diff --git a/defaults/docker_images.yml b/defaults/docker_images.yml
index 8db61a5..bec34e7 100644
--- a/defaults/docker_images.yml
+++ b/defaults/docker_images.yml
@@ -16,7 +16,7 @@
     docker_image_gerrit: "${_param:mcp_docker_registry}/mirantis/cicd/gerrit:${_param:mcp_version}"
     # mysql:5.6
     docker_image_mysql: "${_param:mcp_docker_registry}/mirantis/cicd/mysql:${_param:mcp_version}"
-    # jenkins:2.121.3
+    # jenkins:2.150.3
     docker_image_jenkins: "${_param:mcp_docker_registry}/mirantis/cicd/jenkins:${_param:mcp_version}"
     docker_image_jenkins_slave: "${_param:mcp_docker_registry}/mirantis/cicd/jnlp-slave:${_param:mcp_version}"
     # model-generator
diff --git a/defaults/etcd.yml b/defaults/etcd.yml
new file mode 100644
index 0000000..06d9a18
--- /dev/null
+++ b/defaults/etcd.yml
@@ -0,0 +1,6 @@
+parameters:
+  _param:
+    docker_image_etcd: quay.io/coreos/etcd:v3.3.12
+    kubernetes_etcd_repo: https://github.com/etcd-io/etcd/releases/download
+    kubernetes_etcd_source: ${_param:kubernetes_etcd_repo}/v3.3.12/etcd-v3.3.12-linux-amd64.tar.gz
+    kubernetes_etcd_source_hash: md5=079af00546443b686df31e7ec605135e
diff --git a/defaults/init.yml b/defaults/init.yml
index db9fca9..b70367e 100644
--- a/defaults/init.yml
+++ b/defaults/init.yml
@@ -24,6 +24,8 @@
 - system.defaults.stacklight
 - system.defaults.xtrabackup
 - system.defaults.backup
+# k8s
+- system.defaults.etcd
 parameters:
   _param:
     mcp_version: stable
diff --git a/defaults/openstack/init.yml b/defaults/openstack/init.yml
index 8a6db83..b5b66e1 100644
--- a/defaults/openstack/init.yml
+++ b/defaults/openstack/init.yml
@@ -29,6 +29,12 @@
     openstack_version: queens
     openstack_old_version: ${_param:openstack_version}
     openstack_upgrade_enabled: False
+    # Security compliance user options
+    openstack_service_user_options:
+      ignore_change_password_upon_first_use: True
+      ignore_password_expiry: True
+      ignore_lockout_failure_attempts: False
+      lock_password: False
     # Cinder
     cinder_memcache_security_enabled: ${_param:openstack_memcache_security_enabled}
     cinder_memcache_secret_key: ''
diff --git a/docker/client/images/monitoring.yml b/docker/client/images/monitoring.yml
index 229152d..2189b52 100644
--- a/docker/client/images/monitoring.yml
+++ b/docker/client/images/monitoring.yml
@@ -7,6 +7,7 @@
       - ${_param:docker_image_alertmanager}
       - ${_param:docker_image_grafana}
       - ${_param:docker_image_prometheus}
+      - ${_param:docker_image_prometheus_es_exporter}
       - ${_param:docker_image_prometheus_gainsight}
       - ${_param:docker_image_prometheus_gainsight_elasticsearch}
       - ${_param:docker_image_prometheus_relay}
@@ -14,4 +15,4 @@
       - ${_param:docker_image_remote_agent}
       - ${_param:docker_image_remote_collector}
       - ${_param:docker_image_remote_storage_adapter}
-      - ${_param:docker_image_sf_notifier}
\ No newline at end of file
+      - ${_param:docker_image_sf_notifier}
diff --git a/docker/swarm/stack/monitoring/elasticsearch_exporter.yml b/docker/swarm/stack/monitoring/elasticsearch_exporter.yml
new file mode 100644
index 0000000..5cbc05e
--- /dev/null
+++ b/docker/swarm/stack/monitoring/elasticsearch_exporter.yml
@@ -0,0 +1,28 @@
+classes:
+- system.prometheus.elasticsearch_exporter.container
+parameters:
+  docker:
+    client:
+      stack:
+        monitoring:
+          network:
+            monitoring:
+              driver: overlay
+              driver_opts:
+                encrypted: 1
+          service:
+            elasticsearch_exporter:
+              command: --es-cluster ${_param:stacklight_log_address}:9200 --nodes-stats-disable --cluster-health-disable --indices-stats-disable
+              networks:
+                - monitoring
+              deploy:
+                replicas: 1
+                labels:
+                  com.mirantis.monitoring: "elasticsearch_exporter"
+                restart_policy:
+                  condition: any
+              labels:
+                com.mirantis.monitoring: "elasticsearch_exporter"
+              image: ${_param:docker_image_prometheus_es_exporter}
+              volumes:
+                - "${prometheus:elasticsearch_exporter:dir:config}/elasticsearch_exporter.cfg:/usr/src/app/exporter.cfg"
diff --git a/docker/swarm/stack/monitoring/init.yml b/docker/swarm/stack/monitoring/init.yml
index 134efdc..9fa4281 100644
--- a/docker/swarm/stack/monitoring/init.yml
+++ b/docker/swarm/stack/monitoring/init.yml
@@ -2,6 +2,7 @@
 - system.docker.swarm.stack.monitoring.prometheus
 - system.docker.swarm.stack.monitoring.prometheus.replicated
 - system.docker.swarm.stack.monitoring.alertmanager
+- system.docker.swarm.stack.monitoring.elasticsearch_exporter
 - system.docker.swarm.stack.monitoring.prometheus_relay
 - system.docker.swarm.stack.monitoring.pushgateway
 - system.docker.swarm.stack.monitoring.remote_agent
diff --git a/docker/swarm/stack/monitoring/prometheus_global.yml b/docker/swarm/stack/monitoring/prometheus_global.yml
index 6d8e4ba..925675a 100644
--- a/docker/swarm/stack/monitoring/prometheus_global.yml
+++ b/docker/swarm/stack/monitoring/prometheus_global.yml
@@ -2,6 +2,7 @@
 - system.docker.swarm.stack.monitoring.prometheus
 - system.docker.swarm.stack.monitoring.prometheus.global
 - system.docker.swarm.stack.monitoring.alertmanager
+- system.docker.swarm.stack.monitoring.elasticsearch_exporter
 - system.docker.swarm.stack.monitoring.prometheus_relay
 - system.docker.swarm.stack.monitoring.pushgateway
 - system.docker.swarm.stack.monitoring.remote_agent
diff --git a/etcd/server/cluster.yml b/etcd/server/cluster.yml
index af210d7..2314dc2 100644
--- a/etcd/server/cluster.yml
+++ b/etcd/server/cluster.yml
@@ -3,11 +3,6 @@
 - service.etcd.support
 - service.etcd.linux
 parameters:
-  _param:
-    docker_image_etcd: quay.io/coreos/etcd:v3.3.12
-    kubernetes_etcd_repo: https://github.com/etcd-io/etcd/releases/download
-    kubernetes_etcd_source: ${_param:kubernetes_etcd_repo}/v3.3.12/etcd-v3.3.12-linux-amd64.tar.gz
-    kubernetes_etcd_source_hash: md5=079af00546443b686df31e7ec605135e
   etcd:
     server:
       enabled: true
diff --git a/etcd/server/single.yml b/etcd/server/single.yml
new file mode 100644
index 0000000..b36f743
--- /dev/null
+++ b/etcd/server/single.yml
@@ -0,0 +1,17 @@
+classes:
+- service.etcd.server.single
+- service.etcd.support
+- service.etcd.linux
+parameters:
+  etcd:
+    server:
+      enabled: true
+      image: ${_param:docker_image_etcd}
+      source:
+        engine: archive
+      etcd_source: ${_param:kubernetes_etcd_source}
+      etcd_source_hash: ${_param:kubernetes_etcd_source_hash}
+      bind:
+        host: ${_param:single_address}
+      ssl:
+        enabled: true
diff --git a/jenkins/client/job/validate.yml b/jenkins/client/job/validate.yml
index ad3ab9e..d24db10 100644
--- a/jenkins/client/job/validate.yml
+++ b/jenkins/client/job/validate.yml
@@ -24,6 +24,40 @@
             credentials: "gerrit"
             script: validate-cloud.groovy
           param:
+            ACCUMULATE_RESULTS:
+              type: boolean
+              default: 'true'
+              description: If chosen then previous build results will be used in the current build
+            JOB_TIMEOUT:
+              type: string
+              default: "3"
+              description: Job timeout in hours
+            RUN_RALLY_TESTS:
+              type: boolean
+              default: 'true'
+              description: |
+                  If chosen, Rally tests will be executed. Please set K8S_RALLY='true' if you plan
+                  to test K8S cluster with Rally framework. Special K8S plugin has to be utilized
+            RUN_TEMPEST_TESTS:
+              type: boolean
+              default: 'false'
+              description: If chosen then Tempest tests will be executed
+            RUN_SPT_TESTS:
+              type: boolean
+              default: 'false'
+              description: If chosen, SPT tests will be executed
+            TEST_IMAGE:
+              type: string
+              default: 'xrally/xrally-openstack:latest'
+              description: |
+                  Docker image to use with required test set. Please use
+                  'xrally/xrally-openstack:latest' - for Rally tests
+                  "${_param:mcp_docker_registry}/mirantis/oss/qa-tools" -
+                  for SPT/Tempest environment setup
+            TARGET_NODE:
+              type: string
+              default: ""
+              description: Target node where this job will be executed from
             SALT_MASTER_URL:
               type: string
               default: "${_param:jenkins_salt_api_url}"
@@ -32,151 +66,78 @@
               type: string
               default: "salt"
               description: Credentials to the Salt API
-            TEST_IMAGE:
-              type: string
-              default: "${_param:mcp_docker_registry}/mirantis/oss/qa-tools"
-              description: Docker image to setup testing environment
-            TARGET_NODE:
-              type: string
-              default: ""
-              description: Target node where this job will be executed from
-            RUN_RALLY_TESTS:
-              type: boolean
-              default: 'true'
-              description: If chosen then Rally tests will be executed
-            RUN_TEMPEST_TESTS:
-              type: boolean
-              default: 'true'
-              description: If chosen then Tempest tests will be executed
-            RUN_K8S_TESTS:
-              type: boolean
-              default: 'true'
-              description: If chosen then K8S tests will be executed
-            TEMPEST_TEST_SET:
-              type: choice
-              choices:
-                - smoke
-                - full
-              description: Set of Tempest tests to run
-            TEMPEST_CONFIG_REPO:
-              type: string
-              default: ""
-              description: Git repository with configuration files for Tempest
-            TEMPEST_CONFIG_BRANCH:
-              type: string
-              default: ""
-              description: Git branch which will be used during the checkout
-            TEMPEST_REPO:
-              type: string
-              default: ""
-              description: Git repository with Tempest
-            TEMPEST_VERSION:
-              type: string
-              default: ""
-              description: Version of Tempest (tag, branch or commit)
-            TEST_K8S_NODE:
-              type: string
-              default: ""
-              description: Kubernetes node to run tests from
-            TEST_K8S_API_SERVER:
-              type: string
-              default: "http://127.0.0.1:8080"
-              description: API server parameter for K8S tests
-            TEST_K8S_CONFORMANCE_IMAGE:
-              type: string
-              default: "docker-dev-virtual.docker.mirantis.net/mirantis/kubernetes/k8s-conformance:v1.7.5-2_1504192939316"
-              description: Docker image to run K8S tests
-            RUN_SPT_TESTS:
-              type: boolean
-              default: 'true'
-              description: If chosen then SPT tests will be executed
-            SPT_SSH_USER:
-              type: string
-              default: "root"
-              description: Username that is used to ssh between cluster nodes
-            FLOATING_NETWORK:
-              type: string
-              default: ""
-              description: External(floating) network name (used in both SPT and Rally)
-            SPT_IMAGE:
-              type: string
-              default: ""
-              description: Image that is used for network-VM-to-VM-iperf-tests tests
-            SPT_IMAGE_USER:
-              type: string
-              default: ""
-              description: Username that is used to ssh to SPT_IMAGE
-            SPT_FLAVOR:
-              type: string
-              default: ""
-              description: Flavor name for SPT_IMAGE (make sure you have required flavor created)
-            RALLY_IMAGE:
-              type: string
-              default: "cirros"
-            RALLY_FLAVOR:
-              type: string
-              default: "m1.tiny"
-              description: Flavor name for Rally scenarios
-            RALLY_CONFIG_REPO:
-              type: string
-              default: ""
-              description: Git repository with configuration files for Rally
-            RALLY_CONFIG_BRANCH:
-              type: string
-              default: ""
-              description: Git branch which will be used during the checkout
-            RALLY_SCENARIOS:
-              type: string
-              default: ""
-              description: Rally scenarios directory or file with scenarios
-            RALLY_SL_SCENARIOS:
-              type: string
-              default: ""
-              description: Stacklight Rally scenarios directory or file with scenarios
-            RALLY_TASK_ARGS_FILE:
-              type: string
-              default: ""
-              description: Rally scenarios arguments file
-            AVAILABILITY_ZONE:
-              type: string
-              default: "nova"
-              description: Name of availability zone
-            GENERATE_REPORT:
-              type: boolean
-              default: 'true'
-              description: If chosen then at the end of the test run HTML report will be generated
-            ACCUMULATE_RESULTS:
-              type: boolean
-              default: 'true'
-              description: If chosen then previous build results will be used in the current build
-            RALLY_PLUGINS_REPO:
-              type: string
-              default: ""
-              description: Git repository with Rally plugins
-            RALLY_PLUGINS_BRANCH:
-              type: string
-              default: ""
-              description: Git branch which will be used during the checkout
-            K8S_RALLY:
-              type: boolean
-              default: 'false'
-              description: If chosen then K8S Rally test will be executed
-            STACKLIGHT_RALLY:
-              type: boolean
-              default: 'false'
-              description: If chosen then Stacklight Rally test will be executed
-            JOB_TIMEOUT:
-              type: string
-              default: "3"
-              description: Job timeout in hours
-            REPORT_DIR:
-              type: string
-              default: ""
-              description: Path for reports outside docker image
-            SKIP_LIST:
-              type: string
-              description: "Skip list for Rally test"
-              default: ""
+            VALIDATE_PARAMS:
+              type: text
+              default:  |
+                ---
+                  rally:
+                  # Name of availability zone
+                    AVAILABILITY_ZONE: 'nova'
+                  # External(floating) network name
+                    FLOATING_NETWORK: 'public'
+                  # Rally base image for glance
+                    RALLY_IMAGE: 'cirros'
+                  # Flavor name for Rally scenarios
+                    RALLY_FLAVOR: 'm1.tiny'
+                  # Git repository with configuration files for Rally
+                    RALLY_CONFIG_REPO: 'https://github.com/Mirantis/scale-scenarios'
+                  # Git branch which will be used during the checkout
+                    RALLY_CONFIG_BRANCH: 'master'
+                  # Git repository with Rally plugins
+                    RALLY_PLUGINS_REPO: 'https://github.com/Mirantis/rally-plugins'
+                  # Git branch which will be used during the checkout
+                    RALLY_PLUGINS_BRANCH: 'master'
+                  # Rally scenarios directory or file with scenarios
+                    RALLY_SCENARIOS: 'rally-scenarios-light'
+                  # Stacklight Rally scenarios directory or file with scenarios
+                    RALLY_SL_SCENARIOS: 'rally-stacklight'
+                  # Rally scenarios arguments file
+                    RALLY_TASK_ARGS_FILE: 'job-params-light.yaml'
+                  # Rally-compliant DB connection string for long-term results storing
+                    RALLY_DB_CONN_STRING: ''
+                  # List of tags for marking Rally tasks. Used as filter for Rally trends
+                    RALLY_TAGS:
+                    # - 'platform=openstack'
+                    # - 'env=your_env_name'
+                    # - 'cmp=2'
+                  # Generate rally trends report. Requires an external DB
+                    RALLY_TRENDS: 'false'
+                  # If chosen K8S Rally plugin will be used to test K8S cluster
+                    K8S_RALLY: 'false'
+                  # If chosen then Stacklight Rally test will be executed
+                    STACKLIGHT_RALLY: 'false'
+                  # Path for reports outside docker image
+                    REPORT_DIR: '/root/qa_results'
+                  # Scenarios names/dirs to skip
+                    SKIP_LIST: ''
+                  tempest:
+                  # Set of Tempest tests to run (smoke,full)
+                    TEMPEST_TEST_SET: 'smoke'
+                  # Git repository with configuration files for Tempest
+                    TEMPEST_CONFIG_REPO: ''
+                  # Git branch which will be used during the checkout
+                    TEMPEST_CONFIG_BRANCH: ''
+                  # description: Git repository with Tempest
+                    TEMPEST_REPO: ''
+                  #  description: Version of Tempest (tag, branch or commit)
+                    TEMPEST_VERSION: ''
+                  # If chosen, run HTML report will be generated
+                    GENERATE_REPORT: 'false'
+                  spt:
+                  # Name of availability zone
+                    AVAILABILITY_ZONE: 'nova'
+                  # External(floating) network name
+                    FLOATING_NETWORK: 'public'
+                  # Username that is used to ssh between cluster nodes
+                    SPT_SSH_USER: 'root'
+                  # Image that is used for network-VM-to-VM-iperf-tests tests
+                    SPT_IMAGE: ''
+                  # Username that is used to ssh to SPT_IMAGE
+                    SPT_IMAGE_USER: ''
+                  # Flavor name for SPT_IMAGE (make sure you have required flavor created)
+                    SPT_FLAVOR: ''
+                  # If chosen, run HTML report will be generated
+                    GENERATE_REPORT: 'false'
         cvp-sanity:
           type: workflow-scm
           name: cvp-sanity
diff --git a/keystone/client/core.yml b/keystone/client/core.yml
index 8c73b16..c965e6f 100644
--- a/keystone/client/core.yml
+++ b/keystone/client/core.yml
@@ -35,6 +35,7 @@
                   is_admin: true
                   password: ${_param:keystone_admin_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
         admin_identity:
           admin:
             user: admin
diff --git a/keystone/client/image_manager.yml b/keystone/client/image_manager.yml
index becd512..3f7c773 100644
--- a/keystone/client/image_manager.yml
+++ b/keystone/client/image_manager.yml
@@ -21,5 +21,6 @@
                   is_admin: false
                   password: ${_param:keystone_image_manager_password}
                   email: ${_param:keystone_image_manager_email}
+                  options: ${_param:openstack_service_user_options}
                   roles:
                   - image_manager
diff --git a/keystone/client/service/aodh.yml b/keystone/client/service/aodh.yml
index e7c8a0d..3d2dae0 100644
--- a/keystone/client/service/aodh.yml
+++ b/keystone/client/service/aodh.yml
@@ -15,6 +15,7 @@
                   is_admin: true
                   password: ${_param:keystone_aodh_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             aodh:
               type: alarming
diff --git a/keystone/client/service/barbican.yml b/keystone/client/service/barbican.yml
index 8c975ba..1a65afd 100644
--- a/keystone/client/service/barbican.yml
+++ b/keystone/client/service/barbican.yml
@@ -16,6 +16,7 @@
                 barbican:
                   password: ${_param:keystone_barbican_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
                   roles:
                   - admin
                   - creator
diff --git a/keystone/client/service/billometer.yml b/keystone/client/service/billometer.yml
index 5aa1f2e..14c570e 100644
--- a/keystone/client/service/billometer.yml
+++ b/keystone/client/service/billometer.yml
@@ -14,6 +14,7 @@
                   is_admin: true
                   password: ${_param:keystone_billometer_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             billometer:
               type: billing
diff --git a/keystone/client/service/ceilometer.yml b/keystone/client/service/ceilometer.yml
index e3bc485..131f3bb 100644
--- a/keystone/client/service/ceilometer.yml
+++ b/keystone/client/service/ceilometer.yml
@@ -16,6 +16,7 @@
                   is_admin: true
                   password: ${_param:keystone_ceilometer_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             ceilometer:
               type: metering
diff --git a/keystone/client/service/cinder.yml b/keystone/client/service/cinder.yml
index cf27875..ec0b2ca 100644
--- a/keystone/client/service/cinder.yml
+++ b/keystone/client/service/cinder.yml
@@ -14,3 +14,4 @@
                   is_admin: true
                   password: ${_param:keystone_cinder_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
diff --git a/keystone/client/service/cinder2.yml b/keystone/client/service/cinder2.yml
index 997651a..fd8cbfc 100644
--- a/keystone/client/service/cinder2.yml
+++ b/keystone/client/service/cinder2.yml
@@ -14,6 +14,7 @@
                   is_admin: true
                   password: ${_param:keystone_cinder_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             cinderv2:
               type: volumev2
diff --git a/keystone/client/service/cinder3.yml b/keystone/client/service/cinder3.yml
index 870c781..6280a7b 100644
--- a/keystone/client/service/cinder3.yml
+++ b/keystone/client/service/cinder3.yml
@@ -14,6 +14,7 @@
                   is_admin: true
                   password: ${_param:keystone_cinder_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             cinderv3:
               type: volumev3
diff --git a/keystone/client/service/congress.yml b/keystone/client/service/congress.yml
index 1e1141b..e0a6754 100644
--- a/keystone/client/service/congress.yml
+++ b/keystone/client/service/congress.yml
@@ -14,6 +14,7 @@
                   is_admin: true
                   password: ${_param:keystone_congress_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             congress:
               type: policy
diff --git a/keystone/client/service/contrail.yml b/keystone/client/service/contrail.yml
index ad2f6e2..6792156 100644
--- a/keystone/client/service/contrail.yml
+++ b/keystone/client/service/contrail.yml
@@ -14,6 +14,7 @@
                   is_admin: true
                   password: ${_param:opencontrail_admin_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             opencontrail:
               type: contrail
diff --git a/keystone/client/service/designate.yml b/keystone/client/service/designate.yml
index 83bb7ef..80f3761 100644
--- a/keystone/client/service/designate.yml
+++ b/keystone/client/service/designate.yml
@@ -14,6 +14,7 @@
                   is_admin: true
                   password: ${_param:keystone_designate_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             designate:
                 type: dns
diff --git a/keystone/client/service/glance.yml b/keystone/client/service/glance.yml
index 8c6f39d..69b5d8b 100644
--- a/keystone/client/service/glance.yml
+++ b/keystone/client/service/glance.yml
@@ -14,6 +14,7 @@
                   is_admin: true
                   password: ${_param:keystone_glance_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             glance:
               type: image
diff --git a/keystone/client/service/glare.yml b/keystone/client/service/glare.yml
index 24d827a..22d619f 100644
--- a/keystone/client/service/glare.yml
+++ b/keystone/client/service/glare.yml
@@ -12,6 +12,7 @@
                   is_admin: true
                   password: ${_param:keystone_glance_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             glare:
               type: artifact
diff --git a/keystone/client/service/gnocchi.yml b/keystone/client/service/gnocchi.yml
index 0b46f36..2336a8c 100644
--- a/keystone/client/service/gnocchi.yml
+++ b/keystone/client/service/gnocchi.yml
@@ -17,6 +17,7 @@
                   is_admin: true
                   password: ${_param:keystone_gnocchi_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             gnocchi:
               type: metric
diff --git a/keystone/client/service/heat.yml b/keystone/client/service/heat.yml
index e0bae14..9c17b06 100644
--- a/keystone/client/service/heat.yml
+++ b/keystone/client/service/heat.yml
@@ -17,6 +17,7 @@
                   is_admin: true
                   password: ${_param:keystone_heat_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             heat:
               type: orchestration
diff --git a/keystone/client/service/ironic.yml b/keystone/client/service/ironic.yml
index 1466039..e350284 100644
--- a/keystone/client/service/ironic.yml
+++ b/keystone/client/service/ironic.yml
@@ -15,6 +15,7 @@
                   is_admin: true
                   password: ${_param:keystone_ironic_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             ironic:
               type: baremetal
diff --git a/keystone/client/service/manila.yml b/keystone/client/service/manila.yml
index 358ed36..5cc66d2 100644
--- a/keystone/client/service/manila.yml
+++ b/keystone/client/service/manila.yml
@@ -14,6 +14,7 @@
                   is_admin: true
                   password: ${_param:keystone_manila_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             manila:
               type: share
diff --git a/keystone/client/service/manila2.yml b/keystone/client/service/manila2.yml
index 38f2672..8cccc24 100644
--- a/keystone/client/service/manila2.yml
+++ b/keystone/client/service/manila2.yml
@@ -14,6 +14,7 @@
                   is_admin: true
                   password: ${_param:keystone_manila_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             manilav2:
               type: sharev2
diff --git a/keystone/client/service/murano.yml b/keystone/client/service/murano.yml
index aa3cee3..1652ac2 100644
--- a/keystone/client/service/murano.yml
+++ b/keystone/client/service/murano.yml
@@ -12,6 +12,7 @@
                   is_admin: true
                   password: ${_param:keystone_murano_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             murano:
               type: application-catalog
diff --git a/keystone/client/service/neutron.yml b/keystone/client/service/neutron.yml
index 33434c1..59e4b33 100644
--- a/keystone/client/service/neutron.yml
+++ b/keystone/client/service/neutron.yml
@@ -14,6 +14,7 @@
                   is_admin: true
                   password: ${_param:keystone_neutron_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             neutron:
               type: network
diff --git a/keystone/client/service/nova.yml b/keystone/client/service/nova.yml
index 24a1dd5..22bbfc9 100644
--- a/keystone/client/service/nova.yml
+++ b/keystone/client/service/nova.yml
@@ -14,6 +14,7 @@
                   is_admin: true
                   password: ${_param:keystone_nova_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             nova:
               type: compute
diff --git a/keystone/client/service/nova21.yml b/keystone/client/service/nova21.yml
index 2335f5a..27a0580 100644
--- a/keystone/client/service/nova21.yml
+++ b/keystone/client/service/nova21.yml
@@ -14,6 +14,7 @@
                   is_admin: true
                   password: ${_param:keystone_nova_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             nova20:
               type: compute_legacy
diff --git a/keystone/client/service/octavia.yml b/keystone/client/service/octavia.yml
index a38d40e..c5ca83f 100644
--- a/keystone/client/service/octavia.yml
+++ b/keystone/client/service/octavia.yml
@@ -18,6 +18,7 @@
                   is_admin: true
                   password: ${_param:keystone_octavia_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             octavia:
               type: load-balancer
diff --git a/keystone/client/service/panko.yml b/keystone/client/service/panko.yml
index 7ad4397..43897be 100644
--- a/keystone/client/service/panko.yml
+++ b/keystone/client/service/panko.yml
@@ -15,6 +15,7 @@
                   is_admin: true
                   password: ${_param:keystone_panko_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             panko:
               type: event
diff --git a/keystone/client/service/radosgw-s3.yml b/keystone/client/service/radosgw-s3.yml
index b44d7eb..bcf596f 100644
--- a/keystone/client/service/radosgw-s3.yml
+++ b/keystone/client/service/radosgw-s3.yml
@@ -15,6 +15,7 @@
                   is_admin: true
                   password: ${_param:keystone_swift_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             radosgw-s3:
               type: s3
diff --git a/keystone/client/service/radosgw-swift.yml b/keystone/client/service/radosgw-swift.yml
index cd495ee..c8b6569 100644
--- a/keystone/client/service/radosgw-swift.yml
+++ b/keystone/client/service/radosgw-swift.yml
@@ -17,6 +17,7 @@
                   is_admin: true
                   password: ${_param:keystone_swift_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
             admin:
               user:
                 admin:
diff --git a/keystone/client/service/sahara.yml b/keystone/client/service/sahara.yml
index 526649a..8d88168 100644
--- a/keystone/client/service/sahara.yml
+++ b/keystone/client/service/sahara.yml
@@ -12,6 +12,7 @@
                   is_admin: true
                   password: ${_param:keystone_sahara_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             sahara:
               type: data-processing
diff --git a/keystone/client/service/swift-s3.yml b/keystone/client/service/swift-s3.yml
index d36d279..36050a4 100644
--- a/keystone/client/service/swift-s3.yml
+++ b/keystone/client/service/swift-s3.yml
@@ -12,6 +12,7 @@
                   is_admin: true
                   password: ${_param:keystone_swift_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             swift-s3:
               type: object-store
diff --git a/keystone/client/service/swift.yml b/keystone/client/service/swift.yml
index b599d97..ddcaf26 100644
--- a/keystone/client/service/swift.yml
+++ b/keystone/client/service/swift.yml
@@ -12,6 +12,7 @@
                   is_admin: true
                   password: ${_param:keystone_swift_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             swift:
               type: object-store
diff --git a/keystone/client/service/tacker.yml b/keystone/client/service/tacker.yml
index 28eef93..e1c7019 100644
--- a/keystone/client/service/tacker.yml
+++ b/keystone/client/service/tacker.yml
@@ -13,6 +13,7 @@
                   is_admin: true
                   password: ${_param:keystone_tacker_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
           service:
             tacker:
               type: nfv-orchestration
diff --git a/keystone/client/single.yml b/keystone/client/single.yml
index 74d3e5b..20b2b91 100644
--- a/keystone/client/single.yml
+++ b/keystone/client/single.yml
@@ -43,6 +43,7 @@
                   is_admin: true
                   password: ${_param:keystone_admin_password}
                   email: ${_param:admin_email}
+                  options: ${_param:openstack_service_user_options}
         admin_identity:
           admin:
             user: admin
diff --git a/keystone/client/v3/service/aodh.yml b/keystone/client/v3/service/aodh.yml
index eafd92a..a4f217c 100644
--- a/keystone/client/v3/service/aodh.yml
+++ b/keystone/client/v3/service/aodh.yml
@@ -11,6 +11,7 @@
             aodh:
               password: ${_param:keystone_aodh_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/barbican.yml b/keystone/client/v3/service/barbican.yml
index 93ce204..f008abc 100644
--- a/keystone/client/v3/service/barbican.yml
+++ b/keystone/client/v3/service/barbican.yml
@@ -16,6 +16,7 @@
             barbican:
               password: ${_param:keystone_barbican_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/billometer.yml b/keystone/client/v3/service/billometer.yml
index 0992519..9e115eb 100644
--- a/keystone/client/v3/service/billometer.yml
+++ b/keystone/client/v3/service/billometer.yml
@@ -5,10 +5,11 @@
     client:
       resources:
         v3:
-          user:
+          users:
             billometer:
               password: ${_param:keystone_billometer_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/ceilometer.yml b/keystone/client/v3/service/ceilometer.yml
index 727171e..9129773 100644
--- a/keystone/client/v3/service/ceilometer.yml
+++ b/keystone/client/v3/service/ceilometer.yml
@@ -10,6 +10,7 @@
             ceilometer:
               password: ${_param:keystone_ceilometer_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/cinder.yml b/keystone/client/v3/service/cinder.yml
index 4f6c76c..1dd279a 100644
--- a/keystone/client/v3/service/cinder.yml
+++ b/keystone/client/v3/service/cinder.yml
@@ -9,6 +9,7 @@
             cinder:
               password: ${_param:keystone_cinder_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/cinder2.yml b/keystone/client/v3/service/cinder2.yml
index 886edee..4d49d2b 100644
--- a/keystone/client/v3/service/cinder2.yml
+++ b/keystone/client/v3/service/cinder2.yml
@@ -9,6 +9,7 @@
             cinder:
               password: ${_param:keystone_cinder_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/cinder3.yml b/keystone/client/v3/service/cinder3.yml
index 9682186..a4465ac 100644
--- a/keystone/client/v3/service/cinder3.yml
+++ b/keystone/client/v3/service/cinder3.yml
@@ -9,6 +9,7 @@
             cinder:
               password: ${_param:keystone_cinder_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/congress.yml b/keystone/client/v3/service/congress.yml
index 15cce34..0d34181 100644
--- a/keystone/client/v3/service/congress.yml
+++ b/keystone/client/v3/service/congress.yml
@@ -9,6 +9,7 @@
             congress:
               password: ${_param:keystone_congress_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                     name: admin
diff --git a/keystone/client/v3/service/contrail.yml b/keystone/client/v3/service/contrail.yml
index e6277d5..930804a 100644
--- a/keystone/client/v3/service/contrail.yml
+++ b/keystone/client/v3/service/contrail.yml
@@ -20,6 +20,7 @@
             contrail:
               password: ${_param:opencontrail_admin_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               is_admin: true
               roles:
                 admin:
diff --git a/keystone/client/v3/service/designate.yml b/keystone/client/v3/service/designate.yml
index 821f2cb..271ea22 100644
--- a/keystone/client/v3/service/designate.yml
+++ b/keystone/client/v3/service/designate.yml
@@ -9,6 +9,7 @@
             designate:
               password: ${_param:keystone_designate_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/glance.yml b/keystone/client/v3/service/glance.yml
index a690a73..0e01709 100644
--- a/keystone/client/v3/service/glance.yml
+++ b/keystone/client/v3/service/glance.yml
@@ -9,6 +9,7 @@
             glance:
               password: ${_param:keystone_glance_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/gnocchi.yml b/keystone/client/v3/service/gnocchi.yml
index 6a11023..63241db 100644
--- a/keystone/client/v3/service/gnocchi.yml
+++ b/keystone/client/v3/service/gnocchi.yml
@@ -10,6 +10,7 @@
             gnocchi:
               password: ${_param:keystone_gnocchi_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/heat.yml b/keystone/client/v3/service/heat.yml
index a1b248f..54c8f0b 100644
--- a/keystone/client/v3/service/heat.yml
+++ b/keystone/client/v3/service/heat.yml
@@ -16,6 +16,7 @@
             heat:
               password: ${_param:keystone_heat_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/ironic.yml b/keystone/client/v3/service/ironic.yml
index 216049c..bd2795b 100644
--- a/keystone/client/v3/service/ironic.yml
+++ b/keystone/client/v3/service/ironic.yml
@@ -10,6 +10,7 @@
             ironic:
               password: ${_param:keystone_ironic_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/keystone.yml b/keystone/client/v3/service/keystone.yml
index ab3b29c..6c005c7 100644
--- a/keystone/client/v3/service/keystone.yml
+++ b/keystone/client/v3/service/keystone.yml
@@ -24,6 +24,7 @@
             admin:
               password: ${_param:keystone_admin_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/manila.yml b/keystone/client/v3/service/manila.yml
index 9030c98..bb90159 100644
--- a/keystone/client/v3/service/manila.yml
+++ b/keystone/client/v3/service/manila.yml
@@ -9,6 +9,7 @@
             manila:
               password: ${_param:keystone_manila_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/manila2.yml b/keystone/client/v3/service/manila2.yml
index 06aa44e..f5771ad 100644
--- a/keystone/client/v3/service/manila2.yml
+++ b/keystone/client/v3/service/manila2.yml
@@ -9,6 +9,7 @@
             manila:
               password: ${_param:keystone_manila_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/neutron.yml b/keystone/client/v3/service/neutron.yml
index 2c1df47..6af16f9 100644
--- a/keystone/client/v3/service/neutron.yml
+++ b/keystone/client/v3/service/neutron.yml
@@ -9,6 +9,7 @@
             neutron:
               password: ${_param:keystone_neutron_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/nova.yml b/keystone/client/v3/service/nova.yml
index d2f76f6..d0c7366 100644
--- a/keystone/client/v3/service/nova.yml
+++ b/keystone/client/v3/service/nova.yml
@@ -9,6 +9,7 @@
             nova:
               password: ${_param:keystone_nova_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/nova21.yml b/keystone/client/v3/service/nova21.yml
index 5bccedf..85bd29f 100644
--- a/keystone/client/v3/service/nova21.yml
+++ b/keystone/client/v3/service/nova21.yml
@@ -9,6 +9,7 @@
             nova:
               password: ${_param:keystone_nova_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/octavia.yml b/keystone/client/v3/service/octavia.yml
index 26940ff..54c8bc9 100644
--- a/keystone/client/v3/service/octavia.yml
+++ b/keystone/client/v3/service/octavia.yml
@@ -26,6 +26,7 @@
             octavia:
               password: ${_param:keystone_octavia_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/panko.yml b/keystone/client/v3/service/panko.yml
index 5f4c70b..226f601 100644
--- a/keystone/client/v3/service/panko.yml
+++ b/keystone/client/v3/service/panko.yml
@@ -10,6 +10,7 @@
             panko:
               password: ${_param:keystone_panko_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/radosgw-s3.yml b/keystone/client/v3/service/radosgw-s3.yml
index 7c03f4a..1a7ae3c 100644
--- a/keystone/client/v3/service/radosgw-s3.yml
+++ b/keystone/client/v3/service/radosgw-s3.yml
@@ -4,12 +4,13 @@
     radosgw_service_protocol: http
   keystone:
     client:
-      resource:
+      resources:
         v3:
           users:
             swift:
               password: ${_param:keystone_swift_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/radosgw-swift.yml b/keystone/client/v3/service/radosgw-swift.yml
index d1acce3..2e78bb9 100644
--- a/keystone/client/v3/service/radosgw-swift.yml
+++ b/keystone/client/v3/service/radosgw-swift.yml
@@ -14,6 +14,7 @@
             swift:
               password: ${_param:keystone_swift_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/keystone/client/v3/service/tacker.yml b/keystone/client/v3/service/tacker.yml
index 8a01280..bddca05 100644
--- a/keystone/client/v3/service/tacker.yml
+++ b/keystone/client/v3/service/tacker.yml
@@ -10,6 +10,7 @@
             tacker:
               password: ${_param:keystone_tacker_password}
               email: ${_param:admin_email}
+              options: ${_param:openstack_service_user_options}
               roles:
                 service_admin:
                   name: admin
diff --git a/prometheus/elasticsearch_exporter/container.yml b/prometheus/elasticsearch_exporter/container.yml
new file mode 100644
index 0000000..9f78f4a
--- /dev/null
+++ b/prometheus/elasticsearch_exporter/container.yml
@@ -0,0 +1,2 @@
+classes:
+- service.prometheus.elasticsearch_exporter.container
diff --git a/prometheus/server/target/dns/elasticsearch_exporter.yml b/prometheus/server/target/dns/elasticsearch_exporter.yml
new file mode 100644
index 0000000..3c331fd
--- /dev/null
+++ b/prometheus/server/target/dns/elasticsearch_exporter.yml
@@ -0,0 +1,12 @@
+parameters:
+  prometheus:
+    server:
+      target:
+        dns:
+          enabled: true
+          endpoint:
+            - name: 'elasticsearch_exporter'
+              domain:
+              - 'tasks.monitoring_elasticsearch_exporter'
+              type: A
+              port: 9206
diff --git a/prometheus/server/target/dns/init.yml b/prometheus/server/target/dns/init.yml
index 361d296..7363be1 100644
--- a/prometheus/server/target/dns/init.yml
+++ b/prometheus/server/target/dns/init.yml
@@ -1,5 +1,6 @@
 classes:
 - system.prometheus.server.target.dns.alertmanager
+- system.prometheus.server.target.dns.elasticsearch_exporter
 - system.prometheus.server.target.dns.prometheus
 - system.prometheus.server.target.dns.pushgateway
 - system.prometheus.server.target.dns.remote_agent