diff --git a/aptly/server/docker.yml b/aptly/server/docker.yml
index 3fa0a8e1..4e70a92 100644
--- a/aptly/server/docker.yml
+++ b/aptly/server/docker.yml
@@ -6,6 +6,8 @@
     aptly_gpg_keypair_id: none
     aptly_gpg_public_key: none
     aptly_gpg_private_key: none
+    aptly_server_mirror_sources: false
+    aptly_server_mirror_ubuntu_sources: ${_param:aptly_server_mirror_sources}
   aptly:
     server:
       enabled: true
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu.yml
index 3cd7c7b..3495967 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     linux_system_country_code: cz
+    aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
   aptly:
     server:
       mirror:
@@ -8,6 +9,7 @@
         trusty-main:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: trusty
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           components: main
           architectures: amd64
           gpgkeys:
@@ -21,6 +23,7 @@
         trusty-multiverse:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: trusty
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           components: multiverse
           architectures: amd64
           gpgkeys:
@@ -33,6 +36,7 @@
               - ubuntu/trusty
         trusty-restricted:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty
           components: restricted
           architectures: amd64
@@ -46,6 +50,7 @@
               - ubuntu/trusty
         trusty-universe:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty
           components: universe
           architectures: amd64
@@ -61,6 +66,7 @@
         # trusty-updates
         trusty-updates-main:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-updates
           components: main
           architectures: amd64
@@ -74,6 +80,7 @@
               - ubuntu/trusty-updates
         trusty-updates-multiverse:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-updates
           components: multiverse
           architectures: amd64
@@ -87,6 +94,7 @@
               - ubuntu/trusty-updates
         trusty-updates-restricted:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-updates
           components: restricted
           architectures: amd64
@@ -100,6 +108,7 @@
               - ubuntu/trusty-updates
         trusty-updates-universe:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-updates
           components: universe
           architectures: amd64
@@ -115,6 +124,7 @@
         #trusty-security:
         trusty-security-main:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-security
           components: main
           architectures: amd64
@@ -128,6 +138,7 @@
               - ubuntu/trusty-security
         trusty-security-multiverse:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-security
           components: multiverse
           architectures: amd64
@@ -141,6 +152,7 @@
               - ubuntu/trusty-security
         trusty-security-restricted:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-security
           components: restricted
           architectures: amd64
@@ -154,6 +166,7 @@
               - ubuntu/trusty-security
         trusty-security-universe:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-security
           components: universe
           architectures: amd64
@@ -169,6 +182,7 @@
         #trusty-proposed:
         trusty-proposed-main:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-proposed
           components: main
           architectures: amd64
@@ -182,6 +196,7 @@
               - ubuntu/trusty-proposed
         trusty-proposed-multiverse:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-proposed
           components: multiverse
           architectures: amd64
@@ -195,6 +210,7 @@
               - ubuntu/trusty-proposed
         trusty-proposed-restricted:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-proposed
           components: restricted
           architectures: amd64
@@ -208,6 +224,7 @@
               - ubuntu/trusty-proposed
         trusty-proposed-universe:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-proposed
           components: universe
           architectures: amd64
@@ -223,6 +240,7 @@
         #trusty-backports:
         trusty-backports-main:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-backports
           components: main
           architectures: amd64
@@ -236,6 +254,7 @@
               - ubuntu/trusty-backports
         trusty-backports-multiverse:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-backports
           components: multiverse
           architectures: amd64
@@ -249,6 +268,7 @@
               - ubuntu/trusty-backports
         trusty-backports-restricted:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-backports
           components: restricted
           architectures: amd64
@@ -262,6 +282,7 @@
               - ubuntu/trusty-backports
         trusty-backports-universe:
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+          sources: ${_param:aptly_server_mirror_ubuntu_trusty_sources}
           distribution: trusty-backports
           components: universe
           architectures: amd64
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu.yml
index 4675063..6b41aee 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu.yml
@@ -2,12 +2,13 @@
   _param:
     linux_system_country_code_default: cz
     linux_system_country_code: ${_param:linux_system_country_code_default}
+    aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
   aptly:
     server:
       mirror:
         # xenial
         xenial-main:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial
           components: main
@@ -21,7 +22,7 @@
             distributions:
               - ubuntu/xenial
         xenial-multiverse:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial
           components: multiverse
@@ -35,7 +36,7 @@
             distributions:
               - ubuntu/xenial
         xenial-restricted:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial
           components: restricted
@@ -49,7 +50,7 @@
             distributions:
               - ubuntu/xenial
         xenial-universe:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial
           components: universe
@@ -65,7 +66,7 @@
 
         # xenial-updates
         xenial-updates-main:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial-updates
           components: main
@@ -79,7 +80,7 @@
             distributions:
               - ubuntu/xenial-updates
         xenial-updates-multiverse:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial-updates
           components: multiverse
@@ -93,7 +94,7 @@
             distributions:
               - ubuntu/xenial-updates
         xenial-updates-restricted:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial-updates
           components: restricted
@@ -107,7 +108,7 @@
             distributions:
               - ubuntu/xenial-updates
         xenial-updates-universe:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial-updates
           components: universe
@@ -123,7 +124,7 @@
 
         #xenial-security:
         xenial-security-main:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial-security
           components: main
@@ -137,7 +138,7 @@
             distributions:
               - ubuntu/xenial-security
         xenial-security-multiverse:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial-security
           components: multiverse
@@ -151,7 +152,7 @@
             distributions:
               - ubuntu/xenial-security
         xenial-security-restricted:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial-security
           components: restricted
@@ -165,7 +166,7 @@
             distributions:
               - ubuntu/xenial-security
         xenial-security-universe:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial-security
           components: universe
@@ -181,7 +182,7 @@
 
         #xenial-proposed:
         xenial-proposed-main:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial-proposed
           components: main
@@ -195,7 +196,7 @@
             distributions:
               - ubuntu/xenial-proposed
         xenial-proposed-multiverse:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial-proposed
           components: multiverse
@@ -263,7 +264,7 @@
             distributions:
               - ubuntu/xenial-backports
         xenial-backports-restricted:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial-backports
           components: restricted
@@ -277,7 +278,7 @@
             distributions:
               - ubuntu/xenial-backports
         xenial-backports-universe:
-          sources: true
+          sources: ${_param:aptly_server_mirror_ubuntu_xenial_sources}
           source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
           distribution: xenial-backports
           components: universe
diff --git a/aptly/server/single.yml b/aptly/server/single.yml
index 8b71974..e8da341 100644
--- a/aptly/server/single.yml
+++ b/aptly/server/single.yml
@@ -6,6 +6,8 @@
   _param:
     nginx_aptly_server_host: ${linux:network:fqdn}
     aptly_server_secure: true
+    aptly_server_mirror_sources: false
+    aptly_server_mirror_ubuntu_sources: ${_param:aptly_server_mirror_sources}
   iptables:
     service:
       enabled: true
diff --git a/designate/server/backend/bind.yml b/designate/server/backend/bind.yml
index 4201f60..823d52d 100644
--- a/designate/server/backend/bind.yml
+++ b/designate/server/backend/bind.yml
@@ -21,7 +21,7 @@
         local:
           enabled: true
           bind:
-            address: ${_param:single_address}
+            address: 127.0.0.1
             port: 953
           allow:
             - 127.0.0.1
diff --git a/jenkins/client/job/debian/packages/extra.yml b/jenkins/client/job/debian/packages/extra.yml
index c7df567..b344c63 100644
--- a/jenkins/client/job/debian/packages/extra.yml
+++ b/jenkins/client/job/debian/packages/extra.yml
@@ -101,6 +101,10 @@
               dist: trusty
               build: pipeline
               branch: debian/trusty
+            - package: libvirt-exporter
+              dist: trusty
+              build: libvirt-exporter
+              branch: master
             - package: librdkafka
               dist: xenial
               build: pipeline
@@ -165,6 +169,10 @@
               dist: xenial
               build: jmx-exporter
               branch: master
+            - package: influxdb-relay
+              dist: xenial
+              build: influxdb-relay
+              branch: master
           template:
             type: workflow-scm
             concurrent: false
diff --git a/jenkins/client/job/deploy/update/utils.yml b/jenkins/client/job/deploy/update/utils.yml
new file mode 100644
index 0000000..fa6ce14
--- /dev/null
+++ b/jenkins/client/job/deploy/update/utils.yml
@@ -0,0 +1,70 @@
+parameters:
+  jenkins:
+    client:
+      job:
+        reclass_metadata_update:
+          type: workflow-scm
+          concurrent: true
+          display_name: "Deploy - Update reclass metadata"
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            credentials: "gerrit"
+            script: update-reclass-metadata.groovy
+          param:
+            SALT_MASTER_URL:
+              type: string
+              default: "http://127.0.0.1:8000"
+              description: Full Salt API address [https://127.0.0.1:8000].
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+              description: Credentials to the Salt API.
+            TARGET_SERVERS:
+              type: string
+              default: "I@reclass:storage"
+              description: Salt compound target to match nodes to be updated.
+        salt_master_formula_update:
+          type: workflow-scm
+          concurrent: true
+          display_name: "Deploy - Update salt master formulas"
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            credentials: "gerrit"
+            script: update-salt-master-formulas.groovy
+          param:
+            SALT_MASTER_URL:
+              type: string
+              default: "http://127.0.0.1:8000"
+              description: Full Salt API address [https://127.0.0.1:8000].
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+              description: Credentials to the Salt API.
+            TARGET_SERVERS:
+              type: string
+              default: "I@reclass:storage"
+              description: Salt compound target to match nodes to be updated.
+        jenkins_master_job_update:
+          type: workflow-scm
+          concurrent: true
+          display_name: "Deploy - Update jenkins master jobs"
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            credentials: "gerrit"
+            script: update-jenkins-master-jobs.groovy
+          param:
+            SALT_MASTER_URL:
+              type: string
+              default: "http://127.0.0.1:8000"
+              description: Full Salt API address [https://127.0.0.1:8000].
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+              description: Credentials to the Salt API.
+            TARGET_SERVERS:
+              type: string
+              default: "I@reclass:storage"
+              description: Salt compound target to match nodes to be updated.
diff --git a/jenkins/client/job/git-mirrors/downstream/debian-packages.yml b/jenkins/client/job/git-mirrors/downstream/debian-packages.yml
index dde7d9a..eb899dc 100644
--- a/jenkins/client/job/git-mirrors/downstream/debian-packages.yml
+++ b/jenkins/client/job/git-mirrors/downstream/debian-packages.yml
@@ -15,3 +15,7 @@
         downstream: debian/gophercloud
         upstream: "https://github.com/gophercloud/gophercloud.git"
         branches: master
+      - name: debian-influxdb-relay
+        downstream: debian/influxdb-relay
+        upstream: "https://github.com/influxdata/influxdb-relay.git"
+        branches: master
diff --git a/jenkins/client/job/opencontrail/build/generic.yml b/jenkins/client/job/opencontrail/build/generic.yml
index 19701d6..f21eaa9 100644
--- a/jenkins/client/job/opencontrail/build/generic.yml
+++ b/jenkins/client/job/opencontrail/build/generic.yml
@@ -85,7 +85,7 @@
               branch: R4.0
               ppa: mirantis-opencontrail/opencontrail-4.0
               upload_source_package: true
-              dpdk: contrail_dpdk_2_1
+              dpdk: contrail_dpdk_17_02
               build_trigger: "H H(20-23) * * *"
             - buildname: oc40
               os: ubuntu
@@ -93,22 +93,6 @@
               branch: R4.0
               ppa: mirantis-opencontrail/opencontrail-4.0
               upload_source_package: true
-              dpdk: contrail_dpdk_2_1
-              build_trigger: "H H(20-23) * * *"
-            - buildname: oc40-dpdk1702
-              os: ubuntu
-              dist: trusty
-              branch: R4.0
-              ppa: mirantis-opencontrail/opencontrail-4.0-dpdk-17-02
-              upload_source_package: false
-              dpdk: contrail_dpdk_17_02
-              build_trigger: "H H(20-23) * * *"
-            - buildname: oc40-dpdk1702
-              os: ubuntu
-              dist: xenial
-              branch: R4.0
-              ppa: mirantis-opencontrail/opencontrail-4.0-dpdk-17-02
-              upload_source_package: false
               dpdk: contrail_dpdk_17_02
               build_trigger: "H H(20-23) * * *"
             - buildname: oc666
@@ -116,15 +100,17 @@
               dist: trusty
               branch: master
               ppa: mirantis-opencontrail/opencontrail-master
-              upload_source_package: false
-              build_trigger: ""
+              upload_source_package: true
+              dpdk: contrail_dpdk_17_02
+              build_trigger: "H H(20-23) * * *"
             - buildname: oc666
               os: ubuntu
               dist: xenial
               branch: master
               ppa: mirantis-opencontrail/opencontrail-master
-              upload_source_package: false
-              build_trigger: ""
+              upload_source_package: true
+              dpdk: contrail_dpdk_17_02
+              build_trigger: "H H(20-23) * * *"
           template:
             discard:
              build:
diff --git a/jenkins/client/job/salt-models/tests.yml b/jenkins/client/job/salt-models/tests.yml
index dd2ca90..3233495 100644
--- a/jenkins/client/job/salt-models/tests.yml
+++ b/jenkins/client/job/salt-models/tests.yml
@@ -1,6 +1,6 @@
 parameters:
   _param:
-  jenkins_pollscm_spec: "0 1 * * *"
+    jenkins_pollscm_spec: "0 1 * * *"
   jenkins:
     client:
       job_template:
@@ -103,6 +103,11 @@
           jobs:
             - cookiecutter_template: cookiecutter-templates
           template:
+            discard:
+             build:
+               keep_num: 20
+             artifact:
+               keep_num: 20
             type: workflow-scm
             concurrent: true
             scm:
diff --git a/linux/system/profile/autosudo.yml b/linux/system/profile/autosudo.yml
new file mode 100644
index 0000000..ff5f029
--- /dev/null
+++ b/linux/system/profile/autosudo.yml
@@ -0,0 +1,127 @@
+parameters:
+  linux:
+    system:
+      profile:
+        # script provides sudoon & sudooff commands, allows working as-if root while tracking all commands
+        autosudo.sh: |
+          #!/bin/bash
+
+          # USAGE: $ . autosudo.sh
+          #        $ sudoon
+          #        $ sudo: <any commands>
+          #        $ sudo: ...
+          #        $ sudo: sudooff
+          # LIMITATIONS:
+          #   - does not check your sudo policy, assumes "bash -c ..." is allowed
+          #   - autocompletion (tab) for files/dirs does not work in restricted folders
+          #   - may contain bugs
+          # NOTES: supports "cd ..."; allows to freely operate in restricted directories
+
+          function sudoon () {
+            if [ -z "$PREEXEC_PROMPT" ]
+            then
+              trap - DEBUG
+              ORIGINAL_PROMPT_COMMAND="$PROMPT_COMMAND"
+              PREEXEC_PROMPT=1
+              ORIGINAL_PS1=$PS1
+              PS1=$ORIGINAL_PS1"sudo: "
+              shopt -s extdebug
+              PROMPT_COMMAND="_preexec_prompt"
+              trap "_preexec_sudo" DEBUG
+            fi
+          }
+
+          function sudooff () {
+            trap - DEBUG
+            shopt -u extdebug
+            unset PREEXEC_PROMPT
+            PS1=$ORIGINAL_PS1
+            unset SUDO_DIR
+            PROMPT_COMMAND="$ORIGINAL_PROMPT_COMMAND"
+            unset ORIGINAL_PROMPT_COMMAND
+          }
+
+          function _preexec_prompt() {
+            trap - DEBUG
+            PREEXEC_PROMPT=1
+            trap "_preexec_sudo" DEBUG
+          }
+
+
+          function _preexec_sudo() {
+            # echo PREEXEC_PROMPT=$PREEXEC_PROMPT BASH_COMMAND=$BASH_COMMAND SUDO_DIR=$SUDO_DIR
+            [ -n "$COMP_LINE" ] && return
+            [ "$BASH_COMMAND" == "$PROMPT_COMMAND" ] && return
+            [ -z "$BASH_COMMAND" ] && return
+            [[ "$BASH_COMMAND" =~ ^exit$|^set\ |^shopt\ |^trap\ |^sudoon$|^sudooff$ ]] && return
+            [ -z "$PREEXEC_PROMPT" ] && return
+            if [ "$PREEXEC_PROMPT" -eq 0 ]; then
+              # echo cancelling "$BASH_COMMAND"
+              return 1
+            fi
+
+            # echo "trap-DEBUG"
+            trap - DEBUG
+            PREEXEC_PROMPT=0
+            FULL_COMMAND=$(HISTTIMEFORMAT='' history 1 | sed -e "s/^[ ]*[0-9]*[ ]*//")
+            # echo "Running _preexec_sudo $FULL_COMMAND"
+            ARG_0=$(cut -d' ' -f1 <<< "$BASH_COMMAND")
+            TYPE=$(type "$ARG_0" 2> /dev/null | head -n 1)
+            if [[ ! "$TYPE" =~ / ]]
+            then
+              if [ "$BASH_COMMAND" == "$FULL_COMMAND" ]
+              then
+                if [[ "$BASH_COMMAND" =~ ^cd\  ]]
+                then
+                  if [ -z "$SUDO_DIR" ]
+                  then
+                    if $BASH_COMMAND 2> /dev/null
+                    then
+                      trap "_preexec_sudo" DEBUG
+                      return 1
+                    else
+                      DIR=$(sudo bash -c "$BASH_COMMAND; pwd")
+                      DIR_ERR=$?
+                    fi
+                  else
+                    DIR=$(sudo bash -c "cd $SUDO_DIR; $BASH_COMMAND; pwd")
+                    DIR_ERR=$?
+                  fi
+                  if [ "$DIR_ERR" -eq 0 ]
+                  then
+                    if cd "$DIR" 2> /dev/null
+                    then
+                      SUDO_DIR=''
+                      PS1=$ORIGINAL_PS1"sudo: "
+                    else
+                      SUDO_DIR=$DIR
+                      [ -n "$SUDO_DIR" ] && PS1_SUDO_DIR="($(echo "$SUDO_DIR" | rev | cut -d'/' -f1 | rev))" || PS1_SUDO_DIR=''
+                      PS1=$ORIGINAL_PS1"sudo$PS1_SUDO_DIR: "
+                    fi
+                  fi
+                  trap "_preexec_sudo" DEBUG
+                  return 1
+                elif [ -z "$SUDO_DIR" ]
+                then
+                  trap "_preexec_sudo" DEBUG
+                  return # single call to function / builtin; not sudoing
+                fi
+              fi
+            fi
+            [[ "$TYPE" =~ / ]] && [ "$(which "$ARG_0")" == "$(which sudo)" ] && return 0 # execute explicit sudo as-is
+            if [ -n "$SUDO_DIR" ]
+            then
+              CMD_DIR="cd $SUDO_DIR; "
+            else
+              CMD_DIR=''
+            fi
+            if [ ! "$BASH_COMMAND" == "$FULL_COMMAND" ] || [ -n "$CMD_DIR" ]
+            then
+              # echo combined or cd command: `printf '%q' "$CMD_DIR$FULL_COMMAND"`
+              eval sudo -E bash -c $(printf '%q' "$CMD_DIR$FULL_COMMAND")
+            else
+              eval sudo -E $FULL_COMMAND
+            fi
+            trap "_preexec_sudo" DEBUG
+            return 1
+          }
diff --git a/openssh/server/team/members/nadezhdakabanova.yml b/openssh/server/team/members/nkabanova.yml
similarity index 68%
rename from openssh/server/team/members/nadezhdakabanova.yml
rename to openssh/server/team/members/nkabanova.yml
index 58d2ed3..fdbb827 100644
--- a/openssh/server/team/members/nadezhdakabanova.yml
+++ b/openssh/server/team/members/nkabanova.yml
@@ -20,4 +20,6 @@
   public_keys:
     nkabanova:
       - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDuI74hcXTCbbvWoWHNLkng0nDBBwEzZJu8APmKVBukr9Lldz5r8n4OLRzlMI9oKbzvOuY082Cwp+9f5w5ViF/wmmEBa5sktUOBI5Jsi+g5ulb1i2HQOiaRibFJZZcoW03YRQCqQ8D9H4QcuXkT4oNuL5Wcj0UKPQT5r6N2kvuNXlJfEezQQim4nVRymel2USPt/AhlN4AUfBShR8Ykaky2Me4pt5xi0fLOJ9ZDWlEa4dl19Jd4tPz66+dLPiWql+6dgd9GiN+f7NLdDOv3RfOBH6n/It4y/fI+2/UY57X13dWauQNIQHQHDTpCCRiB+XOHwoCRaV81XTHbR865+/sP
+      - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTOke7Y9PB9lbFxaOHVq/YriVzPWsjH+Ie/KiqfjkeLLy3HsUIAJGrxeDbT1YB8Y6OBEKrCk45ECgsRu6MS6jMx4CmJPEV2QNf05Y7g3XBoTeNZwUQtW1aUER6ZXALiBon81cAvVhHDIRHDwTxrSMUTyY0m4sInSt+M6yg22nW24BJLNbRvKwMvO0bdVFzCHrTWbODAOGNplQf63eWlYC2t87PsqTT8CVHgv40QGLIbmGFCyMhnTk2TUMW8d8qMLzHAQU8Cd50HLW6mCEF1oW5QNffpemqeW0oA8vi2iLcRV0lbD5yuwaojYRMpudXOzMttkfjz/+ok/d+qWpiUzep root@Nadezhda
+
 
diff --git a/openssh/server/team/support.yml b/openssh/server/team/support.yml
index 4dd5bdc..d4afcf5 100644
--- a/openssh/server/team/support.yml
+++ b/openssh/server/team/support.yml
@@ -15,7 +15,6 @@
 - system.openssh.server.team.members.matthewroark
 - system.openssh.server.team.members.maximefimov
 - system.openssh.server.team.members.mikhailkraynov
-- system.openssh.server.team.members.nadezhdakabanova
 - system.openssh.server.team.members.renesoto
 - system.openssh.server.team.members.rsafonov
 - system.openssh.server.team.members.scottmachtmes
@@ -31,6 +30,7 @@
 - system.openssh.server.team.members.fsoppelsa
 - system.openssh.server.team.members.manashkin
 - system.openssh.server.team.members.nkondra
+- system.openssh.server.team.members.nkabanova
 - system.openssh.server.team.members.obryndzii
 - system.openssh.server.team.members.oliemieshko
 - system.openssh.server.team.members.sovsianikov
@@ -98,6 +98,7 @@
             - ${linux:system:user:fsoppelsa:name}
             - ${linux:system:user:manashkin:name}
             - ${linux:system:user:nkondra:name}
+            - ${linux:system:user:nkabanova:name}
             - ${linux:system:user:obryndzii:name}
             - ${linux:system:user:oliemieshko:name}
             - ${linux:system:user:sovsianikov:name}
diff --git a/salt/master/formula/git/saltstack.yml b/salt/master/formula/git/saltstack.yml
index ebcf96f..fde03ef 100644
--- a/salt/master/formula/git/saltstack.yml
+++ b/salt/master/formula/git/saltstack.yml
@@ -39,10 +39,21 @@
               source: git
               address: '${_param:salt_master_environment_repository}/salt-formula-reclass.git'
               revision: ${_param:salt_master_environment_revision}
+              module:
+                reclass.py:
+                  enabled: true
+              state:
+                reclass.py:
+                  enabled: true
             salt:
               source: git
               address: '${_param:salt_master_environment_repository}/salt-formula-salt.git'
               revision: ${_param:salt_master_environment_revision}
+              module:
+                seedng.py:
+                  enabled: true
+                virtng.py:
+                  enabled: true
             sphinx:
               source: git
               address: '${_param:salt_master_environment_repository}/salt-formula-sphinx.git'
diff --git a/salt/minion/cert/salt_api.yml b/salt/minion/cert/salt_api.yml
new file mode 100644
index 0000000..acd9bba
--- /dev/null
+++ b/salt/minion/cert/salt_api.yml
@@ -0,0 +1,11 @@
+parameters:
+  salt:
+    minion:
+      cert:
+        salt_api:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: salt_api
+          signing_policy: cert_server
+          alternative_names: IP:${_param:salt_master_host},IP:127.0.0.1,DNS:${_param:infra_config_hostname}.${_param:cluster_domain}
+          mode: '0644'