client/job/docker/oss/janitor-monkey-docker.yml
+++ b/jenkins/client/job/docker/oss/janitor-monkey-docker.yml
@@ -58,10 +58,4 @@
               default: "Dockerfile"
             CONTEXT_PATH:
               type: string
-              default: "."
-            CI_BUILD_ARG_JANITOR_MONKEY_REPO:
-              type: string
-              default: ""
-            CI_BUILD_ARG_JANITOR_MONKEY_REF:
-              type: string
-              default: ""
\ No newline at end of file
+              default: "."
\ No newline at end of file
diff --git a/jenkins/client/job/docker/oss/pushkin-docker.yml b/jenkins/client/job/docker/oss/pushkin-docker.yml
index d71e701..e77e99b 100644
--- a/jenkins/client/job/docker/oss/pushkin-docker.yml
+++ b/jenkins/client/job/docker/oss/pushkin-docker.yml
@@ -58,16 +58,4 @@
               default: "Dockerfile"
             CONTEXT_PATH:
               type: string
-              default: "."
-            CI_BUILD_ARG_PUSHKIN_REPO:
-              type: string
-              default: ""
-            CI_BUILD_ARG_PUSHKIN_REF:
-              type: string
-              default: ""
-            CI_BUILD_ARG_PUSHKIN_EXT_REPO:
-              type: string
-              default: ""
-            CI_BUILD_ARG_PUSHKIN_EXT_REF:
-              type: string
-              default: ""
\ No newline at end of file
+              default: "."
\ No newline at end of file
diff --git a/jenkins/client/job/docker/oss/security-monkey-docker.yml b/jenkins/client/job/docker/oss/security-monkey-docker.yml
index 7724f80..b9d4512 100644
--- a/jenkins/client/job/docker/oss/security-monkey-docker.yml
+++ b/jenkins/client/job/docker/oss/security-monkey-docker.yml
@@ -58,16 +58,4 @@
               default: "security-monkey/Dockerfile"
             CONTEXT_PATH:
               type: string
-              default: "."
-            CI_BUILD_ARG_SECURITY_MONKEY_REPO:
-              type: string
-              default: ""
-            CI_BUILD_ARG_SECURITY_MONKEY_REF:
-              type: string
-              default: ""
-            CI_BUILD_ARG_SECURITY_MONKEY_OPENSTACK_REPO:
-              type: string
-              default: ""
-            CI_BUILD_ARG_SECURITY_MONKEY_OPENSTACK_REF:
-              type: string
-              default: ""
\ No newline at end of file
+              default: "."
\ No newline at end of file
diff --git a/jenkins/client/job/gating.yml b/jenkins/client/job/gating.yml
index 6886b06..d0f2149 100644
--- a/jenkins/client/job/gating.yml
+++ b/jenkins/client/job/gating.yml
@@ -38,7 +38,6 @@
             quiet_period: 60
             trigger:
               gerrit:
-                silent_start_mode: true
                 project:
                   '{{regex}}':
                     compare_type: REG_EXP
diff --git a/jenkins/client/job/opencontrail/init.yml b/jenkins/client/job/opencontrail/init.yml
index 4b42d50..e07adaf 100644
--- a/jenkins/client/job/opencontrail/init.yml
+++ b/jenkins/client/job/opencontrail/init.yml
@@ -5,10 +5,10 @@
   _param:
     contrail_branches: "R3.0.2.x,R3.0.3.x,R3.1,R3.1.1.x,R3.2,R3.2.3.x,R4.0,master"
     contrail_kubernetes_branches: "master,release-1.2"
-    contrail_dpdk_extra_branches: "mitaka,mitaka_dpdk_17_02,mitaka_dpdk_17_05,kilo,liberty-multiqueue,newton"
+    contrail_dpdk_extra_branches: "mitaka,mitaka_dpdk_17_02,mitaka_dpdk_17_05,kilo,liberty-multiqueue,newton,ocata"
     contrail_ceilometer_plugin_branches: "master,R4.0"
     contrail_kubernetes_branches: "master,origin-1.1,origin-1.1.3,release-1.1,release-1.2"
-    contrail_dpdk_branches: "master,R3.0.2.x,R3.0.3.x,R3.1,R3.1.1.x,R3.2,R3.2.3.x,R4.0,contrail_dpdk_17_02,contrail_dpdk_17_05,contrail_dpdk_1_7,contrail_dpdk_2_0,contrail_dpdk_2_1"
+    contrail_dpdk_branches: "master,R3.0.2.x,R3.0.3.x,R3.1,R3.1.1.x,R3.2,R3.2.3.x,R4.0,R4.0.1,contrail_dpdk_17_02,contrail_dpdk_17_05,contrail_dpdk_1_7,contrail_dpdk_2_0,contrail_dpdk_2_1"
   jenkins:
     client:
       view:
@@ -27,6 +27,8 @@
               naming_rule: "R3.1.1.x"
             - group_regex: "build-opencontrail-oc32-.*"
               naming_rule: "R3.2"
+            - group_regex: "build-opencontrail-oc323-.*"
+              naming_rule: "R3.2.3.x"
             - group_regex: "build-opencontrail-oc40-.*"
               naming_rule: "R4.0"
             - group_regex: "build-opencontrail-oc666-.*"
diff --git a/jenkins/client/job/salt-models/tests.yml b/jenkins/client/job/salt-models/tests.yml
index 4b6c006..7849adc 100644
--- a/jenkins/client/job/salt-models/tests.yml
+++ b/jenkins/client/job/salt-models/tests.yml
@@ -73,6 +73,16 @@
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
               credentials: "gerrit"
               script: test-system-reclass-pipeline.groovy
+            trigger:
+              gerrit:
+                project:
+                  salt-models/{{name}}:
+                    branches:
+                      - master
+                event:
+                  comment:
+                    - addedContains:
+                        commentAddedCommentContains: '(recheck|reverify)'
             concurrent: true
             param:
               TEST_MODELS:
@@ -85,6 +95,9 @@
               DEFAULT_GIT_REF:
                 type: string
                 default: master
+              PARALLEL_NODE_GROUP_SIZE:
+                type: string
+                default: "5"
         test_salt_model_cookiecutter:
           name: test-salt-model-cookiecutter-{{cookiecutter_template}}
           jobs:
diff --git a/jenkins/client/job/test_pipelines.yml b/jenkins/client/job/test_pipelines.yml
index d0f0a6e..822084d 100644
--- a/jenkins/client/job/test_pipelines.yml
+++ b/jenkins/client/job/test_pipelines.yml
@@ -46,7 +46,7 @@
                 default: "niaquinto/gradle"
               GRADLE_CMD:
                 type: string
-                default: "check"
+                default: "check --info"
               DEFAULT_GIT_URL:
                   type: string
                   description: "Run against alternate system reclass"
diff --git a/jenkins/client/job/validate.yml b/jenkins/client/job/validate.yml
new file mode 100644
index 0000000..f8ebcc7
--- /dev/null
+++ b/jenkins/client/job/validate.yml
@@ -0,0 +1,49 @@
+parameters:
+  jenkins:
+    client:
+      view:
+        Validation:
+          enabled: true
+          type: ListView
+          include_regex: "validate.*"
+      job:
+        validate_openstack:
+          type: workflow-scm
+          name: validate-openstack
+          display_name: "Validate - Openstack"
+          discard:
+            build:
+              keep_num: 20
+            artifact:
+              keep_num: 20
+          concurrent: false
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            credentials: "gerrit"
+            script: validate-cloud.groovy
+
+          param:
+            SALT_MASTER_URL:
+              type: string
+              default: ""
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+            TEST_IMAGE:
+              type: string
+              default: "docker-prod-local.artifactory.mirantis.com/mirantis/oss/qa-tools"
+            TARGET_NODE:
+              type: string
+              default: ""
+            RUN_RALLY_TESTS:
+              type: boolean
+              default: 'true'
+            RUN_TEMPEST_TESTS:
+              type: boolean
+              default: 'true'
+            TEMPEST_TEST_SET:
+              type: choice
+              choices:
+                - smoke
+                - full
diff --git a/keystone/server/cluster.yml b/keystone/server/cluster.yml
index 9b13788..0c79462 100644
--- a/keystone/server/cluster.yml
+++ b/keystone/server/cluster.yml
@@ -4,6 +4,12 @@
 - system.haproxy.proxy.listen.openstack.keystone
 - system.haproxy.proxy.listen.openstack.keystone.standalone
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   keystone:
     server:
       enabled: true
diff --git a/keystone/server/single.yml b/keystone/server/single.yml
index 72dc045..c35ef73 100644
--- a/keystone/server/single.yml
+++ b/keystone/server/single.yml
@@ -7,6 +7,12 @@
     mysql_admin_user: root
     mysql_admin_password: password
     mysql_keystone_password: password
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   keystone:
     server:
       enabled: true
diff --git a/linux/system/repo/ceph.yml b/linux/system/repo/ceph.yml
new file mode 100644
index 0000000..ccf63d7
--- /dev/null
+++ b/linux/system/repo/ceph.yml
@@ -0,0 +1,11 @@
+parameters:
+  _param:
+    linux_repo_ceph_component: jewel
+    linux_repo_ceph_mirror: download
+  linux:
+    system:
+      repo:
+        ceph:
+          source: "deb [arch=amd64] https://${_param:linux_repo_ceph_mirror}.ceph.com/debian-${_param:linux_repo_ceph_component} ${_param:linux_system_codename} main"
+          architectures: amd64
+          key_url: "https://${_param:linux_repo_ceph_mirror}.ceph.com/keys/release.asc"
diff --git a/linux/system/repo/mcp/contrail.yml b/linux/system/repo/mcp/contrail.yml
index 0d9d68e..8dad590 100644
--- a/linux/system/repo/mcp/contrail.yml
+++ b/linux/system/repo/mcp/contrail.yml
@@ -7,7 +7,7 @@
     system:
       repo:
         mcp_opencontrail:
-          source: "deb [arch=amd64] http://apt-mk.mirantis.com/${_param:linux_system_codename}/ ${_param:linux_system_repo_mcp_contrail_version} ${_param:openstack_version} ${_param:linux_repo_contrail_component} extra"
+          source: "deb [arch=amd64] http://apt-mk.mirantis.com/${_param:linux_system_codename}/ ${_param:linux_system_repo_mcp_contrail_version} ${_param:linux_repo_contrail_component} extra"
           architectures: amd64
           key_url: "http://apt-mk.mirantis.com/public.gpg"
           pin:
diff --git a/linux/system/sudo.yml b/linux/system/sudo.yml
index ba499d1..68f2b84 100644
--- a/linux/system/sudo.yml
+++ b/linux/system/sudo.yml
@@ -22,21 +22,32 @@
     - /bin/su
     - /usr/sbin/visudo
     - /usr/bin/sudo
+    - /bin/bash
     sudo_coreutils_safe:
+    - /usr/bin/cat
     - /usr/bin/less
+    - /usr/bin/view
+    - /usr/bin/more
     - /usr/bin/grep
     - /usr/bin/fgrep
     - /usr/bin/egrep
     - /usr/bin/zgrep
+    - /usr/bin/ack
     - /usr/bin/tail
     - /usr/bin/socat
     - /usr/bin/top
+    - /usr/bin/atop
     - /usr/bin/tail
     - /usr/bin/lsof
     - /usr/bin/virsh
     - /bin/ls
     - /bin/cp
     - /bin/netstat
+    sudo_coreutils_trusted:
+    - /usr/bin/vi*
+    - /usr/bin/vim*
+    - /usr/bin/emacs*
+    - /usr/bin/nano*
     sudo_rabbitmq_safe:
     - /usr/sbin/rabbitmqctl
     - /usr/sbin/rabbitmqctl status
@@ -80,6 +91,9 @@
     - /usr/bin/rados*
     - /usr/bin/rbd
     - /usr/sbin/gluster
+    - /usr/fdisk -l *
+    - /usr/bin/du *
+    - /bin/df *
     sudo_openstack_clients:
     - /usr/bin/openstack
     - /usr/bin/heat*
diff --git a/neutron/compute/cluster.yml b/neutron/compute/cluster.yml
index d6674f0..fc87e84 100644
--- a/neutron/compute/cluster.yml
+++ b/neutron/compute/cluster.yml
@@ -3,6 +3,12 @@
 parameters:
   _param:
     neutron_enable_qos: False
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   neutron:
     compute:
       dvr: ${_param:neutron_compute_dvr}
diff --git a/neutron/control/cluster.yml b/neutron/control/cluster.yml
index dd1d3ee..9beed6b 100644
--- a/neutron/control/cluster.yml
+++ b/neutron/control/cluster.yml
@@ -4,6 +4,12 @@
 - service.neutron.control.cluster
 - system.haproxy.proxy.listen.openstack.neutron
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   mysql:
     server:
       database:
diff --git a/neutron/control/single.yml b/neutron/control/single.yml
index 663ec32..e412f36 100644
--- a/neutron/control/single.yml
+++ b/neutron/control/single.yml
@@ -1,6 +1,12 @@
 classes:
 - service.neutron.control.single
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   neutron:
     server:
       database:
diff --git a/nova/client/service/octavia.yml b/nova/client/service/octavia.yml
index e0b6557..e31fde3 100644
--- a/nova/client/service/octavia.yml
+++ b/nova/client/service/octavia.yml
@@ -1,8 +1,6 @@
 classes:
 - service.nova.client
 parameters:
-  _param:
-    octavia_ssh_key_path: "/etc/octavia/.ssh/octavia_ssh_key.pub"
   nova:
     client:
       server:
@@ -18,4 +16,4 @@
           endpoint_type: internalURL
           keypair:
             octavia_ssh_key:
-              pub_file: ${_param:octavia_ssh_key_path}
+              pub_key: ${_param:octavia_public_key}
diff --git a/nova/control/cluster.yml b/nova/control/cluster.yml
index d47c5e1..dee725d 100644
--- a/nova/control/cluster.yml
+++ b/nova/control/cluster.yml
@@ -11,6 +11,12 @@
     nova_ram_allocation_ratio: 1.5
     nova_disk_allocation_ratio: 1.0
     metadata_password: metadataPass
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   nova:
     controller:
       enabled: true
diff --git a/nova/control/single.yml b/nova/control/single.yml
index 00182a3..c2aef10 100644
--- a/nova/control/single.yml
+++ b/nova/control/single.yml
@@ -1,6 +1,12 @@
 classes:
 - service.nova.control.single
 parameters:
+  linux:
+    system:
+      package:
+        python-pymysql:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   nova:
     controller:
       database:
diff --git a/octavia/manager/single.yml b/octavia/manager/single.yml
index a7bc7a9..acab136 100644
--- a/octavia/manager/single.yml
+++ b/octavia/manager/single.yml
@@ -5,3 +5,7 @@
     manager:
       enabled: true
       version: ${_param:octavia_version}
+      ssh:
+        private_key: ${_param:octavia_private_key}
+        user: octavia
+        group: octavia
diff --git a/opencontrail/client/resource/k8s_api.yml b/opencontrail/client/resource/k8s_api.yml
index 3c6102b..79d6f0d 100644
--- a/opencontrail/client/resource/k8s_api.yml
+++ b/opencontrail/client/resource/k8s_api.yml
@@ -4,6 +4,6 @@
       linklocal_service:
         k8s_api:
           lls_ip: ${_param:kubernetes_internal_api_address}
-          lls_port: 6443
+          lls_port: 443
           ipf_addresses: ${_param:kubernetes_control_address}
           ipf_port: 443
diff --git a/opencontrail/control/control.yml b/opencontrail/control/control.yml
index fdc4f7d..50c0c77 100644
--- a/opencontrail/control/control.yml
+++ b/opencontrail/control/control.yml
@@ -4,7 +4,10 @@
 - system.haproxy.proxy.listen.opencontrail.control
 parameters:
   _param:
-    multi_tenancy: false  
+    multi_tenancy: false
+    opencontrail_message_queue_node01_address: ${_param:openstack_message_queue_node01_address}
+    opencontrail_message_queue_node02_address: ${_param:openstack_message_queue_node02_address}
+    opencontrail_message_queue_node03_address: ${_param:openstack_message_queue_node03_address}
   opencontrail:
     common:
       identity:
@@ -21,9 +24,9 @@
         address: ${_param:cluster_local_address}
       message_queue:
         members:
-          - host: ${_param:openstack_message_queue_node01_address}
-          - host: ${_param:openstack_message_queue_node02_address}
-          - host: ${_param:openstack_message_queue_node03_address}
+          - host: ${_param:opencontrail_message_queue_node01_address}
+          - host: ${_param:opencontrail_message_queue_node02_address}
+          - host: ${_param:opencontrail_message_queue_node03_address}
       identity:
         region: ${_param:openstack_region}
         host: ${_param:openstack_control_address}
diff --git a/openssh/server/team/members/dkalashnik.yml b/openssh/server/team/members/dkalashnik.yml
new file mode 100644
index 0000000..52a2a69
--- /dev/null
+++ b/openssh/server/team/members/dkalashnik.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        dkalashnik:
+          enabled: true
+          name: dkalashnik
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Dmitry Kalashnik
+          home: /home/dkalashnik
+          email: dkalashnik@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        dkalashnik:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAyz5ovMK/rRxlhiy7x4dVwFkUqN/hhdVIpsQRQoGgTOjVhH6Y+eTE3si0RRq/HKZMwkcClJIqzMgjoajT5eQQphQrAAn2pwuCyZj0mXJJ1RSXQm+nSnhoqyB1r7Nl3keopgxrDlBLWyvyS3dJM9RJy4TimIwhuSA3qdhmfeqRm5M=
+          user: ${linux:system:user:dkalashnik}
\ No newline at end of file
diff --git a/openssh/server/team/members/mniedbala.yml b/openssh/server/team/members/mniedbala.yml
new file mode 100644
index 0000000..30f7f30
--- /dev/null
+++ b/openssh/server/team/members/mniedbala.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        mniedbala:
+          enabled: true
+          name: mniedbala
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Mikolaj Niedbala
+          home: /home/mniedbala
+          email: mniedbala@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        mniedbala:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNepHgtflir2vNW+h9cr3hP3llsTlg5uIvvmByykfk455Cum0vSO27mWKZJu0ebU4LXfeH+WP4MjR3tKAKvXqzjGhPVGjMO3wo4/NLlel2CDx99w0KotcjQhW6p+iqLv1AT9E5LW4Kr1NuQ65nvGn6y4SevRw2y36bNS4VJBq40HlgQFTW3oNP+5u4TVzu7QQhulsTUdQETgLswZKsarX7whgvcHvFs1dnbriZlkPXvrKhZLA/CUb7ot+ugw6KWOl+g4gTFLjnt0IXjJXMstCOL9R7/juflUku9CYFvSuq4/T67yMW7XntQ89VkwudSCMjjUWg6ilEG0ghd9+b3bPr mniedbala@mirantis.com
+          user: ${linux:system:user:mniedbala}
diff --git a/openssh/server/team/mmo_devops.yml b/openssh/server/team/mmo_devops.yml
index fae9be2..1fe82c6 100644
--- a/openssh/server/team/mmo_devops.yml
+++ b/openssh/server/team/mmo_devops.yml
@@ -1,11 +1,9 @@
 classes:
 # DevOps/SRE Team
 - system.openssh.server.team.members.cade
-- system.openssh.server.team.members.dszeluga
 - system.openssh.server.team.members.jmosher
 - system.openssh.server.team.members.ecantwell
 - system.openssh.server.team.members.lmercl
-- system.openssh.server.team.members.mrelewicz
 - system.openssh.server.team.members.mwilson
 - system.openssh.server.team.members.osmola
 - system.openssh.server.team.members.pcizinsky
diff --git a/openssh/server/team/services.yml b/openssh/server/team/services.yml
new file mode 100644
index 0000000..564fc32
--- /dev/null
+++ b/openssh/server/team/services.yml
@@ -0,0 +1,9 @@
+classes:
+- system.linux.system.sudo
+- system.openssh.server.team.members.mniedbala
+parameters:
+  linux:
+    system:
+      user:
+        mniedbala:
+          sudo: true
diff --git a/openssh/server/team/support.yml b/openssh/server/team/support.yml
index 7c0c810..d164d2d 100644
--- a/openssh/server/team/support.yml
+++ b/openssh/server/team/support.yml
@@ -39,7 +39,6 @@
 - system.openssh.server.team.members.jmosher
 - system.openssh.server.team.members.ecantwell
 - system.openssh.server.team.members.lmercl
-- system.openssh.server.team.members.mrelewicz
 - system.openssh.server.team.members.osmola
 - system.openssh.server.team.members.pcizinsky
 - system.openssh.server.team.members.pmathews
@@ -52,8 +51,10 @@
       group:
         supportl1:
           enabled: false
+          name: supportl1
         supportl2:
           enabled: false
+          name: supportl2
         support0:
           enabled: true
           name: support0
@@ -62,66 +63,64 @@
           name: support1
           addusers:
             # L1
-            - ${linux:system:users:ardobdin:name}
-            - ${linux:system:users:arubtsov:name}
-            - ${linux:system:users:aneliubin:name}
-            - ${linux:system:users:arodionov:name}
-            - ${linux:system:users:cmay:name}
-            - ${linux:system:users:dakhmetov:name}
-            - ${linux:system:users:dkostriukov:name}
-            - ${linux:system:users:dgoloshubov:name}
-            - ${linux:system:users:jdiaz:name}
-            - ${linux:system:users:jpalmerin:name}
-            - ${linux:system:users:kfranckowski:name}
-            - ${linux:system:users:mroark:name}
-            - ${linux:system:users:mefimov:name}
-            - ${linux:system:users:mkraynov:name}
-            - ${linux:system:users:nkabanova:name}
-            - ${linux:system:users:rsoto:name}
-            - ${linux:system:users:rsafonov:name}
-            - ${linux:system:users:smachtmes:name}
-            - ${linux:system:users:zkhurasani:name}
+            - ${linux:system:user:adobdin:name}
+            - ${linux:system:user:arubtsov:name}
+            - ${linux:system:user:aneliubin:name}
+            - ${linux:system:user:arodionov:name}
+            - ${linux:system:user:cmay:name}
+            - ${linux:system:user:dakhmetov:name}
+            - ${linux:system:user:dkostriukov:name}
+            - ${linux:system:user:dgoloshubov:name}
+            - ${linux:system:user:jdiaz:name}
+            - ${linux:system:user:jpalmerin:name}
+            - ${linux:system:user:kfranckowski:name}
+            - ${linux:system:user:mroark:name}
+            - ${linux:system:user:mefimov:name}
+            - ${linux:system:user:mkraynov:name}
+            - ${linux:system:user:nkabanova:name}
+            - ${linux:system:user:rsoto:name}
+            - ${linux:system:user:rsafonov:name}
+            - ${linux:system:user:smachtmes:name}
+            - ${linux:system:user:zkhurasani:name}
         support2:
           enabled: true
           name: support2
           addusers:
             # L2OPS
-            - ${linux:system:users:aepifanov:name}
-            - ${linux:system:users:apetrenko:name}
-            - ${linux:system:users:atarasov:name}
-            - ${linux:system:users:dklepikov:name}
-            - ${linux:system:users:dsutyagin:name}
-            - ${linux:system:users:ekozhemyaki:name}
-            - ${linux:system:users:enikanorov:name}
-            - ${linux:system:users:fsoppelsa:name}
-            - ${linux:system:users:manashkin:name}
-            - ${linux:system:users:nkondra:name}
-            - ${linux:system:users:obryndzii:name}
-            - ${linux:system:users:oliemieshko:name}
-            - ${linux:system:users:sovsianikov:name}
+            - ${linux:system:user:aepifanov:name}
+            - ${linux:system:user:apetrenko:name}
+            - ${linux:system:user:atarasov:name}
+            - ${linux:system:user:dklepikov:name}
+            - ${linux:system:user:dsutyagin:name}
+            - ${linux:system:user:ekozhemyakin:name}
+            - ${linux:system:user:enikanorov:name}
+            - ${linux:system:user:fsoppelsa:name}
+            - ${linux:system:user:manashkin:name}
+            - ${linux:system:user:nkondra:name}
+            - ${linux:system:user:obryndzii:name}
+            - ${linux:system:user:oliemieshko:name}
+            - ${linux:system:user:sovsianikov:name}
             # L2OPS SRE
-            - ${linux:system:users:pmichalec:name}
-            - ${linux:system:users:pmathews:name}
-            - ${linux:system:users:pcizinsky:name}
-            - ${linux:system:users:osmola:name}
-            - ${linux:system:users:cade:name}
-            - ${linux:system:users:jmosher:name}
-            - ${linux:system:users:ecantwell:name}
-            - ${linux:system:users:lmercl:name}
-            - ${linux:system:users:mrelewicz:name}
+            - ${linux:system:user:pmichalec:name}
+            - ${linux:system:user:pmathews:name}
+            - ${linux:system:user:pcizinsky:name}
+            - ${linux:system:user:osmola:name}
+            - ${linux:system:user:cade:name}
+            - ${linux:system:user:jmosher:name}
+            - ${linux:system:user:ecantwell:name}
+            - ${linux:system:user:lmercl:name}
         support3:
           enabled: false
           name: support3
           addusers:
-            - ${linux:system:users:pmichalec:name}
-            - ${linux:system:users:pmathews:name}
-            - ${linux:system:users:pcizinsky:name}
-            - ${linux:system:users:osmola:name}
-            - ${linux:system:users:cade:name}
-            - ${linux:system:users:jmosher:name}
-            - ${linux:system:users:ecantwell:name}
-            - ${linux:system:users:lmercl:name}
-            - ${linux:system:users:mrelewicz:name}
+            - ${linux:system:user:pmichalec:name}
+            - ${linux:system:user:pmathews:name}
+            - ${linux:system:user:pcizinsky:name}
+            - ${linux:system:user:osmola:name}
+            - ${linux:system:user:cade:name}
+            - ${linux:system:user:jmosher:name}
+            - ${linux:system:user:ecantwell:name}
+            - ${linux:system:user:lmercl:name}
       sudo:
         enabled: true
         aliases:
diff --git a/prometheus/server/target/kubernetes/endpoint.yml b/prometheus/server/target/kubernetes/endpoint.yml
new file mode 100644
index 0000000..671f037
--- /dev/null
+++ b/prometheus/server/target/kubernetes/endpoint.yml
@@ -0,0 +1,7 @@
+parameters:
+  prometheus:
+    server:
+      target:
+        kubernetes:
+          endpoint:
+            enabled: true
diff --git a/prometheus/server/target/kubernetes.yml b/prometheus/server/target/kubernetes/init.yml
similarity index 100%
rename from prometheus/server/target/kubernetes.yml
rename to prometheus/server/target/kubernetes/init.yml
diff --git a/prometheus/server/target/kubernetes/pod.yml b/prometheus/server/target/kubernetes/pod.yml
new file mode 100644
index 0000000..964282f
--- /dev/null
+++ b/prometheus/server/target/kubernetes/pod.yml
@@ -0,0 +1,7 @@
+parameters:
+  prometheus:
+    server:
+      target:
+        kubernetes:
+          pod:
+            enabled: true
diff --git a/rabbitmq/server/vhost/opencontrail.yml b/rabbitmq/server/vhost/opencontrail.yml
new file mode 100644
index 0000000..8f88cee
--- /dev/null
+++ b/rabbitmq/server/vhost/opencontrail.yml
@@ -0,0 +1,12 @@
+parameters:
+  rabbitmq:
+    server:
+      host:
+        '/':
+          enabled: true
+          user: guest
+          password: guest
+          policies:
+          - name: HA
+            pattern: '^(?!amq\.).*'
+            definition: '{"ha-mode": "all", "message-ttl": 120000}'
diff --git a/reclass/storage/system/ceph_mon_cluster.yml b/reclass/storage/system/ceph_mon_cluster.yml
new file mode 100644
index 0000000..6b99d21
--- /dev/null
+++ b/reclass/storage/system/ceph_mon_cluster.yml
@@ -0,0 +1,38 @@
+parameters:
+  _param:
+    ceph_mon_node01_hostname: cmn01
+    ceph_mon_node02_hostname: cmn02
+    ceph_mon_node03_hostname: cmn03
+  reclass:
+    storage:
+      node:
+        ceph_mon_node01:
+          name: ${_param:ceph_mon_node01_hostname}
+          domain: ${_param:cluster_domain}
+          classes:
+          - cluster.${_param:cluster_name}.ceph.mon
+          params:
+            salt_master_host: ${_param:reclass_config_master}
+            linux_system_codename: xenial
+            single_address: ${_param:ceph_mon_node01_address}
+            keepalived_vip_priority: 103
+        ceph_mon_node02:
+          name: ${_param:ceph_mon_node02_hostname}
+          domain: ${_param:cluster_domain}
+          classes:
+          - cluster.${_param:cluster_name}.ceph.mon
+          params:
+            salt_master_host: ${_param:reclass_config_master}
+            linux_system_codename: xenial
+            single_address: ${_param:ceph_mon_node02_address}
+            keepalived_vip_priority: 102
+        ceph_mon_node03:
+          name: ${_param:ceph_mon_node03_hostname}
+          domain: ${_param:cluster_domain}
+          classes:
+          - cluster.${_param:cluster_name}.ceph.mon
+          params:
+            salt_master_host: ${_param:reclass_config_master}
+            linux_system_codename: xenial
+            single_address: ${_param:ceph_mon_node03_address}
+            keepalived_vip_priority: 101
diff --git a/reclass/storage/system/openstack_dns_cluster.yml b/reclass/storage/system/openstack_dns_cluster.yml
index d134c88..d671e78 100644
--- a/reclass/storage/system/openstack_dns_cluster.yml
+++ b/reclass/storage/system/openstack_dns_cluster.yml
@@ -12,7 +12,7 @@
           - cluster.${_param:cluster_name}.openstack.dns
           params:
             salt_master_host: ${_param:reclass_config_master}
-            linux_system_codename: trusty
+            linux_system_codename: xenial
             single_address: ${_param:openstack_dns_node01_address}
             keepalived_vip_priority: 110
         openstack_dns_node02:
@@ -22,6 +22,6 @@
           - cluster.${_param:cluster_name}.openstack.dns
           params:
             salt_master_host: ${_param:reclass_config_master}
-            linux_system_codename: trusty
+            linux_system_codename: xenial
             single_address: ${_param:openstack_dns_node02_address}
             keepalived_vip_priority: 111
diff --git a/salt/minion/ca/octavia_ca.yml b/salt/minion/ca/octavia_ca.yml
index ac66bec..453c450 100644
--- a/salt/minion/ca/octavia_ca.yml
+++ b/salt/minion/ca/octavia_ca.yml
@@ -27,3 +27,7 @@
           days_valid:
             authority: ${_param:octavia_ca_days_valid_authority}
             certificate: ${_param:octavia_ca_days_valid_certificate}
+          ca_file: ${octavia:manager:certificates:ca_certificate}
+          ca_key_file: ${octavia:manager:certificates:ca_private_key}
+          user: octavia
+          group: octavia
diff --git a/salt/minion/cert/octavia/amphora_client.yml b/salt/minion/cert/octavia/amphora_client.yml
new file mode 100644
index 0000000..fd8f465
--- /dev/null
+++ b/salt/minion/cert/octavia/amphora_client.yml
@@ -0,0 +1,12 @@
+classes:
+- system.salt.minion.cert.octavia
+parameters:
+  salt:
+    minion:
+      cert:
+        octavia_amp_client:
+          ca_file: ${octavia:manager:certificates:ca_certificate}
+          ca_key_file: ${octavia:manager:certificates:ca_private_key}
+          key_file: ${octavia:manager:haproxy_amphora:client_cert_key}
+          cert_file: ${octavia:manager:haproxy_amphora:client_cert}
+          all_file: ${octavia:manager:haproxy_amphora:client_cert_all}
diff --git a/salt/minion/cert/octavia_amp_client.yml b/salt/minion/cert/octavia/init.yml
similarity index 60%
rename from salt/minion/cert/octavia_amp_client.yml
rename to salt/minion/cert/octavia/init.yml
index 5219450..25d3ee4 100644
--- a/salt/minion/cert/octavia_amp_client.yml
+++ b/salt/minion/cert/octavia/init.yml
@@ -12,10 +12,5 @@
           common_name: octavia_amp_client
           signing_policy: cert_open
           key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
-          ca_file: ${octavia:manager:certificates:ca_certificate}
-          ca_key_file: ${octavia:manager:certificates:ca_private_key}
-          key_file: ${octavia:manager:haproxy_amphora:client_cert_key}
-          cert_file: ${octavia:manager:haproxy_amphora:client_cert}
-          all_file: ${octavia:manager:haproxy_amphora:client_cert_all}
           user: octavia
           group: octavia
diff --git a/salt/minion/cert/prometheus_server.yml b/salt/minion/cert/prometheus_server.yml
index 30a0711..154009b 100644
--- a/salt/minion/cert/prometheus_server.yml
+++ b/salt/minion/cert/prometheus_server.yml
@@ -9,5 +9,4 @@
           cert_file: ${prometheus:server:dir:config}/prometheus-server.crt
           common_name: prometheus-server
           signing_policy: cert_client
-          alternative_names: IP:${_param:cluster_vip_address},IP:${_param:cluster_node01_address},IP:${_param:cluster_node02_address},IP:${_param:cluster_node03_address},IP:${_param:kubernetes_internal_api_address}
           mode: '0444'