diff --git a/.releasenotes/notes/elasticsearch-new-parameter-93a08f64ff1a22ab.yaml b/.releasenotes/notes/elasticsearch-new-parameter-93a08f64ff1a22ab.yaml
new file mode 100644
index 0000000..2382274
--- /dev/null
+++ b/.releasenotes/notes/elasticsearch-new-parameter-93a08f64ff1a22ab.yaml
@@ -0,0 +1,15 @@
+---
+summary: >
+  Added a new parameter for Elasticsearch
+
+features:
+  - |
+    Added the ``elasticsearch_version`` parameter to specify which version of
+    Elasticsearch should be deployed. By default, Elasticsearch v2 is
+    installed.
+
+    To deploy Elasticsearch v5, specify the ``elasticsearch_version: 5``
+    parameter in the
+    ``classes/cluster/<cluster_name>/stacklight/server.yml`` file of
+    the Reclass model of your MCP deployment.
+
diff --git a/.releasenotes/notes/kibana-new-parameter-29e59b161f750390.yaml b/.releasenotes/notes/kibana-new-parameter-29e59b161f750390.yaml
new file mode 100644
index 0000000..8805765
--- /dev/null
+++ b/.releasenotes/notes/kibana-new-parameter-29e59b161f750390.yaml
@@ -0,0 +1,13 @@
+---
+summary: >
+  Added a new parameter for Kibana
+
+features:
+  - |
+    Added the ``kibana_version`` parameter to specify which version of Kibana
+    should be deployed. By default, Kibana v4 is installed.
+
+    To deploy Kibana v5, specify the ``kibana_version: 5`` parameter in the
+    ``classes/cluster/<cluster_name>/stacklight/server.yml`` file of the
+    Reclass model of your MCP deployment.
+
diff --git a/aptly/server/mirror/debian/cassandra.yml b/aptly/server/mirror/debian/cassandra.yml
index 3a19e84..4682dc4 100644
--- a/aptly/server/mirror/debian/cassandra.yml
+++ b/aptly/server/mirror/debian/cassandra.yml
@@ -5,6 +5,7 @@
     mirror_cassandra-21x_distribution: 21x
     mirror_cassandra-21x_components: main
     mirror_cassandra-21x_gpgkeys:
+      - A278B781FE4B2BDA
       - F758CE318D77295D
       - 2B5C1B00
       - 0353B12C
diff --git a/aptly/server/mirror/ubuntu/trusty/rabbitmq.yml b/aptly/server/mirror/ubuntu/trusty/rabbitmq.yml
index 5caa9b5..383aeda 100644
--- a/aptly/server/mirror/ubuntu/trusty/rabbitmq.yml
+++ b/aptly/server/mirror/ubuntu/trusty/rabbitmq.yml
@@ -4,6 +4,7 @@
     mirror_rabbitmq-testing-trusty_distribution: testing
     mirror_rabbitmq-testing-trusty_components: main
     mirror_rabbitmq-testing-trusty_gpgkeys:
+      - 6B73A36E6026DFCA
       - 056E8E56
   aptly:
     server:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/main.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/main.yml
index 3625d51..5ae8bdb 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/main.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-backports-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-backports-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-backports-main_distribution: trusty-backports
     mirror_trusty-backports-main_components: main
     mirror_trusty-backports-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/multiverse.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/multiverse.yml
index 96dc420..d04b27a 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-backports-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-backports-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-backports-multiverse_distribution: trusty-backports
     mirror_trusty-backports-multiverse_components: multiverse
     mirror_trusty-backports-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/restricted.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/restricted.yml
index 712bebc..21b6a27 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/restricted.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-backports-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-backports-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-backports-restricted_distribution: trusty-backports
     mirror_trusty-backports-restricted_components: restricted
     mirror_trusty-backports-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/universe.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/universe.yml
index f18b504..0134502 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/universe.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-backports/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-backports-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-backports-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-backports-universe_distribution: trusty-backports
     mirror_trusty-backports-universe_components: universe
     mirror_trusty-backports-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/main.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/main.yml
index 7164628..6aadd64 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/main.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-proposed-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-proposed-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-proposed-main_distribution: trusty-proposed
     mirror_trusty-proposed-main_components: main
     mirror_trusty-proposed-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/multiverse.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/multiverse.yml
index 9227036..af81ef1 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-proposed-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-proposed-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-proposed-multiverse_distribution: trusty-proposed
     mirror_trusty-proposed-multiverse_components: multiverse
     mirror_trusty-proposed-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/restricted.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/restricted.yml
index f5378b9..519cb0f 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/restricted.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-proposed-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-proposed-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-proposed-restricted_distribution: trusty-proposed
     mirror_trusty-proposed-restricted_components: restricted
     mirror_trusty-proposed-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/universe.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/universe.yml
index b6f321b..f3a5c34 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/universe.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-proposed/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-proposed-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-proposed-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-proposed-universe_distribution: trusty-proposed
     mirror_trusty-proposed-universe_components: universe
     mirror_trusty-proposed-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/main.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/main.yml
index 1a797f7..9b0dbf6 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/main.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-security-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-security-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-security-main_distribution: trusty-security
     mirror_trusty-security-main_components: main
     mirror_trusty-security-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/multiverse.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/multiverse.yml
index b38e42b..6bb3f80 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-security-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-security-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-security-multiverse_distribution: trusty-security
     mirror_trusty-security-multiverse_components: multiverse
     mirror_trusty-security-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/restricted.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/restricted.yml
index 76d2b4a..1810a8d 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/restricted.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-security-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-security-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-security-restricted_distribution: trusty-security
     mirror_trusty-security-restricted_components: restricted
     mirror_trusty-security-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/universe.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/universe.yml
index 33d42f5..8700025 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/universe.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-security/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-security-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-security-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-security-universe_distribution: trusty-security
     mirror_trusty-security-universe_components: universe
     mirror_trusty-security-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/main.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/main.yml
index d7db631..bc4e985 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/main.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-updates-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-updates-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-updates-main_distribution: trusty-updates
     mirror_trusty-updates-main_components: main
     mirror_trusty-updates-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/multiverse.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/multiverse.yml
index 518b0ff..1b0b21b 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-updates-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-updates-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-updates-multiverse_distribution: trusty-updates
     mirror_trusty-updates-multiverse_components: multiverse
     mirror_trusty-updates-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/restricted.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/restricted.yml
index 1b7ea0f..7a6c4a6 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/restricted.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-updates-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-updates-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-updates-restricted_distribution: trusty-updates
     mirror_trusty-updates-restricted_components: restricted
     mirror_trusty-updates-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/universe.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/universe.yml
index 3f4d815..f64f9b3 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/universe.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty-updates/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-updates-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-updates-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-updates-universe_distribution: trusty-updates
     mirror_trusty-updates-universe_components: universe
     mirror_trusty-updates-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/main.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/main.yml
index 3a054e7..33b4693 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/main.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-main_distribution: trusty
     mirror_trusty-main_components: main
     mirror_trusty-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/multiverse.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/multiverse.yml
index 37a0b05..68f1586 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-multiverse_distribution: trusty
     mirror_trusty-multiverse_components: multiverse
     mirror_trusty-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/restricted.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/restricted.yml
index dca087a..78d552c 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/restricted.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-restricted_distribution: trusty
     mirror_trusty-restricted_components: restricted
     mirror_trusty-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/universe.yml b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/universe.yml
index a112b94..f24c1ab 100644
--- a/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/universe.yml
+++ b/aptly/server/mirror/ubuntu/trusty/ubuntu/trusty/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_trusty_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_trusty-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_trusty-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_trusty-universe_distribution: trusty
     mirror_trusty-universe_components: universe
     mirror_trusty-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/main.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/main.yml
index f9ad68e..1fbb17d 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/main.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-backports-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-backports-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-backports-main_distribution: xenial-backports
     mirror_xenial-backports-main_components: main
     mirror_xenial-backports-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/multiverse.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/multiverse.yml
index 3ef9908..be45547 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-backports-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-backports-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-backports-multiverse_distribution: xenial-backports
     mirror_xenial-backports-multiverse_components: multiverse
     mirror_xenial-backports-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/restricted.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/restricted.yml
index 5a32ee2..dcf8ede 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/restricted.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-backports-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-backports-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-backports-restricted_distribution: xenial-backports
     mirror_xenial-backports-restricted_components: restricted
     mirror_xenial-backports-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/universe.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/universe.yml
index aca402e..9945a73 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/universe.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-backports/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-backports-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-backports-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-backports-universe_distribution: xenial-backports
     mirror_xenial-backports-universe_components: universe
     mirror_xenial-backports-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/main.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/main.yml
index 920a16f..1ec8777 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/main.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-proposed-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-proposed-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-proposed-main_distribution: xenial-proposed
     mirror_xenial-proposed-main_components: main
     mirror_xenial-proposed-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/multiverse.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/multiverse.yml
index aa6cf27..48a2ddc 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-proposed-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-proposed-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-proposed-multiverse_distribution: xenial-proposed
     mirror_xenial-proposed-multiverse_components: multiverse
     mirror_xenial-proposed-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/restricted.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/restricted.yml
index 78aef0b..d301c81 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/restricted.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-proposed-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-proposed-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-proposed-restricted_distribution: xenial-proposed
     mirror_xenial-proposed-restricted_components: restricted
     mirror_xenial-proposed-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/universe.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/universe.yml
index 618e4e8..8ddd769 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/universe.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-proposed/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-proposed-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-proposed-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-proposed-universe_distribution: xenial-proposed
     mirror_xenial-proposed-universe_components: universe
     mirror_xenial-proposed-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/main.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/main.yml
index dc1309a..a4977cc 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/main.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-security-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-security-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-security-main_distribution: xenial-security
     mirror_xenial-security-main_components: main
     mirror_xenial-security-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/multiverse.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/multiverse.yml
index 77fcd1c..8b40566 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-security-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-security-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-security-multiverse_distribution: xenial-security
     mirror_xenial-security-multiverse_components: multiverse
     mirror_xenial-security-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/restricted.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/restricted.yml
index b6046ff..82beadd 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/restricted.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-security-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-security-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-security-restricted_distribution: xenial-security
     mirror_xenial-security-restricted_components: restricted
     mirror_xenial-security-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/universe.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/universe.yml
index 0a41112..6383be6 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/universe.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-security/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-security-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-security-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-security-universe_distribution: xenial-security
     mirror_xenial-security-universe_components: universe
     mirror_xenial-security-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/main.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/main.yml
index a97dcc4..810e8f6 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/main.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-updates-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-updates-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-updates-main_distribution: xenial-updates
     mirror_xenial-updates-main_components: main
     mirror_xenial-updates-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/multiverse.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/multiverse.yml
index 2373c56..13546b2 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-updates-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-updates-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-updates-multiverse_distribution: xenial-updates
     mirror_xenial-updates-multiverse_components: multiverse
     mirror_xenial-updates-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/restricted.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/restricted.yml
index 74aba0b..870caa0 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/restricted.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-updates-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-updates-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-updates-restricted_distribution: xenial-updates
     mirror_xenial-updates-restricted_components: restricted
     mirror_xenial-updates-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/universe.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/universe.yml
index cf8c817..cf050fd 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/universe.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial-updates/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-updates-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-updates-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-updates-universe_distribution: xenial-updates
     mirror_xenial-updates-universe_components: universe
     mirror_xenial-updates-universe_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/main.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/main.yml
index 4d9db03..c1e5969 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/main.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/main.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-main_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-main_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-main_distribution: xenial
     mirror_xenial-main_components: main
     mirror_xenial-main_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/multiverse.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/multiverse.yml
index a74c520..aff82a6 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/multiverse.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/multiverse.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-multiverse_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-multiverse_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-multiverse_distribution: xenial
     mirror_xenial-multiverse_components: multiverse
     mirror_xenial-multiverse_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/restricted.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/restricted.yml
index bde6b36..78a8ca9 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/restricted.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/restricted.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-restricted_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-restricted_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-restricted_distribution: xenial
     mirror_xenial-restricted_components: restricted
     mirror_xenial-restricted_gpgkeys:
diff --git a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/universe.yml b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/universe.yml
index b24cc1a..c0c67ff 100644
--- a/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/universe.yml
+++ b/aptly/server/mirror/ubuntu/xenial/ubuntu/xenial/universe.yml
@@ -2,7 +2,8 @@
   _param:
     linux_system_country_code: cz
     aptly_server_mirror_ubuntu_xenial_sources: ${_param:aptly_server_mirror_ubuntu_sources}
-    mirror_xenial-universe_source: http://${_param:linux_system_country_code}.archive.ubuntu.com/ubuntu/
+    ubuntu_mirror_url: ${_param:linux_system_country_code}.archive.ubuntu.com
+    mirror_xenial-universe_source: http://${_param:ubuntu_mirror_url}/ubuntu/
     mirror_xenial-universe_distribution: xenial
     mirror_xenial-universe_components: universe
     mirror_xenial-universe_gpgkeys:
diff --git a/artifactory/client/init.yml b/artifactory/client/init.yml
index 05c05be..614266e 100644
--- a/artifactory/client/init.yml
+++ b/artifactory/client/init.yml
@@ -16,121 +16,287 @@
           ldap_account_base: ${_param:artifactory_security_ldap_root_dn}
           ldap_searchFilter: ${_param:artifactory_security_ldap_searchFilter}
         repo:
+          # Please keep repo list sorted
+
           _genericRepository-local:
+            rclass: local
+            packageType: generic
             description: "Used by Jimbo"
-            repo_type: local
-            package_type: generic
-          binary-dev-local:
-            description: "None"
-            repo_type: local
-            package_type: generic
-          binary-prod-local:
-            repo_type: local
-            package_type: generic
-          docker-dev-local:
-            repo_type: local
-            package_type: docker
-          docker-prod-local:
-            repo_type: local
-            package_type: docker
-          k8s-tests-images:
-            repo_type: local
-            package_type: docker
-          maven-local:
-            description: "Hosts Java libraries needed to build Docker images"
-            repo_type: local
-            package_type: maven
-          mcp-ci-images:
-            repo_type: local
-            package_type: docker
-          vm-images:
-            repo_type: local
-            package_type: generic
+
           _genericRepository-remote:
+            rclass: remote
+            packageType: generic
             description: "Used by Jimbo"
-            repo_type: remote
-            package_type: generic
             url: http://localhost
+
+          _genericRepository-virtual:
+            rclass: virtual
+            packageType: generic
+            description: "Used by Jimbo"
+            repositories:
+            - _genericRepository-local
+            - _genericRepository-remote
+
+          apk-local:
+            rclass: local
+            packageType: generic
+
           apk-remote:
-            repo_type: remote
-            package_type: generic
+            rclass: remote
+            packageType: generic
             url: http://dl-cdn.alpinelinux.org/alpine/
+
+          apk-virtual:
+            rclass: virtual
+            packageType: generic
+            repositories:
+            - apk-local
+            - apk-remote
+
           apt-docker-project:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: https://apt.dockerproject.org/repo
+
           artifactory-pro-debian:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: https://jfrog.bintray.com/artifactory-pro-debs
+
+          artifactory-pro-rpm:
+            rclass: remote
+            packageType: yum
+            url: http://jfrog.bintray.com/artifactory-pro-rpms
+
+          binary-dev-local:
+            rclass: local
+            packageType: generic
+
+          binary-dev-virtual:
+            rclass: virtual
+            packageType: generic
+            repositories:
+            - binary-dev-local
+            - binary-prod-local
+            - binary-remote
+            defaultDeploymentRepo: binary-dev-local
+
+          binary-prod-local:
+            rclass: local
+            packageType: generic
+
+          binary-prod-virtual:
+            rclass: virtual
+            packageType: generic
+            repositories:
+            - binary-prod-local
+            - binary-remote
+            - gcs-remote
+            defaultDeploymentRepo: binary-prod-local
+
+          binary-remote:
+            rclass: remote
+            packageType: generic
+            url: https://artifactory.mcp.mirantis.net/artifactory/binary-prod-virtual
+
+          centos:
+            rclass: virtual
+            packageType: yum
+            repositories:
+            - centos-local
+            - centos-remote
+            - artifactory-pro-rpm
+
+          centos-local:
+            rclass: local
+            packageType: yum
+
+          centos-remote:
+            rclass: remote
+            packageType: yum
+            url: http://mirror.centos.org/centos/
+
+          centos-virtual:
+            rclass: virtual
+            packageType: yum
+            repositories:
+            - centos-local
+            - centos-remote
+            defaultDeploymentRepo: centos-local
+
+          debian-local:
+            rclass: local
+            packageType: debian
+
           debian-mariadb-remote:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://sfo1.mirrors.digitalocean.com/mariadb/repo/10.1/debian/
+
           debian-nginx:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://nginx.org/packages/debian/
+
           debian-percona-remote:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://repo.percona.com/apt
+
           debian-rabbitmq-remote:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://www.rabbitmq.com/debian/
+
           debian-remote:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://ftp.us.debian.org/debian
+
           debian-security-remote:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://security.debian.org/
+
+          debian-virtual:
+            rclass: virtual
+            packageType: generic
+            repositories:
+            - debian-local
+            - debian-remote
+            - debian-security-remote
+            defaultDeploymentRepo: debian-local
+
+          docker-dev-local:
+            rclass: local
+            packageType: docker
+
+          docker-dev-virtual:
+            rclass: virtual
+            packageType: docker
+            repositories:
+            - docker-dev-local
+            - docker-prod-local
+            - docker-remote
+            defaultDeploymentRepo: docker-dev-local
+
+          docker-prod-local:
+            rclass: local
+            packageType: docker
+
+          docker-prod-virtual:
+            rclass: virtual
+            packageType: docker
+            repositories:
+            - docker-prod-local
+            - docker-remote
+            defaultDeploymentRepo: docker-prod-local
+
           docker-remote:
-            description: "Remote repository for DockerHub"
-            repo_type: remote
-            package_type: docker
+            rclass: remote
+            packageType: docker
             url: https://registry-1.docker.io/
+            description: "Remote repository for DockerHub"
+
           gcs-remote:
-            description: "Has zero downloads. Can be removed."
-            repo_type: remote
-            package_type: generic
+            rclass: remote
+            packageType: generic
             url: https://storage.googleapis.com
+            description: "Has zero downloads. Can be removed."
+
           gerrit-plugins:
-            description: "Overlaps with maven-local. We should resolve overlap and remove this repo."
-            repo_type: remote
-            package_type: generic
+            rclass: remote
+            packageType: generic
             url: http://builds.quelltextlich.at/gerrit/nightly
+            description: "Overlaps with maven-local. We should resolve overlap and remove this repo."
+
           jcenter:
-            repo_type: remote
-            package_type: maven
+            rclass: remote
+            packageType: maven
             url: https://jcenter.bintray.com
+
           jenkins-deb-pkgs:
-            repo_type: remote
-            package_type: generic
+            rclass: remote
+            packageType: generic
             url: https://pkg.jenkins.io/debian-stable/binary
+
           jenkins-plugins:
-            repo_type: remote
-            package_type: generic
+            rclass: remote
+            packageType: generic
             url: http://mirrors.jenkins-ci.org/plugins
+
           jenkins-plugins-jars:
-            repo_type: remote
-            package_type: maven
+            rclass: remote
+            packageType: maven
             url: https://repo.jenkins-ci.org/releases/org/jenkins-ci/plugins/
+
           jenkins-updates:
-            repo_type: remote
-            package_type: generic
+            rclass: remote
+            packageType: generic
             url: https://updates.jenkins.io/
+
+          k8s-tests-images:
+            rclass: local
+            packageType: docker
+
+          maven-local:
+            rclass: local
+            packageType: maven
+            description: "Hosts Java libraries needed to build Docker images"
+
+          mcp-k8s:
+            rclass: virtual
+            packageType: docker
+            repositories:
+            - mcp-k8s-local
+
+          mcp-k8s-ci:
+            rclass: local
+            packageType: docker
+
+          mcp-k8s-local:
+            rclass: local
+            packageType: docker
+
           mysql-connector-java:
-            repo_type: remote
-            package_type: maven
+            rclass: remote
+            packageType: maven
             url: http://repo.jfrog.org/artifactory/remote-repos/mysql/mysql-connector-java/
+
+          pypi-local:
+            rclass: local
+            packageType: pypi
+
           pypi-remote:
-            repo_type: remote
-            package_type: pypi
+            rclass: remote
+            packageType: pypi
             url: https://pypi.python.org
+
+          pypi-virtual:
+            rclass: virtual
+            packageType: pypi
+            repositories:
+            - pypi-local
+            - pypi-remote
+            defaultDeploymentRepo: pypi-local
+
+          ubuntu-local:
+            rclass: local
+            packageType: debian
+
           ubuntu-remote:
-            repo_type: remote
-            package_type: debian
+            rclass: remote
+            packageType: debian
             url: http://us.archive.ubuntu.com/ubuntu/
+
+          ubuntu-virtual:
+            rclass: virtual
+            packageType: generic
+            repositories:
+            - ubuntu-local
+            - ubuntu-remote
+            defaultDeploymentRepo: ubuntu-local
+
+          vm-images:
+            rclass: local
+            packageType: generic
diff --git a/ceph/common/container.yml b/ceph/common/container.yml
new file mode 100644
index 0000000..5c7619b
--- /dev/null
+++ b/ceph/common/container.yml
@@ -0,0 +1,6 @@
+classes:
+- service.ceph.common.container
+- system.ceph.monitoring.cluster_stats
+parameters:
+  _param:
+    ceph_common_prefix_dir: /srv/volumes/ceph
diff --git a/ceph/osd/cluster.yml b/ceph/osd/cluster.yml
index 9e98f91..31fa050 100644
--- a/ceph/osd/cluster.yml
+++ b/ceph/osd/cluster.yml
@@ -1,2 +1,8 @@
 classes:
 - service.ceph.osd.cluster
+parameters:
+  linux:
+    system:
+      kernel:
+        sysctl:
+          fs.aio-max-nr: 131072
diff --git a/docker/client.yml b/docker/client/compose/init.yml
similarity index 62%
rename from docker/client.yml
rename to docker/client/compose/init.yml
index df11493..efeeadd 100644
--- a/docker/client.yml
+++ b/docker/client/compose/init.yml
@@ -1,11 +1,10 @@
 classes:
-  - service.docker.client
+  - system.docker.client
 parameters:
   _param:
-    docker_image_compose: docker/compose:1.8.0
+    docker_image_compose: docker/compose:1.17.1
   docker:
     client:
-      enabled: true
       compose:
         source:
           engine: docker
diff --git a/docker/client/compose/service/gerrit.yml b/docker/client/compose/service/gerrit.yml
new file mode 100644
index 0000000..183f57d
--- /dev/null
+++ b/docker/client/compose/service/gerrit.yml
@@ -0,0 +1,72 @@
+classes:
+  - system.docker.client.compose
+parameters:
+  _param:
+    docker_image_gerrit: tcpcloud/gerrit:2.13.6
+    docker_image_mysql: tcpcloud/mysql:5.6
+    gerrit_ldap_server: ""
+    gerrit_ldap_bind_user: ""
+    gerrit_ldap_bind_password: ""
+    gerrit_ldap_account_base: ""
+    gerrit_ldap_group_base: ""
+    gerrit_http_listen_url: http://*:8080/
+    gerrit_extra_opts: ""
+  docker:
+    client:
+      compose:
+        gerrit:
+          service:
+            server:
+              image: ${_param:docker_image_gerrit}
+              restart: always
+              ports:
+                - 18083:8080
+                - 29417:29418
+              volumes:
+                - /srv/volumes/gerrit:/var/gerrit/review_site
+              depends_on:
+                - db
+              environment:
+                #GERRIT_INIT_ARGS: ""
+                DATABASE_TYPE: "mysql"
+                DB_PORT_3306_TCP_ADDR: ${_param:cluster_vip_address}
+                DB_ENV_MYSQL_USER: gerrit
+                DB_ENV_MYSQL_PASSWORD: ${_param:mysql_gerrit_password}
+                DB_ENV_MYSQL_DB: gerrit
+                AUTH_TYPE: ${_param:gerrit_auth_type}
+                LDAP_SERVER: ${_param:gerrit_ldap_server}
+                LDAP_ACCOUNTPATTERN: 'uid={username}'
+                LDAP_ACCOUNTBASE: ${_param:gerrit_ldap_account_base}
+                LDAP_GROUPBASE: ${_param:gerrit_ldap_group_base}
+                LDAP_USERNAME: ${_param:gerrit_ldap_bind_user}
+                LDAP_PASSWORD: ${_param:gerrit_ldap_bind_password}
+                WEBURL: ${_param:gerrit_public_host}
+                HTTPD_LISTENURL: ${_param:gerrit_http_listen_url}
+                GERRIT_ADMIN_SSH_PUBLIC: ${_param:gerrit_admin_public_key}
+                GERRIT_ADMIN_PWD: ${_param:gerrit_admin_password}
+                GERRIT_ADMIN_EMAIL: ${_param:gerrit_admin_email}
+                CANLOADINIFRAME: "true"
+                JAVA_OPTIONS: ${_param:gerrit_extra_opts}
+                https_proxy: ${_param:docker_https_proxy}
+                http_proxy: ${_param:docker_http_proxy}
+                no_proxy: ${_param:docker_no_proxy}
+            db:
+              environment:
+                MYSQL_USER: gerrit
+                MYSQL_PASSWORD: ${_param:mysql_gerrit_password}
+                MYSQL_DATABASE: gerrit
+                MYSQL_ROOT_PASSWORD: ${_param:mysql_admin_password}
+                MYSQL_START_TIMEOUT: 300
+              deploy:
+                restart_policy:
+                  condition: any
+              image: "${_param:docker_image_mysql}"
+              ports:
+                - 13306:3306
+              volumes:
+                - /srv/volumes/mysql:/var/lib/mysql
+  linux:
+    system:
+      directory:
+        /srv/volumes/gerrit:
+          makedirs: true
diff --git a/docker/client/compose/service/jenkins.yml b/docker/client/compose/service/jenkins.yml
new file mode 100644
index 0000000..85f2006
--- /dev/null
+++ b/docker/client/compose/service/jenkins.yml
@@ -0,0 +1,42 @@
+classes:
+  - system.docker.client.compose
+parameters:
+  _param:
+    docker_image_jenkins: tcpcloud/jenkins:2.93
+    jenkins_master_extra_opts: ""
+    jenkins_master_executors_num: 4
+    jenkins_master_max_concurent_requests: 40
+    jenkins_home_dir_path: /var/jenkins_home
+  docker:
+    client:
+      compose:
+        jenkins:
+          status: up
+          service:
+            master:
+              environment:
+                JENKINS_HOME: ${_param:jenkins_home_dir_path}
+                JAVA_OPTS: " -server -XX:+AlwaysPreTouch -Xloggc:${_param:jenkins_home_dir_path}/gc-%t.log -XX:NumberOfGCLogFiles=5 -XX:+UseGCLogFileRotation -XX:GCLogFileSize=20m -XX:+PrintGC -XX:+PrintGCDateStamps -XX:+PrintGCDetails -XX:+PrintHeapAtGC -XX:+PrintGCCause -XX:+PrintTenuringDistribution -XX:+PrintReferenceGC -XX:+PrintAdaptiveSizePolicy -XX:+UseG1GC -XX:+ExplicitGCInvokesConcurrent -XX:+ParallelRefProcEnabled -XX:+UseStringDeduplication -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=20 -XX:+UnlockDiagnosticVMOptions -XX:G1SummarizeRSetStatsPeriod=1 -Djenkins.install.runSetupWizard=false -Dhudson.DNSMultiCast.disabled=true -Dhudson.udp=-1 -Dhudson.footerURL=https://www.mirantis.com ${_param:jenkins_master_extra_opts}"
+                JENKINS_NUM_EXECUTORS: ${_param:jenkins_master_executors_num}
+                JENKINS_OPTS: " --handlerCountMax=${_param:jenkins_master_max_concurent_requests}"
+                https_proxy: ${_param:docker_https_proxy}
+                http_proxy: ${_param:docker_http_proxy}
+                no_proxy: ${_param:docker_no_proxy}
+              image: ${_param:docker_image_jenkins}
+              restart: always
+              ports:
+                - 18081:8080
+                - 50001:50000
+              volumes:
+                - /srv/volumes/jenkins:/var/jenkins_home
+                - /etc/ssl/certs/java/cacerts:/etc/ssl/certs/java/cacerts:ro
+  linux:
+    system:
+      directory:
+        /srv/volumes/jenkins:
+          makedirs: true
+          user: 1000
+          group: 1000
+      package:
+        ca-certificates-java:
+          version: latest
diff --git a/docker/client/init.yml b/docker/client/init.yml
new file mode 100644
index 0000000..610e0a4
--- /dev/null
+++ b/docker/client/init.yml
@@ -0,0 +1,6 @@
+classes:
+  - service.docker.client
+parameters:
+  docker:
+    client:
+      enabled: true
diff --git a/docker/swarm/stack/jenkins/master.yml b/docker/swarm/stack/jenkins/master.yml
index 1237fe3..73a4b30 100644
--- a/docker/swarm/stack/jenkins/master.yml
+++ b/docker/swarm/stack/jenkins/master.yml
@@ -2,10 +2,11 @@
 - system.docker
 parameters:
   _param:
-    docker_image_jenkins: tcpcloud/jenkins:2.89
+    docker_image_jenkins: tcpcloud/jenkins:2.93
     jenkins_master_extra_opts: ""
     jenkins_master_executors_num: 4
     jenkins_master_max_concurent_requests: 40
+    jenkins_home_dir_path: /var/jenkins_home
   docker:
     client:
       stack:
@@ -13,8 +14,8 @@
           service:
             master:
               environment:
-                JENKINS_HOME: /var/jenkins_home
-                JAVA_OPTS: " -server -XX:+AlwaysPreTouch -Xloggc:$JENKINS_HOME/gc-%t.log -XX:NumberOfGCLogFiles=5 -XX:+UseGCLogFileRotation -XX:GCLogFileSize=20m -XX:+PrintGC -XX:+PrintGCDateStamps -XX:+PrintGCDetails -XX:+PrintHeapAtGC -XX:+PrintGCCause -XX:+PrintTenuringDistribution -XX:+PrintReferenceGC -XX:+PrintAdaptiveSizePolicy -XX:+UseG1GC -XX:+ExplicitGCInvokesConcurrent -XX:+ParallelRefProcEnabled -XX:+UseStringDeduplication -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=20 -XX:+UnlockDiagnosticVMOptions -XX:G1SummarizeRSetStatsPeriod=1 -Djenkins.install.runSetupWizard=false -Dhudson.DNSMultiCast.disabled=true -Dhudson.udp=-1 -Dhudson.footerURL=https://www.mirantis.com ${_param:jenkins_master_extra_opts}"
+                JENKINS_HOME: ${_param:jenkins_home_dir_path}
+                JAVA_OPTS: " -server -XX:+AlwaysPreTouch -Xloggc:${_param:jenkins_home_dir_path}/gc-%t.log -XX:NumberOfGCLogFiles=5 -XX:+UseGCLogFileRotation -XX:GCLogFileSize=20m -XX:+PrintGC -XX:+PrintGCDateStamps -XX:+PrintGCDetails -XX:+PrintHeapAtGC -XX:+PrintGCCause -XX:+PrintTenuringDistribution -XX:+PrintReferenceGC -XX:+PrintAdaptiveSizePolicy -XX:+UseG1GC -XX:+ExplicitGCInvokesConcurrent -XX:+ParallelRefProcEnabled -XX:+UseStringDeduplication -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=20 -XX:+UnlockDiagnosticVMOptions -XX:G1SummarizeRSetStatsPeriod=1 -Djenkins.install.runSetupWizard=false -Dhudson.DNSMultiCast.disabled=true -Dhudson.udp=-1 -Dhudson.footerURL=https://www.mirantis.com ${_param:jenkins_master_extra_opts}"
                 JENKINS_NUM_EXECUTORS: ${_param:jenkins_master_executors_num}
                 JENKINS_OPTS: " --handlerCountMax=${_param:jenkins_master_max_concurent_requests}"
                 https_proxy: ${_param:docker_https_proxy}
diff --git a/docker/swarm/stack/monitoring/remote_agent/ceph.yml b/docker/swarm/stack/monitoring/remote_agent/ceph.yml
index 6085eeb..07996fa 100644
--- a/docker/swarm/stack/monitoring/remote_agent/ceph.yml
+++ b/docker/swarm/stack/monitoring/remote_agent/ceph.yml
@@ -1,3 +1,4 @@
+# client role is deprecated. Use ceph_common.yml instead
 classes:
 - system.ceph.client.container
 - system.ceph.monitoring.cluster_stats
diff --git a/docker/swarm/stack/monitoring/remote_agent/ceph_common.yml b/docker/swarm/stack/monitoring/remote_agent/ceph_common.yml
new file mode 100644
index 0000000..3a269a7
--- /dev/null
+++ b/docker/swarm/stack/monitoring/remote_agent/ceph_common.yml
@@ -0,0 +1,9 @@
+parameters:
+  docker:
+    client:
+      stack:
+        monitoring:
+          service:
+            remote_agent:
+              volumes:
+                - ${ceph:common:prefix_dir}/etc/ceph:/etc/ceph
diff --git a/docker/swarm/stack/pushkin.yml b/docker/swarm/stack/pushkin.yml
index d0a3bce..22a921d 100644
--- a/docker/swarm/stack/pushkin.yml
+++ b/docker/swarm/stack/pushkin.yml
@@ -22,6 +22,7 @@
     sfdc_consumer_key: example_consumer_key
     sfdc_consumer_secret: example_consumer_secret
     sfdc_organization_id: example_organization_id
+    sfdc_environment_id: 0
     sfdc_sandbox_enabled: true
   docker:
     client:
@@ -46,6 +47,7 @@
             SFDC_CONSUMER_KEY: ${_param:sfdc_consumer_key}
             SFDC_CONSUMER_SECRET: ${_param:sfdc_consumer_secret}
             SFDC_ORGANIZATION_ID: ${_param:sfdc_organization_id}
+            SFDC_ENVIRONMENT_ID: ${_param:sfdc_environment_id}
             SFDC_SANDBOX_ENABLED: ${_param:sfdc_sandbox_enabled}
           service:
             pushkin-api:
diff --git a/docker/swarm/stack/security_monkey.yml b/docker/swarm/stack/security_monkey.yml
index b5a1100..3b9c272 100644
--- a/docker/swarm/stack/security_monkey.yml
+++ b/docker/swarm/stack/security_monkey.yml
@@ -2,6 +2,8 @@
   _param:
     docker_security_monkey_api_replicas: 1
     docker_security_monkey_scheduler_replicas: 1
+    secmonkey_login_id: 11
+    secmonkey_application_id: 1
     docker_image_security_monkey_api: docker-prod-local.artifactory.mirantis.com/mirantis/oss/security-monkey-api
     docker_image_security_monkey_scheduler: docker-prod-local.artifactory.mirantis.com/mirantis/oss/security-monkey-scheduler
     security_monkey_bind_host: security-audit-api
@@ -45,6 +47,8 @@
             WEB_PORT: ${_param:security_monkey_web_port}
             API_PORT: ${_param:security_monkey_api_port}
             NGINX_PORT: ${_param:security_monkey_nginx_port}
+            NOTIFICATIONS_APP_ID: ${_param:secmonkey_application_id}
+            NOTIFICATIONS_LOGIN_ID: ${_param:secmonkey_login_id}
             NOTIFICATIONS_SERVICE_URL: ${_param:notification_service_url}
             DEFAULT_USER: ${_param:security_monkey_user}
             DEFAULT_PASSWORD: ${_param:security_monkey_password}
@@ -63,7 +67,7 @@
             SM_WTF_CSRF_ENABLED: ${_param:devops_portal_sm_wtf_csrf_enabled}
             SECURITY_MONKEY_SYNC_INTERVAL: ${_param:security_monkey_sync_interval}
             SQLALCHEMY_DATABASE_URI: postgresql://${_param:secmonkey_db_user}:${_param:secmonkey_db_user_password}@${_param:secmonkey_db_host}:${_param:haproxy_postgresql_bind_port}/${_param:security_monkey_db}
-            SQLALCHEMY_POOL_RECYCLE: 14400
+            SQLALCHEMY_POOL_RECYCLE: 25000
           service:
             security-audit-api:
               image: ${_param:docker_image_security_monkey_api}
diff --git a/elasticsearch/server/cluster.yml b/elasticsearch/server/cluster.yml
index 9be44ed..94b6d85 100644
--- a/elasticsearch/server/cluster.yml
+++ b/elasticsearch/server/cluster.yml
@@ -6,6 +6,7 @@
     java_environment_version: "8"
     java_environment_platform: openjdk
     elasticsearch_cluster_name: elasticsearch
+    elasticsearch_version: 2
   linux:
     system:
       sysctl:
@@ -16,6 +17,7 @@
       headless: true
   elasticsearch:
     server:
+      version: ${_param:elasticsearch_version}
       name: ${_param:elasticsearch_cluster_name}
       enabled: true
       master: true
diff --git a/elasticsearch/server/single.yml b/elasticsearch/server/single.yml
index 6606617..ce7da36 100644
--- a/elasticsearch/server/single.yml
+++ b/elasticsearch/server/single.yml
@@ -2,6 +2,8 @@
 - service.java.environment.openjdk8
 - service.elasticsearch.server.single
 parameters:
+  _param:
+    elasticsearch_version: 2
   linux:
     system:
       sysctl:
@@ -12,6 +14,7 @@
       headless: true
   elasticsearch:
     server:
+      version: ${_param:elasticsearch_version}
       enabled: true
       bind:
         address: ${_param:single_address}
diff --git a/fluentd/label/default_output/elasticsearch.yml b/fluentd/label/default_output/elasticsearch.yml
new file mode 100644
index 0000000..3c26d15
--- /dev/null
+++ b/fluentd/label/default_output/elasticsearch.yml
@@ -0,0 +1,15 @@
+classes:
+- service.fluentd.agent.output.elasticsearch
+parameters:
+  _params:
+    fluentd_elasticsearch_host: 127.0.0.1
+    elasticsearch_port: 9200
+  fluentd:
+    agent:
+      config:
+        label:
+          default_output:
+            match:
+              elasticsearch_output:
+                host: ${_param:fluentd_elasticsearch_host}
+                port: ${_param:elasticsearch_port}
diff --git a/fluentd/label/default_output/file.yml b/fluentd/label/default_output/file.yml
index 5e0050d..c67e1e0 100644
--- a/fluentd/label/default_output/file.yml
+++ b/fluentd/label/default_output/file.yml
@@ -2,26 +2,27 @@
   _param:
     fluentd_default_output_file: /var/log/td-agent/default-all.log
   fluentd:
-    config:
-      dollar: '$'
-      label:
-        default_output:
-          filter:
-            add_general_fields:
-              tag: "**"
-              type: record_transformer
-              enable_ruby: true
-              record:
-                - name: Type
-                  value: log
-                - name: environment_label
-                  value: ${_param:cluster_domain}
-                - name: Hostname
-                  value: ${fluentd:config:dollar}{ hostname }
-                - name: Timestamp
-                  value: ${fluentd:config:dollar}{ time.strftime('%Y-%m-%dT%H:%M:%S%z') }
-          match:
-            everything:
-              tag: '**'
-              type: 'file'
-              path: ${_param:fluentd_default_output_file}
+    agent:
+      config:
+        dollar: '$'
+        label:
+          default_output:
+            filter:
+              add_general_fields:
+                tag: "**"
+                type: record_transformer
+                enable_ruby: true
+                record:
+                  - name: Type
+                    value: log
+                  - name: environment_label
+                    value: ${_param:cluster_domain}
+                  - name: Hostname
+                    value: ${fluentd:config:dollar}{ hostname }
+                  - name: Timestamp
+                    value: ${fluentd:config:dollar}{ time.strftime('%Y-%m-%dT%H:%M:%S%z') }
+            match:
+              everything:
+                tag: '**'
+                type: 'file'
+                path: ${_param:fluentd_default_output_file}
diff --git a/gerrit/client/init.yml b/gerrit/client/init.yml
index 25c0b94..5456900 100644
--- a/gerrit/client/init.yml
+++ b/gerrit/client/init.yml
@@ -47,16 +47,16 @@
           - name: create
             group: devops-core
           labels:
-          - name: label-Code-Review
+          - name: Code-Review
             group: devops-core
             score: -2..+2
-          - name: label-Code-Review
+          - name: Code-Review
             group: Non-Interactive Users
             score: -1..+1
-          - name: label-Verified
+          - name: Verified
             group: Non-Interactive Users
             score: -1..+1
-          - name: label-Workflow
+          - name: Workflow
             group: devops-core
             score: -1..+1
         "refs/tags/*":
diff --git a/glance/client/image/cirros.yml b/glance/client/image/cirros.yml
index d9f3f33..3a7b213 100644
--- a/glance/client/image/cirros.yml
+++ b/glance/client/image/cirros.yml
@@ -2,7 +2,7 @@
 - system.glance.client
 parameters:
   _param:
-    cirros_image_url: "http://apt.mirantis.com/images/cirros-x64-20170828.qcow2"
+    cirros_image_url: "http://images.mirantis.com/cirros-x64-20170828.qcow2"
     cirros_image_name:  "cirros-0.3.0-x86_64"
   glance:
     client:
diff --git a/glance/client/image/ubuntu_trusty.yml b/glance/client/image/ubuntu_trusty.yml
index be9effc..2af6458 100644
--- a/glance/client/image/ubuntu_trusty.yml
+++ b/glance/client/image/ubuntu_trusty.yml
@@ -2,7 +2,7 @@
 - system.glance.client
 parameters:
   _param:
-    ubuntu_trusty_image_url: "http://apt.mirantis.com/images/ubuntu-14-04-x64-mcp1.1.qcow2"
+    ubuntu_trusty_image_url: "http://images.mirantis.com/ubuntu-14-04-x64-mcp1.1.qcow2"
     ubuntu_trusty_image_name:  "ubuntu-14-04-x64-mcp1.1"
   glance:
     client:
diff --git a/glance/client/image/ubuntu_xenial.yml b/glance/client/image/ubuntu_xenial.yml
index 4206584..a08a47d 100644
--- a/glance/client/image/ubuntu_xenial.yml
+++ b/glance/client/image/ubuntu_xenial.yml
@@ -2,7 +2,7 @@
 - system.glance.client
 parameters:
   _param:
-    ubuntu_xenial_image_url: "http://apt.mirantis.com/images/ubuntu-16-04-x64-mcp1.1.qcow2"
+    ubuntu_xenial_image_url: "http://images.mirantis.com/ubuntu-16-04-x64-mcp1.1.qcow2"
     ubuntu_xenial_image_name:  "ubuntu-16-04-amd64-cloudimg"
   glance:
     client:
diff --git a/haproxy/proxy/listen/cicd/aptly.yml b/haproxy/proxy/listen/cicd/aptly.yml
index 682e0d3..de70101 100644
--- a/haproxy/proxy/listen/cicd/aptly.yml
+++ b/haproxy/proxy/listen/cicd/aptly.yml
@@ -15,8 +15,8 @@
             - httplog
           balance: source
           timeout:
-            server: 10m
-            client: 10m
+            server: 90m
+            client: 90m
           binds:
             - address: ${_param:haproxy_aptly_api_bind_host}
               port: ${_param:haproxy_aptly_api_bind_port}
diff --git a/jenkins/client/approved_scripts.yml b/jenkins/client/approved_scripts.yml
index daafadd..4f12bd6 100644
--- a/jenkins/client/approved_scripts.yml
+++ b/jenkins/client/approved_scripts.yml
@@ -17,12 +17,15 @@
         - method groovy.util.XmlParser parseText java.lang.String
         - method hudson.PluginManager getPlugins
         - method hudson.PluginWrapper getShortName
+        - method hudson.model.Hudson getSlaves
         - method hudson.model.Item getName
         - method hudson.model.ItemGroup getItem java.lang.String
         - method hudson.model.ItemGroup getItems
         - method hudson.model.Job getBuildByNumber int
         - method hudson.model.Job getBuilds
         - method hudson.model.Job getLastBuild
+        - method hudson.model.Node getLabelString
+        - method hudson.model.Node getNodeName
         - method hudson.model.Run getEnvironment
         - method hudson.model.Run getId
         - method hudson.model.Run getNumber
@@ -127,6 +130,7 @@
         - staticMethod org.codehaus.groovy.runtime.ScriptBytecodeAdapter bitwiseNegate java.lang.Object
         - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods toBoolean java.lang.Boolean
         - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.lang.Object java.lang.String
+        - staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods multiply java.lang.String java.lang.Number
         - method java.io.File listFiles
         - method java.lang.String concat java.lang.String
         - method org.jenkinsci.plugins.workflow.steps.FlowInterruptedException getCauses
diff --git a/jenkins/client/init.yml b/jenkins/client/init.yml
index 5e3f4a1..3eeac91 100644
--- a/jenkins/client/init.yml
+++ b/jenkins/client/init.yml
@@ -31,6 +31,7 @@
         git: {}
         heavy-job: {}
         jobConfigHistory: {}
+        jira: {}
         ldap: {}
         matrix-auth: {}
         monitoring: {}
diff --git a/jenkins/client/job/aptly.yml b/jenkins/client/job/aptly.yml
index 256c04a..921e9bc 100644
--- a/jenkins/client/job/aptly.yml
+++ b/jenkins/client/job/aptly.yml
@@ -92,3 +92,63 @@
                 type: string
                 default: "all"
                 description: "Comma separated list (,)"
+              STORAGES:
+                type: string
+                default: "${_param:jenkins_aptly_storages}"
+                description: "Comma separated list of storage"
+      job_template:
+        aptly-all:
+          name: aptly-{{operation}}-all-{{source}}-{{target}}
+          jobs:
+            - operation: promote
+              diff_only: false
+              source: nightly
+              target: testing
+            - operation: promote
+              diff_only: false
+              source: testing
+              target: stable
+          template:
+            discard:
+              build:
+                keep_num: 25
+              artifact:
+                keep_num: 25
+            type: workflow-scm
+            concurrent: false
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              credentials: "gerrit"
+              script: aptly-promote-pipeline.groovy
+            param:
+              SOURCE:
+                type: string
+                default: "(.*)/{{source}}"
+              TARGET:
+                type: string
+                default: "{0}/{{target}}"
+              RECREATE:
+                type: boolean
+                default: 'false'
+              DUMP_PUBLISH:
+                type: boolean
+                default: 'true'
+              DIFF_ONLY:
+                type: boolean
+                default: '{{diff_only}}'
+              APTLY_URL:
+                type: string
+                default: "${_param:jenkins_aptly_api_url}"
+              COMPONENTS:
+                type: string
+                default: "all"
+                description: "Comma separated list (,)"
+              PACKAGES:
+                type: string
+                default: "all"
+                description: "Comma separated list (,)"
+              STORAGES:
+                type: string
+                default: "${_param:jenkins_aptly_storages}"
+                description: "Comma separated list of storage"
diff --git a/jenkins/client/job/ceph/replace-failed-osd.yml b/jenkins/client/job/ceph/replace-failed-osd.yml
index 57081ec..775915f 100644
--- a/jenkins/client/job/ceph/replace-failed-osd.yml
+++ b/jenkins/client/job/ceph/replace-failed-osd.yml
@@ -33,9 +33,9 @@
             DEVICE:
               type: string
               description: Comma separated list of failed devices that will be replaced at HOST (/dev/sdb,/dev/sdc)
-            JOURNAL_OR_BLOCKDB_PARTITION:
+            JOURNAL_BLOCKDB_BLOCKWAL_PARTITION:
               type: string
-              description: Comma separated list of partitions where journal or block_db for the failed devices on this HOST were stored (/dev/sdh2,/dev/sdh3)
+              description: Comma separated list of partitions where journal, block_db or block_wal for the failed devices on this HOST were stored (/dev/sdh2,/dev/sdh3)
             ADMIN_HOST:
               type: string
               description: Host with admin keyring and correct crushmap file in /etc/ceph/crushmap
@@ -44,6 +44,10 @@
               type: boolean
               default: 'false'
               description: Wait for healthy during pipeline
+            DMCRYPT:
+              type: boolean
+              default: 'false'
+              description: Check if replacing osds were encrypted
             CLUSTER_FLAGS:
               type: string
               description: Flags to be aplied before pipeline and after pipeline (comma-separated list)
diff --git a/jenkins/client/job/deploy/lab/component/ceph.yml b/jenkins/client/job/deploy/lab/component/ceph.yml
index e9e3d64..b927c5d 100644
--- a/jenkins/client/job/deploy/lab/component/ceph.yml
+++ b/jenkins/client/job/deploy/lab/component/ceph.yml
@@ -15,3 +15,10 @@
         stack_install: core,ceph
         stack_test: "ceph"
         job_timer: "H H * * *"
+      - stack_name: os_ha_ovs_ceph
+        stack_env: devcloud
+        stack_type: heat
+        stack_install: core,openstack,ovs,ceph
+        stack_test: ""
+        job_timer: "H H(0-6) * * *"
+
diff --git a/jenkins/client/job/deploy/lab/deploy.yml b/jenkins/client/job/deploy/lab/deploy.yml
index 108e30d..308b613 100644
--- a/jenkins/client/job/deploy/lab/deploy.yml
+++ b/jenkins/client/job/deploy/lab/deploy.yml
@@ -71,6 +71,9 @@
                 type: string
                 default: 'deploy-stack-cleanup'
 
+              STACK_RECLASS_ADDRESS:
+                type: string
+                default: ""
               STACK_RECLASS_BRANCH:
                 type: string
                 default: ""
@@ -90,11 +93,14 @@
                 type: string
                 default: ""
                 description: "Formulas revision to install on Salt Master bootstrap stage"
+              EXTRA_FORMULAS:
+                type: string
+                default: "maas memcached ntp nginx collectd sensu heka sphinx mysql grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal rsync docker keepalived aptly jenkins gerrit artifactory influxdb horizon"
 
               # aws api
               AWS_STACK_REGION:
                 type: string
-                default: "us-west-2"
+                default: "eu-central-1"
               AWS_API_CREDENTIALS:
                 type: string
                 default: "aws-credentials"
diff --git a/jenkins/client/job/git-mirrors/2way.yml b/jenkins/client/job/git-mirrors/2way.yml
new file mode 100644
index 0000000..158816a
--- /dev/null
+++ b/jenkins/client/job/git-mirrors/2way.yml
@@ -0,0 +1,49 @@
+parameters:
+  _param:
+    jenkins_pollscm_spec: "H/60 * * * *"
+  jenkins:
+    client:
+      job_template:
+        git-mirror-2way-common:
+          name: git-mirror-2way-{{name}}
+          jobs:
+            - name: salt-formulas-scripts
+              source: salt-formulas/salt-formulas-scripts
+              target: salt-formulas/salt-formulas-scripts
+              branches: "master"
+            - name: mcp-common-scripts
+              source: mcp/mcp-common-scripts
+              target: Mirantis/mcp-common-scripts
+              branches: "master"
+          template:
+            discard:
+              build:
+                keep_num: 10
+              artifact:
+                keep_num: 10
+            type: workflow-scm
+            concurrent: false
+            scm:
+              type: git
+              url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+              credentials: "gerrit"
+              script: git-mirror-2way-pipeline.groovy
+              github:
+                url: "https://github.com/{{target}}"
+            trigger:
+              github:
+              pollscm:
+                spec: ${_param:jenkins_pollscm_spec}
+            param:
+              SOURCE_URL:
+                type: string
+                default: "${_param:jenkins_gerrit_url}/{{source}}.git"
+              TARGET_URL:
+                type: string
+                default: "https://github.com/{{target}}.git"
+              CREDENTIALS_ID:
+                type: string
+                default: "gerrit"
+              BRANCHES:
+                type: string
+                default: "{{branches}}"
diff --git a/jenkins/client/job/git-mirrors/upstream/oss.yml b/jenkins/client/job/git-mirrors/upstream/oss.yml
index af3f816..57ce1a2 100644
--- a/jenkins/client/job/git-mirrors/upstream/oss.yml
+++ b/jenkins/client/job/git-mirrors/upstream/oss.yml
@@ -7,3 +7,7 @@
         downstream: oss/rundeck-cis-jobs
         upstream: "git@github.com:Mirantis/rundeck-cis-jobs"
         branches: master
+      - name: security-monkey
+        downstream: oss/security-monkey
+        upstream: "git@github.com:Netflix/security_monkey.git"
+        branches: develop
diff --git a/jenkins/client/job/oscore/tests.yml b/jenkins/client/job/oscore/tests.yml
index 4844708..85346e1 100644
--- a/jenkins/client/job/oscore/tests.yml
+++ b/jenkins/client/job/oscore/tests.yml
@@ -207,6 +207,10 @@
                 type: string
                 description: Tests pass rate to consider build successful
                 default: "90"
+              USE_PEPPER:
+                type: boolean
+                description: Whether to use pepper to connect to salt master
+                default: 'false'
         results-checker-template:
           name: "{{job_prefix}}-{{test_type}}-results-checker"
           template:
diff --git a/jenkins/client/job/salt-formulas/git-mirrors/2way.yml b/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
index 2de63a5..2fa9c6c 100644
--- a/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
+++ b/jenkins/client/job/salt-formulas/git-mirrors/2way.yml
@@ -263,40 +263,36 @@
               BRANCHES:
                 type: string
                 default: "{{branches}}"
-        git-mirror-2way:
-          name: git-mirror-2way-{{name}}
-          jobs:
-            - name: salt-formulas-scripts
-              branches: master
-          template:
-            discard:
-              build:
-                keep_num: 10
-              artifact:
-                keep_num: 10
-            type: workflow-scm
-            concurrent: false
-            scm:
-              type: git
-              url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
-              credentials: "gerrit"
-              script: git-mirror-2way-pipeline.groovy
-              github:
-                url: "https://github.com/salt-formulas/{{name}}"
-            trigger:
-              github:
-              pollscm:
-                spec: ${_param:jenkins_pollscm_spec}
-            param:
-              SOURCE_URL:
-                type: string
-                default: "${_param:jenkins_gerrit_url}/salt-formulas/{{name}}.git"
-              TARGET_URL:
-                type: string
-                default: "https://github.com/salt-formulas/{{name}}.git"
-              CREDENTIALS_ID:
-                type: string
-                default: "gerrit"
-              BRANCHES:
-                type: string
-                default: "{{branches}}"
+      job:
+        git-mirror-2way-salt-formulas-scripts:
+          discard:
+            build:
+              keep_num: 10
+            artifact:
+              keep_num: 10
+          type: workflow-scm
+          concurrent: false
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            credentials: "gerrit"
+            script: git-mirror-2way-pipeline.groovy
+            github:
+              url: "https://github.com/salt-formulas/salt-formulas-scripts"
+          trigger:
+            github:
+            pollscm:
+              spec: ${_param:jenkins_pollscm_spec}
+          param:
+            SOURCE_URL:
+              type: string
+              default: "${_param:jenkins_gerrit_url}/salt-formulas/salt-formulas-scripts.git"
+            TARGET_URL:
+              type: string
+              default: "https://github.com/salt-formulas/salt-formulas-scripts.git"
+            CREDENTIALS_ID:
+              type: string
+              default: "gerrit"
+            BRANCHES:
+              type: string
+              default: "master"
diff --git a/jenkins/client/job/salt-formulas/tests.yml b/jenkins/client/job/salt-formulas/tests.yml
index 3b3eb43..44fd4c1 100644
--- a/jenkins/client/job/salt-formulas/tests.yml
+++ b/jenkins/client/job/salt-formulas/tests.yml
@@ -13,6 +13,7 @@
             - name: avinetworks
             - name: backupninja
             - name: barbican
+            - name: baremetal-simulator
             - name: billometer
             - name: bind
             - name: bird
@@ -114,7 +115,6 @@
             - name: supervisor
             - name: swift
             - name: taiga
-            - name: tinyproxy
             - name: telegraf
             - name: tinyproxy
             - name: tftpd-hpa
diff --git a/jenkins/client/job/salt-models/tests.yml b/jenkins/client/job/salt-models/tests.yml
index 5e7e82b..19ed2e0 100644
--- a/jenkins/client/job/salt-models/tests.yml
+++ b/jenkins/client/job/salt-models/tests.yml
@@ -164,7 +164,7 @@
                 default: "1"
               EXTRA_FORMULAS:
                 type: string
-                default: "xtrabackup docker haproxy aptly keepalived gerrit jenkins openldap maas"
+                default: "aptly artifactory backupninja collectd devops-portal docker elasticsearch freeipa gerrit glusterfs grafana haproxy heka horizon influxdb jenkins keepalived kibana libvirt maas memcached mysql nginx ntp openldap openssh postfix prometheus rsync rsyslog rundeck sensu sphinx telegraf xtrabackup"
       job:
         test-salt-model-node:
           name: test-salt-model-node
diff --git a/jenkins/client/job/validate.yml b/jenkins/client/job/validate.yml
index 6d3ecda..6bf4cac 100644
--- a/jenkins/client/job/validate.yml
+++ b/jenkins/client/job/validate.yml
@@ -126,6 +126,14 @@
               type: string
               default: ""
               description: Git branch which will be used during the checkout
+            RALLY_SCENARIOS:
+              type: string
+              default: ""
+              description: Rally scenarios directory or file with scenarios
+            RALLY_TASK_ARGS_FILE:
+              type: string
+              default: ""
+              description: Rally scenarios arguments file
             AVAILABILITY_ZONE:
               type: string
               default: "nova"
diff --git a/kibana/server/single.yml b/kibana/server/single.yml
index fe0555c..e6a0a4d 100644
--- a/kibana/server/single.yml
+++ b/kibana/server/single.yml
@@ -1,9 +1,12 @@
 classes:
 - service.kibana.server.single
 parameters:
+  _param:
+    kibana_version: 4
   kibana:
     server:
       enabled: true
+      version: ${_param:kibana_version}
       default_app_id: "dashboard/logs"
       bind:
         address: ${_param:single_address}
diff --git a/linux/system/repo/elasticsearch5.yml b/linux/system/repo/elasticsearch5.yml
new file mode 100644
index 0000000..34699e8
--- /dev/null
+++ b/linux/system/repo/elasticsearch5.yml
@@ -0,0 +1,12 @@
+parameters:
+  linux:
+    system:
+      repo:
+        elasticsearch:
+          source: "deb https://artifacts.elastic.co/packages/5.x/apt stable main"
+          architectures: amd64
+          key_url: "https://artifacts.elastic.co/GPG-KEY-elasticsearch"
+        elasticsearch_curator:
+          source: "deb http://packages.elastic.co/curator/4/debian stable main"
+          architectures: amd64
+          key_url: "https://packages.elastic.co/GPG-KEY-elasticsearch"
diff --git a/linux/system/repo/fluentd.yml b/linux/system/repo/fluentd.yml
new file mode 100644
index 0000000..bec4794
--- /dev/null
+++ b/linux/system/repo/fluentd.yml
@@ -0,0 +1,8 @@
+parameters:
+  linux:
+    system:
+      repo:
+        fluentd3:
+          source: "deb [arch=amd64] http://packages.treasuredata.com/3/ubuntu/${_param:linux_system_codename} ${_param:linux_system_codename} contrib"
+          architectures: amd64
+          key_url: "http://packages.treasuredata.com/GPG-KEY-td-agent"
\ No newline at end of file
diff --git a/linux/system/repo/kibana5.yml b/linux/system/repo/kibana5.yml
new file mode 100644
index 0000000..0d6235b
--- /dev/null
+++ b/linux/system/repo/kibana5.yml
@@ -0,0 +1,7 @@
+parameters:
+  linux:
+    system:
+      repo:
+        kibana:
+          source: "deb https://artifacts.elastic.co/packages/5.x/apt stable main"
+          key_url: "https://artifacts.elastic.co/GPG-KEY-elasticsearch"
\ No newline at end of file
diff --git a/linux/system/repo/mcp/openstack.yml b/linux/system/repo/mcp/openstack.yml
index 8b91431..baa363a 100644
--- a/linux/system/repo/mcp/openstack.yml
+++ b/linux/system/repo/mcp/openstack.yml
@@ -13,38 +13,6 @@
           - pin: 'release a=${_param:openstack_version}'
             priority: 1100
             package: '*'
-        mirantis_openstack_hotfix:
-          source: "deb http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename} ${_param:openstack_version}-hotfix main"
-          architectures: amd64
-          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename}/archive-mcp${_param:openstack_version}.key"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-hotfix'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_security:
-          source: "deb http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename} ${_param:openstack_version}-security main"
-          architectures: amd64
-          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename}/archive-mcp${_param:openstack_version}.key"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-security'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_updates:
-          source: "deb http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename} ${_param:openstack_version}-updates main"
-          architectures: amd64
-          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename}/archive-mcp${_param:openstack_version}.key"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-updates'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_holdback:
-          source: "deb http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename} ${_param:openstack_version}-holdback main"
-          architectures: amd64
-          key_url: "http://mirror.fuel-infra.org/mcp-repos/${_param:openstack_version}/${_param:linux_system_codename}/archive-mcp${_param:openstack_version}.key"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-holdback'
-            priority: 1100
-            package: '*'
         mk_openstack:
           source: "deb [arch=amd64] http://apt.mirantis.com/${_param:linux_system_codename}/ ${_param:linux_system_repo_mk_openstack_version} ${_param:openstack_version}"
           architectures: amd64
diff --git a/linux/system/repo_local/mcp/extra.yml b/linux/system/repo_local/mcp/extra.yml
index c55ecfc..90339d3 100644
--- a/linux/system/repo_local/mcp/extra.yml
+++ b/linux/system/repo_local/mcp/extra.yml
@@ -15,3 +15,6 @@
           - pin: 'release a=${_param:linux_system_repo_mcp_extra_version}'
             priority: 1100
             package: '*'
+          - pin: 'release a=${_param:linux_system_repo_mcp_extra_version}'
+            priority: 500
+            package: 'libsodium18'
diff --git a/linux/system/repo_local/mcp/openstack.yml b/linux/system/repo_local/mcp/openstack.yml
index 83bb29b..a25cc57 100644
--- a/linux/system/repo_local/mcp/openstack.yml
+++ b/linux/system/repo_local/mcp/openstack.yml
@@ -10,36 +10,3 @@
           - pin: 'release a=${_param:openstack_version}'
             priority: 1100
             package: '*'
-        mirantis_openstack_hotfix:
-          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version}-hotfix main"
-          architectures: amd64
-          key_url: "http://${_param:local_repo_url}/public.gpg"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-hotfix'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_security:
-          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version}-security main"
-          architectures: amd64
-          key_url: "http://${_param:local_repo_url}/public.gpg"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-security'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_updates:
-          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version}-updates main"
-          architectures: amd64
-          key_url: "http://${_param:local_repo_url}/public.gpg"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-updates'
-            priority: 1100
-            package: '*'
-        mirantis_openstack_holdback:
-          refresh_db: ${_param:linux_repo_refresh_db}
-          source: "deb [arch=amd64] http://${_param:local_repo_url}/ubuntu-${_param:linux_system_codename}/ ${_param:openstack_version}-holdback main"
-          architectures: amd64
-          key_url: "http://${_param:local_repo_url}/public.gpg"
-          pin:
-          - pin: 'release a=${_param:openstack_version}-holdback'
-            priority: 1100
-            package: '*'
diff --git a/linux/system/single/debian.yml b/linux/system/single/debian.yml
index b6d0b2b..bb3cb54 100644
--- a/linux/system/single/debian.yml
+++ b/linux/system/single/debian.yml
@@ -8,3 +8,7 @@
       package:
         python-msgpack:
           version: latest
+      apt:
+        config:
+          compression-workaround:
+            "Acquire::CompressionTypes::Order": "gz"
diff --git a/neutron/client/service/ironic_provision.yml b/neutron/client/service/ironic_provision.yml
new file mode 100644
index 0000000..fc545b6
--- /dev/null
+++ b/neutron/client/service/ironic_provision.yml
@@ -0,0 +1,21 @@
+classes:
+- service.neutron.client
+parameters:
+  neutron:
+    client:
+      server:
+        admin_identity:
+          endpoint_type: internalURL
+          network:
+            baremetal-provision-network:
+              tenant: admin
+              shared: false
+              admin_state_up: True
+              port_security_enabled: false
+              subnet:
+                baremetal-provision-subnet:
+                  cidr: ${_param:openstack_baremetal_neutron_subnet_cidr}
+                  allocation_pools:
+                    - start: ${_param:openstack_baremetal_neutron_subnet_allocation_start}
+                      end: ${_param:openstack_baremetal_neutron_subnet_allocation_end}
+                  enable_dhcp: true
diff --git a/neutron/compute/nfv/dpdk.yml b/neutron/compute/nfv/dpdk.yml
index 3f05d53..c8872c7 100644
--- a/neutron/compute/nfv/dpdk.yml
+++ b/neutron/compute/nfv/dpdk.yml
@@ -10,6 +10,9 @@
         dpdk_socket_mem: "${_param:compute_ovs_dpdk_socket_mem}"
         dpdk_lcore_mask: "${_param:compute_ovs_dpdk_lcore_mask}"
         memory_channels: "${_param:compute_ovs_memory_channels}"
+        vhost_socket_dir:
+          name: "openvswitch-vhost"
+          path: "/run/openvswitch-vhost"
   neutron:
     compute:
       dpdk: True
diff --git a/neutron/gateway/cluster.yml b/neutron/gateway/cluster.yml
index c96c6bb..558a814 100644
--- a/neutron/gateway/cluster.yml
+++ b/neutron/gateway/cluster.yml
@@ -4,6 +4,11 @@
   _param:
     neutron_enable_qos: False
     neutron_enable_vlan_aware_vms: False
+  linux:
+    system:
+      kernel:
+        sysctl:
+          fs.inotify.max_user_instances: 4096
   neutron:
     gateway:
       dvr: ${_param:neutron_gateway_dvr}
diff --git a/nova/compute/cluster.yml b/nova/compute/cluster.yml
index e8b29cc..5d0e6a1 100644
--- a/nova/compute/cluster.yml
+++ b/nova/compute/cluster.yml
@@ -1,6 +1,5 @@
 classes:
 - service.nova.compute.kvm
-- service.iptables.server
 parameters:
   _param:
     nova_vncproxy_url: https://${_param:cluster_public_host}:6080
@@ -95,15 +94,3 @@
         public_key: ${_param:nova_compute_ssh_public}
         private_key: ${_param:nova_compute_ssh_private}
       my_ip: ${_param:single_address}
-      libvirt:
-        uri: qemu+unix:///system?socket=/var/run/libvirt/libvirt-sock
-  iptables:
-    service:
-      enabled: true
-      chain:
-        INPUT:
-          rules:
-            # deny any connections to libvirt port
-            - destination_port: 16509
-              protocol: tcp
-              jump: DROP
\ No newline at end of file
diff --git a/nova/compute/single.yml b/nova/compute/single.yml
index d5126df..b915145 100644
--- a/nova/compute/single.yml
+++ b/nova/compute/single.yml
@@ -2,7 +2,6 @@
 - nova
 classes:
 - service.nova.compute.kvm
-- service.iptables.server
 parameters:
   _param:
     nova_vncproxy_url: https://${_param:cluster_public_host}:6080
@@ -91,15 +90,3 @@
         public_key: ${_param:nova_compute_ssh_public}
         private_key: ${_param:nova_compute_ssh_private}
       my_ip: ${_param:single_address}
-      libvirt:
-        uri: qemu+unix:///system?socket=/var/run/libvirt/libvirt-sock
-  iptables:
-    service:
-      enabled: true
-      chain:
-        INPUT:
-          rules:
-            # deny any connections to libvirt port
-            - destination_port: 16509
-              protocol: tcp
-              jump: DROP
\ No newline at end of file
diff --git a/opencontrail/client/resource/global_vrouter_config.yml b/opencontrail/client/resource/global_vrouter_config.yml
index 15bf76e..9537775 100644
--- a/opencontrail/client/resource/global_vrouter_config.yml
+++ b/opencontrail/client/resource/global_vrouter_config.yml
@@ -2,7 +2,7 @@
   opencontrail:
     client:
       global_vrouter_config:
-        name: global-vrouter-config
+        name: default-global-vrouter-config
         parent_type: global-system-config
         encap_priority: "MPLSoUDP,MPLSoGRE"
         vxlan_vn_id_mode: automatic
diff --git a/opencontrail/control/analytics4_0.yml b/opencontrail/control/analytics4_0.yml
index a122830..a426e02 100644
--- a/opencontrail/control/analytics4_0.yml
+++ b/opencontrail/control/analytics4_0.yml
@@ -11,33 +11,27 @@
     opencontrail_message_queue_node02_address: ${_param:openstack_message_queue_node02_address}
     opencontrail_message_queue_node03_address: ${_param:openstack_message_queue_node03_address}
     opencontrail_message_queue_address: ${_param:openstack_message_queue_address}
+    opencontrail_analytics_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-analytics
+    opencontrail_analyticsdb_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-analyticsdb
 # Temprorary fix for MOS9 packages to pin old version of kafka
   linux:
     system:
-      package:
-        librdkafka1:
-          version: 0.9.0-0contrail0
-          hold: true
-        python-kafka:
-          version: 1.0.1-0contrail1
-          hold: true
       kernel:
         modules:
         - nf_conntrack_ipv4
   opencontrail:
     common:
+      config_only: true
       identity:
         host: ${_param:openstack_control_address}
       network:
         host: ${_param:openstack_control_address}
     collector:
+      config_only: true
       discovery:
         host: None
-      database:
-        members:
-        - host: ${_param:opencontrail_analytics_node01_address}
-        - host: ${_param:opencontrail_analytics_node02_address}
-        - host: ${_param:opencontrail_analytics_node03_address}
+      identity:
+        host: ${_param:openstack_control_address}
       analytics:
         members:
         - host: ${_param:opencontrail_analytics_node01_address}
@@ -55,6 +49,7 @@
         - host: ${_param:opencontrail_control_node02_address}
         - host: ${_param:opencontrail_control_node03_address}
     database:
+      config_only: true
       discovery:
         host: None
       analytics:
@@ -62,3 +57,34 @@
         - host: ${_param:opencontrail_analytics_node01_address}
         - host: ${_param:opencontrail_analytics_node02_address}
         - host: ${_param:opencontrail_analytics_node03_address}
+  docker:
+    client:
+      compose:
+        opencontrail_api:
+          status: up
+          pull: true
+          service:
+            analytics:
+              image: ${_param:opencontrail_analytics_image}
+              network_mode: "host"
+              privileged: true
+              volumes:
+                - /etc/contrail:/etc/contrail
+                - /etc/redis/redis.conf:/etc/redis/redis.conf
+            analyticsdb:
+              image: ${_param:opencontrail_analyticsdb_image}
+              volumes:
+                - /etc/cassandra/cassandra-env-analytics.sh:/etc/cassandra/cassandra-env.sh
+                - /etc/cassandra/cassandra_analytics.yaml:/etc/cassandra/cassandra.yaml
+                - /etc/cassandra/logback.xml:/etc/cassandra/logback.xml
+                - /etc/contrail:/etc/contrail
+                - /var/lib/analyticsdb:/var/lib/cassandra
+                - /var/lib/analyticsdb_zookeeper_data:/var/lib/zookeeper
+                - /var/lib/zookeeper/myid:/var/lib/zookeeper/myid
+                - /usr/share/kafka/config/server.properties:/usr/share/kafka/config/server.properties
+                - /usr/share/kafka/config/consumer.properties:/usr/share/kafka/config/consumer.properties
+                - /usr/share/kafka/config/zookeeper.properties:/usr/share/kafka/config/zookeeper.properties
+                - /etc/zookeeper/conf/zoo_analytics.cfg:/etc/zookeeper/conf/zoo.cfg
+                - /etc/zookeeper/conf/log4j.properties:/etc/zookeeper/conf/log4j.properties
+              network_mode: "host"
+              privileged: true
diff --git a/opencontrail/control/cluster4_0.yml b/opencontrail/control/cluster4_0.yml
index cd12eef..9796930 100644
--- a/opencontrail/control/cluster4_0.yml
+++ b/opencontrail/control/cluster4_0.yml
@@ -12,31 +12,27 @@
     opencontrail_message_queue_node02_address: ${_param:openstack_control_node02_address}
     opencontrail_message_queue_node03_address: ${_param:openstack_control_node03_address}
     opencontrail_message_queue_address: ${_param:openstack_control_address}
+    opencontrail_analytics_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-analytics
+    opencontrail_analyticsdb_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-analyticsdb
+    opencontrail_controller_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-controller
+    analytics_vip_address: ${_param:opencontrail_analytics_address}
 # Temprorary fix for MOS9 packages to pin old version of kafka
   linux:
     system:
-      package:
-        librdkafka1:
-          version: 0.9.0-0contrail0
-        python-kafka:
-          version: 1.0.1-0contrail1
       kernel:
         modules:
         - nf_conntrack_ipv4
   opencontrail:
     common:
+      config_only: true
       identity:
         host: ${_param:openstack_control_address}
       network:
         host: ${_param:openstack_control_address}
     collector:
+      config_only: true
       discovery:
         host: None
-      database:
-        members:
-        - host: ${_param:cluster_node01_address}
-        - host: ${_param:cluster_node02_address}
-        - host: ${_param:cluster_node03_address}
       analytics:
         members:
         - host: ${_param:cluster_node01_address}
@@ -54,6 +50,7 @@
         - host: ${_param:cluster_node02_address}
         - host: ${_param:cluster_node03_address}
     database:
+      config_only: true
       discovery:
         host: None
       analytics:
@@ -62,6 +59,7 @@
         - host: ${_param:cluster_node02_address}
         - host: ${_param:cluster_node03_address}
     config:
+      config_only: true
       network:
         host: ${_param:openstack_control_address}
       bind:
@@ -84,6 +82,9 @@
         region: ${_param:openstack_region}
         host: ${_param:openstack_control_address}
     control:
+      config_only: true
+      identity:
+        host: ${_param:openstack_control_address}
       analytics:
         members:
         - host: ${_param:cluster_node01_address}
@@ -102,6 +103,7 @@
       discovery:
         host: None
     web:
+      config_only: true
       analytics:
         host: ${_param:opencontrail_control_address}
       cache:
@@ -109,6 +111,51 @@
       identity:
         host: ${_param:openstack_control_address}
       database:
-        port: 9042
+        port: 9041
       network:
         host: ${_param:openstack_control_address}
+  docker:
+    client:
+      compose:
+        opencontrail_api:
+          status: up
+          pull: true
+          service:
+            controller:
+              image: ${_param:opencontrail_controller_image}
+              volumes:
+                - /etc/contrail:/etc/contrail
+                - /var/lib/configdb:/var/lib/cassandra
+                - /var/lib/config_zookeeper_data:/var/lib/zookeeper
+                - /var/lib/zookeeper/myid:/var/lib/zookeeper/myid
+                - /etc/cassandra/cassandra-env.sh:/etc/cassandra/cassandra-env.sh
+                - /etc/cassandra/cassandra.yaml:/etc/cassandra/cassandra.yaml
+                - /etc/cassandra/logback.xml:/etc/cassandra/logback.xml
+                - /etc/zookeeper/conf/zoo.cfg:/etc/zookeeper/conf/zoo.cfg
+                - /etc/zookeeper/conf/log4j.properties:/etc/zookeeper/conf/log4j.properties
+              network_mode: "host"
+              privileged: true
+            analytics:
+              image: ${_param:opencontrail_analytics_image}
+              network_mode: "host"
+              privileged: true
+              volumes:
+                - /etc/contrail:/etc/contrail
+                - /etc/redis/redis.conf:/etc/redis/redis.conf
+            analyticsdb:
+              image: ${_param:opencontrail_analyticsdb_image}
+              volumes:
+                - /etc/cassandra/cassandra-env-analytics.sh:/etc/cassandra/cassandra-env.sh
+                - /etc/cassandra/cassandra_analytics.yaml:/etc/cassandra/cassandra.yaml
+                - /etc/cassandra/logback.xml:/etc/cassandra/logback.xml
+                - /etc/contrail:/etc/contrail
+                - /var/lib/analyticsdb:/var/lib/cassandra
+                - /var/lib/analyticsdb_zookeeper_data:/var/lib/zookeeper
+                - /var/lib/zookeeper/myid:/var/lib/zookeeper/myid
+                - /usr/share/kafka/config/server.properties:/usr/share/kafka/config/server.properties
+                - /usr/share/kafka/config/consumer.properties:/usr/share/kafka/config/consumer.properties
+                - /usr/share/kafka/config/zookeeper.properties:/usr/share/kafka/config/zookeeper.properties
+                - /etc/zookeeper/conf/zoo_analytics.cfg:/etc/zookeeper/conf/zoo.cfg
+                - /etc/zookeeper/conf/log4j.properties:/etc/zookeeper/conf/log4j.properties
+              network_mode: "host"
+              privileged: true
diff --git a/opencontrail/control/control4_0.yml b/opencontrail/control/control4_0.yml
index 32b51e5..f1d603c 100644
--- a/opencontrail/control/control4_0.yml
+++ b/opencontrail/control/control4_0.yml
@@ -9,13 +9,17 @@
     opencontrail_message_queue_node01_address: ${_param:openstack_message_queue_node01_address}
     opencontrail_message_queue_node02_address: ${_param:openstack_message_queue_node02_address}
     opencontrail_message_queue_node03_address: ${_param:openstack_message_queue_node03_address}
+    opencontrail_controller_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-controller
+    analytics_vip_address: ${_param:opencontrail_analytics_address}
   opencontrail:
     common:
+      config_only: true
       identity:
         host: ${_param:openstack_control_address}
       network:
         host: ${_param:openstack_control_address}
     config:
+      config_only: true
       network:
         host: ${_param:openstack_control_address}
       bind:
@@ -38,6 +42,7 @@
         region: ${_param:openstack_region}
         host: ${_param:openstack_control_address}
     control:
+      config_only: true
       analytics:
         members:
         - host: ${_param:opencontrail_analytics_node01_address}
@@ -56,6 +61,7 @@
       discovery:
         host: None
     web:
+      config_only: true
       analytics:
         host: ${_param:opencontrail_analytics_address}
       cache:
@@ -63,10 +69,11 @@
       identity:
         host: ${_param:openstack_control_address}
       database:
-        port: 9042
+        port: 9041
       network:
         host: ${_param:openstack_control_address}
     database:
+      config_only: true
       analytics:
         members:
         - host: ${_param:opencontrail_analytics_node01_address}
@@ -77,3 +84,24 @@
       kernel:
         modules:
         - nf_conntrack_ipv4
+  docker:
+    client:
+      compose:
+        opencontrail_api:
+          status: up
+          pull: true
+          service:
+            controller:
+              image: ${_param:opencontrail_controller_image}
+              volumes:
+                - /etc/contrail:/etc/contrail
+                - /var/lib/configdb:/var/lib/cassandra
+                - /var/lib/config_zookeeper_data:/var/lib/zookeeper
+                - /var/lib/zookeeper/myid:/var/lib/zookeeper/myid
+                - /etc/cassandra/cassandra-env.sh:/etc/cassandra/cassandra-env.sh
+                - /etc/cassandra/cassandra.yaml:/etc/cassandra/cassandra.yaml
+                - /etc/cassandra/logback.xml:/etc/cassandra/logback.xml
+                - /etc/zookeeper/conf/zoo.cfg:/etc/zookeeper/conf/zoo.cfg
+                - /etc/zookeeper/conf/log4j.properties:/etc/zookeeper/conf/log4j.properties
+              network_mode: "host"
+              privileged: true
diff --git a/opencontrail/control/single4_0.yml b/opencontrail/control/single4_0.yml
index 365ed20..ded5289 100644
--- a/opencontrail/control/single4_0.yml
+++ b/opencontrail/control/single4_0.yml
@@ -5,14 +5,13 @@
   _param:
     opencontrail_version: 4.0
     linux_repo_contrail_component: oc40
+    opencontrail_analytics_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-analytics
+    opencontrail_analyticsdb_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-analyticsdb
+    opencontrail_controller_image: docker-prod-local.artifactory.mirantis.com/opencontrail/opencontrail-controller
 # Temprorary fix for MOS9 packages to pin old version of kafka
   linux:
     system:
       package:
-        librdkafka1:
-          version: 0.9.0-0contrail0
-        python-kafka:
-          version: 1.0.1-0contrail1
         contrail-api-cli:
           version: latest
       kernel:
@@ -73,11 +72,13 @@
           password: ${_param:opencontrail_stats_password}
   opencontrail:
     common:
+      config_only: true
       identity:
         host: ${_param:openstack_control_address}
       network:
         host: ${_param:openstack_control_address}
     config:
+      config_only: true
       network:
         host: ${_param:openstack_control_address}
       bind:
@@ -96,6 +97,7 @@
         region: ${_param:openstack_region}
         host: ${_param:openstack_control_address}
     control:
+      config_only: true
       analytics:
         members:
         - host: ${_param:single_address}
@@ -108,6 +110,7 @@
       discovery:
         host: None
     web:
+      config_only: true
       analytics:
         host: ${_param:single_address}
       cache:
@@ -115,14 +118,18 @@
       identity:
         host: ${_param:openstack_control_address}
       database:
-        port: 9042
+        port: 9041
       network:
         host: ${_param:openstack_control_address}
     database:
+      config_only: true
       analytics:
         members:
         - host: ${_param:single_address}
     collector:
+      config_only: true
+      identity:
+        host: ${_param:openstack_control_address}
       discovery:
         host: None
       database:
@@ -138,3 +145,48 @@
       config:
         members:
         - host: ${_param:single_address}
+  docker:
+    client:
+      compose:
+        opencontrail_api:
+          status: up
+          pull: true
+          service:
+            controller:
+              image: ${_param:opencontrail_controller_image}
+              volumes:
+                - /etc/contrail:/etc/contrail
+                - /var/lib/configdb:/var/lib/cassandra
+                - /var/lib/config_zookeeper_data:/var/lib/zookeeper
+                - /var/lib/zookeeper/myid:/var/lib/zookeeper/myid
+                - /etc/cassandra/cassandra-env.sh:/etc/cassandra/cassandra-env.sh
+                - /etc/cassandra/cassandra.yaml:/etc/cassandra/cassandra.yaml
+                - /etc/cassandra/logback.xml:/etc/cassandra/logback.xml
+                - /etc/zookeeper/conf/zoo.cfg:/etc/zookeeper/conf/zoo.cfg
+                - /etc/zookeeper/conf/log4j.properties:/etc/zookeeper/conf/log4j.properties
+              network_mode: "host"
+              privileged: true
+            analytics:
+              image: ${_param:opencontrail_analytics_image}
+              network_mode: "host"
+              privileged: true
+              volumes:
+                - /etc/contrail:/etc/contrail
+                - /etc/redis/redis.conf:/etc/redis/redis.conf
+            analyticsdb:
+              image: ${_param:opencontrail_analyticsdb_image}
+              volumes:
+                - /etc/cassandra/cassandra-env-analytics.sh:/etc/cassandra/cassandra-env.sh
+                - /etc/cassandra/cassandra_analytics.yaml:/etc/cassandra/cassandra.yaml
+                - /etc/cassandra/logback.xml:/etc/cassandra/logback.xml
+                - /etc/contrail:/etc/contrail
+                - /var/lib/analyticsdb:/var/lib/cassandra
+                - /var/lib/analyticsdb_zookeeper_data:/var/lib/zookeeper
+                - /var/lib/zookeeper/myid:/var/lib/zookeeper/myid
+                - /usr/share/kafka/config/server.properties:/usr/share/kafka/config/server.properties
+                - /usr/share/kafka/config/consumer.properties:/usr/share/kafka/config/consumer.properties
+                - /usr/share/kafka/config/zookeeper.properties:/usr/share/kafka/config/zookeeper.properties
+                - /etc/zookeeper/conf/zoo_analytics.cfg:/etc/zookeeper/conf/zoo.cfg
+                - /etc/zookeeper/conf/log4j.properties:/etc/zookeeper/conf/log4j.properties
+              network_mode: "host"
+              privileged: true
diff --git a/openssh/server/team/k8s_team.yml b/openssh/server/team/k8s_team.yml
index 9ec2b88..934afd6 100644
--- a/openssh/server/team/k8s_team.yml
+++ b/openssh/server/team/k8s_team.yml
@@ -1,3 +1,5 @@
+classes:
+- system.openssh.server.team.members.ashestakov
 parameters:
   _param:
     linux_system_user_sudo: true
diff --git a/openssh/server/team/maintenance.yml b/openssh/server/team/maintenance.yml
new file mode 100644
index 0000000..44e8639
--- /dev/null
+++ b/openssh/server/team/maintenance.yml
@@ -0,0 +1,9 @@
+classes:
+- system.linux.system.sudo
+- system.openssh.server.team.members.astupnikov
+- system.openssh.server.team.members.dmeltsaykin
+- system.openssh.server.team.members.myatsenko
+- system.openssh.server.team.members.omolchanov
+parameters:
+  _param:
+    linux_system_user_sudo: true
diff --git a/openssh/server/team/members/astupnikov.yml b/openssh/server/team/members/astupnikov.yml
new file mode 100644
index 0000000..d4522f6
--- /dev/null
+++ b/openssh/server/team/members/astupnikov.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        astupnikov:
+          enabled: true
+          name: astupnikov
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Alexey Stupnikov
+          home: /home/astupnikov
+          email: astupnikov@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        astupnikov:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDrV6q403BYodTCb8BCsWlkW6AHxvtCH5JxI9gUANsvbQd9n8fd16xqgXVecCRBJOS4PVauLNiQPMaj6ZuFeRZ8ZXvX498eNSNa5WhBbSwk0X/DqdK1LN/MStTAtL60JQV0yQSY+BghVJkREw4MJJBksyP0X+OG5AB+ijh/bjsabYr+EQNK+WJblrsRvNNCbjiWPcjzXVMxUrzphB09CYMwWFgx1An5jS7c1EGvXrzf0aK1KkadhGnXcjPACFaMGPYmu5HNgQcRnzNXDQU6PLGeyqNnZYZjHdQWZR88cQywznqzI8y9P4qSOTVStYoKLlYsdQFRTw8sJrRpPZupgSED astupnikov@astupnikov-srv
+          user: ${linux:system:user:astupnikov}
diff --git a/openssh/server/team/members/crh.yml b/openssh/server/team/members/crh.yml
new file mode 100644
index 0000000..8179415
--- /dev/null
+++ b/openssh/server/team/members/crh.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        crh:
+          enabled: true
+          name: crh
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Christian Huebner
+          home: /home/crh
+          email: chuebner@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        crh:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjW4PSMoILjoZWDM8RnbiW6HXHBFntnDd6jgAlokJhTpYIjzUHpoh/OqphraKbNFnPbzL2nkIbaKZqKj+uuvbsitHnApmdFgSpOmBRGeaSExA30GqweYrIMKN5JAQTbONZWLSm+LD689CXRv2s6Th/YMELYfoi2W0pkvwiBdr+/0NxpdRvJydCn36SE6wOigu4uJXIXeNqIjTD+x4sW6GB54Ugbg+SMmI9D5ONlmfEj8K/ZmG1THdPGOLlquy/VLiuOBuwNoJCBV9shsGEmdg8NiOu8NPupQlsbmClZDbBAklJ0AF6ElAwKSiqCOhbaa7hu4qJFrCKC+XAgYxS9t7r
+          user: ${linux:system:user:crh}
diff --git a/openssh/server/team/members/dkruglov.yml b/openssh/server/team/members/dkruglov.yml
new file mode 100644
index 0000000..358e365
--- /dev/null
+++ b/openssh/server/team/members/dkruglov.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        dkruglov:
+          enabled: true
+          name: dkruglov
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Dmitriy Kruglov
+          home: /home/dkruglov
+          email: dkruglov@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        dkruglov:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDd0peqhFCRgFhxsAV23TJ6la96FH7CFd/XYW67vaxWrlWSZsba9+aMMpNFPjNfrcAqZsKNlRk3EOEAHyS4JQHcOzQAxYU5kCnqg2YnIY3bp4ihDwF/V+4xMRvt8avdlo9qBFQGqiX7iPleMM089wiATi6NYsacooqNEhrjf3NvqeJBK2NLS82aSdOFF7reC58hyomArD1dJE1usF28l5+i8d8ALlzOlMLLaIRPFmbJeT43S+VXNycREektwVbXvF+Lmt2FST1oQD2KMd+aWltLsGg2KlXwlzMIod1UuYx0ZcIk7o1GYY7duNP+gmldj+TTqAgqlOChusw8iAdOUPff dkruglov@mirantis.com
+          user: ${linux:system:user:dkruglov}
diff --git a/openssh/server/team/members/dmeltsaykin.yml b/openssh/server/team/members/dmeltsaykin.yml
new file mode 100644
index 0000000..1b5ff2e
--- /dev/null
+++ b/openssh/server/team/members/dmeltsaykin.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        dmeltsaykin:
+          enabled: true
+          name: dmeltsaykin
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Denis Meltsaykin
+          home: /home/dmeltsaykin
+          email: dmeltsaykin@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        dmeltsaykin:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqfNIy3WuxzRzOY/GBNGOnP5UrCFWZ8uMzW6hEl4wgIEYYIcv8o+C1/hvrfHimG/I/rAwYRS6Dx0bZ7m49zATNxe+EVer3BV63ru34Hzel/XxxyD34ULmrDgvP3olaAKFI17gVOFQ7hCBzDRp3s4YN3ojQspPyeiO+Jt8OwVomxJWgLauAHhl7Z/XPVHpT/fssJGG/eC4oOz4RZ4jAk0BH3Yl8s63grfwrgB79H/+nr0UvBdTkBn3T5WiC4gxnm+jQQwci7/BLQsg1Z3OykfTuyftIexNyVVy/SmdsGi37RJGFKRMMovoZx+261JgaHWBoHqBJa5UpV2usi9z3Py2z avgoor@MacBook-Pro-Denis.local
+          user: ${linux:system:user:dmeltsaykin}
diff --git a/openssh/server/team/members/mpolreich.yml b/openssh/server/team/members/mpolreich.yml
index a4658aa..cfe8b70 100644
--- a/openssh/server/team/members/mpolreich.yml
+++ b/openssh/server/team/members/mpolreich.yml
@@ -16,5 +16,5 @@
         mpolreich:
           enabled: true
           public_keys:
-            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC0N+ds8BGTR+ZQo9NSRGRbjv3T8AbPmtSw2nClXxetRdmHpM/mU7/5iD7qfkCXtNptKeCG/Qk44wlijnAtjztJK1qfvyphHe3etZxLnqhYMm73Yy++yKPE/ywFPFb+7kd0BDy2iZqohZpX3gUi5iDnvXUInHNqqtTv3xFe2kmn3lq5bSRuUMtr61nZ7z/fkX8kNfoGxKrm7bhSo5zq4sjTrj3lk1LKZc1HYji3RwrzBM0z4eyed1BaJyDNtG+eFN4nOnvVn59452AR8SmKJXRErk37rEoQn80xszypzybooFPN5dpdB6u9b4xquFCOD83usb8kEjKY9VIYGuXxEEts1KIF20J+xd8UnZU8d4JL50G8JY8zdNgurR3ZyMD2okuord4cpHF8SVecsAyRV6nuhDxVtF2Xn/RriY02jrLoRPsS+3nIrKt9H8vpQZMYJ+jgEpekZhhVfz4AP3pATzOrWENzNXj5G1bLJs1C9aTtwE27EnKW73XekX/GLsehCwsQ21JvDX8PMxJwLVfqvkRlrc5GILEIVgjZ82Cj6Eens1QobymRAEWuEpZxkPx6u0kGO62ri8zFx8+NYwYDz3mwhHDRT34T/Rvzy/9V9xVjkUQOj9cZ3eYBnC1MffJjx8heHDmSQmUd+99zKa9Hzr74z3AvR3AIgFqmu7kx5fIMew== ubuntu@thinkpad-x1
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDC6jbVpCqvru+Te2RGLPy/AkcaoRqyqxdBi3OjjXdRjPQYGNuAEFgmlQDZvs5xBMAKOcrcCl8wLcFb3mmpr9+xBJAdR4K0bEqwMfCKRejsN+6AubCbrOeoWb9SsTdvBOl7rOFyICt/XuSNX56C8k1hJojC0U21DIertWSCd8h5RExE8Skqd9+KdHSFa+TZffWbysMrwba29UBt7XsAPuQr1BUOqhA8JOx146ul5HszitCOSvglre8pSJKpw6a4Fk/cb1J8Oc/AfSMdTvTLAfuF+d2Mw6SEawFEocSXq0WKCdZfJpZrWPr6SEB+7zoq3kvhIWgUH2ypYZvvqf0EVlWx polreichmartin@gmail.com
           user: ${linux:system:user:mpolreich}
\ No newline at end of file
diff --git a/openssh/server/team/members/myatsenko.yml b/openssh/server/team/members/myatsenko.yml
new file mode 100644
index 0000000..01c2417
--- /dev/null
+++ b/openssh/server/team/members/myatsenko.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        myatsenko:
+          enabled: true
+          name: myatsenko
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Maksym Yatsenko
+          home: /home/myatsenko
+          email: myatsenko@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        myatsenko:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3wCjIm2PVzViGp5NFxeDHLVLxSq67gR+mm4jarHyDVb8wz9kfSG6cWGXNZhrqse7NgpDZpurFunFddXQBOgR6LmOfo9sDlcl4oT0+OnWHgyK6RMYcigkVYVYI5W2f5M+3Dz/KjV1S/VmRYlh/tz46PECV+Y93RaUUXS/91Uv19SAzuCd3Rj0l43HY5ROZNK0VZSrIsnhOqLZxF71v0jY/AbFxswooMH0NCM7XFqVBsRjwclfQjIGkV1j4xeWGM1xWkvvHCSEz2JdeAR5w3C7mhCzPpQJXvQGJNuccyZzoNbHPgDdFPx76MGj/VdmeUu5yKnFSnNNoQ1CcbxmaYeJ7 myatsenko@myatsenko-pc
+          user: ${linux:system:user:myatsenko}
diff --git a/openssh/server/team/members/omolchanov.yml b/openssh/server/team/members/omolchanov.yml
new file mode 100644
index 0000000..61289ed
--- /dev/null
+++ b/openssh/server/team/members/omolchanov.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        omolchanov:
+          enabled: true
+          name: omolchanov
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Oleksii Molchanov
+          home: /home/omolchanov
+          email: omolchanov@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        myatsenko:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCulNT7qgpJtIoLshljGonHfWk5IYh/MhzO2PEh3GnzrsnI8Mgv2W8TCD4ZB7RbSP6Jt74T7P6F4Mgzag/Nxjwimh7cUJoJZQH54QC4GVBN+YG+CRjEhIDn/OEM9q+6fnAWqBLBf/k0pzeRxWM4mLpcU+6DSPS57qjEKG5OfLCgFbBFg+4EdGP9HNVTLcMBglo7vTWtvzaGjJgH0XFXjx1fXW9JftEmwMzNdoYpQ/a19JYC2x5vu0cGWUjdMWmrzJbnTJ7SwnVYfD2mhUYDi8WGy/nCk67tb6qKCAUN5kvCEWrMPDhVEcBfvyhXU2wVnZHJbOoZxrBiici9q2U7KDYT alex@alex-B85M-DS3H
+          user: ${linux:system:user:omolchanov}
diff --git a/openssh/server/team/members/pstefanski.yml b/openssh/server/team/members/pstefanski.yml
new file mode 100644
index 0000000..cd14386
--- /dev/null
+++ b/openssh/server/team/members/pstefanski.yml
@@ -0,0 +1,20 @@
+parameters:
+  linux:
+    system:
+      user:
+        pstefanski:
+          enabled: true
+          name: pstefanski
+          sudo: ${_param:linux_system_user_sudo}
+          full_name: Pawel Stefanski
+          home: /home/pstefanski
+          email: pstefanski@mirantis.com
+  openssh:
+    server:
+      enabled: true
+      user:
+        pstefanski:
+          enabled: true
+          public_keys:
+            - key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEmhgYMXA98zTAHALZKpgD4MIhHsUcAbrw0dM5AroBKiGBAEqlClxKxzsg7cC7yv4P8TloIoV656ywtgiRIfTAYoXGANxBgkeDfHFzlBQ7yYf8xU1Cl5jBG2xB9FnPJQYtxFJD36dAsUPQ4ykROw0epfBv+CCqgqmh6AWuIRnY8vGx6o3oKu4eZ4P0iSGuN2ITfVkGc32WoXFI0qIZPrnWLmIf4+LwbeA3aNZ54La5Er2wgrzdwF3D2MOBg964gCnuauUneY4WDkO81W+yUB7MA1n/WQP5dgLwdNTXiMtyNtuXs+QeEzlag2fRvMkmsUoU7oaIC3iuW8mf6967n+ED
+          user: ${linux:system:user:pstefanski}
diff --git a/openssh/server/team/oscore_devops.yml b/openssh/server/team/oscore_devops.yml
index 149d765..b5505a8 100644
--- a/openssh/server/team/oscore_devops.yml
+++ b/openssh/server/team/oscore_devops.yml
@@ -2,7 +2,6 @@
 - system.linux.system.sudo
 - system.openssh.server.team.members.vsaienko
 - system.openssh.server.team.members.vnogin
-- system.openssh.server.team.members.ashestakov
 - system.openssh.server.team.members.mkarpin
 parameters:
   _param:
diff --git a/openssh/server/team/stacklight.yml b/openssh/server/team/stacklight.yml
index 403e7e1..b46ac24 100644
--- a/openssh/server/team/stacklight.yml
+++ b/openssh/server/team/stacklight.yml
@@ -102,6 +102,13 @@
           full_name: Szymon Banka
           home: /home/sbanka
           email: sbanka@mirantis.com
+        crh:
+          enabled: true
+          name: crh
+          sudo: true
+          full_name: Christian Huebner
+          home: /home/crh
+          email: chuebner@mirantis.com
   openssh:
     client:
       enabled: true
@@ -178,6 +185,11 @@
           public_keys:
           - ${public_keys:sbanka}
           user: ${linux:system:user:sbanka}
+        crh:
+          enabled: true
+          public_keys:
+          - ${public_keys:crh}
+          user: ${linux:system:user:crh}
   public_keys:
     newt:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3odU+3V2uDA2ptAFL9hrJRPNEEdAyztWOZFQ5Oyd9oerTGOU3p4xmrgWWjfKFKbYGhiiIUcYAol5PkTfKukGEkkjCHYA1t023soCaaAj85wCZCnw2zQNAziwxTYmAzTqgxiSvtZNMMrtJvFHRIRDzJ3M1lV0prWNWkMM1/3FAd4W49y6VT3fkMCo8uqG7CfGdgR2DgBCxf9KaNPfW5eDEPOgmE5lK8tVSEI6T+Cg7hbcTf4lFYnlFBnlQgp/0JstsM4Vbwb4B34LOpOsf2S8rrWk2xQMjwaMHXkc2s/E8iW3F5nVFuyEXYISFQIiAHw8dzC6CHgLcyHUVWwznKawZ newt@newt-dev1
@@ -192,7 +204,7 @@
     vgusev:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrCyaZjs8hiwx38LfpeQ2z9n9ptwQ7gFrhq2z5sK9q/LQMCubbnp5xhyF0SMY1jmQUewBOKXhnq3QSX+DmtNsnhitnZBw2BE5PBXllCBWMMiWULfAYvB0of728Q3EEjrtyfHkt7o2E+CvreVJcVI4kBwjKh5WpVBZ8mmkW/sexLGMuYu0bUWjCddu6ZlhUa+y14VZKOKp44auemza1VL/UzqOVZkBAfR2gPV2pBG3Im+SlnOlDRxKPEXQbsn3u/sNeZq0wSY++khY86AU7jAKfL2NiNsoA7CyB0jTEKwYO3vOWOhECifZuHwY/TNWyRFWM2ImW3mT9aO7nE4w4jXXJ vgusev@vgusev
     mpolreich:
-      key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC0N+ds8BGTR+ZQo9NSRGRbjv3T8AbPmtSw2nClXxetRdmHpM/mU7/5iD7qfkCXtNptKeCG/Qk44wlijnAtjztJK1qfvyphHe3etZxLnqhYMm73Yy++yKPE/ywFPFb+7kd0BDy2iZqohZpX3gUi5iDnvXUInHNqqtTv3xFe2kmn3lq5bSRuUMtr61nZ7z/fkX8kNfoGxKrm7bhSo5zq4sjTrj3lk1LKZc1HYji3RwrzBM0z4eyed1BaJyDNtG+eFN4nOnvVn59452AR8SmKJXRErk37rEoQn80xszypzybooFPN5dpdB6u9b4xquFCOD83usb8kEjKY9VIYGuXxEEts1KIF20J+xd8UnZU8d4JL50G8JY8zdNgurR3ZyMD2okuord4cpHF8SVecsAyRV6nuhDxVtF2Xn/RriY02jrLoRPsS+3nIrKt9H8vpQZMYJ+jgEpekZhhVfz4AP3pATzOrWENzNXj5G1bLJs1C9aTtwE27EnKW73XekX/GLsehCwsQ21JvDX8PMxJwLVfqvkRlrc5GILEIVgjZ82Cj6Eens1QobymRAEWuEpZxkPx6u0kGO62ri8zFx8+NYwYDz3mwhHDRT34T/Rvzy/9V9xVjkUQOj9cZ3eYBnC1MffJjx8heHDmSQmUd+99zKa9Hzr74z3AvR3AIgFqmu7kx5fIMew== ubuntu@thinkpad-x1
+      key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDC6jbVpCqvru+Te2RGLPy/AkcaoRqyqxdBi3OjjXdRjPQYGNuAEFgmlQDZvs5xBMAKOcrcCl8wLcFb3mmpr9+xBJAdR4K0bEqwMfCKRejsN+6AubCbrOeoWb9SsTdvBOl7rOFyICt/XuSNX56C8k1hJojC0U21DIertWSCd8h5RExE8Skqd9+KdHSFa+TZffWbysMrwba29UBt7XsAPuQr1BUOqhA8JOx146ul5HszitCOSvglre8pSJKpw6a4Fk/cb1J8Oc/AfSMdTvTLAfuF+d2Mw6SEawFEocSXq0WKCdZfJpZrWPr6SEB+7zoq3kvhIWgUH2ypYZvvqf0EVlWx polreichmartin@gmail.com
     isvetlov:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9lvegjKq6OP7cgF9YU9mPOk1/mfJbov3YnYnhiW1Ks0hrWZyAo+0TV3O7LgWZ8jqD9abbYaOiWCt4d9ABkLUJfCLNAqOJRapJ+tybPAxJKx4eV8pptJ7UF0EdItasTdd+gqJJ4Krk869rwmqVQ4hethdykjhKyWu3bG+uVtFUF5xUj9zaT9NThA6/Xhz0idAiTO8ArmLng4W8ne45gANaHIWXpIsklo6GLUSZwl4z6j2z4joxNJsB1hrw0msT56F26ctkDo6thNMAzPMyZsLjYJBJIRYhdC1d4Up9114nVcY4pzYw76+zXU9zED2XNRLdyAaxFlwXvumAs3iMLI8Z isvetlov@isvetlov-mac.local
     akholkin:
@@ -207,3 +219,5 @@
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/UtqwBD6qkEoWSrmO0jXa9sUcwumySxmkX2XCTlAj+e8tzCNndNhaUueu01pbcNrGrB7xvCHyTa5cxgJEv0RAJRxZnObTjluegiuW+/KNSGwiSDy90bwPVb6zWalrDg12xGh8C0ybmv90uC+GrGO1UXFpm5N1qL3ZsUvSjWBRZ70xXjUI4self+fWxBYJhu7hGZ0RVCeA8TjRutzdOWcSZwN2Arn2Oq+fx9n5HP8iXlPcfM6aWj+QvkXphvKjUhDYiImQ07kJctYvxEwMei5pM1dAPZefQ6FRsUP1gKYKPVp1CiBHPIKLG3LMwxp0/LWQmHB4umZvA6HYplSUXZLMd+FhCRuocVFdxe308JWeIFWyw7og/qEBlpxqW4BUk0bR3c4deI9QDKWCuuunTDB4oEB8ZnkI7utknpx7sqO72Ev2UNS/CSi3yyqgOajojQ3l+McWn9bm08KSLzuuMaexETRYQ9dgjE79N7fH+DEt5Ryii+GA2a8Gl3iRtTZs9WA94mTb/KjZBrVxh+PixpQ6s3oGFelFCPMKSPWIEb+rwuAUi0Ulrqb2UZDzJYhT50QfbCzRN2MU+8bR7PJt/xpAADvQX0iMMrMUvAVngs2YrXKapJliyHhTZxOmVdDRIyCQ1YpK2ktBJf+E+RXl3R5XUmbJkT4jZ1R6cA1QJOEKVQ== nzaporozhets@mirantis.com
     sbanka:
       key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMdgjQ/jeWwQTaPyy7G5JJAkM+QPNPFkzMldPHJzOxEBzt/M5zAooj0XgbRIDIztolhXhmj8N5QSG5n3Wn9T9e2KpoxrLaVhMV5WGTgMrXMmyT8oXLV3gLxGNHMWFvplSbHLK78EsZQQ1/kBQMyPXB1+FpIuSHVOxaospOQObJ08lvQfvlO7AUUV4ecpFj3PpV5vkKPRS+KfiRm84BeGIu51BL1BClZcOyHZPBQT+DUBjm8y4Nd7pVZRjsiBzZBvUotCbn5+RqWJnu4kyoGoRNmk8pvCx7jGL1G9rE8NNsKlCUWedvyNkDeoWKvleJuzkj3ggfuCj/iTtDoXFR95e3
+    crh:
+      key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjW4PSMoILjoZWDM8RnbiW6HXHBFntnDd6jgAlokJhTpYIjzUHpoh/OqphraKbNFnPbzL2nkIbaKZqKj+uuvbsitHnApmdFgSpOmBRGeaSExA30GqweYrIMKN5JAQTbONZWLSm+LD689CXRv2s6Th/YMELYfoi2W0pkvwiBdr+/0NxpdRvJydCn36SE6wOigu4uJXIXeNqIjTD+x4sW6GB54Ugbg+SMmI9D5ONlmfEj8K/ZmG1THdPGOLlquy/VLiuOBuwNoJCBV9shsGEmdg8NiOu8NPupQlsbmClZDbBAklJ0AF6ElAwKSiqCOhbaa7hu4qJFrCKC+XAgYxS9t7r
diff --git a/postgresql/client/security_monkey.yml b/postgresql/client/security_monkey.yml
index a7a341f..c47e241 100644
--- a/postgresql/client/security_monkey.yml
+++ b/postgresql/client/security_monkey.yml
@@ -5,8 +5,6 @@
     secmonkey_db_host: ${_param:haproxy_postgresql_bind_host}
     secmonkey_db_user: secmonkey
     secmonkey_db_user_password: secmonkey
-    secmonkey_login_id: 11
-    secmonkey_application_id: 1
   postgresql:
     client:
       server:
diff --git a/prometheus/alertmanager/notification/pushkin.yml b/prometheus/alertmanager/notification/pushkin.yml
index 905a292..dd4f760 100644
--- a/prometheus/alertmanager/notification/pushkin.yml
+++ b/prometheus/alertmanager/notification/pushkin.yml
@@ -18,5 +18,5 @@
             enabled: true
             webhook_configs:
               pushkin-vip:
-                url: "${_param:alertmanager_notification_pushkin_host}:${_param:alertmanager_notification_pushkin_port}/webhook?app=stacklight"
+                url: "http://${_param:alertmanager_notification_pushkin_host}:${_param:alertmanager_notification_pushkin_port}/webhook?app=stacklight_alertmanager"
                 send_resolved: true
diff --git a/rundeck/client/project/cicd.yml b/rundeck/client/project/cicd.yml
index ed8b256..4cbcd40 100644
--- a/rundeck/client/project/cicd.yml
+++ b/rundeck/client/project/cicd.yml
@@ -6,6 +6,7 @@
     rundeck_cis_os_docker_image: docker-prod-local.artifactory.mirantis.com/mirantis/oss/cis-openstack:latest
     rundeck_cis_openstack:
       auth_url: http://yourcloud.com:5000/v3/auth/tokens
+      endpoint_type: publicURL
       username: admin
       password: password
       cert: plain-certificate
@@ -47,6 +48,9 @@
         cis/openstack/auth_url:
           type: password
           content: ${_param:rundeck_cis_openstack:auth_url}
+        cis/openstack/endpoint_type:
+          type: password
+          content: ${_param:rundeck_cis_openstack:endpoint_type}
         cis/openstack/username:
           type: password
           content: ${_param:rundeck_cis_openstack:username}