diff --git a/docker/swarm/stack/janitor_monkey.yml b/docker/swarm/stack/janitor_monkey.yml
index 1152841..2849554 100644
--- a/docker/swarm/stack/janitor_monkey.yml
+++ b/docker/swarm/stack/janitor_monkey.yml
@@ -32,10 +32,11 @@
       auth_url: http://yourcloud.com:5000/v3/auth/tokens
       username: admin
       password: password
-      ssl_verify: False
       endpoint_type: public
-      source_credentials: /srv/volumes/rundeck/storage/content/cis/openstack
-      service_credentials: /opt/os_creds
+      ssl_verify: False
+      source_credentials_dir: /srv/volumes/rundeck/storage
+      destination_credentials_dir: /opt/os_creds
+      cacert_path: ${_param:janitor_monkey_openstack:destination_credentials_dir}/content/keys/cis/openstack/cert.pem
   docker:
     client:
       stack:
@@ -63,7 +64,7 @@
             simianarmy.client.cloudfire.domain: ${_param:janitor_monkey_openstack:project_domain_name}
             simianarmy.client.cloudfire.project: ${_param:janitor_monkey_openstack:project_name}
             simianarmy.client.cloudfire.SSLVerify: ${_param:janitor_monkey_openstack:ssl_verify}
-            simianarmy.client.cloudfire.cafile: ${_param:janitor_monkey_openstack:service_credentials}/cert.pem
+            simianarmy.client.cloudfire.cafile: ${_param:janitor_monkey_openstack:cacert_path}
             simianarmy.janitor.rule.stoppedInstanceRule.instanceAgeThreshold: ${_param:janitor_monkey_instance_age_threshold}
             simianarmy.janitor.notification.oss.url: ${_param:janitor_monkey_notification_oss_url}
             simianarmy.janitor.notification.oss.login_id: ${_param:janitor_monkey_notification_oss_login_id}
@@ -88,7 +89,7 @@
               ports:
                 - ${_param:haproxy_janitor_monkey_exposed_port}:${_param:janitor_monkey_bind_port}
               volumes:
-                - ${_param:janitor_monkey_openstack:source_credentials}:${_param:janitor_monkey_openstack:service_credentials}:ro
+                - ${_param:janitor_monkey_openstack:source_credentials_dir}:${_param:janitor_monkey_openstack:destination_credentials_dir}:ro
           network:
             default:
               external:
diff --git a/docker/swarm/stack/security_monkey.yml b/docker/swarm/stack/security_monkey.yml
index 3b9c272..2f844c0 100644
--- a/docker/swarm/stack/security_monkey.yml
+++ b/docker/swarm/stack/security_monkey.yml
@@ -30,10 +30,11 @@
       project_domain_name: Default
       project_name: admin
       user_domain_name: Default
-      source_credentials: /srv/volumes/rundeck/storage/content/cis/openstack
-      service_credentials: /opt/os_creds
       endpoint_type: public
       ssl_verify: False
+      source_credentials_dir: /srv/volumes/rundeck/storage
+      destination_credentials_dir: /opt/os_creds
+      cacert_path: ${_param:security_monkey_openstack:destination_credentials_dir}/content/keys/cis/openstack/cert.pem
   docker:
     client:
       stack:
@@ -62,7 +63,7 @@
             OS_PROJECT_NAME: ${_param:security_monkey_openstack:project_name}
             OS_SSL_VERIFY: ${_param:security_monkey_openstack:ssl_verify}
             OS_ENDPOINT_TYPE: ${_param:security_monkey_openstack:endpoint_type}
-            CACERT_PATH: ${_param:security_monkey_openstack:service_credentials}/cert.pem
+            CACERT_PATH: ${_param:security_monkey_openstack:cacert_path}
             USER_DOMAIN_NAME: ${_param:security_monkey_openstack:user_domain_name}
             SM_WTF_CSRF_ENABLED: ${_param:devops_portal_sm_wtf_csrf_enabled}
             SECURITY_MONKEY_SYNC_INTERVAL: ${_param:security_monkey_sync_interval}
@@ -79,7 +80,7 @@
                 - ${_param:haproxy_security_monkey_exposed_port}:${_param:haproxy_security_monkey_bind_port}
               volumes:
                 - /srv/volumes/security_monkey/logs:/var/log/security_monkey/logs
-                - ${_param:security_monkey_openstack:source_credentials}:${_param:security_monkey_openstack:service_credentials}:ro
+                - ${_param:security_monkey_openstack:source_credentials_dir}:${_param:security_monkey_openstack:destination_credentials_dir}:ro
             security-audit-scheduler:
               image: ${_param:docker_image_security_monkey_scheduler}
               deploy:
@@ -88,7 +89,7 @@
                   condition: any
               volumes:
                 - /srv/volumes/security_monkey/logs:/var/log/security_monkey/logs
-                - ${_param:security_monkey_openstack:source_credentials}:${_param:security_monkey_openstack:service_credentials}:ro
+                - ${_param:security_monkey_openstack:source_credentials_dir}:${_param:security_monkey_openstack:destination_credentials_dir}:ro
           network:
             default:
               external:
diff --git a/fluentd/init.yml b/fluentd/init.yml
new file mode 100644
index 0000000..ebf469a
--- /dev/null
+++ b/fluentd/init.yml
@@ -0,0 +1,6 @@
+classes:
+- service.fluentd.agent.single
+- system
+parameters:
+  fluentd:
+    dollar: ${_param:dollarsign}
diff --git a/fluentd/label/default_metric/init.yml b/fluentd/label/default_metric/init.yml
new file mode 100644
index 0000000..ef8ecf2
--- /dev/null
+++ b/fluentd/label/default_metric/init.yml
@@ -0,0 +1,20 @@
+parameters:
+  fluentd:
+    agent:
+      config:
+        label:
+          default_metric:
+            filter:
+              add_general_fields:
+                tag: "**"
+                type: record_transformer
+                enable_ruby: true
+                record:
+                  - name: environment_label
+                    value: ${_param:cluster_domain}
+                  - name: Hostname
+                    value: ${fluentd:dollar}{ hostname }
+            match:
+              drop_everything:
+                tag: '**'
+                type: 'null'
diff --git a/fluentd/label/default_metric/prometheus.yml b/fluentd/label/default_metric/prometheus.yml
new file mode 100644
index 0000000..9eb3b1b
--- /dev/null
+++ b/fluentd/label/default_metric/prometheus.yml
@@ -0,0 +1,11 @@
+parameters:
+  fluentd:
+    agent:
+      plugin:
+        fluent-plugin-prometheus:
+          gem: ['fluent-plugin-prometheus']
+      config:
+        input:
+          prometheus:
+            metric:
+              type: prometheus
diff --git a/galera/server/database/panko.yml b/galera/server/database/panko.yml
new file mode 100644
index 0000000..7a3ed63
--- /dev/null
+++ b/galera/server/database/panko.yml
@@ -0,0 +1,15 @@
+parameters:
+  mysql:
+    server:
+      database:
+        panko:
+          encoding: utf8
+          users:
+          - name: panko
+            password: ${_param:mysql_panko_password}
+            host: '%'
+            rights: all
+          - name: panko
+            password: ${_param:mysql_panko_password}
+            host: ${_param:cluster_local_address}
+            rights: all
diff --git a/init.yml b/init.yml
new file mode 100644
index 0000000..7d8695f
--- /dev/null
+++ b/init.yml
@@ -0,0 +1,3 @@
+parameters:
+  _param:
+    dollarsign: '$'
diff --git a/jenkins/client/approved_scripts.yml b/jenkins/client/approved_scripts.yml
index 1973906..2c6528f 100644
--- a/jenkins/client/approved_scripts.yml
+++ b/jenkins/client/approved_scripts.yml
@@ -54,6 +54,7 @@
         - method java.util.Collection stream
         - method java.util.Date getTime
         - method java.util.LinkedHashMap$LinkedHashIterator hasNext
+        - method java.util.List add int java.lang.Object
         - method java.util.List subList int int
         - method java.util.Map remove java.lang.Object
         - method java.util.Map size
diff --git a/jenkins/client/job/docker/oss/cis-collectors.yml b/jenkins/client/job/docker/oss/cis-collectors.yml
index 11d8be9..05620cf 100644
--- a/jenkins/client/job/docker/oss/cis-collectors.yml
+++ b/jenkins/client/job/docker/oss/cis-collectors.yml
@@ -22,11 +22,6 @@
                 "oss/cis-collectors":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/devops-portal.yml b/jenkins/client/job/docker/oss/devops-portal.yml
index 3b831d8..9c3025f 100644
--- a/jenkins/client/job/docker/oss/devops-portal.yml
+++ b/jenkins/client/job/docker/oss/devops-portal.yml
@@ -22,11 +22,6 @@
                 "oss/devops-portal":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/hce-codebase.yml b/jenkins/client/job/docker/oss/hce-codebase.yml
index 41fe789..747ed77 100644
--- a/jenkins/client/job/docker/oss/hce-codebase.yml
+++ b/jenkins/client/job/docker/oss/hce-codebase.yml
@@ -22,11 +22,6 @@
                 "oss/hce":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/hce-docker.yml b/jenkins/client/job/docker/oss/hce-docker.yml
index 33372b9..c7c4a7b 100644
--- a/jenkins/client/job/docker/oss/hce-docker.yml
+++ b/jenkins/client/job/docker/oss/hce-docker.yml
@@ -22,11 +22,6 @@
                 "oss/docker-hce":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/janitor-monkey-codebase.yml b/jenkins/client/job/docker/oss/janitor-monkey-codebase.yml
index 95a45f1..d10993e 100644
--- a/jenkins/client/job/docker/oss/janitor-monkey-codebase.yml
+++ b/jenkins/client/job/docker/oss/janitor-monkey-codebase.yml
@@ -22,11 +22,6 @@
                 "oss/SimianArmy":
                   branches:
                     - devel
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/janitor-monkey-docker.yml b/jenkins/client/job/docker/oss/janitor-monkey-docker.yml
index 78167bd..672e13e 100644
--- a/jenkins/client/job/docker/oss/janitor-monkey-docker.yml
+++ b/jenkins/client/job/docker/oss/janitor-monkey-docker.yml
@@ -22,11 +22,6 @@
                 "oss/docker-janitor-monkey":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
@@ -58,4 +53,4 @@
               default: "Dockerfile"
             CONTEXT_PATH:
               type: string
-              default: "."
\ No newline at end of file
+              default: "."
diff --git a/jenkins/client/job/docker/oss/pushkin-codebase-ext.yml b/jenkins/client/job/docker/oss/pushkin-codebase-ext.yml
index 1a5b5b6..0508d49 100644
--- a/jenkins/client/job/docker/oss/pushkin-codebase-ext.yml
+++ b/jenkins/client/job/docker/oss/pushkin-codebase-ext.yml
@@ -22,11 +22,6 @@
                 "oss/pushkin-extensions":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/pushkin-codebase.yml b/jenkins/client/job/docker/oss/pushkin-codebase.yml
index f40bde3..a45ea75 100644
--- a/jenkins/client/job/docker/oss/pushkin-codebase.yml
+++ b/jenkins/client/job/docker/oss/pushkin-codebase.yml
@@ -22,11 +22,6 @@
                 "oss/pushkin":
                   branches:
                     - devel
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/pushkin-docker.yml b/jenkins/client/job/docker/oss/pushkin-docker.yml
index e77e99b..61d959c 100644
--- a/jenkins/client/job/docker/oss/pushkin-docker.yml
+++ b/jenkins/client/job/docker/oss/pushkin-docker.yml
@@ -22,11 +22,6 @@
                 "oss/docker-pushkin":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
@@ -58,4 +53,4 @@
               default: "Dockerfile"
             CONTEXT_PATH:
               type: string
-              default: "."
\ No newline at end of file
+              default: "."
diff --git a/jenkins/client/job/docker/oss/rundeck.yml b/jenkins/client/job/docker/oss/rundeck.yml
index 9b116fe..adbe9f4 100644
--- a/jenkins/client/job/docker/oss/rundeck.yml
+++ b/jenkins/client/job/docker/oss/rundeck.yml
@@ -22,11 +22,6 @@
                 "oss/docker-rundeck":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/security-monkey-codebase-openstack.yml b/jenkins/client/job/docker/oss/security-monkey-codebase-openstack.yml
index a135df8..0e5a9d4 100644
--- a/jenkins/client/job/docker/oss/security-monkey-codebase-openstack.yml
+++ b/jenkins/client/job/docker/oss/security-monkey-codebase-openstack.yml
@@ -3,7 +3,7 @@
     client:
       job:
         docker-build-images-security-monkey-codebase-openstack:
-          name: docker-build-images-security-monkey-codebase-openstack 
+          name: docker-build-images-security-monkey-codebase-openstack
           discard:
             build:
               keep_num: 25
@@ -22,11 +22,6 @@
                 "oss/security-monkey-openstack":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/docker/oss/security-monkey-docker.yml b/jenkins/client/job/docker/oss/security-monkey-docker.yml
index b9d4512..613f789 100644
--- a/jenkins/client/job/docker/oss/security-monkey-docker.yml
+++ b/jenkins/client/job/docker/oss/security-monkey-docker.yml
@@ -22,11 +22,6 @@
                 "oss/docker-security-monkey":
                   branches:
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
@@ -58,4 +53,4 @@
               default: "security-monkey/Dockerfile"
             CONTEXT_PATH:
               type: string
-              default: "."
\ No newline at end of file
+              default: "."
diff --git a/jenkins/client/job/oscore/security_tests.yml b/jenkins/client/job/oscore/security_tests.yml
index e4f5f6d..36b5441 100644
--- a/jenkins/client/job/oscore/security_tests.yml
+++ b/jenkins/client/job/oscore/security_tests.yml
@@ -62,7 +62,7 @@
               SEVERITY:
                 type: string
                 description: Bandit args
-                default: "3"
+                default: "1"
               CONFIDENCE:
                 type: string
                 description: confidence
diff --git a/jenkins/client/job/oscore/tests.yml b/jenkins/client/job/oscore/tests.yml
index a751935..06060bd 100644
--- a/jenkins/client/job/oscore/tests.yml
+++ b/jenkins/client/job/oscore/tests.yml
@@ -12,6 +12,12 @@
                 keep_num: 30
             type: workflow-scm
             concurrent: true
+            plugin_properties:
+              throttleconcurrents:
+                enabled: true
+                throttle_option: category
+                categories:
+                  - oscore-ci-builds
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/openstack-ci/openstack-pipelines.git"
@@ -638,7 +644,7 @@
               artifact:
                 keep_num: 30
             type: workflow-scm
-            concurrent: false
+            concurrent: true
             scm:
               type: git
               url: "${_param:jenkins_gerrit_url}/openstack-ci/openstack-pipelines.git"
@@ -657,19 +663,10 @@
                   - failed
                   - unstable
                   - not_built
-                message:
-                  build_successful: "Build successful"
-                  build_unstable: "Build unstable"
-                  build_failure: "Build failed"
                 event:
                   comment:
                     - addedContains:
-                        commentAddedCommentContains: 'deploy'
-                  patchset:
-                    - created:
-                        excludeDrafts: true
-                        excludeTrivialRebase: true
-                        excludeNoCodeChange: true
+                        commentAddedCommentContains: '^(?s:Patch Set \d+:.*(test|recheck|reverify)\s*)$'
             param:
               SOURCE_CREDENTIALS:
                 type: string
diff --git a/jenkins/client/job/oss/test_pushkin_codebase.yml b/jenkins/client/job/oss/test_pushkin_codebase.yml
index 245f1d8..baefbc9 100644
--- a/jenkins/client/job/oss/test_pushkin_codebase.yml
+++ b/jenkins/client/job/oss/test_pushkin_codebase.yml
@@ -23,11 +23,6 @@
                   branches:
                     - devel
                     - master
-              skip_vote:
-                - successful
-                - failed
-                - unstable
-                - not_built
               event:
                 patchset:
                   - created:
diff --git a/jenkins/client/job/validate.yml b/jenkins/client/job/validate.yml
index cfbd85d..ab2dd38 100644
--- a/jenkins/client/job/validate.yml
+++ b/jenkins/client/job/validate.yml
@@ -149,7 +149,7 @@
               description: If chosen then previous build results will be used in the current build
         cvp-sanity:
           type: workflow-scm
-          name: validate-cvp-sanity
+          name: cvp-sanity
           display_name: "CVP - Sanity checks"
           discard:
             build:
@@ -166,7 +166,7 @@
           param:
             SALT_MASTER_URL:
               type: string
-              default: ""
+              default: "${_param:jenkins_salt_api_url}"
               description: Full Salt API address [e.g. https://10.10.10.2:6969]
             SALT_MASTER_CREDENTIALS:
               type: string
@@ -175,6 +175,10 @@
               type: string
               default: "https://github.com/Mirantis/cvp-sanity-checks"
               description: Url for cvp-sanity-checks
+            SANITY_TESTS_SETTINGS:
+              type: string
+              default: ""
+              description: e.g. skipped_nodes=nal01.local.com,ntw01.local.com
             SANITY_TESTS_SET:
               type: string
               default: ""
@@ -183,3 +187,71 @@
               type: string
               default: ""
               description: Proxy address to clone repo and install python requirements
+        cvp-ha:
+          type: workflow-scm
+          name: cvp-ha
+          display_name: "CVP - HA tests"
+          discard:
+            build:
+              keep_num: 20
+            artifact:
+              keep_num: 20
+          concurrent: false
+          scm:
+            type: git
+            url: "${_param:jenkins_gerrit_url}/mk/mk-pipelines"
+            credentials: "gerrit"
+            script: cvp-ha.groovy
+          param:
+            SALT_MASTER_URL:
+              type: string
+              default: "${_param:jenkins_salt_api_url}"
+              description: Full Salt API address [e.g. https://10.10.10.2:6969]
+            SALT_MASTER_CREDENTIALS:
+              type: string
+              default: "salt"
+              description: Credentials to the Salt API
+            TEMPEST_TARGET_NODE:
+              type: string
+              default: ""
+              description: Node where container with tempest will be run
+            TEST_IMAGE:
+              type: string
+              default: "rallyforge/rally"
+              description: Docker image to use for running Rally/Tempest
+            TARGET_NODES:
+              type: string
+              default: "ctl*"
+              description: Nodes to test
+            DEBUG_MODE:
+              type: boolean
+              default: 'false'
+              description: If you need to debug (keep container after test), please enabled this
+            RETRY_CHECK_STATUS:
+              type: string
+              default: "200"
+              description: If you have any problems with timeouts (e.g. while waiting for node to be up/down), please increase this value
+            SKIP_LIST_PATH:
+              type: string
+              default: "/home/rally/cvp-configuration/tempest/skip-list.yaml"
+              description: path to skip-list file inside container
+            PROXY:
+              type: string
+              default: ""
+              description: Proxy address to clone repo and install python requirements
+            TEMPEST_TEST_PATTERN:
+              type: string
+              default: "set=smoke"
+              description: Use set=smoke (or identity,full...] or just test name
+            MANUAL_CONFIRMATION:
+              type: boolean
+              default: 'false'
+              description: Ask for confirmation before doing something destructive (reboot/shutdown node)
+            TEMPEST_REPO:
+              type: string
+              default: "https://github.com/openstack/tempest"
+              description: Can be repo url (local or remote) or path to folder (inside container) with Tempest
+            TOOLS_REPO:
+              type: string
+              default: "${_param:gerrit_public_host}/cvp-configuration"
+              description: URL of repo where testing tools, scenarios, configs are located.
diff --git a/jenkins/slave/salt-pepper.yml b/jenkins/slave/salt-pepper.yml
new file mode 100644
index 0000000..c5baf1f
--- /dev/null
+++ b/jenkins/slave/salt-pepper.yml
@@ -0,0 +1,8 @@
+ classes:
+   - system.jenkins.slave
+ parameters:
+   linux:
+     system:
+       package:
+         salt-pepper:
+           version: latest
diff --git a/keystone/client/service/panko.yml b/keystone/client/service/panko.yml
new file mode 100644
index 0000000..05f9453
--- /dev/null
+++ b/keystone/client/service/panko.yml
@@ -0,0 +1,30 @@
+parameters:
+  _param:
+    cluster_public_protocol: https
+  keystone:
+    client:
+      server:
+        identity:
+          project:
+            service:
+              user:
+                panko:
+                  is_admin: true
+                  password: ${_param:keystone_panko_password}
+                  email: ${_param:admin_email}
+          service:
+            panko:
+              type: event
+              description: OpenStack Event Service
+              endpoints:
+              - region: ${_param:openstack_region}
+                public_address: ${_param:cluster_public_host}
+                public_protocol: ${_param:cluster_public_protocol}
+                public_port: 8977
+                public_path: '/'
+                internal_address: ${_param:panko_service_host}
+                internal_port: 8977
+                internal_path: '/'
+                admin_address: ${_param:panko_service_host}
+                admin_port: 8977
+                admin_path: '/'
diff --git a/mysql/client/database/panko.yml b/mysql/client/database/panko.yml
new file mode 100644
index 0000000..e0463ef
--- /dev/null
+++ b/mysql/client/database/panko.yml
@@ -0,0 +1,17 @@
+parameters:
+  mysql:
+    client:
+      server:
+        database:
+          database:
+            panko:
+              encoding: utf8
+              users:
+              - name: panko
+                password: ${_param:mysql_panko_password}
+                host: '%'
+                rights: all
+              - name: panko
+                password: ${_param:mysql_panko_password}
+                host: ${_param:single_address}
+                rights: all
diff --git a/nova/control/cluster.yml b/nova/control/cluster.yml
index dee725d..3b8877d 100644
--- a/nova/control/cluster.yml
+++ b/nova/control/cluster.yml
@@ -29,11 +29,6 @@
       ram_allocation_ratio: ${_param:nova_ram_allocation_ratio}
       disk_allocation_ratio: ${_param:nova_disk_allocation_ratio}
       workers: 8
-      logging:
-      - engine: syslog
-        facility: local0
-        heka:
-          enabled: true
       bind:
         private_address: ${_param:cluster_local_address}
         public_address: ${_param:cluster_vip_address}