diff --git a/apache/server/site/aodh.yml b/apache/server/site/aodh.yml
index 3b7fc23..9646e4c 100644
--- a/apache/server/site/aodh.yml
+++ b/apache/server/site/aodh.yml
@@ -9,6 +9,9 @@
     apache_aodh_api_port: 8042
   apache:
     server:
+      enabled: true
+      modules:
+        - wsgi
       site:
         aodh:
           enabled: false
diff --git a/apache/server/site/barbican.yml b/apache/server/site/barbican.yml
index 7a4297b..34ad44d 100644
--- a/apache/server/site/barbican.yml
+++ b/apache/server/site/barbican.yml
@@ -8,6 +8,8 @@
   apache:
     server:
       enabled: true
+      modules:
+        - wsgi
       site:
         barbican:
           enabled: false
diff --git a/apache/server/site/cinder.yml b/apache/server/site/cinder.yml
index 785817a..a07b9a8 100644
--- a/apache/server/site/cinder.yml
+++ b/apache/server/site/cinder.yml
@@ -12,6 +12,8 @@
     server:
       enabled: true
       default_mpm: event
+      modules:
+        - wsgi
       site:
         cinder:
           enabled: false
diff --git a/apache/server/site/gnocchi.yml b/apache/server/site/gnocchi.yml
index 7aaba6f..3be97e1 100644
--- a/apache/server/site/gnocchi.yml
+++ b/apache/server/site/gnocchi.yml
@@ -9,6 +9,9 @@
     apache_gnocchi_api_port: 8041
   apache:
     server:
+      enabled: true
+      modules:
+        - wsgi
       site:
         gnocchi:
           enabled: false
diff --git a/apache/server/site/horizon.yml b/apache/server/site/horizon.yml
index e909d4c..2c85f6b 100644
--- a/apache/server/site/horizon.yml
+++ b/apache/server/site/horizon.yml
@@ -57,6 +57,7 @@
           log:
             custom:
               format: ${_param:apache_site_openstack_horizon_log_format}
+              file: '/var/log/apache2/openstack_dashboard_access.log'
             error:
               enabled: true
               level: debug
diff --git a/apache/server/site/nova-placement.yml b/apache/server/site/nova-placement.yml
index a869fea..a911fa2 100644
--- a/apache/server/site/nova-placement.yml
+++ b/apache/server/site/nova-placement.yml
@@ -12,6 +12,8 @@
     server:
       enabled: true
       default_mpm: event
+      modules:
+        - wsgi
       site:
         nova_placement:
           enabled: false
diff --git a/apache/server/site/octavia.yml b/apache/server/site/octavia.yml
new file mode 100644
index 0000000..7f420a4
--- /dev/null
+++ b/apache/server/site/octavia.yml
@@ -0,0 +1,47 @@
+parameters:
+  _param:
+    apache_ssl:
+      enabled: false
+    apache_octavia_api_ssl: ${_param:apache_ssl}
+    apache_octavia_api_address: 0.0.0.0
+    apache_octavia_api_host: ${linux:network:fqdn}
+  octavia:
+    server:
+      service_name: apache2
+  apache:
+    server:
+      enabled: true
+      default_mpm: event
+      modules:
+        - wsgi
+      site:
+        octavia_api:
+          enabled: false
+          available: true
+          type: wsgi
+          name: octavia_api
+          ssl: ${_param:apache_octavia_api_ssl}
+          wsgi:
+            daemon_process: octavia-wsgi
+            processes: 5
+            threads: 1
+            user: octavia
+            group: octavia
+            display_name: '%{GROUP}'
+            script_alias: '/ /usr/bin/octavia-wsgi'
+            application_group: '%{GLOBAL}'
+            authorization: 'On'
+          limits:
+            request_body: 114688
+          host:
+            address: ${_param:apache_octavia_api_address}
+            name: ${_param:apache_octavia_api_host}
+            port: 9876
+          log:
+            custom:
+              format: ${_param:apache_site_openstack_placement_log_format}
+              file: '/var/log/apache2/octavia_api_access.log'
+            error:
+              enabled: true
+              format: '%M'
+              file: '/var/log/apache2/octavia_api_error.log'
diff --git a/apache/server/site/panko.yml b/apache/server/site/panko.yml
index a34190d..ef35c67 100644
--- a/apache/server/site/panko.yml
+++ b/apache/server/site/panko.yml
@@ -9,6 +9,9 @@
     apache_panko_api_port: 8977
   apache:
     server:
+      enabled: true
+      modules:
+        - wsgi
       site:
         panko:
           enabled: false
diff --git a/barbican/server/cluster.yml b/barbican/server/cluster.yml
index 110ff29..558f08b 100644
--- a/barbican/server/cluster.yml
+++ b/barbican/server/cluster.yml
@@ -36,6 +36,8 @@
           enabled: ${_param:barbican_memcache_security_enabled}
           strategy: ${_param:openstack_memcache_security_strategy}
           secret_key: ${_param:barbican_memcache_secret_key}
+      # Keystone notification topic. Should be overridden from cluster level (see PROD-32645)
+      ks_notifications_topic: notifications
   linux:
     system:
       package:
diff --git a/cassandra/backup/client/single.yml b/cassandra/backup/client/single.yml
index 892f92f..0753740 100644
--- a/cassandra/backup/client/single.yml
+++ b/cassandra/backup/client/single.yml
@@ -2,8 +2,6 @@
 - service.cassandra.backup.client
 - system.openssh.client.root
 parameters:
-  _param:
-    cassandra_remote_backup_server: cfg01
   cassandra:
     backup:
       client:
diff --git a/cinder/control/cluster.yml b/cinder/control/cluster.yml
index cf5b84b..c8c25bd 100644
--- a/cinder/control/cluster.yml
+++ b/cinder/control/cluster.yml
@@ -54,6 +54,8 @@
         user: ${_param:keystone_cinder_username}
         password: ${_param:keystone_cinder_password}
         protocol: ${_param:cluster_internal_protocol}
+        service_token_roles: admin
+        service_token_roles_required: true
       glance:
         host: ${_param:cluster_vip_address}
         port: 9292
diff --git a/cinder/control/single.yml b/cinder/control/single.yml
index 3ab34e2..963e308 100644
--- a/cinder/control/single.yml
+++ b/cinder/control/single.yml
@@ -37,6 +37,8 @@
         password: ${_param:keystone_cinder_password}
         protocol: ${_param:internal_protocol}
         region: ${_param:openstack_region}
+        service_token_roles: admin
+        service_token_roles_required: true
       barbican:
         enabled: ${_param:barbican_integration_enabled}
       message_queue:
diff --git a/cinder/volume/local.yml b/cinder/volume/local.yml
index 000de98..c35129d 100644
--- a/cinder/volume/local.yml
+++ b/cinder/volume/local.yml
@@ -38,6 +38,8 @@
         password: ${_param:keystone_cinder_password}
         host: ${_param:single_address}
         region: ${_param:openstack_region}
+        service_token_roles: admin
+        service_token_roles_required: true
       cache:
         security:
           enabled: ${_param:cinder_memcache_security_enabled}
diff --git a/cinder/volume/single.yml b/cinder/volume/single.yml
index 8c62889..c40c7e9 100644
--- a/cinder/volume/single.yml
+++ b/cinder/volume/single.yml
@@ -49,6 +49,8 @@
         host: ${_param:openstack_control_address}
         protocol: ${_param:cluster_internal_protocol}
         region: ${_param:openstack_region}
+        service_token_roles: admin
+        service_token_roles_required: true
       cache:
         security:
           enabled: ${_param:cinder_memcache_security_enabled}
diff --git a/debmirror/mirror_mirantis_com/cassandra/xenial.yml b/debmirror/mirror_mirantis_com/cassandra/xenial.yml
index 4527a63..d096854 100644
--- a/debmirror/mirror_mirantis_com/cassandra/xenial.yml
+++ b/debmirror/mirror_mirantis_com/cassandra/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,10 +9,10 @@
           force: ${_param:mirror_mirantis_com_cassandra_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/cassandra/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/cassandra/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/cassandra/xenial/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_cassandra_xenial.log"
           dist: [ "21x" ]
diff --git a/debmirror/mirror_mirantis_com/ceph-luminous/xenial.yml b/debmirror/mirror_mirantis_com/ceph-luminous/xenial.yml
index ec4bb7d..982372b 100644
--- a/debmirror/mirror_mirantis_com/ceph-luminous/xenial.yml
+++ b/debmirror/mirror_mirantis_com/ceph-luminous/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,11 +9,12 @@
           force: ${_param:mirror_mirantis_com_ceph_luminous_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/ceph-luminous/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/ceph-luminous/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/ceph-luminous/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/ceph-luminous/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_ceph_luminous_xenial.log"
           dist: [ xenial ]
           section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/docker/xenial.yml b/debmirror/mirror_mirantis_com/docker/xenial.yml
index e4cffaa..3364ff0 100644
--- a/debmirror/mirror_mirantis_com/docker/xenial.yml
+++ b/debmirror/mirror_mirantis_com/docker/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,11 +9,12 @@
           force: ${_param:mirror_mirantis_com_docker_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/docker/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/docker/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/docker/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/docker/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_docker_xenial.log"
           dist: [ xenial ]
           section: [ stable ]
diff --git a/debmirror/mirror_mirantis_com/elasticsearch-5.x/xenial.yml b/debmirror/mirror_mirantis_com/elasticsearch-5.x/xenial.yml
index 97d2cd3..3a76987 100644
--- a/debmirror/mirror_mirantis_com/elasticsearch-5.x/xenial.yml
+++ b/debmirror/mirror_mirantis_com/elasticsearch-5.x/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -8,11 +10,12 @@
           force: ${_param:mirror_mirantis_com_elasticsearch_5_x_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/elasticsearch-5.x/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/elasticsearch-5.x/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/elasticsearch-5.x/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/elasticsearch-5.x/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_elasticsearch_5_x_xenial.log"
           dist: [ stable ]
           section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/elasticsearch-6.x/xenial.yml b/debmirror/mirror_mirantis_com/elasticsearch-6.x/xenial.yml
index 2c60c82..711da9b 100644
--- a/debmirror/mirror_mirantis_com/elasticsearch-6.x/xenial.yml
+++ b/debmirror/mirror_mirantis_com/elasticsearch-6.x/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -8,11 +10,12 @@
           force: ${_param:mirror_mirantis_com_elasticsearch_6_x_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/elasticsearch-6.x/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/elasticsearch-6.x/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/elasticsearch-6.x/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/elasticsearch-6.x/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_elasticsearch_6_x_xenial.log"
           dist: [ stable ]
           section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/elasticsearch-curator-5/xenial.yml b/debmirror/mirror_mirantis_com/elasticsearch-curator-5/xenial.yml
index 5ee8741..ec61542 100644
--- a/debmirror/mirror_mirantis_com/elasticsearch-curator-5/xenial.yml
+++ b/debmirror/mirror_mirantis_com/elasticsearch-curator-5/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -8,10 +10,10 @@
           force: ${_param:mirror_mirantis_com_elasticsearch_curator_5_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/elasticsearch-curator-5/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/elasticsearch-curator-5/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/elasticsearch-curator-5/xenial/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_elasticsearch_curator_5_xenial.log"
           dist: [ stable ]
diff --git a/debmirror/mirror_mirantis_com/extra/xenial.yml b/debmirror/mirror_mirantis_com/extra/xenial.yml
index f5ed991..1ae00eb 100644
--- a/debmirror/mirror_mirantis_com/extra/xenial.yml
+++ b/debmirror/mirror_mirantis_com/extra/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,11 +9,12 @@
           force: ${_param:mirror_mirantis_com_extra_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/extra/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/extra/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/extra/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/extra/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_extra_xenial.log"
           dist: [ xenial ]
           section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/glusterfs-3.8/xenial.yml b/debmirror/mirror_mirantis_com/glusterfs-3.8/xenial.yml
index fbac95e..a080ad5 100644
--- a/debmirror/mirror_mirantis_com/glusterfs-3.8/xenial.yml
+++ b/debmirror/mirror_mirantis_com/glusterfs-3.8/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,10 +9,10 @@
           force: ${_param:mirror_mirantis_com_glusterfs_3_8_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/glusterfs-3.8/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/glusterfs-3.8/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/glusterfs-3.8/xenial/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_glusterfs_3_8_xenial.log"
           dist: [ xenial ]
diff --git a/debmirror/mirror_mirantis_com/glusterfs-5/xenial.yml b/debmirror/mirror_mirantis_com/glusterfs-5/xenial.yml
new file mode 100644
index 0000000..ef433a7
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/glusterfs-5/xenial.yml
@@ -0,0 +1,21 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_glusterfs_5_xenial:
+          force: ${_param:mirror_mirantis_com_glusterfs_5_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/glusterfs-5/xenial/"
+          target_dir: "${_param:debmirror_mirrors_base_target_dir}/glusterfs-5/xenial/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_glusterfs_5_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
+          filter:
+            001: "--exclude='-dbg_'"
diff --git a/debmirror/mirror_mirantis_com/init.yml b/debmirror/mirror_mirantis_com/init.yml
index 68f7530..753a3a4 100644
--- a/debmirror/mirror_mirantis_com/init.yml
+++ b/debmirror/mirror_mirantis_com/init.yml
@@ -1,17 +1,36 @@
 classes:
 - system.debmirror.mirror_mirantis_com.cassandra.xenial
+- system.debmirror.mirror_mirantis_com.update.cassandra.xenial
 - system.debmirror.mirror_mirantis_com.ceph-luminous.xenial
+- system.debmirror.mirror_mirantis_com.update.ceph-luminous.xenial
 - system.debmirror.mirror_mirantis_com.docker.xenial
+- system.debmirror.mirror_mirantis_com.update.docker.xenial
 - system.debmirror.mirror_mirantis_com.elasticsearch-5.x.xenial
+- system.debmirror.mirror_mirantis_com.update.elasticsearch-5.x.xenial
 - system.debmirror.mirror_mirantis_com.elasticsearch-6.x.xenial
+- system.debmirror.mirror_mirantis_com.update.elasticsearch-6.x.xenial
 - system.debmirror.mirror_mirantis_com.elasticsearch-curator-5.xenial
+- system.debmirror.mirror_mirantis_com.update.elasticsearch-curator-5.xenial
 - system.debmirror.mirror_mirantis_com.extra.xenial
+- system.debmirror.mirror_mirantis_com.update.extra.xenial
 - system.debmirror.mirror_mirantis_com.glusterfs-3.8.xenial
+- system.debmirror.mirror_mirantis_com.glusterfs-5.xenial
+- system.debmirror.mirror_mirantis_com.update.glusterfs-5.xenial
 - system.debmirror.mirror_mirantis_com.maas.xenial
+- system.debmirror.mirror_mirantis_com.update.maas.xenial
+- system.debmirror.mirror_mirantis_com.opencontrail-4.1.xenial
+- system.debmirror.mirror_mirantis_com.update.opencontrail-4.1.xenial
 - system.debmirror.mirror_mirantis_com.openstack-pike.xenial
+- system.debmirror.mirror_mirantis_com.update.openstack-pike.xenial
 - system.debmirror.mirror_mirantis_com.openstack-queens.xenial
+- system.debmirror.mirror_mirantis_com.update.openstack-queens.xenial
 - system.debmirror.mirror_mirantis_com.percona.xenial
+- system.debmirror.mirror_mirantis_com.update.percona.xenial
 - system.debmirror.mirror_mirantis_com.salt-formulas.xenial
+- system.debmirror.mirror_mirantis_com.update.salt-formulas.xenial
 - system.debmirror.mirror_mirantis_com.saltstack-2017.7.xenial
+- system.debmirror.mirror_mirantis_com.update.saltstack-2017.7.xenial
 - system.debmirror.mirror_mirantis_com.td-agent.xenial
+- system.debmirror.mirror_mirantis_com.update.td-agent.xenial
 - system.debmirror.mirror_mirantis_com.ubuntu.xenial
+- system.debmirror.mirror_mirantis_com.update.ubuntu.xenial
diff --git a/debmirror/mirror_mirantis_com/maas/xenial.yml b/debmirror/mirror_mirantis_com/maas/xenial.yml
index c19c0a2..cc3aaa1 100644
--- a/debmirror/mirror_mirantis_com/maas/xenial.yml
+++ b/debmirror/mirror_mirantis_com/maas/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,10 +9,10 @@
           force: ${_param:mirror_mirantis_com_maas_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/maas/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/maas/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/maas/xenial/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_maas_xenial.log"
           dist: [ xenial ]
diff --git a/debmirror/mirror_mirantis_com/opencontrail-4.0/xenial.yml b/debmirror/mirror_mirantis_com/opencontrail-4.0/xenial.yml
index 38b13b1..b637715 100644
--- a/debmirror/mirror_mirantis_com/opencontrail-4.0/xenial.yml
+++ b/debmirror/mirror_mirantis_com/opencontrail-4.0/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,10 +9,10 @@
           force: ${_param:mirror_mirantis_com_oc40_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/opencontrail-4.0/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/opencontrail-4.0/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/opencontrail-4.0/xenial/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_oc40_xenial.log"
           dist: [ xenial ]
diff --git a/debmirror/mirror_mirantis_com/opencontrail-4.1/xenial.yml b/debmirror/mirror_mirantis_com/opencontrail-4.1/xenial.yml
index e7d6b2b..9a0ed44 100644
--- a/debmirror/mirror_mirantis_com/opencontrail-4.1/xenial.yml
+++ b/debmirror/mirror_mirantis_com/opencontrail-4.1/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,11 +9,12 @@
           force: ${_param:mirror_mirantis_com_oc41_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/opencontrail-4.1/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/opencontrail-4.1/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/opencontrail-4.1/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/opencontrail-4.1/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_oc41_xenial.log"
           dist: [ xenial ]
           section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/openstack-pike/xenial.yml b/debmirror/mirror_mirantis_com/openstack-pike/xenial.yml
index e664637..294e0e0 100644
--- a/debmirror/mirror_mirantis_com/openstack-pike/xenial.yml
+++ b/debmirror/mirror_mirantis_com/openstack-pike/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,11 +9,12 @@
           force: ${_param:mirror_mirantis_com_openstack_pike_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/openstack-pike/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/openstack-pike/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/openstack-pike/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/openstack-pike/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_openstack_pike_xenial.log"
           dist: [ xenial ]
           section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/openstack-queens/xenial.yml b/debmirror/mirror_mirantis_com/openstack-queens/xenial.yml
index 52ea04d..1960d8a 100644
--- a/debmirror/mirror_mirantis_com/openstack-queens/xenial.yml
+++ b/debmirror/mirror_mirantis_com/openstack-queens/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,11 +9,12 @@
           force: ${_param:mirror_mirantis_com_openstack_queens_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/openstack-queens/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/openstack-queens/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/openstack-queens/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/openstack-queens/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_openstack_queens_xenial.log"
           dist: [ xenial ]
           section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/percona/xenial.yml b/debmirror/mirror_mirantis_com/percona/xenial.yml
index 87746e0..6f26de7 100644
--- a/debmirror/mirror_mirantis_com/percona/xenial.yml
+++ b/debmirror/mirror_mirantis_com/percona/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,10 +9,10 @@
           force: ${_param:mirror_mirantis_com_percona_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/percona/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/percona/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/percona/xenial/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_percona_xenial.log"
           dist: [ xenial ]
diff --git a/debmirror/mirror_mirantis_com/salt-formulas/xenial.yml b/debmirror/mirror_mirantis_com/salt-formulas/xenial.yml
index c7f8523..f55f7c4 100644
--- a/debmirror/mirror_mirantis_com/salt-formulas/xenial.yml
+++ b/debmirror/mirror_mirantis_com/salt-formulas/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,10 +9,10 @@
           force: ${_param:mirror_mirantis_com_salt-formulas_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/salt-formulas/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/salt-formulas/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/salt-formulas/xenial/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_salt-formulas_xenial.log"
           dist: [ xenial ]
diff --git a/debmirror/mirror_mirantis_com/saltstack-2016.3/xenial.yml b/debmirror/mirror_mirantis_com/saltstack-2016.3/xenial.yml
deleted file mode 100644
index 3a3528b..0000000
--- a/debmirror/mirror_mirantis_com/saltstack-2016.3/xenial.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-parameters:
-  debmirror:
-    client:
-      enabled: true
-      mirrors:
-        mirror_mirantis_com_saltstack_2016_3_xenial:
-          force: ${_param:mirror_mirantis_com_saltstack_2016_3_xenial_force}
-          lock_target: True
-          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
-          arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/saltstack-2016.3/xenial/"
-          target_dir: "${_param:debmirror_mirrors_base_target_dir}/saltstack-2016.3/xenial/"
-          log_file: "/var/log/debmirror/mirror_mirantis_com_saltstack_2016_3_xenial.log"
-          dist: [ xenial ]
-          section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/saltstack-2017.7/xenial.yml b/debmirror/mirror_mirantis_com/saltstack-2017.7/xenial.yml
index 19371b4..f31673b 100644
--- a/debmirror/mirror_mirantis_com/saltstack-2017.7/xenial.yml
+++ b/debmirror/mirror_mirantis_com/saltstack-2017.7/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,10 +9,10 @@
           force: ${_param:mirror_mirantis_com_saltstack_2017_7_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/saltstack-2017.7/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/saltstack-2017.7/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/saltstack-2017.7/xenial/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_saltstack_2017_7_xenial.log"
           dist: [ xenial ]
diff --git a/debmirror/mirror_mirantis_com/td-agent/xenial.yml b/debmirror/mirror_mirantis_com/td-agent/xenial.yml
index 6c6becd..03d5bc5 100644
--- a/debmirror/mirror_mirantis_com/td-agent/xenial.yml
+++ b/debmirror/mirror_mirantis_com/td-agent/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -7,11 +9,12 @@
           force: ${_param:mirror_mirantis_com_td_agent_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/td-agent/xenial/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/td-agent/xenial/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/td-agent/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/td-agent/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_td_agent_xenial.log"
           dist: [ xenial ]
           section: [ contrib ]
diff --git a/debmirror/mirror_mirantis_com/ubuntu/xenial.yml b/debmirror/mirror_mirantis_com/ubuntu/xenial.yml
index bc0a9d7..5073128 100644
--- a/debmirror/mirror_mirantis_com/ubuntu/xenial.yml
+++ b/debmirror/mirror_mirantis_com/ubuntu/xenial.yml
@@ -1,3 +1,5 @@
+classes:
+- system.defaults.debmirror
 parameters:
   debmirror:
     client:
@@ -8,16 +10,15 @@
           force: ${_param:mirror_mirantis_com_ubuntu_xenial_force}
           lock_target: True
           extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
-          method: "rsync"
+          method: "${_param:debmirror_mirrors_sync_method}"
           arch: [ 'amd64' ]
-          mirror_host: "mirror.mirantis.com"
-          mirror_root: ":mirror/${_param:mcp_version}/ubuntu/"
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_root}/ubuntu/"
           target_dir: "${_param:debmirror_mirrors_base_target_dir}/ubuntu/"
           log_file: "/var/log/debmirror/mirror_mirantis_com_ubuntu_xenial.log"
           dist: [ xenial , xenial-security, xenial-updates ]
           section: [ main , restricted, universe ]
-          # FIXME uncomment after PROD-26267 will be fixed
-          # cache_dir: "${_param:debmirror_mirrors_base_target_dir}/../.cache/ubuntu"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/ubuntu/"
           # Don't exclude main/x11 - its required for many pkgs.
           exclude_deb_section:
           - Xfce
@@ -79,7 +80,6 @@
           - 'main/tex$'
           - 'restricted/tex$'
           - 'universe/tex$'
-          - 'text$'
           - 'universe/text$'
           # Updating filter, please always start from section, aka main|universe|multiverse
           filter:
@@ -155,7 +155,6 @@
             508: "--exclude='/universe/s/salt'"
             509: "--exclude='/universe/z/zabbix'"
             510: "--exclude='(universe|main)/(o|d|n)/(openvswitch|dpdk|networking-ovs-dpdk)'"
-            511: "--exclude='/main/libv/.*(libvirt)'"
             512: "--exclude='/main/s/.*(seabios)'"
             513: "--exclude='/universe/.*libvirt'"
             514: "--exclude='/(universe|main)/c/(cinder|ceilometer)'"
@@ -189,3 +188,5 @@
             808: --include='main/.*(linux-libc(-|_|)|libgcc1_).*amd64.deb'
             809: --include='main/(x/xml-core|s/sgml-base|libxml|.*xmlsec1|.*python(3|)-zope.interface)'
             810: --include='universe/p/plexus-(container-default|interactivity-api)/' # PROD-26807 Req.for DogTag
+            811: --include='/main/u/update-notifier/' #   PROD-30102 Req for ceph
+            812: --include='/main/k/krb5/' # Req for curl
diff --git a/debmirror/mirror_mirantis_com/update/cassandra/xenial.yml b/debmirror/mirror_mirantis_com/update/cassandra/xenial.yml
new file mode 100644
index 0000000..1f91284
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/cassandra/xenial.yml
@@ -0,0 +1,19 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_cassandra_xenial:
+          force: ${_param:mirror_mirantis_com_cassandra_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/cassandra/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/cassandra/xenial/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_cassandra_xenial.log"
+          dist: [ "21x" ]
+          section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/update/ceph-luminous/xenial.yml b/debmirror/mirror_mirantis_com/update/ceph-luminous/xenial.yml
new file mode 100644
index 0000000..f966993
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/ceph-luminous/xenial.yml
@@ -0,0 +1,22 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_ceph_luminous_xenial:
+          force: ${_param:mirror_mirantis_com_ceph_luminous_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/ceph-luminous/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/ceph-luminous/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/ceph-luminous/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_ceph_luminous_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
+          filter:
+            001: "--exclude='(-dbg_|-dbg-)'"
diff --git a/debmirror/mirror_mirantis_com/update/docker/xenial.yml b/debmirror/mirror_mirantis_com/update/docker/xenial.yml
new file mode 100644
index 0000000..52f4ff2
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/docker/xenial.yml
@@ -0,0 +1,25 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_docker_xenial:
+          force: ${_param:mirror_mirantis_com_docker_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/docker/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/docker/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/docker/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_docker_xenial.log"
+          dist: [ xenial ]
+          section: [ stable ]
+          filter:
+            # conteinerD - forked at 'extra' repo.
+            001: --exclude='(docker-ce_17|containerd.io_1.2.0~(beta|rc))'
+            # Drop docker-ce <= 18.09
+            002: --exclude='(docker-ce(-|_)18.0[0-8])'
diff --git a/debmirror/mirror_mirantis_com/update/elasticsearch-5.x/xenial.yml b/debmirror/mirror_mirantis_com/update/elasticsearch-5.x/xenial.yml
new file mode 100644
index 0000000..a01cdc0
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/elasticsearch-5.x/xenial.yml
@@ -0,0 +1,24 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_elasticsearch_5_x_xenial:
+          enabled: true
+          force: ${_param:mirror_mirantis_com_elasticsearch_5_x_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/elasticsearch-5.x/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/elasticsearch-5.x/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/elasticsearch-5.x/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_elasticsearch_5_x_xenial.log"
+          dist: [ stable ]
+          section: [ main ]
+          filter:
+            # drop all versions below 5.6.12
+            001: --exclude='(_|-)5\.([0-5]\.|6\.([0-9]|10|11)(-|\.))'
diff --git a/debmirror/mirror_mirantis_com/update/elasticsearch-6.x/xenial.yml b/debmirror/mirror_mirantis_com/update/elasticsearch-6.x/xenial.yml
new file mode 100644
index 0000000..1a640e5
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/elasticsearch-6.x/xenial.yml
@@ -0,0 +1,25 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_elasticsearch_6_x_xenial:
+          enabled: true
+          force: ${_param:mirror_mirantis_com_elasticsearch_6_x_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/elasticsearch-6.x/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/elasticsearch-6.x/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/elasticsearch-6.x/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_elasticsearch_6_x_xenial.log"
+          dist: [ stable ]
+          section: [ main ]
+          filter:
+#            # drop all versions below 6.5.2
+            001: --exclude='(_|-)6\.([0-4]\.|[0-5]\.[0-1])'
+
diff --git a/debmirror/mirror_mirantis_com/update/elasticsearch-curator-5/xenial.yml b/debmirror/mirror_mirantis_com/update/elasticsearch-curator-5/xenial.yml
new file mode 100644
index 0000000..18da05b
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/elasticsearch-curator-5/xenial.yml
@@ -0,0 +1,20 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_elasticsearch_curator_5_xenial:
+          enabled: true
+          force: ${_param:mirror_mirantis_com_elasticsearch_curator_5_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/elasticsearch-curator-5/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/elasticsearch-curator-5/xenial/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_elasticsearch_curator_5_xenial.log"
+          dist: [ stable ]
+          section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/update/extra/xenial.yml b/debmirror/mirror_mirantis_com/update/extra/xenial.yml
new file mode 100644
index 0000000..c655030
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/extra/xenial.yml
@@ -0,0 +1,22 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_extra_xenial:
+          force: ${_param:mirror_mirantis_com_extra_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/extra/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/extra/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/extra/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_extra_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
+          filter:
+            001: --exclude='(-|_)dbg(_|-)'
diff --git a/debmirror/mirror_mirantis_com/update/glusterfs-5/xenial.yml b/debmirror/mirror_mirantis_com/update/glusterfs-5/xenial.yml
new file mode 100644
index 0000000..957bc0f
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/glusterfs-5/xenial.yml
@@ -0,0 +1,21 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_glusterfs_5_xenial:
+          force: ${_param:mirror_mirantis_com_glusterfs_5_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/glusterfs-5/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/glusterfs-5/xenial/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_glusterfs_5_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
+          filter:
+            001: "--exclude='-dbg_'"
diff --git a/debmirror/mirror_mirantis_com/update/maas/xenial.yml b/debmirror/mirror_mirantis_com/update/maas/xenial.yml
new file mode 100644
index 0000000..7402049
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/maas/xenial.yml
@@ -0,0 +1,19 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_maas_xenial:
+          force: ${_param:mirror_mirantis_com_maas_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/maas/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/maas/xenial/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_maas_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/update/opencontrail-4.1/xenial.yml b/debmirror/mirror_mirantis_com/update/opencontrail-4.1/xenial.yml
new file mode 100644
index 0000000..7a195aa
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/opencontrail-4.1/xenial.yml
@@ -0,0 +1,22 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_oc41_xenial:
+          force: ${_param:mirror_mirantis_com_oc41_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/opencontrail-4.1/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/opencontrail-4.1/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/opencontrail-4.1/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_oc41_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
+          filter:
+            001: "--exclude='(-dbg_|-dbg-)'"
diff --git a/debmirror/mirror_mirantis_com/update/openstack-pike/xenial.yml b/debmirror/mirror_mirantis_com/update/openstack-pike/xenial.yml
new file mode 100644
index 0000000..20a4d05
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/openstack-pike/xenial.yml
@@ -0,0 +1,22 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_openstack_pike_xenial:
+          force: ${_param:mirror_mirantis_com_openstack_pike_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/openstack-pike/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/openstack-pike/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/openstack-pike/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_openstack_pike_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
+          filter:
+            001: --exclude='(-|_)dbg(_|-)'
diff --git a/debmirror/mirror_mirantis_com/update/openstack-queens/xenial.yml b/debmirror/mirror_mirantis_com/update/openstack-queens/xenial.yml
new file mode 100644
index 0000000..ef917fb
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/openstack-queens/xenial.yml
@@ -0,0 +1,22 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_openstack_queens_xenial:
+          force: ${_param:mirror_mirantis_com_openstack_queens_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/openstack-queens/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/openstack-queens/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/openstack-queens/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_openstack_queens_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
+          filter:
+            001: --exclude='(-|_)dbg(_|-)'
diff --git a/debmirror/mirror_mirantis_com/update/percona/xenial.yml b/debmirror/mirror_mirantis_com/update/percona/xenial.yml
new file mode 100644
index 0000000..fc739d8
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/percona/xenial.yml
@@ -0,0 +1,25 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_percona_xenial:
+          force: ${_param:mirror_mirantis_com_percona_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/percona/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/percona/xenial/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_percona_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
+          filter:
+            001: --exclude='(-|_)dbg(_|-)'
+            002: "--exclude='/percona-server-5.(5|6)'"
+            003: "--exclude='/percona-server-mongodb'"
+            004: "--exclude='/(percona-xtradb-cluster|percona-server-5|percona-xtradb-cluster)'"
+            050: "--include='/*galera*'"
diff --git a/debmirror/mirror_mirantis_com/update/salt-formulas/xenial.yml b/debmirror/mirror_mirantis_com/update/salt-formulas/xenial.yml
new file mode 100644
index 0000000..fb042ab
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/salt-formulas/xenial.yml
@@ -0,0 +1,19 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_salt-formulas_xenial:
+          force: ${_param:mirror_mirantis_com_salt-formulas_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/salt-formulas/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/salt-formulas/xenial/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_salt-formulas_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/update/saltstack-2017.7/xenial.yml b/debmirror/mirror_mirantis_com/update/saltstack-2017.7/xenial.yml
new file mode 100644
index 0000000..cd9998e
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/saltstack-2017.7/xenial.yml
@@ -0,0 +1,19 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_saltstack_2017_7_xenial:
+          force: ${_param:mirror_mirantis_com_saltstack_2017_7_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/saltstack-2017.7/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/saltstack-2017.7/xenial/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_saltstack_2017_7_xenial.log"
+          dist: [ xenial ]
+          section: [ main ]
diff --git a/debmirror/mirror_mirantis_com/update/td-agent/xenial.yml b/debmirror/mirror_mirantis_com/update/td-agent/xenial.yml
new file mode 100644
index 0000000..c838b73
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/td-agent/xenial.yml
@@ -0,0 +1,20 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        mirror_mirantis_com_update_td_agent_xenial:
+          force: ${_param:mirror_mirantis_com_td_agent_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/td-agent/xenial/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/td-agent/xenial/"
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/td-agent/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_td_agent_xenial.log"
+          dist: [ xenial ]
+          section: [ contrib ]
diff --git a/debmirror/mirror_mirantis_com/update/ubuntu/xenial.yml b/debmirror/mirror_mirantis_com/update/ubuntu/xenial.yml
new file mode 100644
index 0000000..ef0ec04
--- /dev/null
+++ b/debmirror/mirror_mirantis_com/update/ubuntu/xenial.yml
@@ -0,0 +1,192 @@
+classes:
+- system.defaults.debmirror
+parameters:
+  debmirror:
+    client:
+      enabled: true
+      mirrors:
+        # This mirror is used to build unmodified(no meta changes) but reduced offline ubuntu-mirror.
+        mirror_mirantis_com_update_ubuntu_xenial:
+          force: ${_param:mirror_mirantis_com_ubuntu_xenial_force}
+          lock_target: True
+          extra_flags: [ '--verbose', '--progress', '--nosource', '--no-check-gpg', '--rsync-extra=none' ]
+          method: "${_param:debmirror_mirrors_sync_method}"
+          arch: [ 'amd64' ]
+          mirror_host: "${_param:debmirror_mirrors_host}"
+          mirror_root: "${_param:debmirror_mirrors_update_root}/ubuntu/"
+          target_dir: "${_param:debmirror_mirrors_update_target_dir}/ubuntu/"
+          log_file: "/var/log/debmirror/mirror_mirantis_com_update_ubuntu_xenial.log"
+          dist: [ xenial , xenial-security, xenial-updates ]
+          section: [ main , restricted, universe ]
+          cache_dir: "${_param:debmirror_mirrors_common_cache_dir}/ubuntu/"
+          # Don't exclude main/x11 - its required for many pkgs.
+          exclude_deb_section:
+          - Xfce
+          - comm
+          - doc
+          - electronics
+          - games
+          - gnome
+          - graphics
+          - hamradio
+          - kde
+          - localization
+          - news
+          - science
+          - sound
+          - translations
+          - video
+          - main/debug
+          - main/science
+          - restricted/Xfce
+          - restricted/comm
+          - restricted/debug
+          - restricted/doc
+          - restricted/electronics
+          - restricted/games
+          - restricted/gnome
+          - restricted/graphics
+          - restricted/hamradio
+          - restricted/kde
+          - restricted/localization
+          - restricted/news
+          - restricted/science
+          - restricted/sound
+          - restricted/translations
+          - restricted/video
+          - restricted/x11
+          - universe/Xfce
+          - universe/comm
+          - universe/debug
+          - universe/doc
+          - universe/electronics
+          - universe/games
+          - universe/gnome
+          - universe/graphics
+          - universe/hamradio
+          - universe/kde
+          - universe/localization
+          - universe/news
+          - universe/science
+          - universe/sound
+          - universe/translations
+          - universe/video
+          - universe/x11
+          - zope
+          - main/zope
+          - restricted/zope
+          - universe/zope
+          - 'tex$'
+          - 'main/tex$'
+          - 'restricted/tex$'
+          - 'universe/tex$'
+          - 'universe/text$'
+          # Updating filter, please always start from section, aka main|universe|multiverse
+          filter:
+            1: "--exclude='android*'"
+            2: "--exclude='/(main|universe)/f/firefox'"
+            3: "--exclude='/chromium-browser*'"
+            5: "--exclude='/*-wallpapers*'"
+            6: "--exclude='/language-pack-(?!en)'"
+            7: "--exclude='thunderbird*'"
+            8: --exclude='(libreoffice*|bgoffice|openoffice*)'
+            10: "--exclude='live-image-*-desktop*'"
+            11: --exclude='(desktop|mate|cinnamon|xubuntu|kubuntu|lubuntu)-*'
+            16: "--exclude='flashplugin*'"
+            17: --exclude='(unity|gnome).*'
+            20: "--exclude='openjdk-*-(dbg|demo|source).*'"
+            22: "--exclude='(kde|ubuntu|xfce4|sabily|sugar).*artwork*'"
+            23: "--exclude='ubuntu-touch*'"
+            24: "--exclude='remmina*'"
+            25: "--exclude='/libbluetooth*'"
+            26: "--exclude='/libandroid*'"
+            27: "--exclude='/banshee*'"
+            27: "--exclude='/*(.xorg)*joystick'"
+            28: "--exclude='/xserver-xorg-video(.*vivid|.*wily|.*utopic)'"
+            30: --exclude='universe.*bluez.*'
+            32: --exclude='main/(a/a11y-profile-manager|e/emacs24|i/ispell|br\.ispell)'
+            33: --exclude='/universe/.*(alsa|ubuntuone|telepathy|debian-multimedia|kodi|mediaplayer|nagios|getfem|gammaray|geotranz|brasero)'
+            34: --exclude='(usb-creator|gcc-snapshot|gcc-mozilla|gccgo|gcc-.*-cross.*|gcc-avr|gcc-3\.3|gcc-4\.[7-8])'
+            35: --exclude='(.*/q/qt|pyqt)'
+            36: --exclude='/universe/.*(mediascanner2|mediatomb|mediawiki|pidgin|eclipse|esys-particle|fusion|e/emboss|e/empathy|g/globus|ecere-sdk|ferret|gap-)'
+            84: --exclude='restricted/b/bcmwl'
+            86: "--exclude='/main/(m/mozc/|n/nut/|o/oxide-qt/|o/orbit2/|q/(qtbase-opensource-src|qtdeclarative-opensource-src)/|t/telepathy-glib|w/webkit2gtk|w/webrtc-audio-processing)'"
+            87: --exclude='universe/(s/syncevolution|r/r-bioc-|.*(libbiblio|libbusiness|biococoa))'
+            89: --exclude='universe/(libk/libkde|k/kde|r/rustc|r/root-system|e/emacs|x/xemacs21)'
+            90: "--exclude='/universe/p/(psi-plus|puppet-module|plasma|pcl/)'"
+            91: --exclude='/golang-.*'
+            92: "--exclude='/(llvm-toolchain|address-book|amule|openclipart|rhythmbox|gimp|sonic-visualiser|games|bsdgame|gazebo|arduino|webkitgtk|widelands|wxwidget|warzone|wings3d).*'"
+            93: "--exclude='/(asterisk|abiword|webbrowser-app|imagemagick|.*clamav|wireshar|vlc|.*transmission|tryton-modules|trilinos|tomboy|wine1|wine-dev|compiz|mythtv|ubuntustudio).*'"
+            94: "--exclude='/universe/o/(openstack-debian-images).*'"
+            96: "--exclude='/(nvidia).*'"
+            97: --exclude='(gambas3|opengl|screensaver|taoframework)'
+            # Drop all dbg pkgs
+            98: --exclude='(-|_)dbg(_|-)'
+            99: --exclude='mythbuntu|network-manager-applet|debian-junior|game-music-emu|fp-units-castle-game-engine|asio|unidic-mecab|zope\.'
+            100: --exclude='kineticstools|juju-(deployer|mongo|core)|felix-latin|fonts-(yozvox-yozfont|nanum|roboto|baekmuk|arphic-.*|takao|noto-cjk|ipamj-mincho)|insighttoolkit|axiom'
+            101: --exclude='openjdk-(8|9)(?!.*jre-headless.*)'
+            # List of unused linux kernels and unsupported arch
+            300: --exclude='.*-(alpha|arm64|powerpc|s390x|armel|armhf|arm-|aarch64-|sparc64|mips64|mips|ppc64el|mipsn32|hppa|m68k|sh4|mipsel|ppc64|m68hc1|mingw-w64)'
+            301: --exclude='(main|universe)/l/linux-*-(.*azure|.*aws|gke|gcp|.*azure-edge|.*oem/|.*euclid/)'
+            303: "--exclude='/main/l/linux(.*)/linux-source-*'"
+            # Old minor version of kernel|tools|extra|cloud and related.
+            # Generic: Old - if minor less then < 136, but not 4numeric
+            304: --exclude='main/l/linux.*/linux-.*4\.4\.0-(([0-9][0-9])|([0-9][0-3][0-6]))(\.|_|-)'
+            # Hwe 4.8: Old - if minor in 30-49 and < 57.
+            305: '--exclude="main/l/linux.*/linux-.*4\.8\.0-(([0-4][0-9])|([0-9][0-6]))"'
+            # Hwe 4.10: Old - if minor in 0-39, < 42 .
+            306: '--exclude="main/l/linux.*/linux-.*4\.10\.0-(([0-3][0-9])|(4[0-1]))"'
+            # Hwe 4.13: Old - if minor in 0-39, < 44
+            307: '--exclude="main/l/linux.*/linux-.*4\.13\.0-(([0-3][0-9])|(4[0-4]))"'
+            # Hwe 4.15.0: Old - if minor in 0-39, < 43
+            308: --exclude='main/l/linux.*/linux-.*4\.15\.0-(([0-3][0-9])|(4[0-2]))'
+            # Old 4.4.0
+            309: --exclude='main/l/linux.*/linux-.*4\.4\.0-'
+            # List of packages, that should be fetched from fresh ppa or other mirror
+            # So,removing them from upstream mirror.
+            500: --exclude='main/m/maas/'
+            501: --exclude='universe/g/glusterfs/'
+            502: "--exclude='/universe/d/(docker-|docker.io)/'"
+            503: "--exclude='/(main|universe)/c/ceph'"
+            504: "--exclude='/universe/a/aptly'"
+            505: "--exclude='/universe/e/elasticsearch'"
+            506: "--exclude='/universe/g/grafana/'"
+            507: "--exclude='/universe/i/influxdb(?!.*python)'"
+            508: "--exclude='/universe/s/salt'"
+            509: "--exclude='/universe/z/zabbix'"
+            510: "--exclude='(universe|main)/(o|d|n)/(openvswitch|dpdk|networking-ovs-dpdk)'"
+            512: "--exclude='/main/s/.*(seabios)'"
+            513: "--exclude='/universe/.*libvirt'"
+            514: "--exclude='/(universe|main)/c/(cinder|ceilometer)'"
+            515: "--exclude='/(universe|main)/p/python-(cinder|ceilometer)client'"
+            516: "--exclude='/(universe|main)/n/(nova|neutron)'"
+            517: "--exclude='/(universe|main)/p/python-(nova|neutron)client'"
+            518: "--exclude='/(universe|main)/g/(glance)'"
+            519: "--exclude='/(universe|main)/p/python-(glance)client'"
+            520: "--exclude='/(universe|main)/b/(barbican)'"
+            521: "--exclude='/(universe|main)/k/(keystone)'"
+            522: "--exclude='/(universe|main)/d/(designate)'"
+            523: "--exclude='/(universe|main)/p/python-(barbican|keystone|designate)client'"
+            524: "--exclude='/(universe|main)/h/(horizon|heat)'"
+            525: "--exclude='/(universe|main)/p/python-(horizon|heat)client'"
+            526: "--exclude='/(universe|main)/m/(murano|mistral|manila)'"
+            527: "--exclude='/(universe|main)/p/python-(murano|mistral|manila)client'"
+            528: "--exclude='/(universe|main)/i/(ironic)'"
+            529: "--exclude='/(universe|main)/a/(aodh)'"
+            530: "--exclude='/(universe|main)/p/python-(ironic|aodh)client'"
+            531: --exclude='/universe/p/percona-'
+            # List of extra includes, founded after tests.
+            800: "--include='/main(.*)manpages'"
+            801: "--include='/main(.*)python-(.*)doc'"
+            802: "--include='/main(.*)python-(.*)network'"
+            803: "--include='/main(.*)unittest2'" # openstack* pkgs
+            804: "--include='/main(.*)libbluetooth3'" # python-guestfs
+            # Get required llvm.But drop old llvm toolset.Old - if major in 1-5.
+            805: '--include="/main(.*)llvm-toolchain-(?![1-5])"' # pki-ca: < 389-ds-base < dogtag
+            806: "--include='/main(.*)man-db'" # include man tool
+            807: "--include='/main(.*)zfs-doc'" # Some extra fs dep's for MAAS provision stage.PROD-21531
+            808: --include='main/.*(linux-libc(-|_|)|libgcc1_).*amd64.deb'
+            809: --include='main/(x/xml-core|s/sgml-base|libxml|.*xmlsec1|.*python(3|)-zope.interface)'
+            810: --include='universe/p/plexus-(container-default|interactivity-api)/' # PROD-26807 Req.for DogTag
+            811: --include='/main/u/update-notifier/' #   PROD-30102 Req for ceph
+            812: --include='/main/k/krb5/' # Req for curl
diff --git a/defaults/backup.yml b/defaults/backup.yml
index 66e5173..76bed01 100644
--- a/defaults/backup.yml
+++ b/defaults/backup.yml
@@ -5,3 +5,6 @@
     backup_day_of_month: "*"
     backup_month: "*"
     backup_day_of_week: "*"
+    zookeeper_remote_backup_server: ${_param:infra_config_hostname}
+    cassandra_remote_backup_server: ${_param:infra_config_hostname}
+
diff --git a/defaults/debmirror.yml b/defaults/debmirror.yml
index b572dcc..8c636ac 100644
--- a/defaults/debmirror.yml
+++ b/defaults/debmirror.yml
@@ -2,6 +2,14 @@
   _param:
     # Global
     debmirror_mirrors_base_target_dir: "/srv/volumes/aptly/public/${_param:mcp_version}/"
+    debmirror_mirrors_update_target_dir: "/srv/volumes/aptly/public/update/${_param:mcp_version}/"
+    # TODO : expiremental
+    debmirror_mirrors_common_cache_dir: "/srv/volumes/aptly/public/.common_cache/"
+    # debmirror_mirrors_sync_method set to http because mirror.mirantis.com is under cloud front
+    debmirror_mirrors_sync_method: http
+    debmirror_mirrors_host: "mirror.mirantis.com"
+    debmirror_mirrors_root: "${_param:mcp_version}"
+    debmirror_mirrors_update_root: "update/${_param:mcp_version}"
     # Per repo modificators
     mirror_mirantis_com_cassandra_xenial_force: False
     mirror_mirantis_com_ceph_luminous_xenial_force: False
@@ -11,6 +19,7 @@
     mirror_mirantis_com_elasticsearch_curator_5_xenial_force: False
     mirror_mirantis_com_extra_xenial_force: False
     mirror_mirantis_com_glusterfs_3_8_xenial_force: False
+    mirror_mirantis_com_glusterfs_5_xenial_force: False
     mirror_mirantis_com_maas_xenial_force: False
     mirror_mirantis_com_oc40_xenial_force: False
     mirror_mirantis_com_oc41_xenial_force: False
diff --git a/defaults/docker_images.yml b/defaults/docker_images.yml
index 909ef05..e787bb3 100644
--- a/defaults/docker_images.yml
+++ b/defaults/docker_images.yml
@@ -1,14 +1,14 @@
 parameters:
   _param:
     # CI\CD
-    docker_image_compose:    "${_param:mcp_docker_registry}/mirantis/external/docker/compose:1.17.1"
+    docker_image_compose: "${_param:mcp_docker_registry}/mirantis/external/docker/compose:1.17.1"
     # 2.6.2 version, from 12/18/2108, differ from latest 2.6.2 upstream - update next cycle
     docker_image_registry:   "${_param:mcp_docker_registry}/mirantis/external/registry:${_param:mcp_version}"
     docker_image_visualizer: "${_param:mcp_docker_registry}/mirantis/external/visualizer:${_param:mcp_version}"
     docker_image_openldap: "${_param:mcp_docker_registry}/mirantis/external/osixia/openldap:1.2.2"
     docker_image_postgresql: "${_param:mcp_docker_registry}/mirantis/external/library/postgres:9.6.10"
     # 3.4.13, from Feb 15, differ from 3.4.13 upstream verison, from March 14 - update next cycle
-    docker_image_mongodb: "${_param:mcp_docker_registry}/mirantis/external/library/mongo:${_param:mcp_version}"
+    docker_image_mongodb: "${_param:mcp_docker_registry}/mirantis/external/mongo:${_param:mcp_version}"
     ###
     # phpldapadmin:0.6.12
     docker_image_phpldapadmin: "${_param:mcp_docker_registry}/mirantis/cicd/phpldapadmin:2019.2.5"
@@ -25,19 +25,19 @@
     docker_image_operations_api: "${_param:mcp_docker_registry}/mirantis/model-generator/operations-api:${_param:mcp_version}"
     docker_image_operations_ui: "${_param:mcp_docker_registry}/mirantis/model-generator/operations-ui:${_param:mcp_version}"
     # OpenContrail
-    opencontrail_docker_image_tag: "2019.2.5"
+    opencontrail_docker_image_tag: "2019.2.6"
     # stacklight
     # 6.5.0 version, from 11/29/2018, differ from latest upstream 6.5.0 - update next cycle
     docker_image_alerta: "${_param:mcp_docker_registry}/mirantis/external/alerta-web:${_param:mcp_version}"
     docker_image_alertmanager: "${_param:mcp_docker_registry}/openstack-docker/alertmanager:2019.2.4"
     docker_image_grafana: "${_param:mcp_docker_registry}/openstack-docker/grafana:${_param:mcp_version}"
-    docker_image_prometheus_es_exporter: "${_param:mcp_docker_registry}/openstack-docker/prometheus-es-exporter:2019.2.4"
-    docker_image_prometheus: "${_param:mcp_docker_registry}/openstack-docker/prometheus:${_param:mcp_version}"
+    docker_image_prometheus_es_exporter: "${_param:mcp_docker_registry}/openstack-docker/prometheus-es-exporter:2019.2.6"
+    docker_image_prometheus: "${_param:mcp_docker_registry}/openstack-docker/prometheus:2019.2.6"
     docker_image_prometheus_gainsight: "${_param:mcp_docker_registry}/openstack-docker/gainsight:2019.2.4"
     docker_image_prometheus_gainsight_elasticsearch: "${_param:mcp_docker_registry}/openstack-docker/gainsight_elasticsearch:${_param:mcp_version}"
     docker_image_prometheus_relay: "${_param:mcp_docker_registry}/openstack-docker/prometheus-relay:2019.2.5"
     docker_image_pushgateway: "${_param:mcp_docker_registry}/openstack-docker/pushgateway:${_param:mcp_version}"
-    docker_image_remote_agent: "${_param:mcp_docker_registry}/openstack-docker/telegraf:2019.2.5"
+    docker_image_remote_agent: "${_param:mcp_docker_registry}/openstack-docker/telegraf:2019.2.6"
     docker_image_remote_collector: "${_param:mcp_docker_registry}/openstack-docker/heka:${_param:mcp_version}"
     docker_image_remote_storage_adapter: "${_param:mcp_docker_registry}/openstack-docker/remote_storage_adapter:${_param:mcp_version}"
     docker_image_sf_notifier: "${_param:mcp_docker_registry}/openstack-docker/sf_notifier:2019.2.4"
@@ -47,11 +47,11 @@
     docker_image_keycloak_server: "${_param:mcp_docker_registry}/mirantis/external/jboss/keycloak:4.5.0.Final"
     docker_image_keycloak_proxy: "${_param:mcp_docker_registry}/mirantis/external/jboss/keycloak:3.4.2.Final"
     # CVP
-    docker_image_cvp_sanity_checks: ${_param:mcp_docker_registry}/mirantis/cvp/cvp-sanity-checks:2019.2.5
+    docker_image_cvp_sanity_checks: "${_param:mcp_docker_registry}/mirantis/cvp/cvp-sanity-checks:2019.2.6"
     docker_image_cvp_tempest: "${_param:mcp_docker_registry}/mirantis/cicd/ci-tempest:${_param:openstack_version}"
-    docker_image_cvp_shaker_checks: ${_param:mcp_docker_registry}/mirantis/cvp/cvp-shaker:2019.2.3
-    docker_image_cvp_rally: ${_param:mcp_docker_registry}/mirantis/cvp/cvp-rally:2019.2.5
-    docker_image_cvp_xrally: xrally/xrally-openstack:0.11.2
+    docker_image_cvp_shaker_checks: "${_param:mcp_docker_registry}/mirantis/cvp/cvp-shaker:2019.2.3"
+    docker_image_cvp_rally: "${_param:mcp_docker_registry}/mirantis/cvp/cvp-rally:2019.2.5"
+    docker_image_cvp_xrally: "${_param:mcp_docker_registry}/mirantis/external/xrally/xrally-openstack:0.11.2"
     # aptly
     docker_image_aptly:
       base: "${_param:mcp_docker_registry}/mirantis/cicd/aptly:${_param:mcp_version}"
@@ -82,7 +82,7 @@
           name: postgres:9.6.10
         - registry: ${_param:mcp_docker_registry}/mirantis/cicd
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/cicd
-          name: phpldapadmin:${_param:mcp_version}
+          name: phpldapadmin:2019.2.5
 
         - registry: ${_param:mcp_docker_registry}/mirantis/cicd
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/cicd
@@ -99,14 +99,17 @@
           name: jnlp-slave:${_param:mcp_version}
         - registry: ${_param:mcp_docker_registry}/mirantis/cicd
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/cicd
-          name: jenkins:${_param:mcp_version}
+          name: ssh-slave:2019.2.5
         - registry: ${_param:mcp_docker_registry}/mirantis/cicd
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/cicd
-          name: gerrit:${_param:mcp_version}
+          name: jenkins:2019.2.5
+        - registry: ${_param:mcp_docker_registry}/mirantis/cicd
+          target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/cicd
+          name: gerrit:2019.2.5
           # stacklight
         - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
-          name: alertmanager:${_param:mcp_version}
+          name: alertmanager:2019.2.4
         - registry: ${_param:mcp_docker_registry}/mirantis/external
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/external
           name: alerta-web:${_param:mcp_version}
@@ -115,52 +118,69 @@
           name: pushgateway:${_param:mcp_version}
         - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
-          name: prometheus:${_param:mcp_version}
+          name: prometheus:2019.2.6
         - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
-          name: gainsight:${_param:mcp_version}
+          name: gainsight:2019.2.4
         - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
-          name: telegraf:${_param:mcp_version}
+          name: telegraf:2019.2.6
         - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
           name: remote_storage_adapter:${_param:mcp_version}
         - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
-          name: prometheus_relay:${_param:mcp_version}
+          name: prometheus-relay:2019.2.5
         - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
           name: grafana:${_param:mcp_version}
         - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
           name: heka:${_param:mcp_version}
-        - registry: ${_param:mcp_docker_registry}/mirantis/external
-          target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/external
-          name: elasticsearch:${_param:mcp_version}
         - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
           name: sf_notifier:2019.2.4
         - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
           name: gainsight_elasticsearch:${_param:mcp_version}
-        - registry: ${_param:mcp_docker_registry}/mirantis/external/braedon
+        - registry: ${_param:mcp_docker_registry}/openstack-docker
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/openstack-docker
-          name: prometheus-es-exporter:2019.2.4
+          name: prometheus-es-exporter:2019.2.6
+
+        # OpenContrail 4.1
+        - registry: ${_param:mcp_docker_registry}/opencontrail-oc41
+          target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/opencontrail-oc41
+          name: opencontrail-analytics:${_param:opencontrail_docker_image_tag}
+        - registry: ${_param:mcp_docker_registry}/opencontrail-oc41
+          target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/opencontrail-oc41
+          name: opencontrail-analyticsdb:${_param:opencontrail_docker_image_tag}
+        - registry: ${_param:mcp_docker_registry}/opencontrail-oc41
+          target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/opencontrail-oc41
+          name: opencontrail-controller:${_param:opencontrail_docker_image_tag}
 
         # QA\CVP tool-set's
-        - registry: ${_param:mcp_docker_registry}/mirantis/oss
-          target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/oss
-          name: qa-tools:${_param:mcp_version}
+        - registry: ${_param:mcp_docker_registry}/mirantis/cicd
+          target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/cicd
+          name: ci-tempest:pike
+        - registry: ${_param:mcp_docker_registry}/mirantis/cicd
+          target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/cicd
+          name: ci-tempest:queens
         - registry: ${_param:mcp_docker_registry}/mirantis/cvp
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/cvp
-          name: cvp-rally:${_param:mcp_version}
+          name: cvp-rally:2019.2.5
         - registry: ${_param:mcp_docker_registry}/mirantis/cvp
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/cvp
-          name: cvp-spt:${_param:mcp_version}
+          name: cvp-shaker:2019.2.3
         - registry: ${_param:mcp_docker_registry}/mirantis/cvp
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/cvp
-          name: cvp-sanity-checks:${_param:mcp_version}
+          name: cvp-sanity-checks:2019.2.6
+        - registry: ${_param:mcp_docker_registry}/mirantis/external/xrally
+          target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/external/xrally
+          name: xrally-openstack:0.11.2
           #
         - registry: ${_param:mcp_docker_registry}/mirantis/cicd
           target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/cicd
           name: mysql:${_param:mcp_version}
+        - registry: ${_param:mcp_docker_registry}/mirantis/external
+          target_registry: ${_param:default_local_mirrror_content:docker_client_registry_target_registry}/mirantis/external
+          name: mongo:${_param:mcp_version}
diff --git a/defaults/git/init.yml b/defaults/git/init.yml
index 14dd599..88bfc96 100644
--- a/defaults/git/init.yml
+++ b/defaults/git/init.yml
@@ -6,16 +6,14 @@
     default_local_mirrror_content:
       git_server_repos:
        - name: mk-pipelines
-         url: https://github.com/Mirantis/mk-pipelines.git
+         url: https://gerrit.mcp.mirantis.com/mk/mk-pipelines
        - name: pipeline-library
-         url: https://github.com/Mirantis/pipeline-library.git
+         url: https://gerrit.mcp.mirantis.com/mcp-ci/pipeline-library
+       - name: reclass-system
+         url: https://gerrit.mcp.mirantis.com/salt-models/reclass-system
        - name: cvp-sanity-checks
-         url: https://github.com/Mirantis/cvp-sanity-checks.git
-       - name: cvp-spt
-         url: https://github.com/Mirantis/cvp-spt.git
+         url: https://gerrit.mcp.mirantis.com/mcp/cvp-sanity-checks
        - name: stacklight-pytest
-         url: https://github.com/Mirantis/stacklight-pytest
+         url: https://gerrit.mcp.mirantis.com/mcp/stacklight-pytest
        - name: cvp-configuration
-         url: https://github.com/Mirantis/cvp-configuration.git
-       - name: rundeck-cis-jobs
-         url: https://github.com/Mirantis/rundeck-cis-jobs.git
+         url: https://gerrit.mcp.mirantis.com/mcp/cvp-configuration
diff --git a/defaults/init.yml b/defaults/init.yml
index b7995d8..6c8684c 100644
--- a/defaults/init.yml
+++ b/defaults/init.yml
@@ -49,7 +49,7 @@
     # Other
     salt_control_xenial_image_backend: /var/lib/libvirt/images/backends/xenial.qcow2
     salt_control_trusty_image_backend: /var/lib/libvirt/images/backends/trusty.qcow2
-    salt_minion_ca_host: cfg01.${_param:cluster_domain}
+    salt_minion_ca_host: ${_param:infra_config_hostname}.${_param:cluster_domain}
     # Make sure this global variable is defined everywhere, where used it is already set on cluster level
     cluster_public_host: '127.0.0.1'
     single_address: '127.0.0.1'
diff --git a/defaults/linux_system_file.yml b/defaults/linux_system_file.yml
index c37c030..de7b524 100644
--- a/defaults/linux_system_file.yml
+++ b/defaults/linux_system_file.yml
@@ -26,3 +26,9 @@
         amphora-x64-haproxy-queens.qcow2.md5:
           source: ${_param:mcp_binary_registry}/mirantis/openstack/octavia/images/${_param:mcp_version}/queens/amphora-x64-haproxy.qcow2.md5
           name: /srv/http/artifactory.mirantis.com/artifactory/binary-prod-local/mirantis/openstack/octavia/images/${_param:mcp_version}/queens/amphora-x64-haproxy.qcow2.md5
+        cirros-0.4.0-x86_64-disk.img:
+          source: ${_param:mcp_binary_registry}/mirantis/external/images/cirros/0.4.0/cirros-0.4.0-x86_64-disk.img
+          name: /srv/http/artifactory.mirantis.com/artifactory/binary-prod-local/mirantis/external/images/cirros/0.4.0/cirros-0.4.0-x86_64-disk.img
+        Fedora-Cloud-Base-27-1.6.x86_64.qcow2:
+          source: ${_param:mcp_binary_registry}/mirantis/external/images/cloud-fedora/27/Fedora-Cloud-Base-27-1.6.x86_64.qcow2
+          name: /srv/http/artifactory.mirantis.com/artifactory/binary-prod-local/mirantis/external/images/cloud-fedora/27/Fedora-Cloud-Base-27-1.6.x86_64.qcow2
diff --git a/defaults/linux_system_repo.yml b/defaults/linux_system_repo.yml
index 74c5f41..922acc0 100644
--- a/defaults/linux_system_repo.yml
+++ b/defaults/linux_system_repo.yml
@@ -12,6 +12,7 @@
     linux_system_repo_mcp_glusterfs_url: ${_param:linux_system_repo_url}/glusterfs-${_param:linux_system_repo_mcp_glusterfs_version_number}/
     linux_system_repo_mcp_influxdb_url: ${_param:linux_system_repo_url}/influxdb/
     linux_system_repo_mcp_maas_url: ${_param:linux_system_repo_url}/maas/
+    linux_system_repo_mcp_update_maas_url: ${_param:linux_system_repo_update_url}/maas/
     #
     linux_system_repo_mcp_elasticsearch_curator_url: ${_param:linux_system_repo_url}/elasticsearch-curator-5/
     linux_system_repo_mcp_update_elasticsearch_curator_url: ${_param:linux_system_repo_update_url}/elasticsearch-curator-5/
diff --git a/defaults/maas.yml b/defaults/maas.yml
index df932c8..db31590 100644
--- a/defaults/maas.yml
+++ b/defaults/maas.yml
@@ -4,14 +4,14 @@
       maas_mirror_image_sections:
         bootloaders:
           keyring: /usr/share/keyrings/ubuntu-cloudimage-keyring.gpg
-          upstream: ${_param:linux_system_repo_url}/maas-ephemeral-v3/
+          upstream: ${_param:linux_system_repo_update_url}/maas-ephemeral-v3/
           local_dir: /srv/http/${_param:mcp_version}/maas-ephemeral-v3/
           count: 1
           # i386 need for pxe
           filters: ['arch~(i386|amd64)', 'os~(grub*|pxelinux*)']
         xenial:
           keyring: /usr/share/keyrings/ubuntu-cloudimage-keyring.gpg
-          upstream: ${_param:linux_system_repo_url}/maas-ephemeral-v3/
+          upstream: ${_param:linux_system_repo_update_url}/maas-ephemeral-v3/
           local_dir: /srv/http/${_param:mcp_version}/maas-ephemeral-v3/
           count: 1
           filters: ['release~(xenial)', 'arch~(amd64)', 'subarch~(generic|hwe-16*|ga-16*)']
diff --git a/defaults/openstack/init.yml b/defaults/openstack/init.yml
index 19b3fe8..c37e551 100644
--- a/defaults/openstack/init.yml
+++ b/defaults/openstack/init.yml
@@ -142,6 +142,7 @@
     keystone_ironic_username: ironic
     ironic_memcache_security_enabled: ${_param:openstack_memcache_security_enabled}
     ironic_memcache_secret_key: ''
+    ironic_console_enabled: true
     # Keystone
     mysql_keystone_username: keystone
     keystone_old_version: ${_param:openstack_old_version}
@@ -235,6 +236,12 @@
     #
     amphora_image_name: amphora-x64-haproxy
     amphora_image_url: "${_param:mcp_binary_registry}/mirantis/openstack/octavia/images/${_param:mcp_version}/${_param:openstack_version}/amphora-x64-haproxy.qcow2"
+
+    glance_image_cirros_name: 'TestCirros-0.4.0'
+    glance_image_cirros_location: "${_param:mcp_binary_registry}/mirantis/external/images/cirros/0.4.0/cirros-0.4.0-x86_64-disk.img"
+
+    glance_image_fedora_name: 'TestFedora-27-1.6'
+    glance_image_fedora_location: "${_param:mcp_binary_registry}/mirantis/external/images/cloud-fedora/27/Fedora-Cloud-Base-27-1.6.x86_64.qcow2"
     # Sahara
     mysql_sahara_username: sahara
     keystone_sahara_username: sahara
diff --git a/docker/swarm/stack/aptly.yml b/docker/swarm/stack/aptly.yml
index 3282641..f4af5c6 100644
--- a/docker/swarm/stack/aptly.yml
+++ b/docker/swarm/stack/aptly.yml
@@ -22,6 +22,7 @@
                 - 18084:8080
               volumes:
                 - /srv/volumes/aptly:/var/lib/aptly
+                - /dev/urandom:/dev/random:ro
             public:
               deploy:
                 replicas: ${_param:docker_stack_aptly_public_replicas}
diff --git a/docker/swarm/stack/ldap.yml b/docker/swarm/stack/ldap.yml
index 1e12a4a..3091983 100644
--- a/docker/swarm/stack/ldap.yml
+++ b/docker/swarm/stack/ldap.yml
@@ -58,9 +58,9 @@
                 PHPLDAPADMIN_LDAP_ADMIN_PASSWORD: ${_param:openldap_admin_password}
                 PHPLDAPADMIN_LDAP_HOSTS: "#PYTHON2BASH:[{'server': [{'server': [{'host': 'ldaps://${_param:cicd_control_address}', 'tls': False}]},{'login': [{'bind_id': 'cn=admin,${_param:openldap_dn}'},{'bind_pass': '$PHPLDAPADMIN_LDAP_ADMIN_PASSWORD'}]}]}]"
                 PHPLDAPADMIN_LDAP_CLIENT_TLS: "true"
-                PHPLDAPADMIN_LDAP_CLIENT_TLS_CA_CRT_FILENAME: drivetrain_ldap.crt
-                PHPLDAPADMIN_LDAP_CLIENT_TLS_CRT_FILENAME: drivetrain_ldap.key
-                PHPLDAPADMIN_LDAP_CLIENT_TLS_KEY_FILENAME: ca.crt
+                PHPLDAPADMIN_LDAP_CLIENT_TLS_CA_CRT_FILENAME: ca.crt
+                PHPLDAPADMIN_LDAP_CLIENT_TLS_CRT_FILENAME: drivetrain_ldap.crt
+                PHPLDAPADMIN_LDAP_CLIENT_TLS_KEY_FILENAME: drivetrain_ldap.key
                 PHPLDAPADMIN_LDAP_CLIENT_TLS_REQCERT: 'try'
                 PHPLDAPADMIN_HTTPS: "false"
                 PHPLDAPADMIN_TRUST_PROXY_SSL: "true"
diff --git a/docker/swarm/stack/monitoring/elasticsearch_exporter.yml b/docker/swarm/stack/monitoring/elasticsearch_exporter.yml
index ce02782..86a1ae6 100644
--- a/docker/swarm/stack/monitoring/elasticsearch_exporter.yml
+++ b/docker/swarm/stack/monitoring/elasticsearch_exporter.yml
@@ -12,7 +12,7 @@
                 encrypted: 1
           service:
             elasticsearch_exporter:
-              command: --es-cluster ${_param:fluentd_elasticsearch_scheme}://${_param:stacklight_log_address}:9200 --nodes-stats-disable --cluster-health-disable --indices-stats-disable
+              command: --es-cluster ${_param:fluentd_elasticsearch_scheme}://${_param:stacklight_log_address}:9200 --nodes-stats-disable --cluster-health-disable --indices-stats-disable --ca-certs /etc/ssl/certs/ca-certificates.crt
               networks:
                 - monitoring
               deploy:
diff --git a/glance/control/cluster.yml b/glance/control/cluster.yml
index 763ad09..0eae619 100644
--- a/glance/control/cluster.yml
+++ b/glance/control/cluster.yml
@@ -55,6 +55,8 @@
         region: ${_param:openstack_region}
         tenant: service
         protocol: ${_param:cluster_internal_protocol}
+        service_token_roles: admin
+        service_token_roles_required: true
       barbican:
         enabled: ${_param:barbican_integration_enabled}
       message_queue:
diff --git a/glance/control/single.yml b/glance/control/single.yml
index 24e9c3f..160d26d 100644
--- a/glance/control/single.yml
+++ b/glance/control/single.yml
@@ -29,6 +29,8 @@
       identity:
         region: ${_param:openstack_region}
         protocol: ${_param:internal_protocol}
+        service_token_roles: admin
+        service_token_roles_required: true
       registry:
         protocol: ${_param:internal_protocol}
       barbican:
diff --git a/ironic/api/cluster.yml b/ironic/api/cluster.yml
index 0d6587d..cd6c667 100644
--- a/ironic/api/cluster.yml
+++ b/ironic/api/cluster.yml
@@ -17,6 +17,7 @@
       bind:
         address: ${_param:cluster_baremetal_local_address}
       database:
+        user: ${_param:mysql_ironic_username}
         x509:
           enabled: ${_param:openstack_mysql_x509_enabled}
           ca_file: ${_param:mysql_ironic_ssl_ca_file}
@@ -44,3 +45,7 @@
           secret_key: ${_param:ironic_memcache_secret_key}
       identity:
         region: ${_param:openstack_region}
+        protocol: ${_param:cluster_internal_protocol}
+        user: ${_param:keystone_ironic_username}
+      middleware:
+        enable_proxy_headers_parsing: true
diff --git a/ironic/api/single.yml b/ironic/api/single.yml
index 5eb290b..db39076 100644
--- a/ironic/api/single.yml
+++ b/ironic/api/single.yml
@@ -15,6 +15,7 @@
       bind:
         address: ${_param:single_address}
       database:
+        user: ${_param:mysql_ironic_username}
         x509:
           enabled: ${_param:openstack_mysql_x509_enabled}
           ca_file: ${_param:mysql_ironic_ssl_ca_file}
@@ -38,3 +39,7 @@
           secret_key: ${_param:ironic_memcache_secret_key}
       identity:
         region: ${_param:openstack_region}
+        protocol: ${_param:cluster_internal_protocol}
+        user: ${_param:keystone_ironic_username}
+      middleware:
+        enable_proxy_headers_parsing: true
diff --git a/ironic/conductor/cluster.yml b/ironic/conductor/cluster.yml
index eb0b38f..69cc3dc 100644
--- a/ironic/conductor/cluster.yml
+++ b/ironic/conductor/cluster.yml
@@ -3,6 +3,8 @@
 - system.salt.minion.cert.rabbitmq.clients.openstack.ironic
 - service.ironic.conductor.cluster
 parameters:
+  _param:
+    ironic_conductor_api_url_protocol: 'http'
   linux:
     system:
       package:
@@ -11,8 +13,9 @@
           version: latest
   ironic:
     conductor:
-      api_url: 'http://${_param:cluster_baremetal_vip_address}:6385'
+      api_url: '${_param:ironic_conductor_api_url_protocol}://${_param:cluster_baremetal_vip_address}:6385'
       database:
+        user: ${_param:mysql_ironic_username}
         x509:
           enabled: ${_param:openstack_mysql_x509_enabled}
           ca_file: ${_param:mysql_ironic_ssl_ca_file}
@@ -40,3 +43,16 @@
           secret_key: ${_param:ironic_memcache_secret_key}
       identity:
         region: ${_param:openstack_region}
+        protocol: ${_param:cluster_internal_protocol}
+        user: ${_param:keystone_ironic_username}
+      automated_clean: true
+      erase_devices_priority: 0
+      erase_devices_metadata_priority: 1
+      console:
+        enabled: ${_param:ironic_console_enabled}
+      enabled_console_interfaces:
+        - ipmitool-shellinabox
+        - ipmitool-socat
+        - no-console
+      pxe_append_params: 'nofb nomodeset vga=normal ipa-insecure=1'
+      default_boot_option: local
diff --git a/ironic/conductor/single.yml b/ironic/conductor/single.yml
index 36d92be..88179a3 100644
--- a/ironic/conductor/single.yml
+++ b/ironic/conductor/single.yml
@@ -14,6 +14,7 @@
       enabled: true
       version: ${_param:ironic_version}
       database:
+        user: ${_param:mysql_ironic_username}
         x509:
           enabled: ${_param:openstack_mysql_x509_enabled}
           ca_file: ${_param:mysql_ironic_ssl_ca_file}
@@ -37,3 +38,16 @@
           secret_key: ${_param:ironic_memcache_secret_key}
       identity:
         region: ${_param:openstack_region}
+        protocol: ${_param:cluster_internal_protocol}
+        user: ${_param:keystone_ironic_username}
+      automated_clean: true
+      erase_devices_priority: 0
+      erase_devices_metadata_priority: 1
+      console:
+        enabled: ${_param:ironic_console_enabled}
+      enabled_console_interfaces:
+        - ipmitool-shellinabox
+        - ipmitool-socat
+        - no-console
+      pxe_append_params: 'nofb nomodeset vga=normal ipa-insecure=1'
+      default_boot_option: local
diff --git a/jenkins/client/job/ceph/add-osd-upmap.yml b/jenkins/client/job/ceph/add-osd-upmap.yml
index 949154d..9e95894 100644
--- a/jenkins/client/job/ceph/add-osd-upmap.yml
+++ b/jenkins/client/job/ceph/add-osd-upmap.yml
@@ -5,7 +5,7 @@
         ceph-add-osd-upmap:
           type: workflow-scm
           concurrent: true
-          display_name: "Ceph - add osd"
+          display_name: "Ceph - add osd ( upmap )"
           description: "This pipeline requires ceph luminous version, all clients must be upgraded to luminous version to proceed."
           discard:
             build:
diff --git a/jenkins/client/job/deploy/backupninja_backup.yml b/jenkins/client/job/deploy/backupninja_backup.yml
index 147b32b..690ae0a 100644
--- a/jenkins/client/job/deploy/backupninja_backup.yml
+++ b/jenkins/client/job/deploy/backupninja_backup.yml
@@ -5,7 +5,7 @@
         backupninja_backup:
           type: workflow-scm
           name: backupninja-backup
-          display_name: "Backupninja salt-master/MaaS backup"
+          display_name: "Backupninja backup pipeline"
           discard:
             build:
               keep_num: 50
@@ -26,6 +26,12 @@
             ASK_CONFIRMATION:
               type: boolean
               default: 'true'
+            BACKUP_SALTMASTER_AND_MAAS:
+              type: boolean
+              default: 'true'
+            BACKUP_DOGTAG:
+              type: boolean
+              default: 'true'
           trigger:
             timer:
               enabled: true
diff --git a/jenkins/client/job/deploy/backupninja_restore.yml b/jenkins/client/job/deploy/backupninja_restore.yml
index 192f5dc..76a594e 100644
--- a/jenkins/client/job/deploy/backupninja_restore.yml
+++ b/jenkins/client/job/deploy/backupninja_restore.yml
@@ -6,7 +6,7 @@
         backupninja_restore:
           type: workflow-scm
           name: backupninja-restore
-          display_name: "Backupninja restore salt-master/MaaS backup"
+          display_name: "Backupninja restore pipeline"
           discard:
             build:
               keep_num: 50
@@ -24,3 +24,9 @@
             SALT_MASTER_URL:
               type: string
               default: "${_param:jenkins_salt_api_url}"
+            RESTORE_SALTMASTER_AND_MAAS: #TODO: Salt-master and MaaS backup should be separated. See https://mirantis.jira.com/browse/PROD-33616 for more info.
+              type: boolean
+              default: 'true'
+            RESTORE_DOGTAG:
+              type: boolean
+              default: 'true'
diff --git a/jenkins/client/job/deploy/openstack.yml b/jenkins/client/job/deploy/openstack.yml
index 3734741..8b82037 100644
--- a/jenkins/client/job/deploy/openstack.yml
+++ b/jenkins/client/job/deploy/openstack.yml
@@ -25,6 +25,10 @@
               type: string
               default: "core,kvm,openstack,stacklight"
               description: "Components to be installed. Valid values are 'core,kvm,k8s,openstack,contrail,ovs,ceph,oss,cicd,stacklight,sl-legacy,finalize'. For all deployments it's recommended to run 'finalize' as a final step as Salt highstate on all nodes will be run."
+            BATCH_SIZE:
+              type: string
+              default: ''
+              description: 'Use batching for states, which targeted for large amount of nodes. Can be Integer or Percentage, e.g 20 or 20%'
             # salt master
             SALT_MASTER_CREDENTIALS:
               type: string
@@ -64,3 +68,7 @@
               type: string
               default: ""
               description: "Salt compound target to match nodes to be updated [*, G@osfamily:debian]."
+            BATCH_SIZE:
+              type: string
+              default: ''
+              description: 'Use batching for states, which targeted for large amount of nodes. Can be Integer or Percentage, e.g 20 or 20%'
diff --git a/jenkins/client/job/deploy/update/package.yml b/jenkins/client/job/deploy/update/package.yml
index 7444bcc..89a0c1b 100644
--- a/jenkins/client/job/deploy/update/package.yml
+++ b/jenkins/client/job/deploy/update/package.yml
@@ -31,6 +31,14 @@
               type: string
               default: "*"
               description: Salt compound target to match nodes to be updated [*, G@osfamily:debian].
+            ALLOW_DEPENDENCY_UPDATE:
+              type: boolean
+              default: 'false'
+              description: "Allow to install new packages which come as dependencies for updated packages."
+            BATCH_SIZE:
+              type: string
+              default: ''
+              description: 'Use batching for states, which targeted for large amount of nodes. Can be Integer or Percentage, e.g 20 or 20%'
             TARGET_PACKAGES:
               type: string
               description: Space delimited list of packages to be updated, empty string means updating all packages to the latest version e.g. [package1=version package2=version] or [package1 package2].
diff --git a/jenkins/client/job/deploy/update/upgrade_mcp_release.yml b/jenkins/client/job/deploy/update/upgrade_mcp_release.yml
index 091d169..2019945 100644
--- a/jenkins/client/job/deploy/update/upgrade_mcp_release.yml
+++ b/jenkins/client/job/deploy/update/upgrade_mcp_release.yml
@@ -43,13 +43,15 @@
                 ---
                 SALT_MASTER_URL: "${_param:jenkins_salt_api_url}"
                 SALT_MASTER_CREDENTIALS: "salt"
+                # Use batching for states, which targeted for large amount of nodes. Can be Integer or Percentage, e.g 20 or 20%
+                BATCH_SIZE: ''
                 # Replace `mcp_version` parameter to TARGET_MCP_VERSION in cluster level Reclass model?
                 UPDATE_CLUSTER_MODEL: true
                 # Upgrade SaltStack packages
                 UPGRADE_SALTSTACK: true
                 # Mirror pipelines from upstream/local mirror to Gerrit
                 UPDATE_PIPELINES: true
-                # se only when local repositories are present
+                # Use only when local repositories are present
                 UPDATE_LOCAL_REPOS: false
                 # Next parameters added only for test purposes and not enabled by default
                 # RECLASS_SYSTEM_BRANCH: ''
diff --git a/jenkins/client/job/validate.yml b/jenkins/client/job/validate.yml
index ec79239..0fff778 100644
--- a/jenkins/client/job/validate.yml
+++ b/jenkins/client/job/validate.yml
@@ -6,8 +6,7 @@
           enabled: true
           type: ListView
           include_regex: "validate.*"
-      CVP:
-        cvp:
+        CVP:
           enabled: true
           type: ListView
           include_regex: "cvp.*"
diff --git a/keystone/server/notification/messagingv2.yml b/keystone/server/notification/messagingv2.yml
index 2cc7e64..0bddb91 100644
--- a/keystone/server/notification/messagingv2.yml
+++ b/keystone/server/notification/messagingv2.yml
@@ -1,6 +1,8 @@
 parameters:
+  _param:
+    keystone_notification_topics: "${_param:openstack_notification_topics}"
   keystone:
     server:
       notification:
         driver: messagingv2
-        topics: "${_param:openstack_notification_topics}"
+        topics: "${_param:keystone_notification_topics}"
diff --git a/linux/system/repo/mcp/apt_mirantis/update/maas.yml b/linux/system/repo/mcp/apt_mirantis/update/maas.yml
new file mode 100644
index 0000000..650db89
--- /dev/null
+++ b/linux/system/repo/mcp/apt_mirantis/update/maas.yml
@@ -0,0 +1,15 @@
+classes:
+- system.linux.system.repo.keystorage.maas
+parameters:
+  linux:
+    system:
+      repo:
+        mcp_maas_update:
+          source: "deb [arch=amd64] ${_param:linux_system_repo_mcp_update_maas_url}/${_param:linux_system_codename} ${_param:linux_system_codename} main"
+          key: ${_param:linux_system_repo_mcp_maas_key}
+          architectures: amd64
+          clean_file: true
+          pin:
+          - pin: 'release o=LP-PPA-maas-stable'
+            priority: 1100
+            package: '*'
diff --git a/maas/region/boot_sources/maas_ephemeral_v3/init.yml b/maas/region/boot_sources/maas_ephemeral_v3/init.yml
index 7406486..774395a 100644
--- a/maas/region/boot_sources/maas_ephemeral_v3/init.yml
+++ b/maas/region/boot_sources/maas_ephemeral_v3/init.yml
@@ -1,6 +1,6 @@
 parameters:
   _param:
-    maas_region_boot_sources_maas_ephemeral_v3_bs_url: http://mirror.mirantis.com/${_param:mcp_version}/maas-ephemeral-v3/
+    maas_region_boot_sources_maas_ephemeral_v3_bs_url: ${_param:linux_system_repo_update_url}/maas-ephemeral-v3/
   maas:
     region:
       boot_sources_delete_all_others: true
diff --git a/maas/region/single.yml b/maas/region/single.yml
index 309ef34..601b883 100644
--- a/maas/region/single.yml
+++ b/maas/region/single.yml
@@ -4,7 +4,7 @@
 parameters:
   _param:
     maas_admin_username: mirantis
-    maas_region_main_archive: http://mirror.mirantis.com/${_param:mcp_version}/ubuntu/
+    maas_region_main_archive: ${_param:linux_system_repo_update_url}/ubuntu/
   maas:
     cluster:
       enabled: true
diff --git a/neutron/gateway/cluster.yml b/neutron/gateway/cluster.yml
index 2a4f4f4..58aaab8 100644
--- a/neutron/gateway/cluster.yml
+++ b/neutron/gateway/cluster.yml
@@ -11,6 +11,7 @@
       kernel:
         sysctl:
           fs.inotify.max_user_instances: 4096
+          fs.file-max: 400000
   neutron:
     gateway:
       dvr: ${_param:neutron_gateway_dvr}
diff --git a/nginx/server/proxy/ceph_radosgw.yml b/nginx/server/proxy/ceph_radosgw.yml
index c69ec3a..8207bda 100644
--- a/nginx/server/proxy/ceph_radosgw.yml
+++ b/nginx/server/proxy/ceph_radosgw.yml
@@ -12,7 +12,16 @@
           enabled: true
           type: nginx_proxy
           name: ceph_radosgw
+          proxy_set_header:
+            Host:
+              enabled: true
+              value: "$host"
+            X-Forwarded-For:
+              enabled: true
+              value: "$remote_addr"
           proxy:
+            size: 10240m
+            buffer_size: 10240m
             host: ${_param:nginx_proxy_radosgw_service_host}
             port: ${_param:nginx_proxy_radosgw_service_port}
             protocol: http
diff --git a/nova/compute/cluster.yml b/nova/compute/cluster.yml
index 1fdb3bd..3154a37 100644
--- a/nova/compute/cluster.yml
+++ b/nova/compute/cluster.yml
@@ -42,6 +42,8 @@
         password: ${_param:keystone_nova_password}
         tenant: service
         protocol: ${_param:cluster_internal_protocol}
+        service_token_roles: admin
+        service_token_roles_required: true
       service_user:
         enabled: ${_param:nova_service_user_enabled}
       barbican:
diff --git a/nova/compute/single.yml b/nova/compute/single.yml
index 2c47148..a6126ef 100644
--- a/nova/compute/single.yml
+++ b/nova/compute/single.yml
@@ -41,6 +41,8 @@
         tenant: service
         protocol: ${_param:cluster_internal_protocol}
         region: ${_param:openstack_region}
+        service_token_roles: admin
+        service_token_roles_required: true
       barbican:
         enabled: ${_param:barbican_integration_enabled}
       service_user:
diff --git a/nova/control/cluster.yml b/nova/control/cluster.yml
index 325c6a5..7541d28 100644
--- a/nova/control/cluster.yml
+++ b/nova/control/cluster.yml
@@ -61,6 +61,8 @@
         password: ${_param:keystone_nova_password}
         tenant: service
         protocol: ${_param:cluster_internal_protocol}
+        service_token_roles: admin
+        service_token_roles_required: true
       service_user:
         enabled: ${_param:nova_service_user_enabled}
       barbican:
diff --git a/nova/control/single.yml b/nova/control/single.yml
index 11a0f53..e964f76 100644
--- a/nova/control/single.yml
+++ b/nova/control/single.yml
@@ -25,6 +25,8 @@
       identity:
         protocol: ${_param:cluster_internal_protocol}
         region: ${_param:openstack_region}
+        service_token_roles: admin
+        service_token_roles_required: true
       service_user:
         enabled: ${_param:nova_service_user_enabled}
       network:
diff --git a/opencontrail/common/init.yml b/opencontrail/common/init.yml
new file mode 100644
index 0000000..e24a9c3
--- /dev/null
+++ b/opencontrail/common/init.yml
@@ -0,0 +1,10 @@
+parameters:
+  linux:
+    system:
+      kernel:
+        sysctl:
+          net.ipv4.tcp_keepalive_intvl: 1
+          net.ipv4.tcp_keepalive_time: 5
+          net.ipv4.tcp_keepalive_probes: 5
+          net.nf_conntrack_max: 256000
+          fs.file-max: 124165
\ No newline at end of file
diff --git a/openssh/server/team/members/qwu.yml b/openssh/server/team/members/qwu.yml
new file mode 100644
index 0000000..c6d0730
--- /dev/null
+++ b/openssh/server/team/members/qwu.yml
@@ -0,0 +1,19 @@
+parameters:
+  linux:
+    system:
+      user:
+        qwu:
+          email: qwu@mirantis.com
+          enabled: true
+          full_name: Qihuan Wu
+          home: /home/qwu
+          name: qwu
+          sudo: ${_param:linux_system_user_sudo}
+  openssh:
+    server:
+      user:
+        qwu:
+          enabled: true
+          public_keys:
+          - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7d/s8D6FR/eymzT+5NETkIjmA/oFsUsV8z/ITycmRg5yXzXhD/Y+yr85B5qE/Xr0c+FUBuWoKnwjWWX4ocdXb9lSoWvAnqYH/hn4bT5Fy6+30gFmb68Ab2cvKnJ9NW6maR62llikTcwnxFfX1fH5N9B+hcGUqEJOmGXY6zYCfGDRq7jcmfowE/xdQhGnTzdDtI0CvH3yJNhdu8S5N6badL3v+vLW0LnrbQQDeqzioWuJV27CMZC/jp/DL8Naf43VdfzPT8gPUWEfeLeShoxtFx2IzB2AE3xgypYXxOvsNWomqrH/8fwnQGT3L7aU/chAOHoF6W/1ELlLeI4/MXX/r ${linux:system:user:qwu:email}
+          user: ${linux:system:user:qwu}
\ No newline at end of file
diff --git a/openssh/server/team/members/vkuspits.yml b/openssh/server/team/members/vkuspits.yml
new file mode 100644
index 0000000..9cf66de
--- /dev/null
+++ b/openssh/server/team/members/vkuspits.yml
@@ -0,0 +1,19 @@
+parameters:
+  linux:
+    system:
+      user:
+        vkuspits:
+          email: vkuspits@mirantis.com
+          enabled: true
+          full_name: "Vladislav Kuspits"
+          home: /home/vkuspits
+          name: vkuspits
+          sudo: ${_param:linux_system_user_sudo}
+  openssh:
+    server:
+      user:
+        vkuspits:
+          enabled: true
+          public_keys:
+          - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDPI/sOPVQSFnuaZEmXI/H/FJr543ClBpS55MQojMJxTmPTpdrjXfaX1NOEuHSM5bF7aXbiCCTdz2ZomtCWlm300asF/4vT+vsta57+6MdaiOVR5Fyj1LqHAFs0zcJROyhbNWm0sZjljJ95u7J+KwbmMWefq3ngqihgi6/yX3zqVuc7f8edG/X8MXq6c49sZYNZvvlgXrtBdRB5B/Pxhpa/N2xf1hJ0yR2WGhybgXLXLFz4fxINGacHbxx3c+0nPG90b8FSXmiNUDZtTWsV6VvO7K6TB6QM6Y/S+kghlnUA4yZkydUn9ZDP6/WUg9PuzzG3vTUltrMESr3+H80BBTIT
+          user: ${linux:system:user:vkuspits}
diff --git a/openssh/server/team/members/wnawrot.yml b/openssh/server/team/members/wnawrot.yml
new file mode 100644
index 0000000..a6dd3b1
--- /dev/null
+++ b/openssh/server/team/members/wnawrot.yml
@@ -0,0 +1,19 @@
+parameters:
+  linux:
+    system:
+      user:
+        wnawrot:
+          email: wnawrot@mirantis.com
+          enabled: true
+          full_name: Wojciech Nawrot
+          home: /home/wnawrot
+          name: wnawrot
+          sudo: ${_param:linux_system_user_sudo}
+  openssh:
+    server:
+      user:
+        wnawrot:
+          enabled: true
+          public_keys:
+          - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDZCKyblo+QrhAFFum+ZLQHq+gnY7Cmo/OgdYC/+RgApo5aImj2c5Ttkme0zJ6kw22SDrBeOfR4/RVZpY60PZ0KRXvWKNhuvuK+EeUGDaXlezSh98m3GHrtCMzLS3V81WUp2YXK4xGEB3JsAXVDKYkCLPMtgwfBAS7bHuBQkWojf+jfmRxGS1dvwUdUi96i//+0QGLkltO6tfsruJwztsSa4Xx+EhhwPuIGnJIXoJZXU6bw/xEg13C5NiI+EXDLmnR6yQt+vHHZzZWLnBM46JplZ+zUuAnqvihp/ovePSt7jKBumh1cbadOjgP18UZX3GhTBekF4aXUrUqVlzHYlr/X
+          user: ${linux:system:user:wnawrot}
diff --git a/openssh/server/team/services.yml b/openssh/server/team/services.yml
index 61eab35..6dd92e5 100644
--- a/openssh/server/team/services.yml
+++ b/openssh/server/team/services.yml
@@ -1,28 +1,25 @@
 classes:
 - system.linux.system.sudo
-- system.openssh.server.team.members.mniedbala
-- system.openssh.server.team.members.pmichalec
-- system.openssh.server.team.members.pcizinsky
-- system.openssh.server.team.members.lmercl
-- system.openssh.server.team.members.pruzicka
-- system.openssh.server.team.members.korlowska
-- system.openssh.server.team.members.miwinski
-- system.openssh.server.team.members.mlos
+- system.openssh.server.team.members.alis
+- system.openssh.server.team.members.alugovoi
 - system.openssh.server.team.members.dbogaczyk
 - system.openssh.server.team.members.dkruglov
-- system.openssh.server.team.members.sflorczak
-- system.openssh.server.team.members.alugovoi
-- system.openssh.server.team.members.tjaroszyk
-- system.openssh.server.team.members.sburns
-- system.openssh.server.team.members.yisakov
-- system.openssh.server.team.members.vblokhin
 - system.openssh.server.team.members.dstremkouski
-- system.openssh.server.team.members.osavatieiev
-- system.openssh.server.team.members.mchernik
 - system.openssh.server.team.members.hkraemer
-- system.openssh.server.team.members.pbasov
-- system.openssh.server.team.members.alis
 - system.openssh.server.team.members.isviridov
+- system.openssh.server.team.members.korlowska
+- system.openssh.server.team.members.lmercl
+- system.openssh.server.team.members.mchernik
+- system.openssh.server.team.members.mlos
+- system.openssh.server.team.members.osavatieiev
+- system.openssh.server.team.members.pbasov
+- system.openssh.server.team.members.pruzicka
+- system.openssh.server.team.members.qwu
+- system.openssh.server.team.members.sburns
+- system.openssh.server.team.members.tjaroszyk
+- system.openssh.server.team.members.vkuspits
+- system.openssh.server.team.members.yisakov
+- system.openssh.server.team.members.wnawrot
 parameters:
   _param:
     linux_system_user_sudo: true
diff --git a/rabbitmq/server/cluster.yml b/rabbitmq/server/cluster.yml
index 2971795..68d7eba 100644
--- a/rabbitmq/server/cluster.yml
+++ b/rabbitmq/server/cluster.yml
@@ -3,3 +3,7 @@
 - service.keepalived.cluster.single
 - service.haproxy.proxy.single
 - system.rabbitmq.upgrade
+parameters:
+  rabbitmq:
+    server:
+      ulimit: 24576
\ No newline at end of file
diff --git a/rabbitmq/server/single.yml b/rabbitmq/server/single.yml
index 9982957..4d2785d 100644
--- a/rabbitmq/server/single.yml
+++ b/rabbitmq/server/single.yml
@@ -1,3 +1,7 @@
 classes:
 - service.rabbitmq.server.single
 - system.rabbitmq.upgrade
+parameters:
+  rabbitmq:
+    server:
+      ulimit: 24576
\ No newline at end of file
diff --git a/reclass/storage/system/cicd_control_cluster.yml b/reclass/storage/system/cicd_control_cluster.yml
index 34f0de1..94687ef 100644
--- a/reclass/storage/system/cicd_control_cluster.yml
+++ b/reclass/storage/system/cicd_control_cluster.yml
@@ -19,6 +19,7 @@
             keepalived_vip_priority: 103
             cicd_database_id: 1
             glusterfs_node_role: primary
+            drivetrain_role: cicd
         cicd_control_node02:
           name: ${_param:cicd_control_node02_hostname}
           domain: ${_param:cluster_domain}
@@ -31,6 +32,7 @@
             keepalived_vip_priority: 102
             cicd_database_id: 2
             glusterfs_node_role: secondary
+            drivetrain_role: cicd
         cicd_control_node03:
           name: ${_param:cicd_control_node03_hostname}
           domain: ${_param:cluster_domain}
@@ -43,3 +45,4 @@
             keepalived_vip_priority: 101
             cicd_database_id: 3
             glusterfs_node_role: secondary
+            drivetrain_role: cicd
\ No newline at end of file
diff --git a/salt/control/sizes/openstack/golden.yml b/salt/control/sizes/openstack/golden.yml
index 47a35e4..39d70d9 100644
--- a/salt/control/sizes/openstack/golden.yml
+++ b/salt/control/sizes/openstack/golden.yml
@@ -39,7 +39,7 @@
     salt_control_size_cpu_openstack_baremetal: 4
     salt_control_size_ram_openstack_baremetal: 4096
     salt_control_size_disk_profile_openstack_baremetal: small
-    salt_control_size_net_profile_openstack_baremetal: default
+    salt_control_size_net_profile_openstack_baremetal: baremetal
   salt:
     control:
       size:
diff --git a/salt/control/virt.yml b/salt/control/virt.yml
index 05bf23d..03891c5 100644
--- a/salt/control/virt.yml
+++ b/salt/control/virt.yml
@@ -14,6 +14,16 @@
         eth0:
           bridge: br1
           model: virtio
+      baremetal:
+        eth2:
+          bridge: br0
+          model: virtio
+        eth1:
+          bridge: br1
+          model: virtio
+        eth0:
+          bridge: br2
+          model: virtio
     disk:
       default:
         - system:
diff --git a/zookeeper/backup/client/single.yml b/zookeeper/backup/client/single.yml
index d8eaaac..e1eac1b 100644
--- a/zookeeper/backup/client/single.yml
+++ b/zookeeper/backup/client/single.yml
@@ -2,8 +2,6 @@
 - service.zookeeper.backup.client
 - system.openssh.client.root
 parameters:
-  _param:
-    zookeeper_remote_backup_server: cfg01
   zookeeper:
     backup:
       client: