diff --git a/.releasenotes/notes/dop-proxy-2427ec3814c4b467.yaml b/.releasenotes/notes/dop-proxy-2427ec3814c4b467.yaml
new file mode 100644
index 0000000..9ce4d3b
--- /dev/null
+++ b/.releasenotes/notes/dop-proxy-2427ec3814c4b467.yaml
@@ -0,0 +1,15 @@
+---
+prelude: >
+  Default proxy configuration for Devops Portal Dasboard and Rundeck Service added
+features:
+  - |
+    In case of using OSS through proxy configurations,
+    need to define following classes for proxy nodes on cluster level 'cluster_name/stacklight/proxy.yml' or 'cluster_name/openstack/proxy.yml':
+
+     .. code-block:: yaml
+     - system.nginx.server.proxy.oss.devops_portal
+     - system.nginx.server.proxy.oss.rundeck
+
+fixes:
+  - |
+    https://mirantis.jira.com/browse/PROD-14376
diff --git a/.releasenotes/notes/elasticsearch-new-parameter-93a08f64ff1a22ab.yaml b/.releasenotes/notes/elasticsearch-new-parameter-93a08f64ff1a22ab.yaml
new file mode 100644
index 0000000..2382274
--- /dev/null
+++ b/.releasenotes/notes/elasticsearch-new-parameter-93a08f64ff1a22ab.yaml
@@ -0,0 +1,15 @@
+---
+summary: >
+  Added a new parameter for Elasticsearch
+
+features:
+  - |
+    Added the ``elasticsearch_version`` parameter to specify which version of
+    Elasticsearch should be deployed. By default, Elasticsearch v2 is
+    installed.
+
+    To deploy Elasticsearch v5, specify the ``elasticsearch_version: 5``
+    parameter in the
+    ``classes/cluster/<cluster_name>/stacklight/server.yml`` file of
+    the Reclass model of your MCP deployment.
+
diff --git a/.releasenotes/notes/kibana-new-parameter-29e59b161f750390.yaml b/.releasenotes/notes/kibana-new-parameter-29e59b161f750390.yaml
new file mode 100644
index 0000000..8805765
--- /dev/null
+++ b/.releasenotes/notes/kibana-new-parameter-29e59b161f750390.yaml
@@ -0,0 +1,13 @@
+---
+summary: >
+  Added a new parameter for Kibana
+
+features:
+  - |
+    Added the ``kibana_version`` parameter to specify which version of Kibana
+    should be deployed. By default, Kibana v4 is installed.
+
+    To deploy Kibana v5, specify the ``kibana_version: 5`` parameter in the
+    ``classes/cluster/<cluster_name>/stacklight/server.yml`` file of the
+    Reclass model of your MCP deployment.
+
diff --git a/.releasenotes/notes/new-classes-es-kibana-59e86910979d52a4.yaml b/.releasenotes/notes/new-classes-es-kibana-59e86910979d52a4.yaml
new file mode 100644
index 0000000..d6e2ecd
--- /dev/null
+++ b/.releasenotes/notes/new-classes-es-kibana-59e86910979d52a4.yaml
@@ -0,0 +1,21 @@
+---
+summary: >
+  Added two new classes for Elasticsearch and Kibana
+
+features:
+  - |
+    Added two new classes to support Elasticsearch v2 and v5 and Kibana
+    v4 and v5.
+    Update the Elasticsearch and Kibana classes in the
+    ``classes/cluster/<cluster_name>/stacklight/server.yml`` file of
+    the Reclass model of your MCP deployment according to the required
+    versions:
+
+    #. For Elasticsearch, change the ``linux.system.repo.elasticsearch`` class
+       to ``linux.system.repo.elasticsearch.2`` or ``linux.system.repo.elasticsearch.5``.
+       To deploy Elasticsearch version 2, specify the ``elasticsearch_version: 2``
+       parameter in the same file.
+    #. For Kibana, change the ``linux.system.repo.kibana`` class to
+       ``linux.system.repo.kibana.4`` or ``linux.system.repo.kibana.5``.
+       To deploy Kibana version 4, specify the ``kibana_version: 4``
+       parameter in the same file.
diff --git a/.releasenotes/notes/prometheus-2.0-2a7b3bc4ad76e118.yaml b/.releasenotes/notes/prometheus-2.0-2a7b3bc4ad76e118.yaml
new file mode 100644
index 0000000..af017f5
--- /dev/null
+++ b/.releasenotes/notes/prometheus-2.0-2a7b3bc4ad76e118.yaml
@@ -0,0 +1,48 @@
+---
+summary: >
+  Updated the StackLight components to newer versions
+
+upgrade:
+  - |
+    Updated the following StackLight components:
+
+    - Prometheus server to version 2.0.0
+    - Alertmanager to version 0.11.0
+    - Pushgateway to version 0.4.0
+
+    .. important::
+
+       The new version of Prometheus is not backward compatible
+       with previous versions. Therefore, you must upgrade the
+       monitoring stack as described in the MCP Operations Guide.
+
+    To continue using Prometheus v1.7, add the following snippet
+    to the Reclass model of your MCP deployment. However, Mirantis
+    recommends that you update your monitoring stack to obtain new
+    features such as performance improvements.
+
+
+    .. code-block:: yaml
+
+       _param:
+         docker_image_alertmanager: docker-prod-virtual.docker.mirantis.net/openstack-docker/alertmanager:20171222124606
+         docker_image_pushgateway: docker-prod-virtual.docker.mirantis.net/openstack-docker/pushgateway:20171222124606
+         docker_image_prometheus: docker-prod-virtual.docker.mirantis.net/openstack-docker/prometheus:20171222124606
+         docker_image_remote_storage_adapter: docker-prod-virtual.docker.mirantis.net/openstack-docker/remote_storage_adapter:20171222124606
+       docker:
+         client:
+           stack:
+             monitoring:
+               service:
+                 server:
+                   environment:
+                     PROMETHEUS_STORAGE_LOCAL_ENGINE: persisted
+                     PROMETHEUS_STORAGE_LOCAL_TARGET_HEAP_SIZE: 3221225472
+                     PROMETHEUS_STORAGE_LOCAL_NUM_FINGERPRINT_MUTEXES: 4096
+
+       prometheus:
+         server:
+           version: 1.7
+
+
+    .. TODO: Add a link to the upgrade procedure.
diff --git a/.releasenotes/notes/psql-issues-16cb5e030ef7dac5.yaml b/.releasenotes/notes/psql-issues-16cb5e030ef7dac5.yaml
new file mode 100644
index 0000000..9d0410e
--- /dev/null
+++ b/.releasenotes/notes/psql-issues-16cb5e030ef7dac5.yaml
@@ -0,0 +1,14 @@
+---
+summary: >
+  Enabled the Runbooks automation service to use an external datasource
+
+features:
+  - |
+    Enabled the Runbooks automation service to use an external datasource.
+    Now, you can configure the service to use the PostgreSQL database as an
+    external source for the datastore.
+
+    .. seealso::
+
+       * `MCP Operations Guide: Configure an external datasource <https://docs.mirantis.com/mcp/latest/mcp-operations-guide/devops-portal/use-runbooks-automation/configure-rundeck/configure-external-datasource.html>`__
+
diff --git a/.releasenotes/notes/raise-telegraf-version-a3e797a577b7e555.yaml b/.releasenotes/notes/raise-telegraf-version-a3e797a577b7e555.yaml
new file mode 100644
index 0000000..129681a
--- /dev/null
+++ b/.releasenotes/notes/raise-telegraf-version-a3e797a577b7e555.yaml
@@ -0,0 +1,9 @@
+---
+summary: >
+  Updated Telegraf to version 1.5
+
+upgrades:
+  - |
+    Changed the branch for building of the Telegraf package from v1.2 to
+    v1.5. The new branch includes the upstream release 1.5 branch and all
+    downstream improvements. By default, Telegraf v1.5 is installed.
diff --git a/.releasenotes/notes/rundeck-iframe-7b50b9185b0b27a5.yaml b/.releasenotes/notes/rundeck-iframe-7b50b9185b0b27a5.yaml
new file mode 100644
index 0000000..3f67dd4
--- /dev/null
+++ b/.releasenotes/notes/rundeck-iframe-7b50b9185b0b27a5.yaml
@@ -0,0 +1,18 @@
+---
+summary:
+  - Added the possibility to configure iFrame forwarding for the Runbooks
+    Automation service
+
+features:
+  - |
+    Added the possibility to configure iFrame forwarding for the Runbooks
+    Automation service. By default, the Rundeck service configuration does not
+    enable you to get access through an external proxy address and exposed
+    Rundeck port, which is 14440 by default. Now, you can easily forward the
+    Runbooks dashboard through a proxy endpoint in case of using the Devops
+    Portal through external proxy networks.
+
+    .. seealso::
+
+       * `MCP Operations Guide: Configure iFrame forwarding <https://docs.mirantis.com/mcp/latest/mcp-operations-guide/devops-portal/use-runbooks-automation/configure-rundeck/configure-iframe-forwarding.html>`__
+
diff --git a/.releasenotes/notes/switch-es-kibana-to-5-3ef55164a574e066.yaml b/.releasenotes/notes/switch-es-kibana-to-5-3ef55164a574e066.yaml
new file mode 100644
index 0000000..86692c7
--- /dev/null
+++ b/.releasenotes/notes/switch-es-kibana-to-5-3ef55164a574e066.yaml
@@ -0,0 +1,19 @@
+---
+summary: >
+  Updated Elasticsearch and Kibana to versions 5
+
+features:
+  - |
+    Updated Elasticsearch and Kibana to v5. Elasticsearch and Kibana v5
+    are now installed by default.
+
+    To upgrade existing Elasticsearch and Kibana installations to v5,
+    follow the procedures described in the MCP Operations Guide.
+
+    .. TODO: add a link to the upgrade procedure.
+
+    Kibana versions prior to 5.6.x are incompatible with Elasticsearch
+    5.x. Therefore, once you upgrade Elasticsearch to v5, you must also
+    upgrade Kibana to v5 as described in the MCP Operations Guide.
+
+    .. TODO: add a link to the upgrade procedure.
diff --git a/aptly/server/mirror/debian/cassandra.yml b/aptly/server/mirror/debian/cassandra.yml
index 3a19e84..4682dc4 100644
--- a/aptly/server/mirror/debian/cassandra.yml
+++ b/aptly/server/mirror/debian/cassandra.yml
@@ -5,6 +5,7 @@
     mirror_cassandra-21x_distribution: 21x
     mirror_cassandra-21x_components: main
     mirror_cassandra-21x_gpgkeys:
+      - A278B781FE4B2BDA
       - F758CE318D77295D
       - 2B5C1B00
       - 0353B12C
diff --git a/aptly/server/mirror/debian/elasticsearch5.yml b/aptly/server/mirror/debian/elasticsearch5.yml
new file mode 100644
index 0000000..75368ba
--- /dev/null
+++ b/aptly/server/mirror/debian/elasticsearch5.yml
@@ -0,0 +1,46 @@
+parameters:
+  _param:
+    aptly_mirror_elasticsearch-5x_source: https://artifacts.elastic.co/packages/5.x/apt
+    aptly_mirror_elasticsearch-5x_distribution: stable
+    aptly_mirror_elasticsearch-5x_components: main
+    aptly_mirror_elasticsearch-5x_gpgkeys:
+      - D88E42B4
+    aptly_mirror_elasticsearch-curator-5x_source: https://packages.elastic.co/curator/5/debian
+    aptly_mirror_elasticsearch-curator-5x_distribution: stable
+    aptly_mirror_elasticsearch-curator-5x_components: main
+  aptly:
+    server:
+      mirror:
+        elasticsearch-5x:
+          source: ${_param:mirror_elasticsearch-5x_source}
+          distribution: ${_param:mirror_elasticsearch-5x_distribution}
+          components: ${_param:mirror_elasticsearch-5x_components}
+          architectures: amd64
+          gpgkeys: ${_param:mirror_elasticsearch-5x_gpgkeys}
+          publisher:
+            component: elastic
+            distributions:
+              - trusty/${_param:apt_mk_version}
+              - xenial/${_param:apt_mk_version}
+        kibana-5x:
+          source: ${_param:aptly_mirror_elasticsearch-5x_source}
+          distribution: ${_param:aptly_mirror_elasticsearch-5x_distribution}
+          components: ${_param:aptly_mirror_elasticsearch-5x_components}
+          architectures: amd64
+          gpgkeys: ${_param:aptly_mirror_elasticsearch-5x_gpgkeys}
+          publisher:
+            component: elastic
+            distributions:
+              - trusty/${_param:apt_mk_version}
+              - xenial/${_param:apt_mk_version}
+        elasticsearch-curator-5x:
+          source: ${_param:aptly_mirror_elasticsearch-curator-5x_source}
+          distribution: ${_param:aptly_mirror_elasticsearch-curator-5x_distribution}
+          components: ${_param:aptly_mirror_elasticsearch-curator-5x_components}
+          architectures: amd64
+          gpgkeys: ${_param:aptly_mirror_elasticsearch-5x_gpgkeys}
+          publisher:
+            component: elastic
+            distributions:
+              - trusty/${_param:apt_mk_version}
+              - xenial/${_param:apt_mk_version}
diff --git a/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/cassandra.yml b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/cassandra.yml
new file mode 100644
index 0000000..938fc7b
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/cassandra.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_trusty_cassandra_source: http://apt.mirantis.com/trusty/cassandra/
+    mirror_mirantis_openstack_trusty_cassandra_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_trusty_cassandra_components: 21x
+    mirror_mirantis_openstack_trusty_cassandra_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_trusty_cassandra_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_trusty_cassandra:
+          source: ${_param:mirror_mirantis_openstack_trusty_cassandra_source}
+          distribution: ${_param:mirror_mirantis_openstack_trusty_cassandra_distribution}
+          components: ${_param:mirror_mirantis_openstack_trusty_cassandra_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_trusty_cassandra_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_trusty_cassandra_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_trusty_cassandra_components}
+            distributions:
+              - ubuntu-trusty/cassandra/${_param:apt_mk_version}/
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/grafana.yml b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/grafana.yml
new file mode 100644
index 0000000..197e58c
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/grafana.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_trusty_grafana_source: http://apt.mirantis.com/trusty/grafana/
+    mirror_mirantis_openstack_trusty_grafana_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_trusty_grafana_components: main
+    mirror_mirantis_openstack_trusty_grafana_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_trusty_grafana_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_trusty_grafana:
+          source: ${_param:mirror_mirantis_openstack_trusty_grafana_source}
+          distribution: ${_param:mirror_mirantis_openstack_trusty_grafana_distribution}
+          components: ${_param:mirror_mirantis_openstack_trusty_grafana_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_trusty_grafana_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_trusty_grafana_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_trusty_grafana_components}
+            distributions:
+              - ubuntu-trusty/grafana/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/openstack/mitaka.yml b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/openstack/mitaka.yml
new file mode 100644
index 0000000..556e1a3
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/openstack/mitaka.yml
@@ -0,0 +1,103 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+
+    mirror_mirantis_openstack_mitaka_trusty_source: http://apt.mirantis.com/trusty/openstack/mitaka/
+    mirror_mirantis_openstack_mitaka_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_mitaka_trusty_components: main restricted
+    mirror_mirantis_openstack_mitaka_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_mitaka_trusty_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_mitaka_hotfix_trusty_source: http://apt.mirantis.com/trusty/openstack/mitaka/hotfix/
+    mirror_mirantis_openstack_mitaka_hotfix_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_mitaka_hotfix_trusty_components: main restricted
+    mirror_mirantis_openstack_mitaka_hotfix_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_mitaka_hotfix_trusty_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_mitaka_security_trusty_source: http://apt.mirantis.com/trusty/openstack/mitaka/security/
+    mirror_mirantis_openstack_mitaka_security_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_mitaka_security_trusty_components: main restricted
+    mirror_mirantis_openstack_mitaka_security_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_mitaka_security_trusty_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_mitaka_updates_trusty_source: http://apt.mirantis.com/trusty/openstack/mitaka/updates/
+    mirror_mirantis_openstack_mitaka_updates_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_mitaka_updates_trusty_components: main restricted
+    mirror_mirantis_openstack_mitaka_updates_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_mitaka_updates_trusty_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_mitaka_holdback_trusty_source: http://apt.mirantis.com/trusty/openstack/mitaka/holdback/
+    mirror_mirantis_openstack_mitaka_holdback_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_mitaka_holdback_trusty_components: main restricted
+    mirror_mirantis_openstack_mitaka_holdback_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_mitaka_holdback_trusty_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_mitaka_trusty:
+          source: ${_param:mirror_mirantis_openstack_mitaka_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_mitaka_trusty_distribution}
+          components: ${_param:mirror_mirantis_openstack_mitaka_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_mitaka_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_mitaka_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/mitaka/${_param:apt_mk_version}
+
+        mirantis_openstack_mitaka_hotfix_trusty:
+          source: ${_param:mirror_mirantis_openstack_mitaka_hotfix_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_mitaka_hotfix_trusty_distribution}
+          components: ${_param:mirror_mirantis_openstack_mitaka_hotfix_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_mitaka_hotfix_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_mitaka_hotfix_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/mitaka/hotfix/${_param:apt_mk_version}
+
+        mirantis_openstack_mitaka_security_trusty:
+          source: ${_param:mirror_mirantis_openstack_mitaka_security_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_mitaka_security_trusty_distribution}
+          components: ${_param:mirror_mirantis_openstack_mitaka_security_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_mitaka_security_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_mitaka_security_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/mitaka/security/${_param:apt_mk_version}
+
+        # required for alternative horizon plugins/etc..
+        mirantis_openstack_mitaka_updates_trusty:
+          source: ${_param:mirror_mirantis_openstack_mitaka_updates_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_mitaka_updates_trusty_distribution}
+          components:  ${_param:mirror_mirantis_openstack_mitaka_updates_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_mitaka_updates_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_mitaka_updates_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/mitaka/updates/${_param:apt_mk_version}
+
+        # required for salt formulas
+        mirantis_openstack_mitaka_holdback_trusty:
+          source: ${_param:mirror_mirantis_openstack_mitaka_holdback_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_mitaka_holdback_trusty_distribution}
+          components: ${_param:mirror_mirantis_openstack_mitaka_holdback_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_mitaka_holdback_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_mitaka_holdback_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/mitaka/holdback/${_param:apt_mk_version}
+
diff --git a/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/openstack/newton.yml b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/openstack/newton.yml
new file mode 100644
index 0000000..ad867c3
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/openstack/newton.yml
@@ -0,0 +1,103 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+
+    mirror_mirantis_openstack_newton_trusty_source: http://apt.mirantis.com/trusty/openstack/newton/
+    mirror_mirantis_openstack_newton_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_newton_trusty_components: main restricted
+    mirror_mirantis_openstack_newton_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_newton_trusty_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_newton_hotfix_trusty_source: http://apt.mirantis.com/trusty/openstack/newton/hotfix/
+    mirror_mirantis_openstack_newton_hotfix_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_newton_hotfix_trusty_components: main restricted
+    mirror_mirantis_openstack_newton_hotfix_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_newton_hotfix_trusty_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_newton_security_trusty_source: http://apt.mirantis.com/trusty/openstack/newton/security/
+    mirror_mirantis_openstack_newton_security_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_newton_security_trusty_components: main restricted
+    mirror_mirantis_openstack_newton_security_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_newton_security_trusty_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_newton_updates_trusty_source: http://apt.mirantis.com/trusty/openstack/newton/updates/
+    mirror_mirantis_openstack_newton_updates_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_newton_updates_trusty_components: main restricted
+    mirror_mirantis_openstack_newton_updates_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_newton_updates_trusty_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_newton_holdback_trusty_source: http://apt.mirantis.com/trusty/openstack/newton/holdback/
+    mirror_mirantis_openstack_newton_holdback_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_newton_holdback_trusty_components: main restricted
+    mirror_mirantis_openstack_newton_holdback_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_newton_holdback_trusty_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_newton_trusty:
+          source: ${_param:mirror_mirantis_openstack_newton_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_newton_trusty_distribution}
+          components: ${_param:mirror_mirantis_openstack_newton_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_newton_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_newton_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/newton/${_param:apt_mk_version}
+
+        mirantis_openstack_newton_hotfix_trusty:
+          source: ${_param:mirror_mirantis_openstack_newton_hotfix_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_newton_hotfix_trusty_distribution}
+          components: ${_param:mirror_mirantis_openstack_newton_hotfix_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_newton_hotfix_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_newton_hotfix_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/newton/hotfix/${_param:apt_mk_version}
+
+        mirantis_openstack_newton_security_trusty:
+          source: ${_param:mirror_mirantis_openstack_newton_security_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_newton_security_trusty_distribution}
+          components: ${_param:mirror_mirantis_openstack_newton_security_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_newton_security_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_newton_security_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/newton/security/${_param:apt_mk_version}
+
+        # required for alternative horizon plugins/etc..
+        mirantis_openstack_newton_updates_trusty:
+          source: ${_param:mirror_mirantis_openstack_newton_updates_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_newton_updates_trusty_distribution}
+          components:  ${_param:mirror_mirantis_openstack_newton_updates_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_newton_updates_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_newton_updates_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/newton/updates/${_param:apt_mk_version}
+
+        # required for salt formulas
+        mirantis_openstack_newton_holdback_trusty:
+          source: ${_param:mirror_mirantis_openstack_newton_holdback_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_newton_holdback_trusty_distribution}
+          components: ${_param:mirror_mirantis_openstack_newton_holdback_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_newton_holdback_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_newton_holdback_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/newton/holdback/${_param:apt_mk_version}
+
diff --git a/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/openstack/ocata.yml b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/openstack/ocata.yml
new file mode 100644
index 0000000..c01b864
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/openstack/ocata.yml
@@ -0,0 +1,103 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+
+    mirror_mirantis_openstack_ocata_trusty_source: http://apt.mirantis.com/trusty/openstack/ocata/
+    mirror_mirantis_openstack_ocata_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_ocata_trusty_components: main restricted
+    mirror_mirantis_openstack_ocata_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_ocata_trusty_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_ocata_hotfix_trusty_source: http://apt.mirantis.com/trusty/openstack/ocata/hotfix/
+    mirror_mirantis_openstack_ocata_hotfix_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_ocata_hotfix_trusty_components: main restricted
+    mirror_mirantis_openstack_ocata_hotfix_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_ocata_hotfix_trusty_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_ocata_security_trusty_source: http://apt.mirantis.com/trusty/openstack/ocata/security/
+    mirror_mirantis_openstack_ocata_security_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_ocata_security_trusty_components: main restricted
+    mirror_mirantis_openstack_ocata_security_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_ocata_security_trusty_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_ocata_updates_trusty_source: http://apt.mirantis.com/trusty/openstack/ocata/updates/
+    mirror_mirantis_openstack_ocata_updates_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_ocata_updates_trusty_components: main restricted
+    mirror_mirantis_openstack_ocata_updates_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_ocata_updates_trusty_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_ocata_holdback_trusty_source: http://apt.mirantis.com/trusty/openstack/ocata/holdback/
+    mirror_mirantis_openstack_ocata_holdback_trusty_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_ocata_holdback_trusty_components: main restricted
+    mirror_mirantis_openstack_ocata_holdback_trusty_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_ocata_holdback_trusty_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_ocata_trusty:
+          source: ${_param:mirror_mirantis_openstack_ocata_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_ocata_trusty_distribution}
+          components: ${_param:mirror_mirantis_openstack_ocata_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_ocata_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_ocata_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/ocata/${_param:apt_mk_version}
+
+        mirantis_openstack_ocata_hotfix_trusty:
+          source: ${_param:mirror_mirantis_openstack_ocata_hotfix_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_ocata_hotfix_trusty_distribution}
+          components: ${_param:mirror_mirantis_openstack_ocata_hotfix_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_ocata_hotfix_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_ocata_hotfix_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/ocata/hotfix/${_param:apt_mk_version}
+
+        mirantis_openstack_ocata_security_trusty:
+          source: ${_param:mirror_mirantis_openstack_ocata_security_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_ocata_security_trusty_distribution}
+          components: ${_param:mirror_mirantis_openstack_ocata_security_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_ocata_security_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_ocata_security_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/ocata/security/${_param:apt_mk_version}
+
+        # required for alternative horizon plugins/etc..
+        mirantis_openstack_ocata_updates_trusty:
+          source: ${_param:mirror_mirantis_openstack_ocata_updates_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_ocata_updates_trusty_distribution}
+          components:  ${_param:mirror_mirantis_openstack_ocata_updates_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_ocata_updates_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_ocata_updates_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/ocata/updates/${_param:apt_mk_version}
+
+        # required for salt formulas
+        mirantis_openstack_ocata_holdback_trusty:
+          source: ${_param:mirror_mirantis_openstack_ocata_holdback_trusty_source}
+          distribution: ${_param:mirror_mirantis_openstack_ocata_holdback_trusty_distribution}
+          components: ${_param:mirror_mirantis_openstack_ocata_holdback_trusty_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_ocata_holdback_trusty_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_ocata_holdback_trusty_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/openstack/ocata/holdback/${_param:apt_mk_version}
+
diff --git a/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/saltstack/init.yml b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/saltstack/init.yml
new file mode 100644
index 0000000..8dfe2cd
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/saltstack/init.yml
@@ -0,0 +1,3 @@
+classes:
+- system.aptly.server.mirror.ubuntu.trusty.mcp.apt_mk.saltstack.salt-2016-3
+- system.aptly.server.mirror.ubuntu.trusty.mcp.apt_mk.saltstack.salt-2017-7
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/saltstack/salt-2016-3.yml b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/saltstack/salt-2016-3.yml
new file mode 100644
index 0000000..19b002a
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/saltstack/salt-2016-3.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_trusty_saltstack_2016_3_source: http://apt.mirantis.com/trusty/salt/2016.3/
+    mirror_mirantis_openstack_trusty_saltstack_2016_3_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_trusty_saltstack_2016_3_components: main
+    mirror_mirantis_openstack_trusty_saltstack_2016_3_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_trusty_saltstack_2016_3_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_trusty_saltstack_2016_3:
+          source: ${_param:mirror_mirantis_openstack_trusty_saltstack_2016_3_source}
+          distribution: ${_param:mirror_mirantis_openstack_trusty_saltstack_2016_3_distribution}
+          components: ${_param:mirror_mirantis_openstack_trusty_saltstack_2016_3_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_trusty_saltstack_2016_3_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_trusty_saltstack_2016_3_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_trusty_saltstack_2016_3_components}
+            distributions:
+              - ubuntu-trusty/salt/2016.3/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/saltstack/salt-2017-7.yml b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/saltstack/salt-2017-7.yml
new file mode 100644
index 0000000..703d0bf
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk/saltstack/salt-2017-7.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_trusty_saltstack_2017_7_source: http://apt.mirantis.com/trusty/salt/2017.7/
+    mirror_mirantis_openstack_trusty_saltstack_2017_7_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_trusty_saltstack_2017_7_components: main
+    mirror_mirantis_openstack_trusty_saltstack_2017_7_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_trusty_saltstack_2017_7_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_trusty_saltstack_2017_7:
+          source: ${_param:mirror_mirantis_openstack_trusty_saltstack_2017_7_source}
+          distribution: ${_param:mirror_mirantis_openstack_trusty_saltstack_2017_7_distribution}
+          components: ${_param:mirror_mirantis_openstack_trusty_saltstack_2017_7_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_trusty_saltstack_2017_7_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_trusty_saltstack_2017_7_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_trusty_saltstack_2017_7_components}
+            distributions:
+              - ubuntu-trusty/salt/2017.7/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/trusty/rabbitmq.yml b/aptly/server/mirror/ubuntu/trusty/rabbitmq.yml
index 5caa9b5..383aeda 100644
--- a/aptly/server/mirror/ubuntu/trusty/rabbitmq.yml
+++ b/aptly/server/mirror/ubuntu/trusty/rabbitmq.yml
@@ -4,6 +4,7 @@
     mirror_rabbitmq-testing-trusty_distribution: testing
     mirror_rabbitmq-testing-trusty_components: main
     mirror_rabbitmq-testing-trusty_gpgkeys:
+      - 6B73A36E6026DFCA
       - 056E8E56
   aptly:
     server:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/main.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/main.yml
index 3625d51..5ae8bdb 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/main.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-backports-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-backports-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-backports-main_distribution: trusty-backports
     mirror_trusty-backports-main_components: main
     mirror_trusty-backports-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/multiverse.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/multiverse.yml
index 96dc420..d04b27a 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-backports-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-backports-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-backports-multiverse_distribution: trusty-backports
     mirror_trusty-backports-multiverse_components: multiverse
     mirror_trusty-backports-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/restricted.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/restricted.yml
index 712bebc..21b6a27 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/restricted.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-backports-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-backports-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-backports-restricted_distribution: trusty-backports
     mirror_trusty-backports-restricted_components: restricted
     mirror_trusty-backports-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/universe.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/universe.yml
index f18b504..0134502 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/universe.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-backports-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-backports-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-backports-universe_distribution: trusty-backports
     mirror_trusty-backports-universe_components: universe
     mirror_trusty-backports-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/main.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/main.yml
index 7164628..6aadd64 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/main.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-proposed-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-proposed-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-proposed-main_distribution: trusty-proposed
     mirror_trusty-proposed-main_components: main
     mirror_trusty-proposed-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/multiverse.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/multiverse.yml
index 9227036..af81ef1 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-proposed-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-proposed-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-proposed-multiverse_distribution: trusty-proposed
     mirror_trusty-proposed-multiverse_components: multiverse
     mirror_trusty-proposed-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/restricted.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/restricted.yml
index f5378b9..519cb0f 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/restricted.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-proposed-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-proposed-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-proposed-restricted_distribution: trusty-proposed
     mirror_trusty-proposed-restricted_components: restricted
     mirror_trusty-proposed-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/universe.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/universe.yml
index b6f321b..f3a5c34 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/universe.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-proposed-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-proposed-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-proposed-universe_distribution: trusty-proposed
     mirror_trusty-proposed-universe_components: universe
     mirror_trusty-proposed-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/main.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/main.yml
index 1a797f7..9b0dbf6 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/main.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-security-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-security-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-security-main_distribution: trusty-security
     mirror_trusty-security-main_components: main
     mirror_trusty-security-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/multiverse.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/multiverse.yml
index b38e42b..6bb3f80 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-security-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-security-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-security-multiverse_distribution: trusty-security
     mirror_trusty-security-multiverse_components: multiverse
     mirror_trusty-security-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/restricted.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/restricted.yml
index 76d2b4a..1810a8d 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/restricted.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-security-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-security-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-security-restricted_distribution: trusty-security
     mirror_trusty-security-restricted_components: restricted
     mirror_trusty-security-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/universe.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/universe.yml
index 33d42f5..8700025 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/universe.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-security-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-security-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-security-universe_distribution: trusty-security
     mirror_trusty-security-universe_components: universe
     mirror_trusty-security-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/main.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/main.yml
index d7db631..bc4e985 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/main.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-updates-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-updates-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-updates-main_distribution: trusty-updates
     mirror_trusty-updates-main_components: main
     mirror_trusty-updates-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/multiverse.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/multiverse.yml
index 518b0ff..1b0b21b 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-updates-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-updates-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-updates-multiverse_distribution: trusty-updates
     mirror_trusty-updates-multiverse_components: multiverse
     mirror_trusty-updates-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/restricted.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/restricted.yml
index 1b7ea0f..7a6c4a6 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/restricted.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-updates-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-updates-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-updates-restricted_distribution: trusty-updates
     mirror_trusty-updates-restricted_components: restricted
     mirror_trusty-updates-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/universe.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/universe.yml
index 3f4d815..f64f9b3 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/universe.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-updates-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-updates-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-updates-universe_distribution: trusty-updates
     mirror_trusty-updates-universe_components: universe
     mirror_trusty-updates-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/main.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/main.yml
index 3a054e7..33b4693 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/main.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-main_distribution: trusty
     mirror_trusty-main_components: main
     mirror_trusty-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/multiverse.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/multiverse.yml
index 37a0b05..68f1586 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-multiverse_distribution: trusty
     mirror_trusty-multiverse_components: multiverse
     mirror_trusty-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/restricted.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/restricted.yml
index dca087a..78d552c 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/restricted.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-restricted_distribution: trusty
     mirror_trusty-restricted_components: restricted
     mirror_trusty-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/universe.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/universe.yml
index a112b94..f24c1ab 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/universe.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-universe_distribution: trusty
     mirror_trusty-universe_components: universe
     mirror_trusty-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/aptly.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/aptly.yml
new file mode 100644
index 0000000..507ed5e
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/aptly.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_aptly_source: http://apt.mirantis.com/xenial/aptly/
+    mirror_mirantis_openstack_xenial_aptly_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_aptly_components: main
+    mirror_mirantis_openstack_xenial_aptly_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_aptly_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_aptly:
+          source: ${_param:mirror_mirantis_openstack_xenial_aptly_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_aptly_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_aptly_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_aptly_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_aptly_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_aptly_components}
+            distributions:
+              - ubuntu-xenial/aptly/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/cassandra.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/cassandra.yml
new file mode 100644
index 0000000..5afbf77
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/cassandra.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_cassandra_source: http://apt.mirantis.com/xenial/cassandra/
+    mirror_mirantis_openstack_xenial_cassandra_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_cassandra_components: 21x
+    mirror_mirantis_openstack_xenial_cassandra_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_cassandra_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_cassandra:
+          source: ${_param:mirror_mirantis_openstack_xenial_cassandra_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_cassandra_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_cassandra_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_cassandra_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_cassandra_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_cassandra_components}
+            distributions:
+              - ubuntu-xenial/cassandra/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/ceph.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/ceph.yml
new file mode 100644
index 0000000..a0b1293
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/ceph.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_ceph_source: http://apt.mirantis.com/xenial/ceph/
+    mirror_mirantis_openstack_xenial_ceph_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_ceph_components: luminous
+    mirror_mirantis_openstack_xenial_ceph_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_ceph_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_ceph:
+          source: ${_param:mirror_mirantis_openstack_xenial_ceph_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_ceph_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_ceph_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_ceph_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_ceph_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_ceph_components}
+            distributions:
+              - ubuntu-xenial/ceph/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/docker-legacy.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/docker-legacy.yml
new file mode 100644
index 0000000..c71c543
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/docker-legacy.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_docker_legacy_source: http://apt.mirantis.com/xenial/docker/
+    mirror_mirantis_openstack_xenial_docker_legacy_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_docker_legacy_components: legacy
+    mirror_mirantis_openstack_xenial_docker_legacy_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_docker_legacy_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_docker_legacy:
+          source: ${_param:mirror_mirantis_openstack_xenial_docker_legacy_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_docker_legacy_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_docker_legacy_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_docker_legacy_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_docker_legacy_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_docker_legacy_components}
+            distributions:
+              - ubuntu-xenial/docker/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/docker.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/docker.yml
new file mode 100644
index 0000000..703d202
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/docker.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_docker_source: http://apt.mirantis.com/xenial/docker/
+    mirror_mirantis_openstack_xenial_docker_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_docker_components: stable
+    mirror_mirantis_openstack_xenial_docker_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_docker_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_docker:
+          source: ${_param:mirror_mirantis_openstack_xenial_docker_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_docker_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_docker_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_docker_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_docker_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_docker_components}
+            distributions:
+              - ubuntu-xenial/docker/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/elastic/2x.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/elastic/2x.yml
new file mode 100644
index 0000000..6b1c006
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/elastic/2x.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_elastic_2x_source: http://apt.mirantis.com/xenial/elastic/2.x/
+    mirror_mirantis_openstack_xenial_elastic_2x_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_elastic_2x_components: main
+    mirror_mirantis_openstack_xenial_elastic_2x_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_elastic_2x_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_elastic_2x:
+          source: ${_param:mirror_mirantis_openstack_xenial_elastic_2x_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_elastic_2x_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_elastic_2x_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_elastic_2x_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_elastic_2x_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_elastic_2x_components}
+            distributions:
+              - ubuntu-xenial/elastic/2.x/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/elastic/5x.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/elastic/5x.yml
new file mode 100644
index 0000000..d7e92c6
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/elastic/5x.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_elastic_5x_source: http://apt.mirantis.com/xenial/elastic/5.x/
+    mirror_mirantis_openstack_xenial_elastic_5x_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_elastic_5x_components: main
+    mirror_mirantis_openstack_xenial_elastic_5x_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_elastic_5x_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_elastic_5x:
+          source: ${_param:mirror_mirantis_openstack_xenial_elastic_5x_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_elastic_5x_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_elastic_5x_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_elastic_5x_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_elastic_5x_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_elastic_5x_components}
+            distributions:
+              - ubuntu-xenial/elastic/5.x/${_param:apt_mk_version}
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/elastic/init.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/elastic/init.yml
new file mode 100644
index 0000000..f214330
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/elastic/init.yml
@@ -0,0 +1,3 @@
+classes:
+- system.aptly.server.mirror.ubuntu.xenial.mcp.apt_mk.elastic.2x
+- system.aptly.server.mirror.ubuntu.xenial.mcp.apt_mk.elastic.5x
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/glusterfs.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/glusterfs.yml
new file mode 100644
index 0000000..cfec221
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/glusterfs.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_glusterfs_source: http://apt.mirantis.com/xenial/glusterfs/
+    mirror_mirantis_openstack_xenial_glusterfs_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_glusterfs_components: '"3.12"'
+    mirror_mirantis_openstack_xenial_glusterfs_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_glusterfs_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_glusterfs:
+          source: ${_param:mirror_mirantis_openstack_xenial_glusterfs_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_glusterfs_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_glusterfs_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_glusterfs_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_glusterfs_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_glusterfs_components}
+            distributions:
+              - ubuntu-xenial/glusterfs/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/grafana.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/grafana.yml
new file mode 100644
index 0000000..e09ba61
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/grafana.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_grafana_source: http://apt.mirantis.com/xenial/grafana/
+    mirror_mirantis_openstack_xenial_grafana_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_grafana_components: main
+    mirror_mirantis_openstack_xenial_grafana_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_grafana_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_grafana:
+          source: ${_param:mirror_mirantis_openstack_xenial_grafana_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_grafana_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_grafana_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_grafana_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_grafana_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_grafana_components}
+            distributions:
+              - ubuntu-xenial/grafana/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/influxdb.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/influxdb.yml
new file mode 100644
index 0000000..01093fe
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/influxdb.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_influxdb_source: http://apt.mirantis.com/xenial/influxdb/
+    mirror_mirantis_openstack_xenial_influxdb_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_influxdb_components: main
+    mirror_mirantis_openstack_xenial_influxdb_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_influxdb_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_influxdb:
+          source: ${_param:mirror_mirantis_openstack_xenial_influxdb_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_influxdb_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_influxdb_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_influxdb_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_influxdb_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_influxdb_components}
+            distributions:
+              - ubuntu-xenial/influxdb/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/kibana/46.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/kibana/46.yml
new file mode 100644
index 0000000..815185b
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/kibana/46.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_kibana_46_source: http://apt.mirantis.com/xenial/kibana/4.6/
+    mirror_mirantis_openstack_xenial_kibana_46_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_kibana_46_components: "kibana-46"
+    mirror_mirantis_openstack_xenial_kibana_46_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_kibana_46_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_kibana_46:
+          source: ${_param:mirror_mirantis_openstack_xenial_kibana_46_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_kibana_46_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_kibana_46_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_kibana_46_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_kibana_46_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_kibana_46_components}
+            distributions:
+              - ubuntu-xenial/kibana/4.6/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/kibana/5x.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/kibana/5x.yml
new file mode 100644
index 0000000..c1b061e
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/kibana/5x.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_kibana_5x_source: http://apt.mirantis.com/xenial/kibana/5.x/
+    mirror_mirantis_openstack_xenial_kibana_5x_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_kibana_5x_components: "kibana-5x"
+    mirror_mirantis_openstack_xenial_kibana_5x_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_kibana_5x_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_kibana_5x:
+          source: ${_param:mirror_mirantis_openstack_xenial_kibana_5x_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_kibana_5x_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_kibana_5x_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_kibana_5x_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_kibana_5x_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_kibana_5x_components}
+            distributions:
+              - ubuntu-xenial/kibana/5.x/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/kibana/init.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/kibana/init.yml
new file mode 100644
index 0000000..dfd93bb
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/kibana/init.yml
@@ -0,0 +1,3 @@
+classes:
+- system.aptly.server.mirror.ubuntu.xenial.mcp.apt_mk.kibana.46
+- system.aptly.server.mirror.ubuntu.xenial.mcp.apt_mk.kibana.5x
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/maas.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/maas.yml
new file mode 100644
index 0000000..3d63b00
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/maas.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_maas_source: http://apt.mirantis.com/xenial/maas/
+    mirror_mirantis_openstack_xenial_maas_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_maas_components: main
+    mirror_mirantis_openstack_xenial_maas_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_maas_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_maas:
+          source: ${_param:mirror_mirantis_openstack_xenial_maas_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_maas_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_maas_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_maas_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_maas_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_maas_components}
+            distributions:
+              - ubuntu-xenial/maas/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/openstack/mitaka.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/openstack/mitaka.yml
new file mode 100644
index 0000000..d50b2ca
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/openstack/mitaka.yml
@@ -0,0 +1,103 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+
+    mirror_mirantis_openstack_mitaka_xenial_source: http://apt.mirantis.com/xenial/openstack/mitaka/
+    mirror_mirantis_openstack_mitaka_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_mitaka_xenial_components: main restricted
+    mirror_mirantis_openstack_mitaka_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_mitaka_xenial_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_mitaka_hotfix_xenial_source: http://apt.mirantis.com/xenial/openstack/mitaka/hotfix/
+    mirror_mirantis_openstack_mitaka_hotfix_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_mitaka_hotfix_xenial_components: main restricted
+    mirror_mirantis_openstack_mitaka_hotfix_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_mitaka_hotfix_xenial_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_mitaka_security_xenial_source: http://apt.mirantis.com/xenial/openstack/mitaka/security/
+    mirror_mirantis_openstack_mitaka_security_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_mitaka_security_xenial_components: main restricted
+    mirror_mirantis_openstack_mitaka_security_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_mitaka_security_xenial_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_mitaka_updates_xenial_source: http://apt.mirantis.com/xenial/openstack/mitaka/updates/
+    mirror_mirantis_openstack_mitaka_updates_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_mitaka_updates_xenial_components: main restricted
+    mirror_mirantis_openstack_mitaka_updates_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_mitaka_updates_xenial_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_mitaka_holdback_xenial_source: http://apt.mirantis.com/xenial/openstack/mitaka/holdback/
+    mirror_mirantis_openstack_mitaka_holdback_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_mitaka_holdback_xenial_components: main restricted
+    mirror_mirantis_openstack_mitaka_holdback_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_mitaka_holdback_xenial_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_mitaka_xenial:
+          source: ${_param:mirror_mirantis_openstack_mitaka_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_mitaka_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_mitaka_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_mitaka_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_mitaka_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/mitaka/${_param:apt_mk_version}
+
+        mirantis_openstack_mitaka_hotfix_xenial:
+          source: ${_param:mirror_mirantis_openstack_mitaka_hotfix_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_mitaka_hotfix_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_mitaka_hotfix_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_mitaka_hotfix_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_mitaka_hotfix_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/mitaka/hotfix/${_param:apt_mk_version}
+
+        mirantis_openstack_mitaka_security_xenial:
+          source: ${_param:mirror_mirantis_openstack_mitaka_security_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_mitaka_security_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_mitaka_security_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_mitaka_security_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_mitaka_security_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/mitaka/security/${_param:apt_mk_version}
+
+        # required for alternative horizon plugins/etc..
+        mirantis_openstack_mitaka_updates_xenial:
+          source: ${_param:mirror_mirantis_openstack_mitaka_updates_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_mitaka_updates_xenial_distribution}
+          components:  ${_param:mirror_mirantis_openstack_mitaka_updates_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_mitaka_updates_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_mitaka_updates_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/mitaka/updates/${_param:apt_mk_version}
+
+        # required for salt formulas
+        mirantis_openstack_mitaka_holdback_xenial:
+          source: ${_param:mirror_mirantis_openstack_mitaka_holdback_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_mitaka_holdback_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_mitaka_holdback_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_mitaka_holdback_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_mitaka_holdback_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/mitaka/holdback/${_param:apt_mk_version}
+
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/openstack/newton.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/openstack/newton.yml
new file mode 100644
index 0000000..95eb192
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/openstack/newton.yml
@@ -0,0 +1,103 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+
+    mirror_mirantis_openstack_newton_xenial_source: http://apt.mirantis.com/xenial/openstack/newton/
+    mirror_mirantis_openstack_newton_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_newton_xenial_components: main restricted
+    mirror_mirantis_openstack_newton_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_newton_xenial_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_newton_hotfix_xenial_source: http://apt.mirantis.com/xenial/openstack/newton/hotfix/
+    mirror_mirantis_openstack_newton_hotfix_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_newton_hotfix_xenial_components: main restricted
+    mirror_mirantis_openstack_newton_hotfix_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_newton_hotfix_xenial_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_newton_security_xenial_source: http://apt.mirantis.com/xenial/openstack/newton/security/
+    mirror_mirantis_openstack_newton_security_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_newton_security_xenial_components: main restricted
+    mirror_mirantis_openstack_newton_security_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_newton_security_xenial_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_newton_updates_xenial_source: http://apt.mirantis.com/xenial/openstack/newton/updates/
+    mirror_mirantis_openstack_newton_updates_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_newton_updates_xenial_components: main restricted
+    mirror_mirantis_openstack_newton_updates_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_newton_updates_xenial_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_newton_holdback_xenial_source: http://apt.mirantis.com/xenial/openstack/newton/holdback/
+    mirror_mirantis_openstack_newton_holdback_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_newton_holdback_xenial_components: main restricted
+    mirror_mirantis_openstack_newton_holdback_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_newton_holdback_xenial_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_newton_xenial:
+          source: ${_param:mirror_mirantis_openstack_newton_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_newton_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_newton_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_newton_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_newton_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/newton/${_param:apt_mk_version}
+
+        mirantis_openstack_newton_hotfix_xenial:
+          source: ${_param:mirror_mirantis_openstack_newton_hotfix_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_newton_hotfix_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_newton_hotfix_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_newton_hotfix_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_newton_hotfix_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/newton/hotfix/${_param:apt_mk_version}
+
+        mirantis_openstack_newton_security_xenial:
+          source: ${_param:mirror_mirantis_openstack_newton_security_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_newton_security_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_newton_security_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_newton_security_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_newton_security_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/newton/security/${_param:apt_mk_version}
+
+        # required for alternative horizon plugins/etc..
+        mirantis_openstack_newton_updates_xenial:
+          source: ${_param:mirror_mirantis_openstack_newton_updates_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_newton_updates_xenial_distribution}
+          components:  ${_param:mirror_mirantis_openstack_newton_updates_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_newton_updates_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_newton_updates_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/newton/updates/${_param:apt_mk_version}
+
+        # required for salt formulas
+        mirantis_openstack_newton_holdback_xenial:
+          source: ${_param:mirror_mirantis_openstack_newton_holdback_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_newton_holdback_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_newton_holdback_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_newton_holdback_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_newton_holdback_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/newton/holdback/${_param:apt_mk_version}
+
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/openstack/ocata.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/openstack/ocata.yml
new file mode 100644
index 0000000..67f11c8
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/openstack/ocata.yml
@@ -0,0 +1,103 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+
+    mirror_mirantis_openstack_ocata_xenial_source: http://apt.mirantis.com/xenial/openstack/ocata/
+    mirror_mirantis_openstack_ocata_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_ocata_xenial_components: main restricted
+    mirror_mirantis_openstack_ocata_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_ocata_xenial_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_ocata_hotfix_xenial_source: http://apt.mirantis.com/xenial/openstack/ocata/hotfix/
+    mirror_mirantis_openstack_ocata_hotfix_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_ocata_hotfix_xenial_components: main restricted
+    mirror_mirantis_openstack_ocata_hotfix_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_ocata_hotfix_xenial_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_ocata_security_xenial_source: http://apt.mirantis.com/xenial/openstack/ocata/security/
+    mirror_mirantis_openstack_ocata_security_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_ocata_security_xenial_components: main restricted
+    mirror_mirantis_openstack_ocata_security_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_ocata_security_xenial_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_ocata_updates_xenial_source: http://apt.mirantis.com/xenial/openstack/ocata/updates/
+    mirror_mirantis_openstack_ocata_updates_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_ocata_updates_xenial_components: main restricted
+    mirror_mirantis_openstack_ocata_updates_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_ocata_updates_xenial_gpgkeys:
+      - A76882D3
+
+    mirror_mirantis_openstack_ocata_holdback_xenial_source: http://apt.mirantis.com/xenial/openstack/ocata/holdback/
+    mirror_mirantis_openstack_ocata_holdback_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_ocata_holdback_xenial_components: main restricted
+    mirror_mirantis_openstack_ocata_holdback_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_ocata_holdback_xenial_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_ocata_xenial:
+          source: ${_param:mirror_mirantis_openstack_ocata_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_ocata_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_ocata_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_ocata_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_ocata_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/ocata/${_param:apt_mk_version}
+
+        mirantis_openstack_ocata_hotfix_xenial:
+          source: ${_param:mirror_mirantis_openstack_ocata_hotfix_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_ocata_hotfix_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_ocata_hotfix_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_ocata_hotfix_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_ocata_hotfix_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/ocata/hotfix/${_param:apt_mk_version}
+
+        mirantis_openstack_ocata_security_xenial:
+          source: ${_param:mirror_mirantis_openstack_ocata_security_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_ocata_security_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_ocata_security_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_ocata_security_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_ocata_security_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/ocata/security/${_param:apt_mk_version}
+
+        # required for alternative horizon plugins/etc..
+        mirantis_openstack_ocata_updates_xenial:
+          source: ${_param:mirror_mirantis_openstack_ocata_updates_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_ocata_updates_xenial_distribution}
+          components:  ${_param:mirror_mirantis_openstack_ocata_updates_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_ocata_updates_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_ocata_updates_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/ocata/updates/${_param:apt_mk_version}
+
+        # required for salt formulas
+        mirantis_openstack_ocata_holdback_xenial:
+          source: ${_param:mirror_mirantis_openstack_ocata_holdback_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_ocata_holdback_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_ocata_holdback_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_ocata_holdback_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_ocata_holdback_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/ocata/holdback/${_param:apt_mk_version}
+
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/openstack/pike.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/openstack/pike.yml
new file mode 100644
index 0000000..971e8fa
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/openstack/pike.yml
@@ -0,0 +1,25 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+
+    mirror_mirantis_openstack_pike_xenial_source: http://apt.mirantis.com/xenial/openstack/pike/
+    mirror_mirantis_openstack_pike_xenial_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_pike_xenial_components: main
+    mirror_mirantis_openstack_pike_xenial_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_pike_xenial_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_pike_xenial:
+          source: ${_param:mirror_mirantis_openstack_pike_xenial_source}
+          distribution: ${_param:mirror_mirantis_openstack_pike_xenial_distribution}
+          components: ${_param:mirror_mirantis_openstack_pike_xenial_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_pike_xenial_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_pike_xenial_gpgkeys}
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/openstack/pike/${_param:apt_mk_version}
+
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/saltstack/init.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/saltstack/init.yml
new file mode 100644
index 0000000..59952be
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/saltstack/init.yml
@@ -0,0 +1,3 @@
+classes:
+- system.aptly.server.mirror.ubuntu.xenial.mcp.apt_mk.saltstack.salt-2016-3
+- system.aptly.server.mirror.ubuntu.xenial.mcp.apt_mk.saltstack.salt-2017-7
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/saltstack/salt-2016-3.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/saltstack/salt-2016-3.yml
new file mode 100644
index 0000000..86a33e6
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/saltstack/salt-2016-3.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_saltstack_2016_3_source: http://apt.mirantis.com/xenial/salt/2016.3/
+    mirror_mirantis_openstack_xenial_saltstack_2016_3_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_saltstack_2016_3_components: main
+    mirror_mirantis_openstack_xenial_saltstack_2016_3_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_saltstack_2016_3_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_saltstack_2016_3:
+          source: ${_param:mirror_mirantis_openstack_xenial_saltstack_2016_3_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_saltstack_2016_3_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_saltstack_2016_3_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_saltstack_2016_3_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_saltstack_2016_3_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_saltstack_2016_3_components}
+            distributions:
+              - ubuntu-xenial/salt/2016.3/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/saltstack/salt-2017-7.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/saltstack/salt-2017-7.yml
new file mode 100644
index 0000000..0478cde
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/saltstack/salt-2017-7.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_saltstack_2017_7_source: http://apt.mirantis.com/xenial/salt/2017.7/
+    mirror_mirantis_openstack_xenial_saltstack_2017_7_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_saltstack_2017_7_components: main
+    mirror_mirantis_openstack_xenial_saltstack_2017_7_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_saltstack_2017_7_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_saltstack_2017_7:
+          source: ${_param:mirror_mirantis_openstack_xenial_saltstack_2017_7_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_saltstack_2017_7_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_saltstack_2017_7_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_saltstack_2017_7_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_saltstack_2017_7_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_saltstack_2017_7_components}
+            distributions:
+              - ubuntu-xenial/salt/2017.7/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/sensu.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/sensu.yml
new file mode 100644
index 0000000..505ec97
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk/sensu.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    mirror_mirantis_openstack_xenial_sensu_source: http://apt.mirantis.com/xenial/sensu/
+    mirror_mirantis_openstack_xenial_sensu_distribution: ${_param:apt_mk_version}
+    mirror_mirantis_openstack_xenial_sensu_components: main
+    mirror_mirantis_openstack_xenial_sensu_key_url: "http://apt.mirantis.com/public.gpg"
+    mirror_mirantis_openstack_xenial_sensu_gpgkeys:
+      - A76882D3
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial_sensu:
+          source: ${_param:mirror_mirantis_openstack_xenial_sensu_source}
+          distribution: ${_param:mirror_mirantis_openstack_xenial_sensu_distribution}
+          components: ${_param:mirror_mirantis_openstack_xenial_sensu_components}
+          architectures: amd64
+          key_url: ${_param:mirror_mirantis_openstack_xenial_sensu_key_url}
+          gpgkeys: ${_param:mirror_mirantis_openstack_xenial_sensu_gpgkeys}
+          publisher:
+            component: ${_param:mirror_mirantis_openstack_xenial_sensu_components}
+            distributions:
+              - ubuntu-xenial/sensu/${_param:apt_mk_version}
\ No newline at end of file
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/main.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/main.yml
index f9ad68e..1fbb17d 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/main.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-backports-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-backports-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-backports-main_distribution: xenial-backports
     mirror_xenial-backports-main_components: main
     mirror_xenial-backports-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/multiverse.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/multiverse.yml
index 3ef9908..be45547 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-backports-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-backports-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-backports-multiverse_distribution: xenial-backports
     mirror_xenial-backports-multiverse_components: multiverse
     mirror_xenial-backports-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/restricted.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/restricted.yml
index 5a32ee2..dcf8ede 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/restricted.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-backports-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-backports-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-backports-restricted_distribution: xenial-backports
     mirror_xenial-backports-restricted_components: restricted
     mirror_xenial-backports-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/universe.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/universe.yml
index aca402e..9945a73 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/universe.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-backports-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-backports-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-backports-universe_distribution: xenial-backports
     mirror_xenial-backports-universe_components: universe
     mirror_xenial-backports-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/main.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/main.yml
index 920a16f..1ec8777 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/main.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-proposed-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-proposed-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-proposed-main_distribution: xenial-proposed
     mirror_xenial-proposed-main_components: main
     mirror_xenial-proposed-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/multiverse.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/multiverse.yml
index aa6cf27..48a2ddc 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-proposed-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-proposed-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-proposed-multiverse_distribution: xenial-proposed
     mirror_xenial-proposed-multiverse_components: multiverse
     mirror_xenial-proposed-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/restricted.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/restricted.yml
index 78aef0b..d301c81 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/restricted.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-proposed-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-proposed-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-proposed-restricted_distribution: xenial-proposed
     mirror_xenial-proposed-restricted_components: restricted
     mirror_xenial-proposed-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/universe.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/universe.yml
index 618e4e8..8ddd769 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/universe.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-proposed-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-proposed-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-proposed-universe_distribution: xenial-proposed
     mirror_xenial-proposed-universe_components: universe
     mirror_xenial-proposed-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/main.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/main.yml
index dc1309a..a4977cc 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/main.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-security-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-security-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-security-main_distribution: xenial-security
     mirror_xenial-security-main_components: main
     mirror_xenial-security-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/multiverse.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/multiverse.yml
index 77fcd1c..8b40566 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-security-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-security-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-security-multiverse_distribution: xenial-security
     mirror_xenial-security-multiverse_components: multiverse
     mirror_xenial-security-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/restricted.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/restricted.yml
index b6046ff..82beadd 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/restricted.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-security-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-security-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-security-restricted_distribution: xenial-security
     mirror_xenial-security-restricted_components: restricted
     mirror_xenial-security-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/universe.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/universe.yml
index 0a41112..6383be6 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/universe.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-security-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-security-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-security-universe_distribution: xenial-security
     mirror_xenial-security-universe_components: universe
     mirror_xenial-security-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/main.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/main.yml
index a97dcc4..810e8f6 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/main.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-updates-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-updates-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-updates-main_distribution: xenial-updates
     mirror_xenial-updates-main_components: main
     mirror_xenial-updates-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/multiverse.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/multiverse.yml
index 2373c56..13546b2 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-updates-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-updates-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-updates-multiverse_distribution: xenial-updates
     mirror_xenial-updates-multiverse_components: multiverse
     mirror_xenial-updates-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/restricted.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/restricted.yml
index 74aba0b..870caa0 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/restricted.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-updates-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-updates-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-updates-restricted_distribution: xenial-updates
     mirror_xenial-updates-restricted_components: restricted
     mirror_xenial-updates-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/universe.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/universe.yml
index cf8c817..cf050fd 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/universe.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-updates-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-updates-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-updates-universe_distribution: xenial-updates
     mirror_xenial-updates-universe_components: universe
     mirror_xenial-updates-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/main.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/main.yml
index 4d9db03..c1e5969 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/main.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-main_distribution: xenial
     mirror_xenial-main_components: main
     mirror_xenial-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/multiverse.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/multiverse.yml
index a74c520..aff82a6 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-multiverse_distribution: xenial
     mirror_xenial-multiverse_components: multiverse
     mirror_xenial-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/restricted.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/restricted.yml
index bde6b36..78a8ca9 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/restricted.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-restricted_distribution: xenial
     mirror_xenial-restricted_components: restricted
     mirror_xenial-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/universe.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/universe.yml
index b24cc1a..c0c67ff 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/universe.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-universe_distribution: xenial
     mirror_xenial-universe_components: universe
     mirror_xenial-universe_gpgkeys:
diff --git a/artifactory/client/init.yml b/artifactory/client/init.yml
index 05c05be..614266e 100644
--- a/artifactory/client/init.yml
+++ b/artifactory/client/init.yml
@@ -16,121 +16,287 @@
           ldap_account_base: ${_param:artifactory_security_ldap_root_dn}
           ldap_searchFilter: ${_param:artifactory_security_ldap_searchFilter}
         repo:
+          # Please keep repo list sorted
+
           _genericRepository-local:
+            rclass: local
+            packageType: generic
             description: "Used by Jimbo"
-            repo_type: local
-            package_type: generic
-          binary-dev-local:
-            description: "None"
-            repo_type: local
-            package_type: generic
-          binary-prod-local:
-            repo_type: local
-            package_type: generic
-          docker-dev-local:
-            repo_type: local
-            package_type: docker
-          docker-prod-local:
-            repo_type: local
-            package_type: docker
-          k8s-tests-images:
-            repo_type: local
-            package_type: docker
-          maven-local:
-            description: "Hosts Java libraries needed to build Docker images"
-            repo_type: local
-            package_type: maven
-          mcp-ci-images:
-            repo_type: local
-            package_type: docker
-          vm-images:
-            repo_type: local
-            package_type: generic
+
           _genericRepository-remote:
+            rclass: remote
+            packageType: generic
             description: "Used by Jimbo"
-            repo_type: remote
-            package_type: generic
             url: http://localhost
+
+          _genericRepository-virtual:
+            rclass: virtual
+            packageType: generic
+            description: "Used by Jimbo"
+            repositories:
+            - _genericRepository-local
+            - _genericRepository-remote
+
+          apk-local:
+            rclass: local
+            packageType: generic
+
           apk-remote:
-            repo_type: remote
-            package_type: generic
+            rclass: remote
+            packageType: generic
             url: http://dl-cdn.alpinelinux.org/alpine/
+
+          apk-virtual:
+            rclass: virtual
+            packageType: generic
+            repositories:
+            - apk-local
+            - apk-remote
+
           apt-docker-project:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: https://apt.dockerproject.org/repo
+
           artifactory-pro-debian:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: https://jfrog.bintray.com/artifactory-pro-debs
+
+          artifactory-pro-rpm:
+            rclass: remote
+            packageType: yum
+            url: http://jfrog.bintray.com/artifactory-pro-rpms
+
+          binary-dev-local:
+            rclass: local
+            packageType: generic
+
+          binary-dev-virtual:
+            rclass: virtual
+            packageType: generic
+            repositories:
+            - binary-dev-local
+            - binary-prod-local
+            - binary-remote
+            defaultDeploymentRepo: binary-dev-local
+
+          binary-prod-local:
+            rclass: local
+            packageType: generic
+
+          binary-prod-virtual:
+            rclass: virtual
+            packageType: generic
+            repositories:
+            - binary-prod-local
+            - binary-remote
+            - gcs-remote
+            defaultDeploymentRepo: binary-prod-local
+
+          binary-remote:
+            rclass: remote
+            packageType: generic
+            url: https://artifactory.mcp.mirantis.net/artifactory/binary-prod-virtual
+
+          centos:
+            rclass: virtual
+            packageType: yum
+            repositories:
+            - centos-local
+            - centos-remote
+            - artifactory-pro-rpm
+
+          centos-local:
+            rclass: local
+            packageType: yum
+
+          centos-remote:
+            rclass: remote
+            packageType: yum
+            url: http://mirror.centos.org/centos/
+
+          centos-virtual:
+            rclass: virtual
+            packageType: yum
+            repositories:
+            - centos-local
+            - centos-remote
+            defaultDeploymentRepo: centos-local
+
+          debian-local:
+            rclass: local
+            packageType: debian
+
           debian-mariadb-remote:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://sfo1.mirrors.digitalocean.com/mariadb/repo/10.1/debian/
+
           debian-nginx:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://nginx.org/packages/debian/
+
           debian-percona-remote:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://repo.percona.com/apt
+
           debian-rabbitmq-remote:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://www.rabbitmq.com/debian/
+
           debian-remote:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://ftp.us.debian.org/debian
+
           debian-security-remote:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://security.debian.org/
+
+          debian-virtual:
+            rclass: virtual
+            packageType: generic
+            repositories:
+            - debian-local
+            - debian-remote
+            - debian-security-remote
+            defaultDeploymentRepo: debian-local
+
+          docker-dev-local:
+            rclass: local
+            packageType: docker
+
+          docker-dev-virtual:
+            rclass: virtual
+            packageType: docker
+            repositories:
+            - docker-dev-local
+            - docker-prod-local
+            - docker-remote
+            defaultDeploymentRepo: docker-dev-local
+
+          docker-prod-local:
+            rclass: local
+            packageType: docker
+
+          docker-prod-virtual:
+            rclass: virtual
+            packageType: docker
+            repositories:
+            - docker-prod-local
+            - docker-remote
+            defaultDeploymentRepo: docker-prod-local
+
           docker-remote:
-            description: "Remote repository for DockerHub"
-            repo_type: remote
-            package_type: docker
+            rclass: remote
+            packageType: docker
             url: https://registry-1.docker.io/
+            description: "Remote repository for DockerHub"
+
           gcs-remote:
-            description: "Has zero downloads. Can be removed."
-            repo_type: remote
-            package_type: generic
+            rclass: remote
+            packageType: generic
             url: https://storage.googleapis.com
+            description: "Has zero downloads. Can be removed."
+
           gerrit-plugins:
-            description: "Overlaps with maven-local. We should resolve overlap and remove this repo."
-            repo_type: remote
-            package_type: generic
+            rclass: remote
+            packageType: generic
             url: http://builds.quelltextlich.at/gerrit/nightly
+            description: "Overlaps with maven-local. We should resolve overlap and remove this repo."
+
           jcenter:
-            repo_type: remote
-            package_type: maven
+            rclass: remote
+            packageType: maven
             url: https://jcenter.bintray.com
+
           jenkins-deb-pkgs:
-            repo_type: remote
-            package_type: generic
+            rclass: remote
+            packageType: generic
             url: https://pkg.jenkins.io/debian-stable/binary
+
           jenkins-plugins:
-            repo_type: remote
-            package_type: generic
+            rclass: remote
+            packageType: generic
             url: http://mirrors.jenkins-ci.org/plugins
+
           jenkins-plugins-jars:
-            repo_type: remote
-            package_type: maven
+            rclass: remote
+            packageType: maven
             url: https://repo.jenkins-ci.org/releases/org/jenkins-ci/plugins/
+
           jenkins-updates:
-            repo_type: remote
-            package_type: generic
+            rclass: remote
+            packageType: generic
             url: https://updates.jenkins.io/
+
+          k8s-tests-images:
+            rclass: local
+            packageType: docker
+
+          maven-local:
+            rclass: local
+            packageType: maven
+            description: "Hosts Java libraries needed to build Docker images"
+
+          mcp-k8s:
+            rclass: virtual
+            packageType: docker
+            repositories:
+            - mcp-k8s-local
+
+          mcp-k8s-ci:
+            rclass: local
+            packageType: docker
+
+          mcp-k8s-local:
+            rclass: local
+            packageType: docker
+
           mysql-connector-java:
-            repo_type: remote
-            package_type: maven
+            rclass: remote
+            packageType: maven
             url: http://repo.jfrog.org/artifactory/remote-repos/mysql/mysql-connector-java/
+
+          pypi-local:
+            rclass: local
+            packageType: pypi
+
           pypi-remote:
-            repo_type: remote
-            package_type: pypi
+            rclass: remote
+            packageType: pypi
             url: https://pypi.python.org
+
+          pypi-virtual:
+            rclass: virtual
+            packageType: pypi
+            repositories:
+            - pypi-local
+            - pypi-remote
+            defaultDeploymentRepo: pypi-local
+
+          ubuntu-local:
+            rclass: local
+            packageType: debian
+
           ubuntu-remote:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://us.archive.ubuntu.com/ubuntu/
+
+          ubuntu-virtual:
+            rclass: virtual
+            packageType: generic
+            repositories:
+            - ubuntu-local
+            - ubuntu-remote
+            defaultDeploymentRepo: ubuntu-local
+
+          vm-images:
+            rclass: local
+            packageType: generic
diff --git a/ceph/backup/client/single.yml b/ceph/backup/client/single.yml
new file mode 100644
index 0000000..c3afe96
--- /dev/null
+++ b/ceph/backup/client/single.yml
@@ -0,0 +1,3 @@
+classes:
+- service.ceph.backup.client
+- system.openssh.client.root
\ No newline at end of file
diff --git a/ceph/backup/server/single.yml b/ceph/backup/server/single.yml
new file mode 100644
index 0000000..ca36297
--- /dev/null
+++ b/ceph/backup/server/single.yml
@@ -0,0 +1,2 @@
+classes:
+- service.ceph.backup.server
diff --git a/ceph/common/container.yml b/ceph/common/container.yml
new file mode 100644
index 0000000..5c7619b
--- /dev/null
+++ b/ceph/common/container.yml
@@ -0,0 +1,6 @@
+classes:
+- service.ceph.common.container
+- system.ceph.monitoring.cluster_stats
+parameters:
+  _param:
+    ceph_common_prefix_dir: /srv/volumes/ceph
diff --git a/ceph/osd/cluster.yml b/ceph/osd/cluster.yml
index 9e98f91..31fa050 100644
--- a/ceph/osd/cluster.yml
+++ b/ceph/osd/cluster.yml
@@ -1,2 +1,8 @@
 classes:
 - service.ceph.osd.cluster
+parameters:
+  linux:
+    system:
+      kernel:
+        sysctl:
+          fs.aio-max-nr: 131072
diff --git a/designate/server/cluster.yml b/designate/server/cluster.yml
index eb6a5b6..1030861 100644
--- a/designate/server/cluster.yml
+++ b/designate/server/cluster.yml
@@ -4,6 +4,8 @@
 - system.haproxy.proxy.listen.openstack.designate
 - service.haproxy.proxy.single
 parameters:
+  _param:
+    designate_admin_api_enabled: false
   linux:
     system:
       package:
@@ -20,6 +22,9 @@
       region: ${_param:openstack_region}
       domain_id: ${_param:designate_domain_id}
       version: ${_param:designate_version}
+      admin_api:
+        enabled: ${_param:designate_admin_api_enabled}
+        enabled_extensions_admin: quotas
       database:
         engine: mysql
         host: ${_param:openstack_database_address}
diff --git a/designate/server/single.yml b/designate/server/single.yml
index b658f8b..765dcf8 100644
--- a/designate/server/single.yml
+++ b/designate/server/single.yml
@@ -1,6 +1,8 @@
 classes:
 - service.designate.server.single
 parameters:
+  _param:
+    designate_admin_api_enabled: false
   linux:
     system:
       package:
@@ -14,6 +16,9 @@
       region: ${_param:openstack_region}
       domain_id: ${_param:designate_domain_id}
       version: ${_param:designate_version}
+      admin_api:
+        enabled: ${_param:designate_admin_api_enabled}
+        enabled_extensions_admin: quotas
       bind:
         api:
           address: ${_param:single_address}
diff --git a/devops_portal/service/hce.yml b/devops_portal/service/hce.yml
new file mode 100644
index 0000000..274541c
--- /dev/null
+++ b/devops_portal/service/hce.yml
@@ -0,0 +1,15 @@
+parameters:
+  devops_portal:
+    config:
+      service:
+        hardware-correlation:
+          configure_proxy: true
+          resolve_hostname: true
+          proxy_connect_timeout: 300
+          proxy_send_timeout: 300
+          proxy_read_timeout: 300
+          send_timeout: 300
+          endpoint:
+            address: ${_param:hce_bind_host}
+            port: ${_param:hce_bind_port}
+            https: ${_param:hce_ssl:enabled}
diff --git a/docker/client.yml b/docker/client/compose/init.yml
similarity index 62%
rename from docker/client.yml
rename to docker/client/compose/init.yml
index df11493..efeeadd 100644
--- a/docker/client.yml
+++ b/docker/client/compose/init.yml
@@ -1,11 +1,10 @@
 classes:
-  - service.docker.client
+  - system.docker.client
 parameters:
   _param:
-    docker_image_compose: docker/compose:1.8.0
+    docker_image_compose: docker/compose:1.17.1
   docker:
     client:
-      enabled: true
       compose:
         source:
           engine: docker
diff --git a/docker/client/compose/service/gerrit.yml b/docker/client/compose/service/gerrit.yml
new file mode 100644
index 0000000..eeb126e
--- /dev/null
+++ b/docker/client/compose/service/gerrit.yml
@@ -0,0 +1,78 @@
+classes:
+  - system.docker.client.compose
+parameters:
+  _param:
+    docker_image_gerrit: tcpcloud/gerrit:2.13.6
+    docker_image_mysql: tcpcloud/mysql:5.6
+    gerrit_ldap_server: ""
+    gerrit_ldap_bind_user: ""
+    gerrit_ldap_bind_password: ""
+    gerrit_ldap_account_base: ""
+    gerrit_ldap_group_base: ""
+    gerrit_http_listen_url: http://*:8080/
+    gerrit_extra_opts: ""
+  docker:
+    client:
+      compose:
+        gerrit:
+          service:
+            server:
+              image: ${_param:docker_image_gerrit}
+              restart: always
+              ports:
+                - 18083:8080
+                - 29417:29418
+              volumes:
+                - /srv/volumes/gerrit:/var/gerrit/review_site
+              depends_on:
+                - db
+              environment:
+                #GERRIT_INIT_ARGS: ""
+                DATABASE_TYPE: "mysql"
+                DB_PORT_3306_TCP_ADDR: ${_param:cluster_vip_address}
+                DB_ENV_MYSQL_USER: gerrit
+                DB_ENV_MYSQL_PASSWORD: ${_param:mysql_gerrit_password}
+                DB_ENV_MYSQL_DB: gerrit
+                AUTH_TYPE: ${_param:gerrit_auth_type}
+                LDAP_SERVER: ${_param:gerrit_ldap_server}
+                LDAP_ACCOUNTPATTERN: 'uid={username}'
+                LDAP_ACCOUNTBASE: ${_param:gerrit_ldap_account_base}
+                LDAP_GROUPBASE: ${_param:gerrit_ldap_group_base}
+                LDAP_USERNAME: ${_param:gerrit_ldap_bind_user}
+                LDAP_PASSWORD: ${_param:gerrit_ldap_bind_password}
+                WEBURL: ${_param:gerrit_public_host}
+                HTTPD_LISTENURL: ${_param:gerrit_http_listen_url}
+                GERRIT_ADMIN_SSH_PUBLIC: ${_param:gerrit_admin_public_key}
+                GERRIT_ADMIN_PWD: ${_param:gerrit_admin_password}
+                GERRIT_ADMIN_EMAIL: ${_param:gerrit_admin_email}
+                CANLOADINIFRAME: "true"
+                JAVA_OPTIONS: ${_param:gerrit_extra_opts}
+                https_proxy: ${_param:docker_https_proxy}
+                http_proxy: ${_param:docker_http_proxy}
+                no_proxy: ${_param:docker_no_proxy}
+            db:
+              environment:
+                MYSQL_USER: gerrit
+                MYSQL_PASSWORD: ${_param:mysql_gerrit_password}
+                MYSQL_DATABASE: gerrit
+                MYSQL_ROOT_PASSWORD: ${_param:mysql_admin_password}
+                MYSQL_START_TIMEOUT: 300
+              deploy:
+                restart_policy:
+                  condition: any
+              image: "${_param:docker_image_mysql}"
+              ports:
+                - 13306:3306
+              volumes:
+                - /srv/volumes/mysql:/var/lib/mysql
+          network:
+            default:
+              ipam:
+                driver: default
+                config:
+                  - subnet: 172.30.0.0/24
+  linux:
+    system:
+      directory:
+        /srv/volumes/gerrit:
+          makedirs: true
diff --git a/docker/client/compose/service/jenkins.yml b/docker/client/compose/service/jenkins.yml
new file mode 100644
index 0000000..7db9da5
--- /dev/null
+++ b/docker/client/compose/service/jenkins.yml
@@ -0,0 +1,48 @@
+classes:
+  - system.docker.client.compose
+parameters:
+  _param:
+    docker_image_jenkins: tcpcloud/jenkins:2.100
+    jenkins_master_extra_opts: ""
+    jenkins_master_executors_num: 4
+    jenkins_master_max_concurent_requests: 40
+    jenkins_home_dir_path: /var/jenkins_home
+  docker:
+    client:
+      compose:
+        jenkins:
+          status: up
+          service:
+            master:
+              environment:
+                JENKINS_HOME: ${_param:jenkins_home_dir_path}
+                JAVA_OPTS: " -server -XX:+AlwaysPreTouch -Xloggc:${_param:jenkins_home_dir_path}/gc-%t.log -XX:NumberOfGCLogFiles=5 -XX:+UseGCLogFileRotation -XX:GCLogFileSize=20m -XX:+PrintGC -XX:+PrintGCDateStamps -XX:+PrintGCDetails -XX:+PrintHeapAtGC -XX:+PrintGCCause -XX:+PrintTenuringDistribution -XX:+PrintReferenceGC -XX:+PrintAdaptiveSizePolicy -XX:+UseG1GC -XX:+ExplicitGCInvokesConcurrent -XX:+ParallelRefProcEnabled -XX:+UseStringDeduplication -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=20 -XX:+UnlockDiagnosticVMOptions -XX:G1SummarizeRSetStatsPeriod=1 -Djenkins.install.runSetupWizard=false -Dhudson.DNSMultiCast.disabled=true -Dhudson.udp=-1 -Dhudson.footerURL=https://www.mirantis.com ${_param:jenkins_master_extra_opts}"
+                JENKINS_NUM_EXECUTORS: ${_param:jenkins_master_executors_num}
+                JENKINS_OPTS: " --handlerCountMax=${_param:jenkins_master_max_concurent_requests}"
+                https_proxy: ${_param:docker_https_proxy}
+                http_proxy: ${_param:docker_http_proxy}
+                no_proxy: ${_param:docker_no_proxy}
+              image: ${_param:docker_image_jenkins}
+              restart: always
+              ports:
+                - 18081:8080
+                - 50001:50000
+              volumes:
+                - /srv/volumes/jenkins:/var/jenkins_home
+                - /etc/ssl/certs/java/cacerts:/etc/ssl/certs/java/cacerts:ro
+          network:
+            default:
+              ipam:
+                driver: default
+                config:
+                  - subnet: 172.29.0.0/24
+  linux:
+    system:
+      directory:
+        /srv/volumes/jenkins:
+          makedirs: true
+          user: 1000
+          group: 1000
+      package:
+        ca-certificates-java:
+          version: latest
diff --git a/docker/client/init.yml b/docker/client/init.yml
new file mode 100644
index 0000000..610e0a4
--- /dev/null
+++ b/docker/client/init.yml
@@ -0,0 +1,6 @@
+classes:
+  - service.docker.client
+parameters:
+  docker:
+    client:
+      enabled: true
diff --git a/docker/host.yml b/docker/host.yml
index c3cc808..aef7a32 100644
--- a/docker/host.yml
+++ b/docker/host.yml
@@ -13,3 +13,4 @@
       options:
         ipv6: true
         fixed-cidr-v6: fc00::/7
+        storage-driver: overlay2
diff --git a/docker/swarm/manager.yml b/docker/swarm/manager.yml
index 12bfc0c..3b2d916 100644
--- a/docker/swarm/manager.yml
+++ b/docker/swarm/manager.yml
@@ -11,3 +11,7 @@
       master:
         host: ${_param:cluster_node01_address}
         port: ${_param:docker_swarm_master_port}
+    host:
+      options:
+        log-opts:
+          labels: "com.docker.stack.namespace,com.docker.swarm.service.name,com.docker.swarm.task.name"
diff --git a/docker/swarm/master.yml b/docker/swarm/master.yml
index fba9af3..d327796 100644
--- a/docker/swarm/master.yml
+++ b/docker/swarm/master.yml
@@ -7,3 +7,7 @@
     swarm:
       role: master
       advertise_addr: ${_param:single_address}
+    host:
+      options:
+        log-opts:
+          labels: "com.docker.stack.namespace,com.docker.swarm.service.name,com.docker.swarm.task.name"
diff --git a/docker/swarm/stack/hce.yml b/docker/swarm/stack/hce.yml
new file mode 100644
index 0000000..f059602
--- /dev/null
+++ b/docker/swarm/stack/hce.yml
@@ -0,0 +1,34 @@
+parameters:
+  _param:
+    docker_hce_replicas: 1
+    docker_image_hce: docker-prod-local.artifactory.mirantis.com/mirantis/oss/hce
+    hce_bind_host: hce-api
+    hce_bind_port: ${_param:haproxy_hce_bind_port}
+    hce_elasticsearch_host: elastic-endpoint-ip
+    hce_elasticsearch_port: elastic-endpoint-port
+    hce_prometheus_host: prometheus-endpoint-ip
+    hce_prometheus_port: prometheus-endpoint-port
+    hce_ssl:
+      enabled: false
+  docker:
+    client:
+      stack:
+        hce:
+          environment:
+            HCEELASTICHOST: ${_param:hce_elasticsearch_host}
+            HCEELASTICPORT: ${_param:hce_elasticsearch_port}
+            HCEPROMETHEUSHOST: ${_param:hce_prometheus_host}
+            HCEPROMETHEUSPORT: ${_param:hce_prometheus_port}
+          service:
+            hce-api:
+              image: ${_param:docker_image_hce}
+              deploy:
+                replicas: ${_param:docker_hce_replicas}
+                restart_policy:
+                  condition: any
+              ports:
+                - ${_param:haproxy_hce_exposed_port}:${_param:haproxy_hce_bind_port}
+          network:
+            default:
+              external:
+                name: oss_backend
diff --git a/docker/swarm/stack/janitor_monkey.yml b/docker/swarm/stack/janitor_monkey.yml
index 2e5698a..2849554 100644
--- a/docker/swarm/stack/janitor_monkey.yml
+++ b/docker/swarm/stack/janitor_monkey.yml
@@ -32,9 +32,11 @@
       auth_url: http://yourcloud.com:5000/v3/auth/tokens
       username: admin
       password: password
+      endpoint_type: public
       ssl_verify: False
-      source_credentials: /srv/volumes/rundeck/storage/content/cis/openstack
-      service_credentials: /opt/os_creds
+      source_credentials_dir: /srv/volumes/rundeck/storage
+      destination_credentials_dir: /opt/os_creds
+      cacert_path: ${_param:janitor_monkey_openstack:destination_credentials_dir}/content/keys/cis/openstack/cert.pem
   docker:
     client:
       stack:
@@ -56,12 +58,13 @@
             simianarmy.client.cloudfire.region: ${_param:janitor_monkey_cloudfire_region}
             simianarmy.client.cloudfire.cis.clustername: ${_param:janitor_monkey_cis_clustername}
             simianarmy.client.cloudfire.identityEndpoint: ${_param:janitor_monkey_openstack:auth_url}
+            simianarmy.client.cloudfire.identityEndpointType: ${_param:janitor_monkey_openstack:endpoint_type}
             simianarmy.client.cloudfire.accountKey: ${_param:janitor_monkey_openstack:username}
             simianarmy.client.cloudfire.secretKey: ${_param:janitor_monkey_openstack:password}
             simianarmy.client.cloudfire.domain: ${_param:janitor_monkey_openstack:project_domain_name}
             simianarmy.client.cloudfire.project: ${_param:janitor_monkey_openstack:project_name}
             simianarmy.client.cloudfire.SSLVerify: ${_param:janitor_monkey_openstack:ssl_verify}
-            simianarmy.client.cloudfire.cafile: ${_param:janitor_monkey_openstack:service_credentials}/cert.pem
+            simianarmy.client.cloudfire.cafile: ${_param:janitor_monkey_openstack:cacert_path}
             simianarmy.janitor.rule.stoppedInstanceRule.instanceAgeThreshold: ${_param:janitor_monkey_instance_age_threshold}
             simianarmy.janitor.notification.oss.url: ${_param:janitor_monkey_notification_oss_url}
             simianarmy.janitor.notification.oss.login_id: ${_param:janitor_monkey_notification_oss_login_id}
@@ -86,7 +89,7 @@
               ports:
                 - ${_param:haproxy_janitor_monkey_exposed_port}:${_param:janitor_monkey_bind_port}
               volumes:
-                - ${_param:janitor_monkey_openstack:source_credentials}:${_param:janitor_monkey_openstack:service_credentials}:ro
+                - ${_param:janitor_monkey_openstack:source_credentials_dir}:${_param:janitor_monkey_openstack:destination_credentials_dir}:ro
           network:
             default:
               external:
diff --git a/docker/swarm/stack/jenkins/master.yml b/docker/swarm/stack/jenkins/master.yml
index 1237fe3..d08bf71 100644
--- a/docker/swarm/stack/jenkins/master.yml
+++ b/docker/swarm/stack/jenkins/master.yml
@@ -2,10 +2,11 @@
 - system.docker
 parameters:
   _param:
-    docker_image_jenkins: tcpcloud/jenkins:2.89
+    docker_image_jenkins: tcpcloud/jenkins:2.100
     jenkins_master_extra_opts: ""
     jenkins_master_executors_num: 4
     jenkins_master_max_concurent_requests: 40
+    jenkins_home_dir_path: /var/jenkins_home
   docker:
     client:
       stack:
@@ -13,8 +14,8 @@
           service:
             master:
               environment:
-                JENKINS_HOME: /var/jenkins_home
-                JAVA_OPTS: " -server -XX:+AlwaysPreTouch -Xloggc:$JENKINS_HOME/gc-%t.log -XX:NumberOfGCLogFiles=5 -XX:+UseGCLogFileRotation -XX:GCLogFileSize=20m -XX:+PrintGC -XX:+PrintGCDateStamps -XX:+PrintGCDetails -XX:+PrintHeapAtGC -XX:+PrintGCCause -XX:+PrintTenuringDistribution -XX:+PrintReferenceGC -XX:+PrintAdaptiveSizePolicy -XX:+UseG1GC -XX:+ExplicitGCInvokesConcurrent -XX:+ParallelRefProcEnabled -XX:+UseStringDeduplication -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=20 -XX:+UnlockDiagnosticVMOptions -XX:G1SummarizeRSetStatsPeriod=1 -Djenkins.install.runSetupWizard=false -Dhudson.DNSMultiCast.disabled=true -Dhudson.udp=-1 -Dhudson.footerURL=https://www.mirantis.com ${_param:jenkins_master_extra_opts}"
+                JENKINS_HOME: ${_param:jenkins_home_dir_path}
+                JAVA_OPTS: " -server -XX:+AlwaysPreTouch -Xloggc:${_param:jenkins_home_dir_path}/gc-%t.log -XX:NumberOfGCLogFiles=5 -XX:+UseGCLogFileRotation -XX:GCLogFileSize=20m -XX:+PrintGC -XX:+PrintGCDateStamps -XX:+PrintGCDetails -XX:+PrintHeapAtGC -XX:+PrintGCCause -XX:+PrintTenuringDistribution -XX:+PrintReferenceGC -XX:+PrintAdaptiveSizePolicy -XX:+UseG1GC -XX:+ExplicitGCInvokesConcurrent -XX:+ParallelRefProcEnabled -XX:+UseStringDeduplication -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=20 -XX:+UnlockDiagnosticVMOptions -XX:G1SummarizeRSetStatsPeriod=1 -Djenkins.install.runSetupWizard=false -Dhudson.DNSMultiCast.disabled=true -Dhudson.udp=-1 -Dhudson.footerURL=https://www.mirantis.com ${_param:jenkins_master_extra_opts}"
                 JENKINS_NUM_EXECUTORS: ${_param:jenkins_master_executors_num}
                 JENKINS_OPTS: " --handlerCountMax=${_param:jenkins_master_max_concurent_requests}"
                 https_proxy: ${_param:docker_https_proxy}
diff --git a/docker/swarm/stack/monitoring/init.yml b/docker/swarm/stack/monitoring/init.yml
index 6efe125..925a10a 100644
--- a/docker/swarm/stack/monitoring/init.yml
+++ b/docker/swarm/stack/monitoring/init.yml
@@ -116,8 +116,5 @@
                 PROMETHEUS_DATA_DIR: ${_param:prometheus_server_data_directory}
                 PROMETHEUS_BIND_PORT: ${prometheus:server:bind:port}
                 PROMETHEUS_BIND_ADDRESS: ${prometheus:server:bind:address}
-                PROMETHEUS_STORAGE_LOCAL_ENGINE: ${prometheus:server:storage:local:engine}
                 PROMETHEUS_STORAGE_LOCAL_RETENTION: ${prometheus:server:storage:local:retention}
-                PROMETHEUS_STORAGE_LOCAL_TARGET_HEAP_SIZE: ${prometheus:server:storage:local:target_heap_size}
-                PROMETHEUS_STORAGE_LOCAL_NUM_FINGERPRINT_MUTEXES: ${prometheus:server:storage:local:num_fingerprint_mutexes}
                 PROMETHEUS_EXTERNAL_URL: "http://${_param:stacklight_monitor_address}:15010"
diff --git a/docker/swarm/stack/monitoring/remote_agent/ceph.yml b/docker/swarm/stack/monitoring/remote_agent/ceph.yml
index 6085eeb..07996fa 100644
--- a/docker/swarm/stack/monitoring/remote_agent/ceph.yml
+++ b/docker/swarm/stack/monitoring/remote_agent/ceph.yml
@@ -1,3 +1,4 @@
+# client role is deprecated. Use ceph_common.yml instead
 classes:
 - system.ceph.client.container
 - system.ceph.monitoring.cluster_stats
diff --git a/docker/swarm/stack/monitoring/remote_agent/ceph_common.yml b/docker/swarm/stack/monitoring/remote_agent/ceph_common.yml
new file mode 100644
index 0000000..3a269a7
--- /dev/null
+++ b/docker/swarm/stack/monitoring/remote_agent/ceph_common.yml
@@ -0,0 +1,9 @@
+parameters:
+  docker:
+    client:
+      stack:
+        monitoring:
+          service:
+            remote_agent:
+              volumes:
+                - ${ceph:common:prefix_dir}/etc/ceph:/etc/ceph
diff --git a/docker/swarm/stack/pushkin.yml b/docker/swarm/stack/pushkin.yml
index d0a3bce..22a921d 100644
--- a/docker/swarm/stack/pushkin.yml
+++ b/docker/swarm/stack/pushkin.yml
@@ -22,6 +22,7 @@
     sfdc_consumer_key: example_consumer_key
     sfdc_consumer_secret: example_consumer_secret
     sfdc_organization_id: example_organization_id
+    sfdc_environment_id: 0
     sfdc_sandbox_enabled: true
   docker:
     client:
@@ -46,6 +47,7 @@
             SFDC_CONSUMER_KEY: ${_param:sfdc_consumer_key}
             SFDC_CONSUMER_SECRET: ${_param:sfdc_consumer_secret}
             SFDC_ORGANIZATION_ID: ${_param:sfdc_organization_id}
+            SFDC_ENVIRONMENT_ID: ${_param:sfdc_environment_id}
             SFDC_SANDBOX_ENABLED: ${_param:sfdc_sandbox_enabled}
           service:
             pushkin-api:
diff --git a/docker/swarm/stack/rundeck.yml b/docker/swarm/stack/rundeck.yml
index 8ab0554..88693be 100644
--- a/docker/swarm/stack/rundeck.yml
+++ b/docker/swarm/stack/rundeck.yml
@@ -25,6 +25,7 @@
                 - /srv/volumes/rundeck/etc/realm.properties:/etc/rundeck/realm.properties
                 - /srv/volumes/rundeck/etc/rundeck-config.properties:/etc/rundeck/rundeck-config.properties
                 - /srv/volumes/rundeck/rundeck:/var/rundeck
+                - /srv/volumes/rundeck/data:/var/lib/rundeck/data
                 - /srv/volumes/rundeck/log:/var/log/rundeck
                 - /srv/volumes/rundeck/logs:/var/lib/rundeck/logs
                 - /srv/volumes/rundeck/plugins:/opt/rundeck-plugins
diff --git a/docker/swarm/stack/security_monkey.yml b/docker/swarm/stack/security_monkey.yml
index b5a1100..2f844c0 100644
--- a/docker/swarm/stack/security_monkey.yml
+++ b/docker/swarm/stack/security_monkey.yml
@@ -2,6 +2,8 @@
   _param:
     docker_security_monkey_api_replicas: 1
     docker_security_monkey_scheduler_replicas: 1
+    secmonkey_login_id: 11
+    secmonkey_application_id: 1
     docker_image_security_monkey_api: docker-prod-local.artifactory.mirantis.com/mirantis/oss/security-monkey-api
     docker_image_security_monkey_scheduler: docker-prod-local.artifactory.mirantis.com/mirantis/oss/security-monkey-scheduler
     security_monkey_bind_host: security-audit-api
@@ -28,10 +30,11 @@
       project_domain_name: Default
       project_name: admin
       user_domain_name: Default
-      source_credentials: /srv/volumes/rundeck/storage/content/cis/openstack
-      service_credentials: /opt/os_creds
       endpoint_type: public
       ssl_verify: False
+      source_credentials_dir: /srv/volumes/rundeck/storage
+      destination_credentials_dir: /opt/os_creds
+      cacert_path: ${_param:security_monkey_openstack:destination_credentials_dir}/content/keys/cis/openstack/cert.pem
   docker:
     client:
       stack:
@@ -45,6 +48,8 @@
             WEB_PORT: ${_param:security_monkey_web_port}
             API_PORT: ${_param:security_monkey_api_port}
             NGINX_PORT: ${_param:security_monkey_nginx_port}
+            NOTIFICATIONS_APP_ID: ${_param:secmonkey_application_id}
+            NOTIFICATIONS_LOGIN_ID: ${_param:secmonkey_login_id}
             NOTIFICATIONS_SERVICE_URL: ${_param:notification_service_url}
             DEFAULT_USER: ${_param:security_monkey_user}
             DEFAULT_PASSWORD: ${_param:security_monkey_password}
@@ -58,12 +63,12 @@
             OS_PROJECT_NAME: ${_param:security_monkey_openstack:project_name}
             OS_SSL_VERIFY: ${_param:security_monkey_openstack:ssl_verify}
             OS_ENDPOINT_TYPE: ${_param:security_monkey_openstack:endpoint_type}
-            CACERT_PATH: ${_param:security_monkey_openstack:service_credentials}/cert.pem
+            CACERT_PATH: ${_param:security_monkey_openstack:cacert_path}
             USER_DOMAIN_NAME: ${_param:security_monkey_openstack:user_domain_name}
             SM_WTF_CSRF_ENABLED: ${_param:devops_portal_sm_wtf_csrf_enabled}
             SECURITY_MONKEY_SYNC_INTERVAL: ${_param:security_monkey_sync_interval}
             SQLALCHEMY_DATABASE_URI: postgresql://${_param:secmonkey_db_user}:${_param:secmonkey_db_user_password}@${_param:secmonkey_db_host}:${_param:haproxy_postgresql_bind_port}/${_param:security_monkey_db}
-            SQLALCHEMY_POOL_RECYCLE: 14400
+            SQLALCHEMY_POOL_RECYCLE: 25000
           service:
             security-audit-api:
               image: ${_param:docker_image_security_monkey_api}
@@ -75,7 +80,7 @@
                 - ${_param:haproxy_security_monkey_exposed_port}:${_param:haproxy_security_monkey_bind_port}
               volumes:
                 - /srv/volumes/security_monkey/logs:/var/log/security_monkey/logs
-                - ${_param:security_monkey_openstack:source_credentials}:${_param:security_monkey_openstack:service_credentials}:ro
+                - ${_param:security_monkey_openstack:source_credentials_dir}:${_param:security_monkey_openstack:destination_credentials_dir}:ro
             security-audit-scheduler:
               image: ${_param:docker_image_security_monkey_scheduler}
               deploy:
@@ -84,7 +89,7 @@
                   condition: any
               volumes:
                 - /srv/volumes/security_monkey/logs:/var/log/security_monkey/logs
-                - ${_param:security_monkey_openstack:source_credentials}:${_param:security_monkey_openstack:service_credentials}:ro
+                - ${_param:security_monkey_openstack:source_credentials_dir}:${_param:security_monkey_openstack:destination_credentials_dir}:ro
           network:
             default:
               external:
diff --git a/elasticsearch/client/index/janitor_monkey.yml b/elasticsearch/client/index/cis_openstack.yml
similarity index 92%
rename from elasticsearch/client/index/janitor_monkey.yml
rename to elasticsearch/client/index/cis_openstack.yml
index bef92ae..3136f73 100644
--- a/elasticsearch/client/index/janitor_monkey.yml
+++ b/elasticsearch/client/index/cis_openstack.yml
@@ -7,9 +7,9 @@
       index:
         cis-openstack:
           enabled: true
-          force_operation: true
+          force_operation: false
           definition:
             template: cis-openstack
             settings:
               number_of_shards: ${_param:janitor_monkey_cis_openstack_shards}
-              number_of_replicas: ${_param:janitor_monkey_cis_openstack_replicas}
\ No newline at end of file
+              number_of_replicas: ${_param:janitor_monkey_cis_openstack_replicas}
diff --git a/elasticsearch/client/index/pushkin.yml b/elasticsearch/client/index/pushkin.yml
index 1d17c77..668a770 100644
--- a/elasticsearch/client/index/pushkin.yml
+++ b/elasticsearch/client/index/pushkin.yml
@@ -7,7 +7,7 @@
       index:
         notifications:
           enabled: true
-          force_operation: true
+          force_operation: false
           definition:
             template: notifications
             settings:
@@ -39,4 +39,4 @@
                     fields:
                       keyword:
                         type: keyword
-                        ignore_above: 256
\ No newline at end of file
+                        ignore_above: 256
diff --git a/elasticsearch/server/cluster.yml b/elasticsearch/server/cluster.yml
index 9be44ed..1bbe404 100644
--- a/elasticsearch/server/cluster.yml
+++ b/elasticsearch/server/cluster.yml
@@ -6,6 +6,7 @@
     java_environment_version: "8"
     java_environment_platform: openjdk
     elasticsearch_cluster_name: elasticsearch
+    elasticsearch_version: 5
   linux:
     system:
       sysctl:
@@ -16,6 +17,7 @@
       headless: true
   elasticsearch:
     server:
+      version: ${_param:elasticsearch_version}
       name: ${_param:elasticsearch_cluster_name}
       enabled: true
       master: true
diff --git a/elasticsearch/server/single.yml b/elasticsearch/server/single.yml
index 6606617..419513d 100644
--- a/elasticsearch/server/single.yml
+++ b/elasticsearch/server/single.yml
@@ -2,6 +2,8 @@
 - service.java.environment.openjdk8
 - service.elasticsearch.server.single
 parameters:
+  _param:
+    elasticsearch_version: 5
   linux:
     system:
       sysctl:
@@ -12,6 +14,7 @@
       headless: true
   elasticsearch:
     server:
+      version: ${_param:elasticsearch_version}
       enabled: true
       bind:
         address: ${_param:single_address}
diff --git a/fluentd/init.yml b/fluentd/init.yml
new file mode 100644
index 0000000..ebf469a
--- /dev/null
+++ b/fluentd/init.yml
@@ -0,0 +1,6 @@
+classes:
+- service.fluentd.agent.single
+- system
+parameters:
+  fluentd:
+    dollar: ${_param:dollarsign}
diff --git a/fluentd/label/default_metric/init.yml b/fluentd/label/default_metric/init.yml
new file mode 100644
index 0000000..ef8ecf2
--- /dev/null
+++ b/fluentd/label/default_metric/init.yml
@@ -0,0 +1,20 @@
+parameters:
+  fluentd:
+    agent:
+      config:
+        label:
+          default_metric:
+            filter:
+              add_general_fields:
+                tag: "**"
+                type: record_transformer
+                enable_ruby: true
+                record:
+                  - name: environment_label
+                    value: ${_param:cluster_domain}
+                  - name: Hostname
+                    value: ${fluentd:dollar}{ hostname }
+            match:
+              drop_everything:
+                tag: '**'
+                type: 'null'
diff --git a/fluentd/label/default_metric/prometheus.yml b/fluentd/label/default_metric/prometheus.yml
new file mode 100644
index 0000000..9eb3b1b
--- /dev/null
+++ b/fluentd/label/default_metric/prometheus.yml
@@ -0,0 +1,11 @@
+parameters:
+  fluentd:
+    agent:
+      plugin:
+        fluent-plugin-prometheus:
+          gem: ['fluent-plugin-prometheus']
+      config:
+        input:
+          prometheus:
+            metric:
+              type: prometheus
diff --git a/fluentd/label/default_output/drop_event.yml b/fluentd/label/default_output/drop_event.yml
new file mode 100644
index 0000000..295862c
--- /dev/null
+++ b/fluentd/label/default_output/drop_event.yml
@@ -0,0 +1,17 @@
+agent:
+  config:
+    label:
+      default_output:
+        filter:
+          drop_event:
+            tag: '**'
+            type: grep
+            exclude:
+              - name: drop_event
+                regexp: ^.+?$
+          remove_drop_event_key:
+            require:
+              - drop_event
+            tag: '**'
+            type: record_transformer
+            remove_keys: drop_event
diff --git a/fluentd/label/default_output/elasticsearch.yml b/fluentd/label/default_output/elasticsearch.yml
new file mode 100644
index 0000000..3c26d15
--- /dev/null
+++ b/fluentd/label/default_output/elasticsearch.yml
@@ -0,0 +1,15 @@
+classes:
+- service.fluentd.agent.output.elasticsearch
+parameters:
+  _params:
+    fluentd_elasticsearch_host: 127.0.0.1
+    elasticsearch_port: 9200
+  fluentd:
+    agent:
+      config:
+        label:
+          default_output:
+            match:
+              elasticsearch_output:
+                host: ${_param:fluentd_elasticsearch_host}
+                port: ${_param:elasticsearch_port}
diff --git a/fluentd/label/default_output/file.yml b/fluentd/label/default_output/file.yml
index 5e0050d..80707d3 100644
--- a/fluentd/label/default_output/file.yml
+++ b/fluentd/label/default_output/file.yml
@@ -2,26 +2,26 @@
   _param:
     fluentd_default_output_file: /var/log/td-agent/default-all.log
   fluentd:
-    config:
-      dollar: '$'
-      label:
-        default_output:
-          filter:
-            add_general_fields:
-              tag: "**"
-              type: record_transformer
-              enable_ruby: true
-              record:
-                - name: Type
-                  value: log
-                - name: environment_label
-                  value: ${_param:cluster_domain}
-                - name: Hostname
-                  value: ${fluentd:config:dollar}{ hostname }
-                - name: Timestamp
-                  value: ${fluentd:config:dollar}{ time.strftime('%Y-%m-%dT%H:%M:%S%z') }
-          match:
-            everything:
-              tag: '**'
-              type: 'file'
-              path: ${_param:fluentd_default_output_file}
+    agent:
+      config:
+        label:
+          default_output:
+            filter:
+              add_general_fields:
+                tag: "**"
+                type: record_transformer
+                enable_ruby: true
+                record:
+                  - name: Type
+                    value: log
+                  - name: environment_label
+                    value: ${_param:cluster_domain}
+                  - name: Hostname
+                    value: ${fluentd:dollar}{ hostname }
+                  - name: Timestamp
+                    value: ${fluentd:dollar}{ time.strftime('%Y-%m-%dT%H:%M:%S%z') }
+            match:
+              everything:
+                tag: '**'
+                type: 'file'
+                path: ${_param:fluentd_default_output_file}
diff --git a/galera/server/database/aodh.yml b/galera/server/database/aodh.yml
index f5095d2..c7cdfdc 100644
--- a/galera/server/database/aodh.yml
+++ b/galera/server/database/aodh.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_aodh_ssl_option: []
   mysql:
     server:
       database:
@@ -9,7 +11,9 @@
             password: ${_param:mysql_aodh_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_aodh_ssl_option}
           - name: aodh
             password: ${_param:mysql_aodh_password}
             host: ${_param:cluster_vip_address}
             rights: all
+            ssl_option: ${_param:mysql_aodh_ssl_option}
diff --git a/galera/server/database/barbican.yml b/galera/server/database/barbican.yml
index 4759439..a292660 100644
--- a/galera/server/database/barbican.yml
+++ b/galera/server/database/barbican.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_barbican_ssl_option: []
   mysql:
     server:
       database:
@@ -9,7 +11,9 @@
             password: ${_param:mysql_barbican_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_barbican_ssl_option}
           - name: barbican
             password: ${_param:mysql_barbican_password}
             host: ${_param:cluster_vip_address}
             rights: all
+            ssl_option: ${_param:mysql_barbican_ssl_option}
diff --git a/galera/server/database/ceilometer.yml b/galera/server/database/ceilometer.yml
index b33c8f9..08a7f8b 100644
--- a/galera/server/database/ceilometer.yml
+++ b/galera/server/database/ceilometer.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_ceilometer_ssl_option: []
   mysql:
     server:
       database:
@@ -9,7 +11,9 @@
             password: ${_param:mysql_ceilometer_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_ceilometer_ssl_option}
           - name: ceilometer
             password: ${_param:mysql_ceilometer_password}
             host: ${_param:cluster_local_address}
             rights: all
+            ssl_option: ${_param:mysql_ceilometer_ssl_option}
diff --git a/galera/server/database/cinder.yml b/galera/server/database/cinder.yml
index 08b6ddb..6478cb8 100644
--- a/galera/server/database/cinder.yml
+++ b/galera/server/database/cinder.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_cinder_ssl_option: []
   mysql:
     server:
       database:
@@ -9,7 +11,9 @@
             password: ${_param:mysql_cinder_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_cinder_ssl_option}
           - name: cinder
             password: ${_param:mysql_cinder_password}
             host: ${_param:cluster_local_address}
             rights: all
+            ssl_option: ${_param:mysql_cinder_ssl_option}
diff --git a/galera/server/database/designate.yml b/galera/server/database/designate.yml
index 107e3ae..43a76f9 100644
--- a/galera/server/database/designate.yml
+++ b/galera/server/database/designate.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_designate_ssl_option: []
   mysql:
     server:
       database:
@@ -9,10 +11,12 @@
             password: ${_param:mysql_designate_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_designate_ssl_option}
           - name: designate
             password: ${_param:mysql_designate_password}
             host: ${_param:cluster_vip_address}
             rights: all
+            ssl_option: ${_param:mysql_designate_ssl_option}
         designate_pool_manager:
           encoding: utf8
           users:
@@ -20,7 +24,9 @@
             password: ${_param:mysql_designate_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_designate_ssl_option}
           - name: designate
             password: ${_param:mysql_designate_password}
             host: ${_param:cluster_vip_address}
             rights: all
+            ssl_option: ${_param:mysql_designate_ssl_option}
diff --git a/galera/server/database/glance.yml b/galera/server/database/glance.yml
index 7e5e443..7af81d8 100644
--- a/galera/server/database/glance.yml
+++ b/galera/server/database/glance.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_glance_ssl_option: []
   mysql:
     server:
       database:
@@ -9,7 +11,9 @@
             password: ${_param:mysql_glance_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_glance_ssl_option}
           - name: glance
             password: ${_param:mysql_glance_password}
             host: ${_param:cluster_local_address}
             rights: all
+            ssl_option: ${_param:mysql_glance_ssl_option}
diff --git a/galera/server/database/grafana.yml b/galera/server/database/grafana.yml
index fa4742e..3bfee87 100644
--- a/galera/server/database/grafana.yml
+++ b/galera/server/database/grafana.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_grafana_ssl_option: []
   mysql:
     server:
       database:
@@ -9,8 +11,10 @@
             password: ${_param:mysql_grafana_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_grafana_ssl_option}
           - name: grafana
             password: ${_param:mysql_grafana_password}
             host: ${_param:cluster_local_address}
             rights: all
+            ssl_option: ${_param:mysql_grafana_ssl_option}
 
diff --git a/galera/server/database/graphite.yml b/galera/server/database/graphite.yml
index 8ba6efd..595c16b 100644
--- a/galera/server/database/graphite.yml
+++ b/galera/server/database/graphite.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_graphite_ssl_option: []
   mysql:
     server:
       database:
@@ -9,3 +11,4 @@
             password: '${_param:mysql_graphite_password}'
             host: '%'
             rights: 'all'
+            ssl_option: ${_param:mysql_graphite_ssl_option}
diff --git a/galera/server/database/heat.yml b/galera/server/database/heat.yml
index 0d716d8..31b3968 100644
--- a/galera/server/database/heat.yml
+++ b/galera/server/database/heat.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_heat_ssl_option: []
   mysql:
     server:
       database:
@@ -9,7 +11,9 @@
             password: ${_param:mysql_heat_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_heat_ssl_option}
           - name: heat
             password: ${_param:mysql_heat_password}
             host: ${_param:cluster_local_address}
             rights: all
+            ssl_option: ${_param:mysql_heat_ssl_option}
diff --git a/galera/server/database/ironic.yml b/galera/server/database/ironic.yml
index 8cb14a3..a478aeb 100644
--- a/galera/server/database/ironic.yml
+++ b/galera/server/database/ironic.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_ironic_ssl_option: []
   mysql:
     server:
       database:
@@ -9,7 +11,9 @@
             password: ${_param:mysql_ironic_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_ironic_ssl_option}
           - name: ironic
             password: ${_param:mysql_ironic_password}
             host: ${_param:cluster_local_address}
             rights: all
+            ssl_option: ${_param:mysql_ironic_ssl_option}
diff --git a/galera/server/database/keystone.yml b/galera/server/database/keystone.yml
index fc2c5eb..d6483cd 100644
--- a/galera/server/database/keystone.yml
+++ b/galera/server/database/keystone.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_keystone_ssl_option: []
   mysql:
     server:
       database:
@@ -9,7 +11,9 @@
             password: ${_param:mysql_keystone_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_keystone_ssl_option}
           - name: keystone
             password: ${_param:mysql_keystone_password}
             host: ${_param:cluster_local_address}
             rights: all
+            ssl_option: ${_param:mysql_keystone_ssl_option}
diff --git a/galera/server/database/neutron.yml b/galera/server/database/neutron.yml
index 58dd012..b5ee606 100644
--- a/galera/server/database/neutron.yml
+++ b/galera/server/database/neutron.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_neutron_ssl_option: []
   mysql:
     server:
       database:
@@ -9,7 +11,9 @@
             password: '${_param:mysql_neutron_password}'
             host: '%'
             rights: 'all'
+            ssl_option: ${_param:mysql_neutron_ssl_option}
           - name: 'neutron'
             password: '${_param:mysql_neutron_password}'
             host: '${_param:cluster_local_address}'
             rights: 'all'
+            ssl_option: ${_param:mysql_neutron_ssl_option}
diff --git a/galera/server/database/nova.yml b/galera/server/database/nova.yml
index 86d4821..d2ffc4a 100644
--- a/galera/server/database/nova.yml
+++ b/galera/server/database/nova.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_nova_ssl_option: []
   mysql:
     server:
       database:
@@ -9,10 +11,12 @@
             password: ${_param:mysql_nova_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_nova_ssl_option}
           - name: nova
             password: ${_param:mysql_nova_password}
             host: ${_param:cluster_local_address}
             rights: all
+            ssl_option: ${_param:mysql_nova_ssl_option}
         nova_api:
           encoding: utf8
           users:
@@ -20,10 +24,12 @@
             password: ${_param:mysql_nova_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_nova_ssl_option}
           - name: nova
             password: ${_param:mysql_nova_password}
             host: ${_param:cluster_local_address}
             rights: all
+            ssl_option: ${_param:mysql_nova_ssl_option}
         nova_cell0:
           encoding: utf8
           users:
@@ -31,7 +37,9 @@
             password: ${_param:mysql_nova_password}
             host: '%'
             rights: all
+            ssl_option: ${_param:mysql_nova_ssl_option}
           - name: nova
             password: ${_param:mysql_nova_password}
             host: ${_param:cluster_local_address}
             rights: all
+            ssl_option: ${_param:mysql_nova_ssl_option}
diff --git a/galera/server/database/octavia.yml b/galera/server/database/octavia.yml
index dfefb9c..7b4eaaf 100644
--- a/galera/server/database/octavia.yml
+++ b/galera/server/database/octavia.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    mysql_octavia_ssl_option: []
   mysql:
     server:
       database:
@@ -9,7 +11,9 @@
             password: '${_param:mysql_octavia_password}'
             host: '%'
             rights: 'all'
+            ssl_option: ${_param:mysql_octavia_ssl_option}
           - name: 'octavia'
             password: '${_param:mysql_octavia_password}'
             host: '${_param:cluster_local_address}'
             rights: 'all'
+            ssl_option: ${_param:mysql_octavia_ssl_option}
diff --git a/galera/server/database/panko.yml b/galera/server/database/panko.yml
new file mode 100644
index 0000000..c4c455a
--- /dev/null
+++ b/galera/server/database/panko.yml
@@ -0,0 +1,19 @@
+parameters:
+  _param:
+    mysql_panko_ssl_option: []
+  mysql:
+    server:
+      database:
+        panko:
+          encoding: utf8
+          users:
+          - name: panko
+            password: ${_param:mysql_panko_password}
+            host: '%'
+            rights: all
+            ssl_option: ${_param:mysql_panko_ssl_option}
+          - name: panko
+            password: ${_param:mysql_panko_password}
+            host: ${_param:cluster_local_address}
+            rights: all
+            ssl_option: ${_param:mysql_panko_ssl_option}
diff --git a/gerrit/client/init.yml b/gerrit/client/init.yml
index 25c0b94..8b097ee 100644
--- a/gerrit/client/init.yml
+++ b/gerrit/client/init.yml
@@ -7,8 +7,6 @@
     client:
       enabled: True
       try_login: ${_param:gerrit_try_login}
-      source:
-        engine: pip
       dir:
         git: /srv/volumes/gerrit/git
         gerrit_config: /srv/volumes/gerrit/etc/gerrit.config
@@ -47,16 +45,16 @@
           - name: create
             group: devops-core
           labels:
-          - name: label-Code-Review
+          - name: Code-Review
             group: devops-core
             score: -2..+2
-          - name: label-Code-Review
+          - name: Code-Review
             group: Non-Interactive Users
             score: -1..+1
-          - name: label-Verified
+          - name: Verified
             group: Non-Interactive Users
             score: -1..+1
-          - name: label-Workflow
+          - name: Workflow
             group: devops-core
             score: -1..+1
         "refs/tags/*":
diff --git a/gerrit/server/single.yml b/gerrit/server/single.yml
index 952e82e..c279f00 100644
--- a/gerrit/server/single.yml
+++ b/gerrit/server/single.yml
@@ -38,6 +38,11 @@
         hash: sha256=45786a920a929c6258de6461bcf03ddec8925577bd485905f102ceb6e5e1e47c
 #        address: https://gerrit-ci.gerritforge.com/job/Gerrit-stable-2.13/20/artifact/buck-out/gen/gerrit.war
 #        hash: md5=2e17064b8742c4622815593ec496c571
+      receive_timeout: 5min
+      sshd:
+        threads: 64
+        batch_threads: 16
+        max_connections_per_user: 64
       database:
         engine: postgresql
         host: localhost
@@ -45,6 +50,10 @@
         name: gerrit
         user: gerrit
         password: ${_param:postgresql_gerrit_password}
+        pool_limit: 250
+        pool_max_idle: 16
+      change_cleanup:
+        abandon_after: 3months
   postgresql:
     server:
       version: "9.5"
diff --git a/glance/client/image/cirros.yml b/glance/client/image/cirros.yml
index d9f3f33..3a7b213 100644
--- a/glance/client/image/cirros.yml
+++ b/glance/client/image/cirros.yml
@@ -2,7 +2,7 @@
 - system.glance.client
 parameters:
   _param:
-    cirros_image_url: "http://apt.mirantis.com/images/cirros-x64-20170828.qcow2"
+    cirros_image_url: "http://images.mirantis.com/cirros-x64-20170828.qcow2"
     cirros_image_name:  "cirros-0.3.0-x86_64"
   glance:
     client:
diff --git a/glance/client/image/ubuntu_trusty.yml b/glance/client/image/ubuntu_trusty.yml
index be9effc..2af6458 100644
--- a/glance/client/image/ubuntu_trusty.yml
+++ b/glance/client/image/ubuntu_trusty.yml
@@ -2,7 +2,7 @@
 - system.glance.client
 parameters:
   _param:
-    ubuntu_trusty_image_url: "http://apt.mirantis.com/images/ubuntu-14-04-x64-mcp1.1.qcow2"
+    ubuntu_trusty_image_url: "http://images.mirantis.com/ubuntu-14-04-x64-mcp1.1.qcow2"
     ubuntu_trusty_image_name:  "ubuntu-14-04-x64-mcp1.1"
   glance:
     client:
diff --git a/glance/client/image/ubuntu_xenial.yml b/glance/client/image/ubuntu_xenial.yml
index 4206584..a08a47d 100644
--- a/glance/client/image/ubuntu_xenial.yml
+++ b/glance/client/image/ubuntu_xenial.yml
@@ -2,7 +2,7 @@
 - system.glance.client
 parameters:
   _param:
-    ubuntu_xenial_image_url: "http://apt.mirantis.com/images/ubuntu-16-04-x64-mcp1.1.qcow2"
+    ubuntu_xenial_image_url: "http://images.mirantis.com/ubuntu-16-04-x64-mcp1.1.qcow2"
     ubuntu_xenial_image_name:  "ubuntu-16-04-amd64-cloudimg"
   glance:
     client:
diff --git a/haproxy/proxy/listen/cicd/aptly.yml b/haproxy/proxy/listen/cicd/aptly.yml
index 682e0d3..de70101 100644
--- a/haproxy/proxy/listen/cicd/aptly.yml
+++ b/haproxy/proxy/listen/cicd/aptly.yml
@@ -15,8 +15,8 @@
             - httplog
           balance: source
           timeout:
-            server: 10m
-            client: 10m
+            server: 90m
+            client: 90m
           binds:
             - address: ${_param:haproxy_aptly_api_bind_host}
               port: ${_param:haproxy_aptly_api_bind_port}
diff --git a/haproxy/proxy/listen/kubernetes/apiserver.yml b/haproxy/proxy/listen/kubernetes/apiserver.yml
index 8dfcb35..950765f 100644
--- a/haproxy/proxy/listen/kubernetes/apiserver.yml
+++ b/haproxy/proxy/listen/kubernetes/apiserver.yml
@@ -4,8 +4,6 @@
       listen:
         k8s_secure:
           type: kubernetes
-          options:
-            - ssl-hello-chk
           binds:
           - address: ${_param:cluster_vip_address}
             port: 443
@@ -13,15 +11,15 @@
           - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 6443
-            params: check
+            params: check check-ssl verify none
           - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 6443
-            params: check
+            params: check check-ssl verify none
           - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 6443
-            params: check
+            params: check check-ssl verify none
           timeout:
             server: 10m
             client: 10m
diff --git a/haproxy/proxy/listen/openstack/aodh.yml b/haproxy/proxy/listen/openstack/aodh.yml
index 6b024aa..acd6340 100644
--- a/haproxy/proxy/listen/openstack/aodh.yml
+++ b/haproxy/proxy/listen/openstack/aodh.yml
@@ -9,15 +9,15 @@
           - address: ${_param:cluster_vip_address}
             port: 8042
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 8042
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 8042
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 8042
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
\ No newline at end of file
diff --git a/haproxy/proxy/listen/openstack/barbican.yml b/haproxy/proxy/listen/openstack/barbican.yml
index 04251d9..c1f9877 100644
--- a/haproxy/proxy/listen/openstack/barbican.yml
+++ b/haproxy/proxy/listen/openstack/barbican.yml
@@ -9,15 +9,15 @@
           - address: ${_param:cluster_vip_address}
             port: 9311
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 9311
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 9311
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 9311
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
@@ -28,15 +28,15 @@
           - address: ${_param:cluster_vip_address}
             port: 9312
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 9312
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 9312
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 9312
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
\ No newline at end of file
diff --git a/haproxy/proxy/listen/openstack/cinder.yml b/haproxy/proxy/listen/openstack/cinder.yml
index a693e6e..c0bb7be 100644
--- a/haproxy/proxy/listen/openstack/cinder.yml
+++ b/haproxy/proxy/listen/openstack/cinder.yml
@@ -9,15 +9,15 @@
           - address: ${_param:cluster_vip_address}
             port: 8776
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 8776
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 8776
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 8776
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
\ No newline at end of file
diff --git a/haproxy/proxy/listen/openstack/glance.yml b/haproxy/proxy/listen/openstack/glance.yml
index 729cc5b..144fd4e 100644
--- a/haproxy/proxy/listen/openstack/glance.yml
+++ b/haproxy/proxy/listen/openstack/glance.yml
@@ -9,15 +9,15 @@
           - address: ${_param:cluster_vip_address}
             port: 9292
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 9292
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 9292
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 9292
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
@@ -28,15 +28,15 @@
           - address: ${_param:cluster_vip_address}
             port: 9191
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 9191
             params: check
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 9191
             params: check
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 9191
             params: check
diff --git a/haproxy/proxy/listen/openstack/glare.yml b/haproxy/proxy/listen/openstack/glare.yml
index a984275..36a6337 100644
--- a/haproxy/proxy/listen/openstack/glare.yml
+++ b/haproxy/proxy/listen/openstack/glare.yml
@@ -9,15 +9,15 @@
           - address: ${_param:cluster_vip_address}
             port: 9494
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 9494
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 9494
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 9494
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
diff --git a/haproxy/proxy/listen/openstack/heat.yml b/haproxy/proxy/listen/openstack/heat.yml
index 2e6b918..50595ea 100644
--- a/haproxy/proxy/listen/openstack/heat.yml
+++ b/haproxy/proxy/listen/openstack/heat.yml
@@ -9,15 +9,15 @@
           - address: ${_param:cluster_vip_address}
             port: 8003
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 8003
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 8003
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 8003
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
@@ -28,15 +28,15 @@
           - address: ${_param:cluster_vip_address}
             port: 8004
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 8004
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 8004
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 8004
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
@@ -47,15 +47,15 @@
           - address: ${_param:cluster_vip_address}
             port: 8000
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 8000
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 8000
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 8000
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
diff --git a/haproxy/proxy/listen/openstack/horizon.yml b/haproxy/proxy/listen/openstack/horizon.yml
index 9bf838c..14f5c2b 100644
--- a/haproxy/proxy/listen/openstack/horizon.yml
+++ b/haproxy/proxy/listen/openstack/horizon.yml
@@ -9,15 +9,15 @@
           - address: ${_param:cluster_vip_address}
             port: 8078
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 8078
             params: check
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 8078
             params: check
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 8078
             params: check
\ No newline at end of file
diff --git a/haproxy/proxy/listen/openstack/ironic.yml b/haproxy/proxy/listen/openstack/ironic.yml
index 221a9cc..1713085 100644
--- a/haproxy/proxy/listen/openstack/ironic.yml
+++ b/haproxy/proxy/listen/openstack/ironic.yml
@@ -10,15 +10,15 @@
           - address: ${_param:cluster_vip_address}
             port: 6385
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 6385
             params: check
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 6385
             params: check
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 6385
             params: check
diff --git a/haproxy/proxy/listen/openstack/keystone/init.yml b/haproxy/proxy/listen/openstack/keystone/init.yml
index 4359f60..32f776e 100644
--- a/haproxy/proxy/listen/openstack/keystone/init.yml
+++ b/haproxy/proxy/listen/openstack/keystone/init.yml
@@ -7,15 +7,15 @@
           - address: ${_param:cluster_vip_address}
             port: 5000
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 5000
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 5000
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 5000
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
@@ -24,15 +24,15 @@
           - address: ${_param:cluster_vip_address}
             port: 35357
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 35357
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 35357
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 35357
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
diff --git a/haproxy/proxy/listen/openstack/neutron.yml b/haproxy/proxy/listen/openstack/neutron.yml
index 1f8b4d5..29bd548 100644
--- a/haproxy/proxy/listen/openstack/neutron.yml
+++ b/haproxy/proxy/listen/openstack/neutron.yml
@@ -9,15 +9,15 @@
           - address: ${_param:cluster_vip_address}
             port: 9696
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 9696
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 9696
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 9696
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
\ No newline at end of file
diff --git a/haproxy/proxy/listen/openstack/nova-placement.yml b/haproxy/proxy/listen/openstack/nova-placement.yml
index e3b72b7..9fec963 100644
--- a/haproxy/proxy/listen/openstack/nova-placement.yml
+++ b/haproxy/proxy/listen/openstack/nova-placement.yml
@@ -15,15 +15,15 @@
               options:
               - expect status 401
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 8778
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 8778
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 8778
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
diff --git a/haproxy/proxy/listen/openstack/nova.yml b/haproxy/proxy/listen/openstack/nova.yml
index efffee0..1e090ef 100644
--- a/haproxy/proxy/listen/openstack/nova.yml
+++ b/haproxy/proxy/listen/openstack/nova.yml
@@ -9,15 +9,15 @@
           - address: ${_param:cluster_vip_address}
             port: 8774
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 8774
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 8774
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 8774
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
@@ -27,15 +27,15 @@
           - address: ${_param:cluster_vip_address}
             port: 8775
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 8775
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 8775
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 8775
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
diff --git a/haproxy/proxy/listen/openstack/novnc.yml b/haproxy/proxy/listen/openstack/novnc.yml
index 78b7d98..40b9d9c 100644
--- a/haproxy/proxy/listen/openstack/novnc.yml
+++ b/haproxy/proxy/listen/openstack/novnc.yml
@@ -10,15 +10,15 @@
           - address: ${_param:cluster_vip_address}
             port: 6080
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 6080
             params: check
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 6080
             params: check
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 6080
             params: check
diff --git a/haproxy/proxy/listen/openstack/octavia.yml b/haproxy/proxy/listen/openstack/octavia.yml
index 7360557..c2b8e6d 100644
--- a/haproxy/proxy/listen/openstack/octavia.yml
+++ b/haproxy/proxy/listen/openstack/octavia.yml
@@ -9,15 +9,15 @@
           - address: ${_param:cluster_vip_address}
             port: 9876
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 9876
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 9876
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 9876
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
diff --git a/haproxy/proxy/listen/openstack/sahara.yml b/haproxy/proxy/listen/openstack/sahara.yml
index 3bbf809..335c4f6 100644
--- a/haproxy/proxy/listen/openstack/sahara.yml
+++ b/haproxy/proxy/listen/openstack/sahara.yml
@@ -10,15 +10,15 @@
           - address: ${_param:cluster_vip_address}
             port: 8386
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 8386
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 8386
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 8386
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
diff --git a/haproxy/proxy/listen/oss/hce.yml b/haproxy/proxy/listen/oss/hce.yml
new file mode 100644
index 0000000..499674c
--- /dev/null
+++ b/haproxy/proxy/listen/oss/hce.yml
@@ -0,0 +1,33 @@
+parameters:
+  _param:
+    haproxy_hce_bind_host: ${_param:haproxy_bind_address}
+    haproxy_hce_bind_port: 8886
+    haproxy_hce_exposed_port: 18886
+    haproxy_hce_ssl:
+      enabled: false
+  haproxy:
+    proxy:
+      listen:
+        hce:
+          mode: http
+          balance: source
+          http_request:
+            - action: "add-header X-Forwarded-Proto https"
+              condition: "if { ssl_fc }"
+          binds:
+            - address: ${_param:haproxy_hce_bind_host}
+              port: ${_param:haproxy_hce_bind_port}
+              ssl: ${_param:haproxy_hce_ssl}
+          servers:
+            - name: ${_param:cluster_node01_name}
+              host: ${_param:cluster_node01_address}
+              port: ${_param:haproxy_hce_exposed_port}
+              params: check
+            - name: ${_param:cluster_node02_name}
+              host: ${_param:cluster_node02_address}
+              port: ${_param:haproxy_hce_exposed_port}
+              params: backup check
+            - name: ${_param:cluster_node03_name}
+              host: ${_param:cluster_node03_address}
+              port: ${_param:haproxy_hce_exposed_port}
+              params: backup check
diff --git a/init.yml b/init.yml
new file mode 100644
index 0000000..7d8695f
--- /dev/null
+++ b/init.yml
@@ -0,0 +1,3 @@
+parameters:
+  _param:
+    dollarsign: '$'
diff --git a/jenkins/client/approved_scripts.yml b/jenkins/client/approved_scripts.yml
index daafadd..dfcf9ac 100644
--- a/jenkins/client/approved_scripts.yml
+++ b/jenkins/client/approved_scripts.yml
@@ -17,12 +17,15 @@
         - method groovy.util.XmlParser parseText java.lang.String
         - method hudson.PluginManager getPlugins
         - method hudson.PluginWrapper getShortName
+        - method hudson.model.Hudson getSlaves
         - method hudson.model.Item getName
         - method hudson.model.ItemGroup getItem java.lang.String
         - method hudson.model.ItemGroup getItems
         - method hudson.model.Job getBuildByNumber int
         - method hudson.model.Job getBuilds
         - method hudson.model.Job getLastBuild
+        - method hudson.model.Node getLabelString
+        - method hudson.model.Node getNodeName
         - method hudson.model.Run getEnvironment
         - method hudson.model.Run getId
         - method hudson.model.Run getNumber
@@ -51,6 +54,7 @@
         - method java.util.Collection stream
         - method java.util.Date getTime
         - method java.util.LinkedHashMap$LinkedHashIterator hasNext
+        - method java.util.List add int java.lang.Object
         - method java.util.List subList int int
         - method java.util.Map remove java.lang.Object
         - method java.util.Map size
@@ -127,6 +131,8 @@
         - staticMethod org.codehaus.groovy.runtime.ScriptBytecodeAdapter bitwiseNegate java.lang.Object
         - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods toBoolean java.lang.Boolean
         - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.lang.Object java.lang.String
+        - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods multiply java.lang.String java.lang.Number
+        - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods minus java.lang.String java.lang.Object
         - method java.io.File listFiles
         - method java.lang.String concat java.lang.String
         - method org.jenkinsci.plugins.workflow.steps.FlowInterruptedException getCauses
@@ -134,3 +140,4 @@
         - method hudson.model.Actionable getAction java.lang.Class
         - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods toSorted java.lang.Iterable
         - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods intersect java.util.List java.lang.Iterable
+        - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods reverse java.util.List
diff --git a/jenkins/client/init.yml b/jenkins/client/init.yml
index 5e3f4a1..e4a3fcd 100644
--- a/jenkins/client/init.yml
+++ b/jenkins/client/init.yml
@@ -8,6 +8,8 @@
     jenkins_client_password: none
     jenkins_master_host: ${_param:control_vip_address}
     jenkins_master_port: 8081
+    jenkins_aptly_storages: "local"
+    jenkins_pipelines_branch: "master"
   jenkins:
     client:
       master:
@@ -31,6 +33,7 @@
         git: {}
         heavy-job: {}
         jobConfigHistory: {}
+        jira: {}
         ldap: {}
         matrix-auth: {}
         monitoring: {}
diff --git a/jenkins/client/job/aptly.yml b/jenkins/client/job/aptly.yml
index 256c04a..2ac90bb 100644
--- a/jenkins/client/job/aptly.yml
+++ b/jenkins/client/job/aptly.yml
@@ -63,6 +63,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: aptly-promote-pipeline.groovy
             param:
@@ -92,3 +93,64 @@
                 type: string
                 default: "all"
                 description: "Comma separated list (,)"
+              STORAGES:
+                type: string
+                default: "${_param:jenkins_aptly_storages}"
+                description: "Comma separated list of storage"
+      job_template:
+        aptly-all:
+          name: aptly-{{operation}}-all-{{source}}-{{target}}
+          jobs:
+            - operation: promote
+              diff_only: false
+              source: nightly
+              target: testing
+            - operation: promote
+              diff_only: false
+              source: testing
+              target: stable
+          template:
+            discard:
+              build:
+                keep_num: 25
+              artifact:
+                keep_num: 25
+            type: workflow-scm
+            concurrent: false
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
+              credentials: "gerrit"
+              script: aptly-promote-pipeline.groovy
+            param:
+              SOURCE:
+                type: string
+                default: "(.*)/{{source}}"
+              TARGET:
+                type: string
+                default: "{0}/{{target}}"
+              RECREATE:
+                type: boolean
+                default: 'false'
+              DUMP_PUBLISH:
+                type: boolean
+                default: 'true'
+              DIFF_ONLY:
+                type: boolean
+                default: '{{diff_only}}'
+              APTLY_URL:
+                type: string
+                default: "${_param:jenkins_aptly_api_url}"
+              COMPONENTS:
+                type: string
+                default: "all"
+                description: "Comma separated list (,)"
+              PACKAGES:
+                type: string
+                default: "all"
+                description: "Comma separated list (,)"
+              STORAGES:
+                type: string
+                default: "${_param:jenkins_aptly_storages}"
+                description: "Comma separated list of storage"
diff --git a/jenkins/client/job/ceph/add-node.yml b/jenkins/client/job/ceph/add-node.yml
index 9fee51e..29af563 100644
--- a/jenkins/client/job/ceph/add-node.yml
+++ b/jenkins/client/job/ceph/add-node.yml
@@ -12,6 +12,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: ceph-add-node.groovy
           param:
diff --git a/jenkins/client/job/ceph/backend-migration.yml b/jenkins/client/job/ceph/backend-migration.yml
index a8736a2..ab3f639 100644
--- a/jenkins/client/job/ceph/backend-migration.yml
+++ b/jenkins/client/job/ceph/backend-migration.yml
@@ -12,6 +12,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: ceph-backend-migration.groovy
           param:
diff --git a/jenkins/client/job/ceph/remove-node.yml b/jenkins/client/job/ceph/remove-node.yml
index 4a5efe3..af678b5 100644
--- a/jenkins/client/job/ceph/remove-node.yml
+++ b/jenkins/client/job/ceph/remove-node.yml
@@ -12,6 +12,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: ceph-remove-node.groovy
           param:
diff --git a/jenkins/client/job/ceph/remove-osd.yml b/jenkins/client/job/ceph/remove-osd.yml
index af3b9ed..0a5801d 100644
--- a/jenkins/client/job/ceph/remove-osd.yml
+++ b/jenkins/client/job/ceph/remove-osd.yml
@@ -12,6 +12,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: ceph-remove-osd.groovy
           param:
diff --git a/jenkins/client/job/ceph/replace-failed-osd.yml b/jenkins/client/job/ceph/replace-failed-osd.yml
index 57081ec..43c2f0b 100644
--- a/jenkins/client/job/ceph/replace-failed-osd.yml
+++ b/jenkins/client/job/ceph/replace-failed-osd.yml
@@ -12,6 +12,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: ceph-replace-failed-osd.groovy
           param:
@@ -33,9 +34,9 @@
             DEVICE:
               type: string
               description: Comma separated list of failed devices that will be replaced at HOST (/dev/sdb,/dev/sdc)
-            JOURNAL_OR_BLOCKDB_PARTITION:
+            JOURNAL_BLOCKDB_BLOCKWAL_PARTITION:
               type: string
-              description: Comma separated list of partitions where journal or block_db for the failed devices on this HOST were stored (/dev/sdh2,/dev/sdh3)
+              description: Comma separated list of partitions where journal, block_db or block_wal for the failed devices on this HOST were stored (/dev/sdh2,/dev/sdh3)
             ADMIN_HOST:
               type: string
               description: Host with admin keyring and correct crushmap file in /etc/ceph/crushmap
@@ -44,6 +45,10 @@
               type: boolean
               default: 'false'
               description: Wait for healthy during pipeline
+            DMCRYPT:
+              type: boolean
+              default: 'false'
+              description: Check if replacing osds were encrypted
             CLUSTER_FLAGS:
               type: string
               description: Flags to be aplied before pipeline and after pipeline (comma-separated list)
diff --git a/jenkins/client/job/ceph/upgrade.yml b/jenkins/client/job/ceph/upgrade.yml
index 9b58f3b..7717761 100644
--- a/jenkins/client/job/ceph/upgrade.yml
+++ b/jenkins/client/job/ceph/upgrade.yml
@@ -12,6 +12,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: ceph-upgrade.groovy
           param:
@@ -71,4 +72,4 @@
             BACKUP_ENABLED:
               type: boolean
               default: 'true'
-              description: Set to True if disks of Ceph VMs should be copied before upgrade
+              description: Select to copy the disks of Ceph VMs before upgrade and backup Ceph directories on OSD nodes.
diff --git a/jenkins/client/job/debian/packages/extra.yml b/jenkins/client/job/debian/packages/extra.yml
index 13ee191..61d7ee2 100644
--- a/jenkins/client/job/debian/packages/extra.yml
+++ b/jenkins/client/job/debian/packages/extra.yml
@@ -148,11 +148,11 @@
             - package: telegraf
               dist: trusty
               build: telegraf
-              branch: release-1.2
+              branch: release-1.5
             - package: telegraf
               dist: xenial
               build: telegraf
-              branch: release-1.2
+              branch: release-1.5
             - package: libvirt-exporter
               dist: xenial
               build: libvirt-exporter
@@ -189,12 +189,29 @@
               dist: xenial
               build: pipeline
               branch: debian/xenial
+            - package: gerritlib
+              dist: xenial
+              build: pipeline
+              branch: debian/xenial
+            - package: python-pygerrit2
+              dist: xenial
+              build: pipeline
+              branch: debian/xenial
+            - package: jeepyb
+              dist: xenial
+              build: pipeline
+              branch: debian/xenial
+            - package: salt-pepper
+              dist: xenial
+              build: pipeline
+              branch: debian/xenial
           template:
             type: workflow-scm
             concurrent: false
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: build-debian-packages-{{build}}.groovy
             trigger:
diff --git a/jenkins/client/job/debian/packages/heat/resources.yml b/jenkins/client/job/debian/packages/heat/resources.yml
index 73cceb5..92bdbe0 100644
--- a/jenkins/client/job/debian/packages/heat/resources.yml
+++ b/jenkins/client/job/debian/packages/heat/resources.yml
@@ -26,6 +26,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: build-debian-packages-pipeline.groovy
             trigger:
diff --git a/jenkins/client/job/debian/packages/horizon/modules.yml b/jenkins/client/job/debian/packages/horizon/modules.yml
index 4fe4966..ebf3b21 100644
--- a/jenkins/client/job/debian/packages/horizon/modules.yml
+++ b/jenkins/client/job/debian/packages/horizon/modules.yml
@@ -160,6 +160,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: build-debian-packages-pipeline.groovy
             trigger:
diff --git a/jenkins/client/job/debian/packages/horizon/themes.yml b/jenkins/client/job/debian/packages/horizon/themes.yml
index a26977f..dbaab83 100644
--- a/jenkins/client/job/debian/packages/horizon/themes.yml
+++ b/jenkins/client/job/debian/packages/horizon/themes.yml
@@ -40,6 +40,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: build-debian-packages-pipeline.groovy
             trigger:
@@ -94,4 +95,4 @@
                 default: "amd64"
               UPLOAD_APTLY:
                 type: boolean
-                default: 'true'
\ No newline at end of file
+                default: 'true'
diff --git a/jenkins/client/job/debian/packages/salt-multi.yml b/jenkins/client/job/debian/packages/salt-multi.yml
index 322afde..90e6f02 100644
--- a/jenkins/client/job/debian/packages/salt-multi.yml
+++ b/jenkins/client/job/debian/packages/salt-multi.yml
@@ -56,6 +56,9 @@
             - name: kubernetes
               upload_source_package: true
               dist: xenial
+            - name: mirascan
+              upload_source_package: true
+              dist: xenial
             - name: neutron
               upload_source_package: true
               dist: xenial
@@ -76,6 +79,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: build-debian-packages-pipeline.groovy
             trigger:
diff --git a/jenkins/client/job/debian/packages/salt.yml b/jenkins/client/job/debian/packages/salt.yml
index 74665e7..d29fc5e 100644
--- a/jenkins/client/job/debian/packages/salt.yml
+++ b/jenkins/client/job/debian/packages/salt.yml
@@ -170,6 +170,9 @@
             - name: magnum
               upload_source_package: false
               dist: trusty
+            - name: manila
+              upload_source_package: false
+              dist: trusty
             - name: memcached
               upload_source_package: false
               dist: trusty
@@ -266,6 +269,9 @@
             - name: rundeck
               upload_source_package: false
               dist: trusty
+            - name: runtest
+              upload_source_package: false
+              dist: trusty
             - name: sahara
               upload_source_package: false
               dist: trusty
@@ -395,6 +401,9 @@
             - name: fluentbit
               upload_source_package: true
               dist: xenial
+            - name: fluentd
+              upload_source_package: true
+              dist: xenial
             - name: foreman
               upload_source_package: true
               dist: xenial
@@ -482,6 +491,9 @@
             - name: magnum
               upload_source_package: true
               dist: xenial
+            - name: manila
+              upload_source_package: true
+              dist: xenial
             - name: memcached
               upload_source_package: true
               dist: xenial
@@ -581,6 +593,9 @@
             - name: rsyslog
               upload_source_package: true
               dist: xenial
+            - name: runtest
+              upload_source_package: true
+              dist: xenial
             - name: sahara
               upload_source_package: true
               dist: xenial
@@ -637,6 +652,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: build-debian-packages-pipeline.groovy
             trigger:
diff --git a/jenkins/client/job/debian/packages/testing.yml b/jenkins/client/job/debian/packages/testing.yml
index c7ecf98..f150f80 100644
--- a/jenkins/client/job/debian/packages/testing.yml
+++ b/jenkins/client/job/debian/packages/testing.yml
@@ -17,6 +17,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: build-debian-packages-{{build}}.groovy
             trigger:
diff --git a/jenkins/client/job/deploy/k8s_control.yml b/jenkins/client/job/deploy/k8s_control.yml
index 7e915c2..4dba2e7 100644
--- a/jenkins/client/job/deploy/k8s_control.yml
+++ b/jenkins/client/job/deploy/k8s_control.yml
@@ -8,11 +8,12 @@
           display_name: "Deploy - k8s control"
           discard:
             build:
-              keep_num: 20
+              keep_num: 50
           concurrent: false
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: deploy-k8s-deployments.groovy
           param:
diff --git a/jenkins/client/job/deploy/kqueen.yml b/jenkins/client/job/deploy/kqueen.yml
new file mode 100644
index 0000000..06b449b
--- /dev/null
+++ b/jenkins/client/job/deploy/kqueen.yml
@@ -0,0 +1,61 @@
+parameters:
+  jenkins:
+    client:
+      job:
+        deploy_aws_k8s_kqueen_job:
+          name: deploy-aws-k8s-kqueen
+          type: workflow-scm
+          discard:
+            build:
+              keep_num: 50
+          concurrent: true
+          display_name: "Deploy AWS K8S using kqueen"
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
+            credentials: "gerrit"
+            script: deploy-aws-k8s-kqueen-pipeline.groovy
+          param:
+            # deployments
+            STACK_NAME:
+              type: string
+              description: "AWS stack name - mandatory param, will be used as is"
+            STACK_COMPUTE_COUNT:
+              type: string
+              default: '2'
+
+            STACK_TEMPLATE:
+              type: string
+              default: "k8s_ha_calico_sm"
+            STACK_TEMPLATE_URL:
+              type: string
+              default: "${_param:jenkins_gerrit_url}/mk/heat-templates"
+            STACK_TEMPLATE_CREDENTIALS:
+              type: string
+              default: "gerrit"
+            STACK_TEMPLATE_BRANCH:
+              type: string
+              default: "master"
+
+            # salt
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt-qa-credentials"
+            SALT_MASTER_URL:
+              type: string
+              default: ""
+
+            # aws api
+            AWS_STACK_REGION:
+              type: string
+              default: "eu-central-1"
+            AWS_API_CREDENTIALS:
+              type: string
+              default: "aws-credentials"
+            AWS_SSH_KEY:
+              type: string
+              default: "jenkins-mk"
+            KQUEEN_BUILD_ID:
+              type: string
+
diff --git a/jenkins/client/job/deploy/lab/cicd.yml b/jenkins/client/job/deploy/lab/cicd.yml
index 9002c9c..d524bbc 100644
--- a/jenkins/client/job/deploy/lab/cicd.yml
+++ b/jenkins/client/job/deploy/lab/cicd.yml
@@ -14,6 +14,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: cicd-lab-pipeline.groovy
             param:
diff --git a/jenkins/client/job/deploy/lab/cleanup.yml b/jenkins/client/job/deploy/lab/cleanup.yml
index 4d2a179..0db6463 100644
--- a/jenkins/client/job/deploy/lab/cleanup.yml
+++ b/jenkins/client/job/deploy/lab/cleanup.yml
@@ -8,10 +8,11 @@
           display_name: "Deploy - stack cleanup"
           discard:
             build:
-              keep_num: 20
+              keep_num: 50
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: cleanup-pipeline.groovy
           param:
@@ -58,7 +59,7 @@
               default: "aws-credentials"
             AWS_DEFAULT_REGION:
               type: string
-              default: "us-west-2"
+              default: "eu-central-1"
 
         delete-failed-stacks:
           type: workflow-scm
@@ -70,6 +71,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: delete-broken-stacks-pipeline.groovy
           trigger:
diff --git a/jenkins/client/job/deploy/lab/component/ceph.yml b/jenkins/client/job/deploy/lab/component/ceph.yml
index e9e3d64..b927c5d 100644
--- a/jenkins/client/job/deploy/lab/component/ceph.yml
+++ b/jenkins/client/job/deploy/lab/component/ceph.yml
@@ -15,3 +15,10 @@
         stack_install: core,ceph
         stack_test: "ceph"
         job_timer: "H H * * *"
+      - stack_name: os_ha_ovs_ceph
+        stack_env: devcloud
+        stack_type: heat
+        stack_install: core,openstack,ovs,ceph
+        stack_test: ""
+        job_timer: "H H(0-6) * * *"
+
diff --git a/jenkins/client/job/deploy/lab/demo.yml b/jenkins/client/job/deploy/lab/demo.yml
index 3ea8a40..2bb6ad5 100644
--- a/jenkins/client/job/deploy/lab/demo.yml
+++ b/jenkins/client/job/deploy/lab/demo.yml
@@ -9,6 +9,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: kafka-demo.groovy
           param:
diff --git a/jenkins/client/job/deploy/lab/deploy.yml b/jenkins/client/job/deploy/lab/deploy.yml
index 108e30d..9a04876 100644
--- a/jenkins/client/job/deploy/lab/deploy.yml
+++ b/jenkins/client/job/deploy/lab/deploy.yml
@@ -11,12 +11,13 @@
             type: workflow-scm
             discard:
               build:
-                keep_num: 20
+                keep_num: 100
             concurrent: true
             display_name: "Deploy - {{stack_name}} {{stack_type}}"
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: cloud-deploy-pipeline.groovy
             trigger:
@@ -71,6 +72,9 @@
                 type: string
                 default: 'deploy-stack-cleanup'
 
+              STACK_RECLASS_ADDRESS:
+                type: string
+                default: ""
               STACK_RECLASS_BRANCH:
                 type: string
                 default: ""
@@ -86,15 +90,26 @@
                 type: text
                 default: ""
                 description: "YAML with overrides for Salt deployment"
+              BOOTSTRAP_EXTRA_REPO_PARAMS:
+                type: string
+                default: ""
+                description: "Defines a list of extra repos with parameters, format: repo 1, repo priority 1, repo pin 1; repo 2, repo priority 2, repo pin 2"
               FORMULA_PKG_REVISION:
                 type: string
                 default: ""
                 description: "Formulas revision to install on Salt Master bootstrap stage"
+              EXTRA_FORMULAS:
+                type: string
+                default: ""
+              STATIC_MGMT_NETWORK:
+                  type: boolean
+                  default: 'false'
+                  description: "Check if model contains static IP address definitions for all nodes"
 
               # aws api
               AWS_STACK_REGION:
                 type: string
-                default: "us-west-2"
+                default: "eu-central-1"
               AWS_API_CREDENTIALS:
                 type: string
                 default: "aws-credentials"
@@ -165,3 +180,32 @@
                 description: "Run tests matched to pattern only"
                 default: ""
 
+              # TestRail vars
+              TESTRAIL_REPORT:
+                type: boolean
+                description: "Report test results to TestRail if true"
+                default: "false"
+              TESTRAIL_REPORTER_IMAGE:
+                type: string
+                description: "Testrail reporter docker image"
+                default: "alrem/xunit2testrail"
+              TESTRAIL_QA_CREDENTIALS:
+                type: string
+                description: "Credentials for results upload to testrail"
+                default: "oscore-qa-credentials"
+              TESTRAIL_MILESTONE:
+                type: string
+                description: "TestRail milestone"
+                default: "MCP1.1"
+              TESTRAIL_PLAN:
+                type: string
+                description: "TestRail test plan name. Will be generated if missing."
+                default: ""
+              TESTRAIL_GROUP:
+                type: string
+                description: "TestRail test group name."
+                default: "{{stack_name}}"
+              TESTRAIL_SUITE:
+                type: string
+                description: "TestRail test suite name"
+                default: "Tempest 16.0.0 with designate tests"
diff --git a/jenkins/client/job/deploy/lab/ironic.yml b/jenkins/client/job/deploy/lab/ironic.yml
index 8c397cf..f0b67e8 100644
--- a/jenkins/client/job/deploy/lab/ironic.yml
+++ b/jenkins/client/job/deploy/lab/ironic.yml
@@ -76,4 +76,5 @@
             script: ironic-node-provision-pipeline.groovy
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
           type: workflow-scm
diff --git a/jenkins/client/job/deploy/lab/release/mcp11.yml b/jenkins/client/job/deploy/lab/release/mcp11.yml
index 0a3127c..5c0f4d4 100644
--- a/jenkins/client/job/deploy/lab/release/mcp11.yml
+++ b/jenkins/client/job/deploy/lab/release/mcp11.yml
@@ -3,13 +3,13 @@
 parameters:
   _param:
     jenkins_deploy_jobs:
-      - stack_name: virtual_mcp11_contrail
-        stack_env: devcloud_virtual_mcp11_contrail
+      - stack_name: virtual_mcp_contrail
+        stack_env: devcloud_mcp11_contrail
         stack_install: core,openstack,contrail
         stack_type: heat
         stack_test: ""
         job_timer: ""
-      - stack_name: virtual_mcp11_ovs_dvr
+      - stack_name: virtual_mcp11_dvr
         stack_env: devcloud_virtual_mcp11_dvr
         stack_install: core,openstack,dvr
         stack_type: heat
diff --git a/jenkins/client/job/deploy/openstack.yml b/jenkins/client/job/deploy/openstack.yml
index f316ab4..c507824 100644
--- a/jenkins/client/job/deploy/openstack.yml
+++ b/jenkins/client/job/deploy/openstack.yml
@@ -8,11 +8,12 @@
           display_name: "Deploy - OpenStack"
           discard:
             build:
-              keep_num: 20
+              keep_num: 50
           concurrent: true
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: cloud-deploy-pipeline.groovy
           param:
@@ -34,6 +35,10 @@
             ASK_ON_ERROR:
                 type: boolean
                 default: 'false'
+            STATIC_MGMT_NETWORK:
+                type: boolean
+                default: 'false'
+                description: "Check if model contains static IP address definitions for all nodes"
         deploy-openstack-compute:
           type: workflow-scm
           concurrent: true
@@ -41,6 +46,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: openstack-compute-install.groovy
           param:
diff --git a/jenkins/client/job/deploy/rollout.yml b/jenkins/client/job/deploy/rollout.yml
index 93f5167..3b05fd6 100644
--- a/jenkins/client/job/deploy/rollout.yml
+++ b/jenkins/client/job/deploy/rollout.yml
@@ -13,6 +13,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: rollout-config-change.groovy
           param:
@@ -78,6 +79,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: git-merge-branches-pipeline.groovy
           param:
diff --git a/jenkins/client/job/deploy/test.yml b/jenkins/client/job/deploy/test.yml
index 9b99ee5..acf6fa3 100644
--- a/jenkins/client/job/deploy/test.yml
+++ b/jenkins/client/job/deploy/test.yml
@@ -7,12 +7,13 @@
           type: workflow-scm
           discard:
             build:
-              keep_num: 20
+              keep_num: 50
           concurrent: true
           display_name: "Deploy - Test services in environment"
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: test-service.groovy
           param:
diff --git a/jenkins/client/job/deploy/update/config.yml b/jenkins/client/job/deploy/update/config.yml
index e956736..7c75e5b 100644
--- a/jenkins/client/job/deploy/update/config.yml
+++ b/jenkins/client/job/deploy/update/config.yml
@@ -14,6 +14,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: change-config.groovy
           param:
diff --git a/jenkins/client/job/deploy/update/init.yml b/jenkins/client/job/deploy/update/init.yml
index 4d77c7b..4e6f460 100644
--- a/jenkins/client/job/deploy/update/init.yml
+++ b/jenkins/client/job/deploy/update/init.yml
@@ -6,8 +6,10 @@
   - system.jenkins.client.job.deploy.update.update_mirror_image
   - system.jenkins.client.job.deploy.update.upgrade
   - system.jenkins.client.job.deploy.update.upgrade_compute
+  - system.jenkins.client.job.deploy.update.upgrade_mcp_release
   - system.jenkins.client.job.deploy.update.upgrade_ovs_gateway
   - system.jenkins.client.job.deploy.update.upgrade_opencontrail
+  - system.jenkins.client.job.deploy.update.upgrade_opencontrail4_0
   - system.jenkins.client.job.deploy.update.restore_mysql
   - system.jenkins.client.job.deploy.update.restore_cassandra
   - system.jenkins.client.job.deploy.update.restore_zookeeper
diff --git a/jenkins/client/job/deploy/update/package.yml b/jenkins/client/job/deploy/update/package.yml
index 55a9ef0..b276ce4 100644
--- a/jenkins/client/job/deploy/update/package.yml
+++ b/jenkins/client/job/deploy/update/package.yml
@@ -14,6 +14,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: update-package.groovy
           param:
diff --git a/jenkins/client/job/deploy/update/restore_cassandra.yml b/jenkins/client/job/deploy/update/restore_cassandra.yml
index 7f53f80..115f7a2 100644
--- a/jenkins/client/job/deploy/update/restore_cassandra.yml
+++ b/jenkins/client/job/deploy/update/restore_cassandra.yml
@@ -14,6 +14,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: restore-cassandra.groovy
           param:
diff --git a/jenkins/client/job/deploy/update/restore_mysql.yml b/jenkins/client/job/deploy/update/restore_mysql.yml
index 9b2e4d7..2c4ce12 100644
--- a/jenkins/client/job/deploy/update/restore_mysql.yml
+++ b/jenkins/client/job/deploy/update/restore_mysql.yml
@@ -14,6 +14,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: xtrabackup-restore-mysql-db.groovy
           param:
diff --git a/jenkins/client/job/deploy/update/restore_zookeeper.yml b/jenkins/client/job/deploy/update/restore_zookeeper.yml
index f33607a..b6d044a 100644
--- a/jenkins/client/job/deploy/update/restore_zookeeper.yml
+++ b/jenkins/client/job/deploy/update/restore_zookeeper.yml
@@ -14,6 +14,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: restore-zookeeper.groovy
           param:
diff --git a/jenkins/client/job/deploy/update/update_mirror_image.yml b/jenkins/client/job/deploy/update/update_mirror_image.yml
index 75363db..ec812c4 100644
--- a/jenkins/client/job/deploy/update/update_mirror_image.yml
+++ b/jenkins/client/job/deploy/update/update_mirror_image.yml
@@ -14,6 +14,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: update-mirror-image.groovy
           param:
@@ -22,4 +23,37 @@
               default: "${_param:jenkins_salt_api_url}"
             SALT_MASTER_CREDENTIALS:
               type: string
-              default: "salt"
\ No newline at end of file
+              default: "salt"
+            UPDATE_APTLY:
+              type: boolean
+              default: 'true'
+            UPDATE_APTLY_MIRRORS:
+              type: string
+              default: ""
+            PUBLISH_APTLY:
+              type: boolean
+              default: 'true'
+            RECREATE_APTLY_PUBLISHES:
+              type: boolean
+              default: 'false'
+            FORCE_OVERWRITE_APTLY_PUBLISHES:
+              type: boolean
+              default: 'false'
+            CLEANUP_APTLY:
+              type: boolean
+              default: 'false'
+            UPDATE_DOCKER_REGISTRY:
+              type: boolean
+              default: 'true'
+            CLEANUP_DOCKER_CACHE:
+              type: boolean
+              default: 'false'
+            UPDATE_PYPI:
+              type: boolean
+              default: 'true'
+            UPDATE_GIT:
+              type: boolean
+              default: 'true'
+            UPDATE_IMAGES:
+              type: boolean
+              default: 'true'
\ No newline at end of file
diff --git a/jenkins/client/job/deploy/update/update_salt_environment.yml b/jenkins/client/job/deploy/update/update_salt_environment.yml
index 9efd6c5..f9ea6d5 100644
--- a/jenkins/client/job/deploy/update/update_salt_environment.yml
+++ b/jenkins/client/job/deploy/update/update_salt_environment.yml
@@ -14,6 +14,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: update-salt-environment.groovy
           param:
diff --git a/jenkins/client/job/deploy/update/upgrade.yml b/jenkins/client/job/deploy/update/upgrade.yml
index 415e0b4..2c76753 100644
--- a/jenkins/client/job/deploy/update/upgrade.yml
+++ b/jenkins/client/job/deploy/update/upgrade.yml
@@ -14,6 +14,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: openstack-control-upgrade.groovy
           param:
diff --git a/jenkins/client/job/deploy/update/upgrade_compute.yml b/jenkins/client/job/deploy/update/upgrade_compute.yml
index f95e70e..90bfc76 100644
--- a/jenkins/client/job/deploy/update/upgrade_compute.yml
+++ b/jenkins/client/job/deploy/update/upgrade_compute.yml
@@ -14,6 +14,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: openstack-compute-upgrade.groovy
           param:
diff --git a/jenkins/client/job/deploy/update/upgrade_mcp_release.yml b/jenkins/client/job/deploy/update/upgrade_mcp_release.yml
new file mode 100644
index 0000000..8587140
--- /dev/null
+++ b/jenkins/client/job/deploy/update/upgrade_mcp_release.yml
@@ -0,0 +1,33 @@
+#
+# Jobs to upgrade MCP release
+#
+parameters:
+  _param:
+    jenkins_salt_api_url: "http://${_param:salt_master_host}:6969"
+  jenkins:
+    client:
+      job:
+        upgrade-mcp-release:
+          type: workflow-scm
+          concurrent: true
+          display_name: "Deploy - upgrade MCP Release"
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
+            credentials: "gerrit"
+            script: upgrade-mcp-release.groovy
+          param:
+            SALT_MASTER_URL:
+              type: string
+              default: "${_param:jenkins_salt_api_url}"
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+            MCP_VERSION:
+              type: string
+              default: ""
+            UPDATE_LOCAL_REPOS:
+              type: boolean
+              default: 'false'
+              description: "Use only when local repositories are present"
\ No newline at end of file
diff --git a/jenkins/client/job/deploy/update/upgrade_opencontrail.yml b/jenkins/client/job/deploy/update/upgrade_opencontrail.yml
index b5d1e77..de7e46f 100644
--- a/jenkins/client/job/deploy/update/upgrade_opencontrail.yml
+++ b/jenkins/client/job/deploy/update/upgrade_opencontrail.yml
@@ -14,6 +14,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: opencontrail-upgrade.groovy
           param:
diff --git a/jenkins/client/job/deploy/update/upgrade_opencontrail4_0.yml b/jenkins/client/job/deploy/update/upgrade_opencontrail4_0.yml
new file mode 100644
index 0000000..f622371
--- /dev/null
+++ b/jenkins/client/job/deploy/update/upgrade_opencontrail4_0.yml
@@ -0,0 +1,50 @@
+#
+# Jobs to update packages on given Salt master environment
+#
+parameters:
+  _param:
+    jenkins_salt_api_url: "http://${_param:salt_master_host}:6969"
+  jenkins:
+    client:
+      job:
+        deploy-upgrade-opencontrail40:
+          type: workflow-scm
+          concurrent: true
+          display_name: "Deploy - upgrade Opencontrail to 4.x"
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
+            credentials: "gerrit"
+            script: opencontrail40-upgrade.groovy
+          param:
+            SALT_MASTER_URL:
+              type: string
+              default: "${_param:jenkins_salt_api_url}"
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+            STAGE_CONTROLLERS_UPGRADE:
+              type: boolean
+              default: 'true'
+              description: "Run upgrade on Opencontrail controllers"
+            STAGE_COMPUTES_UPGRADE:
+              type: boolean
+              default: 'true'
+              description: "Run upgrade on Opencontrail compute nodes"
+            COMPUTE_TARGET_SERVERS:
+              type: string
+              default: "cmp*"
+              description: Salt compound target to match nodes to be updated [*, G@osfamily:debian].
+            COMPUTE_TARGET_SUBSET_LIVE:
+              type: string
+              default: '1'
+              description: Number of selected nodes to live apply compute upgrade.
+            STAGE_CONTROLLERS_ROLLBACK:
+              type: boolean
+              default: 'false'
+              description: "Run rollback on Opencontrail controllers"
+            STAGE_COMPUTES_ROLLBACK:
+              type: boolean
+              default: 'false'
+              description: "Run rollback on Opencontrail compute nodes"
diff --git a/jenkins/client/job/deploy/update/upgrade_ovs_gateway.yml b/jenkins/client/job/deploy/update/upgrade_ovs_gateway.yml
index 3d12796..335492d 100644
--- a/jenkins/client/job/deploy/update/upgrade_ovs_gateway.yml
+++ b/jenkins/client/job/deploy/update/upgrade_ovs_gateway.yml
@@ -14,6 +14,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: ovs-gateway-upgrade.groovy
           param:
diff --git a/jenkins/client/job/deploy/update/utils.yml b/jenkins/client/job/deploy/update/utils.yml
index fa6ce14..1a6062e 100644
--- a/jenkins/client/job/deploy/update/utils.yml
+++ b/jenkins/client/job/deploy/update/utils.yml
@@ -9,6 +9,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: update-reclass-metadata.groovy
           param:
@@ -31,6 +32,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: update-salt-master-formulas.groovy
           param:
@@ -53,6 +55,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: update-jenkins-master-jobs.groovy
           param:
diff --git a/jenkins/client/job/docker/build-images.yml b/jenkins/client/job/docker/build-images.yml
index a953d95..334db19 100644
--- a/jenkins/client/job/docker/build-images.yml
+++ b/jenkins/client/job/docker/build-images.yml
@@ -7,12 +7,13 @@
           jobs:
             - name: aptly
               repo: mk
+              build_trigger: ""
             - name: ci
               repo: mk
+              build_trigger: "H H(20-23) * * *"
             - name: prometheus
               repo: mcp
-            - name: opencontrail
-              repo: mk
+              build_trigger: ""
           template:
             discard:
               build:
@@ -34,6 +35,8 @@
                 event:
                   ref:
                     - updated: {}
+              pollscm:
+                spec: "{{build_trigger}}"
             param:
               IMAGE_GIT_URL:
                 type: string
diff --git a/jenkins/client/job/docker/cleanup.yml b/jenkins/client/job/docker/cleanup.yml
index eff5754..e1bdcd1 100644
--- a/jenkins/client/job/docker/cleanup.yml
+++ b/jenkins/client/job/docker/cleanup.yml
@@ -17,6 +17,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: docker-cleanup-pipeline.groovy
           trigger:
diff --git a/jenkins/client/job/docker/init.yml b/jenkins/client/job/docker/init.yml
index 63c3f27..d4c15b6 100644
--- a/jenkins/client/job/docker/init.yml
+++ b/jenkins/client/job/docker/init.yml
@@ -16,7 +16,11 @@
               dockerfile: "Dockerfile"
             - name: gerrit
               branch: "2.13.6"
-              tags: "2.13.6 latest"
+              tags: "2.13.6"
+              dockerfile: "Dockerfile"
+            - name: gerrit
+              branch: "2.14.6"
+              tags: "2.14.6 latest"
               dockerfile: "Dockerfile"
             - name: jenkins
               branch: "master"
@@ -28,7 +32,7 @@
               dockerfile: "Dockerfile"
             - name: jenkins
               branch: "2.73"
-              tags: "2.73 latest"
+              tags: "2.73"
               dockerfile: "Dockerfile"
             - name: phpldapadmin
               branch: "master"
@@ -57,6 +61,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: docker-build-image-pipeline.groovy
             trigger:
diff --git a/jenkins/client/job/docker/opencontrail.yml b/jenkins/client/job/docker/opencontrail.yml
new file mode 100644
index 0000000..b5052de
--- /dev/null
+++ b/jenkins/client/job/docker/opencontrail.yml
@@ -0,0 +1,55 @@
+parameters:
+  jenkins:
+    client:
+      job_template:
+        docker-build-images-opencontrail:
+          name: "docker-build-images-opencontrail-{{version}}"
+          jobs:
+            - version: oc40
+            - version: oc41
+          template:
+            discard:
+              build:
+                keep_num: 25
+              artifact:
+                keep_num: 25
+            type: workflow-scm
+            concurrent: true
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/mk/docker-opencontrail"
+              credentials: "gerrit"
+            trigger:
+              gerrit:
+                project:
+                  "mk/docker-opencontrail":
+                    branches:
+                      - master
+                event:
+                  ref:
+                    - updated: {}
+                  comment:
+                    - addedContains:
+                        commentAddedCommentContains: '(buildcontainer|test|recheck|verify|)'
+              reverse:
+                projects:
+                  - build-opencontrail-{{version}}-ubuntu-xenial
+            param:
+              IMAGE_GIT_URL:
+                type: string
+                default: "${_param:jenkins_gerrit_url}/mk/docker-opencontrail"
+              OC_VERSION:
+                type: string
+                default: "{{version}}"
+              IMAGE_CREDENTIALS_ID:
+                type: string
+                default: "gerrit"
+              APT_KEY:
+                type: string
+                default: "${_param:jenkins_aptly_url}/public.gpg"
+              APT_REPO_URL:
+                type: string
+                default: "${_param:jenkins_aptly_url}/xenial/ nightly"
+              REGISTRY_CREDENTIALS_ID:
+                type: string
+                default: "dockerhub"
diff --git a/jenkins/client/job/docker/oss/cis-collectors.yml b/jenkins/client/job/docker/oss/cis-collectors.yml
index 11d8be9..05620cf 100644
--- a/jenkins/client/job/docker/oss/cis-collectors.yml
+++ b/jenkins/client/job/docker/oss/cis-collectors.yml
@@ -22,11 +22,6 @@
                 "oss/cis-collectors":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/devops-portal.yml b/jenkins/client/job/docker/oss/devops-portal.yml
index 3b831d8..9c3025f 100644
--- a/jenkins/client/job/docker/oss/devops-portal.yml
+++ b/jenkins/client/job/docker/oss/devops-portal.yml
@@ -22,11 +22,6 @@
                 "oss/devops-portal":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/hce-codebase.yml b/jenkins/client/job/docker/oss/hce-codebase.yml
new file mode 100644
index 0000000..747ed77
--- /dev/null
+++ b/jenkins/client/job/docker/oss/hce-codebase.yml
@@ -0,0 +1,68 @@
+parameters:
+  jenkins:
+    client:
+      job:
+        docker-build-images-hce-codebase:
+          name: docker-build-images-hce-codebase
+          discard:
+            build:
+              keep_num: 25
+            artifact:
+              keep_num: 25
+          type: workflow-scm
+          concurrent: true
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/oss/jenkins/pipelines"
+            credentials: "gerrit"
+            script: docker-build-image-pipeline.groovy
+          trigger:
+            gerrit:
+              project:
+                "oss/hce":
+                  branches:
+                    - master
+              event:
+                patchset:
+                  - created:
+                      excludeDrafts: false
+                      excludeNoCodeChange: false
+                change:
+                  - merged
+                comment:
+                  - addedContains:
+                      commentAddedCommentContains: 'rebuild'
+          param:
+            IMAGE_NAME:
+              type: string
+              default: "hce"
+            IMAGE_TAGS:
+              type: string
+              default: ""
+            CREDENTIALS_ID:
+              type: string
+              default: "gerrit"
+            DOCKER_REGISTRY:
+              type: string
+              default: "docker-dev-virtual.docker.mirantis.net"
+            PROJECT_NAMESPACE:
+              type: string
+              default: "oss"
+            DOCKERFILE_PATH:
+              type: string
+              default: "Dockerfile"
+            CONTEXT_PATH:
+              type: string
+              default: "."
+            CUSTOM_GERRIT_PROJECT:
+              type: string
+              default: oss/docker-hce
+            CUSTOM_GERRIT_BRANCH:
+              type: string
+              default: master
+            CI_BUILD_ARG_HCE_REPO:
+              type: string
+              default: ""
+            CI_BUILD_ARG_HCE_REF:
+              type: string
+              default: ""
diff --git a/jenkins/client/job/docker/oss/hce-docker.yml b/jenkins/client/job/docker/oss/hce-docker.yml
new file mode 100644
index 0000000..c7c4a7b
--- /dev/null
+++ b/jenkins/client/job/docker/oss/hce-docker.yml
@@ -0,0 +1,56 @@
+parameters:
+  jenkins:
+    client:
+      job:
+        docker-build-images-hce-docker:
+          name: docker-build-images-hce-docker
+          discard:
+            build:
+              keep_num: 25
+            artifact:
+              keep_num: 25
+          type: workflow-scm
+          concurrent: true
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/oss/jenkins/pipelines"
+            credentials: "gerrit"
+            script: docker-build-image-pipeline.groovy
+          trigger:
+            gerrit:
+              project:
+                "oss/docker-hce":
+                  branches:
+                    - master
+              event:
+                patchset:
+                  - created:
+                      excludeDrafts: false
+                      excludeNoCodeChange: false
+                change:
+                  - merged
+                comment:
+                  - addedContains:
+                      commentAddedCommentContains: 'rebuild'
+          param:
+            IMAGE_NAME:
+              type: string
+              default: "hce"
+            IMAGE_TAGS:
+              type: string
+              default: ""
+            CREDENTIALS_ID:
+              type: string
+              default: "gerrit"
+            DOCKER_REGISTRY:
+              type: string
+              default: "docker-dev-virtual.docker.mirantis.net"
+            PROJECT_NAMESPACE:
+              type: string
+              default: "oss"
+            DOCKERFILE_PATH:
+              type: string
+              default: "Dockerfile"
+            CONTEXT_PATH:
+              type: string
+              default: "."
diff --git a/jenkins/client/job/docker/oss/init.yml b/jenkins/client/job/docker/oss/init.yml
index 386ea75..94e138c 100644
--- a/jenkins/client/job/docker/oss/init.yml
+++ b/jenkins/client/job/docker/oss/init.yml
@@ -1,11 +1,14 @@
 classes:
   - system.jenkins.client.job.docker.oss.cis-collectors
   - system.jenkins.client.job.docker.oss.devops-portal
+  - system.jenkins.client.job.docker.oss.hce-codebase
+  - system.jenkins.client.job.docker.oss.hce-docker
   - system.jenkins.client.job.docker.oss.janitor-monkey-codebase
   - system.jenkins.client.job.docker.oss.janitor-monkey-docker
-  - system.jenkins.client.job.docker.oss.pushkin-docker
   - system.jenkins.client.job.docker.oss.pushkin-codebase
   - system.jenkins.client.job.docker.oss.pushkin-codebase-ext
+  - system.jenkins.client.job.docker.oss.pushkin-docker
   - system.jenkins.client.job.docker.oss.rundeck
-  - system.jenkins.client.job.docker.oss.security-monkey-docker
+  - system.jenkins.client.job.docker.oss.security-monkey-codebase
   - system.jenkins.client.job.docker.oss.security-monkey-codebase-openstack
+  - system.jenkins.client.job.docker.oss.security-monkey-docker
diff --git a/jenkins/client/job/docker/oss/janitor-monkey-codebase.yml b/jenkins/client/job/docker/oss/janitor-monkey-codebase.yml
index 95a45f1..d10993e 100644
--- a/jenkins/client/job/docker/oss/janitor-monkey-codebase.yml
+++ b/jenkins/client/job/docker/oss/janitor-monkey-codebase.yml
@@ -22,11 +22,6 @@
                 "oss/SimianArmy":
                   branches:
                     - devel
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/janitor-monkey-docker.yml b/jenkins/client/job/docker/oss/janitor-monkey-docker.yml
index 78167bd..672e13e 100644
--- a/jenkins/client/job/docker/oss/janitor-monkey-docker.yml
+++ b/jenkins/client/job/docker/oss/janitor-monkey-docker.yml
@@ -22,11 +22,6 @@
                 "oss/docker-janitor-monkey":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
@@ -58,4 +53,4 @@
               default: "Dockerfile"
             CONTEXT_PATH:
               type: string
-              default: "."
\ No newline at end of file
+              default: "."
diff --git a/jenkins/client/job/docker/oss/pushkin-codebase-ext.yml b/jenkins/client/job/docker/oss/pushkin-codebase-ext.yml
index 1a5b5b6..0508d49 100644
--- a/jenkins/client/job/docker/oss/pushkin-codebase-ext.yml
+++ b/jenkins/client/job/docker/oss/pushkin-codebase-ext.yml
@@ -22,11 +22,6 @@
                 "oss/pushkin-extensions":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/pushkin-codebase.yml b/jenkins/client/job/docker/oss/pushkin-codebase.yml
index f40bde3..a45ea75 100644
--- a/jenkins/client/job/docker/oss/pushkin-codebase.yml
+++ b/jenkins/client/job/docker/oss/pushkin-codebase.yml
@@ -22,11 +22,6 @@
                 "oss/pushkin":
                   branches:
                     - devel
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/pushkin-docker.yml b/jenkins/client/job/docker/oss/pushkin-docker.yml
index e77e99b..61d959c 100644
--- a/jenkins/client/job/docker/oss/pushkin-docker.yml
+++ b/jenkins/client/job/docker/oss/pushkin-docker.yml
@@ -22,11 +22,6 @@
                 "oss/docker-pushkin":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
@@ -58,4 +53,4 @@
               default: "Dockerfile"
             CONTEXT_PATH:
               type: string
-              default: "."
\ No newline at end of file
+              default: "."
diff --git a/jenkins/client/job/docker/oss/rundeck.yml b/jenkins/client/job/docker/oss/rundeck.yml
index 9b116fe..adbe9f4 100644
--- a/jenkins/client/job/docker/oss/rundeck.yml
+++ b/jenkins/client/job/docker/oss/rundeck.yml
@@ -22,11 +22,6 @@
                 "oss/docker-rundeck":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/security-monkey-codebase-openstack.yml b/jenkins/client/job/docker/oss/security-monkey-codebase-openstack.yml
index a135df8..0e5a9d4 100644
--- a/jenkins/client/job/docker/oss/security-monkey-codebase-openstack.yml
+++ b/jenkins/client/job/docker/oss/security-monkey-codebase-openstack.yml
@@ -3,7 +3,7 @@
     client:
       job:
         docker-build-images-security-monkey-codebase-openstack:
-          name: docker-build-images-security-monkey-codebase-openstack 
+          name: docker-build-images-security-monkey-codebase-openstack
           discard:
             build:
               keep_num: 25
@@ -22,11 +22,6 @@
                 "oss/security-monkey-openstack":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/security-monkey-codebase.yml b/jenkins/client/job/docker/oss/security-monkey-codebase.yml
new file mode 100644
index 0000000..93a79e6
--- /dev/null
+++ b/jenkins/client/job/docker/oss/security-monkey-codebase.yml
@@ -0,0 +1,73 @@
+parameters:
+  jenkins:
+    client:
+      job:
+        docker-build-images-security-monkey-codebase:
+          name: docker-build-images-security-monkey-codebase
+          discard:
+            build:
+              keep_num: 25
+            artifact:
+              keep_num: 25
+          type: workflow-scm
+          concurrent: true
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/oss/jenkins/pipelines"
+            credentials: "gerrit"
+            script: docker-build-image-security-monkey-pipeline.groovy
+          trigger:
+            gerrit:
+              project:
+                "oss/security-monkey":
+                  branches:
+                    - mirantis_0_9_2
+              skip_vote:
+                - successful
+                - failed
+                - unstable
+                - not_built
+              event:
+                patchset:
+                  - created:
+                      excludeDrafts: false
+                      excludeNoCodeChange: false
+                change:
+                  - merged
+                comment:
+                  - addedContains:
+                      commentAddedCommentContains: 'rebuild'
+          param:
+            IMAGE_NAME:
+              type: string
+              default: "security-monkey"
+            IMAGE_TAGS:
+              type: string
+              default: ""
+            CREDENTIALS_ID:
+              type: string
+              default: "gerrit"
+            DOCKER_REGISTRY:
+              type: string
+              default: "docker-dev-virtual.docker.mirantis.net"
+            PROJECT_NAMESPACE:
+              type: string
+              default: "oss"
+            DOCKERFILE_PATH:
+              type: string
+              default: "security-monkey/Dockerfile"
+            CONTEXT_PATH:
+              type: string
+              default: "."
+            CUSTOM_GERRIT_PROJECT:
+              type: string
+              default: oss/docker-security-monkey
+            CUSTOM_GERRIT_BRANCH:
+              type: string
+              default: master
+            CI_BUILD_ARG_SECURITY_MONKEY_REPO:
+              type: string
+              default: https://gerrit.mcp.mirantis.net/oss/security-monkey
+            CI_BUILD_ARG_SECURITY_MONKEY_BRANCH:
+              type: string
+              default: mirantis_0_9_2
diff --git a/jenkins/client/job/docker/oss/security-monkey-docker.yml b/jenkins/client/job/docker/oss/security-monkey-docker.yml
index b9d4512..613f789 100644
--- a/jenkins/client/job/docker/oss/security-monkey-docker.yml
+++ b/jenkins/client/job/docker/oss/security-monkey-docker.yml
@@ -22,11 +22,6 @@
                 "oss/docker-security-monkey":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
@@ -58,4 +53,4 @@
               default: "security-monkey/Dockerfile"
             CONTEXT_PATH:
               type: string
-              default: "."
\ No newline at end of file
+              default: "."
diff --git a/jenkins/client/job/docker/testing.yml b/jenkins/client/job/docker/testing.yml
index bf65dbc..ece8e10 100644
--- a/jenkins/client/job/docker/testing.yml
+++ b/jenkins/client/job/docker/testing.yml
@@ -23,6 +23,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: docker-build-image-pipeline.groovy
             trigger:
diff --git a/jenkins/client/job/gating.yml b/jenkins/client/job/gating.yml
index db2033e..f9e9b1a 100644
--- a/jenkins/client/job/gating.yml
+++ b/jenkins/client/job/gating.yml
@@ -33,6 +33,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: gating-pipeline.groovy
             quiet_period: 60
diff --git a/jenkins/client/job/git-mirrors/2way.yml b/jenkins/client/job/git-mirrors/2way.yml
new file mode 100644
index 0000000..3b1a62f
--- /dev/null
+++ b/jenkins/client/job/git-mirrors/2way.yml
@@ -0,0 +1,55 @@
+parameters:
+  _param:
+    jenkins_pollscm_spec: "H/60 * * * *"
+  jenkins:
+    client:
+      job_template:
+        git-mirror-2way-common:
+          name: git-mirror-2way-{{name}}
+          jobs:
+            - name: mcp-common-scripts
+              source: mcp/mcp-common-scripts
+              target: Mirantis/mcp-common-scripts
+              branches: "master"
+          template:
+            discard:
+              build:
+                keep_num: 10
+              artifact:
+                keep_num: 10
+            type: workflow-scm
+            concurrent: false
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
+              credentials: "gerrit"
+              script: git-mirror-2way-pipeline.groovy
+              github:
+                url: "https://github.com/{{target}}"
+            trigger:
+              github:
+              pollscm:
+                spec: ${_param:jenkins_pollscm_spec}
+              gerrit:
+                project:
+                  "{{source}}":
+                    branches:
+                      - master
+                event:
+                  ref:
+                    - updated
+            param:
+              SOURCE_URL:
+                type: string
+                default: "${_param:jenkins_gerrit_url}/{{source}}.git"
+              TARGET_URL:
+                type: string
+                default: "git@github.com:{{target}}.git"
+              CREDENTIALS_ID:
+                type: string
+                default: "gerrit"
+              BRANCHES:
+                type: string
+                default: "{{branches}}"
+                description: "Comma-separated list of branches to mirror"
diff --git a/jenkins/client/job/git-mirrors/downstream/init.yml b/jenkins/client/job/git-mirrors/downstream/init.yml
index 0ddc0ce..6f5a66d 100644
--- a/jenkins/client/job/git-mirrors/downstream/init.yml
+++ b/jenkins/client/job/git-mirrors/downstream/init.yml
@@ -19,6 +19,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: git-mirror-pipeline.groovy
             trigger:
@@ -37,3 +38,4 @@
               BRANCHES:
                 type: string
                 default: "{{branches}}"
+                description: "Comma-separated list of branches to mirror"
diff --git a/jenkins/client/job/git-mirrors/upstream/init.yml b/jenkins/client/job/git-mirrors/upstream/init.yml
index cc267d9..1707dca 100644
--- a/jenkins/client/job/git-mirrors/upstream/init.yml
+++ b/jenkins/client/job/git-mirrors/upstream/init.yml
@@ -18,6 +18,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: git-mirror-pipeline.groovy
             trigger:
@@ -47,3 +48,4 @@
               BRANCHES:
                 type: string
                 default: "{{branches}}"
+                description: "Comma-separated list of branches to mirror"
diff --git a/jenkins/client/job/git-mirrors/upstream/oss.yml b/jenkins/client/job/git-mirrors/upstream/oss.yml
index af3f816..57ce1a2 100644
--- a/jenkins/client/job/git-mirrors/upstream/oss.yml
+++ b/jenkins/client/job/git-mirrors/upstream/oss.yml
@@ -7,3 +7,7 @@
         downstream: oss/rundeck-cis-jobs
         upstream: "git@github.com:Mirantis/rundeck-cis-jobs"
         branches: master
+      - name: security-monkey
+        downstream: oss/security-monkey
+        upstream: "git@github.com:Netflix/security_monkey.git"
+        branches: develop
diff --git a/jenkins/client/job/k8s-test/mcp-k8s-test-pipeline.yml b/jenkins/client/job/k8s-test/mcp-k8s-test-pipeline.yml
index 8490ee7..36e1dc0 100644
--- a/jenkins/client/job/k8s-test/mcp-k8s-test-pipeline.yml
+++ b/jenkins/client/job/k8s-test/mcp-k8s-test-pipeline.yml
@@ -8,7 +8,7 @@
           display_name: "Kubernetes tests pipeline"
           discard:
             build:
-              keep_num: 20
+              keep_num: 50
           concurrent: false
           scm:
             type: git
diff --git a/jenkins/client/job/kill_stuck_jobs.yml b/jenkins/client/job/kill_stuck_jobs.yml
index 57f0b3f..cc69c6b 100644
--- a/jenkins/client/job/kill_stuck_jobs.yml
+++ b/jenkins/client/job/kill_stuck_jobs.yml
@@ -14,6 +14,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: abort-long-running-jobs.groovy
           trigger:
diff --git a/jenkins/client/job/opencontrail/build/dpdk-extra.yml b/jenkins/client/job/opencontrail/build/dpdk-extra.yml
index 0a152f1..2d4e4d8 100644
--- a/jenkins/client/job/opencontrail/build/dpdk-extra.yml
+++ b/jenkins/client/job/opencontrail/build/dpdk-extra.yml
@@ -54,6 +54,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: build-extra-dpdk-pipeline.groovy
             quiet_period: 120
diff --git a/jenkins/client/job/opencontrail/build/generic.yml b/jenkins/client/job/opencontrail/build/generic.yml
index 699222e..d9be124 100644
--- a/jenkins/client/job/opencontrail/build/generic.yml
+++ b/jenkins/client/job/opencontrail/build/generic.yml
@@ -53,7 +53,7 @@
               branch: R3.2
               ppa: mirantis-opencontrail/opencontrail-3.2
               upload_source_package: true
-              dpdk: contrail_dpdk_2_1
+              dpdk: contrail_dpdk_17_02
               build_trigger: ""
             - buildname: oc32
               os: ubuntu
@@ -61,7 +61,7 @@
               branch: R3.2
               ppa: mirantis-opencontrail/opencontrail-3.2
               upload_source_package: true
-              dpdk: contrail_dpdk_2_1
+              dpdk: contrail_dpdk_17_02
               build_trigger: ""
             - buildname: oc323
               os: ubuntu
diff --git a/jenkins/client/job/opencontrail/git-mirrors/2way.yml b/jenkins/client/job/opencontrail/git-mirrors/2way.yml
index 349dad5..49ae2be 100644
--- a/jenkins/client/job/opencontrail/git-mirrors/2way.yml
+++ b/jenkins/client/job/opencontrail/git-mirrors/2way.yml
@@ -7,46 +7,8 @@
         git-mirror-2way:
           name: git-mirror-2way-{{name}}
           jobs:
-            - name: contrail-build
-              branches: ${_param:contrail_branches}
             - name: contrail-pipeline
-              branches: ${_param:contrail_branches}
-            - name: contrail-controller
-              branches: ${_param:contrail_branches}
-            - name: contrail-vrouter
-              branches: ${_param:contrail_branches}
-            - name: contrail-third-party
-              branches: ${_param:contrail_branches}
-            - name: contrail-generateDS
-              branches: ${_param:contrail_branches}
-            - name: contrail-sandesh
-              branches: ${_param:contrail_branches}
-            - name: contrail-packages
-              branches: ${_param:contrail_branches}
-            - name: contrail-nova-vif-driver
-              branches: ${_param:contrail_branches}
-            - name: contrail-neutron-plugin
-              branches: ${_param:contrail_branches}
-            - name: contrail-nova-extensions
-              branches: ${_param:contrail_branches}
-            - name: contrail-ceilometer-plugin
-              branches: ${_param:contrail_ceilometer_plugin_branches}
-            - name: contrail-heat
-              branches: ${_param:contrail_branches}
-            - name: contrail-web-storage
-              branches: ${_param:contrail_branches}
-            - name: contrail-web-server-manager
-              branches: ${_param:contrail_branches}
-            - name: contrail-web-controller
-              branches: ${_param:contrail_branches}
-            - name: contrail-web-core
-              branches: ${_param:contrail_branches}
-            - name: contrail-webui-third-party
-              branches: ${_param:contrail_branches}
-            - name: contrail-dpdk-extra-packages
-              branches: ${_param:contrail_dpdk_extra_branches}
-            - name: contrail-dpdk
-              branches: ${_param:contrail_dpdk_branches}
+              branches: master
           template:
             discard:
               build:
@@ -58,6 +20,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: git-mirror-2way-pipeline.groovy
               github:
@@ -72,7 +35,7 @@
                 default: "${_param:jenkins_gerrit_url}/contrail/{{name}}.git"
               TARGET_URL:
                 type: string
-                default: "https://github.com/Mirantis/{{name}}.git"
+                default: "git@github.com:Mirantis/{{name}}.git"
               CREDENTIALS_ID:
                 type: string
                 default: "gerrit"
diff --git a/jenkins/client/job/opencontrail/git-mirrors/downstream.yml b/jenkins/client/job/opencontrail/git-mirrors/downstream.yml
index 45b06b6..f92d1a7 100644
--- a/jenkins/client/job/opencontrail/git-mirrors/downstream.yml
+++ b/jenkins/client/job/opencontrail/git-mirrors/downstream.yml
@@ -58,6 +58,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: git-mirror-pipeline.groovy
               github:
@@ -91,6 +92,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: git-mirror-pipeline.groovy
             github:
diff --git a/jenkins/client/job/opencontrail/git-mirrors/upstream.yml b/jenkins/client/job/opencontrail/git-mirrors/upstream.yml
index fa9bc5b..af4c6ac 100644
--- a/jenkins/client/job/opencontrail/git-mirrors/upstream.yml
+++ b/jenkins/client/job/opencontrail/git-mirrors/upstream.yml
@@ -57,6 +57,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: git-mirror-pipeline.groovy
               github:
@@ -100,6 +101,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: git-mirror-pipeline.groovy
             github:
@@ -130,6 +132,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: git-mirror-pipeline.groovy
             github:
@@ -171,6 +174,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: git-mirror-pipeline.groovy
             github:
diff --git a/jenkins/client/job/oscore/init.yml b/jenkins/client/job/oscore/init.yml
index fc06d59..18dd008 100644
--- a/jenkins/client/job/oscore/init.yml
+++ b/jenkins/client/job/oscore/init.yml
@@ -1,4 +1,5 @@
 classes:
+  - system.jenkins.client.job.oscore.security_tests
   - system.jenkins.client.job.oscore.tests
   - system.jenkins.client.job.oscore.qa
 parameters:
diff --git a/jenkins/client/job/oscore/qa.yml b/jenkins/client/job/oscore/qa.yml
index 908df5a..a8d4fae 100644
--- a/jenkins/client/job/oscore/qa.yml
+++ b/jenkins/client/job/oscore/qa.yml
@@ -1,7 +1,7 @@
 parameters:
   jenkins:
     client:
-      job:
+      job_template:
         oscore-build-docker-image:
           name: "{{job_prefix}}-{{oscore-qa-project}}-build-docker-image"
           template:
@@ -46,3 +46,141 @@
               DOCKER_REGISTRY:
                 type: string
                 default: "docker-prod-local.docker.mirantis.net"
+        oscore-docker-image-systest-template:
+          name: "{{job_prefix}}-{{oscore-qa-project}}-image-systest-{{model}}"
+          template:
+            discard:
+              build:
+                keep_num: 30
+              artifact:
+                keep_num: 30
+            type: workflow-scm
+            concurrent: true
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/openstack-ci/openstack-pipelines.git"
+              credentials: "gerrit"
+              branch: 'master'
+              script: test-tempest-image-pipeline.groovy
+            trigger:
+              gerrit:
+                project:
+                  mcp/{{oscore-qa-project}}:
+                    branches:
+                      - compare_type: "PLAIN"
+                        name: "master"
+                skip_vote:
+                  - successful
+                  - failed
+                  - unstable
+                  - not_built
+                event:
+                  patchset:
+                    - created
+                  comment:
+                    - addedContains:
+                        commentAddedCommentContains: '^(?s:Patch Set \d+:.*(test|recheck|reverify)\s*)$'
+                custom_url: '* $JOB_NAME $BUILD_URL'
+            param:
+              # general
+              BOOTSTRAP_EXTRA_REPO_PARAMS:
+                type: string
+                description: Extra repos for bootstrap stage
+                default: ""
+              CREDENTIALS_ID:
+                type: string
+                description: gerrit creds
+                default: "gerrit"
+              GERRIT_PROJECT_URL:
+                type: string
+                description: Url to project with docker image source
+                default: ""
+              GERRIT_BRANCH:
+                type: string
+                description: Branch of project with docker image source
+                default: ""
+              HEAT_STACK_ZONE:
+                type: string
+                description: AZ
+                default: "mcp-oscore-ci"
+              STACK_TEST_JOB:
+                type: string
+                description: Job for environment deployment
+                default: "{{stack_test_job}}"
+              STACK_TYPE:
+                type: string
+                default: "heat"
+              STACK_INSTALL:
+                type: string
+                description: components to install
+                default: 'core,openstack,ovs'
+              STACK_DELETE:
+                type: boolean
+                default: 'true'
+                description: Don't enable it if you need to use the lab after
+              STACK_RECLASS_ADDRESS:
+                type: string
+                default: '{{stack_reclass_address}}'
+                description: 'Url to repository with stack salt models'
+              STACK_RECLASS_BRANCH:
+                type: string
+                default: '{{stack_reclass_branch}}'
+                description: 'Branch of repository with stack salt models'
+              STACK_CLEANUP_JOB:
+                type: string
+                default: "{{stack_cleanup_job}}"
+              # salt
+              FORMULA_PKG_REVISION:
+                type: string
+                description: Version of formulas for salt-master bootstrap
+                default: "{{formula_pkg_revision}}"
+              UPLOAD_CREDENTIALS_ID:
+                type: string
+                description: ID of credentials to connect to target host
+                default: "heat-env-ssh"
+              # openstack api
+              OPENSTACK_API_URL:
+                type: string
+                default: "https://cloud-cz.bud.mirantis.net:5000"
+              OPENSTACK_API_CREDENTIALS:
+                type: string
+                default: "openstack-devcloud-credentials"
+              OPENSTACK_API_PROJECT:
+                type: string
+                default: "mcp-oscore-ci"
+              OPENSTACK_API_PROJECT_DOMAIN:
+                type: string
+                default: "default"
+              OPENSTACK_API_PROJECT_ID:
+                type: string
+                default: ""
+              OPENSTACK_API_USER_DOMAIN:
+                type: string
+                default: "default"
+              OPENSTACK_API_CLIENT:
+                type: string
+                default: ""
+              OPENSTACK_API_VERSION:
+                type: string
+                default: "3"
+              # test
+              TEST_TEMPEST_CONF:
+                type: string
+                description: Tempest configuration file path inside container
+                default: "{{tempest_conf}}"
+              TEST_TEMPEST_TARGET:
+                type: string
+                description: Node to run tests
+                default: "{{tempest_target}}"
+              TEST_MODEL:
+                type: string
+                description: Environment salt model
+                default: "{{model}}"
+              FAIL_ON_TESTS:
+                type: boolean
+                default: 'true'
+                description: Whether to fail build on test results
+              SALT_MASTER_IP:
+                type: string
+                description: Ip of env's salt master
+                default: ""
diff --git a/jenkins/client/job/oscore/security_tests.yml b/jenkins/client/job/oscore/security_tests.yml
new file mode 100644
index 0000000..36b5441
--- /dev/null
+++ b/jenkins/client/job/oscore/security_tests.yml
@@ -0,0 +1,157 @@
+parameters:
+  jenkins:
+    client:
+      job_template:
+        bandit-scanner-template-downstream:
+          name: "{{job_prefix}}-bandit-downstream-{{project}}"
+          template:
+            discard:
+              build:
+                keep_num: 30
+              artifact:
+                keep_num: 30
+            type: workflow-scm
+            # Downstream jobs are uploading reports, so shouldn't be concurrent
+            concurrent: false
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/openstack-ci/openstack-pipelines.git"
+              credentials: "gerrit"
+              branch: 'master'
+              script: bandit-openstack-pipeline.groovy
+            trigger:
+              gerrit:
+                project:
+                  packaging/sources/{{project}}:
+                    branches:
+                      - compare_type: "ANT"
+                        name: "mcp/**"
+                skip_vote:
+                  - successful
+                  - failed
+                  - unstable
+                  - not_built
+                event:
+                  change:
+                    - merged
+                  comment:
+                    - addedContains:
+                        commentAddedCommentContains: '^(?s:Patch Set \d+:.*(run bandit)\s*)$'
+                custom_url: '* $JOB_NAME $BUILD_URL'
+            param:
+              GERRIT_PROJECT_URL:
+                type: string
+                description: project url
+                default: ""
+              GERRIT_BRANCH:
+                type: string
+                description: Version of openstack to test
+                default: ""
+              GERRIT_USER:
+                type: string
+                description: user
+                default: "mcp-jenkins"
+              UPSTREAM:
+                type: boolean
+                description: whether to do upstream like testing
+                default: "false"
+              FAIL_ON_TESTS:
+                type: boolean
+                description: whether to do upstream like testing
+                default: "true"
+              SEVERITY:
+                type: string
+                description: Bandit args
+                default: "1"
+              CONFIDENCE:
+                type: string
+                description: confidence
+                default: "2"
+              CREDENTIALS_ID:
+                type: string
+                description: gerrit creds
+                default: "gerrit"
+              REPORT_FORMAT:
+                type: string
+                description: Format for generated report(csv,html,json)
+                default: "json"
+              UPLOAD_REPORT:
+                type: boolean
+                description: Whether to upload report
+                default: "true"
+              REPORT_HOST:
+                type: string
+                description: Reporting tool hostname
+                default: "cve-slave01-bud.infra.mirantis.net"
+              REPORT_USER:
+                type: string
+                description: User for uploading results to reporting tool
+                default: "bandit"
+              UPLOAD_CREDENTIALS_ID:
+                type: string
+                description: Credentials for uploading report
+                default: "bandit"
+        bandit-scanner-template-upstream:
+          name: "{{job_prefix}}-bandit-upstream-{{project}}"
+          template:
+            discard:
+              build:
+                keep_num: 30
+              artifact:
+                keep_num: 30
+            type: workflow-scm
+            concurrent: true
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/openstack-ci/openstack-pipelines.git"
+              credentials: "gerrit"
+              branch: 'master'
+              script: bandit-openstack-pipeline.groovy
+            trigger:
+              gerrit:
+                project:
+                  packaging/sources/{{project}}:
+                    branches:
+                      - compare_type: "ANT"
+                        name: "mcp/**"
+                skip_vote:
+                  - successful
+                  - failed
+                  - unstable
+                  - not_built
+                event:
+                  change:
+                    - merged
+                  comment:
+                    - addedContains:
+                        commentAddedCommentContains: '^(?s:Patch Set \d+:.*(run bandit)\s*)$'
+                custom_url: '* $JOB_NAME $BUILD_URL'
+            param:
+              GERRIT_PROJECT_URL:
+                type: string
+                description: project url
+                default: ""
+              GERRIT_BRANCH:
+                type: string
+                description: Version of openstack to test
+                default: ""
+              GERRIT_USER:
+                type: string
+                description: user
+                default: "mcp-jenkins"
+              UPSTREAM:
+                type: boolean
+                description: whether to do upstream like testing
+                default: "true"
+              FAIL_ON_TESTS:
+                type: boolean
+                description: whether to do upstream like testing
+                default: "true"
+              CREDENTIALS_ID:
+                type: string
+                description: gerrit creds
+                default: "gerrit"
+              REPORT_FORMAT:
+                type: string
+                description: Format for generated report(csv,html,json)
+                default: "json"
diff --git a/jenkins/client/job/oscore/tests.yml b/jenkins/client/job/oscore/tests.yml
index 4844708..fdb7401 100644
--- a/jenkins/client/job/oscore/tests.yml
+++ b/jenkins/client/job/oscore/tests.yml
@@ -2,6 +2,135 @@
   jenkins:
     client:
       job_template:
+        test-openstack-component-formula:
+          name: "{{job_prefix}}-formula-systest-{{model}}-{{openstack_version}}"
+          template:
+            discard:
+              build:
+                keep_num: 30
+              artifact:
+                keep_num: 30
+            type: workflow-scm
+            concurrent: true
+            plugin_properties:
+              throttleconcurrents:
+                enabled: true
+                throttle_option: category
+                categories:
+                  - oscore-ci-builds
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/openstack-ci/openstack-pipelines.git"
+              credentials: "gerrit"
+              branch: 'master'
+              script: test-openstack-component-pipeline.groovy
+            param:
+              # general
+              HEAT_STACK_ZONE:
+                type: string
+                description: AZ
+                default: "mcp-oscore-ci"
+              OPENSTACK_VERSION:
+                type: string
+                description: Version of openstack to test
+                default: "{{openstack_version}}"
+              PROJECT:
+                type: string
+                description: Project to test
+                default: "all"
+              STACK_TEST_JOB:
+                type: string
+                description: Job for environment deployment
+                default: "{{stack_test_job}}"
+              STACK_TYPE:
+                type: string
+                default: "{{stack_type}}"
+              STACK_INSTALL:
+                type: string
+                description: components to install
+                default: 'core,openstack,ovs'
+              STACK_DELETE:
+                type: boolean
+                default: 'true'
+                description: Don't enable it if you need to use the lab after
+              STACK_CLEANUP_JOB:
+                type: string
+                default: "{{stack_cleanup_job}}"
+              STACK_RECLASS_ADDRESS:
+                type: string
+                default: '{{stack_reclass_address}}'
+                description: 'Url to repository with stack salt models'
+              STACK_RECLASS_BRANCH:
+                type: string
+                default: '{{stack_reclass_branch}}'
+                description: 'Branch of repository with stack salt models'
+              # salt
+              SALT_OVERRIDES:
+                type: text
+                default: ""
+                description: YAML with overrides for Salt deployment
+              FORMULA_PKG_REVISION:
+                type: string
+                description: Version of formulas for salt-master bootstrap
+                default: "{{formula_pkg_revision}}"
+              # openstack api
+              OPENSTACK_API_URL:
+                type: string
+                default: "https://cloud-cz.bud.mirantis.net:5000"
+              OPENSTACK_API_CREDENTIALS:
+                type: string
+                default: "openstack-devcloud-credentials"
+              OPENSTACK_API_PROJECT:
+                type: string
+                default: "mcp-oscore-ci"
+              OPENSTACK_API_PROJECT_DOMAIN:
+                type: string
+                default: "default"
+              OPENSTACK_API_PROJECT_ID:
+                type: string
+                default: ""
+              OPENSTACK_API_USER_DOMAIN:
+                type: string
+                default: "default"
+              OPENSTACK_API_CLIENT:
+                type: string
+                default: ""
+              OPENSTACK_API_VERSION:
+                type: string
+                default: "3"
+              # test
+              TEST_TEMPEST_CONF:
+                type: string
+                description: Tempest configuration file path inside container
+                default: "{{tempest_conf}}"
+              TEST_TEMPEST_TARGET:
+                type: string
+                description: Node to run tests
+                default: "{{tempest_target}}"
+              TEST_TEMPEST_PATTERN:
+                type: string
+                description: Run tests matched to pattern only
+                default: "tempest"
+              TEST_MODEL:
+                type: string
+                description: Environment salt model
+                default: "{{model}}"
+              TEST_PASS_THRESHOLD:
+                type: string
+                description: Tests pass rate to consider build successful
+                default: "{{test_threshold}}"
+              TESTRAIL:
+                type: boolean
+                default: 'false'
+                description: Whether to upload results to testrail
+              FAIL_ON_TESTS:
+                type: boolean
+                default: 'true'
+                description: Whether to fail build on test results
+              BOOTSTRAP_EXTRA_REPO_PARAMS:
+                type: string
+                default: ""
+                description: "Defines a list of extra repos with parameters, format: repo 1, repo priority 1, repo pin 1; repo 2, repo priority 2, repo pin 2"
         test-openstack-component-periodic:
           name: "{{job_prefix}}-{{milestone}}-{{model}}-{{openstack_version}}-{{formula_pkg_revision}}"
           template:
@@ -50,6 +179,14 @@
                 type: boolean
                 default: 'false'
                 description: Don't enable it if you need to use the lab after
+              STACK_RECLASS_ADDRESS:
+                type: string
+                default: '{{stack_reclass_address}}'
+                description: 'Url to repository with stack salt models'
+              STACK_RECLASS_BRANCH:
+                type: string
+                default: '{{stack_reclass_branch}}'
+                description: 'Branch of repository with stack salt models'
               STACK_CLEANUP_JOB:
                 type: string
                 default: "{{stack_cleanup_job}}"
@@ -183,11 +320,18 @@
                 description: Salt target to run tests
               TEST_TEMPEST_IMAGE:
                 type: string
-                description: Node to run tests
+                description: Url to tempest docker image
                 default: 'docker-prod-local.artifactory.mirantis.com/mirantis/oscore/rally-tempest'
+              LOCAL_TEMPEST_IMAGE:
+                type: string
+                description: Path to local docker image
+                default: ''
               TEST_TEMPEST_PATTERN:
                 type: string
                 description: Run tests matched to pattern only
+              TEST_TEMPEST_SET:
+                type: string
+                description: Run tests matched by tempest set only
               TEST_TEMPEST_CONCURRENCY:
                 type: string
                 description: How much test threads to run
@@ -207,6 +351,10 @@
                 type: string
                 description: Tests pass rate to consider build successful
                 default: "90"
+              USE_PEPPER:
+                type: boolean
+                description: Whether to use pepper to connect to salt master
+                default: 'false'
         results-checker-template:
           name: "{{job_prefix}}-{{test_type}}-results-checker"
           template:
@@ -361,3 +509,213 @@
                 type: string
                 description: Environment salt model
                 default: "{{model}}"
+        oscore-oscc-ci-template:
+          name: "{{job_prefix}}-oscc-ci"
+          template:
+            discard:
+              build:
+                keep_num: 30
+              artifact:
+                keep_num: 30
+            type: workflow-scm
+            concurrent: true
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/openstack-ci/openstack-pipelines.git"
+              credentials: "gerrit"
+              branch: 'master'
+              script: oscc-ci-pipeline.groovy
+            param:
+              # general
+              DEPLOY_JOB_NAME:
+                type: string
+                description: "Job name tp deploy envs are going to be tested"
+                default: "{{job_prefix}}-{{deployJobPrefix}}"
+              DISTRIBUTION:
+                type: string
+                default: "{{distribution}}"
+                description: "Distribution for the published repo"
+              COMPONENTS:
+                type: string
+                default: "{{components}}"
+                description: "Components for repo"
+              TMP_REPO_NODE_NAME:
+                type: string
+                default: "{{tmp_repo_node_name}}"
+                description: "Node name where temp repo will be published"
+              STACK_RECLASS_ADDRESS:
+                type: string
+                default: "{{stack_reclass_address}}"
+              OPENSTACK_RELEASES:
+                type: string
+                default: "{{openstack_releases}}"
+                description: "OpenStack releases with comma delimeter which have to be testes. For example: pike,ocata"
+              SOURCE_REPO_NAME:
+                type: string
+                description: "Name of the repo where packages are stored"
+                default: "{{source_repo_name}}"
+              APTLY_API_URL:
+                type: string
+                description: URL for the aptly API
+                default: "${_param:jenkins_aptly_api_url}"
+              STACK_DELETE:
+                type: boolean
+                default: "{{stack_delete}}"
+                description: Do not enable it if you need to use the lab after
+              OPENSTACK_COMPONENTS_LIST:
+                type: string
+                description: "OpenStack related components list"
+                default: "{{openstack_components_list}}"
+        build-salt-formula-refspec-template:
+          name: "{{job_prefix}}-build-salt-formula-refspec"
+          template:
+            discard:
+              build:
+                keep_num: 30
+              artifact:
+                keep_num: 30
+            type: workflow-scm
+            concurrent: true
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines.git"
+              credentials: "gerrit"
+              branch: 'master'
+              script: build-debian-packages-pipeline.groovy
+            param:
+              SOURCE_URL:
+                type: string
+                default: ""
+                description: Project Git repo URL
+              SOURCE_REFSPEC:
+                type: string
+                default: ""
+                description: Refspec to checkout
+              SOURCE_BRANCH:
+                type: string
+                default: "master"
+                description: Name of local branch name for checked out refspec
+              SOURCE_CREDENTIALS:
+                type: string
+                default: "gerrit"
+                description: Credentials to Git repo
+              DEBIAN_SNAPSHOT:
+                type: boolean
+                default: 'true'
+                description: Whether to make a snapshot build
+              EXTRA_REPO_URL:
+                type: string
+                default: "deb ${_param:jenkins_aptly_url}/{{dist}}/ testing salt salt-latest"
+                description: Extra repo for building process
+              EXTRA_REPO_KEY_URL:
+                type: string
+                default: "${_param:jenkins_aptly_url}/public.gpg"
+                description: Extra repo GPG public key URL
+              OS:
+                type: string
+                default: "ubuntu"
+                description: OS name
+              DIST:
+                type: string
+                default: "{{dist}}"
+                description: OS distributive name
+              UPLOAD_PPA:
+                type: boolean
+                default: 'false'
+                description: Whether to upload to PPA
+              UPLOAD_APTLY:
+                type: boolean
+                default: 'false'
+                description: Whether to upload to Aptly
+              DEBIAN_BRANCH:
+                type: string
+                default: "debian/{{dist}}"
+                description: Source repo branch name with build spec
+              LINTIAN_CHECK:
+                type: boolean
+                default: 'false'
+                description: Whether to perform lintian check
+        test-salt-formula-refspec-template:
+          name: "{{job_prefix}}-test-salt-formula-refspec"
+          template:
+            discard:
+              build:
+                keep_num: 30
+              artifact:
+                keep_num: 30
+            type: workflow-scm
+            concurrent: true
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/openstack-ci/openstack-pipelines.git"
+              credentials: "gerrit"
+              branch: 'master'
+              script: deploy-formula-change-pipeline.groovy
+            trigger:
+              gerrit:
+                project:
+                  "^salt-formulas/(nova|cinder|glance|keystone|horizon|neutron|designate|heat|ironic|barbican|salt|linux|reclass|galera)$":
+                    compare_type: 'REG_EXP'
+                    branches:
+                      - master
+                skip_vote:
+                  - successful
+                  - failed
+                  - unstable
+                  - not_built
+                event:
+                  comment:
+                    - addedContains:
+                        commentAddedCommentContains: '^(?s:Patch Set \d+:.*(test|recheck|reverify)\s*)$'
+            param:
+              SOURCE_CREDENTIALS:
+                type: string
+                default: "gerrit"
+              UPLOAD_APTLY:
+                type: boolean
+                default: 'true'
+                description: Whether to upload to Aptly
+              APTLY_REPO:
+                type: string
+                default: ""
+                description: Aptly repo name
+              BUILD_PACKAGE:
+                type: boolean
+                default: 'true'
+                description: Whether to build package
+              APTLY_REPO_URL:
+                type: string
+                default: "${_param:jenkins_aptly_url}"
+                description: Aptly url
+              APTLY_API_URL:
+                type: string
+                default: "${_param:jenkins_aptly_api_url}"
+                description: Aptly API url
+              OPENSTACK_RELEASES:
+                type: string
+                default: "{{openstack_releases}}"
+                description: Comma separated list of OpenStack releases to perform deploy and tests.
+              SOURCES:
+                type: text
+                default: ""
+                description: Optional parameter to list Git refspecs to be build
+              STACK_RECLASS_ADDRESS:
+                type: string
+                default: "{{stack_reclass_address}}"
+                description: Git repo URL to reclass
+              PKG_BUILD_JOB_NAME:
+                type: string
+                default: "{{pkg_build_job_name}}"
+                description: Jenkins job name to build package
+              STACK_DELETE:
+                type: boolean
+                default: 'true'
+                description: Whether to delete stacks ater tests
+              APTLY_PREFIX:
+                type: string
+                default: "{{aptly_prefix}}"
+                description: Aptly prefix
+              SYSTEST_JOB_PREFIX:
+                type: string
+                default: "{{systestJobPrefix}}"
+                description: "Systest job prefix. I.e. oscore-formula-systest-virtual_mcp11_aio-"
diff --git a/jenkins/client/job/oss/test_pushkin_codebase.yml b/jenkins/client/job/oss/test_pushkin_codebase.yml
index 245f1d8..baefbc9 100644
--- a/jenkins/client/job/oss/test_pushkin_codebase.yml
+++ b/jenkins/client/job/oss/test_pushkin_codebase.yml
@@ -23,11 +23,6 @@
                   branches:
                     - devel
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/salt-formulas/git-mirrors/2way.yml b/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
index 2de63a5..25a1b84 100644
--- a/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
+++ b/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
@@ -49,6 +49,8 @@
               branches: ${_param:salt_formulas_branches}
             - name: dekapod
               branches: ${_param:salt_formulas_branches}
+            - name: debmirror
+              branches: ${_param:salt_formulas_branches}
             - name: devops-portal
               branches: ${_param:salt_formulas_branches}
             - name: docker
@@ -131,6 +133,8 @@
               branches: ${_param:salt_formulas_branches}
             - name: magnum
               branches: ${_param:salt_formulas_branches}
+            - name: manila
+              branches: ${_param:salt_formulas_branches}
             - name: memcached
               branches: ${_param:salt_formulas_branches}
             - name: midonet
@@ -201,6 +205,8 @@
               branches: ${_param:salt_formulas_branches}
             - name: rundeck
               branches: ${_param:salt_formulas_branches}
+            - name: runtest
+              branches: ${_param:salt_formulas_branches}
             - name: sahara
               branches: ${_param:salt_formulas_branches}
             - name: salt
@@ -242,6 +248,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: git-mirror-2way-pipeline.groovy
               github:
@@ -250,6 +257,14 @@
               github:
               pollscm:
                 spec: ${_param:jenkins_pollscm_spec}
+              gerrit:
+                project:
+                  salt-formulas/{{name}}:
+                    branches:
+                      - master
+                event:
+                  ref:
+                    - updated
             param:
               SOURCE_URL:
                 type: string
@@ -263,40 +278,70 @@
               BRANCHES:
                 type: string
                 default: "{{branches}}"
-        git-mirror-2way:
-          name: git-mirror-2way-{{name}}
-          jobs:
-            - name: salt-formulas-scripts
-              branches: master
-          template:
-            discard:
-              build:
-                keep_num: 10
-              artifact:
-                keep_num: 10
-            type: workflow-scm
-            concurrent: false
-            scm:
-              type: git
-              url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
-              credentials: "gerrit"
-              script: git-mirror-2way-pipeline.groovy
-              github:
-                url: "https://github.com/salt-formulas/{{name}}"
-            trigger:
-              github:
-              pollscm:
-                spec: ${_param:jenkins_pollscm_spec}
-            param:
-              SOURCE_URL:
-                type: string
-                default: "${_param:jenkins_gerrit_url}/salt-formulas/{{name}}.git"
-              TARGET_URL:
-                type: string
-                default: "https://github.com/salt-formulas/{{name}}.git"
-              CREDENTIALS_ID:
-                type: string
-                default: "gerrit"
-              BRANCHES:
-                type: string
-                default: "{{branches}}"
+      job:
+        git-mirror-2way-salt-formulas-scripts:
+          discard:
+            build:
+              keep_num: 10
+            artifact:
+              keep_num: 10
+          type: workflow-scm
+          concurrent: false
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
+            credentials: "gerrit"
+            script: git-mirror-2way-pipeline.groovy
+            github:
+              url: "https://github.com/salt-formulas/salt-formulas-scripts"
+          trigger:
+            github:
+            pollscm:
+              spec: ${_param:jenkins_pollscm_spec}
+          param:
+            SOURCE_URL:
+              type: string
+              default: "${_param:jenkins_gerrit_url}/salt-formulas/salt-formulas-scripts.git"
+            TARGET_URL:
+              type: string
+              default: "git@github.com:salt-formulas/salt-formulas-scripts.git"
+            CREDENTIALS_ID:
+              type: string
+              default: "gerrit"
+            BRANCHES:
+              type: string
+              default: "master"
+        git-mirror-2way-salt-formulas-cookiecutter:
+          discard:
+            build:
+              keep_num: 10
+            artifact:
+              keep_num: 10
+          type: workflow-scm
+          concurrent: false
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
+            credentials: "gerrit"
+            script: git-mirror-2way-pipeline.groovy
+            github:
+              url: "https://github.com/salt-formulas/salt-formulas-cookiecutter"
+          trigger:
+            github:
+            pollscm:
+              spec: ${_param:jenkins_pollscm_spec}
+          param:
+            SOURCE_URL:
+              type: string
+              default: "${_param:jenkins_gerrit_url}/salt-formulas/salt-formulas-cookiecutter.git"
+            TARGET_URL:
+              type: string
+              default: "git@github.com:salt-formulas/salt-formulas-cookiecutter.git"
+            CREDENTIALS_ID:
+              type: string
+              default: "gerrit"
+            BRANCHES:
+              type: string
+              default: "master"
diff --git a/jenkins/client/job/salt-formulas/release.yml b/jenkins/client/job/salt-formulas/release.yml
index c686e6e..fe6df5e 100644
--- a/jenkins/client/job/salt-formulas/release.yml
+++ b/jenkins/client/job/salt-formulas/release.yml
@@ -8,6 +8,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: release-salt-formulas-pipeline.groovy
             github:
diff --git a/jenkins/client/job/salt-formulas/tests.yml b/jenkins/client/job/salt-formulas/tests.yml
index aa5208b..6425773 100644
--- a/jenkins/client/job/salt-formulas/tests.yml
+++ b/jenkins/client/job/salt-formulas/tests.yml
@@ -13,6 +13,7 @@
             - name: avinetworks
             - name: backupninja
             - name: barbican
+            - name: baremetal-simulator
             - name: billometer
             - name: bind
             - name: bird
@@ -69,8 +70,10 @@
             - name: logrotate
             - name: maas
             - name: magnum
+            - name: manila
             - name: memcached
             - name: midonet
+            - name: mirascan
             - name: monasca
             - name: mongodb
             - name: murano
@@ -104,6 +107,7 @@
             - name: rsync
             - name: rsyslog
             - name: rundeck
+            - name: runtest
             - name: sahara
             - name: salt
             - name: sensu
@@ -114,8 +118,8 @@
             - name: supervisor
             - name: swift
             - name: taiga
-            - name: tinyproxy
             - name: telegraf
+            - name: tinyproxy
             - name: tftpd-hpa
             - name: varnish
             - name: xtrabackup
@@ -131,6 +135,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: test-salt-formulas-pipeline.groovy
             trigger:
@@ -170,7 +175,7 @@
           name: test-salt-formulas-env
           discard:
             build:
-              keep_num: 500
+              keep_num: 1000
             artifact:
               keep_num: 10
           type: workflow-scm
@@ -178,6 +183,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: test-salt-formulas-env.groovy
           param:
diff --git a/jenkins/client/job/salt-models/generate.yml b/jenkins/client/job/salt-models/generate.yml
index 491cfee..b2ef4e5 100644
--- a/jenkins/client/job/salt-models/generate.yml
+++ b/jenkins/client/job/salt-models/generate.yml
@@ -14,6 +14,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "jenkins-mk"
               script: generate-cookiecutter-products.groovy
             param:
diff --git a/jenkins/client/job/salt-models/git-mirrors.yml b/jenkins/client/job/salt-models/git-mirrors.yml
index 034f8d5..a04043b 100644
--- a/jenkins/client/job/salt-models/git-mirrors.yml
+++ b/jenkins/client/job/salt-models/git-mirrors.yml
@@ -12,6 +12,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: git-mirror-2way-pipeline.groovy
               github:
diff --git a/jenkins/client/job/salt-models/tests.yml b/jenkins/client/job/salt-models/tests.yml
index 5e7e82b..6bf8e5a 100644
--- a/jenkins/client/job/salt-models/tests.yml
+++ b/jenkins/client/job/salt-models/tests.yml
@@ -8,9 +8,15 @@
           name: test-salt-model-{{name}}
           template:
             type: workflow-scm
+            discard:
+              build:
+                keep_num: 50
+              artifact:
+                keep_num: 50
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: test-salt-models-pipeline.groovy
             concurrent: true
@@ -80,9 +86,15 @@
           name: test-salt-model-{{name}}
           template:
             type: workflow-scm
+            discard:
+             build:
+               keep_num: 50
+             artifact:
+               keep_num: 50
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: test-system-reclass-pipeline.groovy
             trigger:
@@ -117,14 +129,15 @@
           template:
             discard:
              build:
-               keep_num: 20
+               keep_num: 50
              artifact:
-               keep_num: 20
+               keep_num: 50
             type: workflow-scm
             concurrent: true
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "jenkins-mk"
               script: test-cookiecutter-reclass.groovy
             trigger:
@@ -164,13 +177,13 @@
                 default: "1"
               EXTRA_FORMULAS:
                 type: string
-                default: "xtrabackup docker haproxy aptly keepalived gerrit jenkins openldap maas"
+                default: "aptly artifactory backupninja collectd devops-portal docker elasticsearch freeipa gerrit glusterfs grafana haproxy heka horizon influxdb jenkins keepalived kibana libvirt maas memcached mysql nginx ntp openldap openssh postfix prometheus rsync rsyslog rundeck sensu sphinx telegraf xtrabackup"
       job:
         test-salt-model-node:
           name: test-salt-model-node
           discard:
             build:
-              keep_num: 500
+              keep_num: 1000
             artifact:
               keep_num: 10
           type: workflow-scm
@@ -178,6 +191,7 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: test-salt-model-node.groovy
           param:
diff --git a/jenkins/client/job/test_pipelines.yml b/jenkins/client/job/test_pipelines.yml
index b1b782a..c9a2442 100644
--- a/jenkins/client/job/test_pipelines.yml
+++ b/jenkins/client/job/test_pipelines.yml
@@ -22,6 +22,7 @@
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              branch: "${_param:jenkins_pipelines_branch}"
               credentials: "gerrit"
               script: test-groovy-pipeline.groovy
             trigger:
diff --git a/jenkins/client/job/validate.yml b/jenkins/client/job/validate.yml
index 6d3ecda..7d2fa9b 100644
--- a/jenkins/client/job/validate.yml
+++ b/jenkins/client/job/validate.yml
@@ -15,13 +15,14 @@
           display_name: "Validate - Openstack"
           discard:
             build:
-              keep_num: 20
+              keep_num: 50
             artifact:
-              keep_num: 20
+              keep_num: 50
           concurrent: false
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: validate-cloud.groovy
           param:
@@ -126,6 +127,14 @@
               type: string
               default: ""
               description: Git branch which will be used during the checkout
+            RALLY_SCENARIOS:
+              type: string
+              default: ""
+              description: Rally scenarios directory or file with scenarios
+            RALLY_TASK_ARGS_FILE:
+              type: string
+              default: ""
+              description: Rally scenarios arguments file
             AVAILABILITY_ZONE:
               type: string
               default: "nova"
@@ -140,7 +149,7 @@
               description: If chosen then previous build results will be used in the current build
         cvp-sanity:
           type: workflow-scm
-          name: validate-cvp-sanity
+          name: cvp-sanity
           display_name: "CVP - Sanity checks"
           discard:
             build:
@@ -151,12 +160,13 @@
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
             script: cvp-sanity.groovy
           param:
             SALT_MASTER_URL:
               type: string
-              default: ""
+              default: "${_param:jenkins_salt_api_url}"
               description: Full Salt API address [e.g. https://10.10.10.2:6969]
             SALT_MASTER_CREDENTIALS:
               type: string
@@ -165,6 +175,10 @@
               type: string
               default: "https://github.com/Mirantis/cvp-sanity-checks"
               description: Url for cvp-sanity-checks
+            SANITY_TESTS_SETTINGS:
+              type: string
+              default: ""
+              description: e.g. skipped_nodes=nal01.local.com,ntw01.local.com
             SANITY_TESTS_SET:
               type: string
               default: ""
@@ -173,3 +187,71 @@
               type: string
               default: ""
               description: Proxy address to clone repo and install python requirements
+        cvp-ha:
+          type: workflow-scm
+          name: cvp-ha
+          display_name: "CVP - HA tests"
+          discard:
+            build:
+              keep_num: 20
+            artifact:
+              keep_num: 20
+          concurrent: false
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            credentials: "gerrit"
+            script: cvp-ha.groovy
+          param:
+            SALT_MASTER_URL:
+              type: string
+              default: "${_param:jenkins_salt_api_url}"
+              description: Full Salt API address [e.g. https://10.10.10.2:6969]
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+              description: Credentials to the Salt API
+            TEMPEST_TARGET_NODE:
+              type: string
+              default: ""
+              description: Node where container with tempest will be run
+            TEST_IMAGE:
+              type: string
+              default: "rallyforge/rally"
+              description: Docker image to use for running Rally/Tempest
+            TARGET_NODES:
+              type: string
+              default: "ctl*"
+              description: Nodes to test
+            DEBUG_MODE:
+              type: boolean
+              default: 'false'
+              description: If you need to debug (keep container after test), please enabled this
+            RETRY_CHECK_STATUS:
+              type: string
+              default: "200"
+              description: If you have any problems with timeouts (e.g. while waiting for node to be up/down), please increase this value
+            SKIP_LIST_PATH:
+              type: string
+              default: "/home/rally/cvp-configuration/tempest/skip-list.yaml"
+              description: path to skip-list file inside container
+            PROXY:
+              type: string
+              default: ""
+              description: Proxy address to clone repo and install python requirements
+            TEMPEST_TEST_PATTERN:
+              type: string
+              default: "set=smoke"
+              description: Use set=smoke (or identity,full...] or just test name
+            MANUAL_CONFIRMATION:
+              type: boolean
+              default: 'false'
+              description: Ask for confirmation before doing something destructive (reboot/shutdown node)
+            TEMPEST_REPO:
+              type: string
+              default: "https://github.com/openstack/tempest"
+              description: Can be repo url (local or remote) or path to folder (inside container) with Tempest
+            TOOLS_REPO:
+              type: string
+              default: "${_param:gerrit_public_host}/cvp-configuration"
+              description: URL of repo where testing tools, scenarios, configs are located.
diff --git a/jenkins/slave/debmirror.yml b/jenkins/slave/debmirror.yml
new file mode 100644
index 0000000..6cd7829
--- /dev/null
+++ b/jenkins/slave/debmirror.yml
@@ -0,0 +1,8 @@
+classes:
+  - system.jenkins.slave
+parameters:
+  linux:
+    system:
+      package:
+        debmirror:
+          version: latest
diff --git a/jenkins/slave/salt-pepper.yml b/jenkins/slave/salt-pepper.yml
new file mode 100644
index 0000000..c5baf1f
--- /dev/null
+++ b/jenkins/slave/salt-pepper.yml
@@ -0,0 +1,8 @@
+ classes:
+   - system.jenkins.slave
+ parameters:
+   linux:
+     system:
+       package:
+         salt-pepper:
+           version: latest
diff --git a/keystone/client/core.yml b/keystone/client/core.yml
index 39d28de..f869059 100644
--- a/keystone/client/core.yml
+++ b/keystone/client/core.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    keystone_service_protocol: http
   linux:
     system:
       job:
@@ -16,6 +18,7 @@
             host: ${_param:keystone_service_host}
             port: 35357
             token: ${_param:keystone_service_token}
+            protocol: ${_param:keystone_service_protocol}
           roles:
           - admin
           - Member
@@ -38,3 +41,4 @@
             port: 5000
             region_name: ${_param:openstack_region}
             use_keystoneauth: true
+            protocol: ${_param:keystone_service_protocol}
diff --git a/keystone/client/image_manager.yml b/keystone/client/image_manager.yml
index 024b0c4..becd512 100644
--- a/keystone/client/image_manager.yml
+++ b/keystone/client/image_manager.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     keystone_image_manager_email: 'root@localhost'
+    keystone_service_protocol: http
   keystone:
     client:
       enabled: true
@@ -10,6 +11,7 @@
             host: ${_param:keystone_service_host}
             port: 35357
             token: ${_param:keystone_service_token}
+            protocol: ${_param:keystone_service_protocol}
           roles:
           - image_manager
           project:
diff --git a/keystone/client/service/aodh.yml b/keystone/client/service/aodh.yml
index 51de0ca..c4d49b8 100644
--- a/keystone/client/service/aodh.yml
+++ b/keystone/client/service/aodh.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    aodh_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                 internal_address: ${_param:aodh_service_host}
                 internal_port: 8042
                 internal_path: '/'
+                internal_protocol: ${_param:aodh_service_protocol}
+                admin_protocol: ${_param:aodh_service_protocol}
                 admin_address: ${_param:aodh_service_host}
                 admin_port: 8042
                 admin_path: '/'
diff --git a/keystone/client/service/barbican.yml b/keystone/client/service/barbican.yml
index 497eb50..d222fb6 100644
--- a/keystone/client/service/barbican.yml
+++ b/keystone/client/service/barbican.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    barbican_service_protocol: http
   keystone:
     client:
       server:
@@ -31,6 +32,8 @@
                 internal_address: ${_param:barbican_service_host}
                 internal_port: 9311
                 internal_path: '/'
+                internal_protocol: ${_param:barbican_service_protocol}
                 admin_address: ${_param:barbican_service_host}
                 admin_port: 9311
                 admin_path: '/'
+                admin_protocol: ${_param:barbican_service_protocol}
diff --git a/keystone/client/service/billometer.yml b/keystone/client/service/billometer.yml
index 3728aa5..6100dc9 100644
--- a/keystone/client/service/billometer.yml
+++ b/keystone/client/service/billometer.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    billometer_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                 internal_address: ${_param:billometer_service_host}
                 internal_port: 9753
                 internal_path: '/v1'
+                internal_protocol: ${_param:billometer_service_protocol}
+                admin_protocol: ${_param:billometer_service_protocol}
                 admin_address: ${_param:billometer_service_host}
                 admin_port: 9753
                 admin_path: '/v1'
diff --git a/keystone/client/service/ceilometer.yml b/keystone/client/service/ceilometer.yml
index 4c59f80..90e0d3e 100644
--- a/keystone/client/service/ceilometer.yml
+++ b/keystone/client/service/ceilometer.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    ceilometer_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                 internal_address: ${_param:ceilometer_service_host}
                 internal_port: 8777
                 internal_path: '/'
+                internal_protocol: ${_param:ceilometer_service_protocol}
+                admin_protocol: ${_param:ceilometer_service_protocol}
                 admin_address: ${_param:ceilometer_service_host}
                 admin_port: 8777
                 admin_path: '/'
diff --git a/keystone/client/service/cinder.yml b/keystone/client/service/cinder.yml
index ffb5510..64705e3 100644
--- a/keystone/client/service/cinder.yml
+++ b/keystone/client/service/cinder.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    cinder_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                 internal_address: ${_param:cinder_service_host}
                 internal_port: 8776
                 internal_path: '/v1/$(project_id)s'
+                internal_protocol: ${_param:cinder_service_protocol}
+                admin_protocol: ${_param:cinder_service_protocol}
                 admin_address: ${_param:cinder_service_host}
                 admin_port: 8776
                 admin_path: '/v1/$(project_id)s'
diff --git a/keystone/client/service/cinder2.yml b/keystone/client/service/cinder2.yml
index e0e2636..cb289e1 100644
--- a/keystone/client/service/cinder2.yml
+++ b/keystone/client/service/cinder2.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    cinder_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                 internal_address: ${_param:cinder_service_host}
                 internal_port: 8776
                 internal_path: '/v2/$(project_id)s'
+                internal_protocol: ${_param:cinder_service_protocol}
+                admin_protocol: ${_param:cinder_service_protocol}
                 admin_address: ${_param:cinder_service_host}
                 admin_port: 8776
                 admin_path: '/v2/$(project_id)s'
diff --git a/keystone/client/service/cinder3.yml b/keystone/client/service/cinder3.yml
index 43a805c..d5e0ae1 100644
--- a/keystone/client/service/cinder3.yml
+++ b/keystone/client/service/cinder3.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    cinder_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                 internal_address: ${_param:cinder_service_host}
                 internal_port: 8776
                 internal_path: '/v3/$(project_id)s'
+                internal_protocol: ${_param:cinder_service_protocol}
+                admin_protocol: ${_param:cinder_service_protocol}
                 admin_address: ${_param:cinder_service_host}
                 admin_port: 8776
                 admin_path: '/v3/$(project_id)s'
diff --git a/keystone/client/service/congress.yml b/keystone/client/service/congress.yml
index 529d3ee..49e8337 100644
--- a/keystone/client/service/congress.yml
+++ b/keystone/client/service/congress.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    congress_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                 internal_address: ${_param:congress_service_host}
                 internal_port: 1789
                 internal_path: '/'
+                internal_protocol: ${_param:congress_service_protocol}
+                admin_protocol: ${_param:congress_service_protocol}
                 admin_address: ${_param:congress_service_host}
                 admin_port: 1789
                 admin_path: '/'
diff --git a/keystone/client/service/designate.yml b/keystone/client/service/designate.yml
index 4018712..75a588e 100644
--- a/keystone/client/service/designate.yml
+++ b/keystone/client/service/designate.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    designate_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                     internal_address: ${_param:designate_service_host}
                     internal_port: 9001
                     internal_path: '/'
+                    internal_protocol: ${_param:designate_service_protocol}
+                    admin_protocol: ${_param:designate_service_protocol}
                     admin_address: ${_param:designate_service_host}
                     admin_port: 9001
                     admin_path: '/'
diff --git a/keystone/client/service/glance.yml b/keystone/client/service/glance.yml
index 365917b..3c0db9c 100644
--- a/keystone/client/service/glance.yml
+++ b/keystone/client/service/glance.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    glance_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                 internal_address: ${_param:glance_service_host}
                 internal_port: 9292
                 internal_path: ''
+                internal_protocol: ${_param:glance_service_protocol}
+                admin_protocol: ${_param:glance_service_protocol}
                 admin_address: ${_param:glance_service_host}
                 admin_port: 9292
                 admin_path: ''
diff --git a/keystone/client/service/glare.yml b/keystone/client/service/glare.yml
index 78c7d1f..4534b0e 100644
--- a/keystone/client/service/glare.yml
+++ b/keystone/client/service/glare.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    glare_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                 internal_address: ${_param:glance_service_host}
                 internal_port: 9494
                 internal_path: ''
+                internal_protocol: ${_param:glare_service_protocol}
+                admin_protocol: ${_param:glare_service_protocol}
                 admin_address: ${_param:glance_service_host}
                 admin_port: 9494
                 admin_path: ''
diff --git a/keystone/client/service/heat-cfn.yml b/keystone/client/service/heat-cfn.yml
index 343ff46..1a2486a 100644
--- a/keystone/client/service/heat-cfn.yml
+++ b/keystone/client/service/heat-cfn.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    heat_service_protocol: http
   keystone:
     client:
       server:
@@ -18,6 +19,8 @@
                 internal_address: ${_param:heat_service_host}
                 internal_port: 8000
                 internal_path: '/v1'
+                internal_protocol: ${_param:heat_service_protocol}
+                admin_protocol: ${_param:heat_service_protocol}
                 admin_address: ${_param:heat_service_host}
                 admin_port: 8000
                 admin_path: '/v1'
diff --git a/keystone/client/service/heat.yml b/keystone/client/service/heat.yml
index d7eadd5..c8882dd 100644
--- a/keystone/client/service/heat.yml
+++ b/keystone/client/service/heat.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    heat_service_protocol: http
   keystone:
     client:
       server:
@@ -28,6 +29,8 @@
                 internal_address: ${_param:heat_service_host}
                 internal_port: 8004
                 internal_path: '/v1/%(project_id)s'
+                internal_protocol: ${_param:heat_service_protocol}
+                admin_protocol: ${_param:heat_service_protocol}
                 admin_address: ${_param:heat_service_host}
                 admin_port: 8004
                 admin_path: '/v1/%(project_id)s'
diff --git a/keystone/client/service/ironic.yml b/keystone/client/service/ironic.yml
index 1ab9872..e4c384c 100644
--- a/keystone/client/service/ironic.yml
+++ b/keystone/client/service/ironic.yml
@@ -1,6 +1,8 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    keystone_service_protocol: http
+    ironic_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +27,8 @@
                 internal_address: ${_param:ironic_service_host}
                 internal_port: 6385
                 internal_path: ''
+                internal_protocol: ${_param:ironic_service_protocol}
+                admin_protocol: ${_param:ironic_service_protocol}
                 admin_address: ${_param:ironic_service_host}
                 admin_port: 6385
                 admin_path: ''
@@ -36,3 +40,4 @@
             host: ${_param:keystone_service_host}
             port: 5000
             region_name: ${_param:openstack_region}
+            protocol: ${_param:keystone_service_protocol}
diff --git a/keystone/client/service/keystone.yml b/keystone/client/service/keystone.yml
index af3acfc..d9092e0 100644
--- a/keystone/client/service/keystone.yml
+++ b/keystone/client/service/keystone.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    keystone_service_protocol: http
   keystone:
     client:
       server:
@@ -18,6 +19,8 @@
                 internal_address: ${_param:keystone_service_host}
                 internal_port: 5000
                 internal_path: '/v2.0'
+                internal_protocol: ${_param:keystone_service_protocol}
                 admin_address: ${_param:keystone_service_host}
                 admin_port: 35357
                 admin_path: '/v2.0'
+                admin_protocol: ${_param:keystone_service_protocol}
diff --git a/keystone/client/service/keystone3.yml b/keystone/client/service/keystone3.yml
index bd0c63b..5138c4f 100644
--- a/keystone/client/service/keystone3.yml
+++ b/keystone/client/service/keystone3.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    keystone_service_protocol: http
   keystone:
     client:
       server:
@@ -18,6 +19,8 @@
                 internal_address: ${_param:keystone_service_host}
                 internal_port: 5000
                 internal_path: '/v3'
+                internal_protocol: ${_param:keystone_service_protocol}
                 admin_address: ${_param:keystone_service_host}
                 admin_port: 35357
                 admin_path: '/v2.0'
+                admin_protocol: ${_param:keystone_service_protocol}
diff --git a/keystone/client/service/murano.yml b/keystone/client/service/murano.yml
index 5e65038..e6c70f1 100644
--- a/keystone/client/service/murano.yml
+++ b/keystone/client/service/murano.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    murano_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                   internal_address: ${_param:murano_service_host}
                   internal_port: 8082
                   internal_path: ''
+                  internal_protocol: ${_param:murano_service_protocol}
+                  admin_protocol: ${_param:murano_service_protocol}
                   admin_address: ${_param:murano_service_host}
                   admin_port: 8082
                   admin_path: ''
diff --git a/keystone/client/service/neutron.yml b/keystone/client/service/neutron.yml
index 12fe9fe..8bec7f2 100644
--- a/keystone/client/service/neutron.yml
+++ b/keystone/client/service/neutron.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    neutron_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                 internal_address: ${_param:neutron_service_host}
                 internal_port: 9696
                 internal_path: '/'
+                internal_protocol: ${_param:neutron_service_protocol}
+                admin_protocol: ${_param:neutron_service_protocol}
                 admin_address: ${_param:neutron_service_host}
                 admin_port: 9696
                 admin_path: '/'
diff --git a/keystone/client/service/nova-placement.yml b/keystone/client/service/nova-placement.yml
index 61b5455..3ed0654 100644
--- a/keystone/client/service/nova-placement.yml
+++ b/keystone/client/service/nova-placement.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    nova_service_protocol: http
   keystone:
     client:
       server:
@@ -18,6 +19,8 @@
                 internal_address: ${_param:nova_service_host}
                 internal_port: '8778'
                 internal_path: ''
+                internal_protocol: ${_param:nova_service_protocol}
+                admin_protocol: ${_param:nova_service_protocol}
                 admin_address: ${_param:nova_service_host}
                 admin_port: '8778'
                 admin_path: ''
diff --git a/keystone/client/service/nova.yml b/keystone/client/service/nova.yml
index a0d698b..ca20106 100644
--- a/keystone/client/service/nova.yml
+++ b/keystone/client/service/nova.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    nova_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                 internal_address: ${_param:nova_service_host}
                 internal_port: 8774
                 internal_path: '/v2/$(project_id)s'
+                internal_protocol: ${_param:nova_service_protocol}
+                admin_protocol: ${_param:nova_service_protocol}
                 admin_address: ${_param:nova_service_host}
                 admin_port: 8774
                 admin_path: '/v2/$(project_id)s'
diff --git a/keystone/client/service/nova21.yml b/keystone/client/service/nova21.yml
index 328aefd..2782ec2 100644
--- a/keystone/client/service/nova21.yml
+++ b/keystone/client/service/nova21.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    nova_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                 internal_address: ${_param:nova_service_host}
                 internal_port: 8774
                 internal_path: '/v2/$(project_id)s'
+                internal_protocol: ${_param:nova_service_protocol}
+                admin_protocol: ${_param:nova_service_protocol}
                 admin_address: ${_param:nova_service_host}
                 admin_port: 8774
                 admin_path: '/v2/$(project_id)s'
@@ -40,6 +43,8 @@
                 internal_address: ${_param:nova_service_host}
                 internal_port: 8774
                 internal_path: '/v2.1/$(project_id)s'
+                internal_protocol: ${_param:nova_service_protocol}
+                admin_protocol: ${_param:nova_service_protocol}
                 admin_address: ${_param:nova_service_host}
                 admin_port: 8774
                 admin_path: '/v2.1/$(project_id)s'
diff --git a/keystone/client/service/octavia.yml b/keystone/client/service/octavia.yml
index 0382345..c08312e 100644
--- a/keystone/client/service/octavia.yml
+++ b/keystone/client/service/octavia.yml
@@ -1,6 +1,8 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    keystone_service_protocol: http
+    octavia_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +27,8 @@
                 internal_address: ${_param:octavia_service_host}
                 internal_port: 9876
                 internal_path: '/'
+                internal_protocol: ${_param:octavia_service_protocol}
+                admin_protocol: ${_param:octavia_service_protocol}
                 admin_address: ${_param:octavia_service_host}
                 admin_port: 9876
                 admin_path: '/'
@@ -37,3 +41,4 @@
             port: 5000
             region_name: ${_param:openstack_region}
             use_keystoneauth: true
+            protocol: ${_param:keystone_service_protocol}
diff --git a/keystone/client/service/panko.yml b/keystone/client/service/panko.yml
new file mode 100644
index 0000000..05f9453
--- /dev/null
+++ b/keystone/client/service/panko.yml
@@ -0,0 +1,30 @@
+parameters:
+  _param:
+    cluster_public_protocol: https
+  keystone:
+    client:
+      server:
+        identity:
+          project:
+            service:
+              user:
+                panko:
+                  is_admin: true
+                  password: ${_param:keystone_panko_password}
+                  email: ${_param:admin_email}
+          service:
+            panko:
+              type: event
+              description: OpenStack Event Service
+              endpoints:
+              - region: ${_param:openstack_region}
+                public_address: ${_param:cluster_public_host}
+                public_protocol: ${_param:cluster_public_protocol}
+                public_port: 8977
+                public_path: '/'
+                internal_address: ${_param:panko_service_host}
+                internal_port: 8977
+                internal_path: '/'
+                admin_address: ${_param:panko_service_host}
+                admin_port: 8977
+                admin_path: '/'
diff --git a/keystone/client/service/radosgw-s3.yml b/keystone/client/service/radosgw-s3.yml
index 06d8299..c97c812 100644
--- a/keystone/client/service/radosgw-s3.yml
+++ b/keystone/client/service/radosgw-s3.yml
@@ -2,6 +2,7 @@
   _param:
     cluster_public_protocol: https
     radosgw_s3_cluster_port: 8081
+    radosgw_service_protocol: http
   keystone:
     client:
       server:
@@ -26,6 +27,8 @@
                   internal_address: ${_param:radosgw_service_host}
                   internal_port: ${_param:radosgw_s3_cluster_port}
                   internal_path: '/'
+                  internal_protocol: ${_param:radosgw_service_protocol}
+                  admin_protocol: ${_param:radosgw_service_protocol}
                   admin_address: ${_param:radosgw_service_host}
                   admin_port: ${_param:radosgw_s3_cluster_port}
                   admin_path: '/'
diff --git a/keystone/client/service/radosgw-swift.yml b/keystone/client/service/radosgw-swift.yml
index 3bf9b27..14a24af 100644
--- a/keystone/client/service/radosgw-swift.yml
+++ b/keystone/client/service/radosgw-swift.yml
@@ -2,6 +2,7 @@
   _param:
     cluster_public_protocol: https
     radosgw_swift_cluster_port: 8081
+    radosgw_service_protocol: http
   keystone:
     client:
       server:
@@ -26,6 +27,8 @@
                   internal_address: ${_param:radosgw_service_host}
                   internal_port: ${_param:radosgw_swift_cluster_port}
                   internal_path: '/swift/v1'
+                  internal_protocol: ${_param:radosgw_service_protocol}
+                  admin_protocol: ${_param:radosgw_service_protocol}
                   admin_address: ${_param:radosgw_service_host}
                   admin_port: ${_param:radosgw_swift_cluster_port}
                   admin_path: '/swift/v1'
diff --git a/keystone/client/service/sahara.yml b/keystone/client/service/sahara.yml
index 84a0b96..b635137 100644
--- a/keystone/client/service/sahara.yml
+++ b/keystone/client/service/sahara.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    sahara_internal_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                   internal_address: ${_param:sahara_service_host}
                   internal_port: 8386
                   internal_path: '/v1.1/%(project_id)s'
+                  internal_protocol: ${_param:sahara_internal_protocol}
+                  admin_protocol: ${_param:sahara_internal_protocol}
                   admin_address: ${_param:sahara_service_host}
                   admin_port: 8386
                   admin_path: '/v1.1/%(project_id)s'
diff --git a/keystone/client/service/swift-s3.yml b/keystone/client/service/swift-s3.yml
index 5880487c9..b2769a0 100644
--- a/keystone/client/service/swift-s3.yml
+++ b/keystone/client/service/swift-s3.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    swift_service_protocol: http
   keystone:
     client:
       server:
@@ -26,6 +27,8 @@
                   internal_address: ${_param:swift_service_host}
                   internal_port: 8080
                   internal_path: '/v1/AUTH_%(project_id)s'
+                  internal_protocol: ${_param:swift_service_protocol}
+                  admin_protocol: ${_param:swift_service_protocol}
                   admin_address: ${_param:swift_service_host}
                   admin_port: 8080
                   admin_path: '/'
diff --git a/keystone/client/service/swift.yml b/keystone/client/service/swift.yml
index 781fab9..6f558fb 100644
--- a/keystone/client/service/swift.yml
+++ b/keystone/client/service/swift.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     cluster_public_protocol: https
+    swift_service_protocol: http
   keystone:
     client:
       server:
@@ -25,6 +26,8 @@
                   internal_address: ${_param:swift_service_host}
                   internal_port: 8080
                   internal_path: '/v1/AUTH_%(project_id)s'
+                  internal_protocol: ${_param:swift_service_protocol}
+                  admin_protocol: ${_param:swift_service_protocol}
                   admin_address: ${_param:swift_service_host}
                   admin_port: 8080
                   admin_path: '/'
diff --git a/keystone/client/single.yml b/keystone/client/single.yml
index 0c70390..a79ed7e 100644
--- a/keystone/client/single.yml
+++ b/keystone/client/single.yml
@@ -6,8 +6,9 @@
 - system.keystone.client.service.heat-cfn
 - system.keystone.client.service.keystone
 - system.keystone.client.service.neutron
-- system.keystone.client.service.nova-ec2
 parameters:
+  _param:
+    keystone_service_protocol: http
   linux:
     system:
       job:
@@ -25,6 +26,7 @@
             host: ${_param:keystone_service_host}
             port: 35357
             token: ${_param:keystone_service_token}
+            protocol: ${_param:keystone_service_protocol}
           roles:
           - admin
           - Member
@@ -47,3 +49,4 @@
             port: 5000
             region_name: ${_param:openstack_region}
             use_keystoneauth: true
+            protocol: ${_param:keystone_service_protocol}
diff --git a/keystone/server/cluster.yml b/keystone/server/cluster.yml
index cbe89ca..0ae502b 100644
--- a/keystone/server/cluster.yml
+++ b/keystone/server/cluster.yml
@@ -12,6 +12,9 @@
         python-pymysql:
           fromrepo: ${_param:openstack_version}
           version: latest
+        python-cryptography:
+          fromrepo: ${_param:openstack_version}
+          version: latest
   keystone:
     server:
       enabled: true
diff --git a/keystone/server/wsgi.yml b/keystone/server/wsgi.yml
index f62c1cc..333cb76 100644
--- a/keystone/server/wsgi.yml
+++ b/keystone/server/wsgi.yml
@@ -1,6 +1,10 @@
 classes:
 - system.apache.server.single
 parameters:
+  _param:
+    apache_keystone_ssl:
+      enabled: false
+    apache_keystone_api_host: ${linux:network:fqdn}
   keystone:
     server:
       service_name: apache2
@@ -14,7 +18,8 @@
           type: keystone
           name: wsgi
           host:
-            name: ${linux:network:fqdn}
+            name: ${_param:apache_keystone_api_host}
+          ssl: ${_param:apache_keystone_ssl}
           log:
             custom:
               format: >-
diff --git a/kibana/server/single.yml b/kibana/server/single.yml
index fe0555c..745c07a 100644
--- a/kibana/server/single.yml
+++ b/kibana/server/single.yml
@@ -1,9 +1,12 @@
 classes:
 - service.kibana.server.single
 parameters:
+  _param:
+    kibana_version: 5
   kibana:
     server:
       enabled: true
+      version: ${_param:kibana_version}
       default_app_id: "dashboard/logs"
       bind:
         address: ${_param:single_address}
diff --git a/kubernetes/pool/cluster.yml b/kubernetes/pool/cluster.yml
index 0f961a3..3dd0c40 100644
--- a/kubernetes/pool/cluster.yml
+++ b/kubernetes/pool/cluster.yml
@@ -22,3 +22,5 @@
     host:
       options:
         iptables: false
+        log-opts:
+          labels: "io.kubernetes.pod.name"
diff --git a/kubernetes/pool/single.yml b/kubernetes/pool/single.yml
index 00f22b8..67363a6 100644
--- a/kubernetes/pool/single.yml
+++ b/kubernetes/pool/single.yml
@@ -20,3 +20,5 @@
     host:
       options:
         iptables: false
+        log-opts:
+          labels: "io.kubernetes.pod.name"
diff --git a/linux/system/repo/elasticsearch/5.yml b/linux/system/repo/elasticsearch/5.yml
new file mode 100644
index 0000000..1b9e3e6
--- /dev/null
+++ b/linux/system/repo/elasticsearch/5.yml
@@ -0,0 +1,45 @@
+parameters:
+  _param:
+    elasticsearch_gpg_key: |
+      -----BEGIN PGP PUBLIC KEY BLOCK-----
+      Version: GnuPG v2.0.14 (GNU/Linux)
+
+      mQENBFI3HsoBCADXDtbNJnxbPqB1vDNtCsqhe49vFYsZN9IOZsZXgp7aHjh6CJBD
+      A+bGFOwyhbd7at35jQjWAw1O3cfYsKAmFy+Ar3LHCMkV3oZspJACTIgCrwnkic/9
+      CUliQe324qvObU2QRtP4Fl0zWcfb/S8UYzWXWIFuJqMvE9MaRY1bwUBvzoqavLGZ
+      j3SF1SPO+TB5QrHkrQHBsmX+Jda6d4Ylt8/t6CvMwgQNlrlzIO9WT+YN6zS+sqHd
+      1YK/aY5qhoLNhp9G/HxhcSVCkLq8SStj1ZZ1S9juBPoXV1ZWNbxFNGwOh/NYGldD
+      2kmBf3YgCqeLzHahsAEpvAm8TBa7Q9W21C8vABEBAAG0RUVsYXN0aWNzZWFyY2gg
+      KEVsYXN0aWNzZWFyY2ggU2lnbmluZyBLZXkpIDxkZXZfb3BzQGVsYXN0aWNzZWFy
+      Y2gub3JnPokBOAQTAQIAIgUCUjceygIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgEC
+      F4AACgkQ0n1mbNiOQrRzjAgAlTUQ1mgo3nK6BGXbj4XAJvuZDG0HILiUt+pPnz75
+      nsf0NWhqR4yGFlmpuctgCmTD+HzYtV9fp9qW/bwVuJCNtKXk3sdzYABY+Yl0Cez/
+      7C2GuGCOlbn0luCNT9BxJnh4mC9h/cKI3y5jvZ7wavwe41teqG14V+EoFSn3NPKm
+      TxcDTFrV7SmVPxCBcQze00cJhprKxkuZMPPVqpBS+JfDQtzUQD/LSFfhHj9eD+Xe
+      8d7sw+XvxB2aN4gnTlRzjL1nTRp0h2/IOGkqYfIG9rWmSLNlxhB2t+c0RsjdGM4/
+      eRlPWylFbVMc5pmDpItrkWSnzBfkmXL3vO2X3WvwmSFiQbkBDQRSNx7KAQgA5JUl
+      zcMW5/cuyZR8alSacKqhSbvoSqqbzHKcUQZmlzNMKGTABFG1yRx9r+wa/fvqP6OT
+      RzRDvVS/cycws8YX7Ddum7x8uI95b9ye1/Xy5noPEm8cD+hplnpU+PBQZJ5XJ2I+
+      1l9Nixx47wPGXeClLqcdn0ayd+v+Rwf3/XUJrvccG2YZUiQ4jWZkoxsA07xx7Bj+
+      Lt8/FKG7sHRFvePFU0ZS6JFx9GJqjSBbHRRkam+4emW3uWgVfZxuwcUCn1ayNgRt
+      KiFv9jQrg2TIWEvzYx9tywTCxc+FFMWAlbCzi+m4WD+QUWWfDQ009U/WM0ks0Kww
+      EwSk/UDuToxGnKU2dQARAQABiQEfBBgBAgAJBQJSNx7KAhsMAAoJENJ9ZmzYjkK0
+      c3MIAIE9hAR20mqJWLcsxLtrRs6uNF1VrpB+4n/55QU7oxA1iVBO6IFu4qgsF12J
+      TavnJ5MLaETlggXY+zDef9syTPXoQctpzcaNVDmedwo1SiL03uMoblOvWpMR/Y0j
+      6rm7IgrMWUDXDPvoPGjMl2q1iTeyHkMZEyUJ8SKsaHh4jV9wp9KmC8C+9CwMukL7
+      vM5w8cgvJoAwsp3Fn59AxWthN3XJYcnMfStkIuWgR7U2r+a210W6vnUxU4oN0PmM
+      cursYPyeV0NX/KQeUeNMwGTFB6QHS/anRaGQewijkrYYoTNtfllxIu9XYmiBERQ/
+      qPDlGRlOgVTd9xUfHFkzB52c70E=
+      =92oX
+      -----END PGP PUBLIC KEY BLOCK-----
+  linux:
+    system:
+      repo:
+        elasticsearch:
+          source: "deb https://artifacts.elastic.co/packages/5.x/apt stable main"
+          architectures: amd64
+          key: ${_param:elasticsearch_gpg_key}
+        elasticsearch_curator:
+          source: "deb https://packages.elastic.co/curator/5/debian stable main"
+          architectures: amd64
+          key: ${_param:elasticsearch_gpg_key}
diff --git a/linux/system/repo/elasticsearch.yml b/linux/system/repo/elasticsearch/init.yml
similarity index 100%
rename from linux/system/repo/elasticsearch.yml
rename to linux/system/repo/elasticsearch/init.yml
diff --git a/linux/system/repo/fluentd.yml b/linux/system/repo/fluentd.yml
new file mode 100644
index 0000000..bec4794
--- /dev/null
+++ b/linux/system/repo/fluentd.yml
@@ -0,0 +1,8 @@
+parameters:
+  linux:
+    system:
+      repo:
+        fluentd3:
+          source: "deb [arch=amd64] http://packages.treasuredata.com/3/ubuntu/${_param:linux_system_codename} ${_param:linux_system_codename} contrib"
+          architectures: amd64
+          key_url: "http://packages.treasuredata.com/GPG-KEY-td-agent"
\ No newline at end of file
diff --git a/linux/system/repo/kibana/5.yml b/linux/system/repo/kibana/5.yml
new file mode 100644
index 0000000..795f7d1
--- /dev/null
+++ b/linux/system/repo/kibana/5.yml
@@ -0,0 +1,40 @@
+parameters:
+  _param:
+    kibana_gpg_key: |
+      -----BEGIN PGP PUBLIC KEY BLOCK-----
+      Version: GnuPG v2.0.14 (GNU/Linux)
+
+      mQENBFI3HsoBCADXDtbNJnxbPqB1vDNtCsqhe49vFYsZN9IOZsZXgp7aHjh6CJBD
+      A+bGFOwyhbd7at35jQjWAw1O3cfYsKAmFy+Ar3LHCMkV3oZspJACTIgCrwnkic/9
+      CUliQe324qvObU2QRtP4Fl0zWcfb/S8UYzWXWIFuJqMvE9MaRY1bwUBvzoqavLGZ
+      j3SF1SPO+TB5QrHkrQHBsmX+Jda6d4Ylt8/t6CvMwgQNlrlzIO9WT+YN6zS+sqHd
+      1YK/aY5qhoLNhp9G/HxhcSVCkLq8SStj1ZZ1S9juBPoXV1ZWNbxFNGwOh/NYGldD
+      2kmBf3YgCqeLzHahsAEpvAm8TBa7Q9W21C8vABEBAAG0RUVsYXN0aWNzZWFyY2gg
+      KEVsYXN0aWNzZWFyY2ggU2lnbmluZyBLZXkpIDxkZXZfb3BzQGVsYXN0aWNzZWFy
+      Y2gub3JnPokBOAQTAQIAIgUCUjceygIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgEC
+      F4AACgkQ0n1mbNiOQrRzjAgAlTUQ1mgo3nK6BGXbj4XAJvuZDG0HILiUt+pPnz75
+      nsf0NWhqR4yGFlmpuctgCmTD+HzYtV9fp9qW/bwVuJCNtKXk3sdzYABY+Yl0Cez/
+      7C2GuGCOlbn0luCNT9BxJnh4mC9h/cKI3y5jvZ7wavwe41teqG14V+EoFSn3NPKm
+      TxcDTFrV7SmVPxCBcQze00cJhprKxkuZMPPVqpBS+JfDQtzUQD/LSFfhHj9eD+Xe
+      8d7sw+XvxB2aN4gnTlRzjL1nTRp0h2/IOGkqYfIG9rWmSLNlxhB2t+c0RsjdGM4/
+      eRlPWylFbVMc5pmDpItrkWSnzBfkmXL3vO2X3WvwmSFiQbkBDQRSNx7KAQgA5JUl
+      zcMW5/cuyZR8alSacKqhSbvoSqqbzHKcUQZmlzNMKGTABFG1yRx9r+wa/fvqP6OT
+      RzRDvVS/cycws8YX7Ddum7x8uI95b9ye1/Xy5noPEm8cD+hplnpU+PBQZJ5XJ2I+
+      1l9Nixx47wPGXeClLqcdn0ayd+v+Rwf3/XUJrvccG2YZUiQ4jWZkoxsA07xx7Bj+
+      Lt8/FKG7sHRFvePFU0ZS6JFx9GJqjSBbHRRkam+4emW3uWgVfZxuwcUCn1ayNgRt
+      KiFv9jQrg2TIWEvzYx9tywTCxc+FFMWAlbCzi+m4WD+QUWWfDQ009U/WM0ks0Kww
+      EwSk/UDuToxGnKU2dQARAQABiQEfBBgBAgAJBQJSNx7KAhsMAAoJENJ9ZmzYjkK0
+      c3MIAIE9hAR20mqJWLcsxLtrRs6uNF1VrpB+4n/55QU7oxA1iVBO6IFu4qgsF12J
+      TavnJ5MLaETlggXY+zDef9syTPXoQctpzcaNVDmedwo1SiL03uMoblOvWpMR/Y0j
+      6rm7IgrMWUDXDPvoPGjMl2q1iTeyHkMZEyUJ8SKsaHh4jV9wp9KmC8C+9CwMukL7
+      vM5w8cgvJoAwsp3Fn59AxWthN3XJYcnMfStkIuWgR7U2r+a210W6vnUxU4oN0PmM
+      cursYPyeV0NX/KQeUeNMwGTFB6QHS/anRaGQewijkrYYoTNtfllxIu9XYmiBERQ/
+      qPDlGRlOgVTd9xUfHFkzB52c70E=
+      =92oX
+      -----END PGP PUBLIC KEY BLOCK-----
+  linux:
+    system:
+      repo:
+        kibana:
+          source: "deb https://artifacts.elastic.co/packages/5.x/apt stable main"
+          key: ${_param:kibana_gpg_key}
diff --git a/linux/system/repo/kibana.yml b/linux/system/repo/kibana/init.yml
similarity index 100%
rename from linux/system/repo/kibana.yml
rename to linux/system/repo/kibana/init.yml
diff --git a/linux/system/repo/mcp/apt_mirantis/aptly.yml b/linux/system/repo/mcp/apt_mirantis/aptly.yml
new file mode 100644
index 0000000..b0cf536
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/aptly.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_aptly_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_aptly:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/aptly/ ${_param:linux_system_repo_mcp_aptly_version} main"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_aptly_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/cassandra.yml b/linux/system/repo/mcp/apt_mirantis/cassandra.yml
new file mode 100644
index 0000000..308f555
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/cassandra.yml
@@ -0,0 +1,17 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_cassandra_version: ${_param:apt_mk_version}
+    linux_system_repo_mcp_cassandra_version_number: "21x"
+  linux:
+    system:
+      repo:
+        mcp_cassandra:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/cassandra/ ${_param:linux_system_repo_mcp_cassandra_version} ${_param:linux_system_repo_mcp_cassandra_version_number}"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_cassandra_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/ceph.yml b/linux/system/repo/mcp/apt_mirantis/ceph.yml
new file mode 100644
index 0000000..2532f86
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/ceph.yml
@@ -0,0 +1,17 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_ceph_version: ${_param:apt_mk_version}
+    linux_system_repo_mcp_ceph_codename: luminous
+  linux:
+    system:
+      repo:
+        mcp_ceph:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/ceph/ ${_param:linux_system_repo_mcp_ceph_version} ${_param:linux_system_repo_mcp_ceph_codename}"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_ceph_version}'
+            priority: 1100
+            package: '*'
\ No newline at end of file
diff --git a/linux/system/repo/mcp/apt_mirantis/docker.yml b/linux/system/repo/mcp/apt_mirantis/docker.yml
new file mode 100644
index 0000000..cbd3097
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/docker.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_docker_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_docker:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/docker/ ${_param:linux_system_repo_mcp_docker_version} stable"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_docker_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/docker_legacy.yml b/linux/system/repo/mcp/apt_mirantis/docker_legacy.yml
new file mode 100644
index 0000000..86c6426
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/docker_legacy.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_docker_legacy_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_docker_legacy:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/docker/ ${_param:linux_system_repo_mcp_docker_legacy_version} legacy"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_docker_legacy_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/elastic/2x.yml b/linux/system/repo/mcp/apt_mirantis/elastic/2x.yml
new file mode 100644
index 0000000..4add81e
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/elastic/2x.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_elastic_2x_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_elastic_2x:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/elastic/2.x/ ${_param:linux_system_repo_mcp_elastic_2x_version} main"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_elastic_2x_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/elastic/5x.yml b/linux/system/repo/mcp/apt_mirantis/elastic/5x.yml
new file mode 100644
index 0000000..8876c51
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/elastic/5x.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_elastic_5x_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_elastic_5x:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/elastic/5.x/ ${_param:linux_system_repo_mcp_elastic_5x_version} main"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_elastic_5x_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/elastic/init.yml b/linux/system/repo/mcp/apt_mirantis/elastic/init.yml
new file mode 100644
index 0000000..a66b757
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/elastic/init.yml
@@ -0,0 +1,3 @@
+classes:
+- system.linux.system.repo.mcp.apt_mirantis.elastic.2x
+- system.linux.system.repo.mcp.apt_mirantis.elastic.5x
\ No newline at end of file
diff --git a/linux/system/repo/mcp/apt_mirantis/fluentd.yml b/linux/system/repo/mcp/apt_mirantis/fluentd.yml
new file mode 100644
index 0000000..da7d3ca
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/fluentd.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_fluentd_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_fluentd:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/fluentd/ ${_param:linux_system_repo_mcp_fluentd_version} main"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_fluentd_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/glusterfs.yml b/linux/system/repo/mcp/apt_mirantis/glusterfs.yml
new file mode 100644
index 0000000..1f5dd0e
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/glusterfs.yml
@@ -0,0 +1,17 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_glusterfs_version: ${_param:apt_mk_version}
+    linux_system_repo_mcp_glusterfs_version_number: "3.12"
+  linux:
+    system:
+      repo:
+        mcp_glusterfs:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/glusterfs/ ${_param:linux_system_repo_mcp_glusterfs_version} ${_param:linux_system_repo_mcp_glusterfs_version_number}"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_glusterfs_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/grafana.yml b/linux/system/repo/mcp/apt_mirantis/grafana.yml
new file mode 100644
index 0000000..2d71740
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/grafana.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_grafana_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_grafana:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/grafana/ ${_param:linux_system_repo_mcp_grafana_version} main"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_grafana_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/influxdb.yml b/linux/system/repo/mcp/apt_mirantis/influxdb.yml
new file mode 100644
index 0000000..f3c1fec
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/influxdb.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_influxdb_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_influxdb:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/influxdb/ ${_param:linux_system_repo_mcp_influxdb_version} main"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_influxdb_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/kibana/46.yml b/linux/system/repo/mcp/apt_mirantis/kibana/46.yml
new file mode 100644
index 0000000..f3795ad
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/kibana/46.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_kibana_46_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_kibana_46:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/kibana/4.6/ ${_param:linux_system_repo_mcp_kibana_46_version} kibana-46"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_kibana_46_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/kibana/5x.yml b/linux/system/repo/mcp/apt_mirantis/kibana/5x.yml
new file mode 100644
index 0000000..e2f4795
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/kibana/5x.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_kibana_5x_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_kibana_5x:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/kibana/5.x/ ${_param:linux_system_repo_mcp_kibana_5x_version} kibana-5x"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_kibana_5x_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/kibana/init.yml b/linux/system/repo/mcp/apt_mirantis/kibana/init.yml
new file mode 100644
index 0000000..daaf7ab
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/kibana/init.yml
@@ -0,0 +1,3 @@
+classes:
+- system.linux.system.repo.mcp.apt_mirantis.kibana.46
+- system.linux.system.repo.mcp.apt_mirantis.kibana.5x
\ No newline at end of file
diff --git a/linux/system/repo/mcp/apt_mirantis/maas.yml b/linux/system/repo/mcp/apt_mirantis/maas.yml
new file mode 100644
index 0000000..b18bf65
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/maas.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_maas_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_maas:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/maas/ ${_param:linux_system_repo_mcp_maas_version} main"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_maas_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/openstack.yml b/linux/system/repo/mcp/apt_mirantis/openstack.yml
new file mode 100644
index 0000000..5d11e59
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/openstack.yml
@@ -0,0 +1,23 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mk_openstack_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mirantis_openstack:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/openstack/${_param:openstack_version} ${_param:linux_system_repo_mk_openstack_version} main"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          pin:
+          - pin: 'release l=${_param:openstack_version}'
+            priority: 1100
+            package: '*'
+        mk_openstack:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/ ${_param:linux_system_repo_mk_openstack_version} ${_param:openstack_version}"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          pin:
+          - pin: 'release l=${_param:linux_system_repo_mk_openstack_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/saltstack_2016_3.yml b/linux/system/repo/mcp/apt_mirantis/saltstack_2016_3.yml
new file mode 100644
index 0000000..bec95cd
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/saltstack_2016_3.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_saltstack_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_saltstack:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/salt/2016.3/ ${_param:linux_system_repo_mcp_saltstack_version} main"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_saltstack_version}'
+            priority: 1100
+            package: '*'
\ No newline at end of file
diff --git a/linux/system/repo/mcp/apt_mirantis/sensu.yml b/linux/system/repo/mcp/apt_mirantis/sensu.yml
new file mode 100644
index 0000000..f86b88a
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/sensu.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_extra_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_extra:
+          source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/sensu/ ${_param:linux_system_repo_mcp_extra_version} main"
+          architectures: amd64
+          key_url: "http://apt.mirantis.com/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_extra_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo/mcp/apt_mirantis/ubuntu.yml b/linux/system/repo/mcp/apt_mirantis/ubuntu.yml
new file mode 100644
index 0000000..e254ed6
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/ubuntu.yml
@@ -0,0 +1,24 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+  linux:
+    system:
+      repo:
+        ubuntu:
+          source: "deb [arch=amd64] http://mirror.mirantis.com/${_param:apt_mk_version}/ubuntu/ ${_param:linux_system_codename} main restricted universe"
+          architectures: amd64
+          default: true
+          key_id: 437D05B5
+          key_server: keyserver.ubuntu.com
+        ubuntu_updates:
+          source: "deb [arch=amd64] http://mirror.mirantis.com/${_param:apt_mk_version}/ubuntu/ ${_param:linux_system_codename}-updates main restricted universe"
+          architectures: amd64
+          default: true
+          key_id: 437D05B5
+          key_server: keyserver.ubuntu.com
+        ubuntu_security:
+          source: "deb [arch=amd64] http://mirror.mirantis.com/${_param:apt_mk_version}/ubuntu/ ${_param:linux_system_codename}-security main restricted universe"
+          architectures: amd64
+          default: true
+          key_id: 437D05B5
+          key_server: keyserver.ubuntu.com
\ No newline at end of file
diff --git a/linux/system/repo/mcp/openstack.yml b/linux/system/repo/mcp/openstack.yml
index 8b91431..465b75d 100644
--- a/linux/system/repo/mcp/openstack.yml
+++ b/linux/system/repo/mcp/openstack.yml
@@ -10,39 +10,7 @@
           architectures: amd64
           key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename}/archive-mcp${_param:openstack_version}.key"
           pin:
-          - pin: 'release a=${_param:openstack_version}'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_hotfix:
-          source: "deb http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename} ${_param:openstack_version}-hotfix main"
-          architectures: amd64
-          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename}/archive-mcp${_param:openstack_version}.key"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-hotfix'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_security:
-          source: "deb http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename} ${_param:openstack_version}-security main"
-          architectures: amd64
-          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename}/archive-mcp${_param:openstack_version}.key"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-security'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_updates:
-          source: "deb http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename} ${_param:openstack_version}-updates main"
-          architectures: amd64
-          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename}/archive-mcp${_param:openstack_version}.key"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-updates'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_holdback:
-          source: "deb http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename} ${_param:openstack_version}-holdback main"
-          architectures: amd64
-          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename}/archive-mcp${_param:openstack_version}.key"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-holdback'
+          - pin: 'release l=${_param:openstack_version}'
             priority: 1100
             package: '*'
         mk_openstack:
@@ -50,6 +18,6 @@
           architectures: amd64
           key_url: "http://apt.mirantis.com/public.gpg"
           pin:
-          - pin: 'release a=${_param:linux_system_repo_mk_openstack_version}'
+          - pin: 'release l=${_param:linux_system_repo_mk_openstack_version}'
             priority: 1100
             package: '*'
diff --git a/linux/system/repo/saltstack/rhel.yml b/linux/system/repo/saltstack/rhel.yml
index b0f28f3..ba045c5 100644
--- a/linux/system/repo/saltstack/rhel.yml
+++ b/linux/system/repo/saltstack/rhel.yml
@@ -6,9 +6,11 @@
   linux:
     system:
       repo:
-        salt:
+        saltstack:
           humanname: "SaltStack repo for RHEL/CentOS ${rhel_repo_releasever}"
           source: "https://repo.saltstack.com/yum/redhat/${_param:rhel_releasever}/${_param:rhel_basearch}/${_param:salt_version}"
           gpgkey: "https://repo.saltstack.com/yum/redhat/${_param:rhel_releasever}/${_param:rhel_basearch}/${_param:salt_version}/SALTSTACK-GPG-KEY.pub"
           gpgcheck: true
           architectures: amd64
+        salt:
+          enabled: false
diff --git a/linux/system/repo/saltstack/trusty.yml b/linux/system/repo/saltstack/trusty.yml
index 68ce215..a4bde9a 100644
--- a/linux/system/repo/saltstack/trusty.yml
+++ b/linux/system/repo/saltstack/trusty.yml
@@ -4,7 +4,9 @@
   linux:
     system:
       repo:
-        salt:
+        saltstack:
           source: "deb http://repo.saltstack.com/apt/ubuntu/14.04/amd64/${_param:salt_version} trusty main"
           architectures: amd64
-          key_url: "http://repo.saltstack.com/apt/ubuntu/14.04/amd64/${_param:salt_version}/SALTSTACK-GPG-KEY.pub"
\ No newline at end of file
+          key_url: "http://repo.saltstack.com/apt/ubuntu/14.04/amd64/${_param:salt_version}/SALTSTACK-GPG-KEY.pub"
+        salt:
+          enabled: false
diff --git a/linux/system/repo/saltstack/xenial.yml b/linux/system/repo/saltstack/xenial.yml
index aca462a..e63ff41 100644
--- a/linux/system/repo/saltstack/xenial.yml
+++ b/linux/system/repo/saltstack/xenial.yml
@@ -4,7 +4,9 @@
   linux:
     system:
       repo:
-        salt:
+        saltstack:
           source: "deb http://repo.saltstack.com/apt/ubuntu/16.04/amd64/${_param:salt_version} xenial main"
           architectures: amd64
-          key_url: "http://repo.saltstack.com/apt/ubuntu/16.04/amd64/${_param:salt_version}/SALTSTACK-GPG-KEY.pub"
\ No newline at end of file
+          key_url: "http://repo.saltstack.com/apt/ubuntu/16.04/amd64/${_param:salt_version}/SALTSTACK-GPG-KEY.pub"
+        salt:
+          enabled: false
diff --git a/linux/system/repo/saltstack_2016_3_trusty.yml b/linux/system/repo/saltstack_2016_3_trusty.yml
index c7e03d7..d968734 100644
--- a/linux/system/repo/saltstack_2016_3_trusty.yml
+++ b/linux/system/repo/saltstack_2016_3_trusty.yml
@@ -3,6 +3,8 @@
   linux:
     system:
       repo:
-        salt:
+        saltstack:
           source: "deb http://repo.saltstack.com/apt/ubuntu/14.04/amd64/2016.3 trusty main"
-          key_url: "http://repo.saltstack.com/apt/ubuntu/14.04/amd64/2016.3/SALTSTACK-GPG-KEY.pub"
\ No newline at end of file
+          key_url: "http://repo.saltstack.com/apt/ubuntu/14.04/amd64/2016.3/SALTSTACK-GPG-KEY.pub"
+        salt:
+          enabled: false
diff --git a/linux/system/repo/saltstack_2016_3_xenial.yml b/linux/system/repo/saltstack_2016_3_xenial.yml
index 413294f..ee2189a 100644
--- a/linux/system/repo/saltstack_2016_3_xenial.yml
+++ b/linux/system/repo/saltstack_2016_3_xenial.yml
@@ -3,6 +3,8 @@
   linux:
     system:
       repo:
-        salt:
+        saltstack:
           source: "deb http://repo.saltstack.com/apt/ubuntu/16.04/amd64/2016.3 xenial main"
-          key_url: "http://repo.saltstack.com/apt/ubuntu/16.04/amd64/2016.3/SALTSTACK-GPG-KEY.pub"
\ No newline at end of file
+          key_url: "http://repo.saltstack.com/apt/ubuntu/16.04/amd64/2016.3/SALTSTACK-GPG-KEY.pub"
+        salt:
+          enabled: false
diff --git a/linux/system/repo_local/mcp/apt_mirantis/aptly.yml b/linux/system/repo_local/mcp/apt_mirantis/aptly.yml
new file mode 100644
index 0000000..cc9e7d4
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/aptly.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_aptly_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_aptly:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/aptly/ ${_param:linux_system_repo_mcp_aptly_version} main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_aptly_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/cassandra.yml b/linux/system/repo_local/mcp/apt_mirantis/cassandra.yml
new file mode 100644
index 0000000..ed767ab
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/cassandra.yml
@@ -0,0 +1,17 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_cassandra_version: ${_param:apt_mk_version}
+    linux_system_repo_mcp_cassandra_version_number: "21x"
+  linux:
+    system:
+      repo:
+        mcp_cassandra:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/cassandra/ ${_param:linux_system_repo_mcp_cassandra_version} ${_param:linux_system_repo_mcp_cassandra_version_number}"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_cassandra_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/ceph.yml b/linux/system/repo_local/mcp/apt_mirantis/ceph.yml
new file mode 100644
index 0000000..05f4957
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/ceph.yml
@@ -0,0 +1,17 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_ceph_version: ${_param:apt_mk_version}
+    linux_system_repo_mcp_ceph_codename: luminous
+  linux:
+    system:
+      repo:
+        mcp_ceph:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ceph/ ${_param:linux_system_repo_mcp_ceph_version} ${_param:linux_system_repo_mcp_ceph_codename}"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_ceph_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/docker.yml b/linux/system/repo_local/mcp/apt_mirantis/docker.yml
new file mode 100644
index 0000000..84fed9f
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/docker.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_docker_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_docker:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/docker/ ${_param:linux_system_repo_mcp_docker_version} stable"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_docker_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/docker_legacy.yml b/linux/system/repo_local/mcp/apt_mirantis/docker_legacy.yml
new file mode 100644
index 0000000..9b85ea2
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/docker_legacy.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_docker_legacy_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_docker_legacy:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/docker/ ${_param:linux_system_repo_mcp_docker_legacy_version} legacy"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_docker_legacy_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/elastic/2x.yml b/linux/system/repo_local/mcp/apt_mirantis/elastic/2x.yml
new file mode 100644
index 0000000..3cade96
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/elastic/2x.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_elastic_2x_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_elastic_2x:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/elastic/2.x/ ${_param:linux_system_repo_mcp_elastic_2x_version} main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_elastic_2x_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/elastic/5x.yml b/linux/system/repo_local/mcp/apt_mirantis/elastic/5x.yml
new file mode 100644
index 0000000..7349f72
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/elastic/5x.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_elastic_5x_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_elastic_5x:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/elastic/5.x/ ${_param:linux_system_repo_mcp_elastic_5x_version} main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_elastic_5x_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/elastic/init.yml b/linux/system/repo_local/mcp/apt_mirantis/elastic/init.yml
new file mode 100644
index 0000000..f356aa2
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/elastic/init.yml
@@ -0,0 +1,3 @@
+classes:
+- system.linux.system.repo_local.mcp.apt_mirantis.elastic.2x
+- system.linux.system.repo_local.mcp.apt_mirantis.elastic.5x
\ No newline at end of file
diff --git a/linux/system/repo_local/mcp/apt_mirantis/fluentd.yml b/linux/system/repo_local/mcp/apt_mirantis/fluentd.yml
new file mode 100644
index 0000000..40682d7
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/fluentd.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_fluentd_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_fluentd:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/fluentd/ ${_param:linux_system_repo_mcp_fluentd_version} main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_fluentd_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/glusterfs.yml b/linux/system/repo_local/mcp/apt_mirantis/glusterfs.yml
new file mode 100644
index 0000000..ca7e1bd
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/glusterfs.yml
@@ -0,0 +1,17 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_glusterfs_version: ${_param:apt_mk_version}
+    linux_system_repo_mcp_glusterfs_version_number: "3.12"
+  linux:
+    system:
+      repo:
+        mcp_glusterfs:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/glusterfs/ ${_param:linux_system_repo_mcp_glusterfs_version} ${_param:linux_system_repo_mcp_glusterfs_version_number}"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_glusterfs_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/grafana.yml b/linux/system/repo_local/mcp/apt_mirantis/grafana.yml
new file mode 100644
index 0000000..5ba6a63
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/grafana.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_grafana_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_grafana:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/grafana/ ${_param:linux_system_repo_mcp_grafana_version} main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_grafana_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/influxdb.yml b/linux/system/repo_local/mcp/apt_mirantis/influxdb.yml
new file mode 100644
index 0000000..6bd6509
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/influxdb.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_influxdb_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_influxdb:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/influxdb/ ${_param:linux_system_repo_mcp_influxdb_version} main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_influxdb_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/kibana/46.yml b/linux/system/repo_local/mcp/apt_mirantis/kibana/46.yml
new file mode 100644
index 0000000..7fa87a0
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/kibana/46.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_kibana_46_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_kibana_46:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/kibana/4.6/ ${_param:linux_system_repo_mcp_kibana_46_version} kibana-46"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_kibana_46_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/kibana/5x.yml b/linux/system/repo_local/mcp/apt_mirantis/kibana/5x.yml
new file mode 100644
index 0000000..2441568
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/kibana/5x.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_kibana_5x_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_kibana_5x:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/kibana/5.x/ ${_param:linux_system_repo_mcp_kibana_5x_version} kibana-5x"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_kibana_5x_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/kibana/init.yml b/linux/system/repo_local/mcp/apt_mirantis/kibana/init.yml
new file mode 100644
index 0000000..fe9ec2e
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/kibana/init.yml
@@ -0,0 +1,3 @@
+classes:
+- system.linux.system.repo_local.mcp.apt_mirantis.kibana.46
+- system.linux.system.repo_local.mcp.apt_mirantis.kibana.5x
\ No newline at end of file
diff --git a/linux/system/repo_local/mcp/apt_mirantis/maas.yml b/linux/system/repo_local/mcp/apt_mirantis/maas.yml
new file mode 100644
index 0000000..63f82c2
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/maas.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_maas_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_maas:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/maas/ ${_param:linux_system_repo_mcp_maas_version} main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_maas_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/openstack.yml b/linux/system/repo_local/mcp/apt_mirantis/openstack.yml
new file mode 100644
index 0000000..0ce7d41
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/openstack.yml
@@ -0,0 +1,15 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mk_openstack_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mirantis_openstack:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/openstack/${_param:openstack_version} ${_param:linux_system_repo_mk_openstack_version} main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          pin:
+          - pin: 'release l=${_param:openstack_version}'
+            priority: 1100
+            package: '*'
\ No newline at end of file
diff --git a/linux/system/repo_local/mcp/apt_mirantis/saltstack_2016_3.yml b/linux/system/repo_local/mcp/apt_mirantis/saltstack_2016_3.yml
new file mode 100644
index 0000000..1cd567a
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/saltstack_2016_3.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_saltstack_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_saltstack:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/salt/2016.3/ ${_param:linux_system_repo_mcp_saltstack_version} main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_saltstack_version}'
+            priority: 1100
+            package: '*'
\ No newline at end of file
diff --git a/linux/system/repo_local/mcp/apt_mirantis/sensu.yml b/linux/system/repo_local/mcp/apt_mirantis/sensu.yml
new file mode 100644
index 0000000..5cd16cf
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/sensu.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mcp_extra_version: ${_param:apt_mk_version}
+  linux:
+    system:
+      repo:
+        mcp_extra:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/sensu/ ${_param:linux_system_repo_mcp_extra_version} main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          clean_file: true
+          pin:
+          - pin: 'release a=${_param:linux_system_repo_mcp_extra_version}'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/apt_mirantis/ubuntu.yml b/linux/system/repo_local/mcp/apt_mirantis/ubuntu.yml
new file mode 100644
index 0000000..d510183
--- /dev/null
+++ b/linux/system/repo_local/mcp/apt_mirantis/ubuntu.yml
@@ -0,0 +1,23 @@
+parameters:
+  linux:
+    system:
+      repo:
+        ubuntu:
+          refresh_db: ${_param:linux_repo_refresh_db}
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu ${_param:linux_system_codename} main universe restricted"
+          architectures: amd64
+          default: true
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+        ubuntu-updates:
+          refresh_db: ${_param:linux_repo_refresh_db}
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu ${_param:linux_system_codename}-updates main universe restricted"
+          architectures: amd64
+          default: true
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+        ubuntu-security:
+          refresh_db: ${_param:linux_repo_refresh_db}
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu ${_param:linux_system_codename}-security main universe restricted"
+          architectures: amd64
+          default: true
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+
diff --git a/linux/system/repo_local/mcp/extra.yml b/linux/system/repo_local/mcp/extra.yml
index c55ecfc..90339d3 100644
--- a/linux/system/repo_local/mcp/extra.yml
+++ b/linux/system/repo_local/mcp/extra.yml
@@ -15,3 +15,6 @@
           - pin: 'release a=${_param:linux_system_repo_mcp_extra_version}'
             priority: 1100
             package: '*'
+          - pin: 'release a=${_param:linux_system_repo_mcp_extra_version}'
+            priority: 500
+            package: 'libsodium18'
diff --git a/linux/system/repo_local/mcp/openstack.yml b/linux/system/repo_local/mcp/openstack.yml
index 83bb29b..2e69ef2 100644
--- a/linux/system/repo_local/mcp/openstack.yml
+++ b/linux/system/repo_local/mcp/openstack.yml
@@ -1,4 +1,7 @@
 parameters:
+  _param:
+    apt_mk_version: stable
+    linux_system_repo_mk_openstack_version: ${_param:apt_mk_version}
   linux:
     system:
       repo:
@@ -7,39 +10,14 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release a=${_param:openstack_version}'
+          - pin: 'release l=${_param:openstack_version}'
             priority: 1100
             package: '*'
-        mirantis_openstack_hotfix:
-          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version}-hotfix main"
+        mk_openstack:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:linux_system_repo_mk_openstack_version} ${_param:openstack_version}"
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release a=${_param:openstack_version}-hotfix'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_security:
-          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version}-security main"
-          architectures: amd64
-          key_url: "http://${_param:local_repo_url}/public.gpg"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-security'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_updates:
-          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version}-updates main"
-          architectures: amd64
-          key_url: "http://${_param:local_repo_url}/public.gpg"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-updates'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_holdback:
-          refresh_db: ${_param:linux_repo_refresh_db}
-          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version}-holdback main"
-          architectures: amd64
-          key_url: "http://${_param:local_repo_url}/public.gpg"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-holdback'
+          - pin: 'release l=${_param:linux_system_repo_mk_openstack_version}'
             priority: 1100
             package: '*'
diff --git a/linux/system/repo_local/ubuntu.yml b/linux/system/repo_local/ubuntu.yml
index d510183..46994ee 100644
--- a/linux/system/repo_local/ubuntu.yml
+++ b/linux/system/repo_local/ubuntu.yml
@@ -20,4 +20,3 @@
           architectures: amd64
           default: true
           key_url: "http://${_param:local_repo_url}/public.gpg"
-
diff --git a/linux/system/single/init.yml b/linux/system/single/init.yml
index 8de2dda..c7c583b 100644
--- a/linux/system/single/init.yml
+++ b/linux/system/single/init.yml
@@ -21,6 +21,10 @@
           version: purged
         mcelog:
           version: latest
+      apt:
+        config:
+          compression-workaround:
+            "Acquire::CompressionTypes::Order": "gz"
       kernel:
         modules:
           - nf_conntrack
diff --git a/maas/region/restoredb.yml b/maas/region/restoredb.yml
new file mode 100644
index 0000000..df4ff95
--- /dev/null
+++ b/maas/region/restoredb.yml
@@ -0,0 +1,9 @@
+classes:
+- system.maas.region.single
+parameters:
+  maas:
+    region:
+      database:
+        initial_data:
+          source: ${linux:network:fqdn}
+          host: ${_param:backupninja_backup_host}
\ No newline at end of file
diff --git a/maas/region/single.yml b/maas/region/single.yml
index 20779aa..3fdc105 100644
--- a/maas/region/single.yml
+++ b/maas/region/single.yml
@@ -36,7 +36,7 @@
         dnssec_validation: 'no'
         enable_third_party_drivers: true
         maas_name: mas01
-        active_discovery_interval: '600'
+        active_discovery_interval: 600
         ntp_external_only: true
         upstream_dns: ${_param:dns_server01}
         enable_http_proxy: false
diff --git a/mysql/client/database/panko.yml b/mysql/client/database/panko.yml
new file mode 100644
index 0000000..e0463ef
--- /dev/null
+++ b/mysql/client/database/panko.yml
@@ -0,0 +1,17 @@
+parameters:
+  mysql:
+    client:
+      server:
+        database:
+          database:
+            panko:
+              encoding: utf8
+              users:
+              - name: panko
+                password: ${_param:mysql_panko_password}
+                host: '%'
+                rights: all
+              - name: panko
+                password: ${_param:mysql_panko_password}
+                host: ${_param:single_address}
+                rights: all
diff --git a/neutron/client/service/ironic_provision.yml b/neutron/client/service/ironic_provision.yml
new file mode 100644
index 0000000..fc545b6
--- /dev/null
+++ b/neutron/client/service/ironic_provision.yml
@@ -0,0 +1,21 @@
+classes:
+- service.neutron.client
+parameters:
+  neutron:
+    client:
+      server:
+        admin_identity:
+          endpoint_type: internalURL
+          network:
+            baremetal-provision-network:
+              tenant: admin
+              shared: false
+              admin_state_up: True
+              port_security_enabled: false
+              subnet:
+                baremetal-provision-subnet:
+                  cidr: ${_param:openstack_baremetal_neutron_subnet_cidr}
+                  allocation_pools:
+                    - start: ${_param:openstack_baremetal_neutron_subnet_allocation_start}
+                      end: ${_param:openstack_baremetal_neutron_subnet_allocation_end}
+                  enable_dhcp: true
diff --git a/neutron/compute/nfv/dpdk.yml b/neutron/compute/nfv/dpdk.yml
index 3f05d53..0901bb8 100644
--- a/neutron/compute/nfv/dpdk.yml
+++ b/neutron/compute/nfv/dpdk.yml
@@ -1,4 +1,6 @@
 parameters:
+  _param:
+    compute_ovs_vhost_socket_dir: "/run/openvswitch-vhost"
   linux:
     network:
       bridge: openvswitch
@@ -10,6 +12,10 @@
         dpdk_socket_mem: "${_param:compute_ovs_dpdk_socket_mem}"
         dpdk_lcore_mask: "${_param:compute_ovs_dpdk_lcore_mask}"
         memory_channels: "${_param:compute_ovs_memory_channels}"
+        vhost_socket_dir:
+          name: "openvswitch-vhost"
+          path: "${_param:compute_ovs_vhost_socket_dir}"
   neutron:
     compute:
       dpdk: True
+      vhost_socket_dir: "${_param:compute_ovs_vhost_socket_dir}"
diff --git a/neutron/control/cluster.yml b/neutron/control/cluster.yml
index 47928b6..ea9596d 100644
--- a/neutron/control/cluster.yml
+++ b/neutron/control/cluster.yml
@@ -21,15 +21,15 @@
           - address: ${_param:cluster_vip_address}
             port: 9696
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 9696
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 9696
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 9696
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
diff --git a/neutron/control/openvswitch/cluster.yml b/neutron/control/openvswitch/cluster.yml
index 032ffbf..80489c8 100644
--- a/neutron/control/openvswitch/cluster.yml
+++ b/neutron/control/openvswitch/cluster.yml
@@ -47,15 +47,15 @@
           - address: ${_param:cluster_vip_address}
             port: 9696
           servers:
-          - name: ctl01
+          - name: ${_param:cluster_node01_hostname}
             host: ${_param:cluster_node01_address}
             port: 9696
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl02
+          - name: ${_param:cluster_node02_hostname}
             host: ${_param:cluster_node02_address}
             port: 9696
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
-          - name: ctl03
+          - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 9696
             params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
diff --git a/neutron/gateway/cluster.yml b/neutron/gateway/cluster.yml
index c96c6bb..558a814 100644
--- a/neutron/gateway/cluster.yml
+++ b/neutron/gateway/cluster.yml
@@ -4,6 +4,11 @@
   _param:
     neutron_enable_qos: False
     neutron_enable_vlan_aware_vms: False
+  linux:
+    system:
+      kernel:
+        sysctl:
+          fs.inotify.max_user_instances: 4096
   neutron:
     gateway:
       dvr: ${_param:neutron_gateway_dvr}
diff --git a/nginx/server/proxy/openstack/barbican.yml b/nginx/server/proxy/openstack/barbican.yml
index 5f658d1..89e5a9c 100644
--- a/nginx/server/proxy/openstack/barbican.yml
+++ b/nginx/server/proxy/openstack/barbican.yml
@@ -1,6 +1,8 @@
 parameters:
   _param:
     nginx_proxy_openstack_api_host: ${_param:cluster_public_host}
+    nginx_proxy_openstack_api_address: 0.0.0.0
+    nginx_proxy_openstack_barbican_host: ${_param:barbican_service_host}
   nginx:
     server:
       enabled: true
@@ -11,10 +13,11 @@
           name: openstack_api_barbican
           check: false
           proxy:
-            host: ${_param:barbican_service_host}
+            host: ${_param:nginx_proxy_openstack_barbican_host}
             port: 9311
             protocol: http
           host:
             name: ${_param:nginx_proxy_openstack_api_host}
             port: 9311
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
diff --git a/nginx/server/proxy/openstack/designate.yml b/nginx/server/proxy/openstack/designate.yml
index 29bc390..c238775 100644
--- a/nginx/server/proxy/openstack/designate.yml
+++ b/nginx/server/proxy/openstack/designate.yml
@@ -1,6 +1,8 @@
 parameters:
   _param:
     nginx_proxy_openstack_api_host: ${_param:cluster_public_host}
+    nginx_proxy_openstack_api_address: 0.0.0.0
+    nginx_proxy_openstack_designate_host: ${_param:designate_service_host}
   nginx:
     server:
       enabled: true
@@ -10,10 +12,11 @@
           type: nginx_proxy
           name: openstack_api_designate
           proxy:
-            host: ${_param:nginx_proxy_openstack_api_proxy_host}
+            host: ${_param:nginx_proxy_openstack_designate_host}
             port: 9001
             protocol: http
           host:
             name: ${_param:nginx_proxy_openstack_api_host}
             port: 9001
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
diff --git a/nginx/server/proxy/openstack/glare.yml b/nginx/server/proxy/openstack/glare.yml
new file mode 100644
index 0000000..898f622
--- /dev/null
+++ b/nginx/server/proxy/openstack/glare.yml
@@ -0,0 +1,22 @@
+parameters:
+  _param:
+    nginx_proxy_openstack_api_host: ${_param:cluster_public_host}
+  nginx:
+    server:
+      enabled: true
+      site:
+        nginx_proxy_openstack_api_glare:
+          enabled: true
+          type: nginx_proxy
+          name: openstack_api_glare
+          underscores_in_headers: true
+          check: false
+          proxy:
+            host: ${_param:glance_service_host}
+            port: 9494
+            protocol: http
+            size: 30000m
+          host:
+            name: ${_param:nginx_proxy_openstack_api_host}
+            port: 9494
+          ssl: ${_param:nginx_proxy_ssl}
diff --git a/nginx/server/proxy/openstack/horizon.yml b/nginx/server/proxy/openstack/horizon.yml
index 13df5cb..03e3f3c 100644
--- a/nginx/server/proxy/openstack/horizon.yml
+++ b/nginx/server/proxy/openstack/horizon.yml
@@ -1,4 +1,8 @@
 parameters:
+  _param:
+    nginx_proxy_openstack_api_host: ${_param:cluster_public_host}
+    nginx_proxy_openstack_api_address: 0.0.0.0
+    nginx_proxy_openstack_horizon_host: ${_param:openstack_proxy_address}
   nginx:
     server:
       enabled: true
@@ -8,11 +12,12 @@
           type: nginx_proxy
           name: horizon
           proxy:
-            host: ${_param:openstack_proxy_address}
+            host: ${_param:nginx_proxy_openstack_horizon_host}
             port: 443
             protocol: https
           host:
-            name: ${_param:cluster_public_host}
+            name: ${_param:nginx_proxy_openstack_api_host}
             port: 443
             protocol: https
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
diff --git a/nginx/server/proxy/openstack/placement.yml b/nginx/server/proxy/openstack/placement.yml
new file mode 100644
index 0000000..eda272c
--- /dev/null
+++ b/nginx/server/proxy/openstack/placement.yml
@@ -0,0 +1,22 @@
+parameters:
+  _param:
+    nginx_proxy_openstack_api_host: ${_param:cluster_public_host}
+    nginx_proxy_openstack_api_address: 0.0.0.0
+    nginx_proxy_openstack_placement_host: ${_param:placement_service_host}
+  nginx:
+    server:
+      enabled: true
+      site:
+        nginx_proxy_openstack_api_placement:
+          enabled: true
+          type: nginx_proxy
+          name: openstack_api_placement
+          proxy:
+            host: ${_param:nginx_proxy_openstack_placement_host}
+            port: 8778
+            protocol: http
+          host:
+            name: ${_param:nginx_proxy_openstack_api_host}
+            port: 8778
+            address: ${_param:nginx_proxy_openstack_api_address}
+          ssl: ${_param:nginx_proxy_ssl}
diff --git a/nginx/server/proxy/openstack_api.yml b/nginx/server/proxy/openstack_api.yml
index 4b0b3f4..4f6073d 100644
--- a/nginx/server/proxy/openstack_api.yml
+++ b/nginx/server/proxy/openstack_api.yml
@@ -1,6 +1,13 @@
 parameters:
   _param:
     nginx_proxy_openstack_api_host: ${_param:cluster_public_host}
+    nginx_proxy_openstack_api_address: 0.0.0.0
+    nginx_proxy_openstack_keystone_host: ${_param:keystone_service_host}
+    nginx_proxy_openstack_nova_host: ${_param:nova_service_host}
+    nginx_proxy_openstack_cinder_host: ${_param:cinder_service_host}
+    nginx_proxy_openstack_glance_host: ${_param:glance_service_host}
+    nginx_proxy_openstack_neutron_host: ${_param:neutron_service_host}
+    nginx_proxy_openstack_heat_host: ${_param:heat_service_host}
   nginx:
     server:
       enabled: true
@@ -11,12 +18,13 @@
           name: openstack_api_keystone
           check: false
           proxy:
-            host: ${_param:keystone_service_host}
+            host: ${_param:nginx_proxy_openstack_keystone_host}
             port: 5000
             protocol: http
           host:
             name: ${_param:nginx_proxy_openstack_api_host}
             port: 5000
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
         nginx_proxy_openstack_api_keystone_private:
           enabled: true
@@ -24,12 +32,13 @@
           name: openstack_api_keystone_private
           check: false
           proxy:
-            host: ${_param:keystone_service_host}
+            host: ${_param:nginx_proxy_openstack_keystone_host}
             port: 35357
             protocol: http
           host:
             name: ${_param:nginx_proxy_openstack_api_host}
             port: 35357
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
         nginx_proxy_openstack_api_nova:
           enabled: true
@@ -37,12 +46,13 @@
           name: openstack_api_nova
           check: false
           proxy:
-            host: ${_param:nova_service_host}
+            host: ${_param:nginx_proxy_openstack_nova_host}
             port: 8774
             protocol: http
           host:
             name: ${_param:nginx_proxy_openstack_api_host}
             port: 8774
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
         nginx_proxy_openstack_api_cinder:
           enabled: true
@@ -50,12 +60,13 @@
           name: openstack_api_cinder
           check: false
           proxy:
-            host: ${_param:cinder_service_host}
+            host: ${_param:nginx_proxy_openstack_cinder_host}
             port: 8776
             protocol: http
           host:
             name: ${_param:nginx_proxy_openstack_api_host}
             port: 8776
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
         nginx_proxy_openstack_api_glance:
           enabled: true
@@ -64,13 +75,14 @@
           check: false
           underscores_in_headers: true
           proxy:
-            host: ${_param:glance_service_host}
+            host: ${_param:nginx_proxy_openstack_glance_host}
             port: 9292
             protocol: http
             size: 30000m
           host:
             name: ${_param:nginx_proxy_openstack_api_host}
             port: 9292
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
         nginx_proxy_openstack_api_neutron:
           enabled: true
@@ -78,36 +90,39 @@
           name: openstack_api_neutron
           check: false
           proxy:
-            host: ${_param:neutron_service_host}
+            host: ${_param:nginx_proxy_openstack_neutron_host}
             port: 9696
             protocol: http
           host:
             name: ${_param:nginx_proxy_openstack_api_host}
             port: 9696
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
         nginx_proxy_openstack_api_heat_cloudwatch:
           enabled: true
           type: nginx_proxy
           name: openstack_api_heat_cloudwatch
           proxy:
-            host: ${_param:heat_service_host}
+            host: ${_param:nginx_proxy_openstack_heat_host}
             port: 8003
             protocol: http
           host:
             name: ${_param:nginx_proxy_openstack_api_host}
             port: 8003
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
         nginx_proxy_openstack_api_heat_cfn:
           enabled: true
           type: nginx_proxy
           name: openstack_api_heat_cfn
           proxy:
-            host: ${_param:heat_service_host}
+            host: ${_param:nginx_proxy_openstack_heat_host}
             port: 8000
             protocol: http
           host:
             name: ${_param:nginx_proxy_openstack_api_host}
             port: 8000
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
         nginx_proxy_openstack_api_heat:
           enabled: true
@@ -115,12 +130,13 @@
           name: openstack_api_heat
           check: false
           proxy:
-            host: ${_param:heat_service_host}
+            host: ${_param:nginx_proxy_openstack_heat_host}
             port: 8004
             protocol: http
           host:
             name: ${_param:nginx_proxy_openstack_api_host}
             port: 8004
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
         nginx_proxy_openstack_api_nova_ec2:
           enabled: true
@@ -128,10 +144,11 @@
           name: openstack_api_nova_ec2
           check: false
           proxy:
-            host: ${_param:nova_service_host}
+            host: ${_param:nginx_proxy_openstack_nova_host}
             port: 8773
             protocol: http
           host:
             name: ${_param:nginx_proxy_openstack_api_host}
             port: 8773
+            address: ${_param:nginx_proxy_openstack_api_address}
           ssl: ${_param:nginx_proxy_ssl}
diff --git a/nginx/server/proxy/oss/devops_portal.yml b/nginx/server/proxy/oss/devops_portal.yml
new file mode 100644
index 0000000..7e313bc
--- /dev/null
+++ b/nginx/server/proxy/oss/devops_portal.yml
@@ -0,0 +1,20 @@
+parameters:
+  nginx:
+    server:
+      enabled: true
+      site:
+        nginx_devops_portal:
+          enabled: true
+          type: nginx_proxy
+          name: devops_portal
+          check: false
+          proxy:
+            host: ${_param:stacklight_monitor_address}
+            port: 8800
+            protocol: http
+            websocket: true
+          host:
+            name: ${_param:cluster_public_host}
+            port: 8800
+            protocol: https
+          ssl: ${_param:nginx_proxy_ssl}
diff --git a/nginx/server/proxy/oss/rundeck.yml b/nginx/server/proxy/oss/rundeck.yml
new file mode 100644
index 0000000..e6a0303
--- /dev/null
+++ b/nginx/server/proxy/oss/rundeck.yml
@@ -0,0 +1,20 @@
+parameters:
+  nginx:
+    server:
+      enabled: true
+      site:
+        nginx_rundeck:
+          enabled: true
+          type: nginx_proxy
+          name: rundeck
+          check: false
+          proxy:
+            host: ${_param:stacklight_monitor_address}
+            port: 4440
+            protocol: http
+            websocket: true
+          host:
+            name: ${_param:cluster_public_host}
+            port: 4440
+            protocol: https
+          ssl: ${_param:nginx_proxy_ssl}
diff --git a/nova/compute/cluster.yml b/nova/compute/cluster.yml
index e8b29cc..5d0e6a1 100644
--- a/nova/compute/cluster.yml
+++ b/nova/compute/cluster.yml
@@ -1,6 +1,5 @@
 classes:
 - service.nova.compute.kvm
-- service.iptables.server
 parameters:
   _param:
     nova_vncproxy_url: https://${_param:cluster_public_host}:6080
@@ -95,15 +94,3 @@
         public_key: ${_param:nova_compute_ssh_public}
         private_key: ${_param:nova_compute_ssh_private}
       my_ip: ${_param:single_address}
-      libvirt:
-        uri: qemu+unix:///system?socket=/var/run/libvirt/libvirt-sock
-  iptables:
-    service:
-      enabled: true
-      chain:
-        INPUT:
-          rules:
-            # deny any connections to libvirt port
-            - destination_port: 16509
-              protocol: tcp
-              jump: DROP
\ No newline at end of file
diff --git a/nova/compute/single.yml b/nova/compute/single.yml
index d5126df..b915145 100644
--- a/nova/compute/single.yml
+++ b/nova/compute/single.yml
@@ -2,7 +2,6 @@
 - nova
 classes:
 - service.nova.compute.kvm
-- service.iptables.server
 parameters:
   _param:
     nova_vncproxy_url: https://${_param:cluster_public_host}:6080
@@ -91,15 +90,3 @@
         public_key: ${_param:nova_compute_ssh_public}
         private_key: ${_param:nova_compute_ssh_private}
       my_ip: ${_param:single_address}
-      libvirt:
-        uri: qemu+unix:///system?socket=/var/run/libvirt/libvirt-sock
-  iptables:
-    service:
-      enabled: true
-      chain:
-        INPUT:
-          rules:
-            # deny any connections to libvirt port
-            - destination_port: 16509
-              protocol: tcp
-              jump: DROP
\ No newline at end of file
diff --git a/nova/control/cluster.yml b/nova/control/cluster.yml
index dee725d..3b8877d 100644
--- a/nova/control/cluster.yml
+++ b/nova/control/cluster.yml
@@ -29,11 +29,6 @@
       ram_allocation_ratio: ${_param:nova_ram_allocation_ratio}
       disk_allocation_ratio: ${_param:nova_disk_allocation_ratio}
       workers: 8
-      logging:
-      - engine: syslog
-        facility: local0
-        heka:
-          enabled: true
       bind:
         private_address: ${_param:cluster_local_address}
         public_address: ${_param:cluster_vip_address}
diff --git a/opencontrail/client/resource/global_vrouter_config.yml b/opencontrail/client/resource/global_vrouter_config.yml
index 15bf76e..9537775 100644
--- a/opencontrail/client/resource/global_vrouter_config.yml
+++ b/opencontrail/client/resource/global_vrouter_config.yml
@@ -2,7 +2,7 @@
   opencontrail:
     client:
       global_vrouter_config:
-        name: global-vrouter-config
+        name: default-global-vrouter-config
         parent_type: global-system-config
         encap_priority: "MPLSoUDP,MPLSoGRE"
         vxlan_vn_id_mode: automatic
diff --git a/opencontrail/client/resource/llgr.yml b/opencontrail/client/resource/llgr.yml
new file mode 100644
index 0000000..aff3ffb
--- /dev/null
+++ b/opencontrail/client/resource/llgr.yml
@@ -0,0 +1,18 @@
+parameters:
+  _param:
+    opencontrail_gsc_grp_enable: True
+    opencontrail_gsc_grp_restart_time: 60
+    opencontrail_gsc_grp_end_of_rib_timeout: 30
+    opencontrail_gsc_grp_bgp_helper_enable: False
+    opencontrail_gsc_grp_xmpp_helper_enable: False
+    opencontrail_gsc_grp_long_lived_restart_time: 300
+  opencontrail:
+    client:
+      global_system_config:
+        grp:
+          enable: ${_param:opencontrail_gsc_grp_enable}
+          restart_time: ${_param:opencontrail_gsc_grp_restart_time}
+          end_of_rib_timeout: ${_param:opencontrail_gsc_grp_end_of_rib_timeout}
+          bgp_helper_enable: ${_param:opencontrail_gsc_grp_bgp_helper_enable}
+          xmpp_helper_enable: ${_param:opencontrail_gsc_grp_xmpp_helper_enable}
+          long_lived_restart_time: ${_param:opencontrail_gsc_grp_long_lived_restart_time}
diff --git a/opencontrail/compute/upgrade.yml b/opencontrail/compute/upgrade.yml
new file mode 100644
index 0000000..d1e4894
--- /dev/null
+++ b/opencontrail/compute/upgrade.yml
@@ -0,0 +1,14 @@
+parameters:
+  opencontrail:
+    compute:
+      control:
+        members:
+        - host: ${_param:opencontrail_control_node01_address}
+        - host: ${_param:opencontrail_control_node02_address}
+      collector:
+        members:
+        - host: ${_param:opencontrail_analytics_node01_address}
+        - host: ${_param:opencontrail_analytics_node02_address}
+        - host: ${_param:opencontrail_analytics_node03_address}
+      discovery:
+        enabled: False
diff --git a/opencontrail/control/analytics.yml b/opencontrail/control/analytics.yml
index 8065742..6e56936 100644
--- a/opencontrail/control/analytics.yml
+++ b/opencontrail/control/analytics.yml
@@ -4,6 +4,9 @@
 - service.opencontrail.control.analytics
 - system.haproxy.proxy.listen.opencontrail.analytics
 parameters:
+  _param:
+    opencontrail_kafka_log_cleanup_mtime: '+7'
+    opencontrail_kafka_log_cleanup_dir: '/usr/share/kafka/logs/'
 # Temprorary fix for MOS9 packages to pin old version of kafka
   linux:
     system:
@@ -17,6 +20,12 @@
       kernel:
         modules:
         - nf_conntrack_ipv4
+      job:
+        kafka_logs_cleanup:
+          command: "find ${_param:opencontrail_kafka_log_cleanup_dir} -name '*.log.*' -type f -mtime ${_param:opencontrail_kafka_log_cleanup_mtime} -exec rm {} \\;"
+          identifier: kafka_logs_cleanup
+          hour: 0
+          minute: 0
   opencontrail:
     common:
       identity:
diff --git a/opencontrail/control/analytics4_0.yml b/opencontrail/control/analytics4_0.yml
index a122830..9614d61 100644
--- a/opencontrail/control/analytics4_0.yml
+++ b/opencontrail/control/analytics4_0.yml
@@ -5,39 +5,43 @@
 - system.haproxy.proxy.listen.opencontrail.analytics
 parameters:
   _param:
+    opencontrail_kafka_log_cleanup_mtime: '+7'
+    opencontrail_kafka_log_cleanup_dir: '/usr/share/kafka/logs/'
     opencontrail_version: 4.0
     linux_repo_contrail_component: oc40
     opencontrail_message_queue_node01_address: ${_param:openstack_message_queue_node01_address}
     opencontrail_message_queue_node02_address: ${_param:openstack_message_queue_node02_address}
     opencontrail_message_queue_node03_address: ${_param:openstack_message_queue_node03_address}
     opencontrail_message_queue_address: ${_param:openstack_message_queue_address}
+    opencontrail_analytics_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-analytics
+    opencontrail_analyticsdb_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-analyticsdb
+    opencontrail_analytics_container_name: opencontrail_analytics_1
+    opencontrail_analyticsdb_container_name: opencontrail_analyticsdb_1
 # Temprorary fix for MOS9 packages to pin old version of kafka
   linux:
     system:
-      package:
-        librdkafka1:
-          version: 0.9.0-0contrail0
-          hold: true
-        python-kafka:
-          version: 1.0.1-0contrail1
-          hold: true
       kernel:
         modules:
         - nf_conntrack_ipv4
+      job:
+        kafka_logs_cleanup:
+          command: "find ${_param:opencontrail_kafka_log_cleanup_dir} -name '*.log.*' -type f -mtime ${_param:opencontrail_kafka_log_cleanup_mtime} -exec rm {} \\;"
+          identifier: kafka_logs_cleanup
+          hour: 0
+          minute: 0
   opencontrail:
     common:
+      config_only: true
       identity:
         host: ${_param:openstack_control_address}
       network:
         host: ${_param:openstack_control_address}
     collector:
+      config_only: true
       discovery:
         host: None
-      database:
-        members:
-        - host: ${_param:opencontrail_analytics_node01_address}
-        - host: ${_param:opencontrail_analytics_node02_address}
-        - host: ${_param:opencontrail_analytics_node03_address}
+      identity:
+        host: ${_param:openstack_control_address}
       analytics:
         members:
         - host: ${_param:opencontrail_analytics_node01_address}
@@ -55,6 +59,7 @@
         - host: ${_param:opencontrail_control_node02_address}
         - host: ${_param:opencontrail_control_node03_address}
     database:
+      config_only: true
       discovery:
         host: None
       analytics:
@@ -62,3 +67,39 @@
         - host: ${_param:opencontrail_analytics_node01_address}
         - host: ${_param:opencontrail_analytics_node02_address}
         - host: ${_param:opencontrail_analytics_node03_address}
+  docker:
+    client:
+      compose:
+        opencontrail:
+          status: up
+          pull: true
+          service:
+            analytics:
+              image: ${_param:opencontrail_analytics_image}
+              container_name: ${_param:opencontrail_analytics_container_name}
+              network_mode: "host"
+              privileged: true
+              restart: always
+              volumes:
+                - /etc/contrail:/etc/contrail
+                - /etc/redis/redis.conf:/etc/redis/redis.conf
+            analyticsdb:
+              image: ${_param:opencontrail_analyticsdb_image}
+              container_name: ${_param:opencontrail_analyticsdb_container_name}
+              volumes:
+                - /etc/cassandra/cassandra-env-analytics.sh:/etc/cassandra/cassandra-env.sh
+                - /etc/cassandra/cassandra_analytics.yaml:/etc/cassandra/cassandra.yaml
+                - /etc/cassandra/logback.xml:/etc/cassandra/logback.xml
+                - /etc/contrail:/etc/contrail
+                - /var/lib/analyticsdb:/var/lib/cassandra
+                - /var/lib/analyticsdb_zookeeper_data:/var/lib/zookeeper
+                - /var/lib/zookeeper/myid:/var/lib/zookeeper/myid
+                - /usr/share/kafka/config/server.properties:/usr/share/kafka/config/server.properties
+                - /usr/share/kafka/config/consumer.properties:/usr/share/kafka/config/consumer.properties
+                - /usr/share/kafka/config/zookeeper.properties:/usr/share/kafka/config/zookeeper.properties
+                - /usr/share/kafka/logs:/usr/share/kafka/logs
+                - /etc/zookeeper/conf/zoo_analytics.cfg:/etc/zookeeper/conf/zoo.cfg
+                - /etc/zookeeper/conf/log4j.properties:/etc/zookeeper/conf/log4j.properties
+              network_mode: "host"
+              privileged: true
+              restart: always
diff --git a/opencontrail/control/cluster.yml b/opencontrail/control/cluster.yml
index a4126d6..28c12c4 100644
--- a/opencontrail/control/cluster.yml
+++ b/opencontrail/control/cluster.yml
@@ -5,6 +5,9 @@
 - system.haproxy.proxy.listen.opencontrail.control
 - system.haproxy.proxy.listen.opencontrail.analytics
 parameters:
+  _param:
+    opencontrail_kafka_log_cleanup_mtime: '+7'
+    opencontrail_kafka_log_cleanup_dir: '/usr/share/kafka/logs/'
 # Temprorary fix for MOS9 packages to pin old version of kafka
   linux:
     system:
@@ -16,6 +19,12 @@
       kernel:
         modules:
         - nf_conntrack_ipv4
+      job:
+        kafka_logs_cleanup:
+          command: "find ${_param:opencontrail_kafka_log_cleanup_dir} -name '*.log.*' -type f -mtime ${_param:opencontrail_kafka_log_cleanup_mtime} -exec rm {} \\;"
+          identifier: kafka_logs_cleanup
+          hour: 0
+          minute: 0
   opencontrail:
     web:
       database:
diff --git a/opencontrail/control/cluster4_0.yml b/opencontrail/control/cluster4_0.yml
index cd12eef..60749b3 100644
--- a/opencontrail/control/cluster4_0.yml
+++ b/opencontrail/control/cluster4_0.yml
@@ -6,37 +6,44 @@
 - system.haproxy.proxy.listen.opencontrail.analytics
 parameters:
   _param:
+    opencontrail_kafka_log_cleanup_mtime: '+7'
+    opencontrail_kafka_log_cleanup_dir: '/usr/share/kafka/logs/'
     opencontrail_version: 4.0
     linux_repo_contrail_component: oc40
     opencontrail_message_queue_node01_address: ${_param:openstack_control_node01_address}
     opencontrail_message_queue_node02_address: ${_param:openstack_control_node02_address}
     opencontrail_message_queue_node03_address: ${_param:openstack_control_node03_address}
     opencontrail_message_queue_address: ${_param:openstack_control_address}
+    opencontrail_analytics_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-analytics
+    opencontrail_analyticsdb_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-analyticsdb
+    opencontrail_controller_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-controller
+    opencontrail_controller_container_name: opencontrail_controller_1
+    opencontrail_analytics_container_name: opencontrail_analytics_1
+    opencontrail_analyticsdb_container_name: opencontrail_analyticsdb_1
+    analytics_vip_address: ${_param:opencontrail_analytics_address}
 # Temprorary fix for MOS9 packages to pin old version of kafka
   linux:
     system:
-      package:
-        librdkafka1:
-          version: 0.9.0-0contrail0
-        python-kafka:
-          version: 1.0.1-0contrail1
       kernel:
         modules:
         - nf_conntrack_ipv4
+      job:
+        kafka_logs_cleanup:
+          command: "find ${_param:opencontrail_kafka_log_cleanup_dir} -name '*.log.*' -type f -mtime ${_param:opencontrail_kafka_log_cleanup_mtime} -exec rm {} \\;"
+          identifier: kafka_logs_cleanup
+          hour: 0
+          minute: 0
   opencontrail:
     common:
+      config_only: true
       identity:
         host: ${_param:openstack_control_address}
       network:
         host: ${_param:openstack_control_address}
     collector:
+      config_only: true
       discovery:
         host: None
-      database:
-        members:
-        - host: ${_param:cluster_node01_address}
-        - host: ${_param:cluster_node02_address}
-        - host: ${_param:cluster_node03_address}
       analytics:
         members:
         - host: ${_param:cluster_node01_address}
@@ -54,6 +61,7 @@
         - host: ${_param:cluster_node02_address}
         - host: ${_param:cluster_node03_address}
     database:
+      config_only: true
       discovery:
         host: None
       analytics:
@@ -62,6 +70,7 @@
         - host: ${_param:cluster_node02_address}
         - host: ${_param:cluster_node03_address}
     config:
+      config_only: true
       network:
         host: ${_param:openstack_control_address}
       bind:
@@ -84,6 +93,9 @@
         region: ${_param:openstack_region}
         host: ${_param:openstack_control_address}
     control:
+      config_only: true
+      identity:
+        host: ${_param:openstack_control_address}
       analytics:
         members:
         - host: ${_param:cluster_node01_address}
@@ -102,6 +114,7 @@
       discovery:
         host: None
     web:
+      config_only: true
       analytics:
         host: ${_param:opencontrail_control_address}
       cache:
@@ -109,6 +122,58 @@
       identity:
         host: ${_param:openstack_control_address}
       database:
-        port: 9042
+        port: 9041
       network:
         host: ${_param:openstack_control_address}
+  docker:
+    client:
+      compose:
+        opencontrail:
+          status: up
+          pull: true
+          service:
+            controller:
+              image: ${_param:opencontrail_controller_image}
+              container_name: ${_param:opencontrail_controller_container_name}
+              volumes:
+                - /etc/contrail:/etc/contrail
+                - /var/lib/configdb:/var/lib/cassandra
+                - /var/lib/config_zookeeper_data:/var/lib/zookeeper
+                - /var/lib/zookeeper/myid:/var/lib/zookeeper/myid
+                - /etc/cassandra/cassandra-env.sh:/etc/cassandra/cassandra-env.sh
+                - /etc/cassandra/cassandra.yaml:/etc/cassandra/cassandra.yaml
+                - /etc/cassandra/logback.xml:/etc/cassandra/logback.xml
+                - /etc/zookeeper/conf/zoo.cfg:/etc/zookeeper/conf/zoo.cfg
+                - /etc/zookeeper/conf/log4j.properties:/etc/zookeeper/conf/log4j.properties
+              network_mode: "host"
+              privileged: true
+              restart: always
+            analytics:
+              image: ${_param:opencontrail_analytics_image}
+              container_name: ${_param:opencontrail_analytics_container_name}
+              network_mode: "host"
+              privileged: true
+              restart: always
+              volumes:
+                - /etc/contrail:/etc/contrail
+                - /etc/redis/redis.conf:/etc/redis/redis.conf
+            analyticsdb:
+              image: ${_param:opencontrail_analyticsdb_image}
+              container_name: ${_param:opencontrail_analyticsdb_container_name}
+              volumes:
+                - /etc/cassandra/cassandra-env-analytics.sh:/etc/cassandra/cassandra-env.sh
+                - /etc/cassandra/cassandra_analytics.yaml:/etc/cassandra/cassandra.yaml
+                - /etc/cassandra/logback.xml:/etc/cassandra/logback.xml
+                - /etc/contrail:/etc/contrail
+                - /var/lib/analyticsdb:/var/lib/cassandra
+                - /var/lib/analyticsdb_zookeeper_data:/var/lib/zookeeper
+                - /var/lib/zookeeper/myid:/var/lib/zookeeper/myid
+                - /usr/share/kafka/config/server.properties:/usr/share/kafka/config/server.properties
+                - /usr/share/kafka/config/consumer.properties:/usr/share/kafka/config/consumer.properties
+                - /usr/share/kafka/config/zookeeper.properties:/usr/share/kafka/config/zookeeper.properties
+                - /usr/share/kafka/logs:/usr/share/kafka/logs
+                - /etc/zookeeper/conf/zoo_analytics.cfg:/etc/zookeeper/conf/zoo.cfg
+                - /etc/zookeeper/conf/log4j.properties:/etc/zookeeper/conf/log4j.properties
+              network_mode: "host"
+              privileged: true
+              restart: always
diff --git a/opencontrail/control/control.yml b/opencontrail/control/control.yml
index 50c0c77..e846f5d 100644
--- a/opencontrail/control/control.yml
+++ b/opencontrail/control/control.yml
@@ -4,7 +4,7 @@
 - system.haproxy.proxy.listen.opencontrail.control
 parameters:
   _param:
-    multi_tenancy: false
+    multi_tenancy: true
     opencontrail_message_queue_node01_address: ${_param:openstack_message_queue_node01_address}
     opencontrail_message_queue_node02_address: ${_param:openstack_message_queue_node02_address}
     opencontrail_message_queue_node03_address: ${_param:openstack_message_queue_node03_address}
diff --git a/opencontrail/control/control4_0.yml b/opencontrail/control/control4_0.yml
index 32b51e5..02ab75e 100644
--- a/opencontrail/control/control4_0.yml
+++ b/opencontrail/control/control4_0.yml
@@ -9,13 +9,18 @@
     opencontrail_message_queue_node01_address: ${_param:openstack_message_queue_node01_address}
     opencontrail_message_queue_node02_address: ${_param:openstack_message_queue_node02_address}
     opencontrail_message_queue_node03_address: ${_param:openstack_message_queue_node03_address}
+    opencontrail_controller_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-controller
+    opencontrail_controller_container_name: opencontrail_controller_1
+    analytics_vip_address: ${_param:opencontrail_analytics_address}
   opencontrail:
     common:
+      config_only: true
       identity:
         host: ${_param:openstack_control_address}
       network:
         host: ${_param:openstack_control_address}
     config:
+      config_only: true
       network:
         host: ${_param:openstack_control_address}
       bind:
@@ -38,6 +43,7 @@
         region: ${_param:openstack_region}
         host: ${_param:openstack_control_address}
     control:
+      config_only: true
       analytics:
         members:
         - host: ${_param:opencontrail_analytics_node01_address}
@@ -56,6 +62,7 @@
       discovery:
         host: None
     web:
+      config_only: true
       analytics:
         host: ${_param:opencontrail_analytics_address}
       cache:
@@ -63,10 +70,11 @@
       identity:
         host: ${_param:openstack_control_address}
       database:
-        port: 9042
+        port: 9041
       network:
         host: ${_param:openstack_control_address}
     database:
+      config_only: true
       analytics:
         members:
         - host: ${_param:opencontrail_analytics_node01_address}
@@ -77,3 +85,26 @@
       kernel:
         modules:
         - nf_conntrack_ipv4
+  docker:
+    client:
+      compose:
+        opencontrail:
+          status: up
+          pull: true
+          service:
+            controller:
+              image: ${_param:opencontrail_controller_image}
+              container_name: ${_param:opencontrail_controller_container_name}
+              volumes:
+                - /etc/contrail:/etc/contrail
+                - /var/lib/configdb:/var/lib/cassandra
+                - /var/lib/config_zookeeper_data:/var/lib/zookeeper
+                - /var/lib/zookeeper/myid:/var/lib/zookeeper/myid
+                - /etc/cassandra/cassandra-env.sh:/etc/cassandra/cassandra-env.sh
+                - /etc/cassandra/cassandra.yaml:/etc/cassandra/cassandra.yaml
+                - /etc/cassandra/logback.xml:/etc/cassandra/logback.xml
+                - /etc/zookeeper/conf/zoo.cfg:/etc/zookeeper/conf/zoo.cfg
+                - /etc/zookeeper/conf/log4j.properties:/etc/zookeeper/conf/log4j.properties
+              network_mode: "host"
+              privileged: true
+              restart: always
diff --git a/opencontrail/control/single.yml b/opencontrail/control/single.yml
index 064418e..2ba745b 100644
--- a/opencontrail/control/single.yml
+++ b/opencontrail/control/single.yml
@@ -2,6 +2,9 @@
 - service.opencontrail.control.single
 - service.haproxy.proxy.single
 parameters:
+  _param:
+    opencontrail_kafka_log_cleanup_mtime: '+7'
+    opencontrail_kafka_log_cleanup_dir: '/usr/share/kafka/logs/'
 # Temprorary fix for MOS9 packages to pin old version of kafka
   linux:
     system:
@@ -15,6 +18,12 @@
       kernel:
         modules:
         - nf_conntrack_ipv4
+      job:
+        kafka_logs_cleanup:
+          command: "find ${_param:opencontrail_kafka_log_cleanup_dir} -name '*.log.*' -type f -mtime ${_param:opencontrail_kafka_log_cleanup_mtime} -exec rm {} \\;"
+          identifier: kafka_logs_cleanup
+          hour: 0
+          minute: 0
   haproxy:
     proxy:
       listen:
diff --git a/opencontrail/control/single4_0.yml b/opencontrail/control/single4_0.yml
index 365ed20..a4fae18 100644
--- a/opencontrail/control/single4_0.yml
+++ b/opencontrail/control/single4_0.yml
@@ -3,21 +3,31 @@
 - service.haproxy.proxy.single
 parameters:
   _param:
+    opencontrail_kafka_log_cleanup_mtime: '+7'
+    opencontrail_kafka_log_cleanup_dir: '/usr/share/kafka/logs/'
     opencontrail_version: 4.0
     linux_repo_contrail_component: oc40
+    opencontrail_analytics_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-analytics
+    opencontrail_analyticsdb_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-analyticsdb
+    opencontrail_controller_image: docker-prod-local.artifactory.mirantis.com/opencontrail-${_param:linux_repo_contrail_component}/opencontrail-controller
+    opencontrail_controller_container_name: opencontrail_controller_1
+    opencontrail_analytics_container_name: opencontrail_analytics_1
+    opencontrail_analyticsdb_container_name: opencontrail_analyticsdb_1
 # Temprorary fix for MOS9 packages to pin old version of kafka
   linux:
     system:
       package:
-        librdkafka1:
-          version: 0.9.0-0contrail0
-        python-kafka:
-          version: 1.0.1-0contrail1
         contrail-api-cli:
           version: latest
       kernel:
         modules:
         - nf_conntrack_ipv4
+      job:
+        kafka_logs_cleanup:
+          command: "find ${_param:opencontrail_kafka_log_cleanup_dir} -name '*.log.*' -type f -mtime ${_param:opencontrail_kafka_log_cleanup_mtime} -exec rm {} \\;"
+          identifier: kafka_logs_cleanup
+          hour: 0
+          minute: 0
   haproxy:
     proxy:
       listen:
@@ -73,11 +83,13 @@
           password: ${_param:opencontrail_stats_password}
   opencontrail:
     common:
+      config_only: true
       identity:
         host: ${_param:openstack_control_address}
       network:
         host: ${_param:openstack_control_address}
     config:
+      config_only: true
       network:
         host: ${_param:openstack_control_address}
       bind:
@@ -96,6 +108,7 @@
         region: ${_param:openstack_region}
         host: ${_param:openstack_control_address}
     control:
+      config_only: true
       analytics:
         members:
         - host: ${_param:single_address}
@@ -108,6 +121,7 @@
       discovery:
         host: None
     web:
+      config_only: true
       analytics:
         host: ${_param:single_address}
       cache:
@@ -115,14 +129,18 @@
       identity:
         host: ${_param:openstack_control_address}
       database:
-        port: 9042
+        port: 9041
       network:
         host: ${_param:openstack_control_address}
     database:
+      config_only: true
       analytics:
         members:
         - host: ${_param:single_address}
     collector:
+      config_only: true
+      identity:
+        host: ${_param:openstack_control_address}
       discovery:
         host: None
       database:
@@ -138,3 +156,55 @@
       config:
         members:
         - host: ${_param:single_address}
+  docker:
+    client:
+      compose:
+        opencontrail:
+          status: up
+          pull: true
+          service:
+            controller:
+              image: ${_param:opencontrail_controller_image}
+              container_name: ${_param:opencontrail_controller_container_name}
+              volumes:
+                - /etc/contrail:/etc/contrail
+                - /var/lib/configdb:/var/lib/cassandra
+                - /var/lib/config_zookeeper_data:/var/lib/zookeeper
+                - /var/lib/zookeeper/myid:/var/lib/zookeeper/myid
+                - /etc/cassandra/cassandra-env.sh:/etc/cassandra/cassandra-env.sh
+                - /etc/cassandra/cassandra.yaml:/etc/cassandra/cassandra.yaml
+                - /etc/cassandra/logback.xml:/etc/cassandra/logback.xml
+                - /etc/zookeeper/conf/zoo.cfg:/etc/zookeeper/conf/zoo.cfg
+                - /etc/zookeeper/conf/log4j.properties:/etc/zookeeper/conf/log4j.properties
+              network_mode: "host"
+              privileged: true
+              restart: always
+            analytics:
+              image: ${_param:opencontrail_analytics_image}
+              container_name: ${_param:opencontrail_analytics_container_name}
+              network_mode: "host"
+              privileged: true
+              restart: always
+              volumes:
+                - /etc/contrail:/etc/contrail
+                - /etc/redis/redis.conf:/etc/redis/redis.conf
+            analyticsdb:
+              image: ${_param:opencontrail_analyticsdb_image}
+              container_name: ${_param:opencontrail_analyticsdb_container_name}
+              volumes:
+                - /etc/cassandra/cassandra-env-analytics.sh:/etc/cassandra/cassandra-env.sh
+                - /etc/cassandra/cassandra_analytics.yaml:/etc/cassandra/cassandra.yaml
+                - /etc/cassandra/logback.xml:/etc/cassandra/logback.xml
+                - /etc/contrail:/etc/contrail
+                - /var/lib/analyticsdb:/var/lib/cassandra
+                - /var/lib/analyticsdb_zookeeper_data:/var/lib/zookeeper
+                - /var/lib/zookeeper/myid:/var/lib/zookeeper/myid
+                - /usr/share/kafka/config/server.properties:/usr/share/kafka/config/server.properties
+                - /usr/share/kafka/config/consumer.properties:/usr/share/kafka/config/consumer.properties
+                - /usr/share/kafka/config/zookeeper.properties:/usr/share/kafka/config/zookeeper.properties
+                - /usr/share/kafka/logs:/usr/share/kafka/logs
+                - /etc/zookeeper/conf/zoo_analytics.cfg:/etc/zookeeper/conf/zoo.cfg
+                - /etc/zookeeper/conf/log4j.properties:/etc/zookeeper/conf/log4j.properties
+              network_mode: "host"
+              privileged: true
+              restart: always
diff --git a/openssh/server/team/k8s_team.yml b/openssh/server/team/k8s_team.yml
index 9ec2b88..934afd6 100644
--- a/openssh/server/team/k8s_team.yml
+++ b/openssh/server/team/k8s_team.yml
@@ -1,3 +1,5 @@
+classes:
+- system.openssh.server.team.members.ashestakov
 parameters:
   _param:
     linux_system_user_sudo: true
diff --git a/openssh/server/team/maintenance.yml b/openssh/server/team/maintenance.yml
new file mode 100644
index 0000000..44e8639
--- /dev/null
+++ b/openssh/server/team/maintenance.yml
@@ -0,0 +1,9 @@
+classes:
+- system.linux.system.sudo
+- system.openssh.server.team.members.astupnikov
+- system.openssh.server.team.members.dmeltsaykin
+- system.openssh.server.team.members.myatsenko
+- system.openssh.server.team.members.omolchanov
+parameters:
+  _param:
+    linux_system_user_sudo: true
diff --git a/openssh/server/team/members/astupnikov.yml b/openssh/server/team/members/astupnikov.yml
new file mode 100644
index 0000000..d4522f6
--- /dev/null
+++ b/openssh/server/team/members/astupnikov.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        astupnikov:
+          enabled: true
+          name: astupnikov
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Alexey Stupnikov
+          home: /home/astupnikov
+          email: astupnikov@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        astupnikov:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDrV6q403BYodTCb8BCsWlkW6AHxvtCH5JxI9gUANsvbQd9n8fd16xqgXVecCRBJOS4PVauLNiQPMaj6ZuFeRZ8ZXvX498eNSNa5WhBbSwk0X/DqdK1LN/MStTAtL60JQV0yQSY+BghVJkREw4MJJBksyP0X+OG5AB+ijh/bjsabYr+EQNK+WJblrsRvNNCbjiWPcjzXVMxUrzphB09CYMwWFgx1An5jS7c1EGvXrzf0aK1KkadhGnXcjPACFaMGPYmu5HNgQcRnzNXDQU6PLGeyqNnZYZjHdQWZR88cQywznqzI8y9P4qSOTVStYoKLlYsdQFRTw8sJrRpPZupgSED astupnikov@astupnikov-srv
+          user: ${linux:system:user:astupnikov}
diff --git a/openssh/server/team/members/crh.yml b/openssh/server/team/members/crh.yml
new file mode 100644
index 0000000..8179415
--- /dev/null
+++ b/openssh/server/team/members/crh.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        crh:
+          enabled: true
+          name: crh
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Christian Huebner
+          home: /home/crh
+          email: chuebner@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        crh:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjW4PSMoILjoZWDM8RnbiW6HXHBFntnDd6jgAlokJhTpYIjzUHpoh/OqphraKbNFnPbzL2nkIbaKZqKj+uuvbsitHnApmdFgSpOmBRGeaSExA30GqweYrIMKN5JAQTbONZWLSm+LD689CXRv2s6Th/YMELYfoi2W0pkvwiBdr+/0NxpdRvJydCn36SE6wOigu4uJXIXeNqIjTD+x4sW6GB54Ugbg+SMmI9D5ONlmfEj8K/ZmG1THdPGOLlquy/VLiuOBuwNoJCBV9shsGEmdg8NiOu8NPupQlsbmClZDbBAklJ0AF6ElAwKSiqCOhbaa7hu4qJFrCKC+XAgYxS9t7r
+          user: ${linux:system:user:crh}
diff --git a/openssh/server/team/members/dbogaczyk.yml b/openssh/server/team/members/dbogaczyk.yml
new file mode 100644
index 0000000..109706c
--- /dev/null
+++ b/openssh/server/team/members/dbogaczyk.yml
@@ -0,0 +1,19 @@
+parameters:
+  linux:
+    system:
+      user:
+        dbogaczyk:
+          enabled: true
+          name: dbogaczyk
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Dariusz Bogaczyk
+          home: /home/dbogaczyk
+          email: dbogaczyk@mirantis.com
+  openssh:
+    server:
+      user:
+        dbogaczyk:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC471IhcUC1BZlCWdD012E49P9BLGp08Tp45Zn2EQrSPuMUf6kuNyogU6ZSwRPvW9yzTd8DSNKEqr80hYyoX/SDURsKfZaw5iIKFWhj4M/0AODrx01h6Z6r+l4Oj7cgIe4Y24Qbkg0da9Z1nhy+QjKM7So6n+5IBwQLq0IyEuYkljnY7G1cjlDiw41f+S8euIHMZcOP86t+6UJswdwlLswXrF/QZOlkyXTl7N0Yf1z4ehpO8TpFfd9hdsO8Gh0pBfJ1P+ORveeowldDu9zIv4UUs8D8Q+nuujw2JB42XxiK0dq2xXvHUxwsg7+06gD0N5VHJOZTdJBtsEdOBFPO8GZj dbogaczyk@mirantis.com
+          user: ${linux:system:user:dbogaczyk}
diff --git a/openssh/server/team/members/dkruglov.yml b/openssh/server/team/members/dkruglov.yml
new file mode 100644
index 0000000..1df2a6b
--- /dev/null
+++ b/openssh/server/team/members/dkruglov.yml
@@ -0,0 +1,19 @@
+parameters:
+  linux:
+    system:
+      user:
+        dkruglov:
+          enabled: true
+          name: dkruglov
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Dmitriy Kruglov
+          home: /home/dkruglov
+          email: dkruglov@mirantis.com
+  openssh:
+    server:
+      user:
+        dkruglov:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDd0peqhFCRgFhxsAV23TJ6la96FH7CFd/XYW67vaxWrlWSZsba9+aMMpNFPjNfrcAqZsKNlRk3EOEAHyS4JQHcOzQAxYU5kCnqg2YnIY3bp4ihDwF/V+4xMRvt8avdlo9qBFQGqiX7iPleMM089wiATi6NYsacooqNEhrjf3NvqeJBK2NLS82aSdOFF7reC58hyomArD1dJE1usF28l5+i8d8ALlzOlMLLaIRPFmbJeT43S+VXNycREektwVbXvF+Lmt2FST1oQD2KMd+aWltLsGg2KlXwlzMIod1UuYx0ZcIk7o1GYY7duNP+gmldj+TTqAgqlOChusw8iAdOUPff dkruglov@mirantis.com
+          user: ${linux:system:user:dkruglov}
diff --git a/openssh/server/team/members/dmeltsaykin.yml b/openssh/server/team/members/dmeltsaykin.yml
new file mode 100644
index 0000000..1b5ff2e
--- /dev/null
+++ b/openssh/server/team/members/dmeltsaykin.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        dmeltsaykin:
+          enabled: true
+          name: dmeltsaykin
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Denis Meltsaykin
+          home: /home/dmeltsaykin
+          email: dmeltsaykin@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        dmeltsaykin:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqfNIy3WuxzRzOY/GBNGOnP5UrCFWZ8uMzW6hEl4wgIEYYIcv8o+C1/hvrfHimG/I/rAwYRS6Dx0bZ7m49zATNxe+EVer3BV63ru34Hzel/XxxyD34ULmrDgvP3olaAKFI17gVOFQ7hCBzDRp3s4YN3ojQspPyeiO+Jt8OwVomxJWgLauAHhl7Z/XPVHpT/fssJGG/eC4oOz4RZ4jAk0BH3Yl8s63grfwrgB79H/+nr0UvBdTkBn3T5WiC4gxnm+jQQwci7/BLQsg1Z3OykfTuyftIexNyVVy/SmdsGi37RJGFKRMMovoZx+261JgaHWBoHqBJa5UpV2usi9z3Py2z avgoor@MacBook-Pro-Denis.local
+          user: ${linux:system:user:dmeltsaykin}
diff --git a/openssh/server/team/members/korlowska.yml b/openssh/server/team/members/korlowska.yml
index f175273..cde10d1 100644
--- a/openssh/server/team/members/korlowska.yml
+++ b/openssh/server/team/members/korlowska.yml
@@ -11,7 +11,6 @@
           email: korlowska@mirantis.com
   openssh:
     server:
-      enabled: true
       user:
         korlowska:
           enabled: true
diff --git a/openssh/server/team/members/miwinski.yml b/openssh/server/team/members/miwinski.yml
index 5dc9d80..676fd3c 100644
--- a/openssh/server/team/members/miwinski.yml
+++ b/openssh/server/team/members/miwinski.yml
@@ -11,7 +11,6 @@
           email: miwinski@mirantis.com
   openssh:
     server:
-      enabled: true
       user:
         miwinski:
           enabled: true
diff --git a/openssh/server/team/members/mlos.yml b/openssh/server/team/members/mlos.yml
index 6b30817..fe7b8f4 100644
--- a/openssh/server/team/members/mlos.yml
+++ b/openssh/server/team/members/mlos.yml
@@ -11,7 +11,6 @@
           email: mlos@mirantis.com
   openssh:
     server:
-      enabled: true
       user:
         mlos:
           enabled: true
diff --git a/openssh/server/team/members/mniedbala.yml b/openssh/server/team/members/mniedbala.yml
index 30f7f30..a4ca5c8 100644
--- a/openssh/server/team/members/mniedbala.yml
+++ b/openssh/server/team/members/mniedbala.yml
@@ -11,7 +11,6 @@
           email: mniedbala@mirantis.com
   openssh:
     server:
-      enabled: true
       user:
         mniedbala:
           enabled: true
diff --git a/openssh/server/team/members/mpolreich.yml b/openssh/server/team/members/mpolreich.yml
index a4658aa..cfe8b70 100644
--- a/openssh/server/team/members/mpolreich.yml
+++ b/openssh/server/team/members/mpolreich.yml
@@ -16,5 +16,5 @@
         mpolreich:
           enabled: true
           public_keys:
-            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC0N+ds8BGTR+ZQo9NSRGRbjv3T8AbPmtSw2nClXxetRdmHpM/mU7/5iD7qfkCXtNptKeCG/Qk44wlijnAtjztJK1qfvyphHe3etZxLnqhYMm73Yy++yKPE/ywFPFb+7kd0BDy2iZqohZpX3gUi5iDnvXUInHNqqtTv3xFe2kmn3lq5bSRuUMtr61nZ7z/fkX8kNfoGxKrm7bhSo5zq4sjTrj3lk1LKZc1HYji3RwrzBM0z4eyed1BaJyDNtG+eFN4nOnvVn59452AR8SmKJXRErk37rEoQn80xszypzybooFPN5dpdB6u9b4xquFCOD83usb8kEjKY9VIYGuXxEEts1KIF20J+xd8UnZU8d4JL50G8JY8zdNgurR3ZyMD2okuord4cpHF8SVecsAyRV6nuhDxVtF2Xn/RriY02jrLoRPsS+3nIrKt9H8vpQZMYJ+jgEpekZhhVfz4AP3pATzOrWENzNXj5G1bLJs1C9aTtwE27EnKW73XekX/GLsehCwsQ21JvDX8PMxJwLVfqvkRlrc5GILEIVgjZ82Cj6Eens1QobymRAEWuEpZxkPx6u0kGO62ri8zFx8+NYwYDz3mwhHDRT34T/Rvzy/9V9xVjkUQOj9cZ3eYBnC1MffJjx8heHDmSQmUd+99zKa9Hzr74z3AvR3AIgFqmu7kx5fIMew== ubuntu@thinkpad-x1
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDC6jbVpCqvru+Te2RGLPy/AkcaoRqyqxdBi3OjjXdRjPQYGNuAEFgmlQDZvs5xBMAKOcrcCl8wLcFb3mmpr9+xBJAdR4K0bEqwMfCKRejsN+6AubCbrOeoWb9SsTdvBOl7rOFyICt/XuSNX56C8k1hJojC0U21DIertWSCd8h5RExE8Skqd9+KdHSFa+TZffWbysMrwba29UBt7XsAPuQr1BUOqhA8JOx146ul5HszitCOSvglre8pSJKpw6a4Fk/cb1J8Oc/AfSMdTvTLAfuF+d2Mw6SEawFEocSXq0WKCdZfJpZrWPr6SEB+7zoq3kvhIWgUH2ypYZvvqf0EVlWx polreichmartin@gmail.com
           user: ${linux:system:user:mpolreich}
\ No newline at end of file
diff --git a/openssh/server/team/members/myatsenko.yml b/openssh/server/team/members/myatsenko.yml
new file mode 100644
index 0000000..01c2417
--- /dev/null
+++ b/openssh/server/team/members/myatsenko.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        myatsenko:
+          enabled: true
+          name: myatsenko
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Maksym Yatsenko
+          home: /home/myatsenko
+          email: myatsenko@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        myatsenko:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3wCjIm2PVzViGp5NFxeDHLVLxSq67gR+mm4jarHyDVb8wz9kfSG6cWGXNZhrqse7NgpDZpurFunFddXQBOgR6LmOfo9sDlcl4oT0+OnWHgyK6RMYcigkVYVYI5W2f5M+3Dz/KjV1S/VmRYlh/tz46PECV+Y93RaUUXS/91Uv19SAzuCd3Rj0l43HY5ROZNK0VZSrIsnhOqLZxF71v0jY/AbFxswooMH0NCM7XFqVBsRjwclfQjIGkV1j4xeWGM1xWkvvHCSEz2JdeAR5w3C7mhCzPpQJXvQGJNuccyZzoNbHPgDdFPx76MGj/VdmeUu5yKnFSnNNoQ1CcbxmaYeJ7 myatsenko@myatsenko-pc
+          user: ${linux:system:user:myatsenko}
diff --git a/openssh/server/team/members/omolchanov.yml b/openssh/server/team/members/omolchanov.yml
new file mode 100644
index 0000000..61289ed
--- /dev/null
+++ b/openssh/server/team/members/omolchanov.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        omolchanov:
+          enabled: true
+          name: omolchanov
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Oleksii Molchanov
+          home: /home/omolchanov
+          email: omolchanov@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        myatsenko:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCulNT7qgpJtIoLshljGonHfWk5IYh/MhzO2PEh3GnzrsnI8Mgv2W8TCD4ZB7RbSP6Jt74T7P6F4Mgzag/Nxjwimh7cUJoJZQH54QC4GVBN+YG+CRjEhIDn/OEM9q+6fnAWqBLBf/k0pzeRxWM4mLpcU+6DSPS57qjEKG5OfLCgFbBFg+4EdGP9HNVTLcMBglo7vTWtvzaGjJgH0XFXjx1fXW9JftEmwMzNdoYpQ/a19JYC2x5vu0cGWUjdMWmrzJbnTJ7SwnVYfD2mhUYDi8WGy/nCk67tb6qKCAUN5kvCEWrMPDhVEcBfvyhXU2wVnZHJbOoZxrBiici9q2U7KDYT alex@alex-B85M-DS3H
+          user: ${linux:system:user:omolchanov}
diff --git a/openssh/server/team/members/pruzicka.yml b/openssh/server/team/members/pruzicka.yml
index 93aca1f..d56d3d6 100644
--- a/openssh/server/team/members/pruzicka.yml
+++ b/openssh/server/team/members/pruzicka.yml
@@ -11,7 +11,6 @@
           email: pruzicka@mirantis.com
   openssh:
     server:
-      enabled: true
       user:
         pruzicka:
           enabled: true
diff --git a/openssh/server/team/members/pstefanski.yml b/openssh/server/team/members/pstefanski.yml
new file mode 100644
index 0000000..cd14386
--- /dev/null
+++ b/openssh/server/team/members/pstefanski.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        pstefanski:
+          enabled: true
+          name: pstefanski
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Pawel Stefanski
+          home: /home/pstefanski
+          email: pstefanski@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        pstefanski:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEmhgYMXA98zTAHALZKpgD4MIhHsUcAbrw0dM5AroBKiGBAEqlClxKxzsg7cC7yv4P8TloIoV656ywtgiRIfTAYoXGANxBgkeDfHFzlBQ7yYf8xU1Cl5jBG2xB9FnPJQYtxFJD36dAsUPQ4ykROw0epfBv+CCqgqmh6AWuIRnY8vGx6o3oKu4eZ4P0iSGuN2ITfVkGc32WoXFI0qIZPrnWLmIf4+LwbeA3aNZ54La5Er2wgrzdwF3D2MOBg964gCnuauUneY4WDkO81W+yUB7MA1n/WQP5dgLwdNTXiMtyNtuXs+QeEzlag2fRvMkmsUoU7oaIC3iuW8mf6967n+ED
+          user: ${linux:system:user:pstefanski}
diff --git a/openssh/server/team/oscore_devops.yml b/openssh/server/team/oscore_devops.yml
index 149d765..b5505a8 100644
--- a/openssh/server/team/oscore_devops.yml
+++ b/openssh/server/team/oscore_devops.yml
@@ -2,7 +2,6 @@
 - system.linux.system.sudo
 - system.openssh.server.team.members.vsaienko
 - system.openssh.server.team.members.vnogin
-- system.openssh.server.team.members.ashestakov
 - system.openssh.server.team.members.mkarpin
 parameters:
   _param:
diff --git a/openssh/server/team/services.yml b/openssh/server/team/services.yml
index 8f15552..40694d2 100644
--- a/openssh/server/team/services.yml
+++ b/openssh/server/team/services.yml
@@ -8,6 +8,9 @@
 - system.openssh.server.team.members.korlowska
 - system.openssh.server.team.members.miwinski
 - system.openssh.server.team.members.mlos
+- system.openssh.server.team.members.dbogaczyk
+- system.openssh.server.team.members.dkruglov
+- system.openssh.server.team.members.sflorczak
 parameters:
   _param:
     linux_system_user_sudo: true
diff --git a/openssh/server/team/stacklight.yml b/openssh/server/team/stacklight.yml
index 403e7e1..b46ac24 100644
--- a/openssh/server/team/stacklight.yml
+++ b/openssh/server/team/stacklight.yml
@@ -102,6 +102,13 @@
           full_name: Szymon Banka
           home: /home/sbanka
           email: sbanka@mirantis.com
+        crh:
+          enabled: true
+          name: crh
+          sudo: true
+          full_name: Christian Huebner
+          home: /home/crh
+          email: chuebner@mirantis.com
   openssh:
     client:
       enabled: true
@@ -178,6 +185,11 @@
           public_keys:
           - ${public_keys:sbanka}
           user: ${linux:system:user:sbanka}
+        crh:
+          enabled: true
+          public_keys:
+          - ${public_keys:crh}
+          user: ${linux:system:user:crh}
   public_keys:
     newt:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3odU+3V2uDA2ptAFL9hrJRPNEEdAyztWOZFQ5Oyd9oerTGOU3p4xmrgWWjfKFKbYGhiiIUcYAol5PkTfKukGEkkjCHYA1t023soCaaAj85wCZCnw2zQNAziwxTYmAzTqgxiSvtZNMMrtJvFHRIRDzJ3M1lV0prWNWkMM1/3FAd4W49y6VT3fkMCo8uqG7CfGdgR2DgBCxf9KaNPfW5eDEPOgmE5lK8tVSEI6T+Cg7hbcTf4lFYnlFBnlQgp/0JstsM4Vbwb4B34LOpOsf2S8rrWk2xQMjwaMHXkc2s/E8iW3F5nVFuyEXYISFQIiAHw8dzC6CHgLcyHUVWwznKawZ newt@newt-dev1
@@ -192,7 +204,7 @@
     vgusev:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrCyaZjs8hiwx38LfpeQ2z9n9ptwQ7gFrhq2z5sK9q/LQMCubbnp5xhyF0SMY1jmQUewBOKXhnq3QSX+DmtNsnhitnZBw2BE5PBXllCBWMMiWULfAYvB0of728Q3EEjrtyfHkt7o2E+CvreVJcVI4kBwjKh5WpVBZ8mmkW/sexLGMuYu0bUWjCddu6ZlhUa+y14VZKOKp44auemza1VL/UzqOVZkBAfR2gPV2pBG3Im+SlnOlDRxKPEXQbsn3u/sNeZq0wSY++khY86AU7jAKfL2NiNsoA7CyB0jTEKwYO3vOWOhECifZuHwY/TNWyRFWM2ImW3mT9aO7nE4w4jXXJ vgusev@vgusev
     mpolreich:
-      key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC0N+ds8BGTR+ZQo9NSRGRbjv3T8AbPmtSw2nClXxetRdmHpM/mU7/5iD7qfkCXtNptKeCG/Qk44wlijnAtjztJK1qfvyphHe3etZxLnqhYMm73Yy++yKPE/ywFPFb+7kd0BDy2iZqohZpX3gUi5iDnvXUInHNqqtTv3xFe2kmn3lq5bSRuUMtr61nZ7z/fkX8kNfoGxKrm7bhSo5zq4sjTrj3lk1LKZc1HYji3RwrzBM0z4eyed1BaJyDNtG+eFN4nOnvVn59452AR8SmKJXRErk37rEoQn80xszypzybooFPN5dpdB6u9b4xquFCOD83usb8kEjKY9VIYGuXxEEts1KIF20J+xd8UnZU8d4JL50G8JY8zdNgurR3ZyMD2okuord4cpHF8SVecsAyRV6nuhDxVtF2Xn/RriY02jrLoRPsS+3nIrKt9H8vpQZMYJ+jgEpekZhhVfz4AP3pATzOrWENzNXj5G1bLJs1C9aTtwE27EnKW73XekX/GLsehCwsQ21JvDX8PMxJwLVfqvkRlrc5GILEIVgjZ82Cj6Eens1QobymRAEWuEpZxkPx6u0kGO62ri8zFx8+NYwYDz3mwhHDRT34T/Rvzy/9V9xVjkUQOj9cZ3eYBnC1MffJjx8heHDmSQmUd+99zKa9Hzr74z3AvR3AIgFqmu7kx5fIMew== ubuntu@thinkpad-x1
+      key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDC6jbVpCqvru+Te2RGLPy/AkcaoRqyqxdBi3OjjXdRjPQYGNuAEFgmlQDZvs5xBMAKOcrcCl8wLcFb3mmpr9+xBJAdR4K0bEqwMfCKRejsN+6AubCbrOeoWb9SsTdvBOl7rOFyICt/XuSNX56C8k1hJojC0U21DIertWSCd8h5RExE8Skqd9+KdHSFa+TZffWbysMrwba29UBt7XsAPuQr1BUOqhA8JOx146ul5HszitCOSvglre8pSJKpw6a4Fk/cb1J8Oc/AfSMdTvTLAfuF+d2Mw6SEawFEocSXq0WKCdZfJpZrWPr6SEB+7zoq3kvhIWgUH2ypYZvvqf0EVlWx polreichmartin@gmail.com
     isvetlov:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9lvegjKq6OP7cgF9YU9mPOk1/mfJbov3YnYnhiW1Ks0hrWZyAo+0TV3O7LgWZ8jqD9abbYaOiWCt4d9ABkLUJfCLNAqOJRapJ+tybPAxJKx4eV8pptJ7UF0EdItasTdd+gqJJ4Krk869rwmqVQ4hethdykjhKyWu3bG+uVtFUF5xUj9zaT9NThA6/Xhz0idAiTO8ArmLng4W8ne45gANaHIWXpIsklo6GLUSZwl4z6j2z4joxNJsB1hrw0msT56F26ctkDo6thNMAzPMyZsLjYJBJIRYhdC1d4Up9114nVcY4pzYw76+zXU9zED2XNRLdyAaxFlwXvumAs3iMLI8Z isvetlov@isvetlov-mac.local
     akholkin:
@@ -207,3 +219,5 @@
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/UtqwBD6qkEoWSrmO0jXa9sUcwumySxmkX2XCTlAj+e8tzCNndNhaUueu01pbcNrGrB7xvCHyTa5cxgJEv0RAJRxZnObTjluegiuW+/KNSGwiSDy90bwPVb6zWalrDg12xGh8C0ybmv90uC+GrGO1UXFpm5N1qL3ZsUvSjWBRZ70xXjUI4self+fWxBYJhu7hGZ0RVCeA8TjRutzdOWcSZwN2Arn2Oq+fx9n5HP8iXlPcfM6aWj+QvkXphvKjUhDYiImQ07kJctYvxEwMei5pM1dAPZefQ6FRsUP1gKYKPVp1CiBHPIKLG3LMwxp0/LWQmHB4umZvA6HYplSUXZLMd+FhCRuocVFdxe308JWeIFWyw7og/qEBlpxqW4BUk0bR3c4deI9QDKWCuuunTDB4oEB8ZnkI7utknpx7sqO72Ev2UNS/CSi3yyqgOajojQ3l+McWn9bm08KSLzuuMaexETRYQ9dgjE79N7fH+DEt5Ryii+GA2a8Gl3iRtTZs9WA94mTb/KjZBrVxh+PixpQ6s3oGFelFCPMKSPWIEb+rwuAUi0Ulrqb2UZDzJYhT50QfbCzRN2MU+8bR7PJt/xpAADvQX0iMMrMUvAVngs2YrXKapJliyHhTZxOmVdDRIyCQ1YpK2ktBJf+E+RXl3R5XUmbJkT4jZ1R6cA1QJOEKVQ== nzaporozhets@mirantis.com
     sbanka:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMdgjQ/jeWwQTaPyy7G5JJAkM+QPNPFkzMldPHJzOxEBzt/M5zAooj0XgbRIDIztolhXhmj8N5QSG5n3Wn9T9e2KpoxrLaVhMV5WGTgMrXMmyT8oXLV3gLxGNHMWFvplSbHLK78EsZQQ1/kBQMyPXB1+FpIuSHVOxaospOQObJ08lvQfvlO7AUUV4ecpFj3PpV5vkKPRS+KfiRm84BeGIu51BL1BClZcOyHZPBQT+DUBjm8y4Nd7pVZRjsiBzZBvUotCbn5+RqWJnu4kyoGoRNmk8pvCx7jGL1G9rE8NNsKlCUWedvyNkDeoWKvleJuzkj3ggfuCj/iTtDoXFR95e3
+    crh:
+      key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjW4PSMoILjoZWDM8RnbiW6HXHBFntnDd6jgAlokJhTpYIjzUHpoh/OqphraKbNFnPbzL2nkIbaKZqKj+uuvbsitHnApmdFgSpOmBRGeaSExA30GqweYrIMKN5JAQTbONZWLSm+LD689CXRv2s6Th/YMELYfoi2W0pkvwiBdr+/0NxpdRvJydCn36SE6wOigu4uJXIXeNqIjTD+x4sW6GB54Ugbg+SMmI9D5ONlmfEj8K/ZmG1THdPGOLlquy/VLiuOBuwNoJCBV9shsGEmdg8NiOu8NPupQlsbmClZDbBAklJ0AF6ElAwKSiqCOhbaa7hu4qJFrCKC+XAgYxS9t7r
diff --git a/postgresql/client/security_monkey.yml b/postgresql/client/security_monkey.yml
index a7a341f..c47e241 100644
--- a/postgresql/client/security_monkey.yml
+++ b/postgresql/client/security_monkey.yml
@@ -5,8 +5,6 @@
     secmonkey_db_host: ${_param:haproxy_postgresql_bind_host}
     secmonkey_db_user: secmonkey
     secmonkey_db_user_password: secmonkey
-    secmonkey_login_id: 11
-    secmonkey_application_id: 1
   postgresql:
     client:
       server:
diff --git a/prometheus/alertmanager/notification/pushkin.yml b/prometheus/alertmanager/notification/pushkin.yml
index 905a292..dd4f760 100644
--- a/prometheus/alertmanager/notification/pushkin.yml
+++ b/prometheus/alertmanager/notification/pushkin.yml
@@ -18,5 +18,5 @@
             enabled: true
             webhook_configs:
               pushkin-vip:
-                url: "${_param:alertmanager_notification_pushkin_host}:${_param:alertmanager_notification_pushkin_port}/webhook?app=stacklight"
+                url: "http://${_param:alertmanager_notification_pushkin_host}:${_param:alertmanager_notification_pushkin_port}/webhook?app=stacklight_alertmanager"
                 send_resolved: true
diff --git a/prometheus/server/init.yml b/prometheus/server/init.yml
index 99fdceb..5d115ac 100644
--- a/prometheus/server/init.yml
+++ b/prometheus/server/init.yml
@@ -4,6 +4,7 @@
     prometheus_server_data_directory: /data
   prometheus:
     server:
+      version: 2.0
       dir:
         data: /srv/volumes/local/prometheus/data
         config: /srv/volumes/local/prometheus/config
diff --git a/rundeck/client/init.yml b/rundeck/client/init.yml
index 31b7ee9..f97b8da 100644
--- a/rundeck/client/init.yml
+++ b/rundeck/client/init.yml
@@ -17,3 +17,4 @@
         credentials:
           username: ${_param:rundeck_client_username}
           password: ${_param:rundeck_client_password}
+          api_token: ${_param:rundeck_client_password}
diff --git a/rundeck/client/project/cicd.yml b/rundeck/client/project/cicd.yml
index ed8b256..4cbcd40 100644
--- a/rundeck/client/project/cicd.yml
+++ b/rundeck/client/project/cicd.yml
@@ -6,6 +6,7 @@
     rundeck_cis_os_docker_image: docker-prod-local.artifactory.mirantis.com/mirantis/oss/cis-openstack:latest
     rundeck_cis_openstack:
       auth_url: http://yourcloud.com:5000/v3/auth/tokens
+      endpoint_type: publicURL
       username: admin
       password: password
       cert: plain-certificate
@@ -47,6 +48,9 @@
         cis/openstack/auth_url:
           type: password
           content: ${_param:rundeck_cis_openstack:auth_url}
+        cis/openstack/endpoint_type:
+          type: password
+          content: ${_param:rundeck_cis_openstack:endpoint_type}
         cis/openstack/username:
           type: password
           content: ${_param:rundeck_cis_openstack:username}
diff --git a/rundeck/server/docker.yml b/rundeck/server/docker.yml
index 492d135..d7f1a18 100644
--- a/rundeck/server/docker.yml
+++ b/rundeck/server/docker.yml
@@ -3,12 +3,11 @@
   - service.rundeck.server.single
 parameters:
   _param:
-    rundeck_postgresql_username: rundeck
-    rundeck_postgresql_password: password
-    rundeck_postgresql_database: rundeck
-    rundeck_postgresql_host: ${_param:control_vip_address}
-    rundeck_postgresql_port: 5432
     rundeck_server_ssh_timeout: 300000
+    rundeck_forward_iframe: False
+    rundeck_iframe_host: "external-proxy-endpoint"
+    rundeck_iframe_port: ${_param:haproxy_rundeck_exposed_port}
+    rundeck_iframe_ssl: False
   rundeck:
     server:
       user:
@@ -16,17 +15,15 @@
         gid: 550
       home_dir: /srv/volumes/rundeck
       root_dir: /srv/volumes/rundeck
-      datasource:
-        engine: postgresql
-        host: ${_param:rundeck_postgresql_host}
-        port: ${_param:rundeck_postgresql_port}
-        username: ${_param:rundeck_postgresql_username}
-        password: ${_param:rundeck_postgresql_password}
-        database: ${_param:rundeck_postgresql_database}
       api:
         host: ${_param:haproxy_rundeck_bind_host}
         port: ${_param:haproxy_rundeck_bind_port}
         https: ${_param:haproxy_rundeck_ssl:enabled}
+      iframe:
+        external_forward: ${_param:rundeck_forward_iframe}
+        host: ${_param:rundeck_iframe_host}
+        port: ${_param:rundeck_iframe_port}
+        https: ${_param:rundeck_iframe_ssl}
       ssh:
         user: ${_param:rundeck_runbook_user}
         private_key: ${_param:rundeck_runbook_private_key}
diff --git a/salt/control/virt.yml b/salt/control/virt.yml
index 7556dc9..aea524c 100644
--- a/salt/control/virt.yml
+++ b/salt/control/virt.yml
@@ -48,3 +48,12 @@
       xxxxlarge:
         - system:
             size: 700000
+      huge:
+        - system:
+            size: 1000000
+      xhuge:
+        - system:
+            size: 1500000
+      xxhuge:
+        - system:
+            size: 3000000
diff --git a/salt/master/formula/git/monitoring.yml b/salt/master/formula/git/monitoring.yml
index e0cf30d..ab8a8fc 100644
--- a/salt/master/formula/git/monitoring.yml
+++ b/salt/master/formula/git/monitoring.yml
@@ -4,6 +4,10 @@
       environment:
         dev:
           formula:
+            fluentd:
+              source: git
+              address: '${_param:salt_master_environment_repository}/salt-formula-fluentd.git'
+              revision: ${_param:salt_master_environment_revision}
             prometheus:
               source: git
               address: '${_param:salt_master_environment_repository}/salt-formula-prometheus.git'
diff --git a/salt/master/formula/pkg/monitoring.yml b/salt/master/formula/pkg/monitoring.yml
index 375cbd8..9e2db0b 100644
--- a/salt/master/formula/pkg/monitoring.yml
+++ b/salt/master/formula/pkg/monitoring.yml
@@ -4,6 +4,9 @@
       environment:
         prd:
           formula:
+            fluentd:
+              source: pkg
+              name: salt-formula-fluentd
             prometheus:
               source: pkg
               name: salt-formula-prometheus
diff --git a/salt/master/pillar/composite/init.yml b/salt/master/pillar/composite/init.yml
new file mode 100644
index 0000000..c095d59
--- /dev/null
+++ b/salt/master/pillar/composite/init.yml
@@ -0,0 +1,2 @@
+classes:
+- service.salt.master.pillar.composite
diff --git a/salt/master/pillar/composite/nacl.yml b/salt/master/pillar/composite/nacl.yml
new file mode 100644
index 0000000..a2d382b
--- /dev/null
+++ b/salt/master/pillar/composite/nacl.yml
@@ -0,0 +1,2 @@
+classes:
+- service.salt.master.pillar.composite.nacl
diff --git a/salt/master/pillar/composite/reclass.yml b/salt/master/pillar/composite/reclass.yml
new file mode 100644
index 0000000..0b5443b
--- /dev/null
+++ b/salt/master/pillar/composite/reclass.yml
@@ -0,0 +1,2 @@
+classes:
+- service.salt.master.pillar.composite.reclass
diff --git a/salt/master/pillar/composite/saltclass.yml b/salt/master/pillar/composite/saltclass.yml
new file mode 100644
index 0000000..8ff5e0b
--- /dev/null
+++ b/salt/master/pillar/composite/saltclass.yml
@@ -0,0 +1,2 @@
+classes:
+- service.salt.master.pillar.composite.saltclass
diff --git a/salt/master/pillar/reclass.yml b/salt/master/pillar/reclass.yml
new file mode 100644
index 0000000..cfeca33
--- /dev/null
+++ b/salt/master/pillar/reclass.yml
@@ -0,0 +1,2 @@
+classes:
+- service.salt.master.pillar.reclass
diff --git a/salt/minion/cert/k8s_client.yml b/salt/minion/cert/k8s_client.yml
index 06d83c4..be262b5 100644
--- a/salt/minion/cert/k8s_client.yml
+++ b/salt/minion/cert/k8s_client.yml
@@ -8,6 +8,34 @@
           key_file: /etc/kubernetes/ssl/kubelet-client.key
           cert_file: /etc/kubernetes/ssl/kubelet-client.crt
           ca_file: /etc/kubernetes/ssl/ca-kubernetes.crt
-          common_name: kubelet-client
+          common_name: system:node:${linux:system:name}
+          organization_name: system:nodes
           signing_policy: cert_client
-          alternative_names: IP:${_param:cluster_vip_address},IP:${_param:cluster_node01_address},IP:${_param:cluster_node02_address},IP:${_param:cluster_node03_address},IP:${_param:kubernetes_internal_api_address}
\ No newline at end of file
+          alternative_names: IP:${_param:cluster_vip_address},IP:${_param:cluster_node01_address},IP:${_param:cluster_node02_address},IP:${_param:cluster_node03_address},IP:${_param:kubernetes_internal_api_address}
+        k8s_proxy:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          key_file: /etc/kubernetes/ssl/kube-proxy-client.key
+          cert_file: /etc/kubernetes/ssl/kube-proxy-client.crt
+          ca_file: /etc/kubernetes/ssl/ca-kubernetes.crt
+          common_name: system:kube-proxy
+          signing_policy: cert_client
+          alternative_names: IP:${_param:cluster_vip_address},IP:${_param:cluster_node01_address},IP:${_param:cluster_node02_address},IP:${_param:cluster_node03_address},IP:${_param:kubernetes_internal_api_address}
+        k8s_scheduler:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          key_file: /etc/kubernetes/ssl/kube-scheduler-client.key
+          cert_file: /etc/kubernetes/ssl/kube-scheduler-client.crt
+          ca_file: /etc/kubernetes/ssl/ca-kubernetes.crt
+          common_name: system:kube-scheduler
+          signing_policy: cert_client
+          alternative_names: IP:${_param:cluster_vip_address},IP:${_param:cluster_node01_address},IP:${_param:cluster_node02_address},IP:${_param:cluster_node03_address},IP:${_param:kubernetes_internal_api_address}
+        k8s_controller_manager:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          key_file: /etc/kubernetes/ssl/kube-controller-manager-client.key
+          cert_file: /etc/kubernetes/ssl/kube-controller-manager-client.crt
+          ca_file: /etc/kubernetes/ssl/ca-kubernetes.crt
+          common_name: system:kube-controller-manager
+          signing_policy: cert_client
+          alternative_names: IP:${_param:cluster_vip_address},IP:${_param:cluster_node01_address},IP:${_param:cluster_node02_address},IP:${_param:cluster_node03_address},IP:${_param:kubernetes_internal_api_address}
diff --git a/salt/minion/cert/k8s_client_single.yml b/salt/minion/cert/k8s_client_single.yml
index 179d534..e9c7d79 100644
--- a/salt/minion/cert/k8s_client_single.yml
+++ b/salt/minion/cert/k8s_client_single.yml
@@ -8,6 +8,34 @@
           key_file: /etc/kubernetes/ssl/kubelet-client.key
           cert_file: /etc/kubernetes/ssl/kubelet-client.crt
           ca_file: /etc/kubernetes/ssl/ca-kubernetes.crt
-          common_name: kubelet-client
+          common_name: system:node:${linux:system:name}
+          organization_name: system:nodes
           signing_policy: cert_client
-          alternative_names: IP:${_param:control_address},IP:${_param:kubernetes_internal_api_address}
\ No newline at end of file
+          alternative_names: IP:${_param:control_address},IP:${_param:kubernetes_internal_api_address}
+        k8s_proxy:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          key_file: /etc/kubernetes/ssl/kube-proxy-client.key
+          cert_file: /etc/kubernetes/ssl/kube-proxy-client.crt
+          ca_file: /etc/kubernetes/ssl/ca-kubernetes.crt
+          common_name: system:kube-proxy
+          signing_policy: cert_client
+          alternative_names: IP:${_param:control_address},IP:${_param:kubernetes_internal_api_address}
+        k8s_scheduler:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          key_file: /etc/kubernetes/ssl/kube-scheduler-client.key
+          cert_file: /etc/kubernetes/ssl/kube-scheduler-client.crt
+          ca_file: /etc/kubernetes/ssl/ca-kubernetes.crt
+          common_name: system:kube-scheduler
+          signing_policy: cert_client
+          alternative_names: IP:${_param:control_address},IP:${_param:kubernetes_internal_api_address}
+        k8s_controller_manager:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          key_file: /etc/kubernetes/ssl/kube-controller-manager-client.key
+          cert_file: /etc/kubernetes/ssl/kube-controller-manager-client.crt
+          ca_file: /etc/kubernetes/ssl/ca-kubernetes.crt
+          common_name: system:kube-controller-manager
+          signing_policy: cert_client
+          alternative_names: IP:${_param:control_address},IP:${_param:kubernetes_internal_api_address}
diff --git a/salt/syndic/cluster.yml b/salt/syndic/cluster.yml
new file mode 100644
index 0000000..55ae6d7
--- /dev/null
+++ b/salt/syndic/cluster.yml
@@ -0,0 +1,11 @@
+classes:
+- service.salt.syndic.cluster
+parameters:
+  _param:
+    salt_syndic_master_address_01: 127.0.0.1
+    salt_syndic_master_address_02: 127.0.0.1
+  salt:
+    syndic:
+      masters:
+      - host: ${_param:salt_syndic_master_address_01}
+      - host: ${_param:salt_syndic_master_address_02}
diff --git a/salt/syndic/single.yml b/salt/syndic/single.yml
new file mode 100644
index 0000000..8c015b7
--- /dev/null
+++ b/salt/syndic/single.yml
@@ -0,0 +1,5 @@
+classes:
+- service.salt.syndic.single
+parameters:
+  _param:
+    salt_syndic_master_address: 127.0.0.1