diff --git a/docker/swarm/stack/jenkins/slave.yml b/docker/swarm/stack/jenkins/slave.yml
index 42a0031..e6ed298 100644
--- a/docker/swarm/stack/jenkins/slave.yml
+++ b/docker/swarm/stack/jenkins/slave.yml
@@ -35,7 +35,7 @@
               image: ${_param:docker_image_jenkins_slave}
               volumes:
                 - /etc/ssl/certs/java/cacerts:/etc/ssl/certs/java/cacerts:ro
-                - /etc/aptly-publisher.yaml:/etc/aptly-publisher.yaml:ro
+                - /etc/aptly:/etc/aptly:ro
                 - /var/run/docker.sock:/var/run/docker.sock
                 - /usr/bin/docker:/usr/bin/docker:ro
                 - /var/lib/jenkins:/var/lib/jenkins
@@ -59,7 +59,7 @@
               image: ${_param:docker_image_jenkins_slave}
               volumes:
                 - /etc/ssl/certs/java/cacerts:/etc/ssl/certs/java/cacerts:ro
-                - /etc/aptly-publisher.yaml:/etc/aptly-publisher.yaml:ro
+                - /etc/aptly:/etc/aptly:ro
                 - /var/run/docker.sock:/var/run/docker.sock
                 - /usr/bin/docker:/usr/bin/docker:ro
                 - /var/lib/jenkins:/var/lib/jenkins
@@ -83,7 +83,7 @@
               image: ${_param:docker_image_jenkins_slave}
               volumes:
                 - /etc/ssl/certs/java/cacerts:/etc/ssl/certs/java/cacerts:ro
-                - /etc/aptly-publisher.yaml:/etc/aptly-publisher.yaml:ro
+                - /etc/aptly:/etc/aptly:ro
                 - /var/run/docker.sock:/var/run/docker.sock
                 - /usr/bin/docker:/usr/bin/docker:ro
                 - /var/lib/jenkins:/var/lib/jenkins
diff --git a/gerrit/client/init.yml b/gerrit/client/init.yml
index 5d719d4..16e4231 100644
--- a/gerrit/client/init.yml
+++ b/gerrit/client/init.yml
@@ -3,6 +3,7 @@
 parameters:
   _param:
     gerrit_try_login: true
+    gerrit_server_host: ${_param:cluster_vip_address}
   gerrit:
     client:
       enabled: True
@@ -12,7 +13,7 @@
         gerrit_config: /srv/volumes/gerrit/etc/gerrit.config
         gerrit_secure_config: /srv/volumes/gerrit/etc/secure.config
       server:
-        host: ${_param:cluster_vip_address}
+        host: ${_param:gerrit_server_host}
         user: admin
         email: ${_param:gerrit_admin_email}
         auth_method: basic
diff --git a/jenkins/client/approved_scripts.yml b/jenkins/client/approved_scripts.yml
index 1fb68c9..2b2c6a7 100644
--- a/jenkins/client/approved_scripts.yml
+++ b/jenkins/client/approved_scripts.yml
@@ -151,3 +151,8 @@
         - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.Collection java.lang.String
         - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods init java.util.List
         - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods asBoolean java.lang.CharSequence
+        - staticMethod hudson.model.Hudson getInstance
+        - method hudson.model.Job getProperty java.lang.Class
+        - method hudson.model.ParametersDefinitionProperty getParameterDefinitions
+        - method hudson.model.ParameterDefinition getName
+        - hudson.model.StringParameterDefinition getDefaultValue
diff --git a/jenkins/client/init.yml b/jenkins/client/init.yml
index c1d600c..80724b1 100644
--- a/jenkins/client/init.yml
+++ b/jenkins/client/init.yml
@@ -10,8 +10,12 @@
     jenkins_master_port: 8081
     jenkins_aptly_storages: "local"
     jenkins_pipelines_branch: "master"
+    jenkins_offline_deployment: "false"
   jenkins:
     client:
+      globalenvprop:
+        OFFLINE_DEPLOYMENT:
+          value: ${_param:jenkins_offline_deployment}
       master:
         host: ${_param:jenkins_master_host}
         port: ${_param:jenkins_master_port}
@@ -63,6 +67,7 @@
           enabled: true
           url: ${_param:jenkins_gerrit_url}/mcp-ci/pipeline-library
           credential_id: gerrit
+          branch: ${_param:jenkins_pipelines_branch}
       view:
         Mirrors:
           enabled: true
diff --git a/jenkins/client/job/debian/packages/salt.yml b/jenkins/client/job/debian/packages/salt.yml
index 3f6b0f0..7a9dd04 100644
--- a/jenkins/client/job/debian/packages/salt.yml
+++ b/jenkins/client/job/debian/packages/salt.yml
@@ -753,6 +753,10 @@
               upload_source_package: true
               upload_to_aptly: true
               dist: xenial
+            - name: openscap
+              upload_source_package: true
+              upload_to_aptly: true
+              dist: xenial
             - name: openssh
               upload_source_package: true
               upload_to_aptly: true
diff --git a/jenkins/client/job/deploy/update/upgrade_mcp_release.yml b/jenkins/client/job/deploy/update/upgrade_mcp_release.yml
index 8587140..9f18006 100644
--- a/jenkins/client/job/deploy/update/upgrade_mcp_release.yml
+++ b/jenkins/client/job/deploy/update/upgrade_mcp_release.yml
@@ -10,7 +10,7 @@
         upgrade-mcp-release:
           type: workflow-scm
           concurrent: true
-          display_name: "Deploy - upgrade MCP Release"
+          display_name: "Deploy - upgrade MCP Drivetrain"
           scm:
             type: git
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
@@ -27,7 +27,15 @@
             MCP_VERSION:
               type: string
               default: ""
+            UPDATE_CLUSTER_MODEL:
+              type: boolean
+              default: 'false'
+              description: "Replace `apt_mk_version` parameter in cluster level Reclass model."
+            UPDATE_PIPELINES:
+              type: boolean
+              default: 'false'
+              description: "Mirror pipelines from upstream/local mirror to Gerrit."
             UPDATE_LOCAL_REPOS:
               type: boolean
               default: 'false'
-              description: "Use only when local repositories are present"
\ No newline at end of file
+              description: "Use only when local repositories are present."
\ No newline at end of file
diff --git a/jenkins/client/job/oscore/cookiecutter.yml b/jenkins/client/job/oscore/cookiecutter.yml
index 04a805a..f38609a 100644
--- a/jenkins/client/job/oscore/cookiecutter.yml
+++ b/jenkins/client/job/oscore/cookiecutter.yml
@@ -28,6 +28,7 @@
               type: choice
               description: "Context for coockiecutter template specified as filename."
               choices:
+                - openstack-ovs-core-ocata
                 - openstack-ovs-core-pike
                 - openstack-ovs-core-ssl-pike
                 - openstack-ovs-core-barbican-pike
diff --git a/jenkins/client/job/salt-formulas/tests.yml b/jenkins/client/job/salt-formulas/tests.yml
index 37f0543..1c9f4fb 100644
--- a/jenkins/client/job/salt-formulas/tests.yml
+++ b/jenkins/client/job/salt-formulas/tests.yml
@@ -92,6 +92,7 @@
             - name: octavia
             - name: opencontrail
             - name: openldap
+            - name: openscap
             - name: openssh
             - name: openvpn
             - name: openvstorage
diff --git a/keepalived/cluster/instance/kube_api_server_vip.yml b/keepalived/cluster/instance/kube_api_server_vip.yml
index 7e03d25..f7fbce8 100644
--- a/keepalived/cluster/instance/kube_api_server_vip.yml
+++ b/keepalived/cluster/instance/kube_api_server_vip.yml
@@ -6,6 +6,9 @@
   _param:
     keepalived_vip_priority: 101
     keepalived_kube_apiserver_vrrp_script_content: "pidof haproxy && systemctl status kube-apiserver.service --quiet --no-pager"
+    keepalived_k8s_apiserver_vip_interface: ens3
+    keepalived_k8s_apiserver_vip_address: ${_param:kubernetes_control_address}
+    keepalived_k8s_apiserver_vip_password: password
   keepalived:
     cluster:
       vrrp_scripts:
diff --git a/kubernetes/master/auth/rbac.yml b/kubernetes/master/auth/rbac.yml
new file mode 100644
index 0000000..be0577b
--- /dev/null
+++ b/kubernetes/master/auth/rbac.yml
@@ -0,0 +1,5 @@
+parameters:
+  kubernetes:
+    master:
+      auth:
+        mode: Node,RBAC
diff --git a/kubernetes/master/cluster.yml b/kubernetes/master/cluster.yml
index 1295f3a..78ff659 100644
--- a/kubernetes/master/cluster.yml
+++ b/kubernetes/master/cluster.yml
@@ -1,8 +1,8 @@
 classes:
 - service.kubernetes.master.cluster
-- service.keepalived.cluster.single
 - service.haproxy.proxy.single
 - system.haproxy.proxy.listen.kubernetes.apiserver
+- system.keepalived.cluster.instance.kube_api_server_vip
 parameters:
   _param:
     kubernetes_netchecker_agent_repo: mirantis