diff --git a/apache/server/site/manila.yml b/apache/server/site/manila.yml
index cecf1d4..3080d1d 100644
--- a/apache/server/site/manila.yml
+++ b/apache/server/site/manila.yml
@@ -12,6 +12,8 @@
     server:
       enabled: true
       default_mpm: event
+      modules:
+        - wsgi
       site:
         manila:
           enabled: false
diff --git a/cinder/control/cluster.yml b/cinder/control/cluster.yml
index 5bc5c75..503537e 100644
--- a/cinder/control/cluster.yml
+++ b/cinder/control/cluster.yml
@@ -4,11 +4,14 @@
 - service.keepalived.cluster.single
 - system.haproxy.proxy.listen.openstack.cinder
 - system.salt.minion.cert.mysql.clients.openstack.cinder
+- system.salt.minion.cert.rabbitmq.clients.openstack.cinder
 parameters:
   _param:
     cluster_internal_protocol: 'http'
     openstack_mysql_x509_enabled: False
     galera_ssl_enabled: False
+    openstack_rabbitmq_x509_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -67,6 +70,13 @@
         user: openstack
         password: ${_param:rabbitmq_openstack_password}
         virtual_host: '/openstack'
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_cinder_ssl_ca_file}
+          key_file: ${_param:rabbitmq_cinder_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_cinder_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
       cache:
         engine: memcached
         members:
diff --git a/cinder/control/single.yml b/cinder/control/single.yml
index f38cfb4..ce01579 100644
--- a/cinder/control/single.yml
+++ b/cinder/control/single.yml
@@ -1,11 +1,14 @@
 classes:
 - service.cinder.control.single
 - system.salt.minion.cert.mysql.clients.openstack.cinder
+- system.salt.minion.cert.rabbitmq.clients.openstack.cinder
 parameters:
   _param:
     internal_protocol: 'http'
     openstack_mysql_x509_enabled: False
     galera_ssl_enabled: False
+    openstack_rabbitmq_x509_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -31,4 +34,12 @@
       identity:
         protocol: ${_param:internal_protocol}
         region: ${_param:openstack_region}
+      message_queue:
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_cinder_ssl_ca_file}
+          key_file: ${_param:rabbitmq_cinder_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_cinder_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
 
diff --git a/cinder/volume/local.yml b/cinder/volume/local.yml
index 51c3ba8..d1634d0 100644
--- a/cinder/volume/local.yml
+++ b/cinder/volume/local.yml
@@ -1,10 +1,13 @@
 classes:
 - service.cinder.volume.local
 - system.salt.minion.cert.mysql.clients.openstack.cinder
+- system.salt.minion.cert.rabbitmq.clients.openstack.cinder
 parameters:
   _param:
     openstack_mysql_x509_enabled: False
     galera_ssl_enabled: False
+    openstack_rabbitmq_x509_enabled: False
+    rabbitmq_ssl_enabled: False
   cinder:
     volume:
       enabled: True
@@ -21,6 +24,13 @@
         host: ${_param:single_address}
       message_queue:
         host: ${_param:single_address}
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_cinder_ssl_ca_file}
+          key_file: ${_param:rabbitmq_cinder_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_cinder_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
       identity:
         host: ${_param:single_address}
         region: ${_param:openstack_region}
diff --git a/cinder/volume/single.yml b/cinder/volume/single.yml
index f6d4503..637e45a 100644
--- a/cinder/volume/single.yml
+++ b/cinder/volume/single.yml
@@ -1,11 +1,14 @@
 classes:
 - service.cinder.volume.single
 - system.salt.minion.cert.mysql.clients.openstack.cinder
+- system.salt.minion.cert.rabbitmq.clients.openstack.cinder
 parameters:
   _param:
     cluster_internal_protocol: 'http'
     openstack_mysql_x509_enabled: False
     galera_ssl_enabled: False
+    openstack_rabbitmq_x509_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -32,6 +35,13 @@
           - host: ${_param:openstack_message_queue_node01_address}
           - host: ${_param:openstack_message_queue_node02_address}
           - host: ${_param:openstack_message_queue_node03_address}
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_cinder_ssl_ca_file}
+          key_file: ${_param:rabbitmq_cinder_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_cinder_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
       identity:
         host: ${_param:openstack_control_address}
         protocol: ${_param:cluster_internal_protocol}
diff --git a/designate/server/cluster/default.yml b/designate/server/cluster/default.yml
index de2eb43..112d953 100644
--- a/designate/server/cluster/default.yml
+++ b/designate/server/cluster/default.yml
@@ -3,10 +3,13 @@
 - service.haproxy.proxy.single
 - system.haproxy.proxy.listen.openstack.designate
 - service.designate.server.cluster
+- system.salt.minion.cert.mysql.clients.openstack.designate
 parameters:
   _param:
     designate_admin_api_enabled: false
     cluster_internal_protocol: 'http'
+    openstack_mysql_x509_enabled: False
+    galera_ssl_enabled: False
   linux:
     system:
       package:
@@ -36,6 +39,13 @@
           pool_manager: designate_pool_manager
         user: designate
         password: ${_param:mysql_designate_password}
+        x509:
+          enabled: ${_param:openstack_mysql_x509_enabled}
+          ca_file: ${_param:mysql_designate_ssl_ca_file}
+          key_file: ${_param:mysql_designate_client_ssl_key_file}
+          cert_file: ${_param:mysql_designate_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:galera_ssl_enabled}
       identity:
         engine: keystone
         host: ${_param:openstack_control_address}
@@ -56,4 +66,4 @@
         - host: ${_param:openstack_message_queue_node03_address}
         user: openstack
         password: ${_param:rabbitmq_openstack_password}
-        virtual_host: '/openstack'
\ No newline at end of file
+        virtual_host: '/openstack'
diff --git a/glance/control/cluster.yml b/glance/control/cluster.yml
index a9181de..4f0992d 100644
--- a/glance/control/cluster.yml
+++ b/glance/control/cluster.yml
@@ -4,10 +4,13 @@
 - service.haproxy.proxy.single
 - system.haproxy.proxy.listen.openstack.glance
 - system.salt.minion.cert.mysql.clients.openstack.glance
+- system.salt.minion.cert.rabbitmq.clients.openstack.glance
 parameters:
   _param:
     openstack_mysql_x509_enabled: False
     galera_ssl_enabled: False
+    openstack_rabbitmq_x509_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       cron:
@@ -62,6 +65,13 @@
           - host: ${_param:openstack_message_queue_node01_address}
           - host: ${_param:openstack_message_queue_node02_address}
           - host: ${_param:openstack_message_queue_node03_address}
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_glance_ssl_ca_file}
+          key_file: ${_param:rabbitmq_glance_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_glance_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
       storage:
         engine: file
       images: []
diff --git a/glance/control/single.yml b/glance/control/single.yml
index a036077..c233120 100644
--- a/glance/control/single.yml
+++ b/glance/control/single.yml
@@ -1,10 +1,13 @@
 classes:
 - service.glance.control.single
 - system.salt.minion.cert.mysql.clients.openstack.glance
+- system.salt.minion.cert.rabbitmq.clients.openstack.glance
 parameters:
   _param:
     openstack_mysql_x509_enabled: False
     galera_ssl_enabled: False
+    openstack_rabbitmq_x509_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       cron:
@@ -30,3 +33,11 @@
       identity:
         region: ${_param:openstack_region}
       show_multiple_locations: True
+      message_queue:
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_glance_ssl_ca_file}
+          key_file: ${_param:rabbitmq_glance_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_glance_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
diff --git a/heat/server/cluster.yml b/heat/server/cluster.yml
index 7bbc2ac..4504e89 100644
--- a/heat/server/cluster.yml
+++ b/heat/server/cluster.yml
@@ -4,12 +4,15 @@
 - service.keepalived.cluster.single
 - system.haproxy.proxy.listen.openstack.heat
 - system.salt.minion.cert.mysql.clients.openstack.heat
+- system.salt.minion.cert.rabbitmq.clients.openstack.heat
 parameters:
   _param:
     cluster_public_protocol: 'https'
     cluster_internal_protocol: 'http'
     openstack_mysql_x509_enabled: False
+    openstack_rabbitmq_x509_enabled: False
     galera_ssl_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -77,3 +80,10 @@
           - host: ${_param:openstack_message_queue_node01_address}
           - host: ${_param:openstack_message_queue_node02_address}
           - host: ${_param:openstack_message_queue_node03_address}
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_heat_ssl_ca_file}
+          key_file: ${_param:rabbitmq_heat_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_heat_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
diff --git a/heat/server/single.yml b/heat/server/single.yml
index 208bdf0..9ef10c9 100644
--- a/heat/server/single.yml
+++ b/heat/server/single.yml
@@ -1,10 +1,13 @@
 classes:
 - service.heat.server.single
 - system.salt.minion.cert.mysql.clients.openstack.heat
+- system.salt.minion.cert.rabbitmq.clients.openstack.heat
 parameters:
   _param:
     openstack_mysql_x509_enabled: False
+    openstack_rabbitmq_x509_enabled: False
     galera_ssl_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -32,4 +35,13 @@
           key_file: ${_param:mysql_heat_client_ssl_key_file}
           cert_file: ${_param:mysql_heat_client_ssl_cert_file}
         ssl:
-          enabled: ${_param:galera_ssl_enabled}
\ No newline at end of file
+          enabled: ${_param:galera_ssl_enabled}
+      message_queue:
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_heat_ssl_ca_file}
+          key_file: ${_param:rabbitmq_heat_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_heat_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
+
diff --git a/jenkins/client/job/git-mirrors/upstream/pipelines.yml b/jenkins/client/job/git-mirrors/upstream/pipelines.yml
index 20f7eb6..9e82f80 100644
--- a/jenkins/client/job/git-mirrors/upstream/pipelines.yml
+++ b/jenkins/client/job/git-mirrors/upstream/pipelines.yml
@@ -6,8 +6,8 @@
       - name: pipeline-library
         downstream: mcp-ci/pipeline-library
         upstream: "git@github.com:Mirantis/pipeline-library.git"
-        branches: master
+        branches: master,release/2018.8.1
       - name: mk-pipelines
         downstream: mk/mk-pipelines
         upstream: "git@github.com:Mirantis/mk-pipelines.git"
-        branches: master
+        branches: master,release/2018.8.1
diff --git a/jenkins/client/job/oscore/test_upgrades.yml b/jenkins/client/job/oscore/test_upgrades.yml
index 26a9960..a3cf5ae 100644
--- a/jenkins/client/job/oscore/test_upgrades.yml
+++ b/jenkins/client/job/oscore/test_upgrades.yml
@@ -24,6 +24,16 @@
                 type: string
                 description: "ID of jenkins credentials to be used when connecting to gerrit."
                 default: "gerrit"
+              OPENSTACK_ENVIRONMENT:
+                type: choice
+                description: "Target openstack environment."
+                choices:
+                  - devcloud
+                  - presales
+                  - oscore_devcloud
+              OPENSTACK_API_CREDENTIALS:
+                type: string
+                description: "Credentials to the OpenStack API"
               OPENSTACK_API_PROJECT:
                 type: string
                 default: "mcp-oscore"
diff --git a/keystone/server/cluster.yml b/keystone/server/cluster.yml
index 24840fe..1a5f4a3 100644
--- a/keystone/server/cluster.yml
+++ b/keystone/server/cluster.yml
@@ -6,12 +6,15 @@
 - system.linux.system.users.keystone
 - system.keystone.server.fernet_rotation.cluster
 - system.salt.minion.cert.mysql.clients.openstack.keystone
+- system.salt.minion.cert.rabbitmq.clients.openstack.keystone
 parameters:
   _param:
     keystone_tokens_expiration: 3600
     openstack_node_role: primary
     openstack_mysql_x509_enabled: False
+    openstack_rabbitmq_x509_enabled: False
     galera_ssl_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -69,6 +72,13 @@
         password: ${_param:rabbitmq_openstack_password}
         virtual_host: '/openstack'
         ha_queues: true
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_keystone_ssl_ca_file}
+          key_file: ${_param:rabbitmq_keystone_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_keystone_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
       auth_methods:
       - password
       - token
diff --git a/keystone/server/single.yml b/keystone/server/single.yml
index d926c0d..03cd75d 100644
--- a/keystone/server/single.yml
+++ b/keystone/server/single.yml
@@ -3,6 +3,7 @@
 - system.linux.system.users.keystone
 - system.keystone.server.fernet_rotation.single
 - system.salt.minion.cert.mysql.clients.openstack.keystone
+- system.salt.minion.cert.rabbitmq.clients.openstack.keystone
 parameters:
   _param:
     keystone_service_token: token
@@ -13,7 +14,9 @@
     keystone_tokens_expiration: 3600
     openstack_node_role: primary
     openstack_mysql_x509_enabled: False
+    openstack_rabbitmq_x509_enabled: False
     galera_ssl_enabled: False
+    rabbitmq_ssl_enabled: False
   linux:
     system:
       package:
@@ -65,6 +68,13 @@
         password: ${_param:rabbitmq_openstack_password}
         virtual_host: '/openstack'
         ha_queues: true
+        x509:
+          enabled: ${_param:openstack_rabbitmq_x509_enabled}
+          ca_file: ${_param:rabbitmq_keystone_ssl_ca_file}
+          key_file: ${_param:rabbitmq_keystone_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_keystone_client_ssl_cert_file}
+        ssl:
+          enabled: ${_param:rabbitmq_ssl_enabled}
       roles:
         - admin
         - Member
diff --git a/manila/share/backend/lvm.yml b/manila/share/backend/lvm.yml
index fe709da..9f5c660 100644
--- a/manila/share/backend/lvm.yml
+++ b/manila/share/backend/lvm.yml
@@ -1,12 +1,13 @@
 parameters:
   _param:
     manila_share_address: ${_param:single_address}
+    manila_lvm_volume_name: manila-volume
   linux:
     storage:
       lvm:
         manila-vg:
           enabled: true
-          name: manila-volume
+          name: ${_param:manila_lvm_volume_name}
           devices: ${_param:manila_lvm_devices}
     system:
       package:
@@ -25,4 +26,4 @@
             - "${_param:manila_share_address}"
           dhss: false
           share_driver: manila.share.drivers.lvm.LVMShareDriver
-          lvm_share_volume_group: manila-volume
+          lvm_share_volume_group: ${_param:manila_lvm_volume_name}
diff --git a/salt/minion/cert/rabbitmq/clients/openstack/cinder.yml b/salt/minion/cert/rabbitmq/clients/openstack/cinder.yml
new file mode 100644
index 0000000..576c135
--- /dev/null
+++ b/salt/minion/cert/rabbitmq/clients/openstack/cinder.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    rabbitmq_cinder_client_ssl_key_file: /etc/cinder/ssl/rabbitmq/client-key.pem
+    rabbitmq_cinder_client_ssl_cert_file: /etc/cinder/ssl/rabbitmq/client-cert.pem
+    rabbitmq_cinder_ssl_ca_file: /etc/cinder/ssl/rabbitmq/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        rabbitmq-cinder-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: rabbitmq-cinder-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:rabbitmq_cinder_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_cinder_client_ssl_cert_file}
+          ca_file: ${_param:rabbitmq_cinder_ssl_ca_file}
+          user: cinder
+          group: cinder
+          mode: 640
diff --git a/salt/minion/cert/rabbitmq/clients/openstack/glance.yml b/salt/minion/cert/rabbitmq/clients/openstack/glance.yml
new file mode 100644
index 0000000..94749ae
--- /dev/null
+++ b/salt/minion/cert/rabbitmq/clients/openstack/glance.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    rabbitmq_glance_client_ssl_key_file: /etc/glance/ssl/rabbitmq/client-key.pem
+    rabbitmq_glance_client_ssl_cert_file: /etc/glance/ssl/rabbitmq/client-cert.pem
+    rabbitmq_glance_ssl_ca_file: /etc/glance/ssl/rabbitmq/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        rabbitmq-glance-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: rabbitmq-glance-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:rabbitmq_glance_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_glance_client_ssl_cert_file}
+          ca_file: ${_param:rabbitmq_glance_ssl_ca_file}
+          user: glance
+          group: glance
+          mode: 640
diff --git a/salt/minion/cert/rabbitmq/clients/openstack/heat.yml b/salt/minion/cert/rabbitmq/clients/openstack/heat.yml
new file mode 100644
index 0000000..e69ab14
--- /dev/null
+++ b/salt/minion/cert/rabbitmq/clients/openstack/heat.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    rabbitmq_heat_client_ssl_key_file: /etc/heat/ssl/rabbitmq/client-key.pem
+    rabbitmq_heat_client_ssl_cert_file: /etc/heat/ssl/rabbitmq/client-cert.pem
+    rabbitmq_heat_ssl_ca_file: /etc/heat/ssl/rabbitmq/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        rabbitmq-heat-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: rabbitmq-heat-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:rabbitmq_heat_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_heat_client_ssl_cert_file}
+          ca_file: ${_param:rabbitmq_heat_ssl_ca_file}
+          user: heat
+          group: heat
+          mode: 640
diff --git a/salt/minion/cert/rabbitmq/clients/openstack/keystone.yml b/salt/minion/cert/rabbitmq/clients/openstack/keystone.yml
new file mode 100644
index 0000000..8261f73
--- /dev/null
+++ b/salt/minion/cert/rabbitmq/clients/openstack/keystone.yml
@@ -0,0 +1,27 @@
+parameters:
+  _param:
+    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_authority: salt_master_ca
+    rabbitmq_keystone_client_ssl_key_file: /etc/keystone/ssl/rabbitmq/client-key.pem
+    rabbitmq_keystone_client_ssl_cert_file: /etc/keystone/ssl/rabbitmq/client-cert.pem
+    rabbitmq_keystone_ssl_ca_file: /etc/keystone/ssl/rabbitmq/ca-cert.pem
+  salt:
+    minion:
+      cert:
+        rabbitmq-keystone-client:
+          host: ${_param:salt_minion_ca_host}
+          authority: ${_param:salt_minion_ca_authority}
+          common_name: rabbitmq-keystone-client
+          signing_policy: cert_client
+          alternative_names: >
+            IP:${_param:cluster_local_address},
+            DNS:${_param:cluster_local_address},
+            DNS:${linux:system:name},
+            DNS:${linux:network:fqdn}
+          key_usage: "digitalSignature,nonRepudiation,keyEncipherment"
+          key_file: ${_param:rabbitmq_keystone_client_ssl_key_file}
+          cert_file: ${_param:rabbitmq_keystone_client_ssl_cert_file}
+          ca_file: ${_param:rabbitmq_keystone_ssl_ca_file}
+          user: keystone
+          group: keystone
+          mode: 640