diff --git a/apache/server/site/ironic.yml b/apache/server/site/ironic.yml
new file mode 100644
index 0000000..74173a0
--- /dev/null
+++ b/apache/server/site/ironic.yml
@@ -0,0 +1,11 @@
+parameters:
+  apache:
+    server:
+      site:
+        ironic:
+          name: 'ironic'
+          enabled: true
+          type: 'static'
+          root: '/var/www/httproot'
+          host:
+            name: ${linux:system:name}.${linux:system:domain}
diff --git a/aptly/server/docker.yml b/aptly/server/docker.yml
index ee8f4a2..3fa0a8e1 100644
--- a/aptly/server/docker.yml
+++ b/aptly/server/docker.yml
@@ -20,7 +20,6 @@
       root_dir: /srv/volumes/aptly
       no_config: true
       gpg:
-        keyring: .gnupg/trustdb.gpg
         keypair_id: ${_param:aptly_gpg_keypair_id}
         public_key: ${_param:aptly_gpg_public_key}
         private_key: ${_param:aptly_gpg_private_key}
diff --git a/designate/server/backend/bind.yml b/designate/server/backend/bind.yml
index 2b40424..c057eb7 100644
--- a/designate/server/backend/bind.yml
+++ b/designate/server/backend/bind.yml
@@ -1,15 +1,18 @@
 parameters:
+  _param:
+    designate_bind9_rndc_algorithm: hmac-sha512
   designate:
     server:
       backend:
         bind9:
           rndc_key: "${_param:designate_bind9_rndc_key}"
+          rndc_algorithm: "${_param:designate_bind9_rndc_algorithm}"
   bind:
     server:
       key:
         designate:
           secret: "${_param:designate_bind9_rndc_key}"
-          algorithm: hmac-sha512
+          algorithm: "${_param:designate_bind9_rndc_algorithm}"
       allow_new_zones: true
       query: true
       control:
@@ -33,4 +36,4 @@
       key:
         designate:
           secret: "${_param:designate_bind9_rndc_key}"
-          algorithm: hmac-sha512
+          algorithm: "${_param:designate_bind9_rndc_algorithm}"
diff --git a/designate/server/cluster.yml b/designate/server/cluster.yml
index 573ac66..33eb632 100644
--- a/designate/server/cluster.yml
+++ b/designate/server/cluster.yml
@@ -43,17 +43,14 @@
         user: openstack
         password: ${_param:rabbitmq_openstack_password}
         virtual_host: '/openstack'
-      pool:
-        pool_id: ${_param:designate_pool_id}
-        nameservers:
-          - uuid: ${_param:designate_node1_uuid}
-            host: ${_param:cluster_node01_address}
-            port: 53
-          - uuid: ${_param:designate_node2_uuid}
-            host: ${_param:cluster_node02_address}
-            port: 53
-        targets:
-          uuid: ${_param:designate_target_uuid}
-          options: 'port: 53, host: 127.0.0.1'
-          masters: 127.0.0.1:5354
-          type:  ${_param:designate_target_type}
+      pools:
+        default:
+          description: 'default pool'
+          ns_records: ${_param:designate_pool_ns_records}
+          nameservers: ${_param:designate_pool_nameservers}
+          targets:
+            default:
+              type: ${_param:designate_pool_target_type}
+              description: 'default target'
+              masters: ${_param:designate_pool_target_masters}
+              options: ${_param:designate_pool_target_options}
diff --git a/devops_portal/service/security_monkey.yml b/devops_portal/service/security_monkey.yml
index 3638e56..ba5fe81 100644
--- a/devops_portal/service/security_monkey.yml
+++ b/devops_portal/service/security_monkey.yml
@@ -8,3 +8,6 @@
             address: ${_param:haproxy_security_monkey_bind_host}
             port: ${_param:haproxy_security_monkey_bind_port}
             https: ${_param:haproxy_security_monkey_ssl:enabled}
+          credentials:
+            username: ${_param:security_monkey_user}
+            password: ${_param:security_monkey_password}
diff --git a/docker/swarm/stack/devops_portal.yml b/docker/swarm/stack/devops_portal.yml
index c894d33..430c329 100644
--- a/docker/swarm/stack/devops_portal.yml
+++ b/docker/swarm/stack/devops_portal.yml
@@ -1,7 +1,7 @@
 parameters:
   _param:
     docker_devops_portal_replicas: 1
-    docker_image_devops_portal: docker-sandbox.sandbox.mirantis.net/ikharin/oss/devops-portal:latest
+    docker_image_devops_portal: docker-prod-virtual.docker.mirantis.net/mirantis/oss/devops-portal:latest
   docker:
     client:
       stack:
diff --git a/docker/swarm/stack/jenkins/init.yml b/docker/swarm/stack/jenkins/init.yml
new file mode 100644
index 0000000..ab4f07e
--- /dev/null
+++ b/docker/swarm/stack/jenkins/init.yml
@@ -0,0 +1,3 @@
+classes:
+  - system.docker.swarm.stack.jenkins.master
+  - system.docker.swarm.stack.jenkins.slave
diff --git a/docker/swarm/stack/jenkins.yml b/docker/swarm/stack/jenkins/master.yml
similarity index 69%
rename from docker/swarm/stack/jenkins.yml
rename to docker/swarm/stack/jenkins/master.yml
index acea08b..8b66187 100644
--- a/docker/swarm/stack/jenkins.yml
+++ b/docker/swarm/stack/jenkins/master.yml
@@ -5,11 +5,11 @@
     client:
       stack:
         jenkins:
-          environment:
-            JAVA_OPTS: "-Djenkins.install.runSetupWizard=false -Dhudson.DNSMultiCast.disabled=true -Dhudson.udp=-1 -Dhudson.footerURL=https://www.mirantis.com"
-            JENKINS_NUM_EXECUTORS: 4
           service:
             master:
+              environment:
+                JAVA_OPTS: "-Djenkins.install.runSetupWizard=false -Dhudson.DNSMultiCast.disabled=true -Dhudson.udp=-1 -Dhudson.footerURL=https://www.mirantis.com"
+                JENKINS_NUM_EXECUTORS: 4
               deploy:
                 restart_policy:
                   condition: any
diff --git a/docker/swarm/stack/jenkins/slave.yml b/docker/swarm/stack/jenkins/slave.yml
new file mode 100644
index 0000000..52015ec
--- /dev/null
+++ b/docker/swarm/stack/jenkins/slave.yml
@@ -0,0 +1,71 @@
+parameters:
+  _param:
+    docker_image_jenkins_slave: tcpcloud/jnlp-slave
+    jenkins_master_host: ${_param:control_vip_address}
+    jenkins_master_port: 8081
+    jenkins_secret: "7c40abc1a7df2d26dd6b2e4421af17218df75a16fcbd5e3aa6017d9f47eaeabe"
+    jenkins_master_url: http://${_param:jenkins_master_host}:${_param:jenkins_master_port}
+    jenkins_slave_user: ${_param:jenkins_client_user}
+    jenkins_slave_password: ${_param:jenkins_client_password}
+  docker:
+    client:
+      stack:
+        jenkins:
+          service:
+            slave01:
+              environment:
+                JENKINS_URL: ${_param:jenkins_master_url}
+                JENKINS_AGENT_NAME: slave01
+                JENKINS_UPDATE_SLAVE: 'true'
+                JENKINS_LOGIN: ${_param:jenkins_slave_user}
+                JENKINS_PASSWORD: ${_param:jenkins_slave_password}
+              deploy:
+                restart_policy:
+                  condition: any
+                placement:
+                  constraints:
+                    - "node.hostname == ${_param:cluster_node01_name}"
+              image: ${_param:docker_image_jenkins_slave}
+              volumes:
+                - /etc/ssl/certs/java/cacerts:/etc/ssl/certs/java/cacerts:ro
+                - /etc/aptly-publisher.yaml:/etc/aptly-publisher.yaml:ro
+                - /var/run/docker.sock:/var/run/docker.sock
+                - /usr/bin/docker:/usr/bin/docker:ro
+            slave02:
+              environment:
+                JENKINS_URL: ${_param:jenkins_master_url}
+                JENKINS_AGENT_NAME: slave02
+                JENKINS_UPDATE_SLAVE: 'true'
+                JENKINS_LOGIN: ${_param:jenkins_slave_user}
+                JENKINS_PASSWORD: ${_param:jenkins_slave_password}
+              deploy:
+                restart_policy:
+                  condition: any
+                placement:
+                  constraints:
+                    - "node.hostname == ${_param:cluster_node02_name}"
+              image: ${_param:docker_image_jenkins_slave}
+              volumes:
+                - /etc/ssl/certs/java/cacerts:/etc/ssl/certs/java/cacerts:ro
+                - /etc/aptly-publisher.yaml:/etc/aptly-publisher.yaml:ro
+                - /var/run/docker.sock:/var/run/docker.sock
+                - /usr/bin/docker:/usr/bin/docker:ro
+            slave03:
+              environment:
+                JENKINS_URL: ${_param:jenkins_master_url}
+                JENKINS_AGENT_NAME: slave03
+                JENKINS_UPDATE_SLAVE: 'true'
+                JENKINS_LOGIN: ${_param:jenkins_slave_user}
+                JENKINS_PASSWORD: ${_param:jenkins_slave_password}
+              deploy:
+                restart_policy:
+                  condition: any
+                placement:
+                  constraints:
+                    - "node.hostname == ${_param:cluster_node03_name}"
+              image: ${_param:docker_image_jenkins_slave}
+              volumes:
+                - /etc/ssl/certs/java/cacerts:/etc/ssl/certs/java/cacerts:ro
+                - /etc/aptly-publisher.yaml:/etc/aptly-publisher.yaml:ro
+                - /var/run/docker.sock:/var/run/docker.sock
+                - /usr/bin/docker:/usr/bin/docker:ro
diff --git a/docker/swarm/stack/monitoring.yml b/docker/swarm/stack/monitoring.yml
index 4371367..7c03c35 100644
--- a/docker/swarm/stack/monitoring.yml
+++ b/docker/swarm/stack/monitoring.yml
@@ -15,6 +15,23 @@
               driver_opts:
                 encrypted: 1
           service:
+            remote_agent:
+              networks:
+                - monitoring
+              deploy:
+                replicas: 1
+                labels:
+                  com.mirantis.monitoring: "remote_agent"
+                restart_policy:
+                  condition: any
+              labels:
+                com.mirantis.monitoring: "remote_agent"
+              image: ${_param:docker_image_remote_agent}
+              ports:
+                - 15014:${telegraf:remote_agent:output:prometheus_client:bind:port}
+              volumes:
+                - ${telegraf:remote_agent:dir:config}:/etc/telegraf
+                - ${telegraf:remote_agent:dir:config_d}:/etc/telegraf/telegraf.d
             alertmanager:
               networks:
                 - monitoring
diff --git a/docker/swarm/stack/postgresql.yml b/docker/swarm/stack/postgresql.yml
index bdad6fb..7ae4052 100644
--- a/docker/swarm/stack/postgresql.yml
+++ b/docker/swarm/stack/postgresql.yml
@@ -1,7 +1,7 @@
 parameters:
   _param:
     docker_postgresql_replicas: 1
-    docker_image_postgresql: docker-sandbox.sandbox.mirantis.net/vstoiko/oss/postgresql:latest
+    docker_image_postgresql: library/postgres:9.6
     postgresql_admin_user: postgres
     postgresql_admin_user_password: postgrespassword
   docker:
diff --git a/docker/swarm/stack/rundeck.yml b/docker/swarm/stack/rundeck.yml
index a4ec24b..322a285 100644
--- a/docker/swarm/stack/rundeck.yml
+++ b/docker/swarm/stack/rundeck.yml
@@ -1,7 +1,7 @@
 parameters:
   _param:
     docker_rundeck_replicas: 1
-    docker_image_rundeck: docker-sandbox.sandbox.mirantis.net/ikharin/oss/rundeck:2.7.3-1
+    docker_image_rundeck: docker-prod-virtual.docker.mirantis.net/mirantis/oss/rundeck:latest
   docker:
     client:
       stack:
diff --git a/docker/swarm/stack/security_monkey.yml b/docker/swarm/stack/security_monkey.yml
index 479b028..b3b4074 100644
--- a/docker/swarm/stack/security_monkey.yml
+++ b/docker/swarm/stack/security_monkey.yml
@@ -2,9 +2,22 @@
   _param:
     docker_security_monkey_api_replicas: 1
     docker_security_monkey_scheduler_replicas: 1
-    docker_image_security_monkey_api: docker-sandbox.sandbox.mirantis.net/vstoiko/oss/security-monkey-api:3842.6
-    docker_image_security_monkey_scheduler: docker-sandbox.sandbox.mirantis.net/vstoiko/oss/security-monkey-scheduler:3842.6
+    docker_image_security_monkey_api: docker-sandbox.sandbox.mirantis.net/vstoiko/oss/security-monkey-api:4435
+    docker_image_security_monkey_scheduler: docker-sandbox.sandbox.mirantis.net/vstoiko/oss/security-monkey-scheduler:4435
     security_monkey_db: secmonkey
+    notification_service_url: ${_param:haproxy_pushkin_bind_host}:${_param:haproxy_pushkin_bind_port}/post_notification_json
+    security_monkey_user: devopsportal@devopsportal.local
+    security_monkey_password: devopsportal
+    security_monkey_role: Justify
+    security_monkey_openstack:
+      os_account_id: mcp_cloud
+      os_account_name: mcp_cloud
+      username: ""
+      password: ""
+      auth_url: ""
+      project_domain_name: Default
+      project_name: admin
+      user_domain_name: Default
   docker:
     client:
       stack:
@@ -14,6 +27,18 @@
             SECURITY_MONKEY_POSTGRES_PASSWORD: ${_param:secmonkey_db_user_password}
             SECURITY_MONKEY_POSTGRES_HOST: ${_param:secmonkey_db_host}
             SECURITY_MONKEY_POSTGRES_PORT: ${_param:haproxy_postgresql_bind_port}
+            NOTIFICATIONS_SERVICE_URL: ${_param:notification_service_url}
+            DEFAULT_USER: ${_param:security_monkey_user}
+            DEFAULT_PASSWORD: ${_param:security_monkey_password}
+            DEFAULT_ROLE: ${_param:security_monkey_role}
+            OS_ACCOUNT_ID: ${_param:security_monkey_openstack:os_account_id}
+            OS_ACCOUNT_NAME: ${_param:security_monkey_openstack:os_account_name}
+            OS_USERNAME: ${_param:security_monkey_openstack:username}
+            OS_PASSWORD: ${_param:security_monkey_openstack:password}
+            OS_AUTH_URL: ${_param:security_monkey_openstack:auth_url}
+            OS_PROJECT_DOMAIN_NAME: ${_param:security_monkey_openstack:project_domain_name}
+            OS_PROJECT_NAME: ${_param:security_monkey_openstack:project_name}
+            USER_DOMAIN_NAME: ${_param:security_monkey_openstack:user_domain_name}
           service:
             api:
               image: ${_param:docker_image_security_monkey_api}
@@ -24,7 +49,7 @@
               ports:
                 - ${_param:haproxy_security_monkey_exposed_port}:${_param:haproxy_security_monkey_bind_port}
               volumes:
-                - /srv/volumes/security_monkey:/var/log/security_monkey
+                - /srv/volumes/security_monkey/logs:/var/log/security_monkey/logs
             scheduler:
               image: ${_param:docker_image_security_monkey_scheduler}
               deploy:
@@ -32,4 +57,4 @@
                 restart_policy:
                   condition: any
               volumes:
-                - /srv/volumes/security_monkey:/var/log/security_monkey
\ No newline at end of file
+                - /srv/volumes/security_monkey/logs:/var/log/security_monkey/logs
\ No newline at end of file
diff --git a/galera/server/database/designate.yml b/galera/server/database/designate.yml
new file mode 100644
index 0000000..107e3ae
--- /dev/null
+++ b/galera/server/database/designate.yml
@@ -0,0 +1,26 @@
+parameters:
+  mysql:
+    server:
+      database:
+        designate:
+          encoding: utf8
+          users:
+          - name: designate
+            password: ${_param:mysql_designate_password}
+            host: '%'
+            rights: all
+          - name: designate
+            password: ${_param:mysql_designate_password}
+            host: ${_param:cluster_vip_address}
+            rights: all
+        designate_pool_manager:
+          encoding: utf8
+          users:
+          - name: designate
+            password: ${_param:mysql_designate_password}
+            host: '%'
+            rights: all
+          - name: designate
+            password: ${_param:mysql_designate_password}
+            host: ${_param:cluster_vip_address}
+            rights: all
diff --git a/galera/server/database/ironic.yml b/galera/server/database/ironic.yml
new file mode 100644
index 0000000..8cb14a3
--- /dev/null
+++ b/galera/server/database/ironic.yml
@@ -0,0 +1,15 @@
+parameters:
+  mysql:
+    server:
+      database:
+        ironic:
+          encoding: utf8
+          users:
+          - name: ironic
+            password: ${_param:mysql_ironic_password}
+            host: '%'
+            rights: all
+          - name: ironic
+            password: ${_param:mysql_ironic_password}
+            host: ${_param:cluster_local_address}
+            rights: all
diff --git a/haproxy/proxy/listen/kubernetes/apiserver.yml b/haproxy/proxy/listen/kubernetes/apiserver.yml
index a45a71a..b35d1be 100644
--- a/haproxy/proxy/listen/kubernetes/apiserver.yml
+++ b/haproxy/proxy/listen/kubernetes/apiserver.yml
@@ -21,4 +21,7 @@
           - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 443
-            params: check
\ No newline at end of file
+            params: check
+          timeout:
+            server: 10m
+            client: 10m
diff --git a/haproxy/proxy/listen/kubernetes/apiserver_insecure.yml b/haproxy/proxy/listen/kubernetes/apiserver_insecure.yml
index a365c51..7211507 100644
--- a/haproxy/proxy/listen/kubernetes/apiserver_insecure.yml
+++ b/haproxy/proxy/listen/kubernetes/apiserver_insecure.yml
@@ -20,6 +20,9 @@
             host: ${_param:cluster_node03_address}
             port: 8080
             params: check
+          timeout:
+            server: 10m
+            client: 10m
         k8s_cluster_localhost:
           type: kubernetes
           binds:
@@ -37,4 +40,7 @@
           - name: ${_param:cluster_node03_hostname}
             host: ${_param:cluster_node03_address}
             port: 8080
-            params: check
\ No newline at end of file
+            params: check
+          timeout:
+            server: 10m
+            client: 10m
diff --git a/haproxy/proxy/listen/mysql.yml b/haproxy/proxy/listen/mysql.yml
index a7ef910..40a9f35 100644
--- a/haproxy/proxy/listen/mysql.yml
+++ b/haproxy/proxy/listen/mysql.yml
@@ -7,7 +7,7 @@
       listen:
         mysql:
           mode: tcp
-          balance: source
+          balance: first
           binds:
             - address: ${_param:haproxy_bind_address}
               port: ${_param:haproxy_mysql_bind_port}
diff --git a/haproxy/proxy/listen/openstack/galera.yml b/haproxy/proxy/listen/openstack/galera.yml
index 254dc3b..7298cfc 100644
--- a/haproxy/proxy/listen/openstack/galera.yml
+++ b/haproxy/proxy/listen/openstack/galera.yml
@@ -11,6 +11,7 @@
         mysql_cluster:
           type: mysql
           service_name: mysql
+          balance: first
           binds:
           - address: ${_param:cluster_vip_address}
             port: 3306
diff --git a/haproxy/proxy/listen/openstack/ironic.yml b/haproxy/proxy/listen/openstack/ironic.yml
new file mode 100644
index 0000000..221a9cc
--- /dev/null
+++ b/haproxy/proxy/listen/openstack/ironic.yml
@@ -0,0 +1,25 @@
+parameters:
+  haproxy:
+    proxy:
+      listen:
+        ironic:
+          type: general-service
+          service_name: ironic
+          check: false
+          binds:
+          - address: ${_param:cluster_vip_address}
+            port: 6385
+          servers:
+          - name: ctl01
+            host: ${_param:cluster_node01_address}
+            port: 6385
+            params: check
+          - name: ctl02
+            host: ${_param:cluster_node02_address}
+            port: 6385
+            params: check
+          - name: ctl03
+            host: ${_param:cluster_node03_address}
+            port: 6385
+            params: check
+
diff --git a/ironic/api/cluster.yml b/ironic/api/cluster.yml
new file mode 100644
index 0000000..c476c40
--- /dev/null
+++ b/ironic/api/cluster.yml
@@ -0,0 +1,9 @@
+classes:
+- service.ironic.api.cluster
+parameters:
+  ironic:
+    api:
+      enabled: true
+      version: ${_param:ironic_version}
+      bind:
+        address: ${_param:cluster_local_address}
diff --git a/ironic/api/single.yml b/ironic/api/single.yml
new file mode 100644
index 0000000..0800579
--- /dev/null
+++ b/ironic/api/single.yml
@@ -0,0 +1,7 @@
+classes:
+- service.ironic.api.single
+parameters:
+  ironic:
+    api:
+      bind:
+        address: ${_param:single_address}
diff --git a/ironic/conductor/cluster.yml b/ironic/conductor/cluster.yml
new file mode 100644
index 0000000..ad4666f
--- /dev/null
+++ b/ironic/conductor/cluster.yml
@@ -0,0 +1,6 @@
+classes:
+- service.ironic.conductor.cluster
+parameters:
+  ironic:
+    conductor:
+      api_url: 'http://${_param:cluster_vip_address}'
diff --git a/ironic/conductor/single.yml b/ironic/conductor/single.yml
new file mode 100644
index 0000000..69e6c20
--- /dev/null
+++ b/ironic/conductor/single.yml
@@ -0,0 +1,7 @@
+classes:
+- service.ironic.conductor.single
+parameters:
+  ironic:
+    conductor:
+      enabled: true
+      version: ${_param:ironic_version}
diff --git a/ironic/tftpd_hpa.yml b/ironic/tftpd_hpa.yml
new file mode 100644
index 0000000..fc1dd74
--- /dev/null
+++ b/ironic/tftpd_hpa.yml
@@ -0,0 +1,14 @@
+classes:
+  - service.tftpd_hpa.server.single
+parameters:
+  tftpd_hpa:
+    server:
+      enabled: true
+      bind:
+        address: '0.0.0.0'
+        port: 69
+      username: 'ironic'
+      path: /var/lib/tftpboot
+      options:
+       - secure
+       - map-file: '/var/lib/tftpboot/map-file'
diff --git a/jenkins/client/job/debian/packages/extra.yml b/jenkins/client/job/debian/packages/extra.yml
index c902f32..fe50cd6 100644
--- a/jenkins/client/job/debian/packages/extra.yml
+++ b/jenkins/client/job/debian/packages/extra.yml
@@ -145,6 +145,14 @@
               dist: xenial
               build: libvirt-exporter
               branch: master
+            - package: kafka
+              dist: xenial
+              build: pipeline
+              branch: debian/xenial
+            - package: python-cassandra-driver
+              dist: xenial
+              build: pipeline
+              branch: debian/xenial
           template:
             type: workflow-scm
             concurrent: false
diff --git a/jenkins/client/job/debian/packages/salt-multi.yml b/jenkins/client/job/debian/packages/salt-multi.yml
index d216e9d..85b95c7 100644
--- a/jenkins/client/job/debian/packages/salt-multi.yml
+++ b/jenkins/client/job/debian/packages/salt-multi.yml
@@ -25,6 +25,8 @@
               dist: trusty
             - name: swift
               dist: trusty
+            - name: ironic
+              dist: trusty
             - name: ceilometer
               dist: xenial
             - name: cinder
@@ -45,6 +47,8 @@
               dist: xenial
             - name: swift
               dist: xenial
+            - name: ironic
+              dist: xenial
           template:
             discard:
               build:
@@ -117,4 +121,4 @@
                 default: 'true'
               UPLOAD_APTLY:
                 type: boolean
-                default: 'true'
\ No newline at end of file
+                default: 'true'
diff --git a/jenkins/client/job/debian/packages/salt.yml b/jenkins/client/job/debian/packages/salt.yml
index ecd7432..1fbee1e 100644
--- a/jenkins/client/job/debian/packages/salt.yml
+++ b/jenkins/client/job/debian/packages/salt.yml
@@ -129,6 +129,8 @@
               dist: trusty
             - name: ntp
               dist: trusty
+            - name: octavia
+              dist: trusty
             - name: opencontrail
               dist: trusty
             - name: openldap
@@ -189,6 +191,8 @@
               dist: trusty
             - name: varnish
               dist: trusty
+            - name: xtrabackup
+              dist: trusty
             - name: zookeeper
               dist: trusty
             - name: aodh
@@ -315,6 +319,8 @@
               dist: xenial
             - name: ntp
               dist: xenial
+            - name: octavia
+              dist: xenial
             - name: opencontrail
               dist: xenial
             - name: openldap
@@ -375,6 +381,8 @@
               dist: xenial
             - name: varnish
               dist: xenial
+            - name: xtrabackup
+              dist: xenial
             - name: zookeeper
               dist: xenial
           template:
diff --git a/jenkins/client/job/deploy/lab/cicd.yml b/jenkins/client/job/deploy/lab/cicd.yml
index 7f53d29..fb1dd92 100644
--- a/jenkins/client/job/deploy/lab/cicd.yml
+++ b/jenkins/client/job/deploy/lab/cicd.yml
@@ -62,7 +62,7 @@
               # openstack api
               OPENSTACK_API_URL:
                 type: string
-                default: "https://vpc.tcpisek.cz:5000/v2.0"
+                default: "https://vpc.tcpisek.cz:5000"
               OPENSTACK_API_CREDENTIALS:
                 type: string
                 default: "openstack-qa-credentials"
@@ -75,9 +75,15 @@
               OPENSTACK_API_VERSION:
                 type: string
                 default: "2"
-              OPENSTACK_API_PROJECT_DOMAIN_ID:
+              OPENSTACK_API_PROJECT_DOMAIN:
                 type: string
                 default: "default"
               OPENSTACK_API_USER_DOMAIN_ID:
                 type: string
                 default: "default"
+              OPENSTACK_API_PROJECT_ID:
+                type: string
+                default: ""
+              OPENSTACK_API_USER_DOMAIN:
+                type: string
+                default: "default"
diff --git a/jenkins/client/job/deploy/lab/mk/cleanup.yml b/jenkins/client/job/deploy/lab/mk/cleanup.yml
index 8658eec..a400842 100644
--- a/jenkins/client/job/deploy/lab/mk/cleanup.yml
+++ b/jenkins/client/job/deploy/lab/mk/cleanup.yml
@@ -2,10 +2,10 @@
   jenkins:
     client:
       job:
-        deploy-heat-cleanup:
+        deploy-stack-cleanup:
           type: workflow-scm
           concurrent: true
-          display_name: "Deploy - heat cleanup"
+          display_name: "Deploy - stack cleanup"
           discard:
             build:
               keep_num: 20
@@ -15,10 +15,21 @@
             credentials: "gerrit"
             script: cleanup-pipeline.groovy
           param:
-            # openstack api
+            # general parameters
+            STACK_NAME:
+              type: string
+              description: This stack will be deleted.
+            STACK_TYPE:
+              type: choice
+              choices:
+                - heat
+                - aws
+              default: 'heat'
+
+            # heat parameters
             OPENSTACK_API_URL:
               type: string
-              default: "https://vpc.tcpisek.cz:5000/v2.0"
+              default: "https://vpc.tcpisek.cz:5000"
             OPENSTACK_API_CREDENTIALS:
               type: string
               default: "openstack-qa-credentials"
@@ -31,16 +42,24 @@
             OPENSTACK_API_VERSION:
               type: string
               default: "2"
-            OPENSTACK_API_PROJECT_DOMAIN_ID:
+            OPENSTACK_API_PROJECT_DOMAIN:
               type: string
               default: "default"
-            OPENSTACK_API_USER_DOMAIN_ID:
+            OPENSTACK_API_PROJECT_ID:
+              type: string
+              default: ""
+            OPENSTACK_API_USER_DOMAIN:
               type: string
               default: "default"
-            # heat
-            HEAT_STACK_NAME:
+
+            # aws parameters
+            AWS_API_CREDENTIALS:
               type: string
-              description: This stack will be deleted.
+              default: "aws-credentials"
+            AWS_DEFAULT_REGION:
+              type: string
+              default: "us-west-2"
+
         delete-failed-stacks:
           type: workflow-scm
           concurrent: true
@@ -60,7 +79,7 @@
             # openstack api
             OPENSTACK_API_URL:
               type: string
-              default: "https://vpc.tcpisek.cz:5000/v2.0"
+              default: "https://vpc.tcpisek.cz:5000"
             OPENSTACK_API_CREDENTIALS:
               type: string
               default: "openstack-qa-credentials"
@@ -73,9 +92,15 @@
             OPENSTACK_API_VERSION:
               type: string
               default: "2"
-            OPENSTACK_API_PROJECT_DOMAIN_ID:
+            OPENSTACK_API_PROJECT_DOMAIN:
               type: string
               default: "default"
             OPENSTACK_API_USER_DOMAIN_ID:
               type: string
               default: "default"
+            OPENSTACK_API_PROJECT_ID:
+              type: string
+              default: ""
+            OPENSTACK_API_USER_DOMAIN:
+              type: string
+              default: "default"
diff --git a/jenkins/client/job/deploy/lab/mk/cloud.yml b/jenkins/client/job/deploy/lab/mk/cloud.yml
index 6bffea0..a79414b 100644
--- a/jenkins/client/job/deploy/lab/mk/cloud.yml
+++ b/jenkins/client/job/deploy/lab/mk/cloud.yml
@@ -3,12 +3,12 @@
     jenkins_cloud_deploy_pipelines:
       - stack_name: k8s_calico
         stack_type: heat
-        stack_install: core,k8s
+        stack_install: core,k8s,calico
         job_timer: ""
       - stack_name: k8s_calico
         stack_type: aws
-        stack_install: core,k8s
-        job_timer: ""
+        stack_install: core,k8s,calico
+        job_timer: "H H * * *"
   jenkins:
     client:
       job_template:
@@ -21,7 +21,7 @@
               build:
                 keep_num: 20
             concurrent: true
-            display_name: "Deploy {{stack_type}} {{stack_name}} stack"
+            display_name: "Deploy - {{stack_name}} {{stack_type}}"
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
@@ -31,7 +31,12 @@
               timer:
                 spec: "{{job_timer}}"
             param:
-              # deployments and test settings
+              # general parameters
+              ASK_ON_ERROR:
+                type: boolean
+                default: 'false'
+
+              # deployments
               STACK_NAME:
                 type: string
                 description: Heat stack name. Will be generated if missing.
@@ -54,6 +59,9 @@
               STACK_REUSE:
                 type: boolean
                 default: 'false'
+              STACK_COMPUTE_COUNT:
+                type: string
+                default: '2'
 
               STACK_TEMPLATE_URL:
                 type: string
@@ -66,7 +74,7 @@
                 default: "master"
               STACK_CLEANUP_JOB:
                 type: string
-                default: ''
+                default: 'deploy-stack-cleanup'
 
               # salt master
               SALT_MASTER_CREDENTIALS:
@@ -91,7 +99,7 @@
               # openstack api
               OPENSTACK_API_URL:
                 type: string
-                default: "https://vpc.tcpisek.cz:5000/v2.0"
+                default: "https://vpc.tcpisek.cz:5000"
               OPENSTACK_API_CREDENTIALS:
                 type: string
                 default: "openstack-qa-credentials"
@@ -104,12 +112,18 @@
               OPENSTACK_API_VERSION:
                 type: string
                 default: "2"
-              OPENSTACK_API_PROJECT_DOMAIN_ID:
+              OPENSTACK_API_PROJECT_DOMAIN:
                 type: string
                 default: "default"
               OPENSTACK_API_USER_DOMAIN_ID:
                 type: string
                 default: "default"
+              OPENSTACK_API_PROJECT_ID:
+                type: string
+                default: ""
+              OPENSTACK_API_USER_DOMAIN:
+                type: string
+                default: "default"
 
               # heat
               HEAT_STACK_ENVIRONMENT:
@@ -130,12 +144,8 @@
                 type: string
                 default: "docker-dev-virtual.docker.mirantis.net/mirantis/kubernetes/k8s-conformance:v1.5.1-3_1482332392819"
 
-              # Tempest settings
-              TEMPEST_IMAGE_LINK:
+              # Openstack settings
+              TEMPEST_IMAGE:
                 type: string
                 default: "sandbox-docker-prod-local.docker.mirantis.net/mirantis/rally_tempest:0.1"
 
-              ASK_ON_ERROR:
-                type: boolean
-                default: 'false'
-
diff --git a/jenkins/client/job/deploy/lab/mk/init.yml b/jenkins/client/job/deploy/lab/mk/init.yml
index 9e988ba..1ddd863 100644
--- a/jenkins/client/job/deploy/lab/mk/init.yml
+++ b/jenkins/client/job/deploy/lab/mk/init.yml
@@ -58,7 +58,7 @@
                 default: 'false'
               STACK_CLEANUP_JOB:
                 type: string
-                default: 'deploy-heat-cleanup'
+                default: 'deploy-stack-cleanup'
               # heat
               HEAT_STACK_ENVIRONMENT:
                 type: string
@@ -81,7 +81,7 @@
               # openstack api
               OPENSTACK_API_URL:
                 type: string
-                default: "https://vpc.tcpisek.cz:5000/v2.0"
+                default: "https://vpc.tcpisek.cz:5000"
               OPENSTACK_API_CREDENTIALS:
                 type: string
                 default: "openstack-qa-credentials"
@@ -94,10 +94,16 @@
               OPENSTACK_API_VERSION:
                 type: string
                 default: "2"
-              OPENSTACK_API_PROJECT_DOMAIN_ID:
+              OPENSTACK_API_PROJECT_DOMAIN:
                 type: string
                 default: "default"
-              OPENSTACK_API_USER_DOMAIN_ID:
+              OPENSTACK_API_PROJECT_ID:
+                type: string
+                default: ""
+              OPENSTACK_USER_DOMAIN:
+                type: string
+                default: "default"
+              OPENSTACK_API_USER_DOMAIN:
                 type: string
                 default: "default"
 
diff --git a/jenkins/client/job/deploy/update/package.yml b/jenkins/client/job/deploy/update/package.yml
index 273796c..a4e7fc0 100644
--- a/jenkins/client/job/deploy/update/package.yml
+++ b/jenkins/client/job/deploy/update/package.yml
@@ -36,7 +36,7 @@
             TARGET_SUBSET_LIVE:
               type: string
               default: '1'
-              description: Number of selected noded to live apply selected package update.
+              description: Number of selected nodes to live apply selected package update.
             TARGET_BATCH_LIVE:
               type: string
               description: Batch size for the complete live package update on all nodes, empty string means apply to all targetted nodes.
diff --git a/jenkins/client/job/deploy/update/restore_mysql.yml b/jenkins/client/job/deploy/update/restore_mysql.yml
new file mode 100644
index 0000000..9b2e4d7
--- /dev/null
+++ b/jenkins/client/job/deploy/update/restore_mysql.yml
@@ -0,0 +1,26 @@
+#
+# Jobs to update packages on given Salt master environment
+#
+parameters:
+  _param:
+    jenkins_salt_api_url: "http://${_param:salt_master_host}:6969"
+  jenkins:
+    client:
+      job:
+        deploy-mysql-db-restore:
+          type: workflow-scm
+          concurrent: true
+          display_name: "Xtrabackup - restore mysql db"
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            credentials: "gerrit"
+            script: xtrabackup-restore-mysql-db.groovy
+          param:
+            SALT_MASTER_URL:
+              type: string
+              default: "${_param:jenkins_salt_api_url}"
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+
diff --git a/jenkins/client/job/deploy/update/upgrade_compute.yml b/jenkins/client/job/deploy/update/upgrade_compute.yml
new file mode 100644
index 0000000..0d7ea78
--- /dev/null
+++ b/jenkins/client/job/deploy/update/upgrade_compute.yml
@@ -0,0 +1,42 @@
+#
+# Jobs to update packages on given Salt master environment
+#
+parameters:
+  _param:
+    jenkins_salt_api_url: "http://${_param:salt_master_host}:6969"
+  jenkins:
+    client:
+      job:
+        deploy-update-package:
+          type: workflow-scm
+          concurrent: true
+          display_name: "Deploy - upgrade computes"
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            credentials: "gerrit"
+            script: openstack-compute-upgrade.groovy
+          param:
+            SALT_MASTER_URL:
+              type: string
+              default: "${_param:jenkins_salt_api_url}"
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+            TARGET_SERVERS:
+              type: string
+              default: "*"
+              description: Salt compound target to match nodes to be updated [*, G@osfamily:debian].
+            TARGET_PACKAGES:
+              type: string
+              description: Space delimited list of packages to be updates [package1=version package2=version], empty string means all updating all packages to the latest version.
+            TARGET_SUBSET_TEST:
+              type: string
+              description: Number of nodes to list package updates, empty string means all targetted nodes.
+            TARGET_SUBSET_LIVE:
+              type: string
+              default: '1'
+              description: Number of selected nodes to live apply selected package update.
+            TARGET_BATCH_LIVE:
+              type: string
+              description: Batch size for the complete live package update on all nodes, empty string means apply to all targetted nodes.
diff --git a/jenkins/client/job/docker/devops-portal.yml b/jenkins/client/job/docker/devops-portal.yml
index 7af37eb..399586f 100644
--- a/jenkins/client/job/docker/devops-portal.yml
+++ b/jenkins/client/job/docker/devops-portal.yml
@@ -40,7 +40,7 @@
           param:
             IMAGE_NAME:
               type: string
-              default: "devops_portal"
+              default: "devops-portal"
             IMAGE_TAGS:
               type: string
               default: ""
diff --git a/jenkins/client/job/docker/rundeck.yml b/jenkins/client/job/docker/rundeck.yml
new file mode 100644
index 0000000..63d206f
--- /dev/null
+++ b/jenkins/client/job/docker/rundeck.yml
@@ -0,0 +1,58 @@
+parameters:
+  jenkins:
+    client:
+      job:
+        docker-build-images-rundeck:
+          name: docker-build-images-rundeck
+          discard:
+            build:
+              keep_num: 25
+            artifact:
+              keep_num: 25
+          type: workflow-scm
+          concurrent: false
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            credentials: "gerrit"
+            script: docker-build-to-jfrog.groovy
+          trigger:
+            gerrit:
+              project:
+                "oss/docker-rundeck":
+                  branches:
+                    - master
+              skip_vote:
+                - successful
+                - failed
+                - unstable
+                - not_built
+              event:
+                patchset:
+                  - created:
+                      excludeDrafts: false
+                      excludeNoCodeChange: false
+                change:
+                  - merged
+                comment:
+                  - addedContains:
+                      commentAddedCommentContains: 'rebuild'
+          param:
+            IMAGE_NAME:
+              type: string
+              default: "rundeck"
+            IMAGE_TAGS:
+              type: string
+              default: ""
+            CREDENTIALS_ID:
+              type: string
+              default: "gerrit"
+            DOCKERFILE_PATH:
+              type: string
+              default: "."
+            DOCKER_REGISTRY:
+              type: string
+              default: "docker-dev-virtual.docker.mirantis.net"
+            PROJECT_NAMESPACE:
+              type: string
+              default: "oss"
diff --git a/jenkins/client/job/image/centos.yml b/jenkins/client/job/image/centos.yml
index 995bfd4..6f3484b 100644
--- a/jenkins/client/job/image/centos.yml
+++ b/jenkins/client/job/image/centos.yml
@@ -56,7 +56,7 @@
               default: "qcow2"
             GLANCE_URL:
               type: string
-              default: "https://vpc.tcpisek.cz:5000/v2.0"
+              default: "https://vpc.tcpisek.cz:5000"
             GLANCE_CREDENTIALS_ID:
               type: string
               default: "openstack-qa-credentials"
diff --git a/jenkins/client/job/image/debian.yml b/jenkins/client/job/image/debian.yml
index 924b34c..3efc6b5 100644
--- a/jenkins/client/job/image/debian.yml
+++ b/jenkins/client/job/image/debian.yml
@@ -56,7 +56,7 @@
               default: "qcow2"
             GLANCE_URL:
               type: string
-              default: "https://vpc.tcpisek.cz:5000/v2.0"
+              default: "https://vpc.tcpisek.cz:5000"
             GLANCE_CREDENTIALS_ID:
               type: string
               default: "openstack-qa-credentials"
diff --git a/jenkins/client/job/image/ubuntu.yml b/jenkins/client/job/image/ubuntu.yml
index a9f25e5..63195fe 100644
--- a/jenkins/client/job/image/ubuntu.yml
+++ b/jenkins/client/job/image/ubuntu.yml
@@ -63,7 +63,7 @@
               default: "qcow2"
             GLANCE_URL:
               type: string
-              default: "https://vpc.tcpisek.cz:5000/v2.0"
+              default: "https://vpc.tcpisek.cz:5000"
             GLANCE_CREDENTIALS_ID:
               type: string
               default: "openstack-qa-credentials"
@@ -129,7 +129,7 @@
               default: "qcow2"
             GLANCE_URL:
               type: string
-              default: "https://vpc.tcpisek.cz:5000/v2.0"
+              default: "https://vpc.tcpisek.cz:5000"
             GLANCE_CREDENTIALS_ID:
               type: string
               default: "openstack-qa-credentials"
diff --git a/jenkins/client/job/salt-formulas/git-mirrors/2way.yml b/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
index 1716a44..cf39dbd 100644
--- a/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
+++ b/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
@@ -48,6 +48,7 @@
             - name: horizon
             - name: influxdb
             - name: iptables
+            - name: ironic
             - name: isc-dhcp
             - name: java
             - name: jenkins
@@ -77,6 +78,7 @@
             - name: nodejs
             - name: nova
             - name: ntp
+            - name: octavia
             - name: opencontrail
             - name: openldap
             - name: openssh
@@ -106,6 +108,7 @@
             - name: taiga
             - name: telegraf
             - name: varnish
+            - name: xtrabackup
             - name: zookeeper
           template:
             discard:
diff --git a/jenkins/client/job/salt-formulas/tests.yml b/jenkins/client/job/salt-formulas/tests.yml
index 0f3b405..68792d4 100644
--- a/jenkins/client/job/salt-formulas/tests.yml
+++ b/jenkins/client/job/salt-formulas/tests.yml
@@ -47,6 +47,7 @@
             - name: horizon
             - name: influxdb
             - name: iptables
+            - name: ironic
             - name: isc-dhcp
             - name: java
             - name: jenkins
@@ -76,6 +77,7 @@
             - name: nodejs
             - name: nova
             - name: ntp
+            - name: octavia
             - name: opencontrail
             - name: openldap
             - name: openssh
@@ -107,6 +109,7 @@
             - name: telegraf
             - name: tftpd-hpa
             - name: varnish
+            - name: xtrabackup
             - name: zookeeper
           template:
             discard:
diff --git a/jenkins/client/job/salt-models/generate-auto.yml b/jenkins/client/job/salt-models/generate-auto.yml
index 4f62784..79e4ba3 100644
--- a/jenkins/client/job/salt-models/generate-auto.yml
+++ b/jenkins/client/job/salt-models/generate-auto.yml
@@ -19,7 +19,7 @@
             param:
               COOKIECUTTER_TEMPLATE_URL:
                 type: string
-                default: "git@github.com:Mirantis/mk2x-cookiecutter-reclass-model.git"
+                default: "https://gerrit.mcp.mirantis.net/p/mk/cookiecutter-templates.git"
               COOKIECUTTER_TEMPLATE_CREDENTIALS:
                 type: string
                 default: github-credentials
diff --git a/jenkins/client/job/salt-models/generate.yml b/jenkins/client/job/salt-models/generate.yml
index 697ab51..8202479 100644
--- a/jenkins/client/job/salt-models/generate.yml
+++ b/jenkins/client/job/salt-models/generate.yml
@@ -19,7 +19,7 @@
             param:
               COOKIECUTTER_TEMPLATE_URL:
                 type: string
-                default: "git@github.com:Mirantis/mk2x-cookiecutter-reclass-model.git"
+                default: "https://gerrit.mcp.mirantis.net/p/mk/cookiecutter-templates.git"
               COOKIECUTTER_TEMPLATE_CREDENTIALS:
                 type: string
                 default: github-credentials
@@ -44,3 +44,6 @@
                 default: false
               EMAIL_ADDRESS:
                 type: string
+              TEST_MODEL:
+                type: boolean
+                default: true
diff --git a/jenkins/client/job/salt-models/git-mirrors.yml b/jenkins/client/job/salt-models/git-mirrors.yml
index 7ee7b94..514663b 100644
--- a/jenkins/client/job/salt-models/git-mirrors.yml
+++ b/jenkins/client/job/salt-models/git-mirrors.yml
@@ -6,12 +6,37 @@
       job_template:
         git_mirror_2way_salt_model:
           name: git-mirror-2way-salt-model-{{name}}
-          param:
-            name:
-              - reclass-system
-              - slovaktelekom
-              - stacklight
-              - statens
+          jobs:
+            - name: reclass-system
+              upstream_name: reclass-system
+              branches: "master"
+            - name: slovaktelekom
+              upstream_name: slovaktelekom
+              branches: "master"
+            - name: stacklight
+              upstream_name: stacklight
+              branches: "master"
+            - name: statens
+              upstream_name: statensit
+              branches: "master"
+            - name: aeg
+              upstream_name: aeg
+              branches: "master"
+            - name: att-cicd
+              upstream_name: att-cicd
+              branches: "master"
+            - name: mall
+              upstream_name: mall
+              branches: "master"
+            - name: quickplay
+              upstream_name: quickplay
+              branches: "master"
+            - name: ril-jamnagar
+              upstream_name: ril-jamnagar-lab
+              branches: "master,jlab,next"
+            - name: vf-cloudstore
+              upstream_name: vf-cloudstore
+              branches: "master"
           template:
             type: workflow-scm
             concurrent: false
@@ -21,7 +46,7 @@
               credentials: "gerrit"
               script: git-mirror-2way-pipeline.groovy
               github:
-                url: "https://github.com/Mirantis/{{name}}-salt-model"
+                url: "https://github.com/Mirantis/{{upstream_name}}-salt-model"
             trigger:
               github:
               pollscm:
@@ -44,10 +69,10 @@
                 default: "${_param:jenkins_gerrit_url}/salt-models/{{name}}.git"
               TARGET_URL:
                 type: string
-                default: "git@github.com:Mirantis/{{name}}-salt-model.git"
+                default: "git@github.com:Mirantis/{{upstream_name}}-salt-model.git"
               CREDENTIALS_ID:
                 type: string
                 default: "gerrit"
               BRANCHES:
                 type: string
-                default: "master"
+                default: "{{branches}}"
diff --git a/jenkins/client/job/salt-models/tests.yml b/jenkins/client/job/salt-models/tests.yml
index e4b573d..3b5f647 100644
--- a/jenkins/client/job/salt-models/tests.yml
+++ b/jenkins/client/job/salt-models/tests.yml
@@ -1,23 +1,40 @@
 parameters:
   _param:
+  jenkins_pollscm_spec: "0 1 * * *"
   jenkins:
     client:
       job_template:
         test_salt_model:
           name: test-salt-model-{{name}}
           jobs:
+            - name: aeg
+              extra_formulas: ""
+            - name: att-cicd
+              extra_formulas: ""
+            - name: mall
+              extra_formulas: ""
             - name: mcp-baremetal-lab
               extra_formulas: ""
             - name: mcp-virtual-lab
-              extra_formulas: "prometheus"
+              extra_formulas: "prometheus telegraf"
             - name: mk-ci
               extra_formulas: ""
             - name: qa
               extra_formulas: ""
+            - name: quickplay
+              extra_formulas: ""
+            - name: ril-jamnagar
+              extra_formulas: ""
+            - name: slovaktelekom
+              extra_formulas: ""
             - name: stacklight
               extra_formulas: ""
+            - name: statens
+              extra_formulas: ""
             - name: training
               extra_formulas: ""
+            - name: vf-cloudstore
+              extra_formulas: ""
           template:
             type: workflow-scm
             scm:
@@ -57,7 +74,7 @@
                 default: "gerrit"
               PARALLEL_NODE_GROUP_SIZE:
                 type: string
-                default: "3"
+                default: "1"
               # Salt master setup extra formulas
               EXTRA_FORMULAS:
                 type: string
@@ -96,3 +113,51 @@
               DEFAULT_GIT_REF:
                 type: string
                 default: master
+        test_salt_model_cookiecutter:
+          name: test-salt-model-cookiecutter-{{cookiecutter_template}}
+          jobs:
+            - cookiecutter_template: cookiecutter-templates
+          template:
+            type: workflow-scm
+            concurrent: true
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              credentials: "jenkins-mk"
+              script: test-cookiecutter-reclass.groovy
+            trigger:
+              pollscm:
+                spec: ${_param:jenkins_pollscm_spec}
+              gerrit:
+                project:
+                  mk/{{cookiecutter_template}}:
+                    branches:
+                      - master
+                event:
+                  patchset:
+                    - created:
+                        excludeDrafts: false
+                        excludeTrivialRebase: false
+                        excludeNoCodeChange: false
+                  comment:
+                    - addedContains:
+                        commentAddedCommentContains: '(recheck|reverify)'
+            param:
+              COOKIECUTTER_TEMPLATE_URL:
+                type: string
+                default: "${_param:jenkins_gerrit_url}/mk/{{cookiecutter_template}}"
+              CREDENTIALS_ID:
+                type: string
+                default: gerrit
+              COOKIECUTTER_TEMPLATE_BRANCH:
+                type: string
+                default: master
+              RECLASS_MODEL_URL:
+                type: string
+                default: "${_param:jenkins_gerrit_url}/salt-models/reclass-system"
+              RECLASS_MODEL_BRANCH:
+                type: string
+                default: master
+              PARALLEL_NODE_GROUP_SIZE:
+                type: string
+                default: "1"
diff --git a/jenkins/client/job/test_devops_portal.yml b/jenkins/client/job/test_devops_portal.yml
index 5cf4c79..abe2a36 100644
--- a/jenkins/client/job/test_devops_portal.yml
+++ b/jenkins/client/job/test_devops_portal.yml
@@ -46,6 +46,7 @@
               default: |
                 npm run lint
                 npm run test:unit
+                npm run test:functional
             DEFAULT_GIT_URL:
                 type: string
                 default: "${_param:jenkins_gerrit_url}/oss/devops-portal"
diff --git a/jenkins/client/node.yml b/jenkins/client/node.yml
new file mode 100644
index 0000000..321951a
--- /dev/null
+++ b/jenkins/client/node.yml
@@ -0,0 +1,47 @@
+parameters:
+  _param:
+    jenkins_slave_executors: 4
+  jenkins:
+    client:
+      node:
+        master:
+          node_mode: Exclusive
+          remote_home: /var/lib/jenkins
+          launcher:
+            type: master
+        slave01:
+          remote_home: /var/lib/jenkins
+          desc: ""
+          num_executors: ${_param:jenkins_slave_executors}
+          node_mode: Normal
+          ret_strategy: Always
+          labels:
+            - python
+            - test
+            - docker
+          launcher:
+             type: jnlp
+        slave02:
+          remote_home: /var/lib/jenkins
+          desc: ""
+          num_executors: ${_param:jenkins_slave_executors}
+          node_mode: Normal
+          ret_strategy: Always
+          labels:
+            - python
+            - test
+            - docker
+          launcher:
+             type: jnlp
+        slave03:
+          remote_home: /var/lib/jenkins
+          desc: ""
+          num_executors: ${_param:jenkins_slave_executors}
+          node_mode: Normal
+          ret_strategy: Always
+          labels:
+            - python
+            - test
+            - docker
+          launcher:
+             type: jnlp
diff --git a/jenkins/slave/docker.yml b/jenkins/slave/docker.yml
index ea3639b..ddf997b 100644
--- a/jenkins/slave/docker.yml
+++ b/jenkins/slave/docker.yml
@@ -15,4 +15,13 @@
             hosts:
             - ALL
             commands:
-            - /usr/bin/docker
\ No newline at end of file
+            - /usr/bin/docker
+  docker:
+    client:
+      network:
+        docker_gwbridge:
+          subnet: 10.20.0.0/16
+          opt:
+            com.docker.network.bridge.name: docker_gwbridge
+            com.docker.network.bridge.enable_icc: false
+            com.docker.network.bridge.enable_ip_masquerade: true
\ No newline at end of file
diff --git a/keystone/client/service/ironic.yml b/keystone/client/service/ironic.yml
new file mode 100644
index 0000000..7635e2c
--- /dev/null
+++ b/keystone/client/service/ironic.yml
@@ -0,0 +1,30 @@
+parameters:
+  _param:
+    cluster_public_protocol: https
+  keystone:
+    client:
+      server:
+        identity:
+          project:
+            service:
+              user:
+                ironic:
+                  is_admin: true
+                  password: ${_param:keystone_ironic_password}
+                  email: ${_param:admin_email}
+          service:
+            ironic:
+              type: baremetal
+              description: OpenStack Baremetal Service
+              endpoints:
+              - region: ${_param:openstack_region}
+                public_address: ${_param:cluster_public_host}
+                public_protocol: ${_param:cluster_public_protocol}
+                public_port: 6385
+                public_path: ''
+                internal_address: ${_param:ironic_service_host}
+                internal_port: 6385
+                internal_path: ''
+                admin_address: ${_param:ironic_service_host}
+                admin_port: 6385
+                admin_path: ''
diff --git a/maas/region/single.yml b/maas/region/single.yml
index 569d475..d3227ca 100644
--- a/maas/region/single.yml
+++ b/maas/region/single.yml
@@ -2,15 +2,42 @@
   - service.maas.region.single
   - service.maas.region.vendor_repo
 parameters:
+  _param:
+    maas_admin_username: mirantis
   maas:
+    cluster:
+      enabled: true
+      role: master
+      region:
+        host: ${_param:single_address}
+        port: 5242
     region:
+      salt_master_ip: ${_param:infra_config_deploy_address}
       theme: mirantis
       enable_iframe: True
       bind:
-        host: ${_param:cluster_vip_address}
+        host: ${_param:single_address}
+      admin:
+        username: ${_param:maas_admin_username}
+        password: ${_param:maas_admin_password}
+        email:  email@example.com
       database:
         engine: postgresql
-        host: 10.0.175.10
+        host: localhost
         name: maasdb
-        password: password
-        username: maas
\ No newline at end of file
+        password: ${_param:maas_db_password}
+        username: maas
+      maas_config:
+        commissioning_distro_series: xenial
+        default_distro_series: xenial
+        default_osystem: 'ubuntu'
+        default_storage_layout: lvm
+        disk_erase_with_secure_erase: true
+        dnssec_validation: 'no'
+        enable_third_party_drivers: true
+        maas_name: mas01
+        active_discovery_interval: '600'
+        ntp_external_only: true
+        upstream_dns: ${_param:dns_server01}
+        enable_http_proxy: false
+        default_min_hwe_kernel: ''
diff --git a/mysql/client/database/ironic.yml b/mysql/client/database/ironic.yml
new file mode 100644
index 0000000..e142e64
--- /dev/null
+++ b/mysql/client/database/ironic.yml
@@ -0,0 +1,18 @@
+parameters:
+  mysql:
+    client:
+      server:
+        database:
+          database:
+            ironic:
+              encoding: utf8
+              users:
+              - name: ironic
+                password: ${_param:mysql_ironic_password}
+                host: '%'
+                rights: all
+              - name: ironic
+                password: ${_param:mysql_ironic_password}
+                host: ${_param:cluster_local_address}
+                rights: all
+
diff --git a/neutron/client/service/ironic.yml b/neutron/client/service/ironic.yml
new file mode 100644
index 0000000..c400f96
--- /dev/null
+++ b/neutron/client/service/ironic.yml
@@ -0,0 +1,19 @@
+parameters:
+  neutron:
+    client:
+      enabled: true
+      server:
+        admin_identity:
+          endpoint_type: internalURL
+          network:
+            baremetal-flat-network:
+              tenant: admin
+              shared: True
+              admin_state_up: True
+              provider_network_type: flat
+              provider_physical_network: physnet1
+              port_security_enabled: false
+              subnet:
+                baremetal-subnet:
+                  cidr: 192.168.90.0/24
+                  enable_dhcp: true
diff --git a/openssh/client/lab.yml b/openssh/client/lab.yml
index 26ac7f4..7a65847 100644
--- a/openssh/client/lab.yml
+++ b/openssh/client/lab.yml
@@ -38,13 +38,6 @@
           enabled: true
           user: ${linux:system:user:root}
           private_key: ${private_keys:lab}
-          known_hosts:
-          - ${known_hosts:git.tcpcloud.eu}
-  known_hosts:
-    git.tcpcloud.eu:
-      name: git.tcpcloud.eu
-      type: ecdsa
-      fingerprint: fc:77:72:6c:65:c0:e1:26:0d:68:b8:a8:4a:56:38:22
   private_keys:
     lab:
       type: rsa
diff --git a/postgresql/client/pushkin.yml b/postgresql/client/pushkin.yml
index d768464..c6ec567 100644
--- a/postgresql/client/pushkin.yml
+++ b/postgresql/client/pushkin.yml
@@ -14,10 +14,13 @@
               enabled: true
               encoding: 'UTF8'
               locale: 'en_US'
-              template: 'hstore_enabled'
               users:
               - name: ${_param:pushkin_db_user}
                 password: ${_param:pushkin_db_user_password}
                 host: ${_param:pushkin_db_host}
                 createdb: true
                 rights: all privileges
+              extension:
+                hstore:
+                  enabled: true
+
diff --git a/prometheus/server/target/dns.yml b/prometheus/server/target/dns.yml
index 7bbf92e..ed6602d 100644
--- a/prometheus/server/target/dns.yml
+++ b/prometheus/server/target/dns.yml
@@ -20,3 +20,8 @@
               - 'tasks.monitoring_alertmanager'
               type: A
               port: ${prometheus:alertmanager:bind:port}
+            - name: 'remote_agent'
+              domain:
+              - 'tasks.monitoring_remote_agent'
+              type: A
+              port: ${telegraf:remote_agent:output:prometheus_client:bind:port}
diff --git a/reclass/storage/system/infra_maas_single.yml b/reclass/storage/system/infra_maas_single.yml
new file mode 100644
index 0000000..eb5a96b
--- /dev/null
+++ b/reclass/storage/system/infra_maas_single.yml
@@ -0,0 +1,16 @@
+parameters:
+  _param:
+    infra_maas_node01_hostname: mas01
+  reclass:
+    storage:
+      node:
+        infra_maas_node01:
+          name: ${_param:infra_maas_node01_hostname}
+          domain: ${_param:cluster_domain}
+          classes:
+          - cluster.${_param:cluster_name}.infra.maas
+          params:
+            salt_master_host: ${_param:infra_config_deploy_address}
+            linux_system_codename: xenial
+            single_address: ${_param:infra_maas_node01_deploy_address}
+
diff --git a/rundeck/server/docker.yml b/rundeck/server/docker.yml
index 3406b6a..1c89f4f 100644
--- a/rundeck/server/docker.yml
+++ b/rundeck/server/docker.yml
@@ -2,6 +2,12 @@
   - service.rundeck.common
   - service.rundeck.server.single
 parameters:
+  _param:
+    rundeck_postgresql_username: rundeck
+    rundeck_postgresql_password: password
+    rundeck_postgresql_database: rundeck
+    rundeck_postgresql_host: ${_param:control_vip_address}
+    rundeck_postgresql_port: 5432
   rundeck:
     server:
       user:
@@ -9,6 +15,13 @@
         gid: 550
       home_dir: /srv/volumes/rundeck
       root_dir: /srv/volumes/rundeck
+      datasource:
+        engine: postgresql
+        host: ${_param:rundeck_postgresql_host}
+        port: ${_param:rundeck_postgresql_port}
+        username: ${_param:rundeck_postgresql_username}
+        password: ${_param:rundeck_postgresql_password}
+        database: ${_param:rundeck_postgresql_database}
       api:
         host: ${_param:haproxy_rundeck_bind_host}
         port: ${_param:haproxy_rundeck_bind_port}
diff --git a/salt/control/cluster/infra_maas_single.yml b/salt/control/cluster/infra_maas_single.yml
new file mode 100644
index 0000000..d8675e8
--- /dev/null
+++ b/salt/control/cluster/infra_maas_single.yml
@@ -0,0 +1,20 @@
+parameters:
+  salt:
+    control:
+      size:
+        infra.maas:
+          cpu: 4
+          ram: 8192
+          disk_profile: small
+          net_profile: default
+      cluster:
+        internal:
+          domain: ${_param:cluster_domain}
+          engine: virt
+          node:
+            mas01:
+              name: ${_param:infra_maas_node01_hostname}
+              provider: ${_param:infra_kvm_node01_hostname}.${_param:cluster_domain}
+              image: ${_param:salt_control_xenial_image}
+              size: infra.maas
+
diff --git a/salt/master/formula/git/openstack.yml b/salt/master/formula/git/openstack.yml
index 36ddfc2..9173a4a 100644
--- a/salt/master/formula/git/openstack.yml
+++ b/salt/master/formula/git/openstack.yml
@@ -92,6 +92,10 @@
               source: git
               address: '${_param:salt_master_environment_repository}/salt-formula-nova.git'
               revision: ${_param:salt_master_environment_revision}
+            octavia:
+              source: git
+              address: '${_param:salt_master_environment_repository}/salt-formula-octavia.git'
+              revision: ${_param:salt_master_environment_revision}
             opencontrail:
               source: git
               address: '${_param:salt_master_environment_repository}/salt-formula-opencontrail.git'
diff --git a/salt/master/formula/pkg/openstack.yml b/salt/master/formula/pkg/openstack.yml
index b1222d1..827f096 100644
--- a/salt/master/formula/pkg/openstack.yml
+++ b/salt/master/formula/pkg/openstack.yml
@@ -70,6 +70,9 @@
             nova:
               source: pkg
               name: salt-formula-nova
+            octavia:
+              source: pkg
+              name: salt-formula-octavia
             opencontrail:
               source: pkg
               name: salt-formula-opencontrail
diff --git a/telegraf/agent/remote.yml b/telegraf/agent/remote.yml
new file mode 100644
index 0000000..ecbae25
--- /dev/null
+++ b/telegraf/agent/remote.yml
@@ -0,0 +1,16 @@
+classes:
+- service.telegraf.agent.remote
+parameters:
+  telegraf:
+    remote_agent:
+      dir:
+        config: /srv/volumes/local/telegraf
+        config_d: /srv/volumes/local/telegraf/telegraf.d
+      input:
+        internal:
+      output:
+        prometheus_client:
+          bind:
+            address: 0.0.0.0
+            port: 9126
+          engine: prometheus
diff --git a/xtrabackup/client/single.yml b/xtrabackup/client/single.yml
new file mode 100644
index 0000000..cbe1123
--- /dev/null
+++ b/xtrabackup/client/single.yml
@@ -0,0 +1,3 @@
+classes:
+- service.xtrabackup.client.single
+- system.openssh.client.root
\ No newline at end of file
diff --git a/xtrabackup/server/single.yml b/xtrabackup/server/single.yml
new file mode 100644
index 0000000..d1d54fd
--- /dev/null
+++ b/xtrabackup/server/single.yml
@@ -0,0 +1,2 @@
+classes:
+- service.xtrabackup.server.single