diff --git a/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk.yml b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk.yml
new file mode 100644
index 0000000..553e6dd
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/trusty/mcp/apt_mk.yml
@@ -0,0 +1,79 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+  aptly:
+    server:
+      mirror:
+        # required for opencontrail formulas
+        mcp_opencontrail_trusty_oc311:
+          source: http://apt-mk.mirantis.com/trusty/
+          distribution: ${_param:apt_mk_version}
+          components: oc311
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+          gpgkeys:
+            - A76882D3
+          publisher:
+            component: oc311
+            distributions:
+              - ubuntu-trusty/${_param:apt_mk_version}
+        mcp_opencontrail_trusty_oc31:
+          source: http://apt-mk.mirantis.com/trusty/
+          distribution: ${_param:apt_mk_version}
+          components: oc31
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+          gpgkeys:
+            - A76882D3
+          publisher:
+            component: oc31
+            distributions:
+              - ubuntu-trusty/${_param:apt_mk_version}
+        mcp_opencontrail_trusty_oc32:
+          source: http://apt-mk.mirantis.com/trusty/
+          distribution: ${_param:apt_mk_version}
+          components: oc32
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+          gpgkeys:
+            - A76882D3
+          publisher:
+            component: oc32
+            distributions:
+              - ubuntu-trusty/${_param:apt_mk_version}
+        mcp_opencontrail_trusty_oc303:
+          source: http://apt-mk.mirantis.com/trusty/
+          distribution: ${_param:apt_mk_version}
+          components: oc303
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+          gpgkeys:
+            - A76882D3
+          publisher:
+            component: oc303
+            distributions:
+              - ubuntu-trusty/${_param:apt_mk_version}
+        mirantis_openstack_trusty_extra:
+          source: http://apt-mk.mirantis.com/trusty/
+          distribution: ${_param:apt_mk_version}
+          components: extra
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+          gpgkeys:
+            - A76882D3
+          publisher:
+            component: extra
+            distributions:
+              - ubuntu-trusty/${_param:apt_mk_version}
+        mirantis_openstack_trusty_salt:
+          source: http://apt-mk.mirantis.com/trusty/
+          distribution: ${_param:apt_mk_version}
+          components: salt
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+          gpgkeys:
+            - A76882D3
+          publisher:
+            component: salt
+            distributions:
+              - ubuntu-trusty/${_param:apt_mk_version}
diff --git a/aptly/server/mirror/ubuntu/trusty/mcp/openstack.yml b/aptly/server/mirror/ubuntu/trusty/mcp/openstack.yml
new file mode 100644
index 0000000..b419b8b
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/trusty/mcp/openstack.yml
@@ -0,0 +1,74 @@
+parameters:
+  _param:
+    mcp_repo_version: 1.0
+    linux_system_codename: trusty
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_trusty:
+          source: http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}
+          distribution: mitaka
+          components: main restricted
+          architectures: amd64
+          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}/archive-mcp${_param:mcp_repo_version}.key"
+          gpgkeys:
+            - 1FA22B08
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/mitaka
+
+        mirantis_openstack_hotfix_trusty:
+          source: http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}
+          distribution: mitaka-hotfix
+          components: main restricted
+          architectures: amd64
+          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}/archive-mcp${_param:mcp_repo_version}.key"
+          gpgkeys:
+            - 1FA22B08
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/mitaka-hotfix
+
+        mirantis_openstack_security_trusty:
+          source: http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}
+          distribution: mitaka-security
+          components: main restricted
+          architectures: amd64
+          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}/archive-mcp${_param:mcp_repo_version}.key"
+          gpgkeys:
+            - 1FA22B08
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/mitaka-security
+
+        # required for alternative horizon plugins/etc..
+        mirantis_openstack_updates_trusty:
+          source: http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}
+          distribution: mitaka-updates
+          components:  main restricted
+          architectures: amd64
+          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}/archive-mcp${_param:mcp_repo_version}.key"
+          gpgkeys:
+            - 1FA22B08
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/mitaka-updates
+
+        # required for salt formulas
+        mirantis_openstack_holdback_trusty:
+          source: http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}
+          distribution: mitaka-holdback
+          components: main restricted
+          architectures: amd64
+          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}/archive-mcp${_param:mcp_repo_version}.key"
+          gpgkeys:
+          - 1FA22B08
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-trusty/mitaka-holdback
+
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk.yml b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk.yml
new file mode 100644
index 0000000..6272b69
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/apt_mk.yml
@@ -0,0 +1,79 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+  aptly:
+    server:
+      mirror:
+        # required for opencontrail formulas
+        mcp_opencontrail_xenial_oc311:
+          source: http://apt-mk.mirantis.com/xenial/
+          distribution: ${_param:apt_mk_version}
+          components: oc311
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+          gpgkeys:
+            - A76882D3
+          publisher:
+            component: oc311
+            distributions:
+              - ubuntu-xenial/${_param:apt_mk_version}
+        mcp_opencontrail_xenial_oc31:
+          source: http://apt-mk.mirantis.com/xenial/
+          distribution: ${_param:apt_mk_version}
+          components: oc31
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+          gpgkeys:
+            - A76882D3
+          publisher:
+            component: oc31
+            distributions:
+              - ubuntu-xenial/${_param:apt_mk_version}
+        mcp_opencontrail_xenial_oc32:
+          source: http://apt-mk.mirantis.com/xenial/
+          distribution: ${_param:apt_mk_version}
+          components: oc32
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+          gpgkeys:
+            - A76882D3
+          publisher:
+            component: oc32
+            distributions:
+              - ubuntu-xenial/${_param:apt_mk_version}
+        mcp_opencontrail_xenial_oc303:
+          source: http://apt-mk.mirantis.com/xenial/
+          distribution: ${_param:apt_mk_version}
+          components: oc303
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+          gpgkeys:
+            - A76882D3
+          publisher:
+            component: oc303
+            distributions:
+              - ubuntu-xenial/${_param:apt_mk_version}
+        mirantis_openstack_xenial_extra:
+          source: http://apt-mk.mirantis.com/xenial/
+          distribution: ${_param:apt_mk_version}
+          components: extra
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+          gpgkeys:
+            - A76882D3
+          publisher:
+            component: extra
+            distributions:
+              - ubuntu-xenial/${_param:apt_mk_version}
+        mirantis_openstack_xenial_salt:
+          source: http://apt-mk.mirantis.com/xenial/
+          distribution: ${_param:apt_mk_version}
+          components: salt
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+          gpgkeys:
+            - A76882D3
+          publisher:
+            component: salt
+            distributions:
+              - ubuntu-xenial/${_param:apt_mk_version}
diff --git a/aptly/server/mirror/ubuntu/xenial/mcp/openstack.yml b/aptly/server/mirror/ubuntu/xenial/mcp/openstack.yml
new file mode 100644
index 0000000..0d07f5a
--- /dev/null
+++ b/aptly/server/mirror/ubuntu/xenial/mcp/openstack.yml
@@ -0,0 +1,74 @@
+parameters:
+  _param:
+    mcp_repo_version: 1.0
+    linux_system_codename: xenial
+  aptly:
+    server:
+      mirror:
+        mirantis_openstack_xenial:
+          source: http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}
+          distribution: mitaka
+          components: main restricted
+          architectures: amd64
+          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}/archive-mcp${_param:mcp_repo_version}.key"
+          gpgkeys:
+            - 1FA22B08
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/mitaka
+
+        mirantis_openstack_hotfix_xenial:
+          source: http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}
+          distribution: mitaka-hotfix
+          components: main restricted
+          architectures: amd64
+          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}/archive-mcp${_param:mcp_repo_version}.key"
+          gpgkeys:
+            - 1FA22B08
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/mitaka-hotfix
+
+        mirantis_openstack_security_xenial:
+          source: http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}
+          distribution: mitaka-security
+          components: main restricted
+          architectures: amd64
+          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}/archive-mcp${_param:mcp_repo_version}.key"
+          gpgkeys:
+            - 1FA22B08
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/mitaka-security
+
+        # required for alternative horizon plugins/etc..
+        mirantis_openstack_updates_xenial:
+          source: http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}
+          distribution: mitaka-updates
+          components:  main restricted
+          architectures: amd64
+          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}/archive-mcp${_param:mcp_repo_version}.key"
+          gpgkeys:
+            - 1FA22B08
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/mitaka-updates
+
+        # required for salt formulas
+        mirantis_openstack_holdback_xenial:
+          source: http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}
+          distribution: mitaka-holdback
+          components: main restricted
+          architectures: amd64
+          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}/archive-mcp${_param:mcp_repo_version}.key"
+          gpgkeys:
+          - 1FA22B08
+          publisher:
+            component: main
+            distributions:
+              - ubuntu-xenial/mitaka-holdback
+
diff --git a/docker/swarm/manager.yml b/docker/swarm/manager.yml
index 36f5bcb..25a7fbe 100644
--- a/docker/swarm/manager.yml
+++ b/docker/swarm/manager.yml
@@ -1,4 +1,8 @@
+classes:
+  - system.docker.swarm.network.gwbridge
 parameters:
+  _param:
+    docker_gwbridge_subnet: 10.20.0.0/16
   docker:
     swarm:
       role: manager
diff --git a/docker/swarm/master.yml b/docker/swarm/master.yml
index bb2d83b..fba9af3 100644
--- a/docker/swarm/master.yml
+++ b/docker/swarm/master.yml
@@ -1,4 +1,8 @@
+classes:
+  - system.docker.swarm.network.gwbridge
 parameters:
+  _param:
+    docker_gwbridge_subnet: 10.20.0.0/16
   docker:
     swarm:
       role: master
diff --git a/docker/swarm/network/gwbridge.yml b/docker/swarm/network/gwbridge.yml
new file mode 100644
index 0000000..8208d3d
--- /dev/null
+++ b/docker/swarm/network/gwbridge.yml
@@ -0,0 +1,10 @@
+parameters:
+  docker:
+    swarm:
+      network:
+        docker_gwbridge:
+          subnet: ${_param:docker_gwbridge_subnet}
+          opt:
+            com.docker.network.bridge.name: docker_gwbridge
+            com.docker.network.bridge.enable_icc: false
+            com.docker.network.bridge.enable_ip_masquerade: true
diff --git a/docker/swarm/service/openldap.yml b/docker/swarm/service/openldap.yml
index e390772..863144c 100644
--- a/docker/swarm/service/openldap.yml
+++ b/docker/swarm/service/openldap.yml
@@ -1,6 +1,6 @@
 parameters:
   _param:
-    docker_image_openldap: osixia/openldap:1.1.7
+    docker_image_openldap: osixia/openldap:1.1.8
   docker:
     client:
       service:
@@ -10,19 +10,24 @@
           restart:
             condition: any
           image: ${_param:docker_image_openldap}
+          hostname: ldap01.${_param:openldap_domain}
+          hosts:
+            ldap01:
+              name: ldap01.${_param:openldap_domain}
+              address: 127.0.0.1
           environment:
-            HOSTNAME: ldap01.${_param:cluster_public_host}
+            HOSTNAME: ldap01.${_param:openldap_domain}
             LDAP_ORGANISATION: "${_param:openldap_organisation}"
             LDAP_DOMAIN: "${_param:openldap_domain}"
             LDAP_ADMIN_PASSWORD: ${_param:openldap_admin_password}
             LDAP_CONFIG_PASSWORD: ${_param:openldap_config_password}
-            LDAP_READONLY_USER: true
+            LDAP_READONLY_USER: "true"
             LDAP_READONLY_USER_USERNAME: readonly
             LDAP_READONLY_USER_PASSWORD: ${_param:openldap_readonly_password}
-            LDAP_TLS: false
+            LDAP_TLS: "false"
           ports:
-            - 389:389
-            - 636:636
+            - 1389:389
+            - 1636:636
           volume:
             database:
               type: bind
diff --git a/docker/swarm/service/phpldapadmin.yml b/docker/swarm/service/phpldapadmin.yml
new file mode 100644
index 0000000..fadf714
--- /dev/null
+++ b/docker/swarm/service/phpldapadmin.yml
@@ -0,0 +1,21 @@
+parameters:
+  _param:
+    docker_image_phpldapadmin: osixia/phpldapadmin:0.6.12
+  docker:
+    client:
+      service:
+        phpldapadmin:
+          restart:
+            condition: any
+          image: ${_param:docker_image_phpldapadmin}
+          hosts:
+            ldap:
+              name: ldap.${_param:openldap_domain}
+              address: ${_param:cluster_vip_address}
+          environment:
+            PHPLDAPADMIN_LDAP_HOSTS: "#PYTHON2BASH:[{'ldap.${_param:openldap_domain}': [{'server': [{'tls': False}]},{'login': [{'bind_id': 'cn=admin,${_param:openldap_dn}'},{'bind_pass': '${_param:openldap_admin_password}'}]}]}]"
+            PHPLDAPADMIN_HTTPS: false
+            PHPLDAPADMIN_TRUST_PROXY_SSL: true
+            PHPLDAPADMIN_SERVER_ADMIN: ${_param:admin_email}
+          ports:
+            - 18089:80
diff --git a/docker/swarm/worker.yml b/docker/swarm/worker.yml
index acdb0cf..643b207 100644
--- a/docker/swarm/worker.yml
+++ b/docker/swarm/worker.yml
@@ -1,4 +1,8 @@
+classes:
+  - system.docker.swarm.network.gwbridge
 parameters:
+  _param:
+    docker_gwbridge_subnet: 10.20.0.0/16
   docker:
     swarm:
       role: worker
diff --git a/haproxy/proxy/listen/openldap.yml b/haproxy/proxy/listen/openldap.yml
new file mode 100644
index 0000000..b6f79a0
--- /dev/null
+++ b/haproxy/proxy/listen/openldap.yml
@@ -0,0 +1,46 @@
+parameters:
+  _param:
+    haproxy_openldap_bind_host: ${_param:haproxy_bind_address}
+    haproxy_openldap_bind_port: 389
+    haproxy_openldap_ssl_bind_port: 636
+  haproxy:
+    proxy:
+      listen:
+        openldap:
+          mode: tcp
+          balance: source
+          binds:
+            - address: ${_param:haproxy_openldap_bind_host}
+              port: ${_param:haproxy_openldap_bind_port}
+          servers:
+            - name: ${_param:cluster_node01_name}
+              host: ${_param:cluster_node01_address}
+              port: 1389
+              params: check
+            - name: ${_param:cluster_node02_name}
+              host: ${_param:cluster_node02_address}
+              port: 1389
+              params: backup check
+            - name: ${_param:cluster_node03_name}
+              host: ${_param:cluster_node03_address}
+              port: 1389
+              params: backup check
+        openldap_ssl:
+          mode: tcp
+          balance: source
+          binds:
+            - address: ${_param:haproxy_openldap_bind_host}
+              port: ${_param:haproxy_openldap_ssl_bind_port}
+          servers:
+            - name: ${_param:cluster_node01_name}
+              host: ${_param:cluster_node01_address}
+              port: 1636
+              params: check
+            - name: ${_param:cluster_node02_name}
+              host: ${_param:cluster_node02_address}
+              port: 1636
+              params: backup check
+            - name: ${_param:cluster_node03_name}
+              host: ${_param:cluster_node03_address}
+              port: 1636
+              params: backup check
diff --git a/haproxy/proxy/listen/openstack/murano.yml b/haproxy/proxy/listen/openstack/murano.yml
new file mode 100644
index 0000000..0427820
--- /dev/null
+++ b/haproxy/proxy/listen/openstack/murano.yml
@@ -0,0 +1,18 @@
+parameters:
+  haproxy:
+    proxy:
+      listen:
+        murano_api:
+          type: openstack-service
+          check: false
+          binds:
+          - address: ${_param:cluster_vip_address}
+            port: 8082
+          servers:
+          - name: ${_param:cluster_node01_hostname}
+            host: ${_param:cluster_node01_address}
+            port: 8082
+            params: check
+          - name: ${_param:cluster_node02_hostname}
+            host: ${_param:cluster_node02_address}
+            port: 8082
\ No newline at end of file
diff --git a/haproxy/proxy/listen/openstack/sahara.yml b/haproxy/proxy/listen/openstack/sahara.yml
new file mode 100644
index 0000000..3bbf809
--- /dev/null
+++ b/haproxy/proxy/listen/openstack/sahara.yml
@@ -0,0 +1,24 @@
+parameters:
+  haproxy:
+    proxy:
+      listen:
+        sahara_api:
+          type: openstack-service
+          options:
+            - httplog
+          binds:
+          - address: ${_param:cluster_vip_address}
+            port: 8386
+          servers:
+          - name: ctl01
+            host: ${_param:cluster_node01_address}
+            port: 8386
+            params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
+          - name: ctl02
+            host: ${_param:cluster_node02_address}
+            port: 8386
+            params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
+          - name: ctl03
+            host: ${_param:cluster_node03_address}
+            port: 8386
+            params: check inter 10s fastinter 2s downinter 3s rise 3 fall 3
diff --git a/haproxy/proxy/listen/phpldapadmin.yml b/haproxy/proxy/listen/phpldapadmin.yml
new file mode 100644
index 0000000..b2b7f93
--- /dev/null
+++ b/haproxy/proxy/listen/phpldapadmin.yml
@@ -0,0 +1,30 @@
+parameters:
+  _param:
+    haproxy_phpldapadmin_bind_host: ${_param:haproxy_bind_address}
+    haproxy_phpldapadmin_bind_port: 8089
+  haproxy:
+    proxy:
+      listen:
+        phpldapadmin:
+          mode: http
+          options:
+            - forwardfor
+            - httpclose
+            - httplog
+          balance: source
+          binds:
+            - address: ${_param:haproxy_phpldapadmin_bind_host}
+              port: ${_param:haproxy_phpldapadmin_bind_port}
+          servers:
+            - name: ${_param:cluster_node01_name}
+              host: ${_param:cluster_node01_address}
+              port: 18089
+              params: check
+            - name: ${_param:cluster_node02_name}
+              host: ${_param:cluster_node02_address}
+              port: 18089
+              params: backup check
+            - name: ${_param:cluster_node03_name}
+              host: ${_param:cluster_node03_address}
+              port: 18089
+              params: backup check
diff --git a/jenkins/client/job/debian/packages/salt.yml b/jenkins/client/job/debian/packages/salt.yml
index 6517081..730eeba 100644
--- a/jenkins/client/job/debian/packages/salt.yml
+++ b/jenkins/client/job/debian/packages/salt.yml
@@ -9,6 +9,8 @@
               dist: trusty
             - name: apache
               dist: trusty
+            - name: aptcacher
+              dist: trusty
             - name: aptly
               dist: trusty
             - name: artifactory
@@ -181,6 +183,8 @@
               dist: xenial
             - name: apache
               dist: xenial
+            - name: aptcacher
+              dist: xenial
             - name: aptly
               dist: xenial
             - name: artifactory
diff --git a/jenkins/client/job/salt-formulas/git-mirrors/2way.yml b/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
index a0998a2..88a8ef9 100644
--- a/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
+++ b/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
@@ -9,6 +9,7 @@
           jobs:
             - name: aodh
             - name: apache
+            - name: aptcacher
             - name: aptly
             - name: artifactory
             - name: backupninja
diff --git a/jenkins/client/job/salt-formulas/tests.yml b/jenkins/client/job/salt-formulas/tests.yml
index 226c9c2..27932bc 100644
--- a/jenkins/client/job/salt-formulas/tests.yml
+++ b/jenkins/client/job/salt-formulas/tests.yml
@@ -7,6 +7,7 @@
           jobs:
             - name: aodh
             - name: apache
+            - name: aptcacher
             - name: aptly
             - name: artifactory
             - name: backupninja
diff --git a/jenkins/client/job/salt-models/generate.yml b/jenkins/client/job/salt-models/generate.yml
new file mode 100644
index 0000000..dc539e8
--- /dev/null
+++ b/jenkins/client/job/salt-models/generate.yml
@@ -0,0 +1,58 @@
+parameters:
+  jenkins:
+    client:
+      job_template:
+        generate_reclass_clusters:
+          name: generate_reclass_cluster_{{cookiecutter_template}}
+          param:
+            cookiecutter_template:
+            - separated_products
+          template:
+            type: workflow-scm
+            concurrent: true
+            display_name: "[MCP] Generate reclass cluster {{cookiecutter_template}}"
+            scm:
+              type: git
+              url: ${_param:jenkins_job_repository}
+              credentials: "gitlab"
+              script: metadata/cookiecutter_generate.groovy
+            param:
+              COOKIECUTTER_TEMPLATE_URL:
+                type: string
+                default: "git@github.com:Mirantis/mk2x-cookiecutter-reclass-model.git"
+              COOKIECUTTER_TEMPLATE_CREDENTIALS:
+                type: string
+                default: jenkins
+              COOKIECUTTER_TEMPLATE_BRANCH:
+                type: string
+                default: master
+#              COOKIECUTTER_TEMPLATE_PATH:
+#                type: string
+#                default: 'cluster/{{cookiecutter_template}}'
+              COOKIECUTTER_INSTALL_CICD:
+                type: boolean
+                default: false
+              COOKIECUTTER_INSTALL_CONTRAIL:
+                type: boolean
+                default: false
+              COOKIECUTTER_INSTALL_KUBERNETES:
+                type: boolean
+                default: false
+              COOKIECUTTER_INSTALL_OPENSTACK:
+                type: boolean
+                default: false
+              COOKIECUTTER_INSTALL_STACKLIGHT:
+                type: boolean
+                default: false
+              COOKIECUTTER_TEMPLATE_CONTEXT:
+                type: string
+              RECLASS_MODEL_URL:
+                type: string
+                default: "
+                ssh://jenkins@gerrit.mcp.mirantis.net:29418/salt-models/training"
+              RECLASS_MODEL_CREDENTIALS:
+                type: string
+                default: jenkins_slave
+              RECLASS_MODEL_BRANCH:
+                type: string
+                default: master
diff --git a/linux/system/repo/mcp/openstack.yml b/linux/system/repo/mcp/openstack.yml
index 372caf0..67c9cad 100644
--- a/linux/system/repo/mcp/openstack.yml
+++ b/linux/system/repo/mcp/openstack.yml
@@ -1,6 +1,7 @@
 parameters:
   _param:
     mcp_repo_version: 1.0
+    apt_mk_version: stable 
   linux:
     system:
       repo:
@@ -24,3 +25,8 @@
           source: "deb http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename} ${_param:openstack_version}-holdback main"
           architectures: amd64
           key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:mcp_repo_version}/${_param:linux_system_codename}/archive-mcp${_param:mcp_repo_version}.key"
+        mk_openstack:
+          source: "deb [arch=amd64] http://apt-mk.mirantis.com/${_param:linux_system_codename}/ ${_param:apt_mk_version} ${_param:openstack_version}"
+          architectures: amd64
+          key_url: "http://apt-mk.mirantis.com/public.gpg"
+
diff --git a/linux/system/repo/mos9.yml b/linux/system/repo/mos9.yml
index 9bc7c8c..3a3abe1 100644
--- a/linux/system/repo/mos9.yml
+++ b/linux/system/repo/mos9.yml
@@ -6,15 +6,27 @@
           source: "deb http://mirror.fuel-infra.org/mos-repos/ubuntu/9.0/ mos9.0 main restricted"
           architectures: amd64
           key_url: "http://mirror.fuel-infra.org/mos-repos/ubuntu/9.0/archive-mos9.0.key"
+#          - pin: 'release a=mos9.0'
+#            priority: 1100
+#            package: '*'
         mirantis_openstack_hotfix:
           source: "deb http://mirror.fuel-infra.org/mos-repos/ubuntu/9.0/ mos9.0-hotfix main restricted"
           architectures: amd64
           key_url: "http://mirror.fuel-infra.org/mos-repos/ubuntu/9.0/archive-mos9.0.key"
+#          - pin: 'release a=mos9.0-hotfix'
+#            priority: 1100
+#            package: '*'
         mirantis_openstack_security:
           source: "deb http://mirror.fuel-infra.org/mos-repos/ubuntu/9.0/ mos9.0-security main restricted"
           architectures: amd64
           key_url: "http://mirror.fuel-infra.org/mos-repos/ubuntu/9.0/archive-mos9.0.key"
+#          - pin: 'release a=mos9.0-security'
+#            priority: 1100
+#            package: '*'
         mirantis_openstack_updates:
           source: "deb http://mirror.fuel-infra.org/mos-repos/ubuntu/9.0/ mos9.0-updates main restricted"
           architectures: amd64
           key_url: "http://mirror.fuel-infra.org/mos-repos/ubuntu/9.0/archive-mos9.0.key"
+#          - pin: 'release a=mos9.0-updates'
+#            priority: 1100
+#            package: '*'
diff --git a/linux/system/repo_local/contrail.yml b/linux/system/repo_local/contrail.yml
index c78e68c..902c4d5 100644
--- a/linux/system/repo_local/contrail.yml
+++ b/linux/system/repo_local/contrail.yml
@@ -8,6 +8,6 @@
           refresh_db: ${_param:linux_repo_refresh_db}
           source: "deb [arch=amd64] http://${_param:local_repo_url}/contrail trusty main"
           pin:
-          - pin: 'release l=Local Contrail APT repository'
+          - pin: 'release l=contrail ubuntu-trusty'
             priority: ${_param:contrail_repo_pin_priority}
             package: '*'
diff --git a/linux/system/repo_local/mcp/contrail.yml b/linux/system/repo_local/mcp/contrail.yml
new file mode 100644
index 0000000..158fda5
--- /dev/null
+++ b/linux/system/repo_local/mcp/contrail.yml
@@ -0,0 +1,13 @@
+parameters:
+  _param:
+    linux_repo_contrail_component: oc311
+    contrail_repo_pin_priority: 200
+    apt_mk_version: stable
+  linux:
+    system:
+      repo:
+        mcp_opencontrail_${_param:linux_repo_contrail_component}:
+          refresh_db: ${_param:linux_repo_refresh_db}
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:apt_mk_version} ${_param:linux_repo_contrail_component}"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
diff --git a/linux/system/repo_local/mcp/extra.yml b/linux/system/repo_local/mcp/extra.yml
new file mode 100644
index 0000000..67d85a5
--- /dev/null
+++ b/linux/system/repo_local/mcp/extra.yml
@@ -0,0 +1,12 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+  linux:
+    system:
+      repo:
+        mcp_extra:
+          default: true
+          refresh_db: ${_param:linux_repo_refresh_db}
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:apt_mk_version} extra"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
\ No newline at end of file
diff --git a/linux/system/repo_local/mcp/openstack.yml b/linux/system/repo_local/mcp/openstack.yml
new file mode 100644
index 0000000..29329d1
--- /dev/null
+++ b/linux/system/repo_local/mcp/openstack.yml
@@ -0,0 +1,45 @@
+parameters:
+  linux:
+    system:
+      repo:
+        mirantis_openstack:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version} main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          pin:
+          - pin: 'release a=${_param:openstack_version}'
+            priority: 1100
+            package: '*'
+        mirantis_openstack_hotfix:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version}-hotfix main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          pin:
+          - pin: 'release a=m${_param:openstack_version}-hotfix'
+            priority: 1100
+            package: '*'
+        mirantis_openstack_security:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version}-security main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          pin:
+          - pin: 'release a=${_param:openstack_version}-security'
+            priority: 1100
+            package: '*'
+        mirantis_openstack_updates:
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version}-updates main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          pin:
+          - pin: 'release a=${_param:openstack_version}-updates'
+            priority: 1100
+            package: '*'
+        mirantis_openstack_holdback:
+          refresh_db: ${_param:linux_repo_refresh_db}
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version}-holdback main"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
+          pin:
+          - pin: 'release a=${_param:openstack_version}-holdback'
+            priority: 1100
+            package: '*'
diff --git a/linux/system/repo_local/mcp/salt.yml b/linux/system/repo_local/mcp/salt.yml
new file mode 100644
index 0000000..3abbf92
--- /dev/null
+++ b/linux/system/repo_local/mcp/salt.yml
@@ -0,0 +1,11 @@
+parameters:
+  _param:
+    apt_mk_version: stable
+  linux:
+    system:
+      repo:
+        mcp_salt:
+          refresh_db: ${_param:linux_repo_refresh_db}
+          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:apt_mk_version} salt"
+          architectures: amd64
+          key_url: "http://${_param:local_repo_url}/public.gpg"
\ No newline at end of file
diff --git a/linux/system/repo_local/mos8.yml b/linux/system/repo_local/mos8.yml
index 29c6636..ddefdb7 100644
--- a/linux/system/repo_local/mos8.yml
+++ b/linux/system/repo_local/mos8.yml
@@ -7,7 +7,7 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos8.0'
+          - pin: 'release a=mos8.0'
             priority: 1100
             package: '*'
         #mos8_openstack_hotfix:
@@ -15,7 +15,7 @@
         #  architectures: amd64
         #  key_url: "http://${_param:local_repo_url}/public.gpg"
         #  pin:
-        #  - pin: 'release s=mos8.0-hotfix'
+        #  - pin: 'release a=mos8.0-hotfix'
         #    priority: 1100
         #    package: '*'
         mos8_openstack_proposed:
@@ -23,7 +23,7 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos8.0-proposed'
+          - pin: 'release a=mos8.0-proposed'
             priority: 1100
             package: '*'
         #mos8_openstack_security:
@@ -31,7 +31,7 @@
         #  architectures: amd64
         #  key_url: "http://${_param:local_repo_url}/public.gpg"
         #  pin:
-        #  - pin: 'release s=mos8.0-security'
+        #  - pin: 'release a=mos8.0-security'
         #    priority: 1100
         #    package: '*'
         mos8_openstack_updates:
@@ -39,7 +39,7 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos8.0-updates'
+          - pin: 'release a=mos8.0-updates'
             priority: 1100
             package: '*'
         #mos8_murano:
@@ -48,6 +48,6 @@
         #  architectures: amd64
         #  key_url: "http://${_param:local_repo_url}/public.gpg"
         #  pin:
-        #  - pin: 'release s=mos8.0-proposed'
+        #  - pin: 'release a=mos8.0-proposed'
         #    priority: 1100
-        #    package: '*'
\ No newline at end of file
+        #    package: '*'
diff --git a/linux/system/repo_local/mos9.yml b/linux/system/repo_local/mos9.yml
index 6886185..5b6cdac 100644
--- a/linux/system/repo_local/mos9.yml
+++ b/linux/system/repo_local/mos9.yml
@@ -7,7 +7,7 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos9.0'
+          - pin: 'release a=mos9.0'
             priority: 1100
             package: '*'
         mos9_openstack_hotfix:
@@ -15,7 +15,7 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos9.0-hotfix'
+          - pin: 'release a=mos9.0-hotfix'
             priority: 1100
             package: '*'
         mos9_openstack_proposed:
@@ -23,7 +23,7 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos9.0-proposed'
+          - pin: 'release a=mos9.0-proposed'
             priority: 1100
             package: '*'
         mos9_openstack_security:
@@ -31,7 +31,7 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos9.0-security'
+          - pin: 'release a=mos9.0-security'
             priority: 1100
             package: '*'
         mos9_openstack_updates:
@@ -39,7 +39,7 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos9.0-updates'
+          - pin: 'release a=mos9.0-updates'
             priority: 1100
             package: '*'
         mos9_murano:
@@ -48,6 +48,6 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos8.0-proposed'
+          - pin: 'release a=mos8.0-proposed'
             priority: 1100
             package: '*'
diff --git a/linux/system/repo_local/openstack.yml b/linux/system/repo_local/openstack.yml
index 4754d12..a873afb 100644
--- a/linux/system/repo_local/openstack.yml
+++ b/linux/system/repo_local/openstack.yml
@@ -10,7 +10,7 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos8.0'
+          - pin: 'release a=mos8.0'
             priority: 1000
             package: '*'
         mirantis_openstack_hotfix:
@@ -19,7 +19,7 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos8.0-hotfix'
+          - pin: 'release a=mos8.0-hotfix'
             priority: 1000
             package: '*'
         mirantis_openstack_proposed:
@@ -28,7 +28,7 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos8.0-proposed'
+          - pin: 'release a=mos8.0-proposed'
             priority: 1000
             package: '*'
         mirantis_openstack_security:
@@ -37,7 +37,7 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos8.0-security'
+          - pin: 'release a=mos8.0-security'
             priority: 1000
             package: '*'
         mirantis_openstack_updates:
@@ -46,6 +46,6 @@
           architectures: amd64
           key_url: "http://${_param:local_repo_url}/public.gpg"
           pin:
-          - pin: 'release s=mos8.0-updates'
+          - pin: 'release a=mos8.0-updates'
             priority: 1000
             package: '*'
diff --git a/murano/server/cluster.yml b/murano/server/cluster.yml
new file mode 100644
index 0000000..d698e7c
--- /dev/null
+++ b/murano/server/cluster.yml
@@ -0,0 +1,46 @@
+classes:
+- service.murano.server.cluster
+- service.keepalived.cluster.single
+- system.haproxy.proxy.listen.openstack.murano
+- service.rabbitmq.server.single
+parameters:
+  murano:
+    server:
+      enabled: true
+      version: ${_param:murano_version}
+      bind:
+        address: ${_param:single_address}
+        port: 8082
+      network:
+        external: ${_param:murano_external_network}
+      database:
+        engine: mysql
+        host: ${_param:openstack_database_address}
+        port: 3306
+        name: murano
+        user: murano
+        password: ${_param:mysql_murano_password}
+      identity:
+        engine: keystone
+        host: ${_param:openstack_control_address}
+        port: 35357
+        tenant: service
+        user: murano
+        password: ${_param:keystone_murano_password}
+      message_queue:
+        engine: rabbitmq
+        port: 5672
+        members:
+        - host: ${_param:openstack_messaging_queue_node01_address}
+        - host: ${_param:openstack_messaging_queue_node02_address}
+        - host: ${_param:openstack_messaging_queue_node03_address}
+        user: openstack
+        password: ${_param:rabbitmq_openstack_password}
+        virtual_host: '/openstack'
+      murano_agent_queue:
+        engine: rabbitmq
+        host: ${_param:openstack_proxy_address}
+        port: 5673
+        user: openstack
+        password: ${_param:rabbitmq_murano_agent_password}
+        virtual_host: '/catalog'
diff --git a/murano/server/single.yml b/murano/server/single.yml
new file mode 100644
index 0000000..c3da9f8
--- /dev/null
+++ b/murano/server/single.yml
@@ -0,0 +1,41 @@
+classes:
+- service.murano.server.single
+- service.rabbitmq.server.single
+parameters:
+  murano:
+    server:
+      enabled: true
+      version: ${_param:murano_version}
+      bind:
+        address: ${_param:single_address}
+        port: 8082
+      network:
+        external: ${_param:murano_external_network}
+      database:
+        engine: mysql
+        host: ${_param:openstack_database_address}
+        port: 3306
+        name: murano
+        user: murano
+        password: ${_param:mysql_murano_password}
+      identity:
+        engine: keystone
+        host: ${_param:openstack_control_address}
+        port: 35357
+        tenant: service
+        user: murano
+        password: ${_param:keystone_murano_password}
+      message_queue:
+        engine: rabbitmq
+        port: 5672
+        host: ${_param:cluster_vip_address}
+        user: openstack
+        password: ${_param:rabbitmq_openstack_password}
+        virtual_host: '/openstack'
+      murano_agent_queue:
+        engine: rabbitmq
+        host: ${_param:openstack_proxy_address}
+        port: 5673
+        user: openstack
+        password: ${_param:rabbitmq_murano_agent_password}
+        virtual_host: '/catalog'
diff --git a/mysql/client/database/murano.yml b/mysql/client/database/murano.yml
new file mode 100644
index 0000000..561ea3d
--- /dev/null
+++ b/mysql/client/database/murano.yml
@@ -0,0 +1,17 @@
+parameters:
+  mysql:
+    client:
+      server:
+        database:
+          database:
+            murano:
+              encoding: utf8
+              users:
+              - name: murano
+                password: ${_param:mysql_murano_password}
+                host: '%'
+                rights: all
+              - name: murano
+                password: ${_param:mysql_murano_password}
+                host: ${_param:single_address}
+                rights: all
\ No newline at end of file
diff --git a/mysql/client/database/sahara.yml b/mysql/client/database/sahara.yml
new file mode 100644
index 0000000..86497d8
--- /dev/null
+++ b/mysql/client/database/sahara.yml
@@ -0,0 +1,17 @@
+parameters:
+  mysql:
+    client:
+      server:
+        database:
+          database:
+            sahara:
+              encoding: utf8
+              users:
+              - name: sahara
+                password: ${_param:mysql_sahara_password}
+                host: '%'
+                rights: all
+              - name: sahara
+                password: ${_param:mysql_sahara_password}
+                host: ${_param:single_address}
+                rights: all
diff --git a/nginx/server/proxy/grafana_web.yml b/nginx/server/proxy/grafana_web.yml
index a1c7c49..66fa46b 100644
--- a/nginx/server/proxy/grafana_web.yml
+++ b/nginx/server/proxy/grafana_web.yml
@@ -1,18 +1,2 @@
-parameters:
-  nginx:
-    server:
-      enabled: true
-      site:
-        nginx_proxy_grafana:
-          enabled: true
-          type: nginx_proxy
-          name: grafana
-          proxy:
-            host: ${_param:stacklight_monitor_address}
-            port: 3000
-            protocol: http
-          host:
-            name: ${_param:cluster_public_host}
-            port: 8084
-            protocol: https
-          ssl: ${_param:nginx_proxy_ssl}
+classes:
+- system.nginx.server.proxy.stacklight.grafana
diff --git a/nginx/server/proxy/kibana_web.yml b/nginx/server/proxy/kibana_web.yml
index 1120c9c..0f3f41e 100644
--- a/nginx/server/proxy/kibana_web.yml
+++ b/nginx/server/proxy/kibana_web.yml
@@ -1,18 +1,2 @@
-parameters:
-  nginx:
-    server:
-      enabled: true
-      site:
-        nginx_proxy_kibana:
-          enabled: true
-          type: nginx_proxy
-          name: kibana
-          proxy:
-            host: ${_param:stacklight_monitor_address}
-            port: 5601
-            protocol: http
-          host:
-            name: ${_param:cluster_public_host}
-            port: 5601
-            protocol: https
-          ssl: ${_param:nginx_proxy_ssl}
+classes:
+- system.nginx.server.proxy.stacklight.kibana
diff --git a/nginx/server/proxy/nagios_web.yml b/nginx/server/proxy/nagios_web.yml
index 8b57929..919c74a 100644
--- a/nginx/server/proxy/nagios_web.yml
+++ b/nginx/server/proxy/nagios_web.yml
@@ -1,18 +1,2 @@
-parameters:
-  nginx:
-    server:
-      enabled: true
-      site:
-        nginx_proxy_nagios:
-          enabled: true
-          type: nginx_proxy
-          name: nagios
-          proxy:
-            host: ${_param:stacklight_monitor_address}
-            port: 80
-            protocol: http
-          host:
-            name: ${_param:cluster_public_host}
-            port: 8001
-            protocol: https
-          ssl: ${_param:nginx_proxy_ssl}
+classes:
+- system.nginx.server.proxy.stacklight.nagios
diff --git a/nginx/server/proxy/openstack/murano.yml b/nginx/server/proxy/openstack/murano.yml
new file mode 100644
index 0000000..a93b07e
--- /dev/null
+++ b/nginx/server/proxy/openstack/murano.yml
@@ -0,0 +1,19 @@
+  parameters:
+  _param:
+    nginx_proxy_openstack_api_host: ${_param:cluster_public_host}
+  nginx:
+    server:
+      enabled: true
+      site:
+        nginx_proxy_openstack_api_murano:
+          enabled: true
+          type: nginx_proxy
+          name: openstack_api_murano
+          proxy:
+            host: ${_param:nginx_proxy_openstack_api_proxy_host}
+            port: 8082
+            protocol: http
+          host:
+            name: ${_param:nginx_proxy_openstack_api_host}
+            port: 8082
+          ssl: ${_param:nginx_proxy_ssl}
diff --git a/nginx/server/proxy/openstack/sahara.yml b/nginx/server/proxy/openstack/sahara.yml
new file mode 100644
index 0000000..17ae236
--- /dev/null
+++ b/nginx/server/proxy/openstack/sahara.yml
@@ -0,0 +1,17 @@
+parameters:
+  nginx:
+    server:
+      enabled: true
+      site:
+        nginx_proxy_openstack_api_sahara:
+          enabled: true
+          type: nginx_proxy
+          name: openstack_api_sahara
+          proxy:
+            host: ${_param:nginx_proxy_openstack_api_proxy_host}
+            port: 8386
+            protocol: http
+          host:
+            name: ${_param:nginx_proxy_openstack_api_host}
+            port: 8386
+          ssl: ${_param:nginx_proxy_ssl}
diff --git a/nova/compute/cluster.yml b/nova/compute/cluster.yml
index 7cb866b..f7b2ee5 100644
--- a/nova/compute/cluster.yml
+++ b/nova/compute/cluster.yml
@@ -2,7 +2,7 @@
 - service.nova.compute.kvm
 parameters:
   _param:
-    nova_vncproxy_url: http://${_param:cluster_vip_address}:6080
+    nova_vncproxy_url: https://${_param:cluster_public_host}:6080
     nova_compute_virtualization: kvm
     nova_compute_avail_zone:
     nova_compute_ssh_public: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCltIn93BcTMzNK/n2eBze6PyTkmIgdDkeXNR9X4DqE48Va80ojv2pq8xuaBxiNITJzyl+4p4UvTTXo+HmuX8qbHvqgMGXvuPUCpndEfb2r67f6vpMqPwMgBrUg2ZKgN4OsSDHU+H0dia0cEaTjz5pvbUy9lIsSyhrqOUVF9reJq+boAvVEedm8fUqiZuiejAw2D27+rRtdEPgsKMnh3626YEsr963q4rjU/JssV/iKMNu7mk2a+koOrJ+aHvcVU8zJjfA0YghoeVT/I3GLU/MB/4tD/RyR8GM+UYbI4sgAC7ZOCdQyHdJgnEzx3SJIwcS65U0T2XYvn2qXHXqJ9iGZ root@mirantis.com
diff --git a/nova/compute/single.yml b/nova/compute/single.yml
index 130f2e4..f50b937 100644
--- a/nova/compute/single.yml
+++ b/nova/compute/single.yml
@@ -4,6 +4,7 @@
 - service.nova.compute.kvm
 parameters:
   _param:
+    nova_vncproxy_url: https://${_param:cluster_public_host}:6080
     nova_compute_ssh_public: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCltIn93BcTMzNK/n2eBze6PyTkmIgdDkeXNR9X4DqE48Va80ojv2pq8xuaBxiNITJzyl+4p4UvTTXo+HmuX8qbHvqgMGXvuPUCpndEfb2r67f6vpMqPwMgBrUg2ZKgN4OsSDHU+H0dia0cEaTjz5pvbUy9lIsSyhrqOUVF9reJq+boAvVEedm8fUqiZuiejAw2D27+rRtdEPgsKMnh3626YEsr963q4rjU/JssV/iKMNu7mk2a+koOrJ+aHvcVU8zJjfA0YghoeVT/I3GLU/MB/4tD/RyR8GM+UYbI4sgAC7ZOCdQyHdJgnEzx3SJIwcS65U0T2XYvn2qXHXqJ9iGZ root@mirantis.com
     nova_compute_avail_zone:
     nova_compute_ssh_private: |
@@ -46,7 +47,7 @@
       enabled: true
       virtualization: kvm
       availability_zone: ${_param:nova_compute_avail_zone}
-      vncproxy_url: http://${_param:control_address}:6080
+      vncproxy_url: ${_param:nova_vncproxy_url}
       bind:
         vnc_address: ${_param:control_address}
         vnc_port: 6080
diff --git a/opencontrail/control/cluster.yml b/opencontrail/control/cluster.yml
index a7015d5..4ffe081 100644
--- a/opencontrail/control/cluster.yml
+++ b/opencontrail/control/cluster.yml
@@ -3,6 +3,7 @@
 - service.keepalived.cluster.single
 - service.opencontrail.control.cluster
 - system.haproxy.proxy.listen.opencontrail.control
+- system.haproxy.proxy.listen.opencontrail.analytics
 parameters:
 # Temprorary fix for MOS9 packages to pin old version of kafka
   linux:
diff --git a/openssh/server/team/tcpcloud.yml b/openssh/server/team/tcpcloud.yml
index 8b7073d..bdf29be 100644
--- a/openssh/server/team/tcpcloud.yml
+++ b/openssh/server/team/tcpcloud.yml
@@ -141,6 +141,12 @@
           sudo: true
           full_name: Sergey Matov
           home: /home/smatov
+        dcech:
+          enabled: true
+          name: dcech
+          sudo: true
+          full_name: Daniel Cech
+          home: /home/dcech
       group:
         libvirtd:
           enabled: true
@@ -259,6 +265,11 @@
           public_keys:
           - ${public_keys:smatov}
           user: ${linux:system:user:smatov}
+        dcech:
+          enabled: true
+          public_keys:
+          - ${public_keys:dcech}
+          user: ${linux:system:user:dcech}
   public_keys:
     askotnicky:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDO6EnDYaGdF/Nn6lntxDNnKanCsheZRdh8kA/6ImyeRSjT2cgepm1Fsgv7wXBYoy0OxhB5wgCp5Az/Pj4oLkG3g+G05sUPUxxGCGRiwjcnyQ/FTz4TzHglAVqgbdgWoQYf9Hg6EKZovvPcH3STbEwcl+MhLqvxz0wm5+StE+wvp6I9dEfRV+2/e1uepauOTZ1+Ui1DMNXiMefTlbiIBHzUk7RiwJWgqzQXBndgunmbJWSed8zC0Ug97waDOFIX/oKZmAmsv0NLJ2e/kC3oUTuziGT74F9sh7Pqiw/9HZxvP45hJwEvytfUjfuiikIBbmYdF7Je93czaG/qjXGN8YvP== a.skotnicky@tcpisek.cz
@@ -304,3 +315,5 @@
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCy6mFrr4oNdLjT5wBZj1+KXNpdawnGGWEevDBQ2SWFjxBFujkWVLiW1kxLTpLVSnuoE5FB7doRIsT/CDe9IU5OhsJ+z6TT56R/pfVKrVnSB1rgrwqdezjgmYEM6kTWiH2GKJE0yiQEPgagK8Rz5Zl420JkhbFWnL7EGPhxNtmYMGDTZwUTzP0KYmytyeH15OqNIiBGTrp1t2bTrVB8HRnUp0uDpfoWAUnsijVGNe1j1bNKtDO0Z9LAWx3eUyxIk4cdpX/EeWJg8jNrSMxtAZZ7Hhm/WInNSNqcHcZ1rEYCAjENxo1WVOuA/aqUqc5xaAipWNon4Rk0e0IUAaFOfLvN2lIuilUZ5XKHDe7a2crkGPnotheT9FgaEHOeFtpuhSaygeZHTMR197jeocgjWIkPqHjVAGSQqQf0TAdNuN73QPTigbbfHWWc1d8KlCM5BqJUXMHPG6BasE1sI/4ykYbxN/DAEvVJ4+rdIlqSdedd73ZAseVQjDtpzD8diScGrpdOhZnTm43q89F8dIFv7tt1TjIwvfcDQNSBjyyKcYpj+NTyW2Zk7qWDVz+lzH0ToYk/rOKkGlrsRy7OwOnmyKR8IcIOL7Bowj895ThCX8tBrdLu/m55ojBOcZiCpawCm7K55ri1Ar6i8cO+bHDh11kKRa/utRRSQTpsW0sbCsamzQ== lubos@lubos-ThinkPad-X1
     smatov:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDgBHACRnY/VEEDFE63xDp4bx0zgWY4h1aB9/c2f962HtTNaQ6R/Cz6DLISaB5th8qzrzbvjn9WcpHdxyTm9BqkLLzB4qe7fnebPtn6zGczZ9Btrjk9R8Fuw6DZhSucSk572r/gVIY0O3Z1LajHkNr0ZTQS8AY3fgn8rXMD2vMOruOzyTOmfWKmEw7e+JYUqoFXHhE3Dd7hGQ99d6kH2N3zXfM2rzfjshGAq0kOi5dN4Hx6QIXZapt0t9TzpYTkK5SaVzuEVyVaKRLYSa/rdPjHkKqDFa99RcQ+OI93uvT9CFNWDFIC/TDJ2M+7PQbm836EICXXVWKjQ2NUnQJeOU5v smatov@ubuntu
+    dcech:
+      key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8A26XMLUnXkxv4e/vByD4W4PQ0ZdgGZz5Tg6G/fQKuSa+9zRucG6IlOchJPikwrDyTrojHTGAClHPuyr2bPIRrjFy4oUTZNdjiDptV99Zv/kHRStYzPyZ4KabnFLJVKNtyKKagk6Z3wpzEjFjRHWJK7A5bIzHfd7Amx/frdLKRo9YZjGbLnZRw6mWGqZYyp2/5a/5rKqH1BhMQggDGkAwFGWYQByZzk2F81nDnkt3CY3bi24gX90w4mgFjP8B0m0QCEhcGqpfOKsQTnIyBCtztEHBiUplzBN+RHS4dDOIEs9SWrXLiMFakWu1Vr6bUa7v5xGaNN8XAWjd3xdsy4hvJjJHU5HPaMY9MGH+N6W0UUZxIF0MuxDNP03MDM1uA5mRWTdwffARaDySYaEUrUEYJmzFAtk700Jv/Aav7QixLoIeKU9SAKYvVb7XNlMWgiswQdRPoiMpXPXPw+bMhjpimHJa4n0KFGAUO/cRD1dpJKybqxDe2ip57JzpFkm5PxuNht5qmEreKcS5dWQqm0fDE9wv8cCUMnWQv36f0IDeVpftmeDREatqXSeUjES7NFQOgIQW5C5Pl+8ZHTXw46c/uh89gUILJT2tS/mOXaU4mELox1Qv8vc/laoGAec+TGD0flf75LfiuLOK6JOYX0QVW13ko1wc3CyJzHOi1sFEAw== daniel.cech@tcpcloud.eu
\ No newline at end of file
diff --git a/rabbitmq/server/vhost/catalog.yml b/rabbitmq/server/vhost/catalog.yml
new file mode 100644
index 0000000..23cb0f2
--- /dev/null
+++ b/rabbitmq/server/vhost/catalog.yml
@@ -0,0 +1,20 @@
+parameters:
+  rabbitmq:
+    server:
+      host:
+        '/murano':
+          enabled: true
+          user: openstack
+          password: ${_param:rabbitmq_murano_agent_password}
+          policies:
+          - name: HA
+            pattern: '^(?!amq\.).*'
+            definition: '{"ha-mode": "all", "message-ttl": 120000}'
+      admin:
+        name: admin
+        password: zeQuooQu47eed8esahpie2Lai8En9ohp
+      bind:
+        address: ${_param:single_address}
+      management:
+        bind:
+          address: ${_param:single_address}
diff --git a/reclass/storage/system/openstack_catalog_cluster.yml b/reclass/storage/system/openstack_catalog_cluster.yml
new file mode 100644
index 0000000..332e5d6
--- /dev/null
+++ b/reclass/storage/system/openstack_catalog_cluster.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    openstack_catalog_node01_hostname: asc01
+    openstack_catalog_node02_hostname: asc02
+  reclass:
+    storage:
+      node:
+        openstack_catalog_node01:
+          name: ${_param:openstack_catalog_node01_hostname}
+          domain: ${_param:cluster_domain}
+          classes:
+          - cluster.${_param:cluster_name}.openstack.catalog
+          params:
+            salt_master_host: ${_param:reclass_config_master}
+            linux_system_codename: ${_param:linux_system_codename}
+            single_address: ${_param:openstack_catalog_node01_address}
+            keepalived_vip_priority: 102
+        openstack_catalog_node02:
+          name: ${_param:openstack_catalog_node02_hostname}
+          domain: ${_param:cluster_domain}
+          classes:
+          - cluster.${_param:cluster_name}.openstack.catalog
+          params:
+            salt_master_host: ${_param:reclass_config_master}
+            linux_system_codename: ${_param:linux_system_codename}
+            single_address: ${_param:openstack_catalog_node02_address}
+            keepalived_vip_priority: 101
diff --git a/reclass/storage/system/openstack_catalog_single.yml b/reclass/storage/system/openstack_catalog_single.yml
new file mode 100644
index 0000000..b48ab27
--- /dev/null
+++ b/reclass/storage/system/openstack_catalog_single.yml
@@ -0,0 +1,15 @@
+parameters:
+  _param:
+    openstack_catalog_node01_hostname: asc01
+  reclass:
+    storage:
+      node:
+        openstack_catalog_node01:
+          name: ${_param:openstack_catalog_node01_hostname}
+          domain: ${_param:cluster_domain}
+          classes:
+          - cluster.${_param:cluster_name}.openstack.catalog
+          params:
+            salt_master_host: ${_param:reclass_config_master}
+            linux_system_codename: ${_param:linux_system_codename}
+            single_address: ${_param:openstack_catalog_node01_address}
diff --git a/sahara/server/cluster.yml b/sahara/server/cluster.yml
new file mode 100644
index 0000000..cdb7b04
--- /dev/null
+++ b/sahara/server/cluster.yml
@@ -0,0 +1,39 @@
+classes:
+- service.sahara.server.cluster
+- service.keepalived.cluster.single
+- system.haproxy.proxy.listen.openstack.sahara
+- service.haproxy.proxy.single
+parameters:
+  sahara:
+    server:
+      enabled: true
+      version: ${_param:sahara_version}
+      notification: false
+      bind:
+        address: ${_param:single_address}
+        port: 8386
+      database:
+        engine: mysql
+        host: ${_param:openstack_database_address}
+        port: 3306
+        name: sahara
+        user: sahara
+        password: ${_param:mysql_sahara_password}
+      identity:
+        engine: keystone
+        protocol: http
+        host:  ${_param:openstack_control_address}
+        port: 35357
+        tenant: service
+        user: sahara
+        password: ${_param:keystone_sahara_password}
+      message_queue:
+        engine: rabbitmq
+        port: 5672
+        members:
+        - host: ${_param:openstack_message_queue_node01_address}
+        - host: ${_param:openstack_message_queue_node02_address}
+        - host: ${_param:openstack_message_queue_node03_address}
+        user: openstack
+        password: ${_param:rabbitmq_openstack_password}
+        virtual_host: '/openstack'
diff --git a/sahara/server/single.yml b/sahara/server/single.yml
new file mode 100644
index 0000000..01e7b38
--- /dev/null
+++ b/sahara/server/single.yml
@@ -0,0 +1,31 @@
+classes:
+- service.sahara.server.single
+parameters:
+  sahara:
+    server:
+      enabled: true
+      version: ${_param:sahara_version}
+      bind:
+        host: ${_param:single_address}
+        port: 8386
+      database:
+        engine: mysql
+        host: ${_param:openstack_database_address}
+        port: 3306
+        name: sahara
+        user: sahara
+        password: ${_param:mysql_sahara_password}
+      identity:
+        engine: keystone
+        host: ${_param:openstack_control_address}
+        port: 35357
+        user: sahara
+        password: ${_param:keystone_sahara_password}
+        tenant: service
+      message_queue:
+        engine: rabbitmq
+        host: ${_param:cluster_vip_address}
+        port: 5672
+        user: openstack
+        password: ${_param:rabbitmq_openstack_password}
+        virtual_host: '/openstack'
diff --git a/salt/master/formula/git/openstack.yml b/salt/master/formula/git/openstack.yml
index 86e23b2..36ddfc2 100644
--- a/salt/master/formula/git/openstack.yml
+++ b/salt/master/formula/git/openstack.yml
@@ -104,6 +104,10 @@
               source: git
               address: '${_param:salt_master_environment_repository}/salt-formula-rabbitmq.git'
               revision: ${_param:salt_master_environment_revision}
+            sahara:
+              source: git
+              address: '${_param:salt_master_environment_repository}/salt-formula-sahara.git'
+              revision: ${_param:salt_master_environment_revision}
             statsd:
               source: git
               address: '${_param:salt_master_environment_repository}/salt-formula-statsd.git'
diff --git a/salt/master/formula/pkg/openstack.yml b/salt/master/formula/pkg/openstack.yml
index 1269bd1..b1222d1 100644
--- a/salt/master/formula/pkg/openstack.yml
+++ b/salt/master/formula/pkg/openstack.yml
@@ -58,6 +58,9 @@
             mysql:
               source: pkg
               name: salt-formula-mysql
+            murano:
+              source: pkg
+              name: salt-formula-murano
             neutron:
               source: pkg
               name: salt-formula-neutron
@@ -76,6 +79,9 @@
             rabbitmq:
               source: pkg
               name: salt-formula-rabbitmq
+            sahara:
+              source: pkg
+              name: salt-formula-sahara
             statsd:
               source: pkg
               name: salt-formula-statsd