diff --git a/cinder/control/cluster.yml b/cinder/control/cluster.yml
index 7f8e2d7..8aa97c4 100644
--- a/cinder/control/cluster.yml
+++ b/cinder/control/cluster.yml
@@ -27,6 +27,8 @@
       backend: {}
       version: ${_param:cinder_version}
       role: ${_param:openstack_node_role}
+      # set 'image_conversion_dir' option in case of ceph deployment volume and controller running on the same node
+      image_conversion_dir: ${_param:cinder_image_conversion_dir_path}
       osapi:
         host: ${_param:cluster_local_address}
       database:
diff --git a/cinder/control/single.yml b/cinder/control/single.yml
index b8f670d..bae7bfc 100644
--- a/cinder/control/single.yml
+++ b/cinder/control/single.yml
@@ -19,6 +19,8 @@
       backend: {}
       default_volume_type: ''
       role: ${_param:openstack_node_role}
+      # set 'image_conversion_dir' option in case of ceph deployment volume and controller running on the same node
+      image_conversion_dir: ${_param:cinder_image_conversion_dir_path}
       database:
         host: ${_param:single_address}
         x509:
diff --git a/cinder/volume/local.yml b/cinder/volume/local.yml
index 301946b..cd07d4d 100644
--- a/cinder/volume/local.yml
+++ b/cinder/volume/local.yml
@@ -7,6 +7,7 @@
   cinder:
     volume:
       enabled: True
+      image_conversion_dir: ${_param:cinder_image_conversion_dir_path}
       database:
         host: ${_param:single_address}
         x509:
diff --git a/cinder/volume/single.yml b/cinder/volume/single.yml
index 9531aa4..34f5744 100644
--- a/cinder/volume/single.yml
+++ b/cinder/volume/single.yml
@@ -13,6 +13,7 @@
   cinder:
     volume:
       enabled: True
+      image_conversion_dir: ${_param:cinder_image_conversion_dir_path}
       database:
         host: ${_param:openstack_database_address}
         x509:
diff --git a/defaults/docker_images.yml b/defaults/docker_images.yml
index 1c43a70..ae09bd0 100644
--- a/defaults/docker_images.yml
+++ b/defaults/docker_images.yml
@@ -27,7 +27,7 @@
     # stacklight
     # 6.5.0 version, from 11/29/2018, differ from latest upstream 6.5.0 - update next cycle
     docker_image_alerta: "${_param:mcp_docker_registry}/mirantis/external/alerta-web:${_param:mcp_version}"
-    docker_image_alertmanager: "${_param:mcp_docker_registry}/openstack-docker/alertmanager:${_param:mcp_version}"
+    docker_image_alertmanager: "${_param:mcp_docker_registry}/openstack-docker/alertmanager:2019.2.4"
     docker_image_grafana: "${_param:mcp_docker_registry}/openstack-docker/grafana:${_param:mcp_version}"
     docker_image_prometheus_es_exporter: "${_param:mcp_docker_registry}/mirantis/external/braedon/prometheus-es-exporter:0.5.1"
     docker_image_prometheus: "${_param:mcp_docker_registry}/openstack-docker/prometheus:${_param:mcp_version}"
@@ -45,7 +45,7 @@
     docker_image_keycloak_server: "${_param:mcp_docker_registry}/mirantis/external/jboss/keycloak:4.5.0.Final"
     docker_image_keycloak_proxy: "${_param:mcp_docker_registry}/mirantis/external/jboss/keycloak:3.4.2.Final"
     # CVP
-    docker_image_cvp_sanity_checks: ${_param:mcp_docker_registry}/mirantis/cvp/cvp-sanity-checks:2019.2.3
+    docker_image_cvp_sanity_checks: ${_param:mcp_docker_registry}/mirantis/cvp/cvp-sanity-checks:2019.2.4
     docker_image_cvp_shaker_checks: ${_param:mcp_docker_registry}/mirantis/cvp/cvp-shaker:2019.2.3
     # aptly
     docker_image_aptly:
diff --git a/defaults/openstack/init.yml b/defaults/openstack/init.yml
index 711ab06..4b1960d 100644
--- a/defaults/openstack/init.yml
+++ b/defaults/openstack/init.yml
@@ -14,12 +14,15 @@
     openstack_kmn_service_host: ${_param:openstack_kmn_service_hostname}.${linux:system:domain}
     openstack_telemetry_service_host: ${_param:openstack_telemetry_service_hostname}.${linux:system:domain}
     openstack_service_user_enabled: True
+    openstack_upgrade_enabled: False
     # SSL
     ceilometer_agent_ssl_enabled: False
     openstack_mysql_x509_enabled: False
     # for non-ssl use 5672 / for ssl 5671
     openstack_rabbitmq_port: 5672
     openstack_rabbitmq_x509_enabled: False
+    # RabbitMQ
+    rabbitmq_upgrade_enabled: ${_param:openstack_upgrade_enabled}
     # Openstack memcache
     openstack_memcached_server_bind_address: 0.0.0.0
     openstack_memcache_security_enabled: False
@@ -28,7 +31,6 @@
     openstack_memcached_proto_udp_enabled: False
     openstack_version: queens
     openstack_old_version: ${_param:openstack_version}
-    openstack_upgrade_enabled: False
     # Security compliance user options
     openstack_service_user_options:
       ignore_change_password_upon_first_use: True
@@ -42,6 +44,7 @@
     cinder_version: ${_param:openstack_version}
     cinder_upgrade_enabled: ${_param:openstack_upgrade_enabled}
     cinder_service_user_enabled: ${_param:openstack_service_user_enabled}
+    cinder_image_conversion_dir_path: /var/tmp/cinder/conversion
     # Nova
     nova_memcache_security_enabled: ${_param:openstack_memcache_security_enabled}
     nova_memcache_secret_key: ''
diff --git a/docker/swarm/stack/jenkins/slave01.yml b/docker/swarm/stack/jenkins/slave01.yml
index f616d89..bfe6116 100644
--- a/docker/swarm/stack/jenkins/slave01.yml
+++ b/docker/swarm/stack/jenkins/slave01.yml
@@ -29,6 +29,7 @@
               image: ${_param:docker_image_jenkins_slave}
               volumes:
                 - /etc/ssl/certs/java/cacerts:/etc/ssl/certs/java/cacerts:ro
+                - /dev/urandom:/dev/random:ro
                 - /var/run/docker.sock:/var/run/docker.sock
                 - /usr/bin/docker:/usr/bin/docker:ro
                 - /var/lib/jenkins:/var/lib/jenkins
diff --git a/docker/swarm/stack/jenkins/slave02.yml b/docker/swarm/stack/jenkins/slave02.yml
index cbece06..55505f6 100644
--- a/docker/swarm/stack/jenkins/slave02.yml
+++ b/docker/swarm/stack/jenkins/slave02.yml
@@ -29,6 +29,7 @@
               image: ${_param:docker_image_jenkins_slave}
               volumes:
                 - /etc/ssl/certs/java/cacerts:/etc/ssl/certs/java/cacerts:ro
+                - /dev/urandom:/dev/random:ro
                 - /var/run/docker.sock:/var/run/docker.sock
                 - /usr/bin/docker:/usr/bin/docker:ro
                 - /var/lib/jenkins:/var/lib/jenkins
diff --git a/docker/swarm/stack/jenkins/slave03.yml b/docker/swarm/stack/jenkins/slave03.yml
index 6ff900c..f03ed24 100644
--- a/docker/swarm/stack/jenkins/slave03.yml
+++ b/docker/swarm/stack/jenkins/slave03.yml
@@ -29,6 +29,7 @@
               image: ${_param:docker_image_jenkins_slave}
               volumes:
                 - /etc/ssl/certs/java/cacerts:/etc/ssl/certs/java/cacerts:ro
+                - /dev/urandom:/dev/random:ro
                 - /var/run/docker.sock:/var/run/docker.sock
                 - /usr/bin/docker:/usr/bin/docker:ro
                 - /var/lib/jenkins:/var/lib/jenkins
diff --git a/jenkins/client/init.yml b/jenkins/client/init.yml
index 59faa0b..711c855 100644
--- a/jenkins/client/init.yml
+++ b/jenkins/client/init.yml
@@ -1,8 +1,9 @@
 classes:
-  - service.jenkins.support
-  - service.jenkins.client
-  - system.jenkins.client.approved_scripts
-  - system.jenkins.client.plugins
+- service.jenkins.support
+- service.jenkins.client
+- system.jenkins.client.approved_scripts
+- system.jenkins.client.plugins
+- system.jenkins.client.security.csrf
 parameters:
   _param:
     jenkins_client_user: none
diff --git a/jenkins/client/job/validate.yml b/jenkins/client/job/validate.yml
index 78b4a85..90e135f 100644
--- a/jenkins/client/job/validate.yml
+++ b/jenkins/client/job/validate.yml
@@ -196,10 +196,6 @@
             credentials: "gerrit"
             script: cvp-runner.groovy
           param:
-            DEBUG_MODE:
-              type: boolean
-              default: 'false'
-              description: Enable if you need to keep container after the test and debug
             IMAGE:
               type: string
               default: ${_param:docker_image_cvp_sanity_checks}
@@ -211,22 +207,12 @@
             SALT_MASTER_CREDENTIALS:
               type: string
               default: "salt"
-            TESTS_REPO:
-              type: string
-              default: ""
-              description: Url for cvp-sanity-checks
-            TESTS_SETTINGS:
-              type: string
-              default: ""
-              description: e.g. skipped_nodes=nal01.local.com,ntw01.local.com
-            TESTS_SET:
-              type: string
-              default: "cvp-sanity/cvp_checks/tests"
-              description: "Leave as is for full run or add a filename, e.g. _default_path_/test_mtu.py"
-            PROXY:
-              type: string
-              default: ""
-              description: "Proxy address to use to access the Internet. For offline mode, use \"offline\" value."
+            EXTRA_PARAMS:
+              type: text
+              default: |
+                envs:
+                  - tests_set=''
+              description: "YAML context with additional parameters, e.g. skipped_nodes=nal01.local.com,ntw01.local.com or tests_set='tests/test_mtu.py'"
         cvp-func:
           type: workflow-scm
           name: cvp-func
@@ -360,6 +346,53 @@
               type: string
               default: "https://github.com/Mirantis/cvp-configuration"
               description: URL of repo where testing tools, scenarios, configs are located.
+        cvp-tempest:
+          type: workflow-scm
+          name: cvp-tempest
+          display_name: "CVP-Tempest (technical preview)"
+          discard:
+            build:
+              keep_num: 20
+            artifact:
+              keep_num: 20
+          concurrent: false
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            branch: "${_param:jenkins_pipelines_branch}"
+            credentials: "gerrit"
+            script: cvp-tempest.groovy
+          param:
+            PREPARE_RESOURCES:
+              type: boolean
+              default: true
+              description: Prepare resources for Tempest
+            SALT_MASTER_URL:
+              type: string
+              default: "${_param:jenkins_salt_api_url}"
+              description: SALT_MASTER_URL
+            TEMPEST_TEST_PATTERN:
+              type: string
+              default: "set=smoke"
+              description: Use set=smoke, set=full or just test name (regex)
+            TEMPEST_ENDPOINT_TYPE:
+              type: choice
+              choices:
+                - internalURL
+                - adminURL
+                - publicURL
+              description: Openstack endpoint type to use during test run.
+            EXTRA_PARAMS:
+              type: text
+              default:  |
+                ---
+                  DEBUG_MODE: false
+                  GENERATE_CONFIG: true
+                  TARGET_NODE: "I@gerrit:client"
+                  SKIP_LIST_PATH: ""
+                  TEST_IMAGE: "docker-prod-virtual.docker.mirantis.net/mirantis/cicd/ci-tempest:${_param:openstack_version}"
+                  report_prefix: "cvp_"
+              description: YAML context with additional parameters
         cvp-perf:
           type: workflow-scm
           name: cvp-perf
@@ -424,8 +457,12 @@
             url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
             branch: "${_param:jenkins_pipelines_branch}"
             credentials: "gerrit"
-            script: cvp-stacklight.groovy
+            script: cvp-runner.groovy
           param:
+            IMAGE:
+              type: string
+              default: ${_param:docker_image_cvp_sanity_checks}
+              description: Docker image with tests and all pip dependecies to use for testing
             SALT_MASTER_URL:
               type: string
               default: "${_param:jenkins_salt_api_url}"
@@ -433,22 +470,12 @@
             SALT_MASTER_CREDENTIALS:
               type: string
               default: "salt"
-            TESTS_REPO:
-              type: string
-              default: "http://gerrit.mcp.mirantis.com/mcp/stacklight-pytest -b release/2019.2.0"
-              description: Url for cvp-stacklight-tests
-            TESTS_SETTINGS:
-              type: string
-              default: "SL_AUTOCONF=True;PYTHONPATH=./stacklight-pytest"
-              description: "Additional environment variables to export"
-            TESTS_SET:
-              type: string
-              default: "stacklight-pytest/stacklight_tests/tests/"
-              description: "Leave as is for full run or add a filename, e.g. _default_path_/test_dashboards.py"
-            PROXY:
-              type: string
-              default: ""
-              description: "Proxy address to use to access the Internet."
+            EXTRA_PARAMS:
+              type: text
+              default: |
+                envs:
+                  - SL_AUTOCONF=True
+              description: YAML context with additional parameters
         cvp-spt:
           type: workflow-scm
           name: cvp-spt
@@ -466,10 +493,6 @@
             credentials: "gerrit"
             script: cvp-runner.groovy
           param:
-            DEBUG_MODE:
-              type: boolean
-              default: 'false'
-              description: Enable if you need to keep container after the test and debug
             IMAGE:
               type: string
               default: ${_param:docker_image_cvp_sanity_checks}
@@ -481,22 +504,14 @@
             SALT_MASTER_CREDENTIALS:
               type: string
               default: "salt"
-            TESTS_REPO:
-              type: string
-              default: ""
-              description: Url for cvp-spt repository
-            TESTS_SETTINGS:
-              type: string
-              default: ""
-              description: "Additional environment variables to export, e.g. image_name, networks, HW_NODES"
-            TESTS_SET:
-              type: string
-              default: "cvp-spt/cvp_spt/tests"
-              description: "Leave as is for full run or add a filename, e.g. _default_path_/test_glance.py"
-            PROXY:
-              type: string
-              default: ""
-              description: "Proxy address to use to access the Internet. For offline mode, use \"offline\" value."
+            EXTRA_PARAMS:
+              type: text
+              default: |
+                envs:
+                  - tests_set=''
+                  - image_name='Ubuntu'
+                  - networks=10.101.0.0/24
+              description: 'YAML context with additional parameters. Additional params: HW_NODES, CMP_HOSTS, salt_timeout, skipped_nodes, nova_timeout, iperf_prep_string, IMAGE_SIZE_MB'
         cvp-shaker:
           type: workflow-scm
           name: cvp-shaker
diff --git a/jenkins/client/security/csrf.yml b/jenkins/client/security/csrf.yml
new file mode 100644
index 0000000..0f65db0
--- /dev/null
+++ b/jenkins/client/security/csrf.yml
@@ -0,0 +1,6 @@
+parameters:
+  jenkins:
+    client:
+      security:
+        csrf:
+          enable: True
diff --git a/keystone/client/service/radosgw-swift.yml b/keystone/client/service/radosgw-swift.yml
index e93f9b4..c8b6569 100644
--- a/keystone/client/service/radosgw-swift.yml
+++ b/keystone/client/service/radosgw-swift.yml
@@ -8,6 +8,8 @@
     client:
       server:
         identity:
+          roles:
+          - ResellerAdmin
           project:
             service:
               user:
@@ -16,6 +18,11 @@
                   password: ${_param:keystone_swift_password}
                   email: ${_param:admin_email}
                   options: ${_param:openstack_service_user_options}
+            admin:
+              user:
+                admin:
+                  roles:
+                  - ResellerAdmin
           service:
             radosgw-swift:
               type: object-store
diff --git a/keystone/client/v3/service/radosgw-swift.yml b/keystone/client/v3/service/radosgw-swift.yml
index ca06fed..2e78bb9 100644
--- a/keystone/client/v3/service/radosgw-swift.yml
+++ b/keystone/client/v3/service/radosgw-swift.yml
@@ -6,6 +6,10 @@
     client:
       resources:
         v3:
+          roles:
+            reseller_admin:
+              name: ResellerAdmin
+              enabled: true
           users:
             swift:
               password: ${_param:keystone_swift_password}
@@ -15,6 +19,11 @@
                 service_admin:
                   name: admin
                   project_id: service
+            admin:
+              roles:
+                reseller_admin:
+                  name: ResellerAdmin
+                  project_id: admin
           services:
             radosgw-swift:
               type: object-store
diff --git a/keystone/server/cluster.yml b/keystone/server/cluster.yml
index 7e9ea1b..824c6b5 100644
--- a/keystone/server/cluster.yml
+++ b/keystone/server/cluster.yml
@@ -37,7 +37,7 @@
       region: ${_param:openstack_region}
       bind:
         address: ${_param:cluster_local_address}
-        private_address: ${_param:cluster_vip_address}
+        private_address: ${_param:openstack_service_host}
         private_port: 35357
         public_address: ${_param:cluster_vip_address}
         public_port: 5000
diff --git a/rabbitmq/server/cluster.yml b/rabbitmq/server/cluster.yml
index c9de9a8..2971795 100644
--- a/rabbitmq/server/cluster.yml
+++ b/rabbitmq/server/cluster.yml
@@ -1,4 +1,5 @@
 classes:
 - service.rabbitmq.server.cluster
 - service.keepalived.cluster.single
-- service.haproxy.proxy.single
\ No newline at end of file
+- service.haproxy.proxy.single
+- system.rabbitmq.upgrade
diff --git a/rabbitmq/server/single.yml b/rabbitmq/server/single.yml
index 6183f81..9982957 100644
--- a/rabbitmq/server/single.yml
+++ b/rabbitmq/server/single.yml
@@ -1,2 +1,3 @@
 classes:
 - service.rabbitmq.server.single
+- system.rabbitmq.upgrade
diff --git a/rabbitmq/upgrade/init.yml b/rabbitmq/upgrade/init.yml
new file mode 100644
index 0000000..3a75137
--- /dev/null
+++ b/rabbitmq/upgrade/init.yml
@@ -0,0 +1,4 @@
+parameters:
+  rabbitmq:
+    upgrade:
+      enabled: ${_param:rabbitmq_upgrade_enabled}