diff --git a/.releasenotes/notes/dop-proxy-2427ec3814c4b467.yaml b/.releasenotes/notes/dop-proxy-2427ec3814c4b467.yaml
new file mode 100644
index 0000000..9ce4d3b
--- /dev/null
+++ b/.releasenotes/notes/dop-proxy-2427ec3814c4b467.yaml
@@ -0,0 +1,15 @@
+---
+prelude: >
+  Default proxy configuration for Devops Portal Dasboard and Rundeck Service added
+features:
+  - |
+    In case of using OSS through proxy configurations,
+    need to define following classes for proxy nodes on cluster level 'cluster_name/stacklight/proxy.yml' or 'cluster_name/openstack/proxy.yml':
+
+     .. code-block:: yaml
+     - system.nginx.server.proxy.oss.devops_portal
+     - system.nginx.server.proxy.oss.rundeck
+
+fixes:
+  - |
+    https://mirantis.jira.com/browse/PROD-14376
diff --git a/.releasenotes/notes/prometheus-2.0-2a7b3bc4ad76e118.yaml b/.releasenotes/notes/prometheus-2.0-2a7b3bc4ad76e118.yaml
index 6ba618b..af017f5 100644
--- a/.releasenotes/notes/prometheus-2.0-2a7b3bc4ad76e118.yaml
+++ b/.releasenotes/notes/prometheus-2.0-2a7b3bc4ad76e118.yaml
@@ -16,30 +16,33 @@
        with previous versions. Therefore, you must upgrade the
        monitoring stack as described in the MCP Operations Guide.
 
-       If You want to stick to 1.7 (NOT RECOMMENDATED), update
-       reclass model:
+    To continue using Prometheus v1.7, add the following snippet
+    to the Reclass model of your MCP deployment. However, Mirantis
+    recommends that you update your monitoring stack to obtain new
+    features such as performance improvements.
 
-      .. code-block:: yaml
 
-         _param:
-           docker_image_alertmanager: docker-prod-virtual.docker.mirantis.net/openstack-docker/alertmanager:20171222124606
-           docker_image_pushgateway: docker-prod-virtual.docker.mirantis.net/openstack-docker/pushgateway:20171222124606
-           docker_image_prometheus: docker-prod-virtual.docker.mirantis.net/openstack-docker/prometheus:20171222124606
-           docker_image_remote_storage_adapter: docker-prod-virtual.docker.mirantis.net/openstack-docker/remote_storage_adapter:20171222124606
-         docker:
-           client:
-             stack:
-               monitoring:
-                 service:
-                   server:
-                     environment:
-                       PROMETHEUS_STORAGE_LOCAL_ENGINE: persisted
-                       PROMETHEUS_STORAGE_LOCAL_TARGET_HEAP_SIZE: 3221225472
-                       PROMETHEUS_STORAGE_LOCAL_NUM_FINGERPRINT_MUTEXES: 4096
+    .. code-block:: yaml
 
-         prometheus:
-           server:
-             version: 1.7
+       _param:
+         docker_image_alertmanager: docker-prod-virtual.docker.mirantis.net/openstack-docker/alertmanager:20171222124606
+         docker_image_pushgateway: docker-prod-virtual.docker.mirantis.net/openstack-docker/pushgateway:20171222124606
+         docker_image_prometheus: docker-prod-virtual.docker.mirantis.net/openstack-docker/prometheus:20171222124606
+         docker_image_remote_storage_adapter: docker-prod-virtual.docker.mirantis.net/openstack-docker/remote_storage_adapter:20171222124606
+       docker:
+         client:
+           stack:
+             monitoring:
+               service:
+                 server:
+                   environment:
+                     PROMETHEUS_STORAGE_LOCAL_ENGINE: persisted
+                     PROMETHEUS_STORAGE_LOCAL_TARGET_HEAP_SIZE: 3221225472
+                     PROMETHEUS_STORAGE_LOCAL_NUM_FINGERPRINT_MUTEXES: 4096
+
+       prometheus:
+         server:
+           version: 1.7
 
 
     .. TODO: Add a link to the upgrade procedure.
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/docker-legacy.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/docker-legacy.yml
new file mode 100644
index 0000000..c71c543
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/docker-legacy.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_docker_legacy_source: http://apt.mirantis.com/xenial/docker/
+    mirror_mirantis_openstack_xenial_docker_legacy_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_docker_legacy_components: legacy
+    mirror_mirantis_openstack_xenial_docker_legacy_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_docker_legacy_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_docker_legacy:
+          source: ${_param:mirror_mirantis_openstack_xenial_docker_legacy_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_docker_legacy_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_docker_legacy_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_docker_legacy_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_docker_legacy_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_docker_legacy_components}
+            distributions:
+              - ubuntu-xenial/docker/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/docker/swarm/stack/rundeck.yml b/docker/swarm/stack/rundeck.yml
index 8ab0554..88693be 100644
--- a/docker/swarm/stack/rundeck.yml
+++ b/docker/swarm/stack/rundeck.yml
@@ -25,6 +25,7 @@
                 - /srv/volumes/rundeck/etc/realm.properties:/etc/rundeck/realm.properties
                 - /srv/volumes/rundeck/etc/rundeck-config.properties:/etc/rundeck/rundeck-config.properties
                 - /srv/volumes/rundeck/rundeck:/var/rundeck
+                - /srv/volumes/rundeck/data:/var/lib/rundeck/data
                 - /srv/volumes/rundeck/log:/var/log/rundeck
                 - /srv/volumes/rundeck/logs:/var/lib/rundeck/logs
                 - /srv/volumes/rundeck/plugins:/opt/rundeck-plugins
diff --git a/elasticsearch/client/index/janitor_monkey.yml b/elasticsearch/client/index/cis_openstack.yml
similarity index 92%
rename from elasticsearch/client/index/janitor_monkey.yml
rename to elasticsearch/client/index/cis_openstack.yml
index bef92ae..3136f73 100644
--- a/elasticsearch/client/index/janitor_monkey.yml
+++ b/elasticsearch/client/index/cis_openstack.yml
@@ -7,9 +7,9 @@
       index:
         cis-openstack:
           enabled: true
-          force_operation: true
+          force_operation: false
           definition:
             template: cis-openstack
             settings:
               number_of_shards: ${_param:janitor_monkey_cis_openstack_shards}
-              number_of_replicas: ${_param:janitor_monkey_cis_openstack_replicas}
\ No newline at end of file
+              number_of_replicas: ${_param:janitor_monkey_cis_openstack_replicas}
diff --git a/elasticsearch/client/index/pushkin.yml b/elasticsearch/client/index/pushkin.yml
index 1d17c77..668a770 100644
--- a/elasticsearch/client/index/pushkin.yml
+++ b/elasticsearch/client/index/pushkin.yml
@@ -7,7 +7,7 @@
       index:
         notifications:
           enabled: true
-          force_operation: true
+          force_operation: false
           definition:
             template: notifications
             settings:
@@ -39,4 +39,4 @@
                     fields:
                       keyword:
                         type: keyword
-                        ignore_above: 256
\ No newline at end of file
+                        ignore_above: 256
diff --git a/fluentd/init.yml b/fluentd/init.yml
new file mode 100644
index 0000000..ebf469a
--- /dev/null
+++ b/fluentd/init.yml
@@ -0,0 +1,6 @@
+classes:
+- service.fluentd.agent.single
+- system
+parameters:
+  fluentd:
+    dollar: ${_param:dollarsign}
diff --git a/fluentd/label/default_metric/init.yml b/fluentd/label/default_metric/init.yml
new file mode 100644
index 0000000..ef8ecf2
--- /dev/null
+++ b/fluentd/label/default_metric/init.yml
@@ -0,0 +1,20 @@
+parameters:
+  fluentd:
+    agent:
+      config:
+        label:
+          default_metric:
+            filter:
+              add_general_fields:
+                tag: "**"
+                type: record_transformer
+                enable_ruby: true
+                record:
+                  - name: environment_label
+                    value: ${_param:cluster_domain}
+                  - name: Hostname
+                    value: ${fluentd:dollar}{ hostname }
+            match:
+              drop_everything:
+                tag: '**'
+                type: 'null'
diff --git a/fluentd/label/default_metric/prometheus.yml b/fluentd/label/default_metric/prometheus.yml
new file mode 100644
index 0000000..9eb3b1b
--- /dev/null
+++ b/fluentd/label/default_metric/prometheus.yml
@@ -0,0 +1,11 @@
+parameters:
+  fluentd:
+    agent:
+      plugin:
+        fluent-plugin-prometheus:
+          gem: ['fluent-plugin-prometheus']
+      config:
+        input:
+          prometheus:
+            metric:
+              type: prometheus
diff --git a/gerrit/client/init.yml b/gerrit/client/init.yml
index 5456900..8b097ee 100644
--- a/gerrit/client/init.yml
+++ b/gerrit/client/init.yml
@@ -7,8 +7,6 @@
     client:
       enabled: True
       try_login: ${_param:gerrit_try_login}
-      source:
-        engine: pip
       dir:
         git: /srv/volumes/gerrit/git
         gerrit_config: /srv/volumes/gerrit/etc/gerrit.config
diff --git a/init.yml b/init.yml
new file mode 100644
index 0000000..7d8695f
--- /dev/null
+++ b/init.yml
@@ -0,0 +1,3 @@
+parameters:
+  _param:
+    dollarsign: '$'
diff --git a/jenkins/client/job/debian/packages/extra.yml b/jenkins/client/job/debian/packages/extra.yml
index 383a2d3..61d7ee2 100644
--- a/jenkins/client/job/debian/packages/extra.yml
+++ b/jenkins/client/job/debian/packages/extra.yml
@@ -189,6 +189,22 @@
               dist: xenial
               build: pipeline
               branch: debian/xenial
+            - package: gerritlib
+              dist: xenial
+              build: pipeline
+              branch: debian/xenial
+            - package: python-pygerrit2
+              dist: xenial
+              build: pipeline
+              branch: debian/xenial
+            - package: jeepyb
+              dist: xenial
+              build: pipeline
+              branch: debian/xenial
+            - package: salt-pepper
+              dist: xenial
+              build: pipeline
+              branch: debian/xenial
           template:
             type: workflow-scm
             concurrent: false
diff --git a/jenkins/client/job/debian/packages/salt.yml b/jenkins/client/job/debian/packages/salt.yml
index 6928606..7b0dc68 100644
--- a/jenkins/client/job/debian/packages/salt.yml
+++ b/jenkins/client/job/debian/packages/salt.yml
@@ -266,6 +266,9 @@
             - name: rundeck
               upload_source_package: false
               dist: trusty
+            - name: runtest
+              upload_source_package: false
+              dist: trusty
             - name: sahara
               upload_source_package: false
               dist: trusty
@@ -395,6 +398,9 @@
             - name: fluentbit
               upload_source_package: true
               dist: xenial
+            - name: fluentd
+              upload_source_package: true
+              dist: xenial
             - name: foreman
               upload_source_package: true
               dist: xenial
@@ -581,6 +587,9 @@
             - name: rsyslog
               upload_source_package: true
               dist: xenial
+            - name: runtest
+              upload_source_package: true
+              dist: xenial
             - name: sahara
               upload_source_package: true
               dist: xenial
diff --git a/jenkins/client/job/deploy/kqueen.yml b/jenkins/client/job/deploy/kqueen.yml
new file mode 100644
index 0000000..817eb8f
--- /dev/null
+++ b/jenkins/client/job/deploy/kqueen.yml
@@ -0,0 +1,61 @@
+parameters:
+  jenkins:
+    client:
+      job:
+        deploy_aws_k8s_kqueen_job:
+          name: deploy-aws-k8s-kqueen
+          type: workflow-scm
+          discard:
+            build:
+              keep_num: 20
+          concurrent: true
+          display_name: "Deploy AWS K8S using kqueen"
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
+            credentials: "gerrit"
+            script: deploy-aws-k8s-kqueen-pipeline.groovy
+          param:
+            # deployments
+            STACK_NAME:
+              type: string
+              description: "AWS stack name - mandatory param, will be used as is"
+            STACK_COMPUTE_COUNT:
+              type: string
+              default: '2'
+
+            STACK_TEMPLATE:
+              type: string
+              default: "k8s_ha_calico_sm"
+            STACK_TEMPLATE_URL:
+              type: string
+              default: "${_param:jenkins_gerrit_url}/mk/heat-templates"
+            STACK_TEMPLATE_CREDENTIALS:
+              type: string
+              default: "gerrit"
+            STACK_TEMPLATE_BRANCH:
+              type: string
+              default: "master"
+
+            # salt
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt-qa-credentials"
+            SALT_MASTER_URL:
+              type: string
+              default: ""
+
+            # aws api
+            AWS_STACK_REGION:
+              type: string
+              default: "eu-central-1"
+            AWS_API_CREDENTIALS:
+              type: string
+              default: "aws-credentials"
+            AWS_SSH_KEY:
+              type: string
+              default: "jenkins-mk"
+            KQUEEN_BUILD_ID:
+              type: string
+
diff --git a/jenkins/client/job/docker/opencontrail.yml b/jenkins/client/job/docker/opencontrail.yml
index 53a76e0..b5052de 100644
--- a/jenkins/client/job/docker/opencontrail.yml
+++ b/jenkins/client/job/docker/opencontrail.yml
@@ -6,6 +6,7 @@
           name: "docker-build-images-opencontrail-{{version}}"
           jobs:
             - version: oc40
+            - version: oc41
           template:
             discard:
               build:
@@ -30,6 +31,9 @@
                   comment:
                     - addedContains:
                         commentAddedCommentContains: '(buildcontainer|test|recheck|verify|)'
+              reverse:
+                projects:
+                  - build-opencontrail-{{version}}-ubuntu-xenial
             param:
               IMAGE_GIT_URL:
                 type: string
diff --git a/jenkins/client/job/docker/oss/init.yml b/jenkins/client/job/docker/oss/init.yml
index 9b1e49b..94e138c 100644
--- a/jenkins/client/job/docker/oss/init.yml
+++ b/jenkins/client/job/docker/oss/init.yml
@@ -1,13 +1,14 @@
 classes:
   - system.jenkins.client.job.docker.oss.cis-collectors
   - system.jenkins.client.job.docker.oss.devops-portal
+  - system.jenkins.client.job.docker.oss.hce-codebase
+  - system.jenkins.client.job.docker.oss.hce-docker
   - system.jenkins.client.job.docker.oss.janitor-monkey-codebase
   - system.jenkins.client.job.docker.oss.janitor-monkey-docker
-  - system.jenkins.client.job.docker.oss.pushkin-docker
   - system.jenkins.client.job.docker.oss.pushkin-codebase
   - system.jenkins.client.job.docker.oss.pushkin-codebase-ext
-  - system.jenkins.client.job.docker.oss.hce-docker
-  - system.jenkins.client.job.docker.oss.hce-codebase
+  - system.jenkins.client.job.docker.oss.pushkin-docker
   - system.jenkins.client.job.docker.oss.rundeck
-  - system.jenkins.client.job.docker.oss.security-monkey-docker
+  - system.jenkins.client.job.docker.oss.security-monkey-codebase
   - system.jenkins.client.job.docker.oss.security-monkey-codebase-openstack
+  - system.jenkins.client.job.docker.oss.security-monkey-docker
diff --git a/jenkins/client/job/docker/oss/security-monkey-codebase.yml b/jenkins/client/job/docker/oss/security-monkey-codebase.yml
new file mode 100644
index 0000000..93a79e6
--- /dev/null
+++ b/jenkins/client/job/docker/oss/security-monkey-codebase.yml
@@ -0,0 +1,73 @@
+parameters:
+  jenkins:
+    client:
+      job:
+        docker-build-images-security-monkey-codebase:
+          name: docker-build-images-security-monkey-codebase
+          discard:
+            build:
+              keep_num: 25
+            artifact:
+              keep_num: 25
+          type: workflow-scm
+          concurrent: true
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/oss/jenkins/pipelines"
+            credentials: "gerrit"
+            script: docker-build-image-security-monkey-pipeline.groovy
+          trigger:
+            gerrit:
+              project:
+                "oss/security-monkey":
+                  branches:
+                    - mirantis_0_9_2
+              skip_vote:
+                - successful
+                - failed
+                - unstable
+                - not_built
+              event:
+                patchset:
+                  - created:
+                      excludeDrafts: false
+                      excludeNoCodeChange: false
+                change:
+                  - merged
+                comment:
+                  - addedContains:
+                      commentAddedCommentContains: 'rebuild'
+          param:
+            IMAGE_NAME:
+              type: string
+              default: "security-monkey"
+            IMAGE_TAGS:
+              type: string
+              default: ""
+            CREDENTIALS_ID:
+              type: string
+              default: "gerrit"
+            DOCKER_REGISTRY:
+              type: string
+              default: "docker-dev-virtual.docker.mirantis.net"
+            PROJECT_NAMESPACE:
+              type: string
+              default: "oss"
+            DOCKERFILE_PATH:
+              type: string
+              default: "security-monkey/Dockerfile"
+            CONTEXT_PATH:
+              type: string
+              default: "."
+            CUSTOM_GERRIT_PROJECT:
+              type: string
+              default: oss/docker-security-monkey
+            CUSTOM_GERRIT_BRANCH:
+              type: string
+              default: master
+            CI_BUILD_ARG_SECURITY_MONKEY_REPO:
+              type: string
+              default: https://gerrit.mcp.mirantis.net/oss/security-monkey
+            CI_BUILD_ARG_SECURITY_MONKEY_BRANCH:
+              type: string
+              default: mirantis_0_9_2
diff --git a/jenkins/client/job/git-mirrors/2way.yml b/jenkins/client/job/git-mirrors/2way.yml
index 15f78d7..3b1a62f 100644
--- a/jenkins/client/job/git-mirrors/2way.yml
+++ b/jenkins/client/job/git-mirrors/2way.yml
@@ -52,3 +52,4 @@
               BRANCHES:
                 type: string
                 default: "{{branches}}"
+                description: "Comma-separated list of branches to mirror"
diff --git a/jenkins/client/job/git-mirrors/downstream/init.yml b/jenkins/client/job/git-mirrors/downstream/init.yml
index 649ccdc..6f5a66d 100644
--- a/jenkins/client/job/git-mirrors/downstream/init.yml
+++ b/jenkins/client/job/git-mirrors/downstream/init.yml
@@ -38,3 +38,4 @@
               BRANCHES:
                 type: string
                 default: "{{branches}}"
+                description: "Comma-separated list of branches to mirror"
diff --git a/jenkins/client/job/git-mirrors/upstream/init.yml b/jenkins/client/job/git-mirrors/upstream/init.yml
index 8334f23..1707dca 100644
--- a/jenkins/client/job/git-mirrors/upstream/init.yml
+++ b/jenkins/client/job/git-mirrors/upstream/init.yml
@@ -48,3 +48,4 @@
               BRANCHES:
                 type: string
                 default: "{{branches}}"
+                description: "Comma-separated list of branches to mirror"
diff --git a/jenkins/client/job/oscore/security_tests.yml b/jenkins/client/job/oscore/security_tests.yml
index e4f5f6d..36b5441 100644
--- a/jenkins/client/job/oscore/security_tests.yml
+++ b/jenkins/client/job/oscore/security_tests.yml
@@ -62,7 +62,7 @@
               SEVERITY:
                 type: string
                 description: Bandit args
-                default: "3"
+                default: "1"
               CONFIDENCE:
                 type: string
                 description: confidence
diff --git a/jenkins/client/job/oscore/tests.yml b/jenkins/client/job/oscore/tests.yml
index c022c28..bab8804 100644
--- a/jenkins/client/job/oscore/tests.yml
+++ b/jenkins/client/job/oscore/tests.yml
@@ -323,6 +323,9 @@
               TEST_TEMPEST_PATTERN:
                 type: string
                 description: Run tests matched to pattern only
+              TEST_TEMPEST_SET:
+                type: string
+                description: Run tests matched by tempest set only
               TEST_TEMPEST_CONCURRENCY:
                 type: string
                 description: How much test threads to run
@@ -548,8 +551,165 @@
               APTLY_API_URL:
                 type: string
                 description: URL for the aptly API
-                default: "${_param:jenkins_aptly_url}"
+                default: "${_param:jenkins_aptly_api_url}"
               STACK_DELETE:
                 type: boolean
                 default: "{{stack_delete}}"
                 description: Do not enable it if you need to use the lab after
+              OPENSTACK_COMPONENTS_LIST:
+                type: string
+                description: "OpenStack related components list"
+                default: "{{openstack_components_list}}"
+        build-salt-formula-refspec-template:
+          name: "{{job_prefix}}-build-salt-formula-refspec"
+          template:
+            discard:
+              build:
+                keep_num: 30
+              artifact:
+                keep_num: 30
+            type: workflow-scm
+            concurrent: true
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines.git"
+              credentials: "gerrit"
+              branch: 'master'
+              script: build-debian-packages-pipeline.groovy
+            param:
+              SOURCE_URL:
+                type: string
+                default: ""
+                description: Project Git repo URL
+              SOURCE_REFSPEC:
+                type: string
+                default: ""
+                description: Refspec to checkout
+              SOURCE_BRANCH:
+                type: string
+                default: "master"
+                description: Name of local branch name for checked out refspec
+              SOURCE_CREDENTIALS:
+                type: string
+                default: "gerrit"
+                description: Credentials to Git repo
+              DEBIAN_SNAPSHOT:
+                type: boolean
+                default: 'true'
+                description: Whether to make a snapshot build
+              EXTRA_REPO_URL:
+                type: string
+                default: "deb ${_param:jenkins_aptly_url}/{{dist}}/ testing salt salt-latest"
+                description: Extra repo for building process
+              EXTRA_REPO_KEY_URL:
+                type: string
+                default: "${_param:jenkins_aptly_url}/public.gpg"
+                description: Extra repo GPG public key URL
+              OS:
+                type: string
+                default: "ubuntu"
+                description: OS name
+              DIST:
+                type: string
+                default: "{{dist}}"
+                description: OS distributive name
+              UPLOAD_PPA:
+                type: boolean
+                default: 'false'
+                description: Whether to upload to PPA
+              UPLOAD_APTLY:
+                type: boolean
+                default: 'false'
+                description: Whether to upload to Aptly
+              DEBIAN_BRANCH:
+                type: string
+                default: "debian/{{dist}}"
+                description: Source repo branch name with build spec
+              LINTIAN_CHECK:
+                type: boolean
+                default: 'false'
+                description: Whether to perform lintian check
+        test-salt-formula-refspec-template:
+          name: "{{job_prefix}}-test-salt-formula-refspec"
+          template:
+            discard:
+              build:
+                keep_num: 30
+              artifact:
+                keep_num: 30
+            type: workflow-scm
+            concurrent: false
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/openstack-ci/openstack-pipelines.git"
+              credentials: "gerrit"
+              branch: 'master'
+              script: deploy-formula-change-pipeline.groovy
+            trigger:
+              gerrit:
+                project:
+                  "^salt-formulas/(nova|cinder|glance|keystone|horizon|neutron|designate|heat|ironic|barbican)$":
+                    compare_type: 'REG_EXP'
+                    branches:
+                      - master
+                skip_vote:
+                  - successful
+                  - failed
+                  - unstable
+                  - not_built
+                event:
+                  comment:
+                    - addedContains:
+                        commentAddedCommentContains: '^(?s:Patch Set \d+:.*(test|recheck|reverify)\s*)$'
+            param:
+              SOURCE_CREDENTIALS:
+                type: string
+                default: "gerrit"
+              UPLOAD_APTLY:
+                type: boolean
+                default: 'true'
+                description: Whether to upload to Aptly
+              APTLY_REPO:
+                type: string
+                default: ""
+                description: Aptly repo name
+              BUILD_PACKAGE:
+                type: boolean
+                default: 'true'
+                description: Whether to build package
+              APTLY_REPO_URL:
+                type: string
+                default: "${_param:jenkins_aptly_url}"
+                description: Aptly url
+              APTLY_API_URL:
+                type: string
+                default: "${_param:jenkins_aptly_api_url}"
+                description: Aptly API url
+              OPENSTACK_RELEASES:
+                type: string
+                default: "{{openstack_releases}}"
+                description: Comma separated list of OpenStack releases to perform deploy and tests.
+              SOURCES:
+                type: text
+                default: ""
+                description: Optional parameter to list Git refspecs to be build
+              STACK_RECLASS_ADDRESS:
+                type: string
+                default: "{{stack_reclass_address}}"
+                description: Git repo URL to reclass
+              PKG_BUILD_JOB_NAME:
+                type: string
+                default: "{{pkg_build_job_name}}"
+                description: Jenkins job name to build package
+              STACK_DELETE:
+                type: boolean
+                default: 'true'
+                description: Whether to delete stacks ater tests
+              APTLY_PREFIX:
+                type: string
+                default: "{{aptly_prefix}}"
+                description: Aptly prefix
+              SYSTEST_JOB_PREFIX:
+                type: string
+                default: "{{systestJobPrefix}}"
+                description: "Systest job prefix. I.e. oscore-formula-systest-virtual_mcp11_aio-"
diff --git a/jenkins/client/job/salt-formulas/git-mirrors/2way.yml b/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
index c605744..87f1b89 100644
--- a/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
+++ b/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
@@ -201,6 +201,8 @@
               branches: ${_param:salt_formulas_branches}
             - name: rundeck
               branches: ${_param:salt_formulas_branches}
+            - name: runtest
+              branches: ${_param:salt_formulas_branches}
             - name: sahara
               branches: ${_param:salt_formulas_branches}
             - name: salt
diff --git a/jenkins/client/job/salt-formulas/tests.yml b/jenkins/client/job/salt-formulas/tests.yml
index 2e29d65..3dd77bf 100644
--- a/jenkins/client/job/salt-formulas/tests.yml
+++ b/jenkins/client/job/salt-formulas/tests.yml
@@ -106,6 +106,7 @@
             - name: rsync
             - name: rsyslog
             - name: rundeck
+            - name: runtest
             - name: sahara
             - name: salt
             - name: sensu
diff --git a/jenkins/client/job/validate.yml b/jenkins/client/job/validate.yml
index cfbd85d..ab2dd38 100644
--- a/jenkins/client/job/validate.yml
+++ b/jenkins/client/job/validate.yml
@@ -149,7 +149,7 @@
               description: If chosen then previous build results will be used in the current build
         cvp-sanity:
           type: workflow-scm
-          name: validate-cvp-sanity
+          name: cvp-sanity
           display_name: "CVP - Sanity checks"
           discard:
             build:
@@ -166,7 +166,7 @@
           param:
             SALT_MASTER_URL:
               type: string
-              default: ""
+              default: "${_param:jenkins_salt_api_url}"
               description: Full Salt API address [e.g. https://10.10.10.2:6969]
             SALT_MASTER_CREDENTIALS:
               type: string
@@ -175,6 +175,10 @@
               type: string
               default: "https://github.com/Mirantis/cvp-sanity-checks"
               description: Url for cvp-sanity-checks
+            SANITY_TESTS_SETTINGS:
+              type: string
+              default: ""
+              description: e.g. skipped_nodes=nal01.local.com,ntw01.local.com
             SANITY_TESTS_SET:
               type: string
               default: ""
@@ -183,3 +187,71 @@
               type: string
               default: ""
               description: Proxy address to clone repo and install python requirements
+        cvp-ha:
+          type: workflow-scm
+          name: cvp-ha
+          display_name: "CVP - HA tests"
+          discard:
+            build:
+              keep_num: 20
+            artifact:
+              keep_num: 20
+          concurrent: false
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            credentials: "gerrit"
+            script: cvp-ha.groovy
+          param:
+            SALT_MASTER_URL:
+              type: string
+              default: "${_param:jenkins_salt_api_url}"
+              description: Full Salt API address [e.g. https://10.10.10.2:6969]
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+              description: Credentials to the Salt API
+            TEMPEST_TARGET_NODE:
+              type: string
+              default: ""
+              description: Node where container with tempest will be run
+            TEST_IMAGE:
+              type: string
+              default: "rallyforge/rally"
+              description: Docker image to use for running Rally/Tempest
+            TARGET_NODES:
+              type: string
+              default: "ctl*"
+              description: Nodes to test
+            DEBUG_MODE:
+              type: boolean
+              default: 'false'
+              description: If you need to debug (keep container after test), please enabled this
+            RETRY_CHECK_STATUS:
+              type: string
+              default: "200"
+              description: If you have any problems with timeouts (e.g. while waiting for node to be up/down), please increase this value
+            SKIP_LIST_PATH:
+              type: string
+              default: "/home/rally/cvp-configuration/tempest/skip-list.yaml"
+              description: path to skip-list file inside container
+            PROXY:
+              type: string
+              default: ""
+              description: Proxy address to clone repo and install python requirements
+            TEMPEST_TEST_PATTERN:
+              type: string
+              default: "set=smoke"
+              description: Use set=smoke (or identity,full...] or just test name
+            MANUAL_CONFIRMATION:
+              type: boolean
+              default: 'false'
+              description: Ask for confirmation before doing something destructive (reboot/shutdown node)
+            TEMPEST_REPO:
+              type: string
+              default: "https://github.com/openstack/tempest"
+              description: Can be repo url (local or remote) or path to folder (inside container) with Tempest
+            TOOLS_REPO:
+              type: string
+              default: "${_param:gerrit_public_host}/cvp-configuration"
+              description: URL of repo where testing tools, scenarios, configs are located.
diff --git a/jenkins/slave/salt-pepper.yml b/jenkins/slave/salt-pepper.yml
new file mode 100644
index 0000000..c5baf1f
--- /dev/null
+++ b/jenkins/slave/salt-pepper.yml
@@ -0,0 +1,8 @@
+ classes:
+   - system.jenkins.slave
+ parameters:
+   linux:
+     system:
+       package:
+         salt-pepper:
+           version: latest
diff --git a/keystone/server/cluster.yml b/keystone/server/cluster.yml
index cbe89ca..0ae502b 100644
--- a/keystone/server/cluster.yml
+++ b/keystone/server/cluster.yml
@@ -12,6 +12,9 @@
         python-pymysql:
           fromrepo: ${_param:openstack_version}
           version: latest
+        python-cryptography:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   keystone:
     server:
       enabled: true
diff --git a/linux/system/repo/mcp/apt_mirantis/docker_legacy.yml b/linux/system/repo/mcp/apt_mirantis/docker_legacy.yml
new file mode 100644
index 0000000..86c6426
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/docker_legacy.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_docker_legacy_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_docker_legacy:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/docker/ ${_param:linux_system_repo_mcp_docker_legacy_version} legacy"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_docker_legacy_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/docker_legacy.yml b/linux/system/repo_local/mcp/apt_mirantis/docker_legacy.yml
new file mode 100644
index 0000000..9b85ea2
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/docker_legacy.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_docker_legacy_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_docker_legacy:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/docker/ ${_param:linux_system_repo_mcp_docker_legacy_version} legacy"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_docker_legacy_version}'
+            priority: 1100
+            package: '*'
diff --git a/nginx/server/proxy/oss/devops_portal.yml b/nginx/server/proxy/oss/devops_portal.yml
new file mode 100644
index 0000000..7e313bc
--- /dev/null
+++ b/nginx/server/proxy/oss/devops_portal.yml
@@ -0,0 +1,20 @@
+parameters:
+  nginx:
+    server:
+      enabled: true
+      site:
+        nginx_devops_portal:
+          enabled: true
+          type: nginx_proxy
+          name: devops_portal
+          check: false
+          proxy:
+            host: ${_param:stacklight_monitor_address}
+            port: 8800
+            protocol: http
+            websocket: true
+          host:
+            name: ${_param:cluster_public_host}
+            port: 8800
+            protocol: https
+          ssl: ${_param:nginx_proxy_ssl}
diff --git a/nginx/server/proxy/oss/rundeck.yml b/nginx/server/proxy/oss/rundeck.yml
new file mode 100644
index 0000000..e6a0303
--- /dev/null
+++ b/nginx/server/proxy/oss/rundeck.yml
@@ -0,0 +1,20 @@
+parameters:
+  nginx:
+    server:
+      enabled: true
+      site:
+        nginx_rundeck:
+          enabled: true
+          type: nginx_proxy
+          name: rundeck
+          check: false
+          proxy:
+            host: ${_param:stacklight_monitor_address}
+            port: 4440
+            protocol: http
+            websocket: true
+          host:
+            name: ${_param:cluster_public_host}
+            port: 4440
+            protocol: https
+          ssl: ${_param:nginx_proxy_ssl}
diff --git a/nova/control/cluster.yml b/nova/control/cluster.yml
index dee725d..3b8877d 100644
--- a/nova/control/cluster.yml
+++ b/nova/control/cluster.yml
@@ -29,11 +29,6 @@
       ram_allocation_ratio: ${_param:nova_ram_allocation_ratio}
       disk_allocation_ratio: ${_param:nova_disk_allocation_ratio}
       workers: 8
-      logging:
-      - engine: syslog
-        facility: local0
-        heka:
-          enabled: true
       bind:
         private_address: ${_param:cluster_local_address}
         public_address: ${_param:cluster_vip_address}
diff --git a/opencontrail/control/analytics4_0.yml b/opencontrail/control/analytics4_0.yml
index ed7e99e..9614d61 100644
--- a/opencontrail/control/analytics4_0.yml
+++ b/opencontrail/control/analytics4_0.yml
@@ -13,8 +13,8 @@
     opencontrail_message_queue_node02_address: ${_param:openstack_message_queue_node02_address}
     opencontrail_message_queue_node03_address: ${_param:openstack_message_queue_node03_address}
     opencontrail_message_queue_address: ${_param:openstack_message_queue_address}
-    opencontrail_analytics_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-analytics
-    opencontrail_analyticsdb_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-analyticsdb
+    opencontrail_analytics_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-analytics
+    opencontrail_analyticsdb_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-analyticsdb
     opencontrail_analytics_container_name: opencontrail_analytics_1
     opencontrail_analyticsdb_container_name: opencontrail_analyticsdb_1
 # Temprorary fix for MOS9 packages to pin old version of kafka
diff --git a/opencontrail/control/cluster4_0.yml b/opencontrail/control/cluster4_0.yml
index 17aef3a..60749b3 100644
--- a/opencontrail/control/cluster4_0.yml
+++ b/opencontrail/control/cluster4_0.yml
@@ -14,9 +14,9 @@
     opencontrail_message_queue_node02_address: ${_param:openstack_control_node02_address}
     opencontrail_message_queue_node03_address: ${_param:openstack_control_node03_address}
     opencontrail_message_queue_address: ${_param:openstack_control_address}
-    opencontrail_analytics_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-analytics
-    opencontrail_analyticsdb_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-analyticsdb
-    opencontrail_controller_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-controller
+    opencontrail_analytics_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-analytics
+    opencontrail_analyticsdb_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-analyticsdb
+    opencontrail_controller_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-controller
     opencontrail_controller_container_name: opencontrail_controller_1
     opencontrail_analytics_container_name: opencontrail_analytics_1
     opencontrail_analyticsdb_container_name: opencontrail_analyticsdb_1
diff --git a/opencontrail/control/control4_0.yml b/opencontrail/control/control4_0.yml
index c20652c..02ab75e 100644
--- a/opencontrail/control/control4_0.yml
+++ b/opencontrail/control/control4_0.yml
@@ -9,7 +9,7 @@
     opencontrail_message_queue_node01_address: ${_param:openstack_message_queue_node01_address}
     opencontrail_message_queue_node02_address: ${_param:openstack_message_queue_node02_address}
     opencontrail_message_queue_node03_address: ${_param:openstack_message_queue_node03_address}
-    opencontrail_controller_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-controller
+    opencontrail_controller_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-controller
     opencontrail_controller_container_name: opencontrail_controller_1
     analytics_vip_address: ${_param:opencontrail_analytics_address}
   opencontrail:
diff --git a/opencontrail/control/single4_0.yml b/opencontrail/control/single4_0.yml
index 4fcdf04..a4fae18 100644
--- a/opencontrail/control/single4_0.yml
+++ b/opencontrail/control/single4_0.yml
@@ -7,9 +7,9 @@
     opencontrail_kafka_log_cleanup_dir: '/usr/share/kafka/logs/'
     opencontrail_version: 4.0
     linux_repo_contrail_component: oc40
-    opencontrail_analytics_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-analytics
-    opencontrail_analyticsdb_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-analyticsdb
-    opencontrail_controller_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-controller
+    opencontrail_analytics_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-analytics
+    opencontrail_analyticsdb_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-analyticsdb
+    opencontrail_controller_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-controller
     opencontrail_controller_container_name: opencontrail_controller_1
     opencontrail_analytics_container_name: opencontrail_analytics_1
     opencontrail_analyticsdb_container_name: opencontrail_analyticsdb_1
diff --git a/salt/syndic/cluster.yml b/salt/syndic/cluster.yml
new file mode 100644
index 0000000..55ae6d7
--- /dev/null
+++ b/salt/syndic/cluster.yml
@@ -0,0 +1,11 @@
+classes:
+- service.salt.syndic.cluster
+parameters:
+  _param:
+    salt_syndic_master_address_01: 127.0.0.1
+    salt_syndic_master_address_02: 127.0.0.1
+  salt:
+    syndic:
+      masters:
+      - host: ${_param:salt_syndic_master_address_01}
+      - host: ${_param:salt_syndic_master_address_02}
diff --git a/salt/syndic/single.yml b/salt/syndic/single.yml
new file mode 100644
index 0000000..8c015b7
--- /dev/null
+++ b/salt/syndic/single.yml
@@ -0,0 +1,5 @@
+classes:
+- service.salt.syndic.single
+parameters:
+  _param:
+    salt_syndic_master_address: 127.0.0.1