diff --git a/.gitignore b/.gitignore
index 6317e5b05..b793b5655 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,5 +5,6 @@
 vendor/*
 Gemfile.lock
 packstack.egg-info
+docs/build
 releasenotes/build
 .stestr
diff --git a/.zuul.yaml b/.zuul.yaml
index 3347467d6..5958c5edb 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -21,79 +21,77 @@
       - openstack/puppet-manila
       - openstack/puppet-neutron
       - openstack/puppet-nova
-      - openstack/puppet-openstack_extras
       - openstack/puppet-openstacklib
       - openstack/puppet-oslo
       - openstack/puppet-ovn
-      - openstack/puppet-panko
       - openstack/puppet-placement
-      - openstack/puppet-sahara
       - openstack/puppet-swift
       - openstack/puppet-tempest
       - openstack/puppet-trove
       - openstack/puppet-vswitch
 
 - job:
-    name: packstack-centos8
+    name: packstack-centos9
     parent: packstack-base
     vars:
       selinux_enforcing: "false"
-      delorean: "https://trunk.rdoproject.org/centos8-master/puppet-passed-ci/delorean.repo"
-      delorean_deps: "https://trunk.rdoproject.org/centos8-master/delorean-deps.repo"
-    pre-run: playbooks/packstack-centos8-pre.yaml
+      delorean: "https://trunk.rdoproject.org/centos9-master/puppet-passed-ci/delorean.repo"
+      delorean_deps: "https://trunk.rdoproject.org/centos9-master/delorean-deps.repo"
+    pre-run: playbooks/packstack-centos9-pre.yaml
     nodeset:
       nodes:
-        - name: centos8
-          label: centos-8
+        - name: centos9s
+          label: centos-9-stream
     run: playbooks/packstack-integration-tempest.yaml
 
 - job:
-    name: packstack-multinode-centos8
+    name: packstack-multinode-centos9
     parent: packstack-base
     vars:
       selinux_enforcing: "false"
-      delorean: "https://trunk.rdoproject.org/centos8-master/puppet-passed-ci/delorean.repo"
-      delorean_deps: "https://trunk.rdoproject.org/centos8-master/delorean-deps.repo"
-    pre-run: playbooks/packstack-centos8-pre.yaml
+      delorean: "https://trunk.rdoproject.org/centos9-master/puppet-passed-ci/delorean.repo"
+      delorean_deps: "https://trunk.rdoproject.org/centos9-master/delorean-deps.repo"
+    pre-run: playbooks/packstack-centos9-pre.yaml
+    post-run: playbooks/packstack-post-compute.yaml
     nodeset:
       nodes:
         - name: controller
-          label: centos-8
+          label: centos-9-stream
         - name: compute
-          label: centos-8
+          label: centos-9-stream
     run: playbooks/packstack-multinode.yaml
 
 - job:
-    name: packstack-centos8-integration-scenario001
-    parent: packstack-centos8
+    name: packstack-centos9s-integration-scenario001
+    parent: packstack-centos9
     vars:
       scenario: scenario001
 
 - job:
-    name: packstack-centos8-integration-scenario002
-    parent: packstack-centos8
+    name: packstack-centos9s-integration-scenario002
+    parent: packstack-centos9
     vars:
       scenario: scenario002
 
 - job:
-    name: packstack-centos8-integration-scenario003
-    parent: packstack-centos8
+    name: packstack-centos9s-integration-scenario003
+    parent: packstack-centos9
     vars:
       scenario: scenario003
 
 - job:
-    name: packstack-centos8-multinode-scenario002-tempest
-    parent: packstack-multinode-centos8
+    name: packstack-centos9s-multinode-scenario002-tempest
+    parent: packstack-multinode-centos9
     post-run: playbooks/packstack-post-compute.yaml
     vars:
       scenario: scenario002
 
 - secret:
-    name: packstack_git_mirror_credentials
+    name: packstack_git_mirror_credentials_master
     data:
       user: git
       host: github.com
-      host_key: github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+      host_key: github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
       ssh_key: !encrypted/pkcs1-oaep
         - Rd6fA6jCgfkqHDdNFG4abPZlnsV7mc8ki0AZDANf7dZmopQONSKVVmP7uQ15b57vB8BiK
           Crk4TP0yJEDZBjOSlwGywHbEE0UhGNQU6Gm13XDE0U7gvPJ1kWqMxmDRXr96f0ibpNuNL
@@ -165,24 +163,40 @@
       git_mirror_repository: redhat-openstack/packstack
     secrets:
       - name: git_mirror_credentials
-        secret: packstack_git_mirror_credentials
+        secret: packstack_git_mirror_credentials_master
         pass-to-parent: true
 
 - project:
     check:
       jobs:
-        - packstack-centos8-integration-scenario001
-        - packstack-centos8-integration-scenario002
-        - packstack-centos8-integration-scenario003
-        - packstack-centos8-multinode-scenario002-tempest
-        - openstack-tox-py36
+        - openstack-tox-pep8
+        - openstack-tox-py39
+        - openstack-tox-py312
+        - build-openstack-releasenotes:
+            vars:
+              sphinx_python: python3
+        - packstack-centos9s-integration-scenario001
+        - packstack-centos9s-integration-scenario002
+        - packstack-centos9s-integration-scenario003
+        - packstack-centos9s-multinode-scenario002-tempest
     gate:
       jobs:
-        - packstack-centos8-integration-scenario001
-        - packstack-centos8-integration-scenario002
-        - packstack-centos8-integration-scenario003
-        - packstack-centos8-multinode-scenario002-tempest
-        - openstack-tox-py36
+        - openstack-tox-pep8
+        - openstack-tox-py39
+        - openstack-tox-py312
+        - build-openstack-releasenotes:
+            vars:
+              sphinx_python: python3
+        - packstack-centos9s-integration-scenario001
+        - packstack-centos9s-integration-scenario002
+        - packstack-centos9s-integration-scenario003
+        - packstack-centos9s-multinode-scenario002-tempest
     post:
       jobs:
         - packstack-upload-git-mirror
+    release:
+      jobs:
+        - packstack-upload-git-mirror
+    pre-release:
+      jobs:
+        - packstack-upload-git-mirror
diff --git a/Puppetfile b/Puppetfile
old mode 100755
new mode 100644
index af3beefaa..589ad01f6
--- a/Puppetfile
+++ b/Puppetfile
@@ -1,3 +1,5 @@
+# Auto-generated Puppetfile for Packstack project
+
 moduledir '/usr/share/openstack-puppet/modules'
 
 ## OpenStack modules
@@ -26,10 +28,6 @@ mod 'heat',
   :git => 'https://github.com/openstack/puppet-heat',
   :ref => 'master'
 
-mod 'magnum',
-  :git => 'https://github.com/openstack/puppet-magnum',
-  :ref => 'master'
-
 mod 'horizon',
   :git => 'https://github.com/openstack/puppet-horizon',
   :ref => 'master'
@@ -42,6 +40,10 @@ mod 'keystone',
   :git => 'https://github.com/openstack/puppet-keystone',
   :ref => 'master'
 
+mod 'magnum',
+  :git => 'https://github.com/openstack/puppet-magnum',
+  :ref => 'master'
+
 mod 'manila',
   :git => 'https://github.com/openstack/puppet-manila',
   :ref => 'master'
@@ -54,10 +56,6 @@ mod 'nova',
   :git => 'https://github.com/openstack/puppet-nova',
   :ref => 'master'
 
-mod 'openstack_extras',
-  :git => 'https://github.com/openstack/puppet-openstack_extras',
-  :ref => 'master'
-
 mod 'openstacklib',
   :git => 'https://github.com/openstack/puppet-openstacklib',
   :ref => 'master'
@@ -70,18 +68,10 @@ mod 'ovn',
   :git => 'https://github.com/openstack/puppet-ovn',
   :ref => 'master'
 
-mod 'panko',
-  :git => 'https://github.com/openstack/puppet-panko',
-  :ref => 'master'
-
 mod 'placement',
   :git => 'https://github.com/openstack/puppet-placement',
   :ref => 'master'
 
-mod 'sahara',
-  :git => 'https://github.com/openstack/puppet-sahara',
-  :ref => 'master'
-
 mod 'swift',
   :git => 'https://github.com/openstack/puppet-swift',
   :ref => 'master'
@@ -102,73 +92,65 @@ mod 'vswitch',
 
 mod 'apache',
   :git => 'https://github.com/puppetlabs/puppetlabs-apache',
-  :ref => 'b4cbc858a61ba2eea4a1178c261a982a59db963d'
-
-mod 'certmonger',
-  :git => 'https://github.com/rcritten/puppet-certmonger',
-  :ref => 'master'
+  :ref => 'v12.3.1'
 
 mod 'concat',
   :git => 'https://github.com/puppetlabs/puppetlabs-concat',
-  :ref => '4.2.1'
+  :ref => 'v9.1.0'
 
 mod 'firewall',
   :git => 'https://github.com/puppetlabs/puppetlabs-firewall',
-  :ref => '1.12.0'
+  :ref => 'v8.1.7'
 
 mod 'inifile',
   :git => 'https://github.com/puppetlabs/puppetlabs-inifile',
-  :ref => '2.2.0'
+  :ref => 'v6.2.0'
 
 mod 'memcached',
   :git => 'https://github.com/saz/puppet-memcached',
-  :ref => 'v3.3.0'
+  :ref => 'v10.0.1'
 
 mod 'mysql',
   :git => 'https://github.com/puppetlabs/puppetlabs-mysql',
-  :ref => 'v10.3.0'
+  :ref => 'v16.2.0'
 
 mod 'nssdb',
   :git => 'https://github.com/rcritten/puppet-nssdb',
-  :ref => 'master'
+  :ref => '2ed2a2df59bbeaf9cf628e1a4a499476842282fd'
 
 mod 'rabbitmq',
   :git => 'https://github.com/voxpupuli/puppet-rabbitmq',
-  :ref => 'master'
+  :ref => 'v14.3.0'
 
 mod 'redis',
-  :git => 'https://github.com/arioch/puppet-redis',
-  :ref => 'master'
+  :git => 'https://github.com/voxpupuli/puppet-redis',
+  :ref => 'v11.1.0'
 
 mod 'remote',
   :git => 'https://github.com/paramite/puppet-remote',
-  :ref => 'master'
+  :ref => '7420908328b832f4b20e1eba44bcccd926da8faa'
 
 mod 'rsync',
   :git => 'https://github.com/puppetlabs/puppetlabs-rsync',
-  :ref => '1.1.0'
-
-mod 'ssh',
-  :git => 'https://github.com/saz/puppet-ssh',
-  :ref => 'master'
+  :ref => '1.2.0'
 
 mod 'stdlib',
   :git => 'https://github.com/puppetlabs/puppetlabs-stdlib',
-  :ref => '5.0.0'
+  :ref => 'v9.7.0'
 
 mod 'sysctl',
   :git => 'https://github.com/duritong/puppet-sysctl',
-  :ref => 'v0.0.12'
+  :ref => '847ec1c07ed3e231a48d8816971c0bd4afe7a72b'
 
 mod 'systemd',
-  :git => 'https://github.com/camptocamp/puppet-systemd',
-  :ref => 'master'
+  :git => 'https://github.com/voxpupuli/puppet-systemd',
+  :ref => 'v8.2.0'
 
 mod 'vcsrepo',
   :git => 'https://github.com/puppetlabs/puppetlabs-vcsrepo',
-  :ref => '2.3.0'
+  :ref => 'v7.0.0'
 
 mod 'xinetd',
   :git => 'https://github.com/puppetlabs/puppetlabs-xinetd',
-  :ref => '3.1.0'
+  :ref => 'v3.4.1'
 
diff --git a/README.md b/README.md
deleted file mode 100644
index 73f33724c..000000000
--- a/README.md
+++ /dev/null
@@ -1,217 +0,0 @@
-# Packstack
-
-Utility to install **OpenStack** on **Red Hat** based operating system. See
-other branches for older **OpenStack** versions. Details on how to
-contribute to **Packstack** may be found in the **Packstack** wiki at
-<https://wiki.openstack.org/wiki/Packstack> Additional information
-about involvement in the community around **Packstack** can be found at
-<https://openstack.redhat.com/Get_involved>
-
-
-This utility can be used to install **OpenStack** on a single or group of
-hosts (over `ssh`).
-
-This utility is still in the early stages, a lot of the configuration
-options have yet to be added.
-
-## Installation of packstack:
-
-    $ yum install -y git
-    $ git clone git://github.com/openstack/packstack.git
-    $ cd packstack && sudo python setup.py install
-
-## Installation of Puppet modules (REQUIRED if running packstack from source):
-
-    $ export GEM_HOME=/tmp/somedir
-    $ gem install r10k
-    $ sudo -E /tmp/somedir/bin/r10k puppetfile install -v
-    $ sudo cp -r packstack/puppet/modules/packstack /usr/share/openstack-puppet/modules
-
-### Option 1 (all-in-one)
-
-    $ packstack --allinone
-
-This will install all **OpenStack** services on a single host without
-prompting for any configuration information.  This will generate an
-"answers" file (`packstack-answers-<date>-<time>.txt`) containing all
-the values used for the install.
-
-If you need to re-run packstack, you must use the `--answer-file`
-option in order for packstack to use the correct values for passwords
-and other authentication credentials:
-
-    $ packstack --answer-file packstack-answers-<date>-<time>.txt
-
-### Option 2 (using answer file)
-
-    $ packstack --gen-answer-file=ans.txt
-
-Then edit `ans.txt` as appropriate e.g.
-
-- set `CONFIG_SSH_KEY` to a public ssh key to be installed to remote machines
-- Edit the IP address to anywhere you want to install a piece of OpenStack on another server
-- Edit the 3 network interfaces to whatever makes sense in your setup
-
-    $ packstack --answer-file=ans.txt
-
-### Option 3 (prompts for configuration options)
-
-    $ packstack
-
-that's it, if everything went well you can now start using OpenStack
-
-    $ cd
-    $ . keystonerc_admin
-    $ nova list
-    $ swift list  # if you have installed swift
-
-## Config options
-
-- `CONFIG_NOVA_COMPUTE_HOSTS` :
-  * A comma separated list of ip addresses on which to install nova compute
-- `CONFIG_SWIFT_STORAGE_HOSTS` :
-  * A comma separated list of swift storage devices
-    * `1.1.1.1`: create a testing loopback device and use this for storage
-    * `1.1.1.1/sdb`: use `/dev/sdb` on `1.1.1.1` as a storage device
-
-## Logging
-
-The location of the log files and generated puppet manifests are in the
-`/var/tmp/packstack` directory under a directory named by the date in which
-**Packstack** was run and a random string (e.g. `/var/tmp/packstack/20131022-204316-Bf3Ek2`).
-Inside, we find a manifest directory and the `openstack-setup.log` file; puppet
-manifests and a log file for each one are found inside the manifest directory.
-
-## Debugging
-
-To make **Packstack** write more detailed information into the log file you can use the `-d` switch:
-
-    $ packstack -d --allinone
-
-When upgrading to a new OpenStack release and reusing old answerfile
-it is useful to know if any **Packstack** option was removed. If answerfile is
-written by hand it is possible to make a mistake. The `--validate-answer-file`
-switch allows checking if any provided option is not recognized by **Packstack**.
-
-    $ packstack --validate-answer-file=ans.txt
-
-## Developing
-
-To ease development of **Packstack**, it can be
-useful to install from *git* such that updates to the git repositories are
-immediately effective without reinstallation.
-
-To do this, start with a minimal **CentOS 7** installation.  Then remove any
-relevant packages that might conflict:
-
-    $ yum -y erase openstack-packstack*,puppet-*
-
-Disable **SELinux** by changing "`enforcing`" to "`permissive`" in
-`/etc/sysconfig/selinux`, then reboot to allow service changes to take effect
-and swap over networking.  Then install packages:
-
-    $ yum -y install git python-setuptools
-
-And install **RDO**:
-
-    $ yum -y install https://www.rdoproject.org/repos/rdo-release.rpm
-    $ yum -y update
-
-Install Puppet modules as described [above](README.md#installation-of-puppet-modules-required-if-running-packstack-from-source).
-
-Then we get **Packstack**:
-
-    $ yum install -y python-crypto python-devel libffi-devel openssl-devel gcc-c++
-    $ git clone https://github.com/openstack/packstack
-    $ cd packstack
-    $ python setup.py develop
-
-And we're done.  Changes to the contents of **Packstack** source repository
-are picked up by the **Packstack**
-executable without further intervention, and **Packstack** is ready to install.
-
-## Puppet Style Guide
-
-**IMPORTANT** <https://docs.puppetlabs.com/guides/style_guide.html>
-
-Please, respect the Puppet Style Guide as much as possible !
-
-## Running local Puppet-lint tests
-
-It assumes that both `bundler` as well as `rubygems` (and `ruby`) are already
-installed on the system. If not, run this command:
-
-    $ sudo yum install rubygems rubygem-bundler ruby ruby-devel -y
-
-Go into the **Packstack** root directory.
-
-    $ cd packstack/
-
-A `Rakefile` contains all you need to run puppet-lint task automatically over
-all the puppet manifests included in the **Packstack** project.
-
-    $ ls -l packstack/puppet/templates/
-
-and
-
-    $ ls -l packstack/puppet/modules/
-
-The default puppet-lint pattern for `.pp` files is `**/*.pp`. So there is no
-need to go inside those directories to run puppet-lint !
-
-    $ mkdir vendor
-    $ export GEM_HOME=vendor
-    $ bundle install
-    $ bundle exec rake lint
-
-## Packstack integration tests
-
-Packstack is integration tested in the OpenStack gate and provides the means to
-reproduce these tests on your environment if you wish.
-
-Scenario000 installs packstack allinone only and doesn't run any tests. This is
-the current matrix of available tests:
-
-|     -          | scenario000 | scenario001 | scenario002 | scenario003 |
-|:--------------:|:-----------:|:-----------:|:-----------:|:------------:
-| keystone       |   FERNET    |   FERNET    |    FERNET   |    FERNET   |
-| glance         |             |    file     |    swift    |     file    |
-| nova           |      X      |      X      |      X      |      X      |
-| neutron        |      X      |      X      |      X      |      X      |
-| neutron plugin |     ovn     |     ovn     |     ovs     |     ovn     |
-| vpnaas         |             |             |             |             |
-| cinder         |      X      |      X      |             |             |
-| ceilometer     |      X      |             |             |      X      |
-| aodh           |      X      |             |             |      X      |
-| gnocchi        |      X      |             |             |      X      |
-| panko          |             |             |             |      X      |
-| heat           |             |             |             |      X      |
-| swift          |      X      |             |      X      |             |
-| sahara         |             |             |      X      |             |
-| trove          |             |             |      X      |             |
-| horizon        |             |      X      |             |             |
-| manila         |             |      X      |             |             |
-| SSL            |             |      X      |             |             |
-
-To run these tests:
-
-    export SCENARIO="scenario001"
-    ./run_tests.sh
-
-run_tests.sh will take care of installing the required dependencies,
-configure packstack to run according to the above matrix and run the complete
-installation process. If the installation is successful, tempest will also
-run smoke tests.
-
-By default, run_tests.sh will set up delorean (RDO Trunk) repositories.
-There are two ways of overriding default repositories:
-
-    export DELOREAN="http://someotherdomain.tld/delorean.repo"
-    export DELOREAN_DEPS="http://someotherdomain.tld/delorean-deps.repo"
-    ./run_tests.sh
-
-You can also choose to disable repository management entirely:
-
-    <setup your own custom repositories here>
-    export MANAGE_REPOS="false"
-    ./run_tests.sh
diff --git a/README.rst b/README.rst
new file mode 100644
index 000000000..9e1ae842c
--- /dev/null
+++ b/README.rst
@@ -0,0 +1,293 @@
+Packstack
+=========
+
+Utility to install **OpenStack** on **Red Hat** based operating system.
+See other branches for older **OpenStack** versions. Details on how to
+contribute to **Packstack** may be found in the **Packstack** wiki at
+https://wiki.openstack.org/wiki/Packstack Additional information about
+involvement in the community around **Packstack** can be found at
+https://openstack.redhat.com/Get_involved
+
+This utility can be used to install **OpenStack** on a single or group
+of hosts (over ``ssh``).
+
+This utility is still in the early stages, a lot of the configuration
+options have yet to be added.
+
+Installation of packstack:
+--------------------------
+
+::
+
+   $ yum install -y git
+   $ git clone git://github.com/openstack/packstack.git
+   $ cd packstack && sudo python setup.py install
+
+Installation of Puppet modules (REQUIRED if running packstack from source):
+---------------------------------------------------------------------------
+
+::
+
+   $ export GEM_HOME=/tmp/somedir
+   $ gem install r10k
+   $ sudo -E /tmp/somedir/bin/r10k puppetfile install -v
+   $ sudo cp -r packstack/puppet/modules/packstack /usr/share/openstack-puppet/modules
+
+Option 1 (all-in-one)
+~~~~~~~~~~~~~~~~~~~~~
+
+::
+
+   $ packstack --allinone
+
+This will install all **OpenStack** services on a single host without
+prompting for any configuration information. This will generate an
+“answers” file (``packstack-answers-<date>-<time>.txt``) containing all
+the values used for the install.
+
+If you need to re-run packstack, you must use the ``--answer-file``
+option in order for packstack to use the correct values for passwords
+and other authentication credentials:
+
+::
+
+   $ packstack --answer-file packstack-answers-<date>-<time>.txt
+
+Option 2 (using answer file)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+::
+
+   $ packstack --gen-answer-file=ans.txt
+
+Then edit ``ans.txt`` as appropriate e.g.
+
+-  set ``CONFIG_SSH_KEY`` to a public ssh key to be installed to remote
+   machines
+-  Edit the IP address to anywhere you want to install a piece of
+   OpenStack on another server
+-  Edit the 3 network interfaces to whatever makes sense in your setup
+
+   $ packstack –answer-file=ans.txt
+
+Option 3 (prompts for configuration options)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+::
+
+   $ packstack
+
+that’s it, if everything went well you can now start using OpenStack
+
+::
+
+   $ cd
+   $ . keystonerc_admin
+   $ nova list
+   $ swift list  # if you have installed swift
+
+Config options
+--------------
+
+-  ``CONFIG_NOVA_COMPUTE_HOSTS`` :
+
+   -  A comma separated list of ip addresses on which to install nova
+      compute
+
+-  ``CONFIG_SWIFT_STORAGE_HOSTS`` :
+
+   -  A comma separated list of swift storage devices
+
+      -  ``1.1.1.1``: create a testing loopback device and use this for
+         storage
+      -  ``1.1.1.1/sdb``: use ``/dev/sdb`` on ``1.1.1.1`` as a storage
+         device
+
+Logging
+-------
+
+The location of the log files and generated puppet manifests are in the
+``/var/tmp/packstack`` directory under a directory named by the date in
+which **Packstack** was run and a random string
+(e.g. ``/var/tmp/packstack/20131022-204316-Bf3Ek2``). Inside, we find a
+manifest directory and the ``openstack-setup.log`` file; puppet
+manifests and a log file for each one are found inside the manifest
+directory.
+
+Debugging
+---------
+
+To make **Packstack** write more detailed information into the log file
+you can use the ``-d`` switch:
+
+::
+
+   $ packstack -d --allinone
+
+When upgrading to a new OpenStack release and reusing old answerfile it
+is useful to know if any **Packstack** option was removed. If answerfile
+is written by hand it is possible to make a mistake. The
+``--validate-answer-file`` switch allows checking if any provided option
+is not recognized by **Packstack**.
+
+::
+
+   $ packstack --validate-answer-file=ans.txt
+
+Developing
+----------
+
+To ease development of **Packstack**, it can be useful to install from
+*git* such that updates to the git repositories are immediately
+effective without reinstallation.
+
+To do this, start with a minimal **CentOS 7** installation. Then remove
+any relevant packages that might conflict:
+
+::
+
+   $ yum -y erase openstack-packstack*,puppet-*
+
+Disable **SELinux** by changing “``enforcing``” to “``permissive``” in
+``/etc/sysconfig/selinux``, then reboot to allow service changes to take
+effect and swap over networking. Then install packages:
+
+::
+
+   $ yum -y install git python-setuptools
+
+And install **RDO**:
+
+::
+
+   $ yum -y install https://www.rdoproject.org/repos/rdo-release.rpm
+   $ yum -y update
+
+Install Puppet modules as described
+`above <README.md#installation-of-puppet-modules-required-if-running-packstack-from-source>`__.
+
+Then we get **Packstack**:
+
+::
+
+   $ yum install -y python-crypto python-devel libffi-devel openssl-devel gcc-c++
+   $ git clone https://github.com/openstack/packstack
+   $ cd packstack
+   $ python setup.py develop
+
+And we’re done. Changes to the contents of **Packstack** source
+repository are picked up by the **Packstack** executable without further
+intervention, and **Packstack** is ready to install.
+
+Puppet Style Guide
+------------------
+
+**IMPORTANT** https://docs.puppetlabs.com/guides/style_guide.html
+
+Please, respect the Puppet Style Guide as much as possible !
+
+Running local Puppet-lint tests
+-------------------------------
+
+It assumes that both ``bundler`` as well as ``rubygems`` (and ``ruby``)
+are already installed on the system. If not, run this command:
+
+::
+
+   $ sudo yum install rubygems rubygem-bundler ruby ruby-devel -y
+
+Go into the **Packstack** root directory.
+
+::
+
+   $ cd packstack/
+
+A ``Rakefile`` contains all you need to run puppet-lint task
+automatically over all the puppet manifests included in the
+**Packstack** project.
+
+::
+
+   $ ls -l packstack/puppet/templates/
+
+and
+
+::
+
+   $ ls -l packstack/puppet/modules/
+
+The default puppet-lint pattern for ``.pp`` files is ``**/*.pp``. So
+there is no need to go inside those directories to run puppet-lint !
+
+::
+
+   $ mkdir vendor
+   $ export GEM_HOME=vendor
+   $ bundle install
+   $ bundle exec rake lint
+
+Packstack integration tests
+---------------------------
+
+Packstack is integration tested in the OpenStack gate and provides the
+means to reproduce these tests on your environment if you wish.
+
+Scenario000 installs packstack allinone only and doesn’t run any tests.
+This is the current matrix of available tests:
+
+============== =========== =========== =========== ===========
+-              scenario000 scenario001 scenario002 scenario003
+============== =========== =========== =========== ===========
+keystone       FERNET      FERNET      FERNET      FERNET
+glance                     file        swift       file
+nova           X           X           X           X
+neutron        X           X           X           X
+neutron plugin ovn         ovn         ovs         ovn
+vpnaas                                            
+cinder         X           X                      
+ceilometer     X                                   X
+aodh           X                                   X
+gnocchi        X                                   X
+heat                                               X
+swift          X                       X          
+trove                                  X          
+horizon                    X                      
+manila                     X                      
+SSL                        X                      
+============== =========== =========== =========== ===========
+
+To run these tests:
+
+::
+
+   export SCENARIO="scenario001"
+   ./run_tests.sh
+
+run_tests.sh will take care of installing the required dependencies,
+configure packstack to run according to the above matrix and run the
+complete installation process. If the installation is successful,
+tempest will also run smoke tests.
+
+By default, run_tests.sh will set up delorean (RDO Trunk) repositories.
+There are two ways of overriding default repositories:
+
+::
+
+   export DELOREAN="http://someotherdomain.tld/delorean.repo"
+   export DELOREAN_DEPS="http://someotherdomain.tld/delorean-deps.repo"
+   ./run_tests.sh
+
+You can also choose to disable repository management entirely:
+
+::
+
+   <setup your own custom repositories here>
+   export MANAGE_REPOS="false"
+   ./run_tests.sh
+
+Reporting Bugs
+--------------
+
+Bugs for packstack are tracked in the "packstack" component of the [RDO Jira board](https://issues.redhat.com/issues/?jql=project+%3D+RDO+AND+component+%3D+packstack).
+If you find issues, you can create an issue on that board and provide the relevant information to describe your problem.
+
diff --git a/docs/conf.py b/docs/source/conf.py
similarity index 99%
rename from docs/conf.py
rename to docs/source/conf.py
index b8577e2ca..39f72ebe6 100644
--- a/docs/conf.py
+++ b/docs/source/conf.py
@@ -136,7 +136,7 @@
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
-html_static_path = ['_static']
+html_static_path = []
 
 # If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
 # using the given strftime format.
diff --git a/docs/packstack.rst b/docs/source/packstack.rst
old mode 100755
new mode 100644
similarity index 92%
rename from docs/packstack.rst
rename to docs/source/packstack.rst
index 1704779e1..cdbe84308
--- a/docs/packstack.rst
+++ b/docs/source/packstack.rst
@@ -52,7 +52,7 @@ Global Options
     Specify 'y' to install OpenStack Compute (nova). ['y', 'n']
 
 **CONFIG_NEUTRON_INSTALL**
-    Specify 'y' to install OpenStack Networking (neutron) ['y']
+    Specify 'y' to install OpenStack Networking (neutron) ['y', 'n']
 
 **CONFIG_HORIZON_INSTALL**
     Specify 'y' to install OpenStack Dashboard (horizon). ['y', 'n']
@@ -66,18 +66,12 @@ Global Options
 **CONFIG_AODH_INSTALL**
     Specify 'y' to install OpenStack Telemetry Alarming (Aodh). Note Aodh requires Ceilometer to be installed as well. ['y', 'n']
 
-**CONFIG_PANKO_INSTALL**
-    Specify 'y' to install OpenStack Events Service (panko). ['y', 'n']
-
 **CONFIG_HEAT_INSTALL**
     Specify 'y' to install OpenStack Orchestration (heat). ['y', 'n']
 
 **CONFIG_MAGNUM_INSTALL**
     Specify 'y' to install OpenStack Container Infrastructure Management Service (magnum). ['y', 'n']
 
-**CONFIG_SAHARA_INSTALL**
-    Specify 'y' to install OpenStack Data Processing (sahara). In case of sahara installation packstack also installs heat.['y', 'n']
-
 **CONFIG_TROVE_INSTALL**
     Specify 'y' to install OpenStack Database (trove) ['y', 'n']
 
@@ -112,7 +106,7 @@ Global Options
     Specify 'y' if you want to use unsupported parameters. This should be used only if you know what you are doing. Issues caused by using unsupported options will not be fixed before the next major release. ['y', 'n']
 
 **CONFIG_USE_SUBNETS**
-    Specify 'y' if you want to use subnet addresses (in CIDR format) instead of interface names in following options: CONFIG_NEUTRON_OVS_BRIDGE_IFACES, CONFIG_NEUTRON_LB_INTERFACE_MAPPINGS, CONFIG_NEUTRON_OVS_TUNNEL_IF. This is useful for cases when interface names are not same on all installation hosts.
+    Specify 'y' if you want to use subnet addresses (in CIDR format) instead of interface names in following options: CONFIG_NEUTRON_OVS_BRIDGE_IFACES, CONFIG_NEUTRON_OVS_TUNNEL_IF. This is useful for cases when interface names are not same on all installation hosts.
 
 SSL setup
 ---------
@@ -173,9 +167,6 @@ Global unsupported options
 **CONFIG_STORAGE_HOST**
     (Unsupported!) Server on which to install OpenStack services specific to storage servers such as Image or Block Storage services.
 
-**CONFIG_SAHARA_HOST**
-    (Unsupported!) Server on which to install OpenStack services specific to OpenStack Data Processing (sahara).
-
 Server Prepare Configs
 -----------------------
 
@@ -275,12 +266,6 @@ AMQP Config parameters
 **CONFIG_AMQP_ENABLE_AUTH**
     Specify 'y' to enable authentication for the AMQP service. ['y', 'n']
 
-AMQP Config SSL parameters
---------------------------
-
-**CONFIG_AMQP_NSS_CERTDB_PW**
-    Password for the NSS certificate database of the AMQP service.
-
 AMQP Config Authentication parameters
 -------------------------------------
 
@@ -327,7 +312,7 @@ Keystone Config parameters
     Password to use for the Identity service 'demo' user.
 
 **CONFIG_KEYSTONE_API_VERSION**
-    Identity service API version string. ['v2.0', 'v3']
+    Identity service API version string. ['v3']
 
 **CONFIG_KEYSTONE_TOKEN_FORMAT**
     Identity service token format (FERNET). Since Rocky, only FERNET is supported. ['FERNET']
@@ -392,15 +377,6 @@ Keystone LDAP Identity Backend Config parameters
 **CONFIG_KEYSTONE_LDAP_USER_DEFAULT_PROJECT_ID_ATTRIBUTE**
     Identity service LDAP attribute mapped to default_project_id for users.
 
-**CONFIG_KEYSTONE_LDAP_USER_ALLOW_CREATE**
-    Specify 'y' if you want to be able to create Identity service users through the Identity service interface; specify 'n' if you will create directly in the LDAP backend. ['n', 'y']
-
-**CONFIG_KEYSTONE_LDAP_USER_ALLOW_UPDATE**
-    Specify 'y' if you want to be able to update Identity service users through the Identity service interface; specify 'n' if you will update directly in the LDAP backend. ['n', 'y']
-
-**CONFIG_KEYSTONE_LDAP_USER_ALLOW_DELETE**
-    Specify 'y' if you want to be able to delete Identity service users through the Identity service interface; specify 'n' if you will delete directly in the LDAP backend. ['n', 'y']
-
 **CONFIG_KEYSTONE_LDAP_USER_PASS_ATTRIBUTE**
     Identity service LDAP attribute mapped to password.
 
@@ -434,15 +410,6 @@ Keystone LDAP Identity Backend Config parameters
 **CONFIG_KEYSTONE_LDAP_GROUP_ATTRIBUTE_IGNORE**
     Comma-separated list of attributes stripped from LDAP group entry upon update.
 
-**CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_CREATE**
-    Specify 'y' if you want to be able to create Identity service groups through the Identity service interface; specify 'n' if you will create directly in the LDAP backend. ['n', 'y']
-
-**CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_UPDATE**
-    Specify 'y' if you want to be able to update Identity service groups through the Identity service interface; specify 'n' if you will update directly in the LDAP backend. ['n', 'y']
-
-**CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_DELETE**
-    Specify 'y' if you want to be able to delete Identity service groups through the Identity service interface; specify 'n' if you will delete directly in the LDAP backend. ['n', 'y']
-
 **CONFIG_KEYSTONE_LDAP_GROUP_ADDITIONAL_ATTRIBUTE_MAPPING**
     List of additional LDAP attributes used for mapping additional attribute mappings for groups. The attribute=mapping format is <ldap_attr>:<group_attr>, where ldap_attr is the attribute in the LDAP entry and group_attr is the Identity API attribute.
 
@@ -483,7 +450,7 @@ Cinder Config parameters
     Password to use for the Block Storage service to authenticate with the Identity service.
 
 **CONFIG_CINDER_BACKEND**
-    Storage backend to use for the Block Storage service; valid options are: lvm, gluster, nfs, vmdk, netapp, solidfire. ['lvm', 'gluster', 'nfs', 'vmdk', 'netapp', 'solidfire']
+    Storage backend to use for the Block Storage service; valid options are: lvm, nfs, vmdk, netapp, solidfire. ['lvm', 'nfs', 'vmdk', 'netapp', 'solidfire']
 
 Cinder volume create Config parameters
 --------------------------------------
@@ -503,12 +470,6 @@ Cinder lvm Config parameters
 **CONFIG_CINDER_VOLUME_NAME**
     Specify a custom name for the lvm cinder volume group
 
-Cinder gluster Config parameters
---------------------------------
-
-**CONFIG_CINDER_GLUSTER_MOUNTS**
-    A single or comma-separated list of Red Hat Storage (gluster) volume shares to mount. Example: 'ip-address:/vol-name', 'domain:/vol-name'
-
 Cinder NFS Config parameters
 ----------------------------
 
@@ -694,7 +655,7 @@ Manila Network configuration
 ----------------------------
 
 **CONFIG_MANILA_NETWORK_TYPE**
-    Type of networking that the backend will use. A more detailed description of each option is available in the Manila docs. Defaults to 'neutron'. ['neutron', 'nova-network', 'standalone']
+    Type of networking that the backend will use. A more detailed description of each option is available in the Manila docs. Defaults to 'neutron'. ['neutron', 'standalone']
 
 Manila Standalone network configuration
 ---------------------------------------
@@ -776,7 +737,7 @@ Neutron config
     The password to use for OpenStack Networking to access the database.
 
 **CONFIG_NEUTRON_L3_EXT_BRIDGE**
-    The name of the Open vSwitch bridge (or empty for linuxbridge) for the OpenStack Networking L3 agent to use for external  traffic. Specify 'provider' if you intend to use a provider network to handle external traffic.
+    The name of the Open vSwitch bridge for the OpenStack Networking L3 agent to use for external  traffic. Specify 'provider' if you intend to use a provider network to handle external traffic.
 
 **CONFIG_NEUTRON_METADATA_PW**
     Password for the OpenStack Networking metadata agent.
@@ -784,9 +745,6 @@ Neutron config
 **CONFIG_NEUTRON_METERING_AGENT_INSTALL**
     Specify 'y' to install OpenStack Networking's L3 Metering agent ['y', 'n']
 
-**CONFIG_NEUTRON_FWAAS**
-     Specify 'y' to configure OpenStack Networking's Firewall-as-a-Service (FWaaS). ['y', 'n']
-
 **CONFIG_NEUTRON_VPNAAS**
      Specify 'y' to configure OpenStack Networking's VPN-as-a-Service (VPNaaS). ['y', 'n']
 
@@ -800,7 +758,7 @@ Neutron ML2 plugin config
     Comma-separated, ordered list of network types to allocate as tenant networks. The 'local' value is only useful for single-box testing and provides no connectivity between hosts. ['local', 'vlan', 'gre', 'vxlan', 'geneve']
 
 **CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS**
-    Comma-separated ordered list of networking mechanism driver entry points to be loaded from the neutron.ml2.mechanism_drivers namespace. ['logger', 'test', 'linuxbridge', 'openvswitch', 'hyperv', 'ncs', 'arista', 'cisco_nexus', 'mlnx', 'l2population', 'sriovnicswitch', 'ovn']
+    Comma-separated ordered list of networking mechanism driver entry points to be loaded from the neutron.ml2.mechanism_drivers namespace. ['logger', 'test', 'openvswitch', 'arista', 'mlnx', 'l2population', 'sriovnicswitch', 'ovn']
 
 **CONFIG_NEUTRON_ML2_FLAT_NETWORKS**
     Comma-separated list of physical_network names with which flat networks can be created. Use * to allow flat networks with arbitrary physical_network names.
@@ -822,13 +780,7 @@ Neutron ML2 plugin config
 
 
 **CONFIG_NEUTRON_L2_AGENT**
-    Name of the L2 agent to be used with OpenStack Networking. ['linuxbridge', 'openvswitch', 'ovn']
-
-Neutron LB agent config
------------------------
-
-**CONFIG_NEUTRON_LB_INTERFACE_MAPPINGS**
-    Comma-separated list of interface mappings for the OpenStack Networking linuxbridge plugin. Each tuple in the list must be in the format <physical_network>:<net_interface>. Example: physnet1:eth1,physnet2:eth2,physnet3:eth3.
+    Name of the L2 agent to be used with OpenStack Networking. ['openvswitch', 'ovn']
 
 Neutron OVS agent config
 ------------------------
@@ -1032,6 +984,9 @@ Provisioning tempest config
 **CONFIG_RUN_TEMPEST_TESTS**
     Test suites to run, example: "smoke dashboard TelemetryAlarming". Optional, defaults to "smoke".
 
+**CONFIG_SKIP_TEMPEST_TESTS**
+    Tests to skip, example: "test_basic_scenario test_volume". Optional, defaults to "".
+
 **CONFIG_PROVISION_UEC_IMAGE_NAME**
     Name of the uec image created in Glance used in tempest tests (default "cirros-uec").
 
@@ -1062,9 +1017,6 @@ Ceilometer Config parameters
 **CONFIG_CEILOMETER_COORDINATION_BACKEND**
     Backend driver for Telemetry's group membership coordination. ['redis', 'none']
 
-**CONFIG_CEILOMETER_SERVICE_NAME**
-    Ceilometer service name. ['httpd', 'ceilometer']
-
 **CONFIG_ENABLE_CEILOMETER_MIDDLEWARE**
     Whether to enable ceilometer middleware in swift proxy. By default this should be false to avoid unnecessary load.
 
@@ -1097,24 +1049,6 @@ Gnocchi Config parameters
 **CONFIG_GNOCCHI_KS_PW**
     Password to use for Gnocchi to authenticate with the Identity service.
 
-Panko Config parameters
--------------------------
-
-**CONFIG_PANKO_DB_PW**
-    Password to use for Panko to access the database.
-
-**CONFIG_PANKO_KS_PW**
-    Password to use for Panko to authenticate with the Identity service.
-
-
-Sahara Config parameters
-------------------------
-
-**CONFIG_SAHARA_DB_PW**
-    Password to use for OpenStack Data Processing (sahara) to access the database.
-
-**CONFIG_SAHARA_KS_PW**
-    Password to use for OpenStack Data Processing to authenticate with the Identity service.
 
 Trove config parameters
 -----------------------
diff --git a/external_modules.txt b/external_modules.txt
new file mode 100644
index 000000000..34702db8b
--- /dev/null
+++ b/external_modules.txt
@@ -0,0 +1,16 @@
+puppetlabs/puppetlabs-apache
+puppetlabs/puppetlabs-concat
+puppetlabs/puppetlabs-firewall
+puppetlabs/puppetlabs-inifile
+saz/puppet-memcached
+puppetlabs/puppetlabs-mysql
+rcritten/puppet-nssdb,2ed2a2df59bbeaf9cf628e1a4a499476842282fd
+voxpupuli/puppet-rabbitmq
+voxpupuli/puppet-redis
+paramite/puppet-remote,7420908328b832f4b20e1eba44bcccd926da8faa
+puppetlabs/puppetlabs-rsync
+puppetlabs/puppetlabs-stdlib
+duritong/puppet-sysctl,847ec1c07ed3e231a48d8816971c0bd4afe7a72b
+voxpupuli/puppet-systemd
+puppetlabs/puppetlabs-vcsrepo
+puppetlabs/puppetlabs-xinetd
diff --git a/openstack_modules.txt b/openstack_modules.txt
new file mode 100644
index 000000000..d44325483
--- /dev/null
+++ b/openstack_modules.txt
@@ -0,0 +1,21 @@
+aodh
+ceilometer
+cinder
+glance
+gnocchi
+heat
+horizon
+ironic
+keystone
+magnum
+manila
+neutron
+nova
+openstacklib
+oslo
+ovn
+placement
+swift
+tempest
+trove
+vswitch
diff --git a/packstack/installer/basedefs.py b/packstack/installer/basedefs.py
index 6a496ee69..eddded217 100644
--- a/packstack/installer/basedefs.py
+++ b/packstack/installer/basedefs.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -22,7 +21,7 @@
 import tempfile
 
 import packstack
-from .utils import get_current_user
+from packstack.installer.utils import get_current_user
 
 
 APP_NAME = "Packstack"
@@ -31,7 +30,7 @@
 
 PACKSTACK_SRC_DOC = os.path.realpath(
     os.path.join(os.path.abspath(
-        packstack.__path__[0]), '..', 'docs/packstack.rst'
+        packstack.__path__[0]), '..', 'docs/source/packstack.rst'
     )
 )
 if os.path.exists(PACKSTACK_SRC_DOC):
@@ -59,7 +58,7 @@
     if uid != 0 and os.getuid() == 0:
         try:
             os.chown(PACKSTACK_VAR_DIR, uid, gid)
-        except Exception as ex:
+        except Exception:
             print('Unable to change owner of %s. Please fix ownership '
                   'manually and try again.' % PACKSTACK_VAR_DIR)
             sys.exit(1)
diff --git a/packstack/installer/core/arch.py b/packstack/installer/core/arch.py
index a1fea7ab5..f828ea454 100644
--- a/packstack/installer/core/arch.py
+++ b/packstack/installer/core/arch.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/installer/core/drones.py b/packstack/installer/core/drones.py
index 5f3828d8c..e2869423a 100644
--- a/packstack/installer/core/drones.py
+++ b/packstack/installer/core/drones.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -12,14 +11,14 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import logging
 import os
-import six
+import shutil
 import stat
-import uuid
-import time
-import logging
 import tarfile
 import tempfile
+import time
+import uuid
 
 from .. import utils
 
@@ -41,7 +40,7 @@ def _transfer(self, pack_path, pack_dest, res_dir):
                       "tar -C %(res_dir)s -xpzf %(pack_dest)s" % args)
         try:
             script.execute()
-        except ScriptRuntimeError as ex:
+        except utils.ScriptRuntimeError as ex:
             # TO-DO: change to appropriate exception
             raise RuntimeError('Failed to copy resources to node %s. '
                                'Reason: %s' % (node, ex))
@@ -76,7 +75,7 @@ def _pack_recipes(self):
             dest = self.recipe_dir[len(self.resource_dir):].lstrip('/')
         else:
             dest = ''
-        for marker, recipes in six.iteritems(self._recipes):
+        for marker, recipes in self._recipes.items():
             for path in recipes:
                 _dest = os.path.join(dest, os.path.basename(path))
                 pack.add(path, arcname=_dest)
@@ -279,7 +278,7 @@ def apply(self, marker=None, name=None, skip=None):
         logger = logging.getLogger()
         skip = skip or []
         lastmarker = None
-        for mark, recipelist in six.iteritems(self._recipes):
+        for mark, recipelist in self._recipes.items():
             if marker and marker != mark:
                 logger.debug('Skipping marker %s for node %s.' %
                              (mark, self.node))
@@ -347,8 +346,8 @@ def init_node(self):
         super(PackstackDrone, self).init_node()
         server = utils.ScriptRunner(self.node)
         for pkg in ("puppet", "openssh-clients", "tar"):
-            server.append("rpm -q --whatprovides %(pkg)s || "
-                          "yum install -y %(pkg)s" % locals())
+            server.append(f"rpm -q --whatprovides {pkg} || "
+                          f"yum install -y {pkg}")
         server.execute()
 
     def add_resource(self, path, resource_type=None):
@@ -373,7 +372,7 @@ def _finished(self, recipe):
             local.execute(log=False)
             # if we got to this point the puppet apply has finished
             return True
-        except utils.ScriptRuntimeError as e:
+        except utils.ScriptRuntimeError:
             # the test raises an exception if the file doesn't exist yet
             return False
 
@@ -402,9 +401,9 @@ def _apply(self, recipe):
         rdir = self.resource_dir
         mdir = self._module_dir
         server.append(
-            "( flock %(rdir)s/ps.lock "
-            "puppet apply %(loglevel)s --modulepath %(mdir)s "
-            "%(recipe)s > %(running)s 2>&1 < /dev/null; "
-            "mv %(running)s %(finished)s ) "
-            "> /dev/null 2>&1 < /dev/null &" % locals())
+            f"( flock {rdir}/ps.lock "
+            f"puppet apply {loglevel} --modulepath {mdir} "
+            f"{recipe} > {running} 2>&1 < /dev/null; "
+            f"mv {running} {finished} ) "
+            "> /dev/null 2>&1 < /dev/null &")
         server.execute()
diff --git a/packstack/installer/core/parameters.py b/packstack/installer/core/parameters.py
index ea9ed385d..4078e6dce 100644
--- a/packstack/installer/core/parameters.py
+++ b/packstack/installer/core/parameters.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -17,7 +16,6 @@
 """
 
 from ..utils.datastructures import SortedDict
-import six
 
 
 class Parameter(object):
@@ -32,7 +30,7 @@ def __init__(self, attributes=None):
         defaults = {}.fromkeys(self.allowed_keys)
         defaults.update(attributes)
 
-        for key, value in six.iteritems(defaults):
+        for key, value in defaults.items():
             if key not in self.allowed_keys:
                 raise KeyError('Given attribute %s is not allowed' % key)
             self.__dict__[key] = value
diff --git a/packstack/installer/core/sequences.py b/packstack/installer/core/sequences.py
index 224fd384d..5d26c9745 100644
--- a/packstack/installer/core/sequences.py
+++ b/packstack/installer/core/sequences.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -16,8 +15,8 @@
 Base class for steps & sequences
 """
 
-import sys
 import logging
+import sys
 import traceback
 
 from .. import utils
@@ -48,7 +47,7 @@ def run(self, config=None, messages=None):
         # execute and report state
         try:
             self.function(config, messages)
-        except Exception as ex:
+        except Exception:
             logger.debug(traceback.format_exc())
             state = utils.state_message(self.title, 'ERROR', 'red')
             sys.stdout.write('%s\n' % state)
diff --git a/packstack/installer/exceptions.py b/packstack/installer/exceptions.py
index a37b7b005..8ffd6cc89 100644
--- a/packstack/installer/exceptions.py
+++ b/packstack/installer/exceptions.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/installer/output_messages.py b/packstack/installer/output_messages.py
index cd9bc0a86..36d28f885 100644
--- a/packstack/installer/output_messages.py
+++ b/packstack/installer/output_messages.py
@@ -23,7 +23,7 @@
 
 DONT CHANGE any of the params names (in UPPER-CASE)
 they are used in the engine-setup.py
-'''
+'''     # noqa: W605
 
 from packstack.installer import basedefs
 
diff --git a/packstack/installer/processors.py b/packstack/installer/processors.py
index 3c3054711..63ce386f5 100644
--- a/packstack/installer/processors.py
+++ b/packstack/installer/processors.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -125,8 +124,6 @@ def process_password(param, param_name, config=None):
 
 
 def process_heat(param, param_name, config=None):
-    if config["CONFIG_SAHARA_INSTALL"] == 'y':
-        param = 'y'
     return param
 
 
@@ -154,6 +151,7 @@ def process_bool(param, param_name, config=None):
     elif param.lower() in ('n', 'no', 'false'):
         return False
 
+
 # Define silent processors
 for proc_func in (process_bool, process_add_quotes_around_values):
     proc_func.silent = True
diff --git a/packstack/installer/run_setup.py b/packstack/installer/run_setup.py
index 4ffb17224..7c8a266fe 100644
--- a/packstack/installer/run_setup.py
+++ b/packstack/installer/run_setup.py
@@ -11,21 +11,19 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from six.moves import configparser
-from six.moves import StringIO
-from functools import cmp_to_key
-
+import configparser
 import copy
 import datetime
+from functools import cmp_to_key
 import getpass
+import io
 import logging
 import os
 import re
-import six
 import sys
+import textwrap
 import traceback
 import types
-import textwrap
 
 from optparse import OptionGroup
 from optparse import OptionParser
@@ -46,7 +44,7 @@
 commandLineValues = {}
 
 # List to hold all values to be masked in logging (i.e. passwords and sensitive data)
-# TODO: read default values from conf_param?
+# TODO(tbd): read default values from conf_param?
 masked_value_set = set()
 tmpfiles = []
 
@@ -73,7 +71,7 @@ def initLogging(debug):
         logging.root.handlers = []
         logging.root.addHandler(hdlr)
         logging.root.setLevel(level)
-    except:
+    except Exception:
         logging.error(traceback.format_exc())
         raise Exception(output_messages.ERR_EXP_FAILED_INIT_LOGGER)
 
@@ -96,12 +94,12 @@ def _getInputFromUser(param):
             while loop:
                 # If the value was not supplied by the command line flags
                 if param.CONF_NAME not in commandLineValues:
-                    message = StringIO()
+                    message = io.StringIO()
                     message.write(param.PROMPT)
 
                     val_list = param.VALIDATORS or []
-                    if(validators.validate_regexp not in val_list
-                       and param.OPTION_LIST):
+                    if (validators.validate_regexp not in val_list and
+                            param.OPTION_LIST):
                         message.write(" [%s]" % "|".join(param.OPTION_LIST))
 
                     if param.DEFAULT_VALUE:
@@ -114,7 +112,7 @@ def _getInputFromUser(param):
                     if (param.MASK_INPUT):
                         userInput = getpass.getpass("%s :" % (param.PROMPT))
                     else:
-                        userInput = raw_input(message.read())
+                        userInput = input(message.read())
                 else:
                     userInput = commandLineValues[param.CONF_NAME]
                 # If DEFAULT_VALUE is set and user did not input anything
@@ -150,7 +148,7 @@ def _getInputFromUser(param):
         # add the new line so messages wont be displayed in the same line as the question
         print("")
         raise
-    except:
+    except Exception:
         logging.error(traceback.format_exc())
         raise Exception(output_messages.ERR_EXP_READ_INPUT_PARAM % (param.CONF_NAME))
 
@@ -184,7 +182,7 @@ def input_param(param):
 
 
 def _askYesNo(question=None):
-    message = StringIO()
+    message = io.StringIO()
 
     while True:
         askString = "\r%s? (yes|no): " % (question)
@@ -193,7 +191,7 @@ def _askYesNo(question=None):
         message.write(askString)
         message.seek(0)
 
-        raw = raw_input(message.read())
+        raw = input(message.read())
         if not len(raw):
             continue
 
@@ -243,20 +241,20 @@ def mask(input):
     output = copy.deepcopy(input)
     if isinstance(input, dict):
         for key in input:
-            if isinstance(input[key], six.string_types):
+            if isinstance(input[key], str):
                 output[key] = utils.mask_string(input[key],
                                                 masked_value_set)
     if isinstance(input, list):
         for item in input:
             org = item
             orgIndex = input.index(org)
-            if isinstance(item, six.string_types):
+            if isinstance(item, str):
                 item = utils.mask_string(item, masked_value_set)
             if item != org:
                 output.remove(org)
                 output.insert(orgIndex, item)
-    if isinstance(input, six.string_types):
-            output = utils.mask_string(input, masked_value_set)
+    if isinstance(input, str):
+        output = utils.mask_string(input, masked_value_set)
 
     return output
 
@@ -332,7 +330,7 @@ def _handleGroupCondition(config, conditionName, conditionValue):
 
     # If the condition is a string - just read it to global conf
     # We assume that if we get a string as a member it is the name of a member of conf_params
-    elif isinstance(conditionName, six.string_types):
+    elif isinstance(conditionName, str):
         conditionValue = _loadParamFromFile(config, "general", conditionName)
     else:
         # Any other type is invalid
@@ -367,18 +365,17 @@ def _loadParamFromFile(config, section, param_name):
             if value is None:
                 value = val
             if value != val:
-                raise ValueError('Parameter %(param_name)s deprecates '
-                                 'following parameters:\n%(deprecated)s.\n'
-                                 'Please either use parameter %(param_name)s '
+                raise ValueError(f'Parameter {param_name} deprecates '
+                                 f'following parameters:\n{deprecated}.\n'
+                                 f'Please either use parameter {param_name} '
                                  'or use same value for all deprecated '
-                                 'parameters.' % locals())
+                                 'parameters.')
         if deprecated and value is not None:
             controller.MESSAGES.append('Deprecated parameter has been used '
                                        'in answer file. Please use parameter '
-                                       '%(param_name)s next time. This '
+                                       f'{param_name} next time. This '
                                        'parameter deprecates following '
-                                       'parameters: %(deprecated)s.'
-                                       % locals())
+                                       f'parameters: {deprecated}.')
         if value is None:
             # Let's use default value if we have one
             value = getattr(param, 'DEFAULT_VALUE', None)
@@ -475,6 +472,7 @@ def _gettmpanswerfilepath():
         path = os.path.abspath(os.path.join(p, "tmp-packstack-answers-%s.txt" % ts))
         tmpfiles.append(path)
 
+    controller.MESSAGES.append(msg)
     return path
 
 
@@ -531,7 +529,7 @@ def _handleInteractiveParams():
     except Exception:
         logging.error(traceback.format_exc())
         raise
-    except:
+    except Exception:
         logging.error(traceback.format_exc())
         raise Exception(output_messages.ERR_EXP_HANDLE_PARAMS)
 
@@ -548,7 +546,7 @@ def _getConditionValue(matchMember):
     returnValue = False
     if isinstance(matchMember, types.FunctionType):
         returnValue = matchMember(controller.CONF)
-    elif isinstance(matchMember, six.string_types):
+    elif isinstance(matchMember, str):
         # we assume that if we get a string as a member it is the name
         # of a member of conf_params
         if matchMember not in controller.CONF:
@@ -570,16 +568,16 @@ def _displaySummary():
         for param in group.parameters.itervalues():
             if not param.USE_DEFAULT and param.CONF_NAME in controller.CONF:
                 cmdOption = param.CMD_OPTION
-                l = 30 - len(cmdOption)
+                length = 30 - len(cmdOption)
                 maskParam = param.MASK_INPUT
                 # Only call mask on a value if the param has MASK_INPUT set to True
                 if maskParam:
                     logging.info("%s: %s" % (cmdOption, mask(controller.CONF[param.CONF_NAME])))
-                    print("%s:" % (cmdOption) + " " * l + mask(controller.CONF[param.CONF_NAME]))
+                    print("%s:" % (cmdOption) + " " * length + mask(controller.CONF[param.CONF_NAME]))
                 else:
                     # Otherwise, log & display it as it is
                     logging.info("%s: %s" % (cmdOption, str(controller.CONF[param.CONF_NAME])))
-                    print("%s:" % (cmdOption) + " " * l + str(controller.CONF[param.CONF_NAME]))
+                    print("%s:" % (cmdOption) + " " * length + str(controller.CONF[param.CONF_NAME]))
     logging.info("*** User input summary ***")
     answer = _askYesNo(output_messages.INFO_USE_PARAMS)
     if not answer:
@@ -865,7 +863,6 @@ def initCmdLineParser():
         for param in group.parameters.itervalues():
             cmdOption = param.CMD_OPTION
             paramUsage = param.USAGE
-            optionsList = param.OPTION_LIST
             useDefault = param.USE_DEFAULT
 
             if not useDefault:
@@ -890,7 +887,6 @@ def printOptions():
         for param in group.parameters.itervalues():
             cmdOption = param.CONF_NAME
             paramUsage = param.USAGE
-            optionsList = param.OPTION_LIST or ""
             print("%s" % (("**%s**" % str(cmdOption)).ljust(30)))
             print("    %s" % paramUsage + "\n")
 
@@ -900,9 +896,9 @@ def plugin_compare(x, y):
     Used to sort the plugin file list
     according to the number at the end of the plugin module
     """
-    x_match = re.search(".+\_(\d\d\d)", x)
+    x_match = re.search(r'.+\_(\d\d\d)', x)
     x_cmp = x_match.group(1)
-    y_match = re.search(".+\_(\d\d\d)", y)
+    y_match = re.search(r'.+\_(\d\d\d)', y)
     y_cmp = y_match.group(1)
     return int(x_cmp) - int(y_cmp)
 
@@ -918,7 +914,7 @@ def loadPlugins():
     fileList = sorted(fileList, key=cmp_to_key(plugin_compare))
     for item in fileList:
         # Looking for files that end with ###.py, example: a_plugin_100.py
-        match = re.search("^(.+\_\d\d\d)\.py$", item)
+        match = re.search(r'^(.+\_\d\d\d)\.py$', item)
         if match:
             try:
                 moduleToLoad = match.group(1)
@@ -928,7 +924,7 @@ def loadPlugins():
                 globals()[moduleToLoad] = moduleobj
                 checkPlugin(moduleobj)
                 controller.addPlugin(moduleobj)
-            except:
+            except Exception:
                 logging.error("Failed to load plugin from file %s", item)
                 logging.error(traceback.format_exc())
                 raise Exception("Failed to load plugin from file %s" % item)
@@ -1005,8 +1001,7 @@ def main():
         logFile = initLogging(options.debug)
 
         # Parse parameters
-        runConfiguration = True
-        confFile = None
+        conf_file = None
 
         controller.CONF['DEFAULT_EXEC_TIMEOUT'] = options.timeout
         controller.CONF['DRY_RUN'] = options.dry_run
@@ -1046,15 +1041,16 @@ def main():
                 # If using an answer file, setting a default password
                 # does not really make sense
                 if getattr(options, 'default_password', None):
-                        msg = ('Please do not set --default-password '
-                               'when specifying an answer file.')
-                        raise FlagValidationError(msg)
-                confFile = os.path.expanduser(options.answer_file)
-                if not os.path.exists(confFile):
-                    raise Exception(output_messages.ERR_NO_ANSWER_FILE % confFile)
+                    msg = ('Please do not set --default-password '
+                           'when specifying an answer file.')
+                    raise FlagValidationError(msg)
+                conf_file = os.path.expanduser(options.answer_file)
+                if not os.path.exists(conf_file):
+                    raise Exception(output_messages.ERR_NO_ANSWER_FILE %
+                                    conf_file)
             else:
                 _set_command_line_values(options)
-            _main(options, confFile, logFile)
+            _main(options, conf_file, logFile)
 
     except FlagValidationError as ex:
         optParser.error(str(ex))
diff --git a/packstack/installer/setup_controller.py b/packstack/installer/setup_controller.py
index 6fcbbb0fa..6fd895ead 100644
--- a/packstack/installer/setup_controller.py
+++ b/packstack/installer/setup_controller.py
@@ -44,7 +44,7 @@ def __new__(self, *args, **kwargs):
         instance from a class which inherit Controller.
         did not use isinstance because inheritence makes it behave erratically.
         """
-        if self != type(self.__single):  # flake8: noqa
+        if self != type(self.__single):  # noqa: E721
             self.__single = object.__new__(self, *args, **kwargs)
         return self.__single
 
diff --git a/packstack/installer/utils/__init__.py b/packstack/installer/utils/__init__.py
index 76f4db297..80ee87de5 100644
--- a/packstack/installer/utils/__init__.py
+++ b/packstack/installer/utils/__init__.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -14,19 +13,19 @@
 
 from .datastructures import SortedDict
 from .decorators import retry
+from .network import device_from_ip
+from .network import force_ip
 from .network import get_localhost_ip
 from .network import host2ip
-from .network import force_ip
-from .network import device_from_ip
 from .shell import execute
 from .shell import ScriptRunner
-from .shortcuts import host_iter
-from .shortcuts import hosts
 from .shortcuts import get_current_user
 from .shortcuts import get_current_username
+from .shortcuts import host_iter
+from .shortcuts import hosts
 from .shortcuts import split_hosts
-from .strings import COLORS
 from .strings import color_text
+from .strings import COLORS
 from .strings import mask_string
 from .strings import state_format
 from .strings import state_message
@@ -34,8 +33,8 @@
 
 __all__ = ('SortedDict',
            'retry',
-           'get_localhost_ip', 'host2ip', 'force_ip', 'device_from_ip',
+           'device_from_ip', 'force_ip', 'get_localhost_ip', 'host2ip',
            'ScriptRunner', 'execute',
-           'host_iter', 'hosts', 'get_current_user', 'get_current_username',
-           'split_hosts', 'COLORS', 'color_text', 'mask_string',
+           'get_current_user', 'get_current_username', 'host_iter', 'hosts',
+           'split_hosts', 'color_text', 'COLORS', 'mask_string',
            'state_format', 'state_message')
diff --git a/packstack/installer/utils/datastructures.py b/packstack/installer/utils/datastructures.py
index b9db4a309..e392adf12 100644
--- a/packstack/installer/utils/datastructures.py
+++ b/packstack/installer/utils/datastructures.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/installer/utils/decorators.py b/packstack/installer/utils/decorators.py
index 7dcf7c9b1..bb18f0077 100644
--- a/packstack/installer/utils/decorators.py
+++ b/packstack/installer/utils/decorators.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/installer/utils/network.py b/packstack/installer/utils/network.py
index bf637dbb9..ecaee413e 100644
--- a/packstack/installer/utils/network.py
+++ b/packstack/installer/utils/network.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -12,9 +11,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import logging
 import netifaces
 import socket
-import logging
+
 from ..exceptions import NetworkError
 from .shell import ScriptRunner
 
@@ -119,7 +119,7 @@ def is_ipv4(host):
 
 
 def force_ip(host, allow_localhost=False):
-    if not(is_ipv6(host) or is_ipv4(host)):
+    if not (is_ipv6(host) or is_ipv4(host)):
         host = host2ip(host, allow_localhost=allow_localhost)
     return host
 
diff --git a/packstack/installer/utils/shell.py b/packstack/installer/utils/shell.py
index 4a32b99e3..ab09c76c0 100644
--- a/packstack/installer/utils/shell.py
+++ b/packstack/installer/utils/shell.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -12,10 +11,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import re
-import os
-import six
 import logging
+import os
+import re
+import shlex
 import subprocess
 
 from ..exceptions import ExecuteRuntimeError
@@ -38,9 +37,8 @@ def execute(cmd, workdir=None, can_fail=True, mask_list=None,
     mask_list = mask_list or []
     repl_list = [("'", "'\\''")]
 
-    if not isinstance(cmd, six.string_types):
-        import pipes
-        masked = ' '.join((pipes.quote(i) for i in cmd))
+    if not isinstance(cmd, str):
+        masked = ' '.join((shlex.quote(i) for i in cmd))
     else:
         masked = cmd
 
@@ -55,9 +53,9 @@ def execute(cmd, workdir=None, can_fail=True, mask_list=None,
                             env=environ)
     out, err = proc.communicate()
 
-    if not isinstance(out, six.text_type):
+    if not isinstance(out, str):
         out = out.decode('utf-8')
-    if not isinstance(err, six.text_type):
+    if not isinstance(err, str):
         err = err.decode('utf-8')
     masked_out = mask_string(out, mask_list, repl_list)
     masked_err = mask_string(err, mask_list, repl_list)
@@ -115,9 +113,9 @@ def execute(self, can_fail=True, mask_list=None, log=True):
         script = "function t(){ exit $? ; } \n trap t ERR \n %s" % script
 
         out, err = obj.communicate(script.encode('utf-8'))
-        if not isinstance(out, six.text_type):
+        if not isinstance(out, str):
             out = out.decode('utf-8')
-        if not isinstance(err, six.text_type):
+        if not isinstance(err, str):
             err = err.decode('utf-8')
         masked_out = mask_string(out, mask_list, repl_list)
         masked_err = mask_string(err, mask_list, repl_list)
diff --git a/packstack/installer/utils/shortcuts.py b/packstack/installer/utils/shortcuts.py
index c5a8d98b8..3b1e192a0 100644
--- a/packstack/installer/utils/shortcuts.py
+++ b/packstack/installer/utils/shortcuts.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -15,11 +14,10 @@
 import grp
 import os
 import pwd
-import six
 
 
 def host_iter(config):
-    for key, value in six.iteritems(config):
+    for key, value in config.items():
         if key.endswith("_HOST"):
             host = value.split('/')[0]
             if host:
diff --git a/packstack/installer/utils/strings.py b/packstack/installer/utils/strings.py
index 12b876d5d..2ee1cb9e6 100644
--- a/packstack/installer/utils/strings.py
+++ b/packstack/installer/utils/strings.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -14,7 +13,6 @@
 
 from functools import cmp_to_key
 import re
-import six
 
 
 STR_MASK = '*' * 8
@@ -45,7 +43,7 @@ def mask_string(unmasked, mask_list=None, replace_list=None):
     mask_list = mask_list or []
     replace_list = replace_list or []
 
-    if isinstance(unmasked, six.text_type):
+    if isinstance(unmasked, str):
         masked = unmasked.encode('utf-8')
     else:
         masked = unmasked
diff --git a/packstack/installer/validators.py b/packstack/installer/validators.py
index 3eabe53db..0f9e30005 100644
--- a/packstack/installer/validators.py
+++ b/packstack/installer/validators.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -16,10 +15,10 @@
 Contains all core validation functions.
 """
 
+import logging
 import os
 import re
 import socket
-import logging
 
 from . import utils
 
diff --git a/packstack/modules/common.py b/packstack/modules/common.py
index a608a4045..2f7dd8416 100644
--- a/packstack/modules/common.py
+++ b/packstack/modules/common.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/modules/documentation.py b/packstack/modules/documentation.py
index f04c067e3..e2ba026c3 100644
--- a/packstack/modules/documentation.py
+++ b/packstack/modules/documentation.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 #
 # Copyright (C) 2015 Red Hat, Inc.
 #
diff --git a/packstack/modules/ospluginutils.py b/packstack/modules/ospluginutils.py
index 27072d649..0b59483bb 100644
--- a/packstack/modules/ospluginutils.py
+++ b/packstack/modules/ospluginutils.py
@@ -11,11 +11,16 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import datetime
 import os
 import yaml
 
-from OpenSSL import crypto
-from time import time
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives import serialization
+from cryptography import x509
+from cryptography.x509 import oid
+
 from packstack.installer import basedefs
 from packstack.installer import utils
 from packstack.installer.setup_controller import Controller
@@ -66,6 +71,8 @@ def writeManifests(self):
             fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
             with os.fdopen(fd, 'w') as fp:
                 fp.write(data)
+
+
 manifestfiles = ManifestFiles()
 
 
@@ -91,64 +98,97 @@ def generateHieraDataFile():
 
 def generate_ssl_cert(config, host, service, ssl_key_file, ssl_cert_file):
     """
-    Wrapper on top of openssl
+    Generate SSL certificate
     """
     # We have to check whether the certificate already exists
     cert_dir = os.path.join(config['CONFIG_SSL_CERT_DIR'], 'certs')
     local_cert_name = host + os.path.basename(ssl_cert_file)
     local_cert_path = os.path.join(cert_dir, local_cert_name)
-    if not os.path.exists(local_cert_path):
-        ca_file = open(config['CONFIG_SSL_CACERT_FILE'], 'rt').read()
-        ca_key_file = open(config['CONFIG_SSL_CACERT_KEY_FILE'], 'rt').read()
-        ca_key = crypto.load_privatekey(crypto.FILETYPE_PEM, ca_key_file)
-        ca = crypto.load_certificate(crypto.FILETYPE_PEM, ca_file)
-
-        k = crypto.PKey()
-        k.generate_key(crypto.TYPE_RSA, 4096)
-        mail = config['CONFIG_SSL_CERT_SUBJECT_MAIL']
-        hostinfo = config['HOST_DETAILS'][host]
-        fqdn = hostinfo['fqdn']
-        cert = crypto.X509()
-        subject = cert.get_subject()
-        subject.C = config['CONFIG_SSL_CERT_SUBJECT_C']
-        subject.ST = config['CONFIG_SSL_CERT_SUBJECT_ST']
-        subject.L = config['CONFIG_SSL_CERT_SUBJECT_L']
-        subject.O = config['CONFIG_SSL_CERT_SUBJECT_O']
-        subject.OU = config['CONFIG_SSL_CERT_SUBJECT_OU']
-        cn = "%s/%s" % (service, fqdn)
-        # if subject.CN is more than 64 chars long, cert creation will fail
-        if len(cn) > 64:
-            cn = cn[0:63]
-        subject.CN = cn
-        subject.emailAddress = mail
-
-        cert.add_extensions([
-            crypto.X509Extension(
-                "keyUsage".encode('ascii'),
-                False,
-                "nonRepudiation,digitalSignature,keyEncipherment".encode('ascii')),
-            crypto.X509Extension(
-                "extendedKeyUsage".encode('ascii'),
-                False,
-                "clientAuth,serverAuth".encode('ascii')),
-        ])
-
-        cert.gmtime_adj_notBefore(0)
-        cert.gmtime_adj_notAfter(315360000)
-        cert.set_issuer(ca.get_subject())
-        cert.set_pubkey(k)
-        serial = int(time())
-        cert.set_serial_number(serial)
-        cert.sign(ca_key, 'sha1')
-
-        final_cert = crypto.dump_certificate(crypto.FILETYPE_PEM, cert)
-        final_key = crypto.dump_privatekey(crypto.FILETYPE_PEM, k)
-        deliver_ssl_file(ca_file, config['CONFIG_SSL_CACERT'], host)
-        deliver_ssl_file(final_cert.decode(), ssl_cert_file, host)
-        deliver_ssl_file(final_key.decode(), ssl_key_file, host)
-
-        with open(local_cert_path, 'w') as f:
-            f.write(final_cert.decode())
+    if os.path.exists(local_cert_path):
+        return
+
+    with open(config['CONFIG_SSL_CACERT_FILE'], 'rb') as cacert_file:
+        ca_cert = x509.load_pem_x509_certificate(cacert_file.read())
+
+    with open(config['CONFIG_SSL_CACERT_KEY_FILE'], 'rb') as ca_key_file:
+        ca_key = serialization.load_pem_private_key(ca_key_file.read(),
+                                                    password=None)
+
+    # create a key pair
+    key = rsa.generate_private_key(
+        public_exponent=65537,
+        key_size=4096,
+    )
+
+    hostinfo = config['HOST_DETAILS'][host]
+    fqdn = hostinfo['fqdn']
+    cn = "%s/%s" % (service, fqdn)
+    # if subject.CN is more than 64 chars long, cert creation will fail
+    if len(cn) > 64:
+        cn = cn[0:63]
+
+    subject = x509.Name([
+        x509.NameAttribute(oid.NameOID.COUNTRY_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_C']),
+        x509.NameAttribute(oid.NameOID.STATE_OR_PROVINCE_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_ST']),
+        x509.NameAttribute(oid.NameOID.LOCALITY_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_L']),
+        x509.NameAttribute(oid.NameOID. ORGANIZATION_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_O']),
+        x509.NameAttribute(oid.NameOID. ORGANIZATIONAL_UNIT_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_OU']),
+        x509.NameAttribute(oid.NameOID.COMMON_NAME, cn),
+        x509.NameAttribute(oid.NameOID.EMAIL_ADDRESS,
+                           config['CONFIG_SSL_CERT_SUBJECT_MAIL']),
+    ])
+    cert = x509.CertificateBuilder().subject_name(
+        subject
+    ).issuer_name(
+        ca_cert.subject
+    ).public_key(
+        key.public_key()
+    ).serial_number(
+        x509.random_serial_number()
+    ).not_valid_before(
+        datetime.datetime.now(datetime.timezone.utc)
+    ).not_valid_after(
+        datetime.datetime.now(datetime.timezone.utc) +
+        datetime.timedelta(days=3650)
+    ).add_extension(
+        x509.KeyUsage(
+            digital_signature=True,
+            content_commitment=True,
+            key_encipherment=True,
+            data_encipherment=False,
+            key_agreement=False,
+            key_cert_sign=False,
+            crl_sign=False,
+            encipher_only=False,
+            decipher_only=False,
+        ),
+        critical=False,
+    ).add_extension(
+        x509.ExtendedKeyUsage([
+            x509.ExtendedKeyUsageOID.CLIENT_AUTH,
+            x509.ExtendedKeyUsageOID.SERVER_AUTH,
+        ]),
+        critical=False,
+    ).sign(ca_key, hashes.SHA256())
+
+    final_cacert = ca_cert.public_bytes(serialization.Encoding.PEM)
+    final_cert = cert.public_bytes(serialization.Encoding.PEM)
+    final_key = key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.TraditionalOpenSSL,
+        encryption_algorithm=serialization.NoEncryption()
+    )
+    deliver_ssl_file(final_cacert.decode(), config['CONFIG_SSL_CACERT'], host)
+    deliver_ssl_file(final_cert.decode(), ssl_cert_file, host)
+    deliver_ssl_file(final_key.decode(), ssl_key_file, host)
+
+    with open(local_cert_path, 'wb') as f:
+        f.write(final_cert)
 
 
 def deliver_ssl_file(content, path, host):
diff --git a/packstack/modules/puppet.py b/packstack/modules/puppet.py
index bbc76137d..83b38a70c 100644
--- a/packstack/modules/puppet.py
+++ b/packstack/modules/puppet.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -19,18 +18,18 @@
 from packstack.installer.exceptions import PuppetError
 
 
-# TODO: Fill logger name when logging system will be refactored
+# TODO(tbd): Fill logger name when logging system will be refactored
 logger = logging.getLogger()
 
-re_color = re.compile('\x1b.*?\d\dm')
+re_color = re.compile(r'\x1b.*?\d\dm')
 re_error = re.compile(
-    'err:|Syntax error at|^Duplicate definition:|^Invalid tag|'
-    '^No matching value for selector param|^Parameter name failed:|Error:|'
-    '^Invalid parameter|^Duplicate declaration:|^Could not find resource|'
-    '^Could not parse for|^/usr/bin/puppet:\d+: .+|.+\(LoadError\)|'
-    '^Could not autoload|'
-    '^\/usr\/bin\/env\: jruby\: No such file or directory|'
-    'failed to execute puppet'
+    r'err:|Syntax error at|^Duplicate definition:|^Invalid tag|'
+    r'^No matching value for selector param|^Parameter name failed:|Error:|'
+    r'^Invalid parameter|^Duplicate declaration:|^Could not find resource|'
+    r'^Could not parse for|^/usr/bin/puppet:\d+: .+|.+\(LoadError\)|'
+    r'^Could not autoload|'
+    r'^\/usr\/bin\/env\: jruby\: No such file or directory|'
+    r'failed to execute puppet'
 )
 re_ignore = re.compile(
     # Puppet preloads a provider using the mysql command before it is installed
@@ -38,30 +37,30 @@
     # Puppet preloads a database_grant provider which fails if /root/.my.cnf
     # is missing, this is ok because it will be retried later if needed
     'Could not prefetch database_grant provider.*?\\.my\\.cnf|'
-    # Swift Puppet module tries to install swift-plugin-s3, there is no such
-    # package on RHEL, fixed in the upstream puppet module
-    'yum.*?install swift-plugin-s3|'
     # facter gives a weird NM error when it's disabled, due to
     # https://tickets.puppetlabs.com/browse/FACT-697
-    'NetworkManager is not running'
+    'NetworkManager is not running|'
+    # facter logs Error even though the repository is set to be skipped
+    # if unavailable
+    'Failed to download metadata for repo'
 )
-re_notice = re.compile(r"notice: .*Notify\[packstack_info\]"
-                       "\/message: defined \'message\' as "
-                       "\'(?P<message>.*)\'")
+re_notice = re.compile(r'notice: .*Notify\[packstack_info\]'
+                       r'\/message: defined \'message\' as '
+                       r'\'(?P<message>.*)\'')
 
 surrogates = [
     # Value in /etc/sysctl.conf cannot be changed
-    ('Sysctl::Value\[.*\]\/Sysctl\[(?P<arg1>.*)\].*Field \'val\' is required',
+    (r'Sysctl::Value\[.*\]\/Sysctl\[(?P<arg1>.*)\].*Field \'val\' is required',
         'Cannot change value of %(arg1)s in /etc/sysctl.conf'),
     # Package is not found in yum repos
-    ('Package\[.*\]\/ensure.*yum.*install (?P<arg1>.*)\'.*Nothing to do',
+    (r'Package\[.*\]\/ensure.*yum.*install (?P<arg1>.*)\'.*Nothing to do',
         'Package %(arg1)s has not been found in enabled Yum repos.'),
-    ('Execution of \'.*yum.*install (?P<arg1>.*)\'.*Nothing to do',
+    (r'Execution of \'.*yum.*install (?P<arg1>.*)\'.*Nothing to do',
         'Package %(arg1)s has not been found in enabled Yum repos.'),
     # Packstack does not cooperate with jruby
-    ('jruby', 'Your Puppet installation uses jruby instead of ruby. Package '
-              'jruby does not cooperate with Packstack well. You will have to '
-              'fix this manually.'),
+    (r'jruby', 'Your Puppet installation uses jruby instead of ruby. Package '
+               'jruby does not cooperate with Packstack well. You will have to '
+               'fix this manually.'),
 ]
 
 
diff --git a/packstack/plugins/amqp_002.py b/packstack/plugins/amqp_002.py
index b3e197ee9..21e2d8d79 100644
--- a/packstack/plugins/amqp_002.py
+++ b/packstack/plugins/amqp_002.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -91,29 +90,6 @@ def initConfig(controller):
              "POST_CONDITION_MATCH": True}
     controller.addGroup(group, params)
 
-    params = [
-        {"CMD_OPTION": "amqp-nss-certdb-pw",
-         "PROMPT": "Enter the password for NSS certificate database",
-         "OPTION_LIST": [],
-         "VALIDATORS": [validators.validate_not_empty],
-         "DEFAULT_VALUE": "PW_PLACEHOLDER",
-         "PROCESSORS": [processors.process_password],
-         "MASK_INPUT": True,
-         "LOOSE_VALIDATION": True,
-         "CONF_NAME": "CONFIG_AMQP_NSS_CERTDB_PW",
-         "USE_DEFAULT": False,
-         "NEED_CONFIRM": True,
-         "CONDITION": False},
-    ]
-    update_params_usage(basedefs.PACKSTACK_DOC, params, sectioned=False)
-    group = {"GROUP_NAME": "AMQPSSL",
-             "DESCRIPTION": "AMQP Config SSL parameters",
-             "PRE_CONDITION": "CONFIG_AMQP_ENABLE_SSL",
-             "PRE_CONDITION_MATCH": "y",
-             "POST_CONDITION": False,
-             "POST_CONDITION_MATCH": True}
-    controller.addGroup(group, params)
-
     params = [
         {"CMD_OPTION": "amqp-auth-user",
          "PROMPT": "Enter the user for amqp authentication",
@@ -161,7 +137,6 @@ def initSequences(controller):
 # ------------------------ step functions -------------------------
 
 def create_manifest(config, messages):
-    server = utils.ScriptRunner(config['CONFIG_AMQP_HOST'])
     if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
         config['CONFIG_AMQP_SSL_ENABLED'] = True
         config['CONFIG_AMQP_PROTOCOL'] = 'ssl'
@@ -170,9 +145,7 @@ def create_manifest(config, messages):
         service = 'AMQP'
         ssl_key_file = '/etc/pki/tls/private/ssl_amqp.key'
         ssl_cert_file = '/etc/pki/tls/certs/ssl_amqp.crt'
-        cacert = config['CONFIG_AMQP_SSL_CACERT_FILE'] = (
-            config['CONFIG_SSL_CACERT']
-        )
+        config['CONFIG_AMQP_SSL_CACERT_FILE'] = config['CONFIG_SSL_CACERT']
         generate_ssl_cert(config, amqp_host, service, ssl_key_file,
                           ssl_cert_file)
     else:
diff --git a/packstack/plugins/aodh_810.py b/packstack/plugins/aodh_810.py
index f29ae993f..1445501dc 100644
--- a/packstack/plugins/aodh_810.py
+++ b/packstack/plugins/aodh_810.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/plugins/ceilometer_800.py b/packstack/plugins/ceilometer_800.py
index 6bad638ab..6ae5c4336 100644
--- a/packstack/plugins/ceilometer_800.py
+++ b/packstack/plugins/ceilometer_800.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -60,18 +59,6 @@ def initConfig(controller):
              "NEED_CONFIRM": True,
              "CONDITION": False},
 
-            {"CMD_OPTION": "ceilometer-service-name",
-             "PROMPT": "Enter the Ceilometer service name.",
-             "OPTION_LIST": ['ceilometer', 'httpd'],
-             "VALIDATORS": [validators.validate_options],
-             "DEFAULT_VALUE": "httpd",
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME": 'CONFIG_CEILOMETER_SERVICE_NAME',
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
             {"CONF_NAME": "CONFIG_CEILOMETER_COORDINATION_BACKEND",
              "CMD_OPTION": "ceilometer-coordination-backend",
              "PROMPT": "Enter the coordination driver",
@@ -171,13 +158,7 @@ def create_manifest(config, messages):
                           ssl_cert_file)
 
     fw_details = dict()
-    key = "ceilometer_api"
-    fw_details.setdefault(key, {})
-    fw_details[key]['host'] = "ALL"
-    fw_details[key]['service_name'] = "ceilometer-api"
-    fw_details[key]['chain'] = "INPUT"
-    fw_details[key]['ports'] = ['8777']
-    fw_details[key]['proto'] = "tcp"
+    # NOTE(tkajinam): ceilometer has no API service now
     config['FIREWALL_CEILOMETER_RULES'] = fw_details
 
 
diff --git a/packstack/plugins/cinder_250.py b/packstack/plugins/cinder_250.py
index 16aa2735c..c04c84646 100644
--- a/packstack/plugins/cinder_250.py
+++ b/packstack/plugins/cinder_250.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -85,8 +84,7 @@ def initConfig(controller):
 
             {"CMD_OPTION": "cinder-backend",
              "PROMPT": "Enter the Cinder backend to be configured",
-             "OPTION_LIST": ["lvm", "gluster", "nfs", "vmdk", "netapp",
-                             "solidfire"],
+             "OPTION_LIST": ["lvm", "nfs", "netapp", "solidfire"],
              "VALIDATORS": [validators.validate_options],
              "DEFAULT_VALUE": "lvm",
              "MASK_INPUT": False,
@@ -140,23 +138,6 @@ def initConfig(controller):
              "CONDITION": False},
         ],
 
-        "CINDERGLUSTERMOUNTS": [
-            {"CMD_OPTION": "cinder-gluster-mounts",
-             "PROMPT": ("Enter a single or comma separated list of gluster "
-                        "volume shares to use with Cinder"),
-             "OPTION_LIST": ["^([\d]{1,3}\.){3}[\d]{1,3}:/.*",
-                             "^[a-zA-Z0-9][\-\.\w]*:/.*"],
-             "VALIDATORS": [validators.validate_multi_regexp],
-             "PROCESSORS": [],
-             "DEFAULT_VALUE": "",
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME": "CONFIG_CINDER_GLUSTER_MOUNTS",
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-        ],
-
         "CINDERNFSMOUNTS": [
             {"CMD_OPTION": "cinder-nfs-mounts",
              "PROMPT": ("Enter a single or comma seprated list of NFS exports "
@@ -528,13 +509,6 @@ def initConfig(controller):
          "POST_CONDITION": False,
          "POST_CONDITION_MATCH": True},
 
-        {"GROUP_NAME": "CINDERGLUSTERMOUNTS",
-         "DESCRIPTION": "Cinder gluster Config parameters",
-         "PRE_CONDITION": check_gluster_options,
-         "PRE_CONDITION_MATCH": True,
-         "POST_CONDITION": False,
-         "POST_CONDITION_MATCH": True},
-
         {"GROUP_NAME": "CINDERNFSMOUNTS",
          "DESCRIPTION": "Cinder NFS Config parameters",
          "PRE_CONDITION": check_nfs_options,
@@ -613,7 +587,6 @@ def initSequences(controller):
     )
 
     for key in ('CONFIG_CINDER_NETAPP_VOLUME_LIST',
-                'CONFIG_CINDER_GLUSTER_MOUNTS',
                 'CONFIG_CINDER_NFS_MOUNTS'):
         if key in config:
             config[key] = [i.strip() for i in config[key].split(',') if i]
@@ -644,11 +617,6 @@ def check_lvm_vg_options(config):
             'lvm' in config['CONFIG_CINDER_BACKEND'])
 
 
-def check_gluster_options(config):
-    return (config['CONFIG_CINDER_INSTALL'] == 'y' and
-            'gluster' in config['CONFIG_CINDER_BACKEND'])
-
-
 def check_nfs_options(config):
     return (config['CONFIG_CINDER_INSTALL'] == 'y' and
             'nfs' in config['CONFIG_CINDER_BACKEND'])
@@ -679,15 +647,15 @@ def check_netapp_7modeiscsi_options(config):
 
 def check_netapp_7mode_fc_options(config):
     return (check_netapp_options(config) and
-            config['CONFIG_CINDER_NETAPP_STORAGE_FAMILY'] == "ontap_7mode"
-            and config['CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'] == "fc")
+            config['CONFIG_CINDER_NETAPP_STORAGE_FAMILY'] == "ontap_7mode" and
+            config['CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'] == "fc")
 
 
 def check_netapp_vserver_options(config):
-    return (check_netapp_options(config) and
-            config['CONFIG_CINDER_NETAPP_STORAGE_FAMILY'] == "ontap_cluster"
-            and config['CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'] in
-            ['nfs', 'iscsi'])
+    return (
+        check_netapp_options(config) and
+        config['CONFIG_CINDER_NETAPP_STORAGE_FAMILY'] == "ontap_cluster" and
+        config['CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'] in ['nfs', 'iscsi'])
 
 
 def check_netapp_eseries_options(config):
@@ -719,7 +687,7 @@ def check_cinder_vg(config, messages):
         if not have_cinders_volume:
             raise exceptions.MissingRequirements("The cinder server should "
                                                  "contain a volume group")
-    match = re.match('^(?P<size>\d+)G$',
+    match = re.match(r'^(?P<size>\d+)G$',
                      config['CONFIG_CINDER_VOLUMES_SIZE'].strip())
     if not match:
         msg = 'Invalid Cinder volumes VG size.'
diff --git a/packstack/plugins/dashboard_500.py b/packstack/plugins/dashboard_500.py
index b42c4844d..ad9dff1f1 100644
--- a/packstack/plugins/dashboard_500.py
+++ b/packstack/plugins/dashboard_500.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -142,7 +141,6 @@ def create_manifest(config, messages):
 
     proto = "http"
     config["CONFIG_HORIZON_PORT"] = 80
-    sslmanifestdata = ''
     if config["CONFIG_HORIZON_SSL"] == 'y':
         config["CONFIG_HORIZON_PORT"] = 443
         proto = "https"
@@ -165,9 +163,9 @@ def create_manifest(config, messages):
                 raise exceptions.ParamValidationError(
                     "The file %s doesn't exist" % ssl_chain_file)
 
+            final_cacert = open(ssl_chain_file, 'rt').read()
             final_cert = open(ssl_cert_file, 'rt').read()
             final_key = open(ssl_key_file, 'rt').read()
-            final_cacert = open(ssl_chain_file, 'rt').read()
             host = config['CONFIG_CONTROLLER_HOST']
             deliver_ssl_file(final_cacert, ssl_chain_file, host)
             deliver_ssl_file(final_cert, ssl_cert_file, host)
@@ -192,13 +190,9 @@ def create_manifest(config, messages):
                 "/etc/httpd/conf.d/ssl.conf on %s to use a CA signed cert."
                 % (utils.COLORS['red'], utils.COLORS['nocolor'], horizon_host))
 
-    config["CONFIG_HORIZON_NEUTRON_LB"] = False
-    config["CONFIG_HORIZON_NEUTRON_FW"] = False
     config["CONFIG_HORIZON_NEUTRON_VPN"] = False
 
     if config['CONFIG_NEUTRON_INSTALL'] == 'y':
-        if config["CONFIG_NEUTRON_FWAAS"] == 'y':
-            config["CONFIG_HORIZON_NEUTRON_FW"] = True
         if config["CONFIG_NEUTRON_VPNAAS"] == 'y':
             config["CONFIG_HORIZON_NEUTRON_VPN"] = True
 
diff --git a/packstack/plugins/glance_200.py b/packstack/plugins/glance_200.py
index 2a9c69a05..c79eecc78 100644
--- a/packstack/plugins/glance_200.py
+++ b/packstack/plugins/glance_200.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/plugins/gnocchi_790.py b/packstack/plugins/gnocchi_790.py
index 56c433dc5..8defe884f 100644
--- a/packstack/plugins/gnocchi_790.py
+++ b/packstack/plugins/gnocchi_790.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/plugins/heat_650.py b/packstack/plugins/heat_650.py
index c05c07e16..f500d58c0 100644
--- a/packstack/plugins/heat_650.py
+++ b/packstack/plugins/heat_650.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/plugins/ironic_275.py b/packstack/plugins/ironic_275.py
index 2d970e033..911f4a8b7 100644
--- a/packstack/plugins/ironic_275.py
+++ b/packstack/plugins/ironic_275.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/plugins/keystone_100.py b/packstack/plugins/keystone_100.py
index 861fb8754..1b5cd2e27 100644
--- a/packstack/plugins/keystone_100.py
+++ b/packstack/plugins/keystone_100.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -125,7 +124,7 @@ def initConfig(controller):
 
             {"CMD_OPTION": "keystone-api-version",
              "PROMPT": "Enter the Keystone API version string.",
-             "OPTION_LIST": ['v2.0', 'v3'],
+             "OPTION_LIST": ['v3'],
              "VALIDATORS": [validators.validate_options],
              "DEFAULT_VALUE": 'v3',
              "MASK_INPUT": False,
@@ -384,48 +383,6 @@ def initConfig(controller):
              "NEED_CONFIRM": False,
              "CONDITION": False},
 
-            {"CMD_OPTION": "keystone-ldap-user-allow-create",
-             "PROMPT": (
-                 "Do you want to allow user create through Keystone (n or y)."
-             ),
-             "OPTION_LIST": ['n', 'y'],
-             "VALIDATORS": [validators.validate_options],
-             "DEFAULT_VALUE": 'n',
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_ALLOW_CREATE',
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
-            {"CMD_OPTION": "keystone-ldap-user-allow-update",
-             "PROMPT": (
-                 "Do you want to allow user update through Keystone (n or y)."
-             ),
-             "OPTION_LIST": ['n', 'y'],
-             "VALIDATORS": [validators.validate_options],
-             "DEFAULT_VALUE": 'n',
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_ALLOW_UPDATE',
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
-            {"CMD_OPTION": "keystone-ldap-user-allow-delete",
-             "PROMPT": (
-                 "Do you want to allow user delete through Keystone (n or y)."
-             ),
-             "OPTION_LIST": ['n', 'y'],
-             "VALIDATORS": [validators.validate_options],
-             "DEFAULT_VALUE": 'n',
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_ALLOW_DELETE',
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
             {"CMD_OPTION": "keystone-ldap-user-pass-attribute",
              "PROMPT": "Enter the Keystone LDAP user password attribute.",
              "OPTION_LIST": [],
@@ -564,48 +521,6 @@ def initConfig(controller):
              "NEED_CONFIRM": False,
              "CONDITION": False},
 
-            {"CMD_OPTION": "keystone-ldap-group-allow-create",
-             "PROMPT": (
-                 "Do you want to allow group create through Keystone (n or y)."
-             ),
-             "OPTION_LIST": ['n', 'y'],
-             "VALIDATORS": [validators.validate_options],
-             "DEFAULT_VALUE": 'n',
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_CREATE',
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
-            {"CMD_OPTION": "keystone-ldap-group-allow-update",
-             "PROMPT": (
-                 "Do you want to allow group update through Keystone (n or y)."
-             ),
-             "OPTION_LIST": ['n', 'y'],
-             "VALIDATORS": [validators.validate_options],
-             "DEFAULT_VALUE": 'n',
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_UPDATE',
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
-            {"CMD_OPTION": "keystone-ldap-group-allow-delete",
-             "PROMPT": (
-                 "Do you want to allow group delete through Keystone (n or y)."
-             ),
-             "OPTION_LIST": ['n', 'y'],
-             "VALIDATORS": [validators.validate_options],
-             "DEFAULT_VALUE": 'n',
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_DELETE',
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
             {"CMD_OPTION": "keystone-ldap-group-additional-attribute-mapping",
              "PROMPT": (
                  "Enter the comma separated Keystone LDAP group additional "
@@ -723,12 +638,6 @@ def munge_ldap_config_params(config, messages):
     def is_bool(keyname):
         return keyname in (
             'CONFIG_KEYSTONE_LDAP_USER_ENABLED_INVERT',
-            'CONFIG_KEYSTONE_LDAP_USER_ALLOW_CREATE',
-            'CONFIG_KEYSTONE_LDAP_USER_ALLOW_UPDATE',
-            'CONFIG_KEYSTONE_LDAP_USER_ALLOW_DELETE',
-            'CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_CREATE',
-            'CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_UPDATE',
-            'CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_DELETE',
             'CONFIG_KEYSTONE_LDAP_USE_TLS'
         )
 
diff --git a/packstack/plugins/magnum_920.py b/packstack/plugins/magnum_920.py
old mode 100755
new mode 100644
index 5f5c90e45..bcd21a9c7
--- a/packstack/plugins/magnum_920.py
+++ b/packstack/plugins/magnum_920.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/plugins/manila_355.py b/packstack/plugins/manila_355.py
index 910f3a8d3..557b79e3a 100644
--- a/packstack/plugins/manila_355.py
+++ b/packstack/plugins/manila_355.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -260,8 +259,9 @@ def initConfig(controller):
              "PROMPT": ("Enter a service image location"),
              "OPTION_LIST": [],
              "VALIDATORS": [validators.validate_not_empty],
-             "DEFAULT_VALUE": 'https://www.dropbox.com/s/vi5oeh10q1qkckh/'
-                              'ubuntu_1204_nfs_cifs.qcow2',
+             "DEFAULT_VALUE": ('https://tarballs.opendev.org/openstack/'
+                               'manila-image-elements/images/'
+                               'manila-service-image-master.qcow2'),
              "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
              "CONF_NAME": "CONFIG_MANILA_SERVICE_IMAGE_LOCATION",
@@ -297,7 +297,7 @@ def initConfig(controller):
         "MANILANETWORK": [
             {"CMD_OPTION": "manila-network-type",
              "PROMPT": ("Enter a network type"),
-             "OPTION_LIST": ['neutron', 'nova-network', 'standalone'],
+             "OPTION_LIST": ['neutron', 'standalone'],
              "VALIDATORS": [validators.validate_options],
              "DEFAULT_VALUE": "neutron",
              "MASK_INPUT": False,
diff --git a/packstack/plugins/mariadb_003.py b/packstack/plugins/mariadb_003.py
index 24e446078..de0e0a6fa 100644
--- a/packstack/plugins/mariadb_003.py
+++ b/packstack/plugins/mariadb_003.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/plugins/neutron_350.py b/packstack/plugins/neutron_350.py
index 34dceb034..d1ab1d760 100644
--- a/packstack/plugins/neutron_350.py
+++ b/packstack/plugins/neutron_350.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -16,7 +15,7 @@
 Installs and configures Neutron
 """
 
-import re
+import netifaces
 from packstack.installer import basedefs
 from packstack.installer import utils
 from packstack.installer import validators
@@ -102,18 +101,6 @@ def initConfig(controller):
              "NEED_CONFIRM": False,
              "CONDITION": False},
 
-            {"CMD_OPTION": "neutron-fwaas",
-             "PROMPT": "Would you like to configure neutron FWaaS?",
-             "OPTION_LIST": ["y", "n"],
-             "VALIDATORS": [validators.validate_options],
-             "DEFAULT_VALUE": "n",
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME": "CONFIG_NEUTRON_FWAAS",
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
             {"CMD_OPTION": "os-neutron-vpnaas-install",
              "PROMPT": "Would you like to configure neutron VPNaaS?",
              "OPTION_LIST": ["y", "n"],
@@ -127,21 +114,6 @@ def initConfig(controller):
              "CONDITION": False},
         ],
 
-        "NEUTRON_LB_AGENT": [
-            {"CMD_OPTION": "os-neutron-lb-interface-mappings",
-             "PROMPT": ("Enter a comma separated list of interface mappings "
-                        "for the Neutron linuxbridge plugin"),
-             "OPTION_LIST": [],
-             "VALIDATORS": [],
-             "DEFAULT_VALUE": "",
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME": "CONFIG_NEUTRON_LB_INTERFACE_MAPPINGS",
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-        ],
-
         "NEUTRON_OVS_AGENT": [
             {"CMD_OPTION": "os-neutron-ovs-bridge-mappings",
              "PROMPT": ("Enter a comma separated list of bridge mappings for "
@@ -355,9 +327,9 @@ def initConfig(controller):
              "CONF_NAME": "CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS",
              "PROMPT": ("Enter a comma separated ordered list of networking "
                         "mechanism driver entrypoints"),
-             "OPTION_LIST": ["logger", "test", "linuxbridge", "openvswitch",
-                             "hyperv", "ncs", "arista", "cisco_nexus",
-                             "mlnx", "l2population", "sriovnicswitch", "ovn"],
+             "OPTION_LIST": ["logger", "test", "openvswitch",
+                             "arista", "mlnx", "l2population",
+                             "sriovnicswitch", "ovn"],
              "VALIDATORS": [validators.validate_multi_options],
              "DEFAULT_VALUE": "ovn",
              "MASK_INPUT": False,
@@ -436,7 +408,7 @@ def initConfig(controller):
             {"CMD_OPTION": "os-neutron-l2-agent",
              "PROMPT": ("Enter the name of the L2 agent to be used "
                         "with Neutron"),
-             "OPTION_LIST": ["linuxbridge", "openvswitch", "ovn"],
+             "OPTION_LIST": ["openvswitch", "ovn"],
              "VALIDATORS": [validators.validate_options],
              "DEFAULT_VALUE": "ovn",
              "MASK_INPUT": False,
@@ -445,7 +417,7 @@ def initConfig(controller):
              "USE_DEFAULT": False,
              "NEED_CONFIRM": False,
              "CONDITION": False,
-             "MESSAGE": ("You have chosen OVN Neutron backend. Note that this backend does not support the VPNaaS or FWaaS services. "
+             "MESSAGE": ("You have chosen OVN Neutron backend. Note that this backend does not support the VPNaaS plugin. "
                          "Geneve will be used as the encapsulation method for tenant networks"),
              "MESSAGE_VALUES": ["ovn"]},
 
@@ -479,13 +451,6 @@ def initConfig(controller):
          "POST_CONDITION": False,
          "POST_CONDITION_MATCH": True},
 
-        {"GROUP_NAME": "NEUTRON_LB_AGENT",
-         "DESCRIPTION": "Neutron LB agent config",
-         "PRE_CONDITION": use_ml2_with_linuxbridge,
-         "PRE_CONDITION_MATCH": True,
-         "POST_CONDITION": False,
-         "POST_CONDITION_MATCH": True},
-
         {"GROUP_NAME": "NEUTRON_OVS_AGENT",
          "DESCRIPTION": "Neutron OVS agent config",
          "PRE_CONDITION": use_ml2_with_ovs,
@@ -529,29 +494,33 @@ def initConfig(controller):
 def initSequences(controller):
     config = controller.CONF
     if config['CONFIG_NEUTRON_INSTALL'] != 'y':
+        if config['CONFIG_NOVA_INSTALL'] == 'y':
+            raise RuntimeError('Neutron is required to install Nova properly. '
+                               'Please set CONFIG_NEUTRON_INSTALL=y')
         return
+
+    has_ovs = 'openvswitch' in config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS']
+    has_ovn = 'ovn' in config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS']
+
     if config['CONFIG_IRONIC_INSTALL'] == 'y':
         config['CONFIG_NEUTRON_ML2_TYPE_DRIVERS'] += ', flat'
         config['CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES'] += ', flat'
-        if 'openvswitch' not in config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS']:
+        if not has_ovs:
             config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS'] += ', openvswitch'
         config['CONFIG_NEUTRON_ML2_FLAT_NETWORKS'] = 'extnet'
 
     if use_ml2_with_sriovnicswitch(config):
-        if ('openvswitch' not in config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS']
-                and 'linuxbridge' not in
-                config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS']):
+        if not has_ovs:
             config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS'] += ', openvswitch'
 
     if use_ml2_with_ovn(config):
-        if ('ovn' not in config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS']):
+        if not has_ovn:
             config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS'] = 'ovn'
         # OVN only supports geneve encapsulation
         if ('geneve' not in config['CONFIG_NEUTRON_ML2_TYPE_DRIVERS']):
             config['CONFIG_NEUTRON_ML2_TYPE_DRIVERS'] += ', geneve'
         config['CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES'] = 'geneve'
-        # VPNaaS and FWaaS are not supported with OVN
-        config['CONFIG_NEUTRON_FWAAS'] = 'n'
+        # VPNaaS is not supported with OVN
         config['CONFIG_NEUTRON_VPNAAS'] = 'n'
         config['CONFIG_NEUTRON_METERING_AGENT_INSTALL'] = 'n'
         # When using OVN we need to create the same L2 infrastucture as
@@ -576,8 +545,7 @@ def initSequences(controller):
         ovn_external = 'CONFIG_NEUTRON_OVN_EXTERNAL_PHYSNET'
         config[ovs_external] = config[ovn_external]
     elif use_ml2_with_ovs(config):
-        if ('openvswitch' not in config[
-                'CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS']):
+        if not has_ovs:
             config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS'] = 'openvswitch'
 
     plugin_db = 'neutron'
@@ -632,12 +600,6 @@ def neutron_install(config):
     return config['CONFIG_NEUTRON_INSTALL'] == 'y'
 
 
-def use_ml2_with_linuxbridge(config):
-    ml2_used = (neutron_install(config) and
-                config["CONFIG_NEUTRON_L2_AGENT"] == 'linuxbridge')
-    return ml2_used
-
-
 def use_ml2_with_ovs(config):
     return (neutron_install(config) and
             config["CONFIG_NEUTRON_L2_AGENT"] == 'openvswitch')
@@ -684,8 +646,6 @@ def get_if_driver(config):
     agent = config['CONFIG_NEUTRON_L2_AGENT']
     if agent == "openvswitch":
         return 'neutron.agent.linux.interface.OVSInterfaceDriver'
-    elif agent == 'linuxbridge':
-        return 'neutron.agent.linux.interface.BridgeInterfaceDriver'
     else:
         # OVN does not provides a interface driver
         return ''
@@ -728,18 +688,12 @@ def create_manifests(config, messages):
     if use_ml2_with_ovn(config):
         service_plugins.append('ovn-router')
     else:
-        # ML2 uses the L3 Router service plugin to implement l3 agent for linuxbridge and ovs
+        # ML2 uses the L3 Router service plugin to implement l3 agent for ovs
         service_plugins.append('router')
 
     if config['CONFIG_NEUTRON_METERING_AGENT_INSTALL'] == 'y':
         service_plugins.append('metering')
 
-    if config['CONFIG_NEUTRON_FWAAS'] == 'y':
-        service_plugins.append('firewall_v2')
-        fwaas_sp = ('FIREWALL_V2:fwaas_db:neutron_fwaas.services.firewall.'
-                    'service_drivers.agents.agents.FirewallAgentDriver:default')
-        service_providers.append(fwaas_sp)
-
     if config['CONFIG_NEUTRON_VPNAAS'] == 'y':
         service_plugins.append('vpnaas')
         vpnaas_sp = ('VPN:libreswan:neutron_vpnaas.services.vpn.'
@@ -755,8 +709,6 @@ def create_manifests(config, messages):
     config['FIREWALL_DRIVER'] = ("neutron.agent.linux.iptables_firewall."
                                  "OVSHybridIptablesFirewallDriver")
 
-    plugin_manifest = 'neutron_ml2_plugin'
-
     if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
         ssl_cert_file = config['CONFIG_NEUTRON_SSL_CERT'] = (
             '/etc/pki/tls/certs/ssl_amqp_neutron.crt'
@@ -826,11 +778,10 @@ def create_manifests(config, messages):
                                 n_host, config)
                         else:
                             iface = config['CONFIG_NEUTRON_OVS_TUNNEL_IF']
-                        ifip = ("ipaddress_%s" % iface)
-                        ifip = re.sub('[\.\-\:]', '_', ifip)
                         try:
-                            src_host = config['HOST_DETAILS'][n_host][ifip]
-                        except KeyError:
+                            src_host = (netifaces.ifaddresses(iface)
+                                        [netifaces.AF_INET][0]['addr'])
+                        except Exception:
                             raise KeyError('Couldn\'t detect ipaddress of '
                                            'interface %s on node %s' %
                                            (iface, n_host))
@@ -955,8 +906,6 @@ def create_l2_agent_manifests(config, messages):
         config["CONFIG_NEUTRON_OVS_BRIDGE_IFACES_COMPUTE"] = []
         no_local_types = set(ovs_type) & set(['gre', 'vxlan', 'vlan', 'flat'])
         no_tunnel_types = set(ovs_type) & set(['vlan', 'flat'])
-    elif agent == "linuxbridge":
-        host_var = 'CONFIG_NEUTRON_LB_HOST'
     else:
         raise KeyError("Unknown layer2 agent")
 
@@ -966,8 +915,7 @@ def create_l2_agent_manifests(config, messages):
         # only required if vlan or flat are enabled.
         if (
             agent in ["openvswitch", "ovn"] and (
-                (host in network_hosts and no_local_types)
-                or no_tunnel_types)
+                (host in network_hosts and no_local_types) or no_tunnel_types)
         ):
             if config['CONFIG_USE_SUBNETS'] == 'y':
                 iface_arr = [
diff --git a/packstack/plugins/nova_300.py b/packstack/plugins/nova_300.py
index 5904e714a..f0821b20b 100644
--- a/packstack/plugins/nova_300.py
+++ b/packstack/plugins/nova_300.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -17,7 +16,6 @@
 """
 
 import os
-import platform
 import socket
 
 from packstack.installer import basedefs
@@ -38,13 +36,6 @@
 
 
 def initConfig(controller):
-    if platform.linux_distribution()[0] == "Fedora":
-        primary_netif = "em1"
-        secondary_netif = "em2"
-    else:
-        primary_netif = "eth0"
-        secondary_netif = "eth1"
-
     nova_params = {
         "NOVA": [
             {"CMD_OPTION": 'nova-db-purge-enable',
@@ -176,7 +167,7 @@ def initConfig(controller):
                         "'name':'default'}, {...}] "),
              "OPTION_LIST": [],
              "VALIDATORS": [],
-             "DEFAULT_VALUE": "",
+             "DEFAULT_VALUE": "[]",
              "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
              "CONF_NAME": "CONFIG_NOVA_PCI_ALIAS",
@@ -191,7 +182,7 @@ def initConfig(controller):
                         "'name':'default'}, {...}]"),
              "OPTION_LIST": [],
              "VALIDATORS": [],
-             "DEFAULT_VALUE": "",
+             "DEFAULT_VALUE": "[]",
              "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
              "CONF_NAME": "CONFIG_NOVA_PCI_PASSTHROUGH_WHITELIST",
@@ -232,11 +223,6 @@ def initSequences(controller):
     if controller.CONF['CONFIG_NOVA_INSTALL'] != 'y':
         return
 
-    if controller.CONF['CONFIG_NEUTRON_INSTALL'] == 'y':
-        network_title = ('Preparing OpenStack Network-related '
-                         'Nova entries')
-        network_function = create_neutron_manifest
-
     novaapisteps = [
         {'title': 'Preparing Nova API entries',
          'functions': [create_api_manifest]},
@@ -250,8 +236,8 @@ def initSequences(controller):
          'functions': [create_sched_manifest]},
         {'title': 'Preparing Nova VNC Proxy entries',
          'functions': [create_vncproxy_manifest]},
-        {'title': network_title,
-         'functions': [network_function]},
+        {'title': 'Preparing OpenStack Network-related Nova entries',
+         'functions': [create_neutron_manifest]},
         {'title': 'Preparing Nova Common entries',
          'functions': [create_common_manifest]},
     ]
@@ -277,7 +263,7 @@ def create_ssh_keys(config, messages):
 
     config['NOVA_MIGRATION_KEY_TYPE'] = 'ssh-rsa'
     config['NOVA_MIGRATION_KEY_PUBLIC'] = public.split()[1]
-    config['NOVA_MIGRATION_KEY_SECRET'] = secret
+    config['NOVA_MIGRATION_KEY_SECRET'] = secret + '\n'
 
 
 def gather_host_keys(config, messages):
@@ -285,7 +271,7 @@ def gather_host_keys(config, messages):
 
     for host in compute_hosts:
         local = utils.ScriptRunner()
-        local.append('ssh-keyscan %s' % host)
+        local.append('ssh-keyscan -q %s' % host)
         retcode, hostkey = local.execute()
         config['HOST_KEYS_%s' % host] = hostkey
 
@@ -397,7 +383,7 @@ def create_compute_manifest(config, messages):
                 )
                 ssl_host = config['CONFIG_CONTROLLER_HOST']
                 service = 'ceilometer'
-                generate_ssl_cert(config, host, service, ssl_key_file,
+                generate_ssl_cert(config, ssl_host, service, ssl_key_file,
                                   ssl_cert_file)
 
         fw_details = dict()
@@ -449,9 +435,6 @@ def create_vncproxy_manifest(config, messages):
 def create_common_manifest(config, messages):
     global compute_hosts, network_hosts
 
-    network_type = (config['CONFIG_NEUTRON_INSTALL'] == "y" and
-                    'neutron' or 'nova')
-    network_multi = len(network_hosts) > 1
     dbacces_hosts = set([config.get('CONFIG_CONTROLLER_HOST')])
     dbacces_hosts |= network_hosts
 
@@ -475,14 +458,7 @@ def create_common_manifest(config, messages):
         else:
             config['CONFIG_NOVA_SQL_CONN_NOPW'] = sqlconn
 
-        # for nova-network in multihost mode each compute host is metadata
-        # host otherwise we use api host
-        if (network_type == 'nova' and network_multi and
-                host in compute_hosts):
-            metadata = host
-        else:
-            metadata = config['CONFIG_CONTROLLER_HOST']
-        config['CONFIG_NOVA_METADATA_HOST'] = metadata
+        config['CONFIG_NOVA_METADATA_HOST'] = config['CONFIG_CONTROLLER_HOST']
 
     if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
         nova_hosts = compute_hosts
diff --git a/packstack/plugins/openstack_client_400.py b/packstack/plugins/openstack_client_400.py
index 9795c61af..bc082acc0 100644
--- a/packstack/plugins/openstack_client_400.py
+++ b/packstack/plugins/openstack_client_400.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/plugins/panko_820.py b/packstack/plugins/panko_820.py
deleted file mode 100644
index 364d4d3b2..000000000
--- a/packstack/plugins/panko_820.py
+++ /dev/null
@@ -1,103 +0,0 @@
-# -*- coding: utf-8 -*-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-"""
-Installs and configures Panko
-"""
-
-from packstack.installer import basedefs
-from packstack.installer import utils
-from packstack.installer import validators
-from packstack.installer import processors
-
-from packstack.modules.documentation import update_params_usage
-
-# ------------- Panko Packstack Plugin Initialization --------------
-
-PLUGIN_NAME = "OS-Panko"
-PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
-
-
-def initConfig(controller):
-    panko_params = {
-        "PANKO": [
-            {"CONF_NAME": "CONFIG_PANKO_DB_PW",
-             "CMD_OPTION": "panko-db-passwd",
-             "PROMPT": "Enter the password for Panko DB access",
-             "OPTION_LIST": [],
-             "VALIDATORS": [validators.validate_not_empty],
-             "DEFAULT_VALUE": "PW_PLACEHOLDER",
-             "PROCESSORS": [processors.process_password],
-             "MASK_INPUT": True,
-             "LOOSE_VALIDATION": False,
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": True,
-             "CONDITION": False},
-            {"CONF_NAME": "CONFIG_PANKO_KS_PW",
-             "CMD_OPTION": "panko-ks-passwd",
-             "PROMPT": "Enter the password for the Panko Keystone access",
-             "OPTION_LIST": [],
-             "VALIDATORS": [validators.validate_not_empty],
-             "DEFAULT_VALUE": "PW_PLACEHOLDER",
-             "PROCESSORS": [processors.process_password],
-             "MASK_INPUT": True,
-             "LOOSE_VALIDATION": False,
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": True,
-             "CONDITION": False}
-        ]
-    }
-
-    update_params_usage(basedefs.PACKSTACK_DOC, panko_params)
-
-    def use_panko(config):
-        return (config['CONFIG_CEILOMETER_INSTALL'] == 'y' and
-                config['CONFIG_PANKO_INSTALL'] == 'y')
-
-    panko_groups = [
-        {"GROUP_NAME": "PANKO",
-         "DESCRIPTION": "Panko Config parameters",
-         "PRE_CONDITION": use_panko,
-         "PRE_CONDITION_MATCH": True,
-         "POST_CONDITION": False,
-         "POST_CONDITION_MATCH": True},
-    ]
-    for group in panko_groups:
-        paramList = panko_params[group["GROUP_NAME"]]
-        controller.addGroup(group, paramList)
-
-
-def initSequences(controller):
-    if (controller.CONF['CONFIG_PANKO_INSTALL'] != 'y' or
-       controller.CONF['CONFIG_CEILOMETER_INSTALL'] != 'y'):
-        return
-
-    steps = [{'title': 'Preparing Panko entries',
-              'functions': [create_manifest]}]
-    controller.addSequence("Installing OpenStack Panko", [], [],
-                           steps)
-
-
-# -------------------------- step functions --------------------------
-
-def create_manifest(config, messages):
-    fw_details = dict()
-    key = "panko_api"
-    fw_details.setdefault(key, {})
-    fw_details[key]['host'] = "ALL"
-    fw_details[key]['service_name'] = "panko-api"
-    fw_details[key]['chain'] = "INPUT"
-    fw_details[key]['ports'] = ['8977']
-    fw_details[key]['proto'] = "tcp"
-    config['FIREWALL_PANKO_RULES'] = fw_details
diff --git a/packstack/plugins/postscript_951.py b/packstack/plugins/postscript_951.py
index fd4da8877..857835964 100644
--- a/packstack/plugins/postscript_951.py
+++ b/packstack/plugins/postscript_951.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -56,8 +55,9 @@ def run_tempest(config, messages):
     print("Running Tempest on %s" % config['CONFIG_TEMPEST_HOST'])
     server = utils.ScriptRunner(config['CONFIG_TEMPEST_HOST'])
     server.append('pushd /var/lib/tempest')
-    server.append('tempest run --regex \'(%s)\' --concurrency 2  > %s'
+    server.append('tempest run --regex \'(%s)\' --black-regex \'%s\' --concurrency 2  > %s'
                   % (config['CONFIG_RUN_TEMPEST_TESTS'].replace(' ', '|'),
+                     config['CONFIG_SKIP_TEMPEST_TESTS'].replace(' ', '|'),
                      logfile))
     server.append('popd')
     server.execute()
diff --git a/packstack/plugins/prescript_000.py b/packstack/plugins/prescript_000.py
old mode 100755
new mode 100644
index ef28400b5..cf4b70f6a
--- a/packstack/plugins/prescript_000.py
+++ b/packstack/plugins/prescript_000.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -16,12 +15,11 @@
 Plugin responsible for setting OpenStack global options
 """
 
-import os
-import re
-import logging
-import platform
+import distro
 import glob
+import logging
 import os
+import re
 import uuid
 
 from packstack.installer import basedefs
@@ -231,35 +229,6 @@ def initConfig(controller):
              "NEED_CONFIRM": False,
              "CONDITION": False},
 
-            {"CMD_OPTION": "os-panko-install",
-             "PROMPT": (
-                 "Should Packstack install OpenStack Events Service (Panko)"
-             ),
-             "OPTION_LIST": ["y", "n"],
-             "VALIDATORS": [validators.validate_options],
-             "DEFAULT_VALUE": "n",
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME": "CONFIG_PANKO_INSTALL",
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
-            {"CMD_OPTION": "os-sahara-install",
-             "PROMPT": (
-                 "Should Packstack install OpenStack Clustering (Sahara)."
-                 " If yes it'll also install Heat."
-             ),
-             "OPTION_LIST": ["y", "n"],
-             "VALIDATORS": [validators.validate_options],
-             "DEFAULT_VALUE": "n",
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME": "CONFIG_SAHARA_INSTALL",
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
             {"CMD_OPTION": "os-heat-install",
              "PROMPT": (
                  "Should Packstack install OpenStack Orchestration (Heat)"
@@ -532,18 +501,6 @@ def initConfig(controller):
              "USE_DEFAULT": False,
              "NEED_CONFIRM": False,
              "CONDITION": False},
-
-            {"CONF_NAME": "CONFIG_SAHARA_HOST",
-             "CMD_OPTION": "os-sahara-host",
-             "PROMPT": "Enter the host for the Sahara",
-             "OPTION_LIST": [],
-             "VALIDATORS": [validators.validate_ssh],
-             "DEFAULT_VALUE": utils.get_localhost_ip(),
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": False,
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
         ],
 
         "SERVERPREPARE": [
@@ -949,16 +906,16 @@ def initSequences(controller):
 
 
 def is_rhel():
-    return 'Red Hat Enterprise Linux' in platform.linux_distribution()[0]
+    return 'Red Hat Enterprise Linux' in distro.linux_distribution()[0]
 
 
 def detect_os_and_version(host):
     server = utils.ScriptRunner(host)
     server.append(
-        'python -c "import platform; '
-        'print platform.linux_distribution(full_distribution_name=0)[0]'
+        'python -c "import distro; '
+        'print distro.linux_distribution(full_distribution_name=0)[0]'
         '+\',\'+'
-        'platform.linux_distribution()[1]"'
+        'distro.linux_distribution()[1]"'
     )
     try:
         rc, out = server.execute()
@@ -977,15 +934,15 @@ def run_rhn_reg(host, server_url, username=None, password=None,
     Registers given host to given RHN Satellite server. To successfully
     register either activation_key or username/password is required.
     """
-    logging.debug('Setting RHN Satellite server: %s.' % locals())
+    logging.debug('Setting RHN Satellite server: %s.' % server_url)
 
     mask = []
     cmd = ['/usr/sbin/rhnreg_ks']
     server = utils.ScriptRunner(host)
 
     # check satellite server url
-    server_url = (server_url.rstrip('/').endswith('/XMLRPC')
-                  and server_url or '%s/XMLRPC' % server_url)
+    server_url = (server_url.rstrip('/').endswith('/XMLRPC') and
+                  server_url or '%s/XMLRPC' % server_url)
     cmd.extend(['--serverUrl', server_url])
 
     if activation_key:
@@ -1005,10 +962,9 @@ def run_rhn_reg(host, server_url, username=None, password=None,
         location = "/etc/sysconfig/rhn/%s" % os.path.basename(cacert)
         if not os.path.isfile(location):
             logging.debug('Downloading cacert from %s.' % server_url)
-            wget_cmd = ('ls %(location)s &> /dev/null && echo -n "" || '
+            wget_cmd = (f'ls {location} &> /dev/null && echo -n "" || '
                         'wget -nd --no-check-certificate --timeout=30 '
-                        '--tries=3 -O "%(location)s" "%(cacert)s"' %
-                        locals())
+                        f'--tries=3 -O "{location}" "{cacert}"')
             server.append(wget_cmd)
         cmd.extend(['--sslCACert', location])
 
@@ -1043,13 +999,13 @@ def run_rhsm_reg(host, username, password, optional=False, proxy_server=None,
 
     # configure proxy if it is necessary
     if proxy_server:
-        cmd = ('subscription-manager config '
-               '--server.proxy_hostname=%(proxy_server)s '
-               '--server.proxy_port=%(proxy_port)s')
+        cmd = ['subscription-manager', 'config',
+               f'--server.proxy_hostname={proxy_server}',
+               f'--server.proxy_port={proxy_port}']
         if proxy_user:
-            cmd += (' --server.proxy_user=%(proxy_user)s '
-                    '--server.proxy_password=%(proxy_password)s')
-        server.append(cmd % locals())
+            cmd += [f'--server.proxy_user={proxy_user}',
+                    f'--server.proxy_password={proxy_password}']
+        server.append(cmd.join(' '))
 
     if sat6_server:
         # Register to Satellite 6 host
@@ -1105,14 +1061,12 @@ def manage_centos_release_openstack(host, config):
     if not match:
         # No CentOS Cloud SIG repo, so we don't need to continue
         return
-    branch, version, release = match.group('branch'), match.group('version'), match.group('release')
-    package_name = ("centos-release-openstack-%(branch)s-%(version)s-"
-                    "%(release)s" % locals())
+    branch = match.group('branch')
 
     server = utils.ScriptRunner(host)
-    server.append("(rpm -q 'centos-release-openstack-%(branch)s' ||"
-                  " yum -y install centos-release-openstack-%(branch)s) || true"
-                  % locals())
+    server.append(
+        f"(rpm -q 'centos-release-openstack-{branch}' ||"
+        f" yum -y install centos-release-openstack-{branch}) || true")
 
     try:
         server.execute()
@@ -1133,15 +1087,20 @@ def manage_rdo(host, config):
         # RDO repo is not installed, so we don't need to continue
         return
 
-    match = re.match(r'^(?P<version>\w+)\-(?P<release>\d+\.[\d\w]+)\n', out)
-    version, release = match.group('version'), match.group('release')
-    rdo_url = ("https://www.rdoproject.org/repos/openstack-%(version)s/"
-               "rdo-release-%(version)s.rpm" % locals())
+    match = re.match(r'^(?P<version>\w+)\-.*\n', out)
+    version = match.group('version')
+    if re.match(r'^(.*\.el8.*\n)', out):
+        dist_tag = '.el8'
+    elif re.match(r'^(.*\.el9s.*\n)', out):
+        dist_tag = '.el9s'
+    else:
+        dist_tag = ''
+    rdo_url = (f"https://www.rdoproject.org/repos/openstack-{version}/"
+               f"rdo-release-{version}{dist_tag}.rpm")
 
     server = utils.ScriptRunner(host)
-    server.append("(rpm -q 'rdo-release-%(version)s' ||"
-                  " yum install -y --nogpg %(rdo_url)s) || true"
-                  % locals())
+    server.append(f"(rpm -q 'rdo-release-{version}' ||"
+                  f" yum install -y --nogpg {rdo_url}) || true")
     try:
         server.execute()
     except exceptions.ScriptRuntimeError as ex:
@@ -1150,18 +1109,22 @@ def manage_rdo(host, config):
 
     reponame = 'openstack-%s' % version
     server.clear()
-    server.append('yum-config-manager --enable %(reponame)s' % locals())
+    server.append('yum-config-manager --enable %s' % reponame)
 
     if config['CONFIG_ENABLE_RDO_TESTING'] == 'y':
-        server.append('yum-config-manager --disable %(reponame)s' % locals())
-        server.append('yum-config-manager --enable %(reponame)s-testing' % locals())
+        server.append('yum-config-manager --disable %s' % reponame)
+        server.append('yum-config-manager --enable %s-testing' % reponame)
 
-    # yum-config-manager returns 0 always, but returns current setup
-    # if succeeds
     rc, out = server.execute()
-
-    match = re.search('enabled\s*=\s*(1|True)', out)
-    if not match:
+    match = re.search(r'enabled\s*=\s*(1|True)', out)
+    # In CentOS 7 yum-config-manager returns 0 always, but returns current setup
+    # if succeeds
+    # In CentOS 8 yum-config-manager returns 1 when failing but doesn't return current
+    # setup if succeeds
+    # In CentOS 9 yum-config-manager returns 1 when failing but doesn't return current
+    # setup if succeeds
+    if ((dist_tag == '.el9s' and rc != 0) or (dist_tag == '.el8' and rc != 0) or
+            (dist_tag == '' and not match)):
         msg = ('Failed to set RDO repo on host %s:\nRPM file seems to be '
                'installed, but appropriate repo file is probably missing '
                'in /etc/yum.repos.d/' % host)
@@ -1198,7 +1161,7 @@ def choose_ip_version(config, messages):
 
 def install_keys_on_host(hostname, sshkeydata):
     server = utils.ScriptRunner(hostname)
-    # TODO replace all that with ssh-copy-id
+    # TODO(tbd) replace all that with ssh-copy-id
     server.append("mkdir -p ~/.ssh")
     server.append("chmod 500 ~/.ssh")
     server.append("grep '%s' ~/.ssh/authorized_keys > /dev/null 2>&1 || "
@@ -1355,11 +1318,10 @@ def server_prep(config, messages):
         if CONFIG_REPO:
             for i, repourl in enumerate(CONFIG_REPO.split(',')):
                 reponame = 'packstack_%d' % i
-                server.append('echo "[%(reponame)s]\nname=%(reponame)s\n'
-                              'baseurl=%(repourl)s\nenabled=1\n'
+                server.append(f'echo "[{reponame}]\nname={reponame}\n'
+                              f'baseurl={repourl}\nenabled=1\n'
                               'priority=1\ngpgcheck=0"'
-                              ' > /etc/yum.repos.d/%(reponame)s.repo'
-                              % locals())
+                              f' > /etc/yum.repos.d/{reponame}.repo')
 
         server.append("yum clean metadata")
         server.execute()
diff --git a/packstack/plugins/provision_700.py b/packstack/plugins/provision_700.py
index f6212c6de..6ed489a3e 100644
--- a/packstack/plugins/provision_700.py
+++ b/packstack/plugins/provision_700.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -32,24 +31,11 @@
 
 DEMO_IMAGE_NAME = 'cirros'
 DEMO_IMAGE_URL = (
-    'https://download.cirros-cloud.net/0.3.5/cirros-0.3.5-%s-disk.img'
+    'https://download.cirros-cloud.net/0.5.1/cirros-0.5.1-%s-disk.img'
     % (arch.cirros_arch())
 )
 DEMO_IMAGE_SSH_USER = 'cirros'
 DEMO_IMAGE_FORMAT = 'qcow2'
-UEC_IMAGE_NAME = 'cirros-uec'
-UEC_IMAGE_KERNEL_URL = (
-    'https://download.cirros-cloud.net/0.3.5/cirros-0.3.5-%s-kernel'
-    % (arch.cirros_arch())
-)
-UEC_IMAGE_RAMDISK_URL = (
-    'https://download.cirros-cloud.net/0.3.5/cirros-0.3.5-%s-initramfs'
-    % (arch.cirros_arch())
-)
-UEC_IMAGE_DISK_URL = (
-    'https://download.cirros-cloud.net/0.3.5/cirros-0.3.5-%s-disk.img'
-    % (arch.cirros_arch())
-)
 
 
 def initConfig(controller):
@@ -179,57 +165,6 @@ def process_tempest(param, param_name, config=None):
              "USE_DEFAULT": False,
              "NEED_CONFIRM": False,
              "CONDITION": False},
-
-            {"CMD_OPTION": "provision-uec-image-name",
-             "PROMPT": "Enter the name to be assigned to the uec image used for tempest",
-             "OPTION_LIST": False,
-             "VALIDATORS": [validators.validate_not_empty],
-             "DEFAULT_VALUE": UEC_IMAGE_NAME,
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME": "CONFIG_PROVISION_UEC_IMAGE_NAME",
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
-            {"CMD_OPTION": "provision-uec-kernel-url",
-             "PROMPT": ("Enter the location of a uec kernel to be loaded "
-                        "into Glance"),
-             "OPTION_LIST": False,
-             "VALIDATORS": [validators.validate_not_empty],
-             "DEFAULT_VALUE": UEC_IMAGE_KERNEL_URL,
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME": "CONFIG_PROVISION_UEC_IMAGE_KERNEL_URL",
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
-            {"CMD_OPTION": "provision-uec-ramdisk-url",
-             "PROMPT": ("Enter the location of a uec ramdisk to be loaded "
-                        "into Glance"),
-             "OPTION_LIST": False,
-             "VALIDATORS": [validators.validate_not_empty],
-             "DEFAULT_VALUE": UEC_IMAGE_RAMDISK_URL,
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME": "CONFIG_PROVISION_UEC_IMAGE_RAMDISK_URL",
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
-
-            {"CMD_OPTION": "provision-uec-disk-url",
-             "PROMPT": ("Enter the location of a uec disk image to be loaded "
-                        "into Glance"),
-             "OPTION_LIST": False,
-             "VALIDATORS": [validators.validate_not_empty],
-             "DEFAULT_VALUE": UEC_IMAGE_DISK_URL,
-             "MASK_INPUT": False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME": "CONFIG_PROVISION_UEC_IMAGE_DISK_URL",
-             "USE_DEFAULT": False,
-             "NEED_CONFIRM": False,
-             "CONDITION": False},
         ],
 
         "PROVISION_TEMPEST": [
@@ -406,6 +341,19 @@ def process_tempest(param, param_name, config=None):
              "CONF_NAME": "CONFIG_RUN_TEMPEST_TESTS",
              "USE_DEFAULT": False,
              "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "skip-tempest-tests",
+             "PROMPT": ("What tempest tests should skipped ?"
+                        " (If blank, Tempest will not skip any tests)"),
+             "OPTION_LIST": [],
+             "VALIDATORS": False,
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_SKIP_TEMPEST_TESTS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
              "CONDITION": False}
         ],
 
diff --git a/packstack/plugins/puppet_950.py b/packstack/plugins/puppet_950.py
old mode 100755
new mode 100644
index 0f5cc4454..619f9a168
--- a/packstack/plugins/puppet_950.py
+++ b/packstack/plugins/puppet_950.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -16,9 +15,9 @@
 Installs and configures Puppet
 """
 
-import sys
 import logging
 import os
+import sys
 import time
 
 from packstack.installer import utils
@@ -145,16 +144,14 @@ def run_cleanup(config, messages):
 
 
 def copy_puppet_modules(config, messages):
-    os_modules = ' '.join(('aodh', 'apache', 'ceilometer', 'certmonger',
-                           'cinder', 'concat', 'firewall', 'glance',
-                           'gnocchi', 'heat', 'horizon', 'inifile', 'ironic',
-                           'keystone', 'magnum', 'manila', 'memcached',
-                           'mysql', 'neutron', 'nova', 'nssdb', 'openstack',
-                           'openstacklib', 'oslo', 'ovn', 'packstack', 'panko',
+    os_modules = ' '.join(('aodh', 'apache', 'ceilometer', 'cinder', 'concat',
+                           'firewall', 'glance', 'gnocchi', 'heat', 'horizon',
+                           'inifile', 'ironic', 'keystone', 'magnum', 'manila',
+                           'memcached', 'mysql', 'neutron', 'nova', 'nssdb',
+                           'openstacklib', 'oslo', 'ovn', 'packstack',
                            'placement', 'rabbitmq', 'redis', 'remote', 'rsync',
-                           'sahara', 'ssh', 'stdlib', 'swift', 'sysctl',
-                           'systemd', 'tempest', 'trove', 'vcsrepo',
-                           'vswitch', 'xinetd'))
+                           'ssh', 'stdlib', 'swift', 'sysctl', 'systemd',
+                           'tempest', 'trove', 'vcsrepo', 'vswitch', 'xinetd'))
 
     # write puppet manifest to disk
     manifestfiles.writeManifests()
@@ -234,6 +231,7 @@ def apply_puppet_manifest(config, messages):
             server.append("touch %s" % running_logfile)
             server.append("chmod 600 %s" % running_logfile)
             server.append("export PACKSTACK_VAR_DIR=%s" % host_dir)
+            server.append("export LANG=C.UTF-8")
             cmd = ("( flock %s/ps.lock "
                    "puppet apply %s --modulepath %s/modules %s > %s "
                    "2>&1 < /dev/null ; "
@@ -265,12 +263,16 @@ def prepare_puppet_modules(config, messages):
         manifestfile = "%s_compute.pp" % host
         appendManifestFile(manifestfile, manifestdata, marker='compute')
 
+    manifestdata = getManifestTemplate("controller_post")
+    manifestfile = "%s_controller_post.pp" % config['CONFIG_CONTROLLER_HOST']
+    appendManifestFile(manifestfile, manifestdata, marker='controller')
+
 
 def finalize(config, messages):
     for hostname in filtered_hosts(config):
         server = utils.ScriptRunner(hostname)
         server.append("installed=$(rpm -q kernel --last | head -n1 | "
-                      "sed 's/kernel-\([a-z0-9\.\_\-]*\).*/\\1/g')")
+                      "sed 's/kernel-\([a-z0-9\.\_\-]*\).*/\\1/g')")    # noqa: W605
         server.append("loaded=$(uname -r | head -n1)")
         server.append('[ "$loaded" == "$installed" ]')
         try:
diff --git a/packstack/plugins/sahara_900.py b/packstack/plugins/sahara_900.py
deleted file mode 100644
index 6efc3dc2d..000000000
--- a/packstack/plugins/sahara_900.py
+++ /dev/null
@@ -1,108 +0,0 @@
-# -*- coding: utf-8 -*-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-"""
-Installs and configures Sahara
-"""
-
-from packstack.installer import basedefs
-from packstack.installer import utils
-from packstack.installer import validators
-from packstack.installer import processors
-
-from packstack.modules.documentation import update_params_usage
-from packstack.modules.ospluginutils import generate_ssl_cert
-
-# ------------------ Sahara installer initialization ------------------
-
-PLUGIN_NAME = "OS-Sahara"
-PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, "blue")
-
-
-def initConfig(controller):
-    params = [
-        {"CONF_NAME": "CONFIG_SAHARA_DB_PW",
-         "CMD_OPTION": "sahara-db-passwd",
-         "PROMPT": "Enter the password to use for Sahara to access the DB",
-         "OPTION_LIST": [],
-         "VALIDATORS": [validators.validate_not_empty],
-         "DEFAULT_VALUE": "PW_PLACEHOLDER",
-         "PROCESSORS": [processors.process_password],
-         "MASK_INPUT": True,
-         "LOOSE_VALIDATION": False,
-         "USE_DEFAULT": False,
-         "NEED_CONFIRM": True,
-         "CONDITION": False},
-
-        {"CONF_NAME": "CONFIG_SAHARA_KS_PW",
-         "CMD_OPTION": "sahara-ks-passwd",
-         "PROMPT": "Enter the password for Sahara Keystone access",
-         "OPTION_LIST": [],
-         "VALIDATORS": [validators.validate_not_empty],
-         "DEFAULT_VALUE": "PW_PLACEHOLDER",
-         "PROCESSORS": [processors.process_password],
-         "MASK_INPUT": True,
-         "LOOSE_VALIDATION": False,
-         "USE_DEFAULT": False,
-         "NEED_CONFIRM": True,
-         "CONDITION": False},
-    ]
-    update_params_usage(basedefs.PACKSTACK_DOC, params, sectioned=False)
-    group = {"GROUP_NAME": "SAHARA",
-             "DESCRIPTION": "Sahara Config parameters",
-             "PRE_CONDITION": "CONFIG_SAHARA_INSTALL",
-             "PRE_CONDITION_MATCH": "y",
-             "POST_CONDITION": False,
-             "POST_CONDITION_MATCH": True}
-    controller.addGroup(group, params)
-
-
-def initSequences(controller):
-    conf = controller.CONF
-    if conf["CONFIG_SAHARA_INSTALL"] != 'y':
-        return
-
-    saharasteps = [
-        {"title": "Preparing Sahara entries",
-         "functions": [create_manifest]},
-    ]
-    controller.addSequence("Installing Sahara", [], [], saharasteps)
-
-
-# -------------------------- step functions --------------------------
-def create_manifest(config, messages):
-    if config['CONFIG_UNSUPPORTED'] != 'y':
-        config['CONFIG_SAHARA_HOST'] = config['CONFIG_CONTROLLER_HOST']
-
-    if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
-        ssl_host = config['CONFIG_SAHARA_HOST']
-        ssl_cert_file = config['CONFIG_SAHARA_SSL_CERT'] = (
-            '/etc/pki/tls/certs/ssl_amqp_sahara.crt'
-        )
-        ssl_key_file = config['CONFIG_SAHARA_SSL_KEY'] = (
-            '/etc/pki/tls/private/ssl_amqp_sahara.key'
-        )
-        service = 'sahara'
-        generate_ssl_cert(config, ssl_host, service, ssl_key_file,
-                          ssl_cert_file)
-
-    fw_details = dict()
-    key = "sahara-api"
-    fw_details.setdefault(key, {})
-    fw_details[key]["host"] = "ALL"
-    fw_details[key]["service_name"] = "sahara api"
-    fw_details[key]["chain"] = "INPUT"
-    fw_details[key]["ports"] = ["8386"]
-    fw_details[key]["proto"] = "tcp"
-    config["FIREWALL_SAHARA_CFN_RULES"] = fw_details
diff --git a/packstack/plugins/ssl_001.py b/packstack/plugins/ssl_001.py
index d2d01c18e..636685d67 100644
--- a/packstack/plugins/ssl_001.py
+++ b/packstack/plugins/ssl_001.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -15,11 +14,16 @@
 """
 Plugin responsible for managing SSL options
 """
+import datetime
 import os
-
-from OpenSSL import crypto
 from socket import gethostname
 
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives import serialization
+from cryptography import x509
+from cryptography.x509 import oid
+
 from packstack.installer import basedefs
 from packstack.installer import utils
 from packstack.installer import validators
@@ -207,7 +211,7 @@ def initSequences(controller):
 
 def create_self_signed_cert(config, messages):
     """
-    OpenSSL wrapper to create selfsigned CA.
+    Generate selfsigned CA.
     """
 
     # for now hardcoded place for landing CACert file on servers
@@ -239,55 +243,82 @@ def create_self_signed_cert(config, messages):
     KEY_FILE = config['CONFIG_SSL_CACERT_KEY_FILE'] = (
         '%s/keys/selfcert.crt' % config['CONFIG_SSL_CERT_DIR']
     )
-    if not os.path.exists(CERT_FILE) or not os.path.exists(KEY_FILE):
-        # create a key pair
-        k = crypto.PKey()
-        k.generate_key(crypto.TYPE_RSA, 4096)
-
-        # create a self-signed cert
-        mail = config['CONFIG_SSL_CERT_SUBJECT_MAIL']
-        cert = crypto.X509()
-        subject = cert.get_subject()
-        subject.C = config['CONFIG_SSL_CERT_SUBJECT_C']
-        subject.ST = config['CONFIG_SSL_CERT_SUBJECT_ST']
-        subject.L = config['CONFIG_SSL_CERT_SUBJECT_L']
-        subject.O = config['CONFIG_SSL_CERT_SUBJECT_O']
-        subject.OU = config['CONFIG_SSL_CERT_SUBJECT_OU']
-        subject.CN = config['CONFIG_SSL_CERT_SUBJECT_CN']
-        subject.emailAddress = mail
-        cert.set_serial_number(1000)
-        cert.gmtime_adj_notBefore(0)
-        cert.gmtime_adj_notAfter(10 * 365 * 24 * 60 * 60)
-        cert.set_issuer(cert.get_subject())
-        cert.set_pubkey(k)
-
-        # CA extensions
-        cert.add_extensions([
-            crypto.X509Extension("basicConstraints".encode('ascii'), False,
-                                 "CA:TRUE".encode('ascii')),
-            crypto.X509Extension("keyUsage".encode('ascii'), False,
-                                 "keyCertSign, cRLSign".encode('ascii')),
-            crypto.X509Extension("subjectKeyIdentifier".encode('ascii'), False,
-                                 "hash".encode('ascii'),
-                                 subject=cert),
-        ])
-
-        cert.add_extensions([
-            crypto.X509Extension(
-                "authorityKeyIdentifier".encode('ascii'), False,
-                "keyid:always".encode('ascii'), issuer=cert)
-        ])
-
-        cert.sign(k, 'sha1')
-
-        open((CERT_FILE), "w").write(
-            crypto.dump_certificate(crypto.FILETYPE_PEM, cert).decode())
-        open((KEY_FILE), "w").write(
-            crypto.dump_privatekey(crypto.FILETYPE_PEM, k).decode())
-
-        messages.append(
-            "%sNOTE%s : A selfsigned CA certificate was generated to be used "
-            "for ssl, you should still change it do subordinate CA cert. In "
-            "any case please save the contents of %s."
-            % (utils.COLORS['red'], utils.COLORS['nocolor'],
-                config['CONFIG_SSL_CERT_DIR']))
+
+    if os.path.exists(CERT_FILE) and os.path.exists(KEY_FILE):
+        return
+
+    # create a key pair
+    key = rsa.generate_private_key(
+        public_exponent=65537,
+        key_size=4096,
+    )
+
+    subject = issuer = x509.Name([
+        x509.NameAttribute(oid.NameOID.COUNTRY_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_C']),
+        x509.NameAttribute(oid.NameOID.STATE_OR_PROVINCE_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_ST']),
+        x509.NameAttribute(oid.NameOID.LOCALITY_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_L']),
+        x509.NameAttribute(oid.NameOID. ORGANIZATION_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_O']),
+        x509.NameAttribute(oid.NameOID. ORGANIZATIONAL_UNIT_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_OU']),
+        x509.NameAttribute(oid.NameOID.COMMON_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_CN']),
+        x509.NameAttribute(oid.NameOID.EMAIL_ADDRESS,
+                           config['CONFIG_SSL_CERT_SUBJECT_MAIL']),
+    ])
+    cert = x509.CertificateBuilder().subject_name(
+        subject
+    ).issuer_name(
+        issuer
+    ).public_key(
+        key.public_key()
+    ).serial_number(
+        x509.random_serial_number()
+    ).not_valid_before(
+        datetime.datetime.now(datetime.timezone.utc)
+    ).not_valid_after(
+        datetime.datetime.now(datetime.timezone.utc) +
+        datetime.timedelta(days=3650)
+    ).add_extension(
+        x509.BasicConstraints(ca=True, path_length=None),
+        critical=False,
+    ).add_extension(
+        x509.KeyUsage(
+            digital_signature=False,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=False,
+            key_cert_sign=True,
+            crl_sign=True,
+            encipher_only=False,
+            decipher_only=False,
+        ),
+        critical=False,
+    ).add_extension(
+        x509.SubjectKeyIdentifier.from_public_key(key.public_key()),
+        critical=False,
+    ).add_extension(
+        x509.AuthorityKeyIdentifier.from_issuer_public_key(key.public_key()),
+        critical=False,
+    ).sign(key, hashes.SHA256())
+
+    with open(CERT_FILE, 'wb') as certfile:
+        certfile.write(cert.public_bytes(serialization.Encoding.PEM))
+
+    with open(KEY_FILE, 'wb') as keyfile:
+        keyfile.write(key.private_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PrivateFormat.TraditionalOpenSSL,
+            encryption_algorithm=serialization.NoEncryption()
+        ))
+
+    messages.append(
+        "%sNOTE%s : A selfsigned CA certificate was generated to be used "
+        "for ssl, you should still change it do subordinate CA cert. In "
+        "any case please save the contents of %s."
+        % (utils.COLORS['red'], utils.COLORS['nocolor'],
+            config['CONFIG_SSL_CERT_DIR']))
diff --git a/packstack/plugins/swift_600.py b/packstack/plugins/swift_600.py
index 8a756b355..3bb85a67e 100644
--- a/packstack/plugins/swift_600.py
+++ b/packstack/plugins/swift_600.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -16,9 +15,9 @@
 Installs and configures Swift
 """
 
+import netaddr
 import re
 import uuid
-import netaddr
 
 from packstack.installer import basedefs
 from packstack.installer import validators
@@ -232,7 +231,7 @@ def get_storage_size(config):
     ranges = {'G': 1048576, 'M': 1024, 'K': 1}
     size = config['CONFIG_SWIFT_STORAGE_SIZE'].strip()
     for measure in ['G', 'M', 'K']:
-        if re.match('\d+' + measure, size, re.IGNORECASE):
+        if re.match(r'\d+' + measure, size, re.IGNORECASE):
             intsize = int(size.rstrip(measure)) * ranges[measure]
             return intsize
 
@@ -262,7 +261,6 @@ def device_def(dev_type, host, dev_port, devicename, zone):
          ('SWIFT_RING_ACCOUNT_DEVICES', 'ring_account_device', 6002)]):
         swift_dev_details = dict()
         host = utils.force_ip(config['CONFIG_STORAGE_HOST_URL'])
-        fstype = config["CONFIG_SWIFT_STORAGE_FSTYPE"]
         for device in devices:
             devicename = device['device_name']
             key = "dev_%s_%s" % (host, devicename)
diff --git a/packstack/plugins/trove_850.py b/packstack/plugins/trove_850.py
index e27598b98..a6e23b02b 100644
--- a/packstack/plugins/trove_850.py
+++ b/packstack/plugins/trove_850.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/packstack/puppet/modules/packstack/Gemfile b/packstack/puppet/modules/packstack/Gemfile
index 5c7ec5e83..41a1cae68 100644
--- a/packstack/puppet/modules/packstack/Gemfile
+++ b/packstack/puppet/modules/packstack/Gemfile
@@ -2,9 +2,9 @@ source 'https://rubygems.org'
 
 group :development, :test do
   gem 'puppetlabs_spec_helper', :require => false
-  gem 'puppet-lint', '~> 0.3.2'
-  gem 'rake', '10.1.1'
-  gem 'rspec', '< 2.99'
+  gem 'puppet-lint', '>= 1.0.0'
+  gem 'rake', '< 13.0.0'
+  gem 'rspec'
 end
 
 if puppetversion = ENV['PUPPET_GEM_VERSION']
diff --git a/packstack/puppet/modules/packstack/lib/facter/mariadb.rb b/packstack/puppet/modules/packstack/lib/facter/mariadb.rb
deleted file mode 100644
index f2c35f276..000000000
--- a/packstack/puppet/modules/packstack/lib/facter/mariadb.rb
+++ /dev/null
@@ -1,14 +0,0 @@
-
-# Check if mariadb provides galera server
-
-Facter.add(:mariadb_provides_galera) do
-  setcode do
-    if Facter.value(:operatingsystem) == 'Fedora' and Facter.value(:operatingsystemmajrelease).to_i > 22
-      command = 'dnf repoquery --whatprovides mariadb-galera-server'
-    else
-      command = 'repoquery --whatprovides mariadb-galera-server'
-    end
-    output = Facter::Util::Resolution.exec(command)
-    (output =~ /mariadb-server-galera.*/) != nil
-  end
-end
diff --git a/packstack/puppet/modules/packstack/lib/facter/netns.py b/packstack/puppet/modules/packstack/lib/facter/netns.py
deleted file mode 100644
index e8bd553be..000000000
--- a/packstack/puppet/modules/packstack/lib/facter/netns.py
+++ /dev/null
@@ -1,218 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-import contextlib
-import inspect
-import os
-import random
-import subprocess
-import sys
-import tempfile
-import uuid
-import unittest
-
-
-def execute(cmd_string, check_error=True, return_code=0, input=None,
-            block=True, error_msg='Error executing cmd'):
-    print(cmd_string)
-    cmd = cmd_string.split(' ')
-    proc = subprocess.Popen(cmd,
-                            stdin=subprocess.PIPE,
-                            stdout=subprocess.PIPE,
-                            stderr=subprocess.PIPE)
-    if input:
-        proc.communicate(input=input)
-    elif block:
-        proc.wait()
-    if (check_error and
-            proc.returncode is not None and
-            proc.returncode != return_code):
-        msg = """
-%(error_msg)s
- Command: %(cmd)s
- Exit Code: %(code)s
-""".strip() % dict(cmd=' '.join(cmd),
-                   code=proc.returncode,
-                   error_msg=error_msg)
-        if input:
-            msg += "\n Stdin: %s" % input
-        if not proc.stdout.closed:
-            msg += "\n Stdout: %s" % proc.stdout.read()
-        if not proc.stderr.closed:
-            msg += "\n Stderr: %s" % proc.stderr.read()
-        raise Exception(msg)
-    return proc
-
-
-def e(cmd, prefix='ip netns exec ', sudo=False, **kwargs):
-    frame_locals = inspect.getargvalues(sys._getframe(1))[3]
-    if sudo:
-        prefix = 'sudo ' + prefix
-    return execute(prefix + cmd % frame_locals, **kwargs)
-
-
-def rand_name(name='test'):
-    return '%s-%s' % (name, str(random.randint(1, 0x7fffffff)))
-
-
-@contextlib.contextmanager
-def add_namespace():
-    name = rand_name('testns')
-    try:
-        e('ip netns add %(name)s', prefix='')
-        e('%(name)s ip link set lo up')
-        yield name
-    finally:
-        e('ip netns delete %(name)s', prefix='')
-
-
-@contextlib.contextmanager
-def add_namespaces():
-    with add_namespace() as ns1:
-        with add_namespace() as ns2:
-            yield ns1, ns2
-
-
-def add_veth_pair(ns1, ns2, veth1, veth2, address1, address2):
-    e('ip link add %(veth1)s netns %(ns1)s type veth '
-      'peer name %(veth2)s netns %(ns2)s', prefix='')
-    e('%(ns1)s ip link show %(veth1)s')
-    e('%(ns2)s ip link show %(veth2)s')
-    e('%(ns1)s ip -4 addr add %(address1)s/24 brd 255.255.255.0 '
-      'scope global dev %(veth1)s')
-    e('%(ns2)s ip -4 addr add %(address2)s/24 brd 255.255.255.0 '
-      'scope global dev %(veth2)s')
-    e('%(ns1)s ip link set %(veth1)s up')
-    e('%(ns2)s ip link set %(veth2)s up')
-
-
-class TestNetns(unittest.TestCase):
-
-    def test_neutron_netns_cmds(self):
-        """Exercise the netns functionality required by neutron.
-
-          - Check that a veth pair can be configured to transit traffic
-            between 2 namespaces
-          - Check that iptables filtering can be configured
-          - Check that iptables routing can be configured
-
-        """
-        # Naming scheme [resource][id]_[namespace id]
-        veth1_1 = 'veth1_1'
-        veth1_2 = 'veth1_2'
-        address1_1 = '192.168.0.1'
-        address1_2 = '192.168.0.2'
-        with add_namespaces() as (ns1, ns2):
-            # Check that inter-namespace connectivity can be established
-            add_veth_pair(ns1, ns2, veth1_1, veth1_2, address1_1, address1_2)
-            e('%(ns1)s ip link list')
-            e('%(ns1)s ip link show %(veth1_1)s')
-            e('%(ns1)s arping -A -U -I %(veth1_1)s '
-              '-c 1 %(address1_1)s')
-            e('%(ns2)s route add default gw %(address1_1)s')
-            e('%(ns2)s ping -c 1 -w 1 %(address1_1)s')
-            e('ping -c 1 -w 1 %(address1_1)s', prefix='', return_code=1,
-              error_msg='Namespace isolation not supported!')
-
-            # Check that iptables filtering and save/restore can be performed
-            try:
-                iptables_filename = os.path.join(
-                    tempfile.gettempdir(),
-                    'iptables-%s' % str(uuid.uuid4()))
-                e('%%(ns1)s iptables-save > %s' % iptables_filename)
-                e('%(ns1)s iptables -A INPUT -p icmp --icmp-type 8 -j DROP')
-                e('%(ns2)s ping -c 1 -w 1 %(address1_1)s', return_code=1)
-                e('%%(ns1)s iptables-restore < %s' % iptables_filename)
-                e('%(ns2)s ping -c 1 -w 1 %(address1_1)s')
-            finally:
-                if os.path.exists(iptables_filename):
-                    os.unlink(iptables_filename)
-
-            # Create another namespace (ns3) that is connected to ns1
-            # via a different subnet, so that traffic between ns3 and
-            # ns2 will have to be routed by ns1:
-            #
-            #  ns2 <- 192.168.0.0/24 -> ns1 <- 192.168.1.0/24 -> ns3
-            #
-            with add_namespace() as ns3:
-                veth2_1 = 'veth2_1'
-                veth2_3 = 'veth2_3'
-                address2_1 = '192.168.1.1'
-                address2_3 = '192.168.1.2'
-                add_veth_pair(ns1, ns3, veth2_1, veth2_3,
-                              address2_1, address2_3)
-                e('%(ns1)s sysctl -w net.ipv4.ip_forward=1')
-                e('%(ns1)s iptables -t nat -A POSTROUTING -o %(veth2_1)s -j '
-                  'MASQUERADE')
-                e('%(ns1)s iptables -A FORWARD -i %(veth2_1)s -o %(veth1_1)s '
-                  '-m state --state RELATED,ESTABLISHED -j ACCEPT')
-                e('%(ns1)s iptables -A FORWARD -i %(veth1_1)s -o %(veth2_1)s '
-                  '-j ACCEPT')
-                e('%(ns2)s ping -c 1 -w 1 %(address2_3)s')
-
-            # Check that links can be torn down
-            e('%(ns1)s ip -4 addr del %(address1_1)s/24 '
-              'dev %(veth1_1)s')
-            e('%(ns1)s ip link delete %(veth1_1)s')
-
-    def test_domain_socket_access(self):
-        """Check that a domain socket can be accessed regardless of namespace.
-
-        Neutron extends nova' metadata service - which identifies VM's
-        by their ip addresses - to configurations with overlapping
-        ips.  Support is provided by:
-
-          - a proxy in each namespace (neutron-ns-metadata-proxy)
-
-            - the proxy can uniquely identify a given VM by its ip
-              address in the context of the router or network of the
-              namespace.
-
-          - a metadata agent (neutron-metadata-agent) that forwards
-            requests from the namespace proxies to nova's metadata
-            service.
-
-        Communication between the proxies and the agent is over a unix
-        domain socket.  It is necessary that access to a domain socket
-        not be restricted by namespace, or such communication will not
-        be possible.
-
-        """
-        try:
-            execute('which nc')
-        except Exception:
-            self.fail("The 'nc' command is not available - please install it.")
-
-        sock_filename = os.path.join(tempfile.gettempdir(),
-                                     'testsock-%s' % str(uuid.uuid4()))
-        server = None
-        try:
-            # Create a server in the root namespace attached to a domain socket
-            server = e('nc -lU %(sock_filename)s', sudo=False, prefix='',
-                       block=False)
-            # Attempt to connect to the domain socket from within a namespace
-            with add_namespace() as ns:
-                e('%(ns)s nc -U %(sock_filename)s', input='magic',
-                  error_msg='Unable to communicate between namespaces via '
-                            'domain sockets.')
-        finally:
-            if server:
-                server.kill()
-            if os.path.exists(sock_filename):
-                os.unlink(sock_filename)
-
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/packstack/puppet/modules/packstack/lib/facter/netns_support.rb b/packstack/puppet/modules/packstack/lib/facter/netns_support.rb
deleted file mode 100644
index 783dd3375..000000000
--- a/packstack/puppet/modules/packstack/lib/facter/netns_support.rb
+++ /dev/null
@@ -1,16 +0,0 @@
-Facter.add(:netns_support) do
-  setcode do
-    oldout = $stdout.clone
-    olderr = $stderr.clone
-    $stdout.reopen("/dev/null", "w")
-    $stderr.reopen("/dev/null", "w")
-
-    script_path = File.join(File.dirname(__FILE__), 'netns.py')
-    passed = system "python #{script_path}"
-
-    $stdout.reopen(oldout)
-    $stderr.reopen(olderr)
-
-    passed
-  end
-end
diff --git a/packstack/puppet/modules/packstack/lib/puppet/functions/parse_hash_from_string.rb b/packstack/puppet/modules/packstack/lib/puppet/functions/parse_hash_from_string.rb
new file mode 100644
index 000000000..c03797ed1
--- /dev/null
+++ b/packstack/puppet/modules/packstack/lib/puppet/functions/parse_hash_from_string.rb
@@ -0,0 +1,12 @@
+Puppet::Functions.create_function(:parse_hash_from_string) do
+  def parse_hash_from_string(*args)
+    if args.length > 1
+      raise Puppet::Error, 'Argument must be one'
+    elsif !(args[0].kind_of?(String))
+      raise Puppet::Error, 'Argument must be a string'
+    end
+
+    value = args[0]
+    return Hash[value.scan(/(\S+)='([^']*)'/)]
+  end
+end
diff --git a/packstack/puppet/modules/packstack/lib/puppet/parser/functions/hiera_undef.rb b/packstack/puppet/modules/packstack/lib/puppet/parser/functions/hiera_undef.rb
deleted file mode 100644
index cf6881895..000000000
--- a/packstack/puppet/modules/packstack/lib/puppet/parser/functions/hiera_undef.rb
+++ /dev/null
@@ -1,21 +0,0 @@
-# Copyright (c) 2013 puppet@camptocamp.com All rights reserved.
-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-
-#    http://www.apache.org/licenses/LICENSE-2.0
-
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-module Puppet::Parser::Functions
-  newfunction(:hiera_undef, :type => :rvalue) do |*args|
-    require 'hiera_puppet'
-    key, override = HieraPuppet.parse_args(args)
-    HieraPuppet.lookup(key, :undef, self, override, :priority)
-  end
-end
diff --git a/packstack/puppet/modules/packstack/manifests/amqp.pp b/packstack/puppet/modules/packstack/manifests/amqp.pp
index b271367f1..69ce90cb2 100644
--- a/packstack/puppet/modules/packstack/manifests/amqp.pp
+++ b/packstack/puppet/modules/packstack/manifests/amqp.pp
@@ -1,86 +1,26 @@
-define packstack::amqp::enable_rabbitmq {
-  create_resources(packstack::firewall, hiera('FIREWALL_AMQP_RULES', {}))
-  $amqp_enable_ssl = hiera('CONFIG_AMQP_SSL_ENABLED')
-
-  if $amqp_enable_ssl {
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
-    $kombu_ssl_keyfile = '/etc/pki/tls/private/ssl_amqp.key'
-    $kombu_ssl_certfile = '/etc/pki/tls/certs/ssl_amqp.crt'
-
-    $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
-    file { $files_to_set_owner:
-      owner   => 'rabbitmq',
-      group   => 'rabbitmq',
-      require => Package['rabbitmq-server'],
-      notify  => Service['rabbitmq-server'],
-    }
-
-    file { $kombu_ssl_ca_certs:
-      mode   => '0644',
-      require => Package['rabbitmq-server'],
-      notify  => Service['rabbitmq-server'],
-    }
-
-    class { '::rabbitmq':
-      port                     => undef,
-      ssl_port                 => 0 + hiera('CONFIG_AMQP_CLIENTS_PORT'),
-      ssl_only                 => true,
-      ssl                      => true,
-      ssl_cacert               => $kombu_ssl_ca_certs,
-      ssl_cert                 => $kombu_ssl_certfile,
-      ssl_key                  => $kombu_ssl_keyfile,
-      default_user             => hiera('CONFIG_AMQP_AUTH_USER'),
-      default_pass             => hiera('CONFIG_AMQP_AUTH_PASSWORD'),
-      package_provider         => 'yum',
-      repos_ensure             => false,
-      admin_enable             => false,
-      loopback_users           => [],
-      # FIXME: it's ugly to not to require client certs
-      ssl_fail_if_no_peer_cert => true,
-      config_ranch             => false,
-      tcp_keepalive            => true,
-      tcp_backlog              => 128,
-    }
-  } else {
-    class { '::rabbitmq':
-      port             => 0 + hiera('CONFIG_AMQP_CLIENTS_PORT'),
-      ssl              => false,
-      default_user     => hiera('CONFIG_AMQP_AUTH_USER'),
-      default_pass     => hiera('CONFIG_AMQP_AUTH_PASSWORD'),
-      package_provider => 'yum',
-      repos_ensure     => false,
-      admin_enable     => false,
-      loopback_users   => [],
-      config_ranch             => false,
-      tcp_keepalive            => true,
-      tcp_backlog              => 128,
-    }
-  }
-}
-
 class packstack::amqp ()
 {
-     $amqp = hiera('CONFIG_AMQP_BACKEND')
+  $amqp = lookup('CONFIG_AMQP_BACKEND')
 
-     case $amqp  {
-       'rabbitmq': {
-         packstack::amqp::enable_rabbitmq { 'rabbitmq': }
+  case $amqp  {
+    'rabbitmq': {
+      packstack::amqp::enable_rabbitmq { 'rabbitmq': }
 
-          # The following kernel parameters help alleviate some RabbitMQ
-          # connection issues
+        # The following kernel parameters help alleviate some RabbitMQ
+        # connection issues
 
-          sysctl::value { 'net.ipv4.tcp_keepalive_intvl':
-            value => '1',
-          }
+        sysctl::value { 'net.ipv4.tcp_keepalive_intvl':
+          value => '1',
+        }
 
-          sysctl::value { 'net.ipv4.tcp_keepalive_probes':
-            value => '5',
-          }
+        sysctl::value { 'net.ipv4.tcp_keepalive_probes':
+          value => '5',
+        }
 
-          sysctl::value { 'net.ipv4.tcp_keepalive_time':
-            value => '5',
-          }
-       }
-       default: {}
-     }
+        sysctl::value { 'net.ipv4.tcp_keepalive_time':
+          value => '5',
+        }
+    }
+    default: {}
+  }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/amqp/enable_rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/amqp/enable_rabbitmq.pp
new file mode 100644
index 000000000..2060e6154
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/amqp/enable_rabbitmq.pp
@@ -0,0 +1,59 @@
+define packstack::amqp::enable_rabbitmq {
+  create_resources(packstack::firewall, lookup('FIREWALL_AMQP_RULES', undef, undef, {}))
+  $amqp_enable_ssl = lookup('CONFIG_AMQP_SSL_ENABLED')
+
+  if $amqp_enable_ssl {
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = '/etc/pki/tls/private/ssl_amqp.key'
+    $kombu_ssl_certfile = '/etc/pki/tls/certs/ssl_amqp.crt'
+
+    $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+    file { $files_to_set_owner:
+      owner   => 'rabbitmq',
+      group   => 'rabbitmq',
+      require => Package['rabbitmq-server'],
+      notify  => Service['rabbitmq-server'],
+    }
+
+    file { $kombu_ssl_ca_certs:
+      mode    => '0644',
+      require => Package['rabbitmq-server'],
+      notify  => Service['rabbitmq-server'],
+    }
+
+    class { 'rabbitmq':
+      port                     => undef,
+      ssl_port                 => 0 + lookup('CONFIG_AMQP_CLIENTS_PORT'),
+      ssl_only                 => true,
+      ssl                      => true,
+      ssl_cacert               => $kombu_ssl_ca_certs,
+      ssl_cert                 => $kombu_ssl_certfile,
+      ssl_key                  => $kombu_ssl_keyfile,
+      default_user             => lookup('CONFIG_AMQP_AUTH_USER'),
+      default_pass             => lookup('CONFIG_AMQP_AUTH_PASSWORD'),
+      package_provider         => 'yum',
+      repos_ensure             => false,
+      admin_enable             => false,
+      loopback_users           => [],
+      ssl_verify               => 'verify_peer',
+      ssl_fail_if_no_peer_cert => true,
+      config_ranch             => false,
+      tcp_keepalive            => true,
+      tcp_backlog              => 128,
+    }
+  } else {
+    class { 'rabbitmq':
+      port             => 0 + lookup('CONFIG_AMQP_CLIENTS_PORT'),
+      ssl              => false,
+      default_user     => lookup('CONFIG_AMQP_AUTH_USER'),
+      default_pass     => lookup('CONFIG_AMQP_AUTH_PASSWORD'),
+      package_provider => 'yum',
+      repos_ensure     => false,
+      admin_enable     => false,
+      loopback_users   => [],
+      config_ranch     => false,
+      tcp_keepalive    => true,
+      tcp_backlog      => 128,
+    }
+  }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/aodh.pp b/packstack/puppet/modules/packstack/manifests/aodh.pp
index 6fa2858b5..6667b41c9 100644
--- a/packstack/puppet/modules/packstack/manifests/aodh.pp
+++ b/packstack/puppet/modules/packstack/manifests/aodh.pp
@@ -1,41 +1,47 @@
 class packstack::aodh ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_AODH_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_AODH_RULES', undef, undef, {}))
 
-    $config_aodh_coordination_backend = hiera('CONFIG_CEILOMETER_COORDINATION_BACKEND')
+    $config_aodh_coordination_backend = lookup('CONFIG_CEILOMETER_COORDINATION_BACKEND')
 
     if $config_aodh_coordination_backend == 'redis' {
-      $redis_host = hiera('CONFIG_REDIS_HOST_URL')
-      $redis_port = hiera('CONFIG_REDIS_PORT')
-      $coordination_url = "redis://${redis_host}:${redis_port}"
+      $coordination_url = os_url({
+        'scheme' => 'redis',
+        'host'   => lookup('CONFIG_REDIS_HOST_URL'),
+        'port'   => lookup('CONFIG_REDIS_PORT'),
+      })
+      Service<| title == 'redis' |> -> Anchor['aodh::service::begin']
     } else {
-      $coordination_url = ''
+      $coordination_url = undef
     }
 
-    class { '::aodh::keystone::authtoken':
-      password => hiera('CONFIG_AODH_KS_PW'),
-      auth_url => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+    class { 'aodh::keystone::authtoken':
+      password             => lookup('CONFIG_AODH_KS_PW'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
-    class { '::aodh::api':
+    class { 'aodh::api':
       enabled      => true,
       service_name => 'httpd',
       sync_db      => true,
     }
 
-    class { '::aodh::wsgi::apache':
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
+    class { 'aodh::wsgi::apache':
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
       ssl     => false
     }
 
-    class { '::aodh::auth':
-      auth_password => hiera('CONFIG_AODH_KS_PW'),
-      auth_url => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+    class { 'aodh::service_credentials':
+      password    => lookup('CONFIG_AODH_KS_PW'),
+      auth_url    => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      region_name => lookup('CONFIG_KEYSTONE_REGION'),
     }
-    class { '::aodh::evaluator':
-      coordination_url => $coordination_url,
+    class { 'aodh::coordination':
+      backend_url => $coordination_url,
     }
-    class { '::aodh::notifier': }
-    class { '::aodh::listener': }
-    class { '::aodh::client': }
+    class { 'aodh::evaluator': }
+    class { 'aodh::notifier': }
+    class { 'aodh::listener': }
+    class { 'aodh::client': }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/aodh/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/aodh/rabbitmq.pp
index 89aadde6b..72b4ef279 100644
--- a/packstack/puppet/modules/packstack/manifests/aodh/rabbitmq.pp
+++ b/packstack/puppet/modules/packstack/manifests/aodh/rabbitmq.pp
@@ -1,17 +1,8 @@
 class packstack::aodh::rabbitmq ()
 {
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_AODH_SSL_KEY', undef)
-    $kombu_ssl_certfile = hiera('CONFIG_AODH_SSL_CERT', undef)
-
-    $aodh_db_pw = hiera('CONFIG_AODH_DB_PW')
-    $aodh_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
-
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
-
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_AODH_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_AODH_SSL_CERT', undef, undef, undef)
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -22,17 +13,33 @@
       }
       File[$files_to_set_owner] ~> Service<| tag == 'aodh-service' |>
     }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'aodh-service' |>
+
+    class { 'aodh::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
 
-    class { '::aodh::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'aodh::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'aodh',
+        'password' => lookup('CONFIG_AODH_DB_PW'),
+        'database' => 'aodh',
+      })
     }
 
-    class { '::aodh':
-      rabbit_use_ssl     => hiera('CONFIG_AMQP_SSL_ENABLED'),
-      default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      kombu_ssl_ca_certs => $kombu_ssl_ca_certs,
-      kombu_ssl_keyfile  => $kombu_ssl_keyfile,
-      kombu_ssl_certfile => $kombu_ssl_certfile,
-      database_connection => "mysql+pymysql://aodh:${aodh_db_pw}@${aodh_mariadb_host}/aodh",
+    class { 'aodh':
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/apache.pp b/packstack/puppet/modules/packstack/manifests/apache.pp
index 6013d8bab..487bb9184 100644
--- a/packstack/puppet/modules/packstack/manifests/apache.pp
+++ b/packstack/puppet/modules/packstack/manifests/apache.pp
@@ -1,51 +1,5 @@
 class packstack::apache ()
 {
-    # Use python3 for mod_wsg in fedora
-    if ($::operatingsystem == 'Fedora') or ($::osfamily == 'RedHat' and Integer.new($::operatingsystemmajrelease) > 7)  {
-      class { '::apache':
-        purge_configs => false,
-        mod_packages => merge($::apache::params::mod_packages, {
-          'wsgi' => 'python3-mod_wsgi',
-        }),
-        mod_libs     => merge($::apache::params::mod_libs, {
-          'wsgi' => 'mod_wsgi_python3.so',
-        })
-      }
-    }else{
-      class {'::apache':
-        purge_configs => false,
-      }
-    }
-
-    if hiera('CONFIG_HORIZON_SSL')  == 'y' {
-      ensure_packages(['mod_ssl'], {'ensure' => 'present'})
-      Package['mod_ssl'] -> Class['::apache']
-      apache::listen { '443': }
-    }
-
-    # Keystone port
-    apache::listen { '5000': }
-
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
-      if hiera('CONFIG_CEILOMETER_SERVICE_NAME') == 'httpd' {
-        # Ceilometer port
-        apache::listen { '8777': }
-      }
-    }
-
-    if hiera('CONFIG_AODH_INSTALL') == 'y' {
-      # Aodh port
-      apache::listen { '8042': }
-    }
-
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
-      # Gnocchi port
-      apache::listen { '8041': }
-    }
-
-    if hiera('CONFIG_PANKO_INSTALL') == 'y' {
-      # Panko port
-      apache::listen { '8977': }
-    }
+    class { 'apache': }
 }
 
diff --git a/packstack/puppet/modules/packstack/manifests/ceilometer.pp b/packstack/puppet/modules/packstack/manifests/ceilometer.pp
index f8e4d79f7..bb22ea607 100644
--- a/packstack/puppet/modules/packstack/manifests/ceilometer.pp
+++ b/packstack/puppet/modules/packstack/manifests/ceilometer.pp
@@ -1,62 +1,44 @@
 class packstack::ceilometer ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_CEILOMETER_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_CEILOMETER_RULES', undef, undef, {}))
 
-    $config_ceilometer_coordination_backend = hiera('CONFIG_CEILOMETER_COORDINATION_BACKEND')
+    $config_ceilometer_coordination_backend = lookup('CONFIG_CEILOMETER_COORDINATION_BACKEND')
 
-    $config_gnocchi_host = hiera('CONFIG_KEYSTONE_HOST_URL')
-
-    if ($::operatingsystem == 'Fedora') or
-       ($::osfamily == 'RedHat' and Integer.new($::operatingsystemmajrelease) > 7) {
-      $pyvers = '3'
-    } else {
-      $pyvers = ''
-    }
+    $config_gnocchi_host = lookup('CONFIG_KEYSTONE_HOST_URL')
 
     if $config_ceilometer_coordination_backend == 'redis' {
-      $redis_host = hiera('CONFIG_REDIS_HOST_URL')
-      $redis_port = hiera('CONFIG_REDIS_PORT')
-      $coordination_url = "redis://${redis_host}:${redis_port}"
-
-      ensure_resource('package', "python-redis", {
-        name   => "python${pyvers}-redis",
-        tag    => 'openstack',
+      $coordination_url = os_url({
+        'scheme' => 'redis',
+        'host'   => lookup('CONFIG_REDIS_HOST_URL'),
+        'port'   => lookup('CONFIG_REDIS_PORT'),
       })
+      Service<| title == 'redis' |> -> Anchor['ceilometer::service::begin']
     } else {
-      $coordination_url = ''
+      $coordination_url = undef
     }
 
-    include ::ceilometer
+    include ceilometer
 
-    exec {'ceilometer-db-upgrade':
-      command   => 'ceilometer-upgrade',
-      path      => ['/usr/bin', '/usr/sbin'],
-      try_sleep => 10,
-      tries     => 20
-    }
+    include ceilometer::db::sync
 
-    Keystone::Resource::Service_identity<||> -> Exec['ceilometer-db-upgrade'] ~>
-      Service['ceilometer-agent-notification']
+    Keystone::Resource::Service_identity<||> -> Anchor['ceilometer::dbsync::begin']
 
-    class { '::ceilometer::agent::notification':
+    class { 'ceilometer::agent::notification':
       manage_event_pipeline     => true,
-      event_pipeline_publishers => ["gnocchi://", "panko://"],
+      event_pipeline_publishers => ['gnocchi://'],
     }
 
-    class { '::ceilometer::agent::auth':
-      auth_url      => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      auth_password => hiera('CONFIG_CEILOMETER_KS_PW'),
-      auth_region   => hiera('CONFIG_KEYSTONE_REGION'),
+    class { 'ceilometer::agent::service_credentials':
+      auth_url    => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      password    => lookup('CONFIG_CEILOMETER_KS_PW'),
+      region_name => lookup('CONFIG_KEYSTONE_REGION'),
     }
 
-    class { '::ceilometer::agent::polling':
-      manage_polling    => true,
-      coordination_url => $coordination_url,
+    class { 'ceilometer::coordination':
+      backend_url => $coordination_url,
     }
 
-    class { '::ceilometer::keystone::authtoken':
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
-      password             => hiera('CONFIG_CEILOMETER_KS_PW'),
+    class { 'ceilometer::agent::polling':
+      manage_polling   => true,
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/ceilometer/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/ceilometer/rabbitmq.pp
index 826f61724..53f55a0a2 100644
--- a/packstack/puppet/modules/packstack/manifests/ceilometer/rabbitmq.pp
+++ b/packstack/puppet/modules/packstack/manifests/ceilometer/rabbitmq.pp
@@ -1,13 +1,8 @@
 class packstack::ceilometer::rabbitmq ()
 {
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_CEILOMETER_SSL_KEY', undef)
-    $kombu_ssl_certfile = hiera('CONFIG_CEILOMETER_SSL_CERT', undef)
-
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_CEILOMETER_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_CEILOMETER_SSL_CERT', undef, undef, undef)
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -18,17 +13,24 @@
       }
       File[$files_to_set_owner] ~> Service<| tag == 'ceilometer-service' |>
     }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'ceilometer-service' |>
 
-    class { '::ceilometer::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'ceilometer::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
-    class { '::ceilometer':
-      telemetry_secret   => hiera('CONFIG_CEILOMETER_SECRET'),
-      rabbit_use_ssl     => hiera('CONFIG_AMQP_SSL_ENABLED'),
-      default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      kombu_ssl_ca_certs => $kombu_ssl_ca_certs,
-      kombu_ssl_keyfile  => $kombu_ssl_keyfile,
-      kombu_ssl_certfile => $kombu_ssl_certfile,
+    class { 'ceilometer':
+      telemetry_secret      => lookup('CONFIG_CEILOMETER_SECRET'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/chrony.pp b/packstack/puppet/modules/packstack/manifests/chrony.pp
index ec7d68329..131406085 100644
--- a/packstack/puppet/modules/packstack/manifests/chrony.pp
+++ b/packstack/puppet/modules/packstack/manifests/chrony.pp
@@ -1,7 +1,7 @@
 class packstack::chrony ()
 {
-    $cfg_ntp_server_def = hiera('CONFIG_NTP_SERVER_DEF')
-    $cfg_ntp_servers    = hiera('CONFIG_NTP_SERVERS')
+    $cfg_ntp_server_def = lookup('CONFIG_NTP_SERVER_DEF')
+    $cfg_ntp_servers    = lookup('CONFIG_NTP_SERVERS')
 
     $config_content = "
     # Use public servers from the pool.ntp.org project.
@@ -54,11 +54,6 @@
       name   => 'chrony',
     }
 
-    package { 'ntpdate':
-      ensure => 'installed',
-      name   => 'ntpdate',
-    }
-
     file { 'chrony_conf':
       ensure  => file,
       path    => '/etc/chrony.conf',
@@ -72,14 +67,8 @@
       onlyif  => 'systemctl status chronyd.service'
     }
 
-    # for cases where ntpd is running instead of default chronyd
-    service { 'ntpd':
-      ensure => stopped,
-      enable => false,
-    }
-
     exec { 'ntpdate':
-      command => "/usr/sbin/ntpdate ${cfg_ntp_servers}",
+      command => "/usr/bin/chronyc makestep",
       tries   => 3,
     }
 
@@ -91,11 +80,9 @@
       hasrestart => true,
     }
 
-    Package['chrony'] ->
-    Package['ntpdate'] ->
-    File['chrony_conf'] ->
-    Exec['stop-chronyd'] ->
-    Service['ntpd'] ->
-    Exec['ntpdate'] ->
-    Service['chronyd']
+    Package['chrony']
+    -> File['chrony_conf']
+    -> Exec['stop-chronyd']
+    -> Service['chronyd']
+    -> Exec['ntpdate']
 }
diff --git a/packstack/puppet/modules/packstack/manifests/cinder.pp b/packstack/puppet/modules/packstack/manifests/cinder.pp
index b660fdf36..319542e5a 100644
--- a/packstack/puppet/modules/packstack/manifests/cinder.pp
+++ b/packstack/puppet/modules/packstack/manifests/cinder.pp
@@ -1,68 +1,66 @@
 class packstack::cinder ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_CINDER_RULES', {}))
-    create_resources(packstack::firewall, hiera('FIREWALL_CINDER_API_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_CINDER_RULES', undef, undef, {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_CINDER_API_RULES', undef, undef, {}))
 
-    $cinder_backends = hiera_array('CONFIG_CINDER_BACKEND')
+    $cinder_backends = lookup('CONFIG_CINDER_BACKEND', { merge => 'unique' })
 
     case $cinder_backends[0] {
-      'lvm':       { $default_volume_type = 'iscsi' }
-      'gluster':   { $default_volume_type = 'glusterfs' }
+      'lvm':       { $default_volume_type = 'lvm' }
       'nfs':       { $default_volume_type = 'nfs' }
-      'vmdk':      { $default_volume_type = 'vmdk' }
       'netapp':    { $default_volume_type = 'netapp' }
       'solidfire': { $default_volume_type = 'solidfire' }
-      default:     { $default_volume_type = 'iscsi' }
+      default:     { $default_volume_type = 'lvm' }
     }
 
-    cinder_config {
-      'DEFAULT/glance_host': value => hiera('CONFIG_STORAGE_HOST_URL');
-    }
-
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    class { '::cinder::keystone::authtoken':
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
-      password             => hiera('CONFIG_CINDER_KS_PW'),
+    class { 'cinder::keystone::authtoken':
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      password             => lookup('CONFIG_CINDER_KS_PW'),
     }
 
-    class { '::cinder::api':
-      bind_host               => $bind_host,
-      service_workers         => hiera('CONFIG_SERVICE_WORKERS'),
-      default_volume_type     => $default_volume_type,
+    class { 'cinder::api':
+      service_name        => 'httpd',
+      default_volume_type => $default_volume_type,
+    }
+    class { 'cinder::wsgi::apache':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
-    class { '::cinder::scheduler': }
+    class { 'cinder::scheduler': }
 
-    class { '::cinder::volume': }
+    class { 'cinder::volume': }
 
-    class { '::cinder::client': }
+    class { 'cinder::client': }
 
-    $cinder_keystone_admin_username = hiera('CONFIG_KEYSTONE_ADMIN_USERNAME')
-    $cinder_keystone_admin_password = hiera('CONFIG_KEYSTONE_ADMIN_PW')
-    $cinder_keystone_auth_url = hiera('CONFIG_KEYSTONE_PUBLIC_URL')
-    $cinder_keystone_api = hiera('CONFIG_KEYSTONE_API_VERSION')
+    class { 'cinder::glance': }
+
+    class { 'cinder::nova':
+      auth_type => 'password',
+      password  => lookup('CONFIG_NOVA_KS_PW'),
+      auth_url  => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
 
-    # Cinder::Type requires keystone credentials
-    Cinder::Type {
-      os_password    => hiera('CONFIG_CINDER_KS_PW'),
-      os_tenant_name => 'services',
-      os_username    => 'cinder',
-      os_auth_url    => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+    class { 'cinder::keystone::service_user':
+      send_service_user_token => true,
+      password                => lookup('CONFIG_CINDER_KS_PW'),
+      auth_url                => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
-    class { '::cinder::backends':
-      enabled_backends => hiera_array('CONFIG_CINDER_BACKEND'),
+    class { 'cinder::backends':
+      enabled_backends => lookup('CONFIG_CINDER_BACKEND', { merge => 'unique' }),
     }
 
-    $db_purge = hiera('CONFIG_CINDER_DB_PURGE_ENABLE')
+    $db_purge = lookup('CONFIG_CINDER_DB_PURGE_ENABLE')
     if $db_purge {
-      class { '::cinder::cron::db_purge':
+      class { 'cinder::cron::db_purge':
         hour        => '*/24',
         destination => '/dev/null',
         age         => 1
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/backend/gluster.pp b/packstack/puppet/modules/packstack/manifests/cinder/backend/gluster.pp
deleted file mode 100644
index 3d50b03c5..000000000
--- a/packstack/puppet/modules/packstack/manifests/cinder/backend/gluster.pp
+++ /dev/null
@@ -1,16 +0,0 @@
-class packstack::cinder::backend::gluster ()
-{
-    ensure_packages(['glusterfs-fuse'], {'ensure' => 'present'})
-
-    cinder::backend::glusterfs { 'gluster':
-      glusterfs_shares        => hiera_array('CONFIG_CINDER_GLUSTER_MOUNTS'),
-      require                 => Package['glusterfs-fuse'],
-      glusterfs_shares_config => '/etc/cinder/glusterfs_shares.conf',
-    }
-
-    cinder_type { 'glusterfs':
-      ensure     => present,
-      properties => ["volume_backend_name=gluster"],
-      require    => Class['cinder::api'],
-    }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/backend/lvm.pp b/packstack/puppet/modules/packstack/manifests/cinder/backend/lvm.pp
index 851cbe362..269d4fdac 100644
--- a/packstack/puppet/modules/packstack/manifests/cinder/backend/lvm.pp
+++ b/packstack/puppet/modules/packstack/manifests/cinder/backend/lvm.pp
@@ -1,69 +1,51 @@
 class packstack::cinder::backend::lvm ()
 {
-    $create_cinder_volume = hiera('CONFIG_CINDER_VOLUMES_CREATE')
-    $cinder_volume_name = hiera('CONFIG_CINDER_VOLUME_NAME')
+    $create_cinder_volume = lookup('CONFIG_CINDER_VOLUMES_CREATE')
+    $cinder_volume_name = lookup('CONFIG_CINDER_VOLUME_NAME')
 
     if $create_cinder_volume == 'y' {
         # Find an available loop device
         $loop_dev = chomp(generate('/usr/sbin/losetup', '-f'))
 
-        class { '::cinder::setup_test_volume':
-          size            => hiera('CONFIG_CINDER_VOLUMES_SIZE'),
+        class { 'cinder::setup_test_volume':
+          size            => lookup('CONFIG_CINDER_VOLUMES_SIZE'),
           loopback_device => $loop_dev,
           volume_path     => '/var/lib/cinder',
           volume_name     => $cinder_volume_name,
         }
 
-        # Add loop device on boot
-        $el_releases = ['RedHat', 'CentOS', 'Scientific']
-        if $::operatingsystem in $el_releases and (versioncmp($::operatingsystemmajrelease, '7') < 0) {
-
-          file_line{ 'rc.local_losetup_cinder_volume':
-            path  => '/etc/rc.d/rc.local',
-            match => "^.*/var/lib/cinder/$cinder_volume_name.*$",
-            line  => "losetup -f /var/lib/cinder/$cinder_volume_name && service openstack-cinder-volume restart",
-          }
-
-          file { '/etc/rc.d/rc.local':
-            mode  => '0755',
-          }
-
-        } else {
-
-          file { 'openstack-losetup':
-            path    => '/usr/lib/systemd/system/openstack-losetup.service',
-            before  => Service['openstack-losetup'],
-            notify  => Exec['reload systemd files for cinder-volume'],
-            content => "[Unit]
-    Description=Setup cinder-volume loop device
-    DefaultDependencies=false
-    Before=openstack-cinder-volume.service
-    After=local-fs.target
-
-    [Service]
-    Type=oneshot
-    ExecStart=/usr/bin/sh -c \'/usr/sbin/losetup -j /var/lib/cinder/$cinder_volume_name | /usr/bin/grep /var/lib/cinder/$cinder_volume_name || /usr/sbin/losetup -f /var/lib/cinder/$cinder_volume_name\'
-    ExecStop=/usr/bin/sh -c \'/usr/sbin/losetup -j /var/lib/cinder/$cinder_volume_name | /usr/bin/cut -d : -f 1 | /usr/bin/xargs /usr/sbin/losetup -d\'
-    TimeoutSec=60
-    RemainAfterExit=yes
-
-    [Install]
-    RequiredBy=openstack-cinder-volume.service",
-          }
-
-          exec { 'reload systemd files for cinder-volume':
-            command     => '/usr/bin/systemctl daemon-reload',
-            refreshonly => true,
-            before      => Service['openstack-losetup'],
-          }
-
-          service { 'openstack-losetup':
-            ensure  => running,
-            enable  => true,
-            require => Class['cinder::setup_test_volume'],
-          }
-
-        }
+        file { 'openstack-losetup':
+          path    => '/usr/lib/systemd/system/openstack-losetup.service',
+          before  => Service['openstack-losetup'],
+          notify  => Exec['reload systemd files for cinder-volume'],
+          content => "[Unit]
+Description=Setup cinder-volume loop device
+DefaultDependencies=false
+Before=openstack-cinder-volume.service
+After=local-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/sh -c \'/usr/sbin/losetup -j /var/lib/cinder/${cinder_volume_name} | /usr/bin/grep /var/lib/cinder/${cinder_volume_name} || /usr/sbin/losetup -f /var/lib/cinder/${cinder_volume_name}\'
+ExecStop=/usr/bin/sh -c \'/usr/sbin/losetup -j /var/lib/cinder/${cinder_volume_name} | /usr/bin/cut -d : -f 1 | /usr/bin/xargs /usr/sbin/losetup -d\'
+TimeoutSec=60
+RemainAfterExit=yes
+
+[Install]
+RequiredBy=openstack-cinder-volume.service",
+      }
+
+      exec { 'reload systemd files for cinder-volume':
+        command     => '/usr/bin/systemctl daemon-reload',
+        refreshonly => true,
+        before      => Service['openstack-losetup'],
+      }
+
+      service { 'openstack-losetup':
+        ensure  => running,
+        enable  => true,
+        require => Class['cinder::setup_test_volume'],
+      }
     }
     else {
         ensure_packages(['lvm2'], {'ensure' => 'present'})
@@ -85,14 +67,9 @@
     }
 
     cinder::backend::iscsi { 'lvm':
-      target_ip_address => hiera('CONFIG_STORAGE_HOST_URL'),
-      require           => Package['lvm2'],
-      volume_group      => $cinder_volume_name,
-    }
-
-    cinder_type { 'iscsi':
-      ensure     => present,
-      properties => ["volume_backend_name=lvm"],
-      require    => Class['cinder::api'],
+      target_ip_address  => lookup('CONFIG_STORAGE_HOST_URL'),
+      require            => Package['lvm2'],
+      volume_group       => $cinder_volume_name,
+      manage_volume_type => true,
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/backend/netapp.pp b/packstack/puppet/modules/packstack/manifests/cinder/backend/netapp.pp
index 1dee52cd8..be5fc13f6 100644
--- a/packstack/puppet/modules/packstack/manifests/cinder/backend/netapp.pp
+++ b/packstack/puppet/modules/packstack/manifests/cinder/backend/netapp.pp
@@ -1,40 +1,42 @@
 # Copyright (c) – 2014, Ryan Hefner.  All rights reserved.
 class packstack::cinder::backend::netapp ()
 {
-    $netapp_storage_family = hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY')
-    $netapp_storage_protocol = hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL')
+    $netapp_storage_family = lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY')
+    $netapp_storage_protocol = lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL')
     $netapp_backend_name = 'netapp'
 
     if $netapp_storage_family == 'ontap_cluster' {
       if $netapp_storage_protocol == 'nfs' {
         cinder::backend::netapp { $netapp_backend_name:
-          netapp_login              => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
-          netapp_password           => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
-          netapp_server_hostname    => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
-          netapp_server_port        => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-          netapp_storage_family     => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-          netapp_storage_protocol   => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-          netapp_transport_type     => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-          netapp_vserver            => hiera('CONFIG_CINDER_NETAPP_VSERVER'),
-          expiry_thres_minutes      => hiera('CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES'),
-          thres_avl_size_perc_start => hiera('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_START'),
-          thres_avl_size_perc_stop  => hiera('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_STOP'),
-          nfs_shares                => hiera_array('CONFIG_CINDER_NETAPP_NFS_SHARES'),
-          nfs_shares_config         => hiera('CONFIG_CINDER_NETAPP_NFS_SHARES_CONFIG'),
+          netapp_login              => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_password           => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_server_hostname    => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_port        => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_storage_family     => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_protocol   => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_transport_type     => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_vserver            => lookup('CONFIG_CINDER_NETAPP_VSERVER'),
+          expiry_thres_minutes      => lookup('CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES'),
+          thres_avl_size_perc_start => lookup('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_START'),
+          thres_avl_size_perc_stop  => lookup('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_STOP'),
+          nfs_shares                => lookup('CONFIG_CINDER_NETAPP_NFS_SHARES', { merge => 'unique' }),
+          nfs_shares_config         => lookup('CONFIG_CINDER_NETAPP_NFS_SHARES_CONFIG'),
+          manage_volume_type        => true,
         }
         ensure_packages(['nfs-utils'], {'ensure' => 'present'})
       }
       elsif $netapp_storage_protocol == 'iscsi' {
         cinder::backend::netapp { $netapp_backend_name:
-          netapp_login            => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
-          netapp_password         => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
-          netapp_server_hostname  => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
-          netapp_server_port      => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-          netapp_size_multiplier  => hiera('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
-          netapp_storage_family   => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-          netapp_storage_protocol => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-          netapp_transport_type   => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-          netapp_vserver          => hiera('CONFIG_CINDER_NETAPP_VSERVER'),
+          netapp_login            => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_password         => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_server_hostname  => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_port      => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_size_multiplier  => lookup('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
+          netapp_storage_family   => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_protocol => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_transport_type   => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_vserver          => lookup('CONFIG_CINDER_NETAPP_VSERVER'),
+          manage_volume_type      => true,
         }
 
         ensure_packages(['iscsi-initiator-utils'], {'ensure' => 'present'})
@@ -42,49 +44,52 @@
 
       elsif $netapp_storage_protocol == 'fc' {
         cinder::backend::netapp { $netapp_backend_name:
-          netapp_login            => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
-          netapp_password         => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
-          netapp_server_hostname  => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
-          netapp_server_port      => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-          netapp_size_multiplier  => hiera('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
-          netapp_storage_family   => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-          netapp_storage_protocol => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-          netapp_transport_type   => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-          netapp_vserver          => hiera('CONFIG_CINDER_NETAPP_VSERVER'),
+          netapp_login            => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_password         => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_server_hostname  => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_port      => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_size_multiplier  => lookup('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
+          netapp_storage_family   => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_protocol => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_transport_type   => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_vserver          => lookup('CONFIG_CINDER_NETAPP_VSERVER'),
+          manage_volume_type      => true,
         }
       }
     }
     elsif $netapp_storage_family == 'ontap_7mode' {
       if $netapp_storage_protocol == 'nfs' {
         cinder::backend::netapp { $netapp_backend_name:
-          netapp_login              => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
-          netapp_password           => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
-          netapp_server_hostname    => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
-          netapp_server_port        => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-          netapp_storage_family     => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-          netapp_storage_protocol   => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-          netapp_transport_type     => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-          expiry_thres_minutes      => hiera('CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES'),
-          thres_avl_size_perc_start => hiera('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_START'),
-          thres_avl_size_perc_stop  => hiera('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_STOP'),
-          nfs_shares                => hiera_array('CONFIG_CINDER_NETAPP_NFS_SHARES'),
-          nfs_shares_config         => hiera('CONFIG_CINDER_NETAPP_NFS_SHARES_CONFIG'),
+          netapp_login              => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_password           => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_server_hostname    => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_port        => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_storage_family     => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_protocol   => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_transport_type     => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          expiry_thres_minutes      => lookup('CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES'),
+          thres_avl_size_perc_start => lookup('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_START'),
+          thres_avl_size_perc_stop  => lookup('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_STOP'),
+          nfs_shares                => lookup('CONFIG_CINDER_NETAPP_NFS_SHARES', { merge => 'unique' }),
+          nfs_shares_config         => lookup('CONFIG_CINDER_NETAPP_NFS_SHARES_CONFIG'),
+          manage_volume_type        => true,
         }
 
         ensure_packages(['nfs-utils'], {'ensure' => 'present'})
       }
       elsif $netapp_storage_protocol == 'iscsi' {
         cinder::backend::netapp { $netapp_backend_name:
-          netapp_login            => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
-          netapp_password         => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
-          netapp_server_hostname  => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
-          netapp_server_port      => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-          netapp_size_multiplier  => hiera('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
-          netapp_storage_family   => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-          netapp_storage_protocol => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-          netapp_transport_type   => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-          netapp_vfiler           => hiera('CONFIG_CINDER_NETAPP_VFILER'),
-          netapp_volume_list      => hiera('CONFIG_CINDER_NETAPP_VOLUME_LIST'),
+          netapp_login            => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_password         => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_server_hostname  => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_port      => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_size_multiplier  => lookup('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
+          netapp_storage_family   => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_protocol => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_transport_type   => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_vfiler           => lookup('CONFIG_CINDER_NETAPP_VFILER'),
+          netapp_volume_list      => lookup('CONFIG_CINDER_NETAPP_VOLUME_LIST'),
+          manage_volume_type      => true,
         }
 
         ensure_packages(['iscsi-initiator-utils'], {'ensure' => 'present'})
@@ -92,42 +97,38 @@
 
       elsif $netapp_storage_protocol == 'fc' {
         cinder::backend::netapp { $netapp_backend_name:
-          netapp_login                => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
-          netapp_password             => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
-          netapp_server_hostname      => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
-          netapp_server_port          => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-          netapp_size_multiplier      => hiera('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
-          netapp_storage_family       => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-          netapp_storage_protocol     => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-          netapp_transport_type       => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-          netapp_vfiler               => hiera('CONFIG_CINDER_NETAPP_VFILER'),
-          netapp_partner_backend_name => hiera('CONFIG_CINDER_NETAPP_PARTNER_BACKEND_NAME'),
-          netapp_volume_list          => hiera('CONFIG_CINDER_NETAPP_VOLUME_LIST'),
+          netapp_login                => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_password             => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_server_hostname      => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_port          => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_size_multiplier      => lookup('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
+          netapp_storage_family       => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_protocol     => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_transport_type       => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_vfiler               => lookup('CONFIG_CINDER_NETAPP_VFILER'),
+          netapp_partner_backend_name => lookup('CONFIG_CINDER_NETAPP_PARTNER_BACKEND_NAME'),
+          netapp_volume_list          => lookup('CONFIG_CINDER_NETAPP_VOLUME_LIST'),
+          manage_volume_type          => true,
         }
       }
     }
     elsif $netapp_storage_family == 'eseries' {
       cinder::backend::netapp { $netapp_backend_name:
-        netapp_login             => hiera('CONFIG_CINDER_NETAPP_LOGIN'),
-        netapp_password          => hiera('CONFIG_CINDER_NETAPP_PASSWORD'),
-        netapp_server_hostname   => hiera('CONFIG_CINDER_NETAPP_HOSTNAME'),
-        netapp_server_port       => hiera('CONFIG_CINDER_NETAPP_SERVER_PORT'),
-        netapp_storage_family    => hiera('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
-        netapp_storage_protocol  => hiera('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
-        netapp_transport_type    => hiera('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
-        netapp_controller_ips    => hiera('CONFIG_CINDER_NETAPP_CONTROLLER_IPS'),
-        netapp_sa_password       => hiera('CONFIG_CINDER_NETAPP_SA_PASSWORD'),
-        netapp_storage_pools     => hiera('CONFIG_CINDER_NETAPP_STORAGE_POOLS'),
-        netapp_eseries_host_type => hiera('CONFIG_CINDER_NETAPP_ESERIES_HOST_TYPE'),
-        netapp_webservice_path   => hiera('CONFIG_CINDER_NETAPP_WEBSERVICE_PATH'),
+        netapp_login             => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+        netapp_password          => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+        netapp_server_hostname   => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+        netapp_server_port       => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+        netapp_storage_family    => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+        netapp_storage_protocol  => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+        netapp_transport_type    => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+        netapp_controller_ips    => lookup('CONFIG_CINDER_NETAPP_CONTROLLER_IPS'),
+        netapp_sa_password       => lookup('CONFIG_CINDER_NETAPP_SA_PASSWORD'),
+        netapp_storage_pools     => lookup('CONFIG_CINDER_NETAPP_STORAGE_POOLS'),
+        netapp_eseries_host_type => lookup('CONFIG_CINDER_NETAPP_ESERIES_HOST_TYPE'),
+        netapp_webservice_path   => lookup('CONFIG_CINDER_NETAPP_WEBSERVICE_PATH'),
+        manage_volume_type       => true,
       }
 
-        ensure_packages(['iscsi-initiator-utils'], {'ensure' => 'present'})
-    }
-
-    cinder_type { $netapp_backend_name:
-      ensure     => present,
-      properties => ["volume_backend_name=${netapp_backend_name}"],
-      require    => Class['cinder::api'],
+      ensure_packages(['iscsi-initiator-utils'], {'ensure' => 'present'})
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/backend/nfs.pp b/packstack/puppet/modules/packstack/manifests/cinder/backend/nfs.pp
index c379b0062..8b0010b33 100644
--- a/packstack/puppet/modules/packstack/manifests/cinder/backend/nfs.pp
+++ b/packstack/puppet/modules/packstack/manifests/cinder/backend/nfs.pp
@@ -3,14 +3,10 @@
     ensure_packages(['nfs-utils'], {'ensure' => 'present'})
 
     cinder::backend::nfs { 'nfs':
-      nfs_servers       => hiera_array('CONFIG_CINDER_NFS_MOUNTS'),
-      require           => Package['nfs-utils'],
-      nfs_shares_config => '/etc/cinder/nfs_shares.conf',
-    }
-
-    cinder_type { 'nfs':
-      ensure     => present,
-      properties => ["volume_backend_name=nfs"],
-      require   => Class['cinder::api'],
+      nfs_servers          => lookup('CONFIG_CINDER_NFS_MOUNTS', { merge => 'unique' }),
+      require              => Package['nfs-utils'],
+      nfs_shares_config    => '/etc/cinder/nfs_shares.conf',
+      nfs_snapshot_support => true,
+      manage_volume_type   => true,
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/backend/solidfire.pp b/packstack/puppet/modules/packstack/manifests/cinder/backend/solidfire.pp
index b779ad18c..1027238a8 100644
--- a/packstack/puppet/modules/packstack/manifests/cinder/backend/solidfire.pp
+++ b/packstack/puppet/modules/packstack/manifests/cinder/backend/solidfire.pp
@@ -4,17 +4,12 @@
     $solidfire_backend_name = 'solidfire'
 
     cinder::backend::solidfire { $solidfire_backend_name :
-        san_ip               => hiera('CONFIG_CINDER_SOLIDFIRE_LOGIN'),
-        san_login            => hiera('CONFIG_CINDER_SOLIDFIRE_PASSWORD'),
-        san_password         => hiera('CONFIG_CINDER_SOLIDFIRE_HOSTNAME'),
-        volume_backend_name  => $solidfire_backend_name,
+      san_ip              => lookup('CONFIG_CINDER_SOLIDFIRE_LOGIN'),
+      san_login           => lookup('CONFIG_CINDER_SOLIDFIRE_PASSWORD'),
+      san_password        => lookup('CONFIG_CINDER_SOLIDFIRE_HOSTNAME'),
+      volume_backend_name => $solidfire_backend_name,
+      manage_volume_type  => true,
     }
 
     ensure_packages(['iscsi-initiator-utils'], {'ensure' => 'present'})
-
-    cinder_type { $solidfire_backend_name:
-      ensure     => present,
-      properties => ["volume_backend_name=${solidfire_backend_name}"],
-      require    => Class['cinder::api'],
-    }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/backend/vmdk.pp b/packstack/puppet/modules/packstack/manifests/cinder/backend/vmdk.pp
deleted file mode 100644
index 021f0fce2..000000000
--- a/packstack/puppet/modules/packstack/manifests/cinder/backend/vmdk.pp
+++ /dev/null
@@ -1,14 +0,0 @@
-class packstack::cinder::backend::vmdk ()
-{
-    cinder::backend::vmdk { 'vmdk':
-      host_ip       => hiera('CONFIG_VCENTER_HOST'),
-      host_username => hiera('CONFIG_VCENTER_USER'),
-      host_password => hiera('CONFIG_VCENTER_PASSWORD'),
-    }
-
-    cinder_type { 'vmdk':
-      ensure     => present,
-      properties => ["volume_backend_name=vmdk"],
-      require    => Class['cinder::api'],
-    }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/backup.pp b/packstack/puppet/modules/packstack/manifests/cinder/backup.pp
index 4d4478aaa..33aa143e2 100644
--- a/packstack/puppet/modules/packstack/manifests/cinder/backup.pp
+++ b/packstack/puppet/modules/packstack/manifests/cinder/backup.pp
@@ -1,12 +1,11 @@
 class packstack::cinder::backup ()
 {
-    class { '::cinder::backup': }
+    class { 'cinder::backup': }
 
-    $cinder_backup_conf_ctrl_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $cinder_backup_conf_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
 
-    class { '::cinder::backup::swift':
-      backup_swift_url => "http://${cinder_backup_conf_ctrl_host}:8080/v1/AUTH_",
+    class { 'cinder::backup::swift':
+      backup_swift_url          => "http://${cinder_backup_conf_ctrl_host}:8080/v1/AUTH_",
+      backup_swift_service_auth => true
     }
-
-    Class['cinder::api'] ~> Service['cinder-backup']
 }
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/ceilometer.pp b/packstack/puppet/modules/packstack/manifests/cinder/ceilometer.pp
deleted file mode 100644
index a33e79117..000000000
--- a/packstack/puppet/modules/packstack/manifests/cinder/ceilometer.pp
+++ /dev/null
@@ -1,4 +0,0 @@
-class packstack::cinder::ceilometer ()
-{
-    class { '::cinder::ceilometer': }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/cinder/rabbitmq.pp
index f32f79873..ddcdcf2f3 100644
--- a/packstack/puppet/modules/packstack/manifests/cinder/rabbitmq.pp
+++ b/packstack/puppet/modules/packstack/manifests/cinder/rabbitmq.pp
@@ -1,16 +1,8 @@
 class packstack::cinder::rabbitmq ()
 {
-    $cinder_rab_cfg_cinder_db_pw = hiera('CONFIG_CINDER_DB_PW')
-    $cinder_rab_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
-
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_CINDER_SSL_KEY', undef)
-    $kombu_ssl_certfile = hiera('CONFIG_CINDER_SSL_CERT', undef)
-
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_CINDER_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_CINDER_SSL_CERT', undef, undef, undef)
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -18,20 +10,37 @@
         owner   => 'cinder',
         group   => 'cinder',
         require => Class['cinder'],
-        notify  => Service['cinder-api'],
       }
+      File[$files_to_set_owner] ~> Service<| tag == 'cinder-service' |>
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'cinder-service' |>
+
+    class { 'cinder::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
-    class { '::cinder::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'cinder::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'cinder',
+        'password' => lookup('CONFIG_CINDER_DB_PW'),
+        'database' => 'cinder',
+      })
     }
 
-    class { '::cinder':
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
-      default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      database_connection   => "mysql+pymysql://cinder:${cinder_rab_cfg_cinder_db_pw}@${cinder_rab_cfg_mariadb_host}/cinder",
+    class { 'cinder':
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,
       kombu_ssl_certfile    => $kombu_ssl_certfile,
+      notification_driver   => 'messagingv2',
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/firewall.pp b/packstack/puppet/modules/packstack/manifests/firewall.pp
index fd4c014a1..b8e2847cc 100644
--- a/packstack/puppet/modules/packstack/manifests/firewall.pp
+++ b/packstack/puppet/modules/packstack/manifests/firewall.pp
@@ -9,9 +9,9 @@
   $ports = undef,
   $proto = 'tcp'
 ) {
-  $ip_version = hiera('CONFIG_IP_VERSION')
+  $ip_version = lookup('CONFIG_IP_VERSION')
 
-  $provider = $ip_version ? {
+  $protocol = $ip_version ? {
     'ipv6'  => 'ip6tables',
     default => 'iptables',
     # TO-DO(mmagr): Add IPv6 support when hostnames are used
@@ -34,9 +34,9 @@
     firewall { "001 ${service_name} ${heading} ${title}":
       chain    => $chain,
       proto    => $proto,
-      action   => 'accept',
+      jump     => 'accept',
       source   => $source,
-      provider => $provider,
+      protocol => $protocol,
     }
   }
   else {
@@ -44,9 +44,9 @@
       chain    => $chain,
       proto    => $proto,
       dport    => $ports,
-      action   => 'accept',
+      jump     => 'accept',
       source   => $source,
-      provider => $provider,
+      protocol => $protocol,
     }
   }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/glance.pp b/packstack/puppet/modules/packstack/manifests/glance.pp
index 923842845..2f614da9e 100644
--- a/packstack/puppet/modules/packstack/manifests/glance.pp
+++ b/packstack/puppet/modules/packstack/manifests/glance.pp
@@ -1,62 +1,48 @@
 class packstack::glance ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_GLANCE_RULES', {}))
-
-    $glance_ks_pw = hiera('CONFIG_GLANCE_DB_PW')
-    $glance_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
-    $glance_cfg_ctrl_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    create_resources(packstack::firewall, lookup('FIREWALL_GLANCE_RULES', undef, undef, {}))
 
     # glance option bind_host requires address without brackets
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
-    # magical hack for magical config - glance option registry_host requires brackets
-    $registry_host = hiera('CONFIG_IP_VERSION') ? {
-      'ipv6'  => '[::0]',
-      default => '0.0.0.0',
-      # TO-DO(mmagr): Add IPv6 support when hostnames are used
-    }
-    $default_store = hiera('CONFIG_GLANCE_BACKEND') ? {
+
+    $default_store = lookup('CONFIG_GLANCE_BACKEND') ? {
       'swift' => 'swift',
       default => 'file',
     }
 
-    class { '::glance::api::authtoken':
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
-      password             => hiera('CONFIG_GLANCE_KS_PW'),
+    class { 'glance::api::authtoken':
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      password             => lookup('CONFIG_GLANCE_KS_PW'),
     }
 
-    class { '::glance::api::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'glance::api::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
-    class { '::glance::api':
-      bind_host           => $bind_host,
-      registry_host       => $registry_host,
-      pipeline            => 'keystone',
-      database_connection => "mysql+pymysql://glance:${glance_ks_pw}@${glance_mariadb_host}/glance",
-      os_region_name      => hiera('CONFIG_KEYSTONE_REGION'),
-      workers             => hiera('CONFIG_SERVICE_WORKERS'),
-      stores              => ['file', 'http', 'swift'],
-      default_store       => $default_store,
+    class { 'glance::api::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'glance',
+        'password' => lookup('CONFIG_GLANCE_DB_PW'),
+        'database' => 'glance',
+      })
     }
 
-    class { '::glance::registry::authtoken':
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
-      password             => hiera('CONFIG_GLANCE_KS_PW'),
+    class { 'glance::api':
+      service_name     => 'httpd',
+      enabled_backends => ["${default_store}:${default_store}", "http:http"],
+      default_backend  => $default_store,
     }
-
-    class { '::glance::registry::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'glance::wsgi::apache':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
-    class { '::glance::registry':
-      bind_host           => $bind_host,
-      database_connection => "mysql+pymysql://glance:${glance_ks_pw}@${glance_mariadb_host}/glance",
-      workers             => hiera('CONFIG_SERVICE_WORKERS'),
-    }
+    glance::backend::multistore::http { 'http': }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/glance/backend/file.pp b/packstack/puppet/modules/packstack/manifests/glance/backend/file.pp
index 224dac6ec..59d8661ae 100644
--- a/packstack/puppet/modules/packstack/manifests/glance/backend/file.pp
+++ b/packstack/puppet/modules/packstack/manifests/glance/backend/file.pp
@@ -1,7 +1,6 @@
 class packstack::glance::backend::file ()
 {
-    # TO-DO: Make this configurable
-    class { '::glance::backend::file':
+    glance::backend::multistore::file { 'file':
       filesystem_store_datadir => '/var/lib/glance/images/',
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/glance/backend/swift.pp b/packstack/puppet/modules/packstack/manifests/glance/backend/swift.pp
index 9095427d0..f8c7b4629 100644
--- a/packstack/puppet/modules/packstack/manifests/glance/backend/swift.pp
+++ b/packstack/puppet/modules/packstack/manifests/glance/backend/swift.pp
@@ -2,15 +2,15 @@
 {
     Service<| tag == 'swift-service' |> -> Service['glance-api']
 
-    $swift_auth_version = hiera('CONFIG_KEYSTONE_API_VERSION') ? {
+    $swift_auth_version = lookup('CONFIG_KEYSTONE_API_VERSION') ? {
       'v2.0'  => '2',
       default => '3',
     }
 
-    class { '::glance::backend::swift':
+    glance::backend::multistore::swift { 'swift':
       swift_store_user                    => 'services:glance',
-      swift_store_key                     => hiera('CONFIG_GLANCE_KS_PW'),
-      swift_store_auth_address            => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+      swift_store_key                     => lookup('CONFIG_GLANCE_KS_PW'),
+      swift_store_auth_address            => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
       swift_store_container               => 'glance',
       swift_store_auth_version            => $swift_auth_version,
       swift_store_large_object_size       => '5120',
diff --git a/packstack/puppet/modules/packstack/manifests/glance/ceilometer.pp b/packstack/puppet/modules/packstack/manifests/glance/ceilometer.pp
index ddda31325..5ee6b36c1 100644
--- a/packstack/puppet/modules/packstack/manifests/glance/ceilometer.pp
+++ b/packstack/puppet/modules/packstack/manifests/glance/ceilometer.pp
@@ -1,13 +1,8 @@
 class packstack::glance::ceilometer ()
 {
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_GLANCE_SSL_KEY', undef)
-    $kombu_ssl_certfile = hiera('CONFIG_GLANCE_SSL_CERT', undef)
-
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_GLANCE_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_GLANCE_SSL_CERT', undef, undef, undef)
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -18,14 +13,21 @@
         notify  => Service['glance-api'],
       }
     }
-    class { '::glance::notify::rabbitmq':
-      rabbit_notification_exchange => 'glance',
-      rabbit_notification_topic    => 'notifications',
-      rabbit_use_ssl               => hiera('CONFIG_AMQP_SSL_ENABLED'),
-      default_transport_url        => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      kombu_ssl_ca_certs           => $kombu_ssl_ca_certs,
-      kombu_ssl_keyfile            => $kombu_ssl_keyfile,
-      kombu_ssl_certfile           => $kombu_ssl_certfile,
-      notification_driver          => 'messagingv2',
+    Service<| name == 'rabbitmq-server' |> -> Service['glance-api']
+
+    class { 'glance::notify::rabbitmq':
+      rabbit_notification_topic => 'notifications',
+      rabbit_use_ssl            => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url     => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      kombu_ssl_ca_certs        => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile         => $kombu_ssl_keyfile,
+      kombu_ssl_certfile        => $kombu_ssl_certfile,
+      notification_driver       => 'messagingv2',
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/gnocchi.pp b/packstack/puppet/modules/packstack/manifests/gnocchi.pp
index b55fcd8d9..c3cd179af 100644
--- a/packstack/puppet/modules/packstack/manifests/gnocchi.pp
+++ b/packstack/puppet/modules/packstack/manifests/gnocchi.pp
@@ -1,41 +1,60 @@
 class packstack::gnocchi ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_GNOCCHI_RULES', {}))
-
-    $gnocchi_cfg_db_pw = hiera('CONFIG_GNOCCHI_DB_PW')
-    $gnocchi_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    create_resources(packstack::firewall, lookup('FIREWALL_GNOCCHI_RULES', undef, undef, {}))
+
+    $config_gnocchi_coordination_backend = lookup('CONFIG_CEILOMETER_COORDINATION_BACKEND')
+
+    if $config_gnocchi_coordination_backend == 'redis' {
+      $coordination_url = os_url({
+        'scheme' => 'redis',
+        'host'   => lookup('CONFIG_REDIS_HOST_URL'),
+        'port'   => lookup('CONFIG_REDIS_PORT'),
+      })
+      Service<| title == 'redis' |> -> Anchor['gnocchi::service::begin']
+    } else {
+      $coordination_url = uhdef
+    }
 
-    class { '::gnocchi::wsgi::apache':
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
+    class { 'gnocchi::wsgi::apache':
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
       ssl     => false
     }
 
-    class { '::gnocchi':
-      database_connection => "mysql+pymysql://gnocchi:${gnocchi_cfg_db_pw}@${gnocchi_cfg_mariadb_host}/gnocchi?charset=utf8",
+    class { 'gnocchi':
+      coordination_url => $coordination_url,
+    }
+
+    class { 'gnocchi::keystone::authtoken':
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      password             => lookup('CONFIG_GNOCCHI_KS_PW')
     }
 
-    class { '::gnocchi::keystone::authtoken':
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
-      auth_version         => hiera('CONFIG_KEYSTONE_API_VERSION'),
-      password             => hiera('CONFIG_GNOCCHI_KS_PW')
+    class { 'gnocchi::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'gnocchi',
+        'password' => lookup('CONFIG_GNOCCHI_DB_PW'),
+        'database' => 'gnocchi',
+        'charset'  => 'utf8',
+      })
     }
 
-    class { '::gnocchi::api':
+    class { 'gnocchi::api':
       service_name => 'httpd',
       sync_db      => true,
     }
 
-    class { '::gnocchi::storage': }
-    class { '::gnocchi::storage::file': }
+    class { 'gnocchi::storage': }
+    class { 'gnocchi::storage::file': }
 
-    class {'::gnocchi::metricd': }
+    class { 'gnocchi::metricd': }
 
-    class {'::gnocchi::statsd':
+    class { 'gnocchi::statsd':
       resource_id         => '5e3fcbe2-7aab-475d-b42c-a440aa42e5ad',
       archive_policy_name => 'high',
-      flush_delay         => '10',
     }
 
-    include ::gnocchi::client
+    include gnocchi::client
 }
diff --git a/packstack/puppet/modules/packstack/manifests/heat.pp b/packstack/puppet/modules/packstack/manifests/heat.pp
index 4414118fd..f395e08e7 100644
--- a/packstack/puppet/modules/packstack/manifests/heat.pp
+++ b/packstack/puppet/modules/packstack/manifests/heat.pp
@@ -1,25 +1,44 @@
 class packstack::heat ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_HEAT_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_HEAT_RULES', undef, undef, {}))
 
-    class { '::heat::api':
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
     }
 
-    $keystone_admin = hiera('CONFIG_KEYSTONE_ADMIN_USERNAME')
-    $heat_cfg_ctrl_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    class { 'heat::api':
+      service_name => 'httpd',
+    }
+    class { 'heat::wsgi::apache_api':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    $memcache_servers = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => ['[::1]:11211'],
+      default => ['127.0.0.1:11211'],
+    }
+    class {'heat::cache':
+      enabled          => true,
+      backend          => 'dogpile.cache.pymemcache',
+      memcache_servers => $memcache_servers,
+    }
+    include packstack::memcached
+    Class['memcached'] -> Anchor['heat::service::begin']
+
+    $heat_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
 
-    class { '::heat::engine':
+    class { 'heat::engine':
       heat_metadata_server_url      => "http://${heat_cfg_ctrl_host}:8000",
       heat_waitcondition_server_url => "http://${heat_cfg_ctrl_host}:8000/v1/waitcondition",
-      heat_watch_server_url         => "http://${heat_cfg_ctrl_host}:8003",
-      auth_encryption_key           => hiera('CONFIG_HEAT_AUTH_ENC_KEY'),
-      num_engine_workers            => hiera('CONFIG_SERVICE_WORKERS'),
+      auth_encryption_key           => lookup('CONFIG_HEAT_AUTH_ENC_KEY'),
+      num_engine_workers            => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
-    class { '::heat::keystone::domain':
-      domain_name       => hiera('CONFIG_HEAT_DOMAIN'),
-      domain_admin      => hiera('CONFIG_HEAT_DOMAIN_ADMIN'),
-      domain_password   => hiera('CONFIG_HEAT_DOMAIN_PASSWORD'),
+    class { 'heat::keystone::domain':
+      domain_name     => lookup('CONFIG_HEAT_DOMAIN'),
+      domain_admin    => lookup('CONFIG_HEAT_DOMAIN_ADMIN'),
+      domain_password => lookup('CONFIG_HEAT_DOMAIN_PASSWORD'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/heat/cfn.pp b/packstack/puppet/modules/packstack/manifests/heat/cfn.pp
index 3ca21ccdc..94608220f 100644
--- a/packstack/puppet/modules/packstack/manifests/heat/cfn.pp
+++ b/packstack/puppet/modules/packstack/manifests/heat/cfn.pp
@@ -1,17 +1,26 @@
 class packstack::heat::cfn ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_HEAT_CFN_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_HEAT_CFN_RULES', undef, undef, {}))
 
-    class { '::heat::api_cfn':
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
     }
 
-    $heat_cfn_cfg_ctrl_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    class { 'heat::api_cfn':
+      service_name => 'httpd',
+    }
+    class { 'heat::wsgi::apache_api_cfn':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    $heat_cfn_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
 
-    class { '::heat::keystone::auth_cfn':
-      admin_url    => "http://$heat_cfn_cfg_ctrl_host:8000/v1",
-      public_url   => "http://$heat_cfn_cfg_ctrl_host:8000/v1",
-      internal_url => "http://$heat_cfn_cfg_ctrl_host:8000/v1",
-      password     => hiera('CONFIG_HEAT_KS_PW'),
+    class { 'heat::keystone::auth_cfn':
+      admin_url    => "http://${heat_cfn_cfg_ctrl_host}:8000/v1",
+      public_url   => "http://${heat_cfn_cfg_ctrl_host}:8000/v1",
+      internal_url => "http://${heat_cfn_cfg_ctrl_host}:8000/v1",
+      password     => lookup('CONFIG_HEAT_KS_PW'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/heat/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/heat/rabbitmq.pp
index 1a6ec6e0c..80a025c20 100644
--- a/packstack/puppet/modules/packstack/manifests/heat/rabbitmq.pp
+++ b/packstack/puppet/modules/packstack/manifests/heat/rabbitmq.pp
@@ -1,18 +1,10 @@
 class packstack::heat::rabbitmq ()
 {
-    $heat_rabbitmq_cfg_heat_db_pw = hiera('CONFIG_HEAT_DB_PW')
-    $heat_rabbitmq_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_HEAT_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_HEAT_SSL_CERT', undef, undef, undef)
 
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', $::os_service_default)
-    $kombu_ssl_keyfile = hiera('CONFIG_HEAT_SSL_KEY', $::os_service_default)
-    $kombu_ssl_certfile = hiera('CONFIG_HEAT_SSL_CERT', $::os_service_default)
-
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
-
-    if ! is_service_default($kombu_ssl_keyfile) {
+    if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
       file { $files_to_set_owner:
         owner   => 'heat',
@@ -21,31 +13,51 @@
       }
       File[$files_to_set_owner] ~> Service<| tag == 'heat-service' |>
     }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'heat-service' |>
 
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
       $heat_notification_driver = 'messagingv2'
     } else {
-      $heat_notification_driver = $::os_service_default
+      $heat_notification_driver = $facts['os_service_default']
+    }
+
+    class { 'heat::trustee':
+      password => lookup('CONFIG_HEAT_KS_PW'),
+      auth_url => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
+    class { 'heat::keystone::authtoken':
+      password             => lookup('CONFIG_HEAT_KS_PW'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
-    class { '::heat::keystone::authtoken':
-      password             => hiera('CONFIG_HEAT_KS_PW'),
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+    class { 'heat::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
-    class { '::heat::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'heat::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'heat',
+        'password' => lookup('CONFIG_HEAT_DB_PW'),
+        'database' => 'heat',
+      })
     }
 
-    class { '::heat':
-      keystone_ec2_uri    => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      rabbit_use_ssl      => hiera('CONFIG_AMQP_SSL_ENABLED'),
-      default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      database_connection => "mysql+pymysql://heat:${heat_rabbitmq_cfg_heat_db_pw}@${heat_rabbitmq_cfg_mariadb_host}/heat",
-      kombu_ssl_ca_certs  => $kombu_ssl_ca_certs,
-      kombu_ssl_keyfile   => $kombu_ssl_keyfile,
-      kombu_ssl_certfile  => $kombu_ssl_certfile,
-      notification_driver => $heat_notification_driver,
+    class { 'heat':
+      keystone_ec2_uri      => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
+      notification_driver   => $heat_notification_driver,
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/horizon.pp b/packstack/puppet/modules/packstack/manifests/horizon.pp
index afd766975..bd9617b37 100644
--- a/packstack/puppet/modules/packstack/manifests/horizon.pp
+++ b/packstack/puppet/modules/packstack/manifests/horizon.pp
@@ -1,76 +1,78 @@
 class packstack::horizon ()
 {
-    $is_django_debug = hiera('CONFIG_DEBUG_MODE') ? {
-      true  => 'True',
-      false => 'False',
+    $log_level = lookup('CONFIG_DEBUG_MODE') ? {
+      true    => 'DEBUG',
+      default => 'INFO',
     }
 
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    $horizon_ssl = hiera('CONFIG_HORIZON_SSL') ? {
-      'y' => true,
-      'n' => false,
+    $horizon_ssl = lookup('CONFIG_HORIZON_SSL') ? {
+      'y'     => true,
+      default => false,
     }
 
-    class {'::horizon':
-      secret_key            => hiera('CONFIG_HORIZON_SECRET_KEY'),
-      keystone_url          => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      keystone_default_role => '_member_',
-      server_aliases        => [hiera('CONFIG_CONTROLLER_HOST'), $::fqdn, 'localhost'],
+    include packstack::memcached
+    $cache_server_ip = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::1',
+      default => '127.0.0.1',
+    }
+
+    class { 'horizon':
+      secret_key            => lookup('CONFIG_HORIZON_SECRET_KEY'),
+      keystone_url          => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
+      server_aliases        => [lookup('CONFIG_CONTROLLER_HOST'), $facts['networking']['fqdn'], 'localhost'],
       allowed_hosts         => '*',
-      hypervisor_options    => {'can_set_mount_point' => false, },
-      django_debug          => $is_django_debug,
       django_session_engine => 'django.contrib.sessions.backends.cache',
-      cache_backend         => 'django.core.cache.backends.memcached.MemcachedCache',
-      cache_server_ip       => '127.0.0.1',
+      cache_backend         => 'django.core.cache.backends.memcached.PyMemcacheCache',
+      cache_server_ip       => $cache_server_ip,
       cache_server_port     => '11211',
       file_upload_temp_dir  => '/var/tmp',
       listen_ssl            => $horizon_ssl,
-      horizon_cert          => hiera('CONFIG_HORIZON_SSL_CERT', undef),
-      horizon_key           => hiera('CONFIG_HORIZON_SSL_KEY', undef),
-      horizon_ca            => hiera('CONFIG_HORIZON_SSL_CACERT', undef),
+      ssl_cert              => lookup('CONFIG_HORIZON_SSL_CERT', undef, undef, undef),
+      ssl_key               => lookup('CONFIG_HORIZON_SSL_KEY', undef, undef, undef),
+      ssl_ca                => lookup('CONFIG_HORIZON_SSL_CACERT', undef, undef, undef),
+      ssl_verify_client     => 'optional',
+      log_level             => $log_level,
+      django_log_level      => 'INFO',
       neutron_options       => {
-        'enable_firewall' => hiera('CONFIG_HORIZON_NEUTRON_FW'),
-        'enable_vpn'      => hiera('CONFIG_HORIZON_NEUTRON_VPN'),
-        'enable_lb'       => hiera('CONFIG_HORIZON_NEUTRON_LB'),
+        'enable_vpn' => lookup('CONFIG_HORIZON_NEUTRON_VPN'),
       },
     }
 
-    if hiera('CONFIG_MAGNUM_INSTALL') == 'y' {
-      ensure_packages(['openstack-magnum-ui'], {'ensure' => 'present'})
+    if lookup('CONFIG_MAGNUM_INSTALL') == 'y' {
+      horizon::dashboard { 'magnum': }
     }
 
-    if hiera('CONFIG_IRONIC_INSTALL') == 'y' {
-      ensure_packages(['openstack-ironic-ui'], {'ensure' => 'present'})
+    if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
+      include horizon::dashboards::ironic
     }
 
-    if hiera('CONFIG_TROVE_INSTALL') == 'y' {
-      ensure_packages(['openstack-trove-ui'], {'ensure' => 'present'})
+    if lookup('CONFIG_TROVE_INSTALL') == 'y' {
+      horizon::dashboard { 'trove': }
     }
 
-    if hiera('CONFIG_SAHARA_INSTALL') == 'y' {
-      ensure_packages(['openstack-sahara-ui'], {'ensure' => 'present'})
+    if lookup('CONFIG_HEAT_INSTALL') == 'y' {
+      include horizon::dashboards::heat
     }
 
-    if hiera('CONFIG_HEAT_INSTALL') == 'y' {
-      ensure_packages(['openstack-heat-ui'], {'ensure' => 'present'})
+    if lookup('CONFIG_MANILA_INSTALL') == 'y' {
+      include horizon::dashboards::manila
     }
 
-    include '::packstack::memcached'
-
-    $firewall_port = hiera('CONFIG_HORIZON_PORT')
+    $firewall_port = lookup('CONFIG_HORIZON_PORT')
 
     firewall { "001 horizon ${firewall_port} incoming":
       proto  => 'tcp',
       dport  => [$firewall_port],
-      action => 'accept',
+      jump   => 'accept',
     }
 
-    if str2bool($::selinux) {
+    if str2bool($facts['os']['selinux']['enabled']) {
       selboolean{ 'httpd_can_network_connect':
         value      => on,
         persistent => true,
diff --git a/packstack/puppet/modules/packstack/manifests/ironic.pp b/packstack/puppet/modules/packstack/manifests/ironic.pp
index 4809ed59c..49af33165 100644
--- a/packstack/puppet/modules/packstack/manifests/ironic.pp
+++ b/packstack/puppet/modules/packstack/manifests/ironic.pp
@@ -1,19 +1,16 @@
 class packstack::ironic ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_IRONIC_API_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_IRONIC_API_RULES', undef, undef, {}))
 
-    ironic_config {
-      'glance/glance_host': value => hiera('CONFIG_STORAGE_HOST_URL');
+    class { 'ironic::api::authtoken':
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      password             => lookup('CONFIG_IRONIC_KS_PW'),
     }
 
-    class { '::ironic::api::authtoken':
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      password             => hiera('CONFIG_IRONIC_KS_PW'),
-    }
-
-    class { '::ironic::api': }
+    class { 'ironic::api': }
 
-    class { '::ironic::client': }
+    class { 'ironic::client': }
 
-    class { '::ironic::conductor': }
+    class { 'ironic::conductor': }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/ironic/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/ironic/rabbitmq.pp
index 7b5c9f51c..beaa8b29a 100644
--- a/packstack/puppet/modules/packstack/manifests/ironic/rabbitmq.pp
+++ b/packstack/puppet/modules/packstack/manifests/ironic/rabbitmq.pp
@@ -1,16 +1,8 @@
 class packstack::ironic::rabbitmq ()
 {
-    $ironic_rabbitmq_cfg_ironic_db_pw = hiera('CONFIG_IRONIC_DB_PW')
-    $ironic_rabbitmq_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
-
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_IRONIC_SSL_KEY', undef)
-    $kombu_ssl_certfile = hiera('CONFIG_IRONIC_SSL_CERT', undef)
-
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_IRONIC_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_IRONIC_SSL_CERT', undef, undef, undef)
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -21,15 +13,31 @@
       }
       File[$files_to_set_owner] ~> Service<| tag == 'ironic-service' |>
     }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'ironic-service' |>
 
-    class { '::ironic::logging':
+    class { 'ironic::logging':
       debug => true,
     }
 
-    class { '::ironic':
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
-      default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      database_connection   => "mysql+pymysql://ironic:${ironic_rabbitmq_cfg_ironic_db_pw}@${ironic_rabbitmq_cfg_mariadb_host}/ironic",
+    class { 'ironic::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'ironic',
+        'password' => lookup('CONFIG_IRONIC_DB_PW'),
+        'database' => 'ironic',
+      })
+    }
+
+    class { 'ironic':
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,
       kombu_ssl_certfile    => $kombu_ssl_certfile,
diff --git a/packstack/puppet/modules/packstack/manifests/keystone.pp b/packstack/puppet/modules/packstack/manifests/keystone.pp
index 0ab3fc986..c997c8e13 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone.pp
@@ -1,124 +1,122 @@
 class packstack::keystone ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_KEYSTONE_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_KEYSTONE_RULES', undef, undef, {}))
 
-    $keystone_use_ssl = false
-    $keystone_cfg_ks_db_pw = hiera('CONFIG_KEYSTONE_DB_PW')
-    $keystone_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
-    $keystone_token_provider_str = downcase(hiera('CONFIG_KEYSTONE_TOKEN_FORMAT'))
-    $keystone_url = regsubst(regsubst(hiera('CONFIG_KEYSTONE_PUBLIC_URL'),'/v2.0',''),'/v3','')
-    $keystone_admin_url = hiera('CONFIG_KEYSTONE_ADMIN_URL')
+    $keystone_token_provider_str = downcase(lookup('CONFIG_KEYSTONE_TOKEN_FORMAT'))
+    $keystone_url = regsubst(regsubst(lookup('CONFIG_KEYSTONE_PUBLIC_URL'),'/v2.0',''),'/v3','')
+    $keystone_admin_url = lookup('CONFIG_KEYSTONE_ADMIN_URL')
 
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
-      'ipv6'  => '::0',
-      default => '0.0.0.0',
-      # TO-DO(mmagr): Add IPv6 support when hostnames are used
-    }
-
-    class { '::keystone::client': }
-
-    if hiera('CONFIG_KEYSTONE_FERNET_TOKEN_ROTATE_ENABLE',false) {
-      class { '::keystone::cron::fernet_rotate':
+    if lookup('CONFIG_KEYSTONE_FERNET_TOKEN_ROTATE_ENABLE', undef, undef, false) {
+      class { 'keystone::cron::fernet_rotate':
         require     => Service['crond'],
       }
+      package { 'cronie':
+        ensure => 'installed',
+        name   => 'cronie',
+      }
       service { 'crond':
-        ensure => 'running',
-        enable => true,
+        ensure  => 'running',
+        enable  => true,
+        require => Package['cronie'],
       }
     }
 
-    class { '::keystone::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'keystone::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'keystone::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'keystone_admin',
+        'password' => lookup('CONFIG_KEYSTONE_DB_PW'),
+        'database' => 'keystone',
+      })
     }
 
-    class { '::keystone':
-      database_connection => "mysql+pymysql://keystone_admin:${keystone_cfg_ks_db_pw}@${keystone_cfg_mariadb_host}/keystone",
-      token_provider      => "${keystone_token_provider_str}",
+    class { 'keystone':
+      token_provider      => $keystone_token_provider_str,
       enable_fernet_setup => true,
       service_name        => 'httpd',
-      enable_ssl          => $keystone_use_ssl,
-      public_bind_host    => $bind_host,
-      admin_bind_host     => $bind_host,
       default_domain      => 'Default',
     }
 
-    class { '::keystone::wsgi::apache':
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
-      ssl     => $keystone_use_ssl
+    class { 'keystone::wsgi::apache':
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
-    $username = hiera('CONFIG_KEYSTONE_ADMIN_USERNAME')
-
-    # Ensure the default _member_ role is present
-    keystone_role { '_member_':
-      ensure => present,
-    }
-
-    class { '::keystone::bootstrap':
-      password     => hiera('CONFIG_KEYSTONE_ADMIN_PW'),
-      username     => $username,
-      email        => hiera('CONFIG_KEYSTONE_ADMIN_EMAIL'),
+    class { 'keystone::bootstrap':
+      password     => lookup('CONFIG_KEYSTONE_ADMIN_PW'),
+      username     => lookup('CONFIG_KEYSTONE_ADMIN_USERNAME'),
+      email        => lookup('CONFIG_KEYSTONE_ADMIN_EMAIL'),
       project_name => 'admin',
       role_name    => 'admin',
       admin_url    => $keystone_admin_url,
       public_url   => $keystone_url,
       internal_url => $keystone_url,
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+    }
+
+    $memcache_servers = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => ['[::1]:11211'],
+      default => ['127.0.0.1:11211'],
+    }
+    class { 'keystone::cache':
+      enabled          => true,
+      backend          => 'dogpile.cache.pymemcache',
+      memcache_servers => $memcache_servers,
     }
+    include packstack::memcached
+    Class['memcached'] -> Anchor['keystone::dbsync::begin']
 
     # default assignment driver is SQL
     $assignment_driver = 'keystone.assignment.backends.sql.Assignment'
 
-    if hiera('CONFIG_KEYSTONE_IDENTITY_BACKEND') == 'ldap' {
+    if lookup('CONFIG_KEYSTONE_IDENTITY_BACKEND') == 'ldap' {
 
-      if hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ENABLED_EMULATION_DN', undef) {
+      if lookup('CONFIG_KEYSTONE_LDAP_USER_ENABLED_EMULATION_DN', undef, undef, undef) {
         $user_enabled_emulation = true
       } else {
         $user_enabled_emulation = false
       }
 
-      class { '::keystone::ldap':
-        url                                => hiera_undef('CONFIG_KEYSTONE_LDAP_URL', undef),
-        user                               => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_DN', undef),
-        password                           => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_PASSWORD', undef),
-        suffix                             => hiera_undef('CONFIG_KEYSTONE_LDAP_SUFFIX', undef),
-        query_scope                        => hiera_undef('CONFIG_KEYSTONE_LDAP_QUERY_SCOPE', undef),
-        page_size                          => hiera_undef('CONFIG_KEYSTONE_LDAP_PAGE_SIZE', undef),
-        user_tree_dn                       => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_SUBTREE', undef),
-        user_filter                        => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_FILTER', undef),
-        user_objectclass                   => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_OBJECTCLASS', undef),
-        user_id_attribute                  => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ID_ATTRIBUTE', undef),
-        user_name_attribute                => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_NAME_ATTRIBUTE', undef),
-        user_mail_attribute                => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_MAIL_ATTRIBUTE', undef),
-        user_enabled_attribute             => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ENABLED_ATTRIBUTE', undef),
-        user_enabled_mask                  => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ENABLED_MASK', undef),
-        user_enabled_default               => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ENABLED_DEFAULT', undef),
-        user_enabled_invert                => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ENABLED_INVERT', undef),
-        user_attribute_ignore              => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ATTRIBUTE_IGNORE', undef),
-        user_default_project_id_attribute  => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_DEFAULT_PROJECT_ID_ATTRIBUTE', undef),
-        user_allow_create                  => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ALLOW_CREATE', undef),
-        user_allow_update                  => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ALLOW_UPDATE', undef),
-        user_allow_delete                  => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ALLOW_DELETE', undef),
-        user_pass_attribute                => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_PASS_ATTRIBUTE', undef),
+      class { 'keystone::ldap':
+        url                                => lookup('CONFIG_KEYSTONE_LDAP_URL', undef, undef, undef),
+        user                               => lookup('CONFIG_KEYSTONE_LDAP_USER_DN', undef, undef, undef),
+        password                           => lookup('CONFIG_KEYSTONE_LDAP_USER_PASSWORD', undef, undef, undef),
+        suffix                             => lookup('CONFIG_KEYSTONE_LDAP_SUFFIX', undef, undef, undef),
+        query_scope                        => lookup('CONFIG_KEYSTONE_LDAP_QUERY_SCOPE', undef, undef, undef),
+        page_size                          => lookup('CONFIG_KEYSTONE_LDAP_PAGE_SIZE', undef, undef, undef),
+        user_tree_dn                       => lookup('CONFIG_KEYSTONE_LDAP_USER_SUBTREE', undef, undef, undef),
+        user_filter                        => lookup('CONFIG_KEYSTONE_LDAP_USER_FILTER', undef, undef, undef),
+        user_objectclass                   => lookup('CONFIG_KEYSTONE_LDAP_USER_OBJECTCLASS', undef, undef, undef),
+        user_id_attribute                  => lookup('CONFIG_KEYSTONE_LDAP_USER_ID_ATTRIBUTE', undef, undef, undef),
+        user_name_attribute                => lookup('CONFIG_KEYSTONE_LDAP_USER_NAME_ATTRIBUTE', undef, undef, undef),
+        user_mail_attribute                => lookup('CONFIG_KEYSTONE_LDAP_USER_MAIL_ATTRIBUTE', undef, undef, undef),
+        user_enabled_attribute             => lookup('CONFIG_KEYSTONE_LDAP_USER_ENABLED_ATTRIBUTE', undef, undef, undef),
+        user_enabled_mask                  => lookup('CONFIG_KEYSTONE_LDAP_USER_ENABLED_MASK', undef, undef, undef),
+        user_enabled_default               => lookup('CONFIG_KEYSTONE_LDAP_USER_ENABLED_DEFAULT', undef, undef, undef),
+        user_enabled_invert                => lookup('CONFIG_KEYSTONE_LDAP_USER_ENABLED_INVERT', undef, undef, undef),
+        user_attribute_ignore              => lookup('CONFIG_KEYSTONE_LDAP_USER_ATTRIBUTE_IGNORE', undef, undef, undef),
+        user_default_project_id_attribute  => lookup('CONFIG_KEYSTONE_LDAP_USER_DEFAULT_PROJECT_ID_ATTRIBUTE', undef, undef, undef),
+        user_pass_attribute                => lookup('CONFIG_KEYSTONE_LDAP_USER_PASS_ATTRIBUTE', undef, undef, undef),
         user_enabled_emulation             => $user_enabled_emulation,
-        user_enabled_emulation_dn          => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ENABLED_EMULATION_DN', undef),
-        user_additional_attribute_mapping  => hiera_undef('CONFIG_KEYSTONE_LDAP_USER_ADDITIONAL_ATTRIBUTE_MAPPING', undef),
-        group_tree_dn                      => hiera_undef('CONFIG_KEYSTONE_LDAP_GROUP_SUBTREE', undef),
-        group_filter                       => hiera_undef('CONFIG_KEYSTONE_LDAP_GROUP_FILTER', undef),
-        group_objectclass                  => hiera_undef('CONFIG_KEYSTONE_LDAP_GROUP_OBJECTCLASS', undef),
-        group_id_attribute                 => hiera_undef('CONFIG_KEYSTONE_LDAP_GROUP_ID_ATTRIBUTE', undef),
-        group_name_attribute               => hiera_undef('CONFIG_KEYSTONE_LDAP_GROUP_NAME_ATTRIBUTE', undef),
-        group_member_attribute             => hiera_undef('CONFIG_KEYSTONE_LDAP_GROUP_MEMBER_ATTRIBUTE', undef),
-        group_desc_attribute               => hiera_undef('CONFIG_KEYSTONE_LDAP_GROUP_DESC_ATTRIBUTE', undef),
-        group_attribute_ignore             => hiera_undef('CONFIG_KEYSTONE_LDAP_GROUP_ATTRIBUTE_IGNORE', undef),
-        group_allow_create                 => hiera_undef('CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_CREATE', undef),
-        group_allow_update                 => hiera_undef('CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_UPDATE', undef),
-        group_allow_delete                 => hiera_undef('CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_DELETE', undef),
-        group_additional_attribute_mapping => hiera_undef('CONFIG_KEYSTONE_LDAP_GROUP_ADDITIONAL_ATTRIBUTE_MAPPING', undef),
-        use_tls                            => hiera_undef('CONFIG_KEYSTONE_LDAP_USE_TLS', undef),
-        tls_cacertdir                      => hiera_undef('CONFIG_KEYSTONE_LDAP_TLS_CACERTDIR', undef),
-        tls_cacertfile                     => hiera_undef('CONFIG_KEYSTONE_LDAP_TLS_CACERTFILE', undef),
-        tls_req_cert                       => hiera_undef('CONFIG_KEYSTONE_LDAP_TLS_REQ_CERT', undef),
+        user_enabled_emulation_dn          => lookup('CONFIG_KEYSTONE_LDAP_USER_ENABLED_EMULATION_DN', undef, undef, undef),
+        user_additional_attribute_mapping  => lookup('CONFIG_KEYSTONE_LDAP_USER_ADDITIONAL_ATTRIBUTE_MAPPING', undef, undef, undef),
+        group_tree_dn                      => lookup('CONFIG_KEYSTONE_LDAP_GROUP_SUBTREE', undef, undef, undef),
+        group_filter                       => lookup('CONFIG_KEYSTONE_LDAP_GROUP_FILTER', undef, undef, undef),
+        group_objectclass                  => lookup('CONFIG_KEYSTONE_LDAP_GROUP_OBJECTCLASS', undef, undef, undef),
+        group_id_attribute                 => lookup('CONFIG_KEYSTONE_LDAP_GROUP_ID_ATTRIBUTE', undef, undef, undef),
+        group_name_attribute               => lookup('CONFIG_KEYSTONE_LDAP_GROUP_NAME_ATTRIBUTE', undef, undef, undef),
+        group_member_attribute             => lookup('CONFIG_KEYSTONE_LDAP_GROUP_MEMBER_ATTRIBUTE', undef, undef, undef),
+        group_desc_attribute               => lookup('CONFIG_KEYSTONE_LDAP_GROUP_DESC_ATTRIBUTE', undef, undef, undef),
+        group_attribute_ignore             => lookup('CONFIG_KEYSTONE_LDAP_GROUP_ATTRIBUTE_IGNORE', undef, undef, undef),
+        group_additional_attribute_mapping => lookup('CONFIG_KEYSTONE_LDAP_GROUP_ADDITIONAL_ATTRIBUTE_MAPPING', undef, undef, undef),
+        use_tls                            => lookup('CONFIG_KEYSTONE_LDAP_USE_TLS', undef, undef, undef),
+        tls_cacertdir                      => lookup('CONFIG_KEYSTONE_LDAP_TLS_CACERTDIR', undef, undef, undef),
+        tls_cacertfile                     => lookup('CONFIG_KEYSTONE_LDAP_TLS_CACERTFILE', undef, undef, undef),
+        tls_req_cert                       => lookup('CONFIG_KEYSTONE_LDAP_TLS_REQ_CERT', undef, undef, undef),
         identity_driver                    => 'keystone.identity.backends.ldap.Identity',
         assignment_driver                  => $assignment_driver,
       }
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/aodh.pp b/packstack/puppet/modules/packstack/manifests/keystone/aodh.pp
index ee6a1bd70..67f4bab75 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/aodh.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/aodh.pp
@@ -1,10 +1,10 @@
 class packstack::keystone::aodh ()
 {
-    $keystone_host_url = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $keystone_host_url = lookup('CONFIG_KEYSTONE_HOST_URL')
 
-    class { '::aodh::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_AODH_KS_PW'),
+    class { 'aodh::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_AODH_KS_PW'),
       public_url   => "http://${keystone_host_url}:8042",
       admin_url    => "http://${keystone_host_url}:8042",
       internal_url => "http://${keystone_host_url}:8042",
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/ceilometer.pp b/packstack/puppet/modules/packstack/manifests/keystone/ceilometer.pp
index 47c0754d4..40724873c 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/ceilometer.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/ceilometer.pp
@@ -1,15 +1,7 @@
 class packstack::keystone::ceilometer ()
 {
-    $ceilometer_protocol = 'http'
-    $ceilometer_port = '8777'
-    $ceilometer_api_host = hiera('CONFIG_KEYSTONE_HOST_URL')
-    $ceilometer_url = "${ceilometer_protocol}://${ceilometer_api_host}:${ceilometer_port}"
-
-    class { '::ceilometer::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_CEILOMETER_KS_PW'),
-      public_url   => $ceilometer_url,
-      admin_url    => $ceilometer_url,
-      internal_url => $ceilometer_url,
+    class { 'ceilometer::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_CEILOMETER_KS_PW'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/cinder.pp b/packstack/puppet/modules/packstack/manifests/keystone/cinder.pp
index b22fd9dda..ff4170292 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/cinder.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/cinder.pp
@@ -1,18 +1,16 @@
 class packstack::keystone::cinder ()
 {
     $cinder_protocol = 'http'
-    $cinder_host = hiera('CONFIG_STORAGE_HOST_URL')
+    $cinder_host = lookup('CONFIG_STORAGE_HOST_URL')
     $cinder_port = '8776'
-    $cinder_url = "${cinder_protocol}://${cinder_host}:$cinder_port"
+    $cinder_url = "${cinder_protocol}://${cinder_host}:${cinder_port}"
 
-    class { '::cinder::keystone::auth':
-      region          => hiera('CONFIG_KEYSTONE_REGION'),
-      password        => hiera('CONFIG_CINDER_KS_PW'),
-      public_url_v2   => "${cinder_url}/v2/%(tenant_id)s",
-      internal_url_v2 => "${cinder_url}/v2/%(tenant_id)s",
-      admin_url_v2    => "${cinder_url}/v2/%(tenant_id)s",
-      public_url_v3   => "${cinder_url}/v3/%(tenant_id)s",
-      internal_url_v3 => "${cinder_url}/v3/%(tenant_id)s",
-      admin_url_v3    => "${cinder_url}/v3/%(tenant_id)s",
+    class { 'cinder::keystone::auth':
+      region          => lookup('CONFIG_KEYSTONE_REGION'),
+      password        => lookup('CONFIG_CINDER_KS_PW'),
+      roles           => ['admin', 'service'],
+      public_url_v3   => "${cinder_url}/v3",
+      internal_url_v3 => "${cinder_url}/v3",
+      admin_url_v3    => "${cinder_url}/v3",
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/glance.pp b/packstack/puppet/modules/packstack/manifests/keystone/glance.pp
index 227c5282f..84eb8a59d 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/glance.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/glance.pp
@@ -2,12 +2,12 @@
 {
     $glance_protocol = 'http'
     $glance_port = '9292'
-    $glance_api_host = hiera('CONFIG_STORAGE_HOST_URL')
+    $glance_api_host = lookup('CONFIG_STORAGE_HOST_URL')
     $glance_url = "${glance_protocol}://${glance_api_host}:${glance_port}"
 
-    class { '::glance::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_GLANCE_KS_PW'),
+    class { 'glance::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_GLANCE_KS_PW'),
       public_url   => $glance_url,
       admin_url    => $glance_url,
       internal_url => $glance_url,
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/gnocchi.pp b/packstack/puppet/modules/packstack/manifests/keystone/gnocchi.pp
index ea59ce198..65be0f049 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/gnocchi.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/gnocchi.pp
@@ -1,10 +1,10 @@
 class packstack::keystone::gnocchi ()
 {
-    $gnocchi_keystone_host_url = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $gnocchi_keystone_host_url = lookup('CONFIG_KEYSTONE_HOST_URL')
 
-    class { '::gnocchi::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_GNOCCHI_KS_PW'),
+    class { 'gnocchi::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_GNOCCHI_KS_PW'),
       public_url   => "http://${gnocchi_keystone_host_url}:8041",
       admin_url    => "http://${gnocchi_keystone_host_url}:8041",
       internal_url => "http://${gnocchi_keystone_host_url}:8041",
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/heat.pp b/packstack/puppet/modules/packstack/manifests/keystone/heat.pp
index ba833d9b9..75cb9c3f3 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/heat.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/heat.pp
@@ -2,13 +2,13 @@
 {
     $heat_protocol = 'http'
     $heat_port = '8004'
-    $heat_api_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $heat_api_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $heat_url = "${heat_protocol}://${heat_api_host}:${heat_port}/v1/%(tenant_id)s"
 
     # heat::keystone::auth
-    class { '::heat::keystone::auth':
-      region                    => hiera('CONFIG_KEYSTONE_REGION'),
-      password                  => hiera('CONFIG_HEAT_KS_PW'),
+    class { 'heat::keystone::auth':
+      region                    => lookup('CONFIG_KEYSTONE_REGION'),
+      password                  => lookup('CONFIG_HEAT_KS_PW'),
       public_url                => $heat_url,
       admin_url                 => $heat_url,
       internal_url              => $heat_url,
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/ironic.pp b/packstack/puppet/modules/packstack/manifests/keystone/ironic.pp
index 8183281e3..e90de995e 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/ironic.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/ironic.pp
@@ -1,13 +1,13 @@
 class packstack::keystone::ironic ()
 {
     $ironic_protocol = 'http'
-    $ironic_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $ironic_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $ironic_port = '6385'
-    $ironic_url = "${ironic_protocol}://${ironic_host}:$ironic_port"
+    $ironic_url = "${ironic_protocol}://${ironic_host}:${ironic_port}"
 
-    class { '::ironic::keystone::auth':
-        region       => hiera('CONFIG_KEYSTONE_REGION'),
-        password     => hiera('CONFIG_IRONIC_KS_PW'),
+    class { 'ironic::keystone::auth':
+        region       => lookup('CONFIG_KEYSTONE_REGION'),
+        password     => lookup('CONFIG_IRONIC_KS_PW'),
         public_url   => $ironic_url,
         admin_url    => $ironic_url,
         internal_url => $ironic_url,
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/magnum.pp b/packstack/puppet/modules/packstack/manifests/keystone/magnum.pp
old mode 100755
new mode 100644
index 44bc413fa..d503ce13b
--- a/packstack/puppet/modules/packstack/manifests/keystone/magnum.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/magnum.pp
@@ -1,19 +1,19 @@
 class packstack::keystone::magnum ()
 {
     $magnum_protocol = 'http'
-    $magnum_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $magnum_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $magnum_port = '9511'
-    $magnum_url = "${magnum_protocol}://${magnum_host}:$magnum_port/v1"
+    $magnum_url = "${magnum_protocol}://${magnum_host}:${magnum_port}/v1"
 
-    class { '::magnum::keystone::auth':
-      region          => hiera('CONFIG_KEYSTONE_REGION'),
-      password        => hiera('CONFIG_MAGNUM_KS_PW'),
-      public_url      => $magnum_url,
-      admin_url       => $magnum_url,
-      internal_url    => $magnum_url
+    class { 'magnum::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_MAGNUM_KS_PW'),
+      public_url   => $magnum_url,
+      admin_url    => $magnum_url,
+      internal_url => $magnum_url
     }
 
-    class { '::magnum::keystone::domain':
-      domain_password => hiera('CONFIG_MAGNUM_KS_PW'),
+    class { 'magnum::keystone::domain':
+      domain_password => lookup('CONFIG_MAGNUM_KS_PW'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/manila.pp b/packstack/puppet/modules/packstack/manifests/keystone/manila.pp
index 1a11f73f2..334e5125e 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/manila.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/manila.pp
@@ -1,13 +1,13 @@
 class packstack::keystone::manila ()
 {
     $manila_protocol = 'http'
-    $manila_host = hiera('CONFIG_STORAGE_HOST_URL')
+    $manila_host = lookup('CONFIG_STORAGE_HOST_URL')
     $manila_port = '8786'
-    $manila_url = "${manila_protocol}://${manila_host}:$manila_port/v1/%(tenant_id)s"
-    $manila_url_v2 = "${manila_protocol}://${manila_host}:$manila_port/v2/%(tenant_id)s"
+    $manila_url = "${manila_protocol}://${manila_host}:${manila_port}/v1/%(tenant_id)s"
+    $manila_url_v2 = "${manila_protocol}://${manila_host}:${manila_port}/v2/"
 
-    class { '::manila::keystone::auth':
-      password        => hiera('CONFIG_MANILA_KS_PW'),
+    class { 'manila::keystone::auth':
+      password        => lookup('CONFIG_MANILA_KS_PW'),
       public_url      => $manila_url,
       admin_url       => $manila_url,
       internal_url    => $manila_url,
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/neutron.pp b/packstack/puppet/modules/packstack/manifests/keystone/neutron.pp
index 168eab4d5..2fbc68e1f 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/neutron.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/neutron.pp
@@ -1,13 +1,13 @@
 class packstack::keystone::neutron ()
 {
     $neutron_protocol = 'http'
-    $neutron_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $neutron_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $neutron_port = '9696'
-    $neutron_url = "${neutron_protocol}://${neutron_host}:$neutron_port"
+    $neutron_url = "${neutron_protocol}://${neutron_host}:${neutron_port}"
 
-    class { '::neutron::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_NEUTRON_KS_PW'),
+    class { 'neutron::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_NEUTRON_KS_PW'),
       public_url   => $neutron_url,
       admin_url    => $neutron_url,
       internal_url => $neutron_url,
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/nova.pp b/packstack/puppet/modules/packstack/manifests/keystone/nova.pp
index b967ebb99..48f53d9a5 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/nova.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/nova.pp
@@ -1,16 +1,17 @@
 class packstack::keystone::nova ()
 {
     $nova_protocol = 'http'
-    $nova_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $nova_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $nova_port = '8774'
-    $nova_url = "${nova_protocol}://${nova_host}:${nova_port}/v2.1/%(tenant_id)s"
+    $nova_url = "${nova_protocol}://${nova_host}:${nova_port}/v2.1"
 
 
-    class { '::nova::keystone::auth':
-      region          => hiera('CONFIG_KEYSTONE_REGION'),
-      password        => hiera('CONFIG_NOVA_KS_PW'),
-      public_url      => $nova_url,
-      admin_url       => $nova_url,
-      internal_url    => $nova_url,
+    class { 'nova::keystone::auth':
+      roles        => ['admin', 'service'],
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_NOVA_KS_PW'),
+      public_url   => $nova_url,
+      admin_url    => $nova_url,
+      internal_url => $nova_url,
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/panko.pp b/packstack/puppet/modules/packstack/manifests/keystone/panko.pp
deleted file mode 100644
index 576ca827c..000000000
--- a/packstack/puppet/modules/packstack/manifests/keystone/panko.pp
+++ /dev/null
@@ -1,12 +0,0 @@
-class packstack::keystone::panko ()
-{
-    $keystone_host_url = hiera('CONFIG_KEYSTONE_HOST_URL')
-
-    class { '::panko::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_PANKO_KS_PW'),
-      public_url   => "http://${keystone_host_url}:8977",
-      admin_url    => "http://${keystone_host_url}:8977",
-      internal_url => "http://${keystone_host_url}:8977",
-    }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/placement.pp b/packstack/puppet/modules/packstack/manifests/keystone/placement.pp
index d38415929..06f1a30df 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/placement.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/placement.pp
@@ -1,22 +1,20 @@
 class packstack::keystone::placement ()
 {
     $placement_protocol = 'http'
-    $placement_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $placement_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $placement_port = '8778'
-    $placement_url = "${placement_protocol}://${placement_host}:${placement_port}/placement"
+    $placement_url = "${placement_protocol}://${placement_host}:${placement_port}"
 
-    class { '::placement::keystone::authtoken':
-      password             => hiera('CONFIG_NOVA_KS_PW'),
-      user_domain_name     => 'Default',
-      project_domain_name  => 'Default',
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+    class { 'placement::keystone::authtoken':
+      password             => lookup('CONFIG_NOVA_KS_PW'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
     }
 
-    class { '::placement::keystone::auth':
+    class { 'placement::keystone::auth':
       public_url   => $placement_url,
       internal_url => $placement_url,
       admin_url    => $placement_url,
-      password     => hiera('CONFIG_NOVA_KS_PW'),
+      password     => lookup('CONFIG_NOVA_KS_PW'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/sahara.pp b/packstack/puppet/modules/packstack/manifests/keystone/sahara.pp
deleted file mode 100644
index 215791960..000000000
--- a/packstack/puppet/modules/packstack/manifests/keystone/sahara.pp
+++ /dev/null
@@ -1,14 +0,0 @@
-class packstack::keystone::sahara ()
-{
-    $sahara_protocol = 'http'
-    $sahara_host = hiera('CONFIG_KEYSTONE_HOST_URL')
-    $sahara_port = '8386'
-    $sahara_url = "${sahara_protocol}://${sahara_host}:$sahara_port"
-
-    class { '::sahara::keystone::auth':
-      password     => hiera('CONFIG_SAHARA_KS_PW'),
-      public_url   => $sahara_url,
-      admin_url    => $sahara_url,
-      internal_url => $sahara_url,
-    }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/swift.pp b/packstack/puppet/modules/packstack/manifests/keystone/swift.pp
index b6daeaf33..550a74955 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/swift.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/swift.pp
@@ -1,17 +1,17 @@
 class packstack::keystone::swift ()
 {
     $swift_protocol = 'http'
-    $swift_host = hiera('CONFIG_STORAGE_HOST_URL')
+    $swift_host = lookup('CONFIG_STORAGE_HOST_URL')
     $swift_port = '8080'
-    $swift_url = "${swift_protocol}://${swift_host}:$swift_port/v1/AUTH_%(tenant_id)s"
+    $swift_url = "${swift_protocol}://${swift_host}:${swift_port}/v1/AUTH_%(tenant_id)s"
 
-    class { '::swift::keystone::auth':
-      region          => hiera('CONFIG_KEYSTONE_REGION'),
-      password        => hiera('CONFIG_SWIFT_KS_PW'),
-      operator_roles  => ['admin', 'SwiftOperator', 'ResellerAdmin'],
-      public_url      => $swift_url,
-      internal_url    => $swift_url,
-      admin_url       => $swift_url,
-      configure_s3_endpoint  => false,
+    class { 'swift::keystone::auth':
+      region                => lookup('CONFIG_KEYSTONE_REGION'),
+      password              => lookup('CONFIG_SWIFT_KS_PW'),
+      operator_roles        => ['admin', 'SwiftOperator', 'ResellerAdmin'],
+      public_url            => $swift_url,
+      internal_url          => $swift_url,
+      admin_url             => $swift_url,
+      configure_s3_endpoint => false,
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/trove.pp b/packstack/puppet/modules/packstack/manifests/keystone/trove.pp
index 27c78e957..b6ef5aa22 100644
--- a/packstack/puppet/modules/packstack/manifests/keystone/trove.pp
+++ b/packstack/puppet/modules/packstack/manifests/keystone/trove.pp
@@ -1,13 +1,13 @@
 class packstack::keystone::trove ()
 {
     $trove_protocol = 'http'
-    $trove_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $trove_host = lookup('CONFIG_KEYSTONE_HOST_URL')
     $trove_port = '8779'
-    $trove_url = "${trove_protocol}://${trove_host}:$trove_port/v1.0/%(tenant_id)s"
+    $trove_url = "${trove_protocol}://${trove_host}:${trove_port}/v1.0/%(tenant_id)s"
 
-    class { '::trove::keystone::auth':
-      region       => hiera('CONFIG_KEYSTONE_REGION'),
-      password     => hiera('CONFIG_TROVE_KS_PW'),
+    class { 'trove::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_TROVE_KS_PW'),
       public_url   => $trove_url,
       admin_url    => $trove_url,
       internal_url => $trove_url,
diff --git a/packstack/puppet/modules/packstack/manifests/magnum.pp b/packstack/puppet/modules/packstack/manifests/magnum.pp
index 8eec82806..862840943 100644
--- a/packstack/puppet/modules/packstack/manifests/magnum.pp
+++ b/packstack/puppet/modules/packstack/manifests/magnum.pp
@@ -1,44 +1,58 @@
 class packstack::magnum ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_MAGNUM_API_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_MAGNUM_API_RULES', undef, undef, {}))
 
-    $magnum_cfg_magnum_db_pw = hiera('CONFIG_MAGNUM_DB_PW')
-    $magnum_cfg_magnum_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
-    class { '::magnum::db':
-      database_connection => "mysql+pymysql://magnum:${magnum_cfg_magnum_db_pw}@${magnum_cfg_magnum_mariadb_host}/magnum",
+    class { 'magnum::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'magnum',
+        'password' => lookup('CONFIG_MAGNUM_DB_PW'),
+        'database' => 'magnum',
+      })
     }
 
-    $magnum_protocol = 'http'
-    $magnum_host = hiera('CONFIG_KEYSTONE_HOST_URL')
-    $magnum_port = '9511'
-    $magnum_url = "${magnum_protocol}://${magnum_host}:$magnum_port/v1"
-    class { '::magnum::keystone::authtoken':
-      www_authenticate_uri => "${magnum_protocol}://${magnum_host}:5000/v3",
-      auth_url             => "${magnum_protocol}://${magnum_host}:5000",
-      auth_version         => 'v3',
-      username             => 'magnum',
-      password             => hiera('CONFIG_MAGNUM_KS_PW'),
-      auth_type            => 'password',
-      memcached_servers    => "${magnum_host}:11211",
-      project_name         => 'services'
+    $magnum_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+    class { 'magnum::keystone::authtoken':
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      password             => lookup('CONFIG_MAGNUM_KS_PW'),
     }
 
-    class { '::magnum::api':
-      enabled => true,
-      host    => '0.0.0.0'
+    class { 'magnum::keystone::keystone_auth':
+      username            => 'magnum',
+      password            => lookup('CONFIG_MAGNUM_KS_PW'),
+      auth_url            => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      project_name        => 'services',
+      user_domain_name    => 'Default',
+      project_domain_name => 'Default',
     }
 
-    class { '::magnum::conductor':
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    class { '::magnum::client':
+    class { 'magnum::api':
+      service_name => 'httpd',
+    }
+    class { 'magnum::wsgi::apache':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    class { 'magnum::conductor':
+    }
+
+    class { 'magnum::client':
     }
 
-    class { '::magnum::clients':
-      region_name => hiera('CONFIG_KEYSTONE_REGION')
+    class { 'magnum::clients':
+      region_name => lookup('CONFIG_KEYSTONE_REGION')
     }
 
-    class { '::magnum::certificates':
+    class { 'magnum::certificates':
       cert_manager_type => 'local'
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/magnum/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/magnum/rabbitmq.pp
old mode 100755
new mode 100644
index 43af51416..4f2d867d3
--- a/packstack/puppet/modules/packstack/manifests/magnum/rabbitmq.pp
+++ b/packstack/puppet/modules/packstack/manifests/magnum/rabbitmq.pp
@@ -1,13 +1,8 @@
 class packstack::magnum::rabbitmq ()
 {
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_MAGNUM_SSL_KEY', undef)
-    $kombu_ssl_certfile = hiera('CONFIG_MAGNUM_SSL_CERT', undef)
-
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_MAGNUM_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_MAGNUM_SSL_CERT', undef, undef, undef)
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -18,10 +13,17 @@
       }
       File[$files_to_set_owner] ~> Service<| tag == 'magnum-service' |>
     }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'magnum-service' |>
 
-    class { '::magnum':
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
-      default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
+    class { 'magnum':
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,
       kombu_ssl_certfile    => $kombu_ssl_certfile,
diff --git a/packstack/puppet/modules/packstack/manifests/manila.pp b/packstack/puppet/modules/packstack/manifests/manila.pp
index 7be68c15f..68bd03e12 100644
--- a/packstack/puppet/modules/packstack/manifests/manila.pp
+++ b/packstack/puppet/modules/packstack/manifests/manila.pp
@@ -1,33 +1,34 @@
 class packstack::manila ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_MANILA_API_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_MANILA_API_RULES', undef, undef, {}))
 
-    manila_config {
-      'DEFAULT/glance_host': value => hiera('CONFIG_STORAGE_HOST_URL');
-    }
-
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    class { '::manila::keystone::authtoken':
-      password             => hiera('CONFIG_MANILA_KS_PW'),
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
+    class { 'manila::keystone::authtoken':
+      password             => lookup('CONFIG_MANILA_KS_PW'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
-    class { '::manila::api':
-      bind_host          => $bind_host,
+    class { 'manila::api':
+      service_name => 'httpd',
+    }
+    class { 'manila::wsgi::apache':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
-    class { '::manila::scheduler':
+    class { 'manila::scheduler':
     }
 
-    class { '::manila::share':
+    class { 'manila::share':
     }
 
-    class { '::manila::backends':
-      enabled_share_backends => hiera('CONFIG_MANILA_BACKEND'),
+    class { 'manila::backends':
+      enabled_share_backends => lookup('CONFIG_MANILA_BACKEND'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/manila/backend/generic.pp b/packstack/puppet/modules/packstack/manifests/manila/backend/generic.pp
index 7535b5a97..1cf617050 100644
--- a/packstack/puppet/modules/packstack/manifests/manila/backend/generic.pp
+++ b/packstack/puppet/modules/packstack/manifests/manila/backend/generic.pp
@@ -3,24 +3,17 @@
     ensure_packages(['nfs-utils'], {'ensure' => 'present'})
 
     manila::backend::generic{ 'generic':
-      driver_handles_share_servers => hiera('CONFIG_MANILA_GENERIC_DRV_HANDLES_SHARE_SERVERS'),
-      volume_name_template         => hiera('CONFIG_MANILA_GENERIC_VOLUME_NAME_TEMPLATE'),
-      share_mount_path             => hiera('CONFIG_MANILA_GENERIC_SHARE_MOUNT_PATH'),
+      driver_handles_share_servers => lookup('CONFIG_MANILA_GENERIC_DRV_HANDLES_SHARE_SERVERS'),
+      volume_name_template         => lookup('CONFIG_MANILA_GENERIC_VOLUME_NAME_TEMPLATE'),
+      share_mount_path             => lookup('CONFIG_MANILA_GENERIC_SHARE_MOUNT_PATH'),
     }
 
     packstack::manila::network{ 'generic': }
 
-    if ($::manila_network_type == 'neutron'){
-      $service_instance_network_helper_type = 'neutron'
-    }
-    elsif ($::manila_network_type == 'nova-network'){
-      $service_instance_network_helper_type = 'nova'
-    }
-
-    $admin_username = hiera('CONFIG_KEYSTONE_ADMIN_USERNAME')
-    $admin_password = hiera('CONFIG_KEYSTONE_ADMIN_PW')
+    $admin_username = lookup('CONFIG_KEYSTONE_ADMIN_USERNAME')
+    $admin_password = lookup('CONFIG_KEYSTONE_ADMIN_PW')
     $admin_tenant   = 'admin'
-    $keystone_url   = hiera('CONFIG_KEYSTONE_PUBLIC_URL')
+    $keystone_url   = lookup('CONFIG_KEYSTONE_PUBLIC_URL')
 
     nova_flavor { 'm1.manila':
       ensure => present,
@@ -28,23 +21,23 @@
       ram    => '512',
       disk   => '1',
       vcpus  => '1',
-      require => [ Class['::nova::api'], Class['::nova::keystone::auth'] ],
-    } ->
-    manila::service_instance{ 'generic':
-      service_image_location               => hiera('CONFIG_MANILA_SERVICE_IMAGE_LOCATION'),
-      service_instance_user                => hiera('CONFIG_MANILA_SERVICE_INSTANCE_USER'),
-      service_instance_password            => hiera('CONFIG_MANILA_SERVICE_INSTANCE_PASSWORD'),
-      service_instance_network_helper_type => $service_instance_network_helper_type,
-      service_instance_flavor_id           => 66,
+    }
+    manila::backend::service_instance{ 'generic':
+      service_image_location     => lookup('CONFIG_MANILA_SERVICE_IMAGE_LOCATION'),
+      service_instance_user      => lookup('CONFIG_MANILA_SERVICE_INSTANCE_USER'),
+      service_instance_password  => lookup('CONFIG_MANILA_SERVICE_INSTANCE_PASSWORD'),
+      service_instance_flavor_id => 66,
     }
 
-    class { '::manila::compute::nova':
-      nova_admin_password    => hiera('CONFIG_NOVA_KS_PW'),
-      nova_admin_tenant_name => 'services',
+    class { 'manila::compute::nova':
+      auth_type => 'password',
+      auth_url  => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      password  => lookup('CONFIG_NOVA_KS_PW'),
     }
 
-    class { '::manila::volume::cinder':
-      cinder_admin_password    => hiera('CONFIG_CINDER_KS_PW'),
-      cinder_admin_tenant_name => 'services',
+    class { 'manila::volume::cinder':
+      auth_type => 'password',
+      auth_url  => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      password  => lookup('CONFIG_CINDER_KS_PW'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/manila/backend/glusternative.pp b/packstack/puppet/modules/packstack/manifests/manila/backend/glusternative.pp
index c385d31b5..3aba5bba5 100644
--- a/packstack/puppet/modules/packstack/manifests/manila/backend/glusternative.pp
+++ b/packstack/puppet/modules/packstack/manifests/manila/backend/glusternative.pp
@@ -1,9 +1,9 @@
 class packstack::manila::backend::glusternative ()
 {
     manila::backend::glusternative{ 'glusternative':
-      glusterfs_servers                    => hiera('CONFIG_MANILA_GLUSTERFS_SERVERS'),
-      glusterfs_native_path_to_private_key => hiera('CONFIG_MANILA_GLUSTERFS_NATIVE_PATH_TO_PRIVATE_KEY'),
-      glusterfs_volume_pattern             => hiera('CONFIG_MANILA_GLUSTERFS_VOLUME_PATTERN'),
+      glusterfs_servers                    => lookup('CONFIG_MANILA_GLUSTERFS_SERVERS'),
+      glusterfs_path_to_private_key        => lookup('CONFIG_MANILA_GLUSTERFS_NATIVE_PATH_TO_PRIVATE_KEY'),
+      glusterfs_volume_pattern             => lookup('CONFIG_MANILA_GLUSTERFS_VOLUME_PATTERN'),
     }
 
     packstack::manila::network{ 'glusternative': }
diff --git a/packstack/puppet/modules/packstack/manifests/manila/backend/glusternfs.pp b/packstack/puppet/modules/packstack/manifests/manila/backend/glusternfs.pp
index e63024bc5..5ff6223d7 100644
--- a/packstack/puppet/modules/packstack/manifests/manila/backend/glusternfs.pp
+++ b/packstack/puppet/modules/packstack/manifests/manila/backend/glusternfs.pp
@@ -1,11 +1,11 @@
 class packstack::manila::backend::glusternfs ()
 {
     manila::backend::glusternfs{ 'glusternfs':
-      glusterfs_target              => hiera('CONFIG_MANILA_GLUSTERFS_TARGET'),
-      glusterfs_mount_point_base    => hiera('CONFIG_MANILA_GLUSTERFS_MOUNT_POINT_BASE'),
-      glusterfs_nfs_server_type     => hiera('CONFIG_MANILA_GLUSTERFS_NFS_SERVER_TYPE'),
-      glusterfs_path_to_private_key => hiera('CONFIG_MANILA_GLUSTERFS_PATH_TO_PRIVATE_KEY'),
-      glusterfs_ganesha_server_ip   => hiera('CONFIG_MANILA_GLUSTERFS_GANESHA_SERVER_IP'),
+      glusterfs_target              => lookup('CONFIG_MANILA_GLUSTERFS_TARGET'),
+      glusterfs_mount_point_base    => lookup('CONFIG_MANILA_GLUSTERFS_MOUNT_POINT_BASE'),
+      glusterfs_nfs_server_type     => lookup('CONFIG_MANILA_GLUSTERFS_NFS_SERVER_TYPE'),
+      glusterfs_path_to_private_key => lookup('CONFIG_MANILA_GLUSTERFS_PATH_TO_PRIVATE_KEY'),
+      glusterfs_ganesha_server_ip   => lookup('CONFIG_MANILA_GLUSTERFS_GANESHA_SERVER_IP'),
     }
 
     packstack::manila::network{ 'glusternfs': }
diff --git a/packstack/puppet/modules/packstack/manifests/manila/backend/netapp.pp b/packstack/puppet/modules/packstack/manifests/manila/backend/netapp.pp
index f8f2f10ff..0818d8d78 100644
--- a/packstack/puppet/modules/packstack/manifests/manila/backend/netapp.pp
+++ b/packstack/puppet/modules/packstack/manifests/manila/backend/netapp.pp
@@ -1,17 +1,17 @@
 class packstack::manila::backend::netapp ()
 {
     manila::backend::netapp{ 'netapp':
-      driver_handles_share_servers         => hiera('CONFIG_MANILA_NETAPP_DRV_HANDLES_SHARE_SERVERS'),
-      netapp_transport_type                => hiera('CONFIG_MANILA_NETAPP_TRANSPORT_TYPE'),
-      netapp_login                         => hiera('CONFIG_MANILA_NETAPP_LOGIN'),
-      netapp_password                      => hiera('CONFIG_MANILA_NETAPP_PASSWORD'),
-      netapp_server_hostname               => hiera('CONFIG_MANILA_NETAPP_SERVER_HOSTNAME'),
-      netapp_storage_family                => hiera('CONFIG_MANILA_NETAPP_STORAGE_FAMILY'),
-      netapp_server_port                   => hiera('CONFIG_MANILA_NETAPP_SERVER_PORT'),
-      netapp_vserver                       => hiera('CONFIG_MANILA_NETAPP_VSERVER', undef),
-      netapp_aggregate_name_search_pattern => hiera('CONFIG_MANILA_NETAPP_AGGREGATE_NAME_SEARCH_PATTERN'),
-      netapp_root_volume_aggregate         => hiera('CONFIG_MANILA_NETAPP_ROOT_VOLUME_AGGREGATE', undef),
-      netapp_root_volume_name              => hiera('CONFIG_MANILA_NETAPP_ROOT_VOLUME_NAME', undef),
+      driver_handles_share_servers         => lookup('CONFIG_MANILA_NETAPP_DRV_HANDLES_SHARE_SERVERS'),
+      netapp_transport_type                => lookup('CONFIG_MANILA_NETAPP_TRANSPORT_TYPE'),
+      netapp_login                         => lookup('CONFIG_MANILA_NETAPP_LOGIN'),
+      netapp_password                      => lookup('CONFIG_MANILA_NETAPP_PASSWORD'),
+      netapp_server_hostname               => lookup('CONFIG_MANILA_NETAPP_SERVER_HOSTNAME'),
+      netapp_storage_family                => lookup('CONFIG_MANILA_NETAPP_STORAGE_FAMILY'),
+      netapp_server_port                   => lookup('CONFIG_MANILA_NETAPP_SERVER_PORT'),
+      netapp_vserver                       => lookup('CONFIG_MANILA_NETAPP_VSERVER', undef, undef, undef),
+      netapp_aggregate_name_search_pattern => lookup('CONFIG_MANILA_NETAPP_AGGREGATE_NAME_SEARCH_PATTERN'),
+      netapp_root_volume_aggregate         => lookup('CONFIG_MANILA_NETAPP_ROOT_VOLUME_AGGREGATE', undef, undef, undef),
+      netapp_root_volume_name              => lookup('CONFIG_MANILA_NETAPP_ROOT_VOLUME_NAME', undef, undef, undef),
     }
 
     packstack::manila::network{ 'netapp': }
diff --git a/packstack/puppet/modules/packstack/manifests/manila/network.pp b/packstack/puppet/modules/packstack/manifests/manila/network.pp
index 3d9e1f2d5..85ae6c126 100644
--- a/packstack/puppet/modules/packstack/manifests/manila/network.pp
+++ b/packstack/puppet/modules/packstack/manifests/manila/network.pp
@@ -1,27 +1,27 @@
 
 define packstack::manila::network ($backend_name = $name) {
-  $manila_network_type = hiera('CONFIG_MANILA_NETWORK_TYPE')
+  $manila_network_type = lookup('CONFIG_MANILA_NETWORK_TYPE')
 
-  if ($manila_network_type == 'neutron'){
-    class { '::manila::network::neutron':
-      neutron_admin_password     => hiera('CONFIG_NEUTRON_KS_PW'),
-      neutron_admin_tenant_name  => 'services',
+  case $manila_network_type {
+    'neutron': {
+      class { 'manila::network::neutron':
+        auth_type => 'password',
+        auth_url  => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+        password  => lookup('CONFIG_NEUTRON_KS_PW'),
+      }
     }
-  }
-  elsif ($manila_network_type == 'nova-network'){
-    manila::network::nova_network{ $backend_name: }
-  }
-  elsif ($manila_network_type == 'standalone'){
-    manila::network::standalone{ $backend_name:
-      standalone_network_plugin_gateway           => hiera('CONFIG_MANILA_NETWORK_STANDALONE_GATEWAY'),
-      standalone_network_plugin_mask              => hiera('CONFIG_MANILA_NETWORK_STANDALONE_NETMASK'),
-      standalone_network_plugin_segmentation_id   => hiera('CONFIG_MANILA_NETWORK_STANDALONE_SEG_ID'),
-      standalone_network_plugin_allowed_ip_ranges => hiera('CONFIG_MANILA_NETWORK_STANDALONE_IP_RANGE'),
-      standalone_network_plugin_ip_version        => hiera('CONFIG_MANILA_NETWORK_STANDALONE_IP_VERSION'),
+    'standalone': {
+      manila::network::standalone{ $backend_name:
+        standalone_network_plugin_gateway           => lookup('CONFIG_MANILA_NETWORK_STANDALONE_GATEWAY'),
+        standalone_network_plugin_mask              => lookup('CONFIG_MANILA_NETWORK_STANDALONE_NETMASK'),
+        standalone_network_plugin_segmentation_id   => lookup('CONFIG_MANILA_NETWORK_STANDALONE_SEG_ID'),
+        standalone_network_plugin_allowed_ip_ranges => lookup('CONFIG_MANILA_NETWORK_STANDALONE_IP_RANGE'),
+        standalone_network_plugin_ip_version        => lookup('CONFIG_MANILA_NETWORK_STANDALONE_IP_VERSION'),
+      }
+    }
+    default: {
+      fail("The value ${manila_network_type} is not a valid value for the Manila network type.")
     }
-  }
-  else {
-    fail("The value ${manila_network_type} is not a valid value for the Manila network type.")
   }
 }
 
diff --git a/packstack/puppet/modules/packstack/manifests/manila/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/manila/rabbitmq.pp
index 5a555e793..d57ca25f1 100644
--- a/packstack/puppet/modules/packstack/manifests/manila/rabbitmq.pp
+++ b/packstack/puppet/modules/packstack/manifests/manila/rabbitmq.pp
@@ -1,13 +1,13 @@
 class packstack::manila::rabbitmq ()
 {
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_MANILA_SSL_KEY', undef)
-    $kombu_ssl_certfile = hiera('CONFIG_MANILA_SSL_CERT', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_MANILA_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_MANILA_SSL_CERT', undef, undef, undef)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -19,17 +19,27 @@
       }
       File[$files_to_set_owner] ~> Service<| tag == 'manila-service' |>
     }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'manila-service' |>
 
-    $db_pw = hiera('CONFIG_MANILA_DB_PW')
-    $mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
+    class { 'manila::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
 
-    class { '::manila::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'manila::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'manila',
+        'password' => lookup('CONFIG_MANILA_DB_PW'),
+        'database' => 'manila',
+      })
     }
 
-    class { '::manila':
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
+    class { 'manila':
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
       default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      sql_connection        => "mysql+pymysql://manila:${db_pw}@${mariadb_host}/manila",
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/mariadb.pp b/packstack/puppet/modules/packstack/manifests/mariadb.pp
index 52c6ef3ab..08d96b7e8 100644
--- a/packstack/puppet/modules/packstack/manifests/mariadb.pp
+++ b/packstack/puppet/modules/packstack/manifests/mariadb.pp
@@ -1,33 +1,21 @@
 class packstack::mariadb ()
 {
-  if hiera('CONFIG_MARIADB_INSTALL') == 'y' {
-    create_resources(packstack::firewall, hiera('FIREWALL_MARIADB_RULES', {}))
-    $max_connections = hiera('CONFIG_SERVICE_WORKERS') * 128
+  if lookup('CONFIG_MARIADB_INSTALL') == 'y' {
+    create_resources(packstack::firewall, lookup('FIREWALL_MARIADB_RULES', undef, undef, {}))
+    $max_connections = lookup('CONFIG_SERVICE_WORKERS') * 128
 
-    if ($::mariadb_provides_galera) {
-      # Since mariadb 10.1 galera is included in main mariadb
-      $mariadb_package_name = 'mariadb-server-galera'
-      $mariadb_present      = 'present'
-    } else  {
-      # Package mariadb-server conflicts with mariadb-galera-server
-      $mariadb_package_name = 'mariadb-galera-server'
-      $mariadb_present      = 'absent'
-    }
-    ensure_packages(['mariadb-server'], {'ensure' => $mariadb_present})
-
-    $bind_address = hiera('CONFIG_IP_VERSION') ? {
+    $bind_address = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    $mysql_root_password = hiera('CONFIG_MARIADB_PW')
+    $mysql_root_password = lookup('CONFIG_MARIADB_PW')
 
-    class { '::mysql::server':
-      package_name     => $mariadb_package_name,
+    class { 'mysql::server':
+      package_name     => 'mariadb-server-galera',
       restart          => true,
       root_password    => $mysql_root_password,
-      require          => Package['mariadb-server'],
       override_options => {
         'mysqld' => {
           'bind_address'           => $bind_address,
@@ -51,19 +39,22 @@
       require => Class['mysql::server'],
     }
 
-    if ($::fqdn != '' and $::fqdn != 'localhost') {
-      mysql_user { [ "root@${::fqdn}", "@${::fqdn}"]:
+    $fqdn = $facts['networking']['fqdn']
+    $hostname = $facts['networking']['hostname']
+
+    if ($fqdn != '' and $fqdn != 'localhost') {
+      mysql_user { [ "root@${fqdn}", "@${fqdn}"]:
         ensure  => 'absent',
         require => Class['mysql::server'],
       }
     }
-    if ($::fqdn != $::hostname and $::hostname != 'localhost') {
-      mysql_user { ["root@${::hostname}", "@${::hostname}"]:
+    if ($fqdn != $hostname and $hostname != 'localhost') {
+      mysql_user { ["root@${hostname}", "@${hostname}"]:
         ensure  => 'absent',
         require => Class['mysql::server'],
       }
     }
   } else {
-        class { '::remote::db': }
+        class { 'remote::db': }
   }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/mariadb/services.pp b/packstack/puppet/modules/packstack/manifests/mariadb/services.pp
old mode 100755
new mode 100644
index 1cfdd5628..8a1efd3bf
--- a/packstack/puppet/modules/packstack/manifests/mariadb/services.pp
+++ b/packstack/puppet/modules/packstack/manifests/mariadb/services.pp
@@ -1,134 +1,116 @@
 class packstack::mariadb::services ()
 {
-    class { '::keystone::db::mysql':
+    class { 'keystone::db::mysql':
       user          => 'keystone_admin',
-      password      => hiera('CONFIG_KEYSTONE_DB_PW'),
+      password      => lookup('CONFIG_KEYSTONE_DB_PW'),
       allowed_hosts => '%',
       charset       => 'utf8',
     }
 
-    if hiera('CONFIG_CINDER_INSTALL') == 'y' {
-         class { '::cinder::db::mysql':
-           password      => hiera('CONFIG_CINDER_DB_PW'),
-           host          => '%',
-           allowed_hosts => '%',
-           charset       => 'utf8',
-         }
+    if lookup('CONFIG_CINDER_INSTALL') == 'y' {
+      class { 'cinder::db::mysql':
+        password      => lookup('CONFIG_CINDER_DB_PW'),
+        host          => '%',
+        allowed_hosts => '%',
+        charset       => 'utf8',
+      }
     }
 
-    if hiera('CONFIG_GLANCE_INSTALL') == 'y' {
-        class { '::glance::db::mysql':
-          password      => hiera('CONFIG_GLANCE_DB_PW'),
+    if lookup('CONFIG_GLANCE_INSTALL') == 'y' {
+        class { 'glance::db::mysql':
+          password      => lookup('CONFIG_GLANCE_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
           charset       => 'utf8',
         }
     }
 
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
-        class { '::gnocchi::db::mysql':
-          password      => hiera('CONFIG_GNOCCHI_DB_PW'),
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+        class { 'gnocchi::db::mysql':
+          password      => lookup('CONFIG_GNOCCHI_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
         }
     }
 
-    if hiera('CONFIG_AODH_INSTALL') == 'y' and
-       hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
-        class { '::aodh::db::mysql':
-          password      => hiera('CONFIG_AODH_DB_PW'),
+    if lookup('CONFIG_AODH_INSTALL') == 'y' and
+      lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+        class { 'aodh::db::mysql':
+          password      => lookup('CONFIG_AODH_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
         }
     }
 
-    if hiera('CONFIG_HEAT_INSTALL') == 'y' {
-        class { '::heat::db::mysql':
-          password      => hiera('CONFIG_HEAT_DB_PW'),
-          host          => '%',
-          allowed_hosts => '%',
-          charset       => 'utf8',
-       }
+    if lookup('CONFIG_HEAT_INSTALL') == 'y' {
+      class { 'heat::db::mysql':
+        password      => lookup('CONFIG_HEAT_DB_PW'),
+        host          => '%',
+        allowed_hosts => '%',
+        charset       => 'utf8',
+      }
     }
 
-    if hiera('CONFIG_MAGNUM_INSTALL') == 'y' {
-        class { '::magnum::db::mysql':
-          password      => hiera('CONFIG_MAGNUM_DB_PW'),
-          host          => '%',
-          allowed_hosts => '%',
-          charset       => 'utf8',
-       }
+    if lookup('CONFIG_MAGNUM_INSTALL') == 'y' {
+      class { 'magnum::db::mysql':
+        password      => lookup('CONFIG_MAGNUM_DB_PW'),
+        host          => '%',
+        allowed_hosts => '%',
+        charset       => 'utf8',
+      }
     }
 
-    if hiera('CONFIG_IRONIC_INSTALL') == 'y' {
-        class { '::ironic::db::mysql':
-          password      => hiera('CONFIG_IRONIC_DB_PW'),
-          host          => '%',
-          allowed_hosts => '%',
-          charset       => 'utf8',
-        }
+    if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
+      class { 'ironic::db::mysql':
+        password      => lookup('CONFIG_IRONIC_DB_PW'),
+        host          => '%',
+        allowed_hosts => '%',
+        charset       => 'utf8',
+      }
     }
 
-    if hiera('CONFIG_MANILA_INSTALL') == 'y' {
-        class { '::manila::db::mysql':
-          password      => hiera('CONFIG_MANILA_DB_PW'),
+    if lookup('CONFIG_MANILA_INSTALL') == 'y' {
+        class { 'manila::db::mysql':
+          password      => lookup('CONFIG_MANILA_DB_PW'),
           allowed_hosts => '%',
           charset       => 'utf8',
         }
     }
 
-    if hiera('CONFIG_NEUTRON_INSTALL') == 'y' {
-        class { '::neutron::db::mysql':
-          password      => hiera('CONFIG_NEUTRON_DB_PW'),
+    if lookup('CONFIG_NEUTRON_INSTALL') == 'y' {
+        class { 'neutron::db::mysql':
+          password      => lookup('CONFIG_NEUTRON_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
-          dbname        => hiera('CONFIG_NEUTRON_L2_DBNAME'),
+          dbname        => lookup('CONFIG_NEUTRON_L2_DBNAME'),
           charset       => 'utf8',
         }
     }
 
-    if hiera('CONFIG_NOVA_INSTALL') == 'y' {
-        class { '::nova::db::mysql':
-          password      => hiera('CONFIG_NOVA_DB_PW'),
+    if lookup('CONFIG_NOVA_INSTALL') == 'y' {
+        class { 'nova::db::mysql':
+          password      => lookup('CONFIG_NOVA_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
           charset       => 'utf8',
         }
-        class { '::nova::db::mysql_api':
-          password      => hiera('CONFIG_NOVA_DB_PW'),
+        class { 'nova::db::mysql_api':
+          password      => lookup('CONFIG_NOVA_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
           charset       => 'utf8',
         }
-        class { '::placement::db::mysql':
-          password      => hiera('CONFIG_NOVA_DB_PW'),
+        class { 'placement::db::mysql':
+          password      => lookup('CONFIG_NOVA_DB_PW'),
           host          => '%',
           allowed_hosts => '%',
           charset       => 'utf8',
         }
     }
 
-    if hiera('CONFIG_PANKO_INSTALL') == 'y' and
-       hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
-        class { '::panko::db::mysql':
-          password      => hiera('CONFIG_PANKO_DB_PW'),
-          host          => '%',
-          allowed_hosts => '%',
-        }
-    }
-
-    if hiera('CONFIG_SAHARA_INSTALL') == 'y' {
-        class { '::sahara::db::mysql':
-          password      => hiera('CONFIG_SAHARA_DB_PW'),
-          host          => '%',
-          allowed_hosts => '%',
-        }
-
-    }
-
-    if hiera('CONFIG_TROVE_INSTALL') == 'y' {
-        class { '::trove::db::mysql':
-            password      => hiera('CONFIG_TROVE_DB_PW'),
+    if lookup('CONFIG_TROVE_INSTALL') == 'y' {
+        class { 'trove::db::mysql':
+            password      => lookup('CONFIG_TROVE_DB_PW'),
             host          => '%',
             allowed_hosts => '%',
             charset       => 'utf8',
diff --git a/packstack/puppet/modules/packstack/manifests/mariadb/services_remote.pp b/packstack/puppet/modules/packstack/manifests/mariadb/services_remote.pp
old mode 100755
new mode 100644
index 8d11aa3de..ef3448986
--- a/packstack/puppet/modules/packstack/manifests/mariadb/services_remote.pp
+++ b/packstack/puppet/modules/packstack/manifests/mariadb/services_remote.pp
@@ -1,370 +1,339 @@
 class packstack::mariadb::services_remote () {
-        remote_database { 'keystone':
-          ensure      => 'present',
-          charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
-          provider    => 'mysql',
-        }
+    remote_database { 'keystone':
+      ensure      => 'present',
+      charset     => 'utf8',
+      db_host     => lookup('CONFIG_MARIADB_HOST'),
+      db_user     => lookup('CONFIG_MARIADB_USER'),
+      db_password => lookup('CONFIG_MARIADB_PW'),
+      provider    => 'mysql',
+    }
 
-        $mariadb_keystone_noinstall_db_pw = hiera('CONFIG_KEYSTONE_DB_PW')
+    $mariadb_keystone_noinstall_db_pw = lookup('CONFIG_KEYSTONE_DB_PW')
 
-        remote_database_user { 'keystone_admin@%':
-          password_hash => mysql_password($mariadb_keystone_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
-          provider      => 'mysql',
-          require       => Remote_database['keystone'],
-        }
+    remote_database_user { 'keystone_admin@%':
+      password_hash => mysql_password($mariadb_keystone_noinstall_db_pw),
+      db_host       => lookup('CONFIG_MARIADB_HOST'),
+      db_user       => lookup('CONFIG_MARIADB_USER'),
+      db_password   => lookup('CONFIG_MARIADB_PW'),
+      provider      => 'mysql',
+      require       => Remote_database['keystone'],
+    }
 
-        remote_database_grant { 'keystone_admin@%/keystone':
-          privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
-          provider    => 'mysql',
-          require     => Remote_database_user['keystone_admin@%'],
-        }
-
-    if hiera('CONFIG_CINDER_INSTALL') == 'y' {
-	    remote_database { 'cinder':
-	      ensure      => 'present',
-	      charset     => 'utf8',
-	      db_host     => hiera('CONFIG_MARIADB_HOST'),
-	      db_user     => hiera('CONFIG_MARIADB_USER'),
-	      db_password => hiera('CONFIG_MARIADB_PW'),
-	      provider    => 'mysql',
-	    }
-
-	    $mariadb_cinder_noinstall_db_pw = hiera('CONFIG_CINDER_DB_PW')
-
-	    remote_database_user { 'cinder@%':
-	      password_hash => mysql_password($mariadb_cinder_noinstall_db_pw),
-	      db_host       => hiera('CONFIG_MARIADB_HOST'),
-	      db_user       => hiera('CONFIG_MARIADB_USER'),
-	      db_password   => hiera('CONFIG_MARIADB_PW'),
-	      provider      => 'mysql',
-	      require       => Remote_database['cinder'],
-	    }
-
-	    remote_database_grant { 'cinder@%/cinder':
-	      privileges  => 'all',
-	      db_host     => hiera('CONFIG_MARIADB_HOST'),
-	      db_user     => hiera('CONFIG_MARIADB_USER'),
-	      db_password => hiera('CONFIG_MARIADB_PW'),
-	      provider    => 'mysql',
-	      require     => Remote_database_user['cinder@%'],
-	    }
+    remote_database_grant { 'keystone_admin@%/keystone':
+      privileges  => 'all',
+      db_host     => lookup('CONFIG_MARIADB_HOST'),
+      db_user     => lookup('CONFIG_MARIADB_USER'),
+      db_password => lookup('CONFIG_MARIADB_PW'),
+      provider    => 'mysql',
+      require     => Remote_database_user['keystone_admin@%'],
     }
 
-    if hiera('CONFIG_GLANCE_INSTALL') == 'y' {
+    if lookup('CONFIG_CINDER_INSTALL') == 'y' {
+      remote_database { 'cinder':
+        ensure      => 'present',
+        charset     => 'utf8',
+        db_host     => lookup('CONFIG_MARIADB_HOST'),
+        db_user     => lookup('CONFIG_MARIADB_USER'),
+        db_password => lookup('CONFIG_MARIADB_PW'),
+        provider    => 'mysql',
+      }
+
+      $mariadb_cinder_noinstall_db_pw = lookup('CONFIG_CINDER_DB_PW')
+
+      remote_database_user { 'cinder@%':
+        password_hash => mysql_password($mariadb_cinder_noinstall_db_pw),
+        db_host       => lookup('CONFIG_MARIADB_HOST'),
+        db_user       => lookup('CONFIG_MARIADB_USER'),
+        db_password   => lookup('CONFIG_MARIADB_PW'),
+        provider      => 'mysql',
+        require       => Remote_database['cinder'],
+      }
+
+      remote_database_grant { 'cinder@%/cinder':
+        privileges  => 'all',
+        db_host     => lookup('CONFIG_MARIADB_HOST'),
+        db_user     => lookup('CONFIG_MARIADB_USER'),
+        db_password => lookup('CONFIG_MARIADB_PW'),
+        provider    => 'mysql',
+        require     => Remote_database_user['cinder@%'],
+      }
+    }
+
+    if lookup('CONFIG_GLANCE_INSTALL') == 'y' {
         remote_database { 'glance':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $mariadb_glance_noinstall_db_pw = hiera('CONFIG_GLANCE_DB_PW')
+        $mariadb_glance_noinstall_db_pw = lookup('CONFIG_GLANCE_DB_PW')
 
         remote_database_user { 'glance@%':
           password_hash => mysql_password($mariadb_glance_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['glance'],
         }
 
         remote_database_grant { 'glance@%/glance':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['glance@%'],
         }
     }
 
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
         remote_database { 'gnocchi':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $gnocchi_cfg_db_pw = hiera('CONFIG_GNOCCHI_DB_PW')
+        $gnocchi_cfg_db_pw = lookup('CONFIG_GNOCCHI_DB_PW')
 
         remote_database_user { 'gnocchi@%':
           password_hash => mysql_password($gnocchi_cfg_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['gnocchi'],
         }
 
         remote_database_grant { 'gnocchi@%/gnocchi':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['gnocchi@%'],
         }
     }
 
-    if hiera('CONFIG_AODH_INSTALL') == 'y' {
+    if lookup('CONFIG_AODH_INSTALL') == 'y' {
         remote_database { 'aodh':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $aodh_cfg_db_pw = hiera('CONFIG_AODH_DB_PW')
+        $aodh_cfg_db_pw = lookup('CONFIG_AODH_DB_PW')
 
         remote_database_user { 'aodh@%':
           password_hash => mysql_password($aodh_cfg_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['aodh'],
         }
 
         remote_database_grant { 'aodh@%/aodh':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['aodh@%'],
         }
     }
 
-    if hiera('CONFIG_PANKO_INSTALL') == 'y' {
-        remote_database { 'panko':
-          ensure      => 'present',
-          charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
-          provider    => 'mysql',
-        }
-
-        $panko_cfg_db_pw = hiera('CONFIG_PANKO_DB_PW')
-
-        remote_database_user { 'panko@%':
-          password_hash => mysql_password($panko_cfg_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
-          provider      => 'mysql',
-          require       => Remote_database['panko'],
-        }
-
-        remote_database_grant { 'panko@%/panko':
-          privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
-          provider    => 'mysql',
-          require     => Remote_database_user['panko@%'],
-        }
-    }
-
-    if hiera('CONFIG_HEAT_INSTALL') == 'y' {
+    if lookup('CONFIG_HEAT_INSTALL') == 'y' {
         remote_database { 'heat':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $mariadb_heat_noinstall_db_pw = hiera('CONFIG_HEAT_DB_PW')
+        $mariadb_heat_noinstall_db_pw = lookup('CONFIG_HEAT_DB_PW')
 
         remote_database_user { 'heat@%':
           password_hash => mysql_password($mariadb_heat_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['heat'],
         }
 
         remote_database_grant { 'heat@%/heat':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['heat@%'],
         }
     }
 
-    if hiera('CONFIG_MAGNUM_INSTALL') == 'y' {
+    if lookup('CONFIG_MAGNUM_INSTALL') == 'y' {
         remote_database { 'magnum':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $mariadb_magnum_noinstall_db_pw = hiera('CONFIG_MAGNUM_DB_PW')
+        $mariadb_magnum_noinstall_db_pw = lookup('CONFIG_MAGNUM_DB_PW')
 
         remote_database_user { 'magnum@%':
           password_hash => mysql_password($mariadb_magnum_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['magnum'],
         }
 
         remote_database_grant { 'magnum@%/magnum':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['magnum@%'],
         }
     }
 
-    if hiera('CONFIG_IRONIC_INSTALL') == 'y' {
+    if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
         remote_database { 'ironic':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $mariadb_ironic_noinstall_db_pw = hiera('CONFIG_IRONIC_DB_PW')
+        $mariadb_ironic_noinstall_db_pw = lookup('CONFIG_IRONIC_DB_PW')
 
         remote_database_user { 'ironic@%':
           password_hash => mysql_password($mariadb_ironic_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['ironic'],
         }
 
         remote_database_grant { 'ironic@%/ironic':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['ironic@%'],
         }
     }
 
-    if hiera('CONFIG_MANILA_INSTALL') == 'y' {
+    if lookup('CONFIG_MANILA_INSTALL') == 'y' {
         remote_database { 'manila':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $mariadb_manila_noinstall_db_pw = hiera('CONFIG_MANILA_DB_PW')
+        $mariadb_manila_noinstall_db_pw = lookup('CONFIG_MANILA_DB_PW')
 
         remote_database_user { 'manila@%':
           password_hash => mysql_password($mariadb_manila_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['manila'],
         }
 
         remote_database_grant { 'manila@%/manila':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['manila@%'],
         }
     }
 
-    if hiera('CONFIG_NEUTRON_INSTALL') == 'y' {
-        $mariadb_neutron_noinstall_db_pw     = hiera('CONFIG_NEUTRON_DB_PW')
-        $mariadb_neutron_noinstall_l2_dbname = hiera('CONFIG_NEUTRON_L2_DBNAME')
+    if lookup('CONFIG_NEUTRON_INSTALL') == 'y' {
+        $mariadb_neutron_noinstall_db_pw     = lookup('CONFIG_NEUTRON_DB_PW')
+        $mariadb_neutron_noinstall_l2_dbname = lookup('CONFIG_NEUTRON_L2_DBNAME')
 
         remote_database { $mariadb_neutron_noinstall_l2_dbname:
           ensure      => present,
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
         remote_database_user { 'neutron@%':
           password_hash => mysql_password($mariadb_neutron_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database[$mariadb_neutron_noinstall_l2_dbname],
         }
 
         remote_database_grant { "neutron@%/${mariadb_neutron_noinstall_l2_dbname}":
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['neutron@%'],
         }
     }
 
-    if hiera('CONFIG_NOVA_INSTALL') == 'y' {
+    if lookup('CONFIG_NOVA_INSTALL') == 'y' {
         remote_database { 'nova':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $mariadb_nova_noinstall_db_pw = hiera('CONFIG_NOVA_DB_PW')
+        $mariadb_nova_noinstall_db_pw = lookup('CONFIG_NOVA_DB_PW')
 
         remote_database_user { 'nova@%':
           password_hash => mysql_password($mariadb_nova_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['nova'],
         }
 
         remote_database_grant { 'nova@%/nova':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['nova@%'],
         }
@@ -372,26 +341,26 @@
         remote_database { 'nova_api':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
         remote_database_user { 'nova_api@%':
           password_hash => mysql_password($mariadb_nova_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['nova_api'],
         }
 
         remote_database_grant { 'nova_api@%/nova_api':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['nova_api@%'],
         }
@@ -399,26 +368,26 @@
         remote_database { 'placement':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
         remote_database_user { 'placement@%':
           password_hash => mysql_password($mariadb_nova_noinstall_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['placement'],
         }
 
         remote_database_grant { 'placement@%/placement':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['placement@%'],
         }
@@ -426,17 +395,17 @@
         remote_database { 'nova_cell0':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
         remote_database_grant { 'nova@%/nova_cell0':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => [ Remote_database_user['nova@%'],
                           Remote_database['nova_cell0'] ],
@@ -444,63 +413,32 @@
 
     }
 
-    if hiera('CONFIG_SAHARA_INSTALL') == 'y' {
-        remote_database { 'sahara':
-          ensure      => 'present',
-          charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
-          provider    => 'mysql',
-        }
-
-        $sahara_cfg_sahara_db_pw = hiera('CONFIG_SAHARA_DB_PW')
-
-        remote_database_user { 'sahara@%':
-          password_hash => mysql_password($sahara_cfg_sahara_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
-          provider      => 'mysql',
-          require       => Remote_database['sahara'],
-        }
-
-        remote_database_grant { 'sahara@%/sahara':
-          privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
-          provider    => 'mysql',
-          require     => Remote_database_user['sahara@%'],
-        }
-    }
-
-    if hiera('CONFIG_TROVE_INSTALL') == 'y' {
+    if lookup('CONFIG_TROVE_INSTALL') == 'y' {
         remote_database { 'trove':
           ensure      => 'present',
           charset     => 'utf8',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
         }
 
-        $trove_cfg_trove_db_pw = hiera('CONFIG_TROVE_DB_PW')
+        $trove_cfg_trove_db_pw = lookup('CONFIG_TROVE_DB_PW')
 
         remote_database_user { 'trove@%':
           password_hash => mysql_password($trove_cfg_trove_db_pw),
-          db_host       => hiera('CONFIG_MARIADB_HOST'),
-          db_user       => hiera('CONFIG_MARIADB_USER'),
-          db_password   => hiera('CONFIG_MARIADB_PW'),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
           provider      => 'mysql',
           require       => Remote_database['trove'],
         }
 
         remote_database_grant { 'trove@%/trove':
           privileges  => 'all',
-          db_host     => hiera('CONFIG_MARIADB_HOST'),
-          db_user     => hiera('CONFIG_MARIADB_USER'),
-          db_password => hiera('CONFIG_MARIADB_PW'),
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
           provider    => 'mysql',
           require     => Remote_database_user['trove@%'],
         }
diff --git a/packstack/puppet/modules/packstack/manifests/memcached.pp b/packstack/puppet/modules/packstack/manifests/memcached.pp
index 27fd745dd..0dcd14298 100644
--- a/packstack/puppet/modules/packstack/manifests/memcached.pp
+++ b/packstack/puppet/modules/packstack/manifests/memcached.pp
@@ -1,12 +1,12 @@
 class packstack::memcached ()
 {
-    $memcached_bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $memcached_bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    class { '::memcached':
+    class { 'memcached':
       listen_ip  => $memcached_bind_host,
       max_memory => '10%',
     }
diff --git a/packstack/puppet/modules/packstack/manifests/netns.pp b/packstack/puppet/modules/packstack/manifests/netns.pp
deleted file mode 100644
index e994fbfb0..000000000
--- a/packstack/puppet/modules/packstack/manifests/netns.pp
+++ /dev/null
@@ -1,20 +0,0 @@
-#
-# Checks if netns is supported and if not updates kernel, iputils
-# and iproute
-
-class packstack::netns (
-  $warning = 'Kernel package with netns support has been installed.'
-) {
-  if $::netns_support != true {
-    exec { 'netns_dependecy_install':
-      path    => '/usr/bin/',
-      command => 'yum update -y kernel iputils iproute',
-      timeout => 900,
-    }
-
-    notify { 'packstack_info':
-      message => $warning,
-      require => Exec['netns_dependecy_install'],
-    }
-  }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron.pp b/packstack/puppet/modules/packstack/manifests/neutron.pp
index 3070baf82..6190b5c9c 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron.pp
@@ -1,9 +1,3 @@
 class packstack::neutron ()
 {
-    $neutron_db_host         = hiera('CONFIG_MARIADB_HOST_URL')
-    $neutron_db_name         = hiera('CONFIG_NEUTRON_L2_DBNAME')
-    $neutron_db_user         = 'neutron'
-    $neutron_db_password     = hiera('CONFIG_NEUTRON_DB_PW')
-    $neutron_sql_connection  = "mysql+pymysql://${neutron_db_user}:${neutron_db_password}@${neutron_db_host}/${neutron_db_name}"
-    $neutron_user_password   = hiera('CONFIG_NEUTRON_KS_PW')
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/api.pp b/packstack/puppet/modules/packstack/manifests/neutron/api.pp
index 829dabbbe..8fdb38fa0 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/api.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/api.pp
@@ -1,43 +1,55 @@
 class packstack::neutron::api ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_NEUTRON_SERVER_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_NEUTRON_SERVER_RULES', undef, undef, {}))
 
-    $neutron_db_host         = hiera('CONFIG_MARIADB_HOST_URL')
-    $neutron_db_name         = hiera('CONFIG_NEUTRON_L2_DBNAME')
-    $neutron_db_user         = 'neutron'
-    $neutron_db_password     = hiera('CONFIG_NEUTRON_DB_PW')
-    $neutron_sql_connection  = "mysql+pymysql://${neutron_db_user}:${neutron_db_password}@${neutron_db_host}/${neutron_db_name}"
-    $neutron_user_password   = hiera('CONFIG_NEUTRON_KS_PW')
-    $neutron_fwaas_enabled   = str2bool(hiera('CONFIG_NEUTRON_FWAAS'))
-    $neutron_vpnaas_enabled  = str2bool(hiera('CONFIG_NEUTRON_VPNAAS'))
+    $neutron_vpnaas_enabled = str2bool(lookup('CONFIG_NEUTRON_VPNAAS'))
 
-    class { '::neutron::keystone::authtoken':
-      username             => 'neutron',
-      password             => $neutron_user_password,
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
-      project_name         => 'services',
+    class { 'neutron::keystone::authtoken':
+      password             => lookup('CONFIG_NEUTRON_KS_PW'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
-    class { '::neutron::server':
-      database_connection   => $neutron_sql_connection,
-      sync_db               => true,
-      enabled               => true,
-      api_workers           => hiera('CONFIG_SERVICE_WORKERS'),
-      rpc_workers           => hiera('CONFIG_SERVICE_WORKERS'),
-      service_providers     => hiera_array('SERVICE_PROVIDERS'),
-      ensure_fwaas_package  => $neutron_fwaas_enabled,
-      ensure_vpnaas_package => $neutron_vpnaas_enabled,
+    class { 'neutron::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'neutron',
+        'password' => lookup('CONFIG_NEUTRON_DB_PW'),
+        'database' => lookup('CONFIG_NEUTRON_L2_DBNAME'),
+      })
     }
 
-    file { '/etc/neutron/api-paste.ini':
-      ensure  => file,
-      mode    => '0640',
+    $rpc_workrers = lookup('CONFIG_NEUTRON_L2_AGENT') ? {
+      'ovn'   => 0,
+      default => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+    $rpc_service_name = $rpc_workers ? {
+      0       => false,
+      default => undef,
+    }
+    $rpc_state_report_workers = lookup('CONFIG_NEUTRON_L2_AGENT') ? {
+      'ovn'   => 0,
+      default => undef,
     }
 
-    if $neutron_vpnaas_enabled {
-      class { '::neutron::services::vpnaas': }
+    class { 'neutron::wsgi::apache':
+      bind_host => $bind_host,
+      ssl       => false,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+    class { 'neutron::server':
+      sync_db                  => true,
+      enabled                  => true,
+      api_workers              => lookup('CONFIG_SERVICE_WORKERS'),
+      rpc_workers              => $rpc_workers,
+      rpc_state_report_workers => $rpc_state_report_workers,
+      api_service_name         => 'httpd',
+      rpc_service_name         => $rpc_service_name,
+      service_providers        => lookup('SERVICE_PROVIDERS', { merge => 'unique' }),
     }
 
-    Class['::neutron::server'] -> File['/etc/neutron/api-paste.ini']
+    if $neutron_vpnaas_enabled {
+      class { 'neutron::services::vpnaas': }
+    }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/dhcp.pp b/packstack/puppet/modules/packstack/manifests/neutron/dhcp.pp
index a23e52190..e6a53c434 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/dhcp.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/dhcp.pp
@@ -1,10 +1,10 @@
 class packstack::neutron::dhcp ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_NEUTRON_DHCPIN_RULES', {}))
-    create_resources(packstack::firewall, hiera('FIREWALL_NEUTRON_DHCPOUT_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_NEUTRON_DHCPIN_RULES', undef, undef, {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_NEUTRON_DHCPOUT_RULES', undef, undef, {}))
 
-    class { '::neutron::agents::dhcp':
-      interface_driver    => hiera('CONFIG_NEUTRON_DHCP_INTERFACE_DRIVER'),
-      debug               => hiera('CONFIG_DEBUG_MODE'),
+    class { 'neutron::agents::dhcp':
+      interface_driver => lookup('CONFIG_NEUTRON_DHCP_INTERFACE_DRIVER'),
+      debug            => lookup('CONFIG_DEBUG_MODE'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/fwaas.pp b/packstack/puppet/modules/packstack/manifests/neutron/fwaas.pp
deleted file mode 100644
index b3813d99f..000000000
--- a/packstack/puppet/modules/packstack/manifests/neutron/fwaas.pp
+++ /dev/null
@@ -1,8 +0,0 @@
-class packstack::neutron::fwaas ()
-{
-    class { '::neutron::services::fwaas':
-      enabled => true,
-      agent_version => 'v2',
-      driver  => 'neutron_fwaas.services.firewall.service_drivers.agents.drivers.linux.iptables_fwaas_v2.IptablesFwaasDriver',
-    }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/l3.pp b/packstack/puppet/modules/packstack/manifests/neutron/l3.pp
index e1c40b04a..3de7d8277 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/l3.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/l3.pp
@@ -1,27 +1,15 @@
 class packstack::neutron::l3 ()
 {
-    $start_l3_agent = hiera('CONFIG_NEUTRON_VPNAAS') ? {
+    $start_l3_agent = lookup('CONFIG_NEUTRON_VPNAAS') ? {
         'y'     => false,
         default => true
     }
 
-    $neutron_fwaas_enabled   = str2bool(hiera('CONFIG_NEUTRON_FWAAS'))
-    if $neutron_fwaas_enabled {
-      $extensions = 'fwaas_v2'
-    } else {
-      $extensions = undef
-    }
-
-    class { '::neutron::agents::l3':
-      interface_driver        => hiera('CONFIG_NEUTRON_L3_INTERFACE_DRIVER'),
-      manage_service          => $start_l3_agent,
-      enabled                 => $start_l3_agent,
-      debug                   => hiera('CONFIG_DEBUG_MODE'),
-      extensions              => $extensions
-    }
-
-    if defined(Class['neutron::services::fwaas']) {
-      Class['neutron::services::fwaas'] -> Class['neutron::agents::l3']
+    class { 'neutron::agents::l3':
+      interface_driver => lookup('CONFIG_NEUTRON_L3_INTERFACE_DRIVER'),
+      manage_service   => $start_l3_agent,
+      enabled          => $start_l3_agent,
+      debug            => lookup('CONFIG_DEBUG_MODE'),
     }
 
     sysctl::value { 'net.ipv4.ip_forward':
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/lb_agent.pp b/packstack/puppet/modules/packstack/manifests/neutron/lb_agent.pp
deleted file mode 100644
index cfef43a89..000000000
--- a/packstack/puppet/modules/packstack/manifests/neutron/lb_agent.pp
+++ /dev/null
@@ -1,30 +0,0 @@
-class packstack::neutron::lb_agent ()
-{
-
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
-      'ipv6'  => '::0',
-      default => '0.0.0.0',
-      # TO-DO(mmagr): Add IPv6 support when hostnames are used
-    }
-
-    $neutron_lb_interface_mappings = hiera_array('CONFIG_NEUTRON_LB_INTERFACE_MAPPINGS')
-
-    $use_subnets_value = hiera('CONFIG_USE_SUBNETS')
-    $use_subnets = $use_subnets_value ? {
-      'y'     => true,
-      default => false,
-    }
-
-    if ( 'vxlan' in hiera_array('CONFIG_NEUTRON_ML2_TYPE_DRIVERS') ){
-      class { '::neutron::agents::ml2::linuxbridge':
-        physical_interface_mappings => force_interface($neutron_lb_interface_mappings, $use_subnets),
-        tunnel_types  => ['vxlan'],
-        local_ip      => $bind_host,
-      }
-    }
-    else {
-      class { '::neutron::agents::ml2::linuxbridge':
-        physical_interface_mappings => force_interface($neutron_lb_interface_mappings, $use_subnets),
-      }
-    }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/metadata.pp b/packstack/puppet/modules/packstack/manifests/neutron/metadata.pp
index 8dcc3d532..9acc203e3 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/metadata.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/metadata.pp
@@ -1,9 +1,9 @@
 class packstack::neutron::metadata ()
 {
-    class { '::neutron::agents::metadata':
-      shared_secret    => hiera('CONFIG_NEUTRON_METADATA_PW'),
-      metadata_host    => force_ip(hiera('CONFIG_KEYSTONE_HOST_URL')),
-      debug            => hiera('CONFIG_DEBUG_MODE'),
-      metadata_workers => hiera('CONFIG_SERVICE_WORKERS'),
+    class { 'neutron::agents::metadata':
+      shared_secret    => lookup('CONFIG_NEUTRON_METADATA_PW'),
+      metadata_host    => force_ip(lookup('CONFIG_KEYSTONE_HOST_URL')),
+      debug            => lookup('CONFIG_DEBUG_MODE'),
+      metadata_workers => lookup('CONFIG_SERVICE_WORKERS'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/metering.pp b/packstack/puppet/modules/packstack/manifests/neutron/metering.pp
index 359ae7c14..6f9565385 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/metering.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/metering.pp
@@ -1,7 +1,7 @@
 class packstack::neutron::metering ()
 {
-    class { '::neutron::agents::metering':
-      interface_driver => hiera('CONFIG_NEUTRON_METERING_IFCE_DRIVER'),
-      debug            => hiera('CONFIG_DEBUG_MODE'),
+    class { 'neutron::agents::metering':
+      interface_driver => lookup('CONFIG_NEUTRON_METERING_IFCE_DRIVER'),
+      debug            => lookup('CONFIG_DEBUG_MODE'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/ml2.pp b/packstack/puppet/modules/packstack/manifests/neutron/ml2.pp
index b70fd33bb..408a32cf4 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/ml2.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/ml2.pp
@@ -1,30 +1,29 @@
 class packstack::neutron::ml2 ()
 {
-    if hiera('CONFIG_NEUTRON_ML2_VXLAN_GROUP') == '' {
+    if lookup('CONFIG_NEUTRON_ML2_VXLAN_GROUP') == '' {
       $vxlan_group_value = undef
     } else {
-      $vxlan_group_value = hiera('CONFIG_NEUTRON_ML2_VXLAN_GROUP')
+      $vxlan_group_value = lookup('CONFIG_NEUTRON_ML2_VXLAN_GROUP')
     }
 
-    class { '::neutron::plugins::ml2':
-      type_drivers              => hiera_array('CONFIG_NEUTRON_ML2_TYPE_DRIVERS'),
-      tenant_network_types      => hiera_array('CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES'),
-      mechanism_drivers         => hiera_array('CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS'),
-      flat_networks             => hiera_array('CONFIG_NEUTRON_ML2_FLAT_NETWORKS'),
-      network_vlan_ranges       => hiera_array('CONFIG_NEUTRON_ML2_VLAN_RANGES'),
-      tunnel_id_ranges          => hiera_array('CONFIG_NEUTRON_ML2_TUNNEL_ID_RANGES'),
-      vxlan_group               => $vxlan_group_value,
-      vni_ranges                => hiera_array('CONFIG_NEUTRON_ML2_VNI_RANGES'),
-      enable_security_group     => true,
-      firewall_driver           => hiera('FIREWALL_DRIVER'),
-      extension_drivers         => 'port_security,qos',
-      max_header_size           => 38,
+    class { 'neutron::plugins::ml2':
+      type_drivers          => lookup('CONFIG_NEUTRON_ML2_TYPE_DRIVERS', { merge => 'unique' }),
+      tenant_network_types  => lookup('CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES', { merge => 'unique' }),
+      mechanism_drivers     => lookup('CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS', { merge => 'unique' }),
+      flat_networks         => lookup('CONFIG_NEUTRON_ML2_FLAT_NETWORKS', { merge => 'unique' }),
+      network_vlan_ranges   => lookup('CONFIG_NEUTRON_ML2_VLAN_RANGES', { merge => 'unique' }),
+      tunnel_id_ranges      => lookup('CONFIG_NEUTRON_ML2_TUNNEL_ID_RANGES', { merge => 'unique' }),
+      vxlan_group           => $vxlan_group_value,
+      vni_ranges            => lookup('CONFIG_NEUTRON_ML2_VNI_RANGES', { merge => 'unique' }),
+      enable_security_group => true,
+      extension_drivers     => 'port_security,qos',
+      max_header_size       => 38,
     }
 
-    if hiera('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
-      class {'::neutron::plugins::ml2::ovn':
-        ovn_nb_connection => "tcp:${hiera('CONFIG_CONTROLLER_HOST')}:6641",
-        ovn_sb_connection => "tcp:${hiera('CONFIG_CONTROLLER_HOST')}:6642",
+    if lookup('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
+      class { 'neutron::plugins::ml2::ovn':
+        ovn_nb_connection    => "tcp:${lookup('CONFIG_CONTROLLER_HOST')}:6641",
+        ovn_sb_connection    => "tcp:${lookup('CONFIG_CONTROLLER_HOST')}:6642",
         ovn_metadata_enabled => true,
       }
     }
@@ -32,8 +31,8 @@
     # For cases where "neutron-db-manage upgrade" command is called
     # we need to fill config file first
     if defined(Exec['neutron-db-manage upgrade']) {
-      Neutron_plugin_ml2<||> ->
-      File['/etc/neutron/plugin.ini'] ->
-      Exec['neutron-db-manage upgrade']
+      Neutron_plugin_ml2<||>
+      -> File['/etc/neutron/plugin.ini']
+      -> Exec['neutron-db-manage upgrade']
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/notifications.pp b/packstack/puppet/modules/packstack/manifests/neutron/notifications.pp
index fe2be7dac..e22ac99a6 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/notifications.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/notifications.pp
@@ -1,13 +1,16 @@
 class packstack::neutron::notifications ()
 {
-    $neutron_notif_cfg_ctrl_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $neutron_notif_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
 
     # Configure nova notifications system
-    class { '::neutron::server::notifications':
-      username    => 'nova',
-      password    => hiera('CONFIG_NOVA_KS_PW'),
-      tenant_name => 'services',
-      auth_url    => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
-      region_name => hiera('CONFIG_KEYSTONE_REGION'),
+    class { 'neutron::server::notifications':
+    }
+
+    class { 'neutron::server::notifications::nova':
+      username     => 'nova',
+      password     => lookup('CONFIG_NOVA_KS_PW'),
+      project_name => 'services',
+      auth_url     => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      region_name  => lookup('CONFIG_KEYSTONE_REGION'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/ovn_agent.pp b/packstack/puppet/modules/packstack/manifests/neutron/ovn_agent.pp
index d6ac5cf2d..bafa3ff3f 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/ovn_agent.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/ovn_agent.pp
@@ -1,13 +1,13 @@
 class packstack::neutron::ovn_agent ()
 {
-    $my_ip = choose_my_ip(hiera('HOST_LIST'))
+    $my_ip = choose_my_ip(lookup('HOST_LIST'))
     $my_ip_without_dot = regsubst($my_ip, '[\.\:]', '_', 'G')
     $neutron_tunnel_rule_name = "FIREWALL_NEUTRON_TUNNEL_RULES_${my_ip_without_dot}"
-    create_resources(packstack::firewall, hiera($neutron_tunnel_rule_name, {}))
+    create_resources(packstack::firewall, lookup($neutron_tunnel_rule_name, undef, undef, {}))
 
-    $neutron_ovn_tunnel_if = hiera('CONFIG_NEUTRON_OVN_TUNNEL_IF', undef)
+    $neutron_ovn_tunnel_if = lookup('CONFIG_NEUTRON_OVN_TUNNEL_IF', undef, undef, undef)
 
-    $use_subnets_value = hiera('CONFIG_USE_SUBNETS')
+    $use_subnets_value = lookup('CONFIG_USE_SUBNETS')
     $use_subnets = $use_subnets_value ? {
       'y'     => true,
       default => false,
@@ -23,11 +23,11 @@
       $iface = regsubst($ovn_agent_tunnel_cfg_neut_ovs_tun_if, '[\.\-\:]', '_', 'G')
       $localip = inline_template("<%= scope.lookupvar('::ipaddress_${iface}') %>")
     } else {
-      $localip = choose_my_ip(hiera('HOST_LIST'))
+      $localip = choose_my_ip(lookup('HOST_LIST'))
     }
 
-    $network_hosts =  split(hiera('CONFIG_NETWORK_HOSTS'),',')
-    if member($network_hosts, choose_my_ip(hiera('HOST_LIST'))) {
+    $network_hosts =  split(lookup('CONFIG_NETWORK_HOSTS'),',')
+    if member($network_hosts, choose_my_ip(lookup('HOST_LIST'))) {
       $bridge_ifaces_param = 'CONFIG_NEUTRON_OVS_BRIDGE_IFACES'
       $bridge_mappings_param = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS'
     } else {
@@ -35,21 +35,22 @@
       $bridge_mappings_param = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS_COMPUTE'
     }
 
-    if hiera('CREATE_BRIDGES') == 'y' {
-      $bridge_uplinks  = hiera_array($bridge_ifaces_param)
-      $bridge_mappings = hiera_array($bridge_mappings_param)
+    if lookup('CREATE_BRIDGES') == 'y' {
+      $bridge_uplinks  = lookup($bridge_ifaces_param, { merge => 'unique' })
+      $bridge_mappings = lookup($bridge_mappings_param, { merge => 'unique' })
     } else {
       $bridge_uplinks  = []
       $bridge_mappings = []
     }
 
-    $ovn_southd = "tcp:${hiera('CONFIG_CONTROLLER_HOST')}:6642"
+    $ovn_southd = "tcp:${lookup('CONFIG_CONTROLLER_HOST')}:6642"
 
-    class { '::ovn::controller':
+    class { 'ovn::controller':
       ovn_remote                => $ovn_southd,
       ovn_bridge_mappings       => $bridge_mappings,
       bridge_interface_mappings => $bridge_uplinks,
       ovn_encap_ip              => force_ip($localip),
-      hostname                  => $::fqdn,
+      hostname                  => $facts['networking']['fqdn'],
+      ovn_cms_options           => 'enable-chassis-as-gw',
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/ovn_metadata.pp b/packstack/puppet/modules/packstack/manifests/neutron/ovn_metadata.pp
index 55c70bb92..c4e019332 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/ovn_metadata.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/ovn_metadata.pp
@@ -1,13 +1,13 @@
 class packstack::neutron::ovn_metadata ()
 {
-    $ovn_southd = "tcp:${hiera('CONFIG_CONTROLLER_HOST')}:6642"
+    $ovn_southd = "tcp:${lookup('CONFIG_CONTROLLER_HOST')}:6642"
 
-    class { '::neutron::agents::ovn_metadata':
+    class { 'neutron::agents::ovn_metadata':
       ovn_sb_connection => $ovn_southd,
-      shared_secret    => hiera('CONFIG_NEUTRON_METADATA_PW'),
-      metadata_ip      => force_ip(hiera('CONFIG_KEYSTONE_HOST_URL')),
-      debug            => hiera('CONFIG_DEBUG_MODE'),
-      metadata_workers => hiera('CONFIG_SERVICE_WORKERS'),
+      shared_secret     => lookup('CONFIG_NEUTRON_METADATA_PW'),
+      metadata_host     => force_ip(lookup('CONFIG_KEYSTONE_HOST_URL')),
+      debug             => lookup('CONFIG_DEBUG_MODE'),
+      metadata_workers  => lookup('CONFIG_SERVICE_WORKERS'),
     }
     Service<| title == 'controller' |> -> Service<| title == 'ovn-metadata' |>
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/ovn_northd.pp b/packstack/puppet/modules/packstack/manifests/neutron/ovn_northd.pp
index c4911cfe7..067ce6869 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/ovn_northd.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/ovn_northd.pp
@@ -1,4 +1,4 @@
 class packstack::neutron::ovn_northd ()
 {
-    include ::ovn::northd
+    include ovn::northd
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/ovs_agent.pp b/packstack/puppet/modules/packstack/manifests/neutron/ovs_agent.pp
index aa86dee8c..634894a7b 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/ovs_agent.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/ovs_agent.pp
@@ -1,13 +1,13 @@
 class packstack::neutron::ovs_agent ()
 {
-    $my_ip = choose_my_ip(hiera('HOST_LIST'))
+    $my_ip = choose_my_ip(lookup('HOST_LIST'))
     $my_ip_without_dot = regsubst($my_ip, '[\.\:]', '_', 'G')
     $neutron_tunnel_rule_name = "FIREWALL_NEUTRON_TUNNEL_RULES_${my_ip_without_dot}"
-    create_resources(packstack::firewall, hiera($neutron_tunnel_rule_name, {}))
+    create_resources(packstack::firewall, lookup($neutron_tunnel_rule_name, undef, undef, {}))
 
-    $neutron_ovs_tunnel_if = hiera('CONFIG_NEUTRON_OVS_TUNNEL_IF', undef)
+    $neutron_ovs_tunnel_if = lookup('CONFIG_NEUTRON_OVS_TUNNEL_IF', undef, undef, undef)
 
-    $use_subnets_value = hiera('CONFIG_USE_SUBNETS')
+    $use_subnets_value = lookup('CONFIG_USE_SUBNETS')
     $use_subnets = $use_subnets_value ? {
       'y'     => true,
       default => false,
@@ -23,11 +23,11 @@
       $iface = regsubst($ovs_agent_vxlan_cfg_neut_ovs_tun_if, '[\.\-\:]', '_', 'G')
       $localip = inline_template("<%= scope.lookupvar('::ipaddress_${iface}') %>")
     } else {
-      $localip = choose_my_ip(hiera('HOST_LIST'))
+      $localip = choose_my_ip(lookup('HOST_LIST'))
     }
 
-    $network_hosts =  split(hiera('CONFIG_NETWORK_HOSTS'),',')
-    if member($network_hosts, choose_my_ip(hiera('HOST_LIST'))) {
+    $network_hosts =  split(lookup('CONFIG_NETWORK_HOSTS'),',')
+    if member($network_hosts, choose_my_ip(lookup('HOST_LIST'))) {
       $bridge_ifaces_param = 'CONFIG_NEUTRON_OVS_BRIDGE_IFACES'
       $bridge_mappings_param = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS'
     } else {
@@ -35,21 +35,21 @@
       $bridge_mappings_param = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS_COMPUTE'
     }
 
-    if hiera('CREATE_BRIDGES') == 'y' {
-      $bridge_uplinks  = hiera_array($bridge_ifaces_param)
-      $bridge_mappings = hiera_array($bridge_mappings_param)
+    if lookup('CREATE_BRIDGES') == 'y' {
+      $bridge_uplinks  = lookup($bridge_ifaces_param, { merge => 'unique' })
+      $bridge_mappings = lookup($bridge_mappings_param, { merge => 'unique' })
     } else {
       $bridge_uplinks  = []
       $bridge_mappings = []
     }
 
-    class { '::neutron::agents::ml2::ovs':
-      bridge_uplinks   => $bridge_uplinks,
-      bridge_mappings  => $bridge_mappings,
-      tunnel_types     => hiera_array('CONFIG_NEUTRON_OVS_TUNNEL_TYPES'),
-      local_ip         => force_ip($localip),
-      vxlan_udp_port   => hiera('CONFIG_NEUTRON_OVS_VXLAN_UDP_PORT',undef),
-      l2_population    => hiera('CONFIG_NEUTRON_USE_L2POPULATION'),
-      firewall_driver  => hiera('FIREWALL_DRIVER'),
+    class { 'neutron::agents::ml2::ovs':
+      bridge_uplinks  => $bridge_uplinks,
+      bridge_mappings => $bridge_mappings,
+      tunnel_types    => lookup('CONFIG_NEUTRON_OVS_TUNNEL_TYPES', { merge => 'unique' }),
+      local_ip        => force_ip($localip),
+      vxlan_udp_port  => lookup('CONFIG_NEUTRON_OVS_VXLAN_UDP_PORT', undef, undef, undef),
+      l2_population   => lookup('CONFIG_NEUTRON_USE_L2POPULATION'),
+      firewall_driver => lookup('FIREWALL_DRIVER'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/ovs_bridge.pp b/packstack/puppet/modules/packstack/manifests/neutron/ovs_bridge.pp
index c00297732..0675cfc76 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/ovs_bridge.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/ovs_bridge.pp
@@ -2,7 +2,7 @@
 {
   $agent_service = 'neutron-ovs-agent-service'
 
-  $config_neutron_ovs_bridge = hiera('CONFIG_NEUTRON_OVS_BRIDGE')
+  $config_neutron_ovs_bridge = lookup('CONFIG_NEUTRON_OVS_BRIDGE')
 
   vs_bridge { $config_neutron_ovs_bridge:
     ensure  => present,
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/neutron/rabbitmq.pp
index 3df252198..fb67efbcd 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/rabbitmq.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/rabbitmq.pp
@@ -1,19 +1,14 @@
 class packstack::neutron::rabbitmq ()
 {
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_NEUTRON_SSL_KEY', undef)
-    $kombu_ssl_certfile = hiera('CONFIG_NEUTRON_SSL_CERT', undef)
-
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_NEUTRON_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_NEUTRON_SSL_CERT', undef, undef, undef)
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -24,18 +19,24 @@
       }
       File[$files_to_set_owner] ~> Service<| tag == 'neutron-service' |>
     }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'neutron-service' |>
 
-    class { '::neutron::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'neutron::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
-    class { '::neutron':
+    class { 'neutron':
       bind_host             => $bind_host,
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
-      default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      core_plugin           => hiera('CONFIG_NEUTRON_CORE_PLUGIN'),
-      allow_overlapping_ips => true,
-      service_plugins       => hiera_array('SERVICE_PLUGINS'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      core_plugin           => lookup('CONFIG_NEUTRON_CORE_PLUGIN'),
+      service_plugins       => lookup('SERVICE_PLUGINS', { merge => 'unique' }),
       kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
       kombu_ssl_keyfile     => $kombu_ssl_keyfile,
       kombu_ssl_certfile    => $kombu_ssl_certfile,
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/sriov.pp b/packstack/puppet/modules/packstack/manifests/neutron/sriov.pp
index 05f82fe6f..001c94bba 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/sriov.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/sriov.pp
@@ -1,6 +1,6 @@
 class packstack::neutron::sriov ()
 {
     class { 'neutron::agents::ml2::sriov' :
-      physical_device_mappings   => hiera_array('CONFIG_NEUTRON_ML2_SRIOV_INTERFACE_MAPPINGS'),
+      physical_device_mappings => lookup('CONFIG_NEUTRON_ML2_SRIOV_INTERFACE_MAPPINGS', { merge => 'unique' }),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/vpnaas.pp b/packstack/puppet/modules/packstack/manifests/neutron/vpnaas.pp
index f42c7e9ae..e60bd9ed1 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/vpnaas.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/vpnaas.pp
@@ -1,6 +1,6 @@
 class packstack::neutron::vpnaas ()
 {
-    class { '::neutron::agents::vpnaas':
+    class { 'neutron::agents::vpnaas':
       vpn_device_driver => 'neutron_vpnaas.services.vpn.device_drivers.libreswan_ipsec.LibreSwanDriver',
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/nova.pp b/packstack/puppet/modules/packstack/manifests/nova.pp
index 0eb71213b..775e69387 100644
--- a/packstack/puppet/modules/packstack/manifests/nova.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova.pp
@@ -1,26 +1,17 @@
 class packstack::nova ()
 {
-    $nova_db_pw = hiera('CONFIG_NOVA_DB_PW')
-    $nova_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
-
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
-
     $private_key = {
-      'type' => hiera('NOVA_MIGRATION_KEY_TYPE'),
-      key  => hiera('NOVA_MIGRATION_KEY_SECRET'),
+      'type' => lookup('NOVA_MIGRATION_KEY_TYPE'),
+      'key'  => lookup('NOVA_MIGRATION_KEY_SECRET'),
     }
     $public_key = {
-      'type' => hiera('NOVA_MIGRATION_KEY_TYPE'),
-      key  => hiera('NOVA_MIGRATION_KEY_PUBLIC'),
+      'type' => lookup('NOVA_MIGRATION_KEY_TYPE'),
+      'key'  => lookup('NOVA_MIGRATION_KEY_PUBLIC'),
     }
 
-
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_NOVA_SSL_KEY', undef)
-    $kombu_ssl_certfile = hiera('CONFIG_NOVA_SSL_CERT', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_NOVA_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_NOVA_SSL_CERT', undef, undef, undef)
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
@@ -31,9 +22,9 @@
       }
       File[$files_to_set_owner] ~> Service<| tag == 'nova-service' |>
     }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'nova-service' |>
 
-    $nova_common_rabbitmq_cfg_storage_host = hiera('CONFIG_STORAGE_HOST_URL')
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
       $nova_common_notification_driver = 'messagingv2'
       $notify_on_state_change = 'vm_and_task_state'
     } else {
@@ -41,45 +32,71 @@
       $notify_on_state_change = undef
     }
 
-    if hiera('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
-      $novahost = $::fqdn
+    if lookup('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
+      $novahost = $facts['networking']['fqdn']
     } else {
       $novahost = undef
     }
 
-    if hiera('CONFIG_HORIZON_SSL') == 'y' {
+    if lookup('CONFIG_HORIZON_SSL') == 'y' {
       $ssl_only = true
-      $cert = hiera('CONFIG_VNC_SSL_CERT')
-      $key = hiera('CONFIG_VNC_SSL_KEY')
+      $cert = lookup('CONFIG_VNC_SSL_CERT')
+      $key = lookup('CONFIG_VNC_SSL_KEY')
     } else {
       $ssl_only = false
       $cert = undef
       $key = undef
     }
 
-    class { '::nova::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'nova::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'nova::db':
+      database_connection     => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'nova',
+        'password' => lookup('CONFIG_NOVA_DB_PW'),
+        'database' => 'nova',
+      }),
+      api_database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'nova_api',
+        'password' => lookup('CONFIG_NOVA_DB_PW'),
+        'database' => 'nova_api',
+      })
+    }
+
+    class { 'nova':
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      rabbit_use_ssl          => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      nova_public_key         => $public_key,
+      nova_private_key        => $private_key,
+      kombu_ssl_ca_certs      => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile       => $kombu_ssl_keyfile,
+      kombu_ssl_certfile      => $kombu_ssl_certfile,
+      notification_driver     => $nova_common_notification_driver,
+      notify_on_state_change  => $notify_on_state_change,
+      cpu_allocation_ratio    => lookup('CONFIG_NOVA_SCHED_CPU_ALLOC_RATIO'),
+      ram_allocation_ratio    => lookup('CONFIG_NOVA_SCHED_RAM_ALLOC_RATIO'),
+      host                    => $novahost,
+      ssl_only                => $ssl_only,
+      cert                    => $cert,
+      key                     => $key,
     }
 
-    class { '::nova':
-      glance_api_servers            => "http://${nova_common_rabbitmq_cfg_storage_host}:9292",
-      default_transport_url         => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      rabbit_use_ssl                => hiera('CONFIG_AMQP_SSL_ENABLED'),
-      nova_public_key               => $public_key,
-      nova_private_key              => $private_key,
-      kombu_ssl_ca_certs            => $kombu_ssl_ca_certs,
-      kombu_ssl_keyfile             => $kombu_ssl_keyfile,
-      kombu_ssl_certfile            => $kombu_ssl_certfile,
-      notification_driver           => $nova_common_notification_driver,
-      notify_on_state_change        => $notify_on_state_change,
-      database_connection           => "mysql+pymysql://nova:${nova_db_pw}@${nova_mariadb_host}/nova",
-      api_database_connection       => "mysql+pymysql://nova_api:${nova_db_pw}@${nova_mariadb_host}/nova_api",
-      cpu_allocation_ratio          => hiera('CONFIG_NOVA_SCHED_CPU_ALLOC_RATIO'),
-      ram_allocation_ratio          => hiera('CONFIG_NOVA_SCHED_RAM_ALLOC_RATIO'),
-      host                          => $novahost,
-      ssl_only                      => $ssl_only,
-      cert                          => $cert,
-      key                           => $key,
+    class { 'nova::keystone::service_user':
+      send_service_user_token => true,
+      password                => lookup('CONFIG_NOVA_KS_PW'),
+      auth_url                => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
 }
diff --git a/packstack/puppet/modules/packstack/manifests/nova/api.pp b/packstack/puppet/modules/packstack/manifests/nova/api.pp
index 01432f65c..52100562a 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/api.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/api.pp
@@ -1,95 +1,86 @@
 class packstack::nova::api ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_NOVA_API_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_NOVA_API_RULES', undef, undef, {}))
 
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    $www_authenticate_uri = hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS')
-    $admin_password = hiera('CONFIG_NOVA_KS_PW')
+    $admin_password = lookup('CONFIG_NOVA_KS_PW')
 
-    class {'::nova::keystone::authtoken':
+    class { 'nova::keystone::authtoken':
       password             => $admin_password,
-      www_authenticate_uri => $www_authenticate_uri,
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
-    if hiera('CONFIG_NOVA_PCI_ALIAS') == '' {
-      $pci_alias = $::os_service_default
-    } else {
-      $pci_alias = hiera('CONFIG_NOVA_PCI_ALIAS')
+    $pci_alias = parsejson(lookup('CONFIG_NOVA_PCI_ALIAS'))
+
+    class { 'nova::pci':
+      aliases => $pci_alias,
     }
 
-    class { '::nova::api':
-      api_bind_address                     => $bind_host,
-      enabled                              => true,
-      sync_db                              => false,
-      sync_db_api                          => false,
-      osapi_compute_workers                => hiera('CONFIG_SERVICE_WORKERS'),
-      allow_resize_to_same_host            => hiera('CONFIG_NOVA_ALLOW_RESIZE_TO_SAME'),
-      nova_metadata_wsgi_enabled           => true,
-      service_name                         => 'httpd',
+    class { 'nova::api':
+      api_bind_address           => $bind_host,
+      enabled                    => true,
+      sync_db                    => false,
+      sync_db_api                => false,
+      osapi_compute_workers      => lookup('CONFIG_SERVICE_WORKERS'),
+      allow_resize_to_same_host  => lookup('CONFIG_NOVA_ALLOW_RESIZE_TO_SAME'),
+      service_name               => 'httpd',
     }
 
-    class { '::nova::metadata':
-      neutron_metadata_proxy_shared_secret => hiera('CONFIG_NEUTRON_METADATA_PW_UNQUOTED', undef),
+    include packstack::nova::cache
+    class { 'nova::metadata':
+      neutron_metadata_proxy_shared_secret => lookup('CONFIG_NEUTRON_METADATA_PW_UNQUOTED', undef, undef, undef),
     }
 
-    class { '::nova::wsgi::apache_api':
+    class { 'nova::wsgi::apache_api':
       bind_host => $bind_host,
       ssl       => false,
-      workers   => hiera('CONFIG_SERVICE_WORKERS'),
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
-    class { '::nova::wsgi::apache_metadata':
+    class { 'nova::wsgi::apache_metadata':
       bind_host => $bind_host,
       ssl       => false,
-      workers   => hiera('CONFIG_SERVICE_WORKERS'),
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
-    class { '::nova::db::sync':
+    class { 'nova::db::sync':
       db_sync_timeout => 600,
     }
 
-    class { '::nova::db::sync_api':
+    class { 'nova::db::sync_api':
       db_sync_timeout => 600,
     }
 
-    class { '::nova::pci':
-      aliases                              => $pci_alias,
-    }
-
-    class { '::nova::placement':
-      auth_url    => $www_authenticate_uri,
+    class { 'nova::placement':
+      auth_url    => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
       password    => $admin_password,
-      region_name => hiera('CONFIG_KEYSTONE_REGION'),
+      region_name => lookup('CONFIG_KEYSTONE_REGION'),
     }
 
-    $db_purge = hiera('CONFIG_NOVA_DB_PURGE_ENABLE')
+    $db_purge = lookup('CONFIG_NOVA_DB_PURGE_ENABLE')
     if $db_purge {
-      class { '::nova::cron::archive_deleted_rows':
+      class { 'nova::cron::archive_deleted_rows':
         hour        => '*/12',
         destination => '/dev/null',
       }
     }
 
-    include ::nova::cell_v2::simple_setup
+    include nova::cell_v2::simple_setup
 
-    $manage_flavors = str2bool(hiera('CONFIG_NOVA_MANAGE_FLAVORS'))
+    $manage_flavors = str2bool(lookup('CONFIG_NOVA_MANAGE_FLAVORS'))
     if $manage_flavors {
-      Class['::nova::api'] -> Nova_flavor<||>
-      Class['::keystone'] -> Nova_flavor<||>
-
       nova_flavor { 'm1.tiny':
         ensure => present,
         id     => '1',
         ram    => '512',
         disk   => '1',
         vcpus  => '1',
-        require => [ Class['::nova::api'], Class['::nova::keystone::auth'] ],
       }
 
       nova_flavor { 'm1.small':
@@ -98,7 +89,6 @@
         ram    => '2048',
         disk   => '20',
         vcpus  => '1',
-        require => [ Class['::nova::api'], Class['::nova::keystone::auth'] ],
       }
 
       nova_flavor { 'm1.medium':
@@ -107,7 +97,6 @@
         ram    => '4096',
         disk   => '40',
         vcpus  => '2',
-        require => [ Class['::nova::api'], Class['::nova::keystone::auth'] ],
       }
 
       nova_flavor { 'm1.large':
@@ -116,7 +105,6 @@
         ram    => '8192',
         disk   => '80',
         vcpus  => '4',
-        require => [ Class['::nova::api'], Class['::nova::keystone::auth'] ],
       }
 
       nova_flavor { 'm1.xlarge':
@@ -125,7 +113,6 @@
         ram    => '16384',
         disk   => '160',
         vcpus  => '8',
-        require => [ Class['::nova::api'], Class['::nova::keystone::auth'] ],
       }
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/nova/cache.pp b/packstack/puppet/modules/packstack/manifests/nova/cache.pp
new file mode 100644
index 000000000..376715079
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/cache.pp
@@ -0,0 +1,14 @@
+class packstack::nova::cache ()
+{
+    $memcache_servers = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => ['[::1]:11211'],
+      default => ['127.0.0.1:11211'],
+    }
+    class { 'nova::cache':
+      enabled          => true,
+      backend          => 'dogpile.cache.pymemcache',
+      memcache_servers => $memcache_servers,
+    }
+    include packstack::memcached
+    Class['memcached'] -> Anchor['nova::service::begin']
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/ceilometer.pp b/packstack/puppet/modules/packstack/manifests/nova/ceilometer.pp
index 6168ed94b..e004d6179 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/ceilometer.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/ceilometer.pp
@@ -1,14 +1,14 @@
 class packstack::nova::ceilometer ()
 {
-    class { '::ceilometer::agent::auth':
-      auth_url      => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      auth_password => hiera('CONFIG_CEILOMETER_KS_PW'),
-      auth_region   => hiera('CONFIG_KEYSTONE_REGION'),
+    class { 'ceilometer::agent::service_credentials':
+      auth_url     => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      password     => lookup('CONFIG_CEILOMETER_KS_PW'),
+      region_name  => lookup('CONFIG_KEYSTONE_REGION'),
     }
 
     ensure_packages(['openstack-ceilometer-ipmi'], {'ensure' => 'present'})
 
-    class { '::ceilometer::agent::polling': }
+    class { 'ceilometer::agent::polling': }
 
     Package['openstack-ceilometer-ipmi'] -> Service['ceilometer-polling']
 }
diff --git a/packstack/puppet/modules/packstack/manifests/nova/ceilometer/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/nova/ceilometer/rabbitmq.pp
index 3e76c9b0a..100759e68 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/ceilometer/rabbitmq.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/ceilometer/rabbitmq.pp
@@ -1,36 +1,38 @@
 class packstack::nova::ceilometer::rabbitmq ()
 {
-    $ceilometer_kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
-    $ceilometer_kombu_ssl_keyfile = hiera('CONFIG_CEILOMETER_SSL_KEY', undef)
-    $ceilometer_kombu_ssl_certfile = hiera('CONFIG_CEILOMETER_SSL_CERT', undef)
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_CEILOMETER_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_CEILOMETER_SSL_CERT', undef, undef, undef)
 
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
-
-    if $ceilometer_kombu_ssl_keyfile {
-      $ceilometer_files_to_set_owner = [ $ceilometer_kombu_ssl_keyfile, $ceilometer_kombu_ssl_certfile ]
-      file { $ceilometer_files_to_set_owner:
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
         owner   => 'ceilometer',
         group   => 'ceilometer',
         require => Package['nova-common'],
       }
-      File[$ceilometer_files_to_set_owner] ~> Service<| tag == 'ceilometer-service' |>
+      File[$files_to_set_owner] ~> Service<| tag == 'ceilometer-service' |>
     }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'ceilometer-service' |>
 
-    class { '::ceilometer::logging':
-        debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'ceilometer::logging':
+        debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
-    class { '::ceilometer':
-        telemetry_secret      => hiera('CONFIG_CEILOMETER_SECRET'),
-        rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
-        default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-        # for some strange reason ceilometer needs to be in nova group
-        require               => Package['nova-common'],
-        kombu_ssl_ca_certs    => $ceilometer_kombu_ssl_ca_certs,
-        kombu_ssl_keyfile     => $ceilometer_kombu_ssl_keyfile,
-        kombu_ssl_certfile    => $ceilometer_kombu_ssl_certfile,
+    class { 'ceilometer':
+      telemetry_secret      => lookup('CONFIG_CEILOMETER_SECRET'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      # for some strange reason ceilometer needs to be in nova group
+      require               => Package['nova-common'],
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/nova/common.pp b/packstack/puppet/modules/packstack/manifests/nova/common.pp
index 1e9d5ee80..f300fab76 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/common.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/common.pp
@@ -3,9 +3,4 @@
     # Ensure Firewall changes happen before nova services start
     # preventing a clash with rules being set by nova-compute and nova-network
     Firewall <| |> -> Class['nova']
-
-    nova_config{
-      # metadata_host has to be IP
-      'DEFAULT/metadata_host':         value => force_ip(hiera('CONFIG_CONTROLLER_HOST'));
-    }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/nova/compute.pp b/packstack/puppet/modules/packstack/manifests/nova/compute.pp
index 0ffd42209..856d32651 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/compute.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/compute.pp
@@ -1,30 +1,30 @@
 class packstack::nova::compute ()
 {
-    $my_ip = choose_my_ip(hiera('HOST_LIST'))
+    $my_ip = choose_my_ip(lookup('HOST_LIST'))
     $my_ip_without_dot = regsubst($my_ip, '\.', '_', 'G')
     $qemu_rule_name = "FIREWALL_NOVA_QEMU_MIG_RULES_${my_ip_without_dot}"
-    create_resources(packstack::firewall, hiera($qemu_rule_name, {}))
-    create_resources(packstack::firewall, hiera('FIREWALL_NOVA_COMPUTE_RULES', {}))
+    create_resources(packstack::firewall, lookup($qemu_rule_name, undef, undef, {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_NOVA_COMPUTE_RULES', undef, undef, {}))
 
     ensure_packages(['/usr/bin/cinder'], {'ensure' => 'present'})
     Package['/usr/bin/cinder'] -> Class['nova']
 
     # Install the private key to be used for live migration.  This needs to be
     # configured into libvirt/live_migration_uri in nova.conf.
-    $migrate_transport = hiera('CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL')
+    $migrate_transport = lookup('CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL')
     if $migrate_transport == 'ssh' {
       ensure_packages(['openstack-nova-migration'], {'ensure' => 'present'})
 
       file { '/etc/nova/migration/identity':
-        content => hiera('NOVA_MIGRATION_KEY_SECRET'),
+        content => lookup('NOVA_MIGRATION_KEY_SECRET'),
         mode    => '0600',
         owner   => nova,
         group   => nova,
         require => Package['openstack-nova-migration'],
       }
 
-      $key_type = hiera('NOVA_MIGRATION_KEY_TYPE')
-      $key_content = hiera('NOVA_MIGRATION_KEY_PUBLIC')
+      $key_type = lookup('NOVA_MIGRATION_KEY_TYPE')
+      $key_content = lookup('NOVA_MIGRATION_KEY_PUBLIC')
 
       file { '/etc/nova/migration/authorized_keys':
         content => "${key_type} ${key_content}",
@@ -43,9 +43,9 @@
           'set Match[Condition/User = "nova_migration"]/Settings/ForceCommand /bin/nova-migration-wrapper',
           'set Match[Condition/User = "nova_migration"]/Settings/PasswordAuthentication no',
           'set Match[Condition/User = "nova_migration"]/Settings/X11Forwarding no',
-         ],
-        onlyif => 'match Match[Condition/User = "nova_migration"] size == 0',
-        notify => Service['sshd']
+        ],
+        onlyif  => 'match Match[Condition/User = "nova_migration"] size == 0',
+        notify  => Service['sshd']
       }
 
       service {'sshd':
@@ -53,19 +53,14 @@
       }
     }
 
-    nova_config{
-      'DEFAULT/volume_api_class':
-        value => 'nova.volume.cinder.API';
-    }
-
-    if ($::fqdn == '' or $::fqdn =~ /localhost/) {
+    if ($facts['networking']['fqdn'] == '' or $facts['networking']['fqdn'] =~ /localhost/) {
       # For cases where FQDNs have not been correctly set
-      $vncproxy_server = choose_my_ip(hiera('HOST_LIST'))
+      $vncproxy_server = choose_my_ip(lookup('HOST_LIST'))
     } else {
-      $vncproxy_server = $::fqdn
+      $vncproxy_server = $facts['networking']['fqdn']
     }
 
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
       $instance_usage_audit = true
       $instance_usage_audit_period = 'hour'
     } else {
@@ -73,31 +68,27 @@
       $instance_usage_audit_period = 'month'
     }
 
-    class { '::nova::compute':
+    class { 'nova::compute::pci':
+      passthrough => parsejson(lookup('CONFIG_NOVA_PCI_PASSTHROUGH_WHITELIST'))
+    }
+
+    class { 'nova::compute':
       enabled                       => true,
-      vncproxy_host                 => hiera('CONFIG_KEYSTONE_HOST_URL'),
-      vncproxy_protocol             => hiera('CONFIG_VNCPROXY_PROTOCOL'),
+      vncproxy_host                 => lookup('CONFIG_KEYSTONE_HOST_URL'),
+      vncproxy_protocol             => lookup('CONFIG_VNCPROXY_PROTOCOL'),
       vncserver_proxyclient_address => $vncproxy_server,
       instance_usage_audit          => $instance_usage_audit,
       instance_usage_audit_period   => $instance_usage_audit_period,
-      allow_resize_to_same_host     => hiera('CONFIG_NOVA_ALLOW_RESIZE_TO_SAME'),
       force_config_drive            => false,
+      mkisofs_cmd                   => 'mkisofs',
     }
 
-    class { '::nova::placement':
-      auth_url    => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      password    => hiera('CONFIG_NOVA_KS_PW'),
-      region_name => hiera('CONFIG_KEYSTONE_REGION'),
+    class { 'nova::placement':
+      auth_url    => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
+      password    => lookup('CONFIG_NOVA_KS_PW'),
+      region_name => lookup('CONFIG_KEYSTONE_REGION'),
     }
 
-    class { '::nova::compute::pci':
-      passthrough => hiera('CONFIG_NOVA_PCI_PASSTHROUGH_WHITELIST')
-    }
-
-    include ::nova::cell_v2::discover_hosts
-
-    Class['nova::compute'] ~> Class['nova::cell_v2::discover_hosts']
-
     # Tune the host with a virtual hosts profile
     ensure_packages(['tuned'], {'ensure' => 'present'})
 
diff --git a/packstack/puppet/modules/packstack/manifests/nova/compute/ironic.pp b/packstack/puppet/modules/packstack/manifests/nova/compute/ironic.pp
index b5e8a7cea..034ad7fa4 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/compute/ironic.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/compute/ironic.pp
@@ -1,15 +1,15 @@
 class packstack::nova::compute::ironic ()
 {
-  $ironic_config_controller_host = hiera('CONFIG_KEYSTONE_HOST_URL')
-  $ironic_config_keystone_admin = hiera('CONFIG_KEYSTONE_ADMIN_URL')
+  $ironic_config_controller_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+  $ironic_config_keystone_admin = lookup('CONFIG_KEYSTONE_ADMIN_URL')
 
-  class { '::nova::ironic::common':
+  class { 'nova::ironic::common':
       username     => 'ironic',
-      password     => hiera('CONFIG_IRONIC_KS_PW'),
+      password     => lookup('CONFIG_IRONIC_KS_PW'),
       auth_url     => $ironic_config_keystone_admin,
       project_name => 'services',
       api_endpoint => "http://${ironic_config_controller_host}:6385/v1",
   }
 
-  include ::nova::compute::ironic
+   include nova::compute::ironic
 }
diff --git a/packstack/puppet/modules/packstack/manifests/nova/compute/libvirt.pp b/packstack/puppet/modules/packstack/manifests/nova/compute/libvirt.pp
index 196ac82a7..04b3c57be 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/compute/libvirt.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/compute/libvirt.pp
@@ -4,30 +4,30 @@
     # preventing a clash with rules being set by libvirt
     Firewall <| |> -> Class['::nova::compute::libvirt']
 
-    $libvirt_vnc_bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $libvirt_vnc_bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    $libvirt_virt_type = hiera('CONFIG_NOVA_LIBVIRT_VIRT_TYPE')
+    $libvirt_virt_type = lookup('CONFIG_NOVA_LIBVIRT_VIRT_TYPE')
     if $libvirt_virt_type == 'kvm' {
         # Workaround for bad /dev/kvm permissions
         # https://bugzilla.redhat.com/show_bug.cgi?id=950436
         file { '/dev/kvm':
-          owner  => 'root',
-          group  => 'kvm',
-          mode   => '666',
+          owner => 'root',
+          group => 'kvm',
+          mode  => '0666',
         }
 
         # We have to fix the permissions after the installation has been done
         # and before the service is started.
-        Package <| title == 'libvirt' |> ->
-        File['/dev/kvm'] ->
-        Service <| title == 'libvirt' |>
+        Package <| title == 'libvirt' |>
+        -> File['/dev/kvm']
+        -> Service <| title == 'libvirt' |>
     }
 
-    $migrate_transport = hiera('CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL')
+    $migrate_transport = lookup('CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL')
     if $migrate_transport == 'ssh' {
       $client_extraparams = {
         keyfile   => '/etc/nova/migration/identity',
@@ -36,17 +36,17 @@
       $client_extraparams = {}
     }
 
-    class { '::nova::migration::libvirt':
-      transport   => $migrate_transport,
-      client_user => 'nova_migration',
+    class { 'nova::migration::libvirt':
+      transport          => $migrate_transport,
+      client_user        => 'nova_migration',
       client_extraparams => $client_extraparams,
-      require => Class['::nova::compute::libvirt']
+      require            => Class['::nova::compute::libvirt']
     }
 
-    class { '::nova::compute::libvirt':
-      libvirt_virt_type        => $libvirt_virt_type,
-      vncserver_listen         => $libvirt_vnc_bind_host,
-      migration_support        => true,
+    class { 'nova::compute::libvirt':
+      virt_type         => $libvirt_virt_type,
+      vncserver_listen  => $libvirt_vnc_bind_host,
+      migration_support => true,
     }
 
     # Remove libvirt's default network (usually virbr0) as it's unnecessary and
@@ -63,9 +63,8 @@
       require => Exec['virsh-net-destroy-default'],
     }
 
-    $libvirt_debug = hiera('CONFIG_DEBUG_MODE')
+    $libvirt_debug = lookup('CONFIG_DEBUG_MODE')
     if $libvirt_debug {
-
       file_line { '/etc/libvirt/libvirt.conf log_filters':
         path   => '/etc/libvirt/libvirtd.conf',
         line   => 'log_filters = "1:libvirt 1:qemu 1:conf 1:security 3:event 3:json 3:file 1:util"',
@@ -79,6 +78,5 @@
         match  => 'log_outputs =',
         notify => Service['libvirt'],
       }
-
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/nova/compute/vmware.pp b/packstack/puppet/modules/packstack/manifests/nova/compute/vmware.pp
index 62a58716f..02a6d4c94 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/compute/vmware.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/compute/vmware.pp
@@ -1,13 +1,13 @@
 class packstack::nova::compute::vmware ()
 {
-    $cluster_list = hiera('CONFIG_VCENTER_CLUSTERS')
-    $my_ip = choose_my_ip(hiera('HOST_LIST'))
+    $cluster_list = lookup('CONFIG_VCENTER_CLUSTERS')
+    $my_ip = choose_my_ip(lookup('HOST_LIST'))
     $nova_vcenter_cluster_name = $cluster_list[$my_ip]
 
-    class { '::nova::compute::vmware':
-      host_ip       => hiera('CONFIG_VCENTER_HOST'),
-      host_username => hiera('CONFIG_VCENTER_USER'),
-      host_password => hiera('CONFIG_VCENTER_PASSWORD'),
+    class { 'nova::compute::vmware':
+      host_ip       => lookup('CONFIG_VCENTER_HOST'),
+      host_username => lookup('CONFIG_VCENTER_USER'),
+      host_password => lookup('CONFIG_VCENTER_PASSWORD'),
       cluster_name  => $nova_vcenter_cluster_name,
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/nova/conductor.pp b/packstack/puppet/modules/packstack/manifests/nova/conductor.pp
index 41edc44d0..0dc14a46a 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/conductor.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/conductor.pp
@@ -1,8 +1,9 @@
 class packstack::nova::conductor ()
 {
-    class { '::nova::conductor':
+    include packstack::nova::cache
+    class { 'nova::conductor':
       enabled => true,
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
     Keystone_endpoint <||> -> Service['nova-conductor']
diff --git a/packstack/puppet/modules/packstack/manifests/nova/gluster.pp b/packstack/puppet/modules/packstack/manifests/nova/gluster.pp
deleted file mode 100644
index 7f243254c..000000000
--- a/packstack/puppet/modules/packstack/manifests/nova/gluster.pp
+++ /dev/null
@@ -1,4 +0,0 @@
-class packstack::nova::gluster ()
-{
- ensure_packages(['glusterfs-fuse'], {'ensure' => 'present'})
-}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/metadata.pp b/packstack/puppet/modules/packstack/manifests/nova/metadata.pp
deleted file mode 100644
index 16e4a2c1a..000000000
--- a/packstack/puppet/modules/packstack/manifests/nova/metadata.pp
+++ /dev/null
@@ -1,9 +0,0 @@
-class packstack::nova::metadata ()
-{
-    nova::generic_service { 'metadata-api':
-        enabled        => true,
-        ensure_package => 'present',
-        package_name   => 'openstack-nova-api',
-        service_name   => 'openstack-nova-metadata-api',
-    }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/neutron.pp b/packstack/puppet/modules/packstack/manifests/nova/neutron.pp
index 7507ee261..402d6e451 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/neutron.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/neutron.pp
@@ -1,14 +1,14 @@
 class packstack::nova::neutron ()
 {
-    $nova_neutron_cfg_ctrl_host = hiera('CONFIG_KEYSTONE_HOST_URL')
-    $neutron_auth_url = hiera('CONFIG_KEYSTONE_ADMIN_URL')
+    $nova_neutron_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+    $neutron_auth_url = lookup('CONFIG_KEYSTONE_ADMIN_URL')
 
-    class { '::nova::network::neutron':
+    class { 'nova::network::neutron':
       default_floating_pool => 'public',
-      neutron_password      => hiera('CONFIG_NEUTRON_KS_PW'),
-      neutron_auth_type     => 'v3password',
-      neutron_project_name  => 'services',
-      neutron_auth_url      => "${neutron_auth_url}/v3",
-      neutron_region_name   => hiera('CONFIG_KEYSTONE_REGION'),
+      password              => lookup('CONFIG_NEUTRON_KS_PW'),
+      auth_type             => 'v3password',
+      project_name          => 'services',
+      auth_url              => "${neutron_auth_url}/v3",
+      region_name           => lookup('CONFIG_KEYSTONE_REGION'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/nova/nfs.pp b/packstack/puppet/modules/packstack/manifests/nova/nfs.pp
index bdc703266..36397d8f7 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/nfs.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/nfs.pp
@@ -1,4 +1,4 @@
 class packstack::nova::nfs ()
 {
- ensure_packages(['nfs-utils'], {'ensure' => 'present'})
+  ensure_packages(['nfs-utils'], {'ensure' => 'present'})
 }
diff --git a/packstack/puppet/modules/packstack/manifests/nova/sched.pp b/packstack/puppet/modules/packstack/manifests/nova/sched.pp
index 7cfd97019..aed1a5007 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/sched.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/sched.pp
@@ -1,14 +1,8 @@
 class packstack::nova::sched ()
 {
-    class {'::nova::scheduler::filter':
-      scheduler_default_filters => ['RetryFilter', 'AvailabilityZoneFilter',
-                                    'ComputeFilter',
-                                    'ComputeCapabilitiesFilter', 'ImagePropertiesFilter',
-                                    'ServerGroupAntiAffinityFilter',
-                                    'ServerGroupAffinityFilter'],
-    }
-
-    class { '::nova::scheduler':
+    include packstack::nova::cache
+    include nova::scheduler::filter
+    class { 'nova::scheduler':
       enabled => true,
     }
 
diff --git a/packstack/puppet/modules/packstack/manifests/nova/sched/ironic.pp b/packstack/puppet/modules/packstack/manifests/nova/sched/ironic.pp
index 04958ce75..5a1633e4d 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/sched/ironic.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/sched/ironic.pp
@@ -1,6 +1,6 @@
 class packstack::nova::sched::ironic ()
 {
-  class { '::nova::scheduler':
+  class { 'nova::scheduler':
     enabled => true,
   }
 }
\ No newline at end of file
diff --git a/packstack/puppet/modules/packstack/manifests/nova/vncproxy.pp b/packstack/puppet/modules/packstack/manifests/nova/vncproxy.pp
index 841e28604..83bf2afbf 100644
--- a/packstack/puppet/modules/packstack/manifests/nova/vncproxy.pp
+++ b/packstack/puppet/modules/packstack/manifests/nova/vncproxy.pp
@@ -1,12 +1,12 @@
 class packstack::nova::vncproxy ()
 {
-    $vnc_bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $vnc_bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    class { '::nova::vncproxy':
+    class { 'nova::vncproxy':
       enabled => true,
       host    => $vnc_bind_host,
     }
@@ -14,6 +14,6 @@
     firewall { '001 novncproxy incoming':
       proto  => 'tcp',
       dport  => ['6080'],
-      action => 'accept',
+      jump   => 'accept',
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/openstackclient.pp b/packstack/puppet/modules/packstack/manifests/openstackclient.pp
index a70d8a31a..b91d40f37 100644
--- a/packstack/puppet/modules/packstack/manifests/openstackclient.pp
+++ b/packstack/puppet/modules/packstack/manifests/openstackclient.pp
@@ -6,17 +6,17 @@
 
     ensure_packages($clientlibs, {'ensure' => 'present'})
 
-    if hiera('CONFIG_MANILA_INSTALL') == 'y' {
+    if lookup('CONFIG_MANILA_INSTALL') == 'y' {
       ensure_packages(['/usr/bin/manila'], {'ensure' => 'present'})
     }
 
-    $ost_cl_keystone_admin_username = hiera('CONFIG_KEYSTONE_ADMIN_USERNAME')
-    $ost_cl_keystone_admin_pw       = hiera('CONFIG_KEYSTONE_ADMIN_PW')
-    $ost_cl_ctrl_keystone_url       = hiera('CONFIG_KEYSTONE_PUBLIC_URL')
-    $ost_cl_keystone_region         = hiera('CONFIG_KEYSTONE_REGION')
-    $ost_cl_keystone_demo_pw        = hiera('CONFIG_KEYSTONE_DEMO_PW')
+    $ost_cl_keystone_admin_username = lookup('CONFIG_KEYSTONE_ADMIN_USERNAME')
+    $ost_cl_keystone_admin_pw       = lookup('CONFIG_KEYSTONE_ADMIN_PW')
+    $ost_cl_ctrl_keystone_url       = lookup('CONFIG_KEYSTONE_PUBLIC_URL')
+    $ost_cl_keystone_region         = lookup('CONFIG_KEYSTONE_REGION')
+    $ost_cl_keystone_demo_pw        = lookup('CONFIG_KEYSTONE_DEMO_PW')
 
-    $config_keystone_api_version = hiera('CONFIG_KEYSTONE_API_VERSION')
+    $config_keystone_api_version = lookup('CONFIG_KEYSTONE_API_VERSION')
     if $config_keystone_api_version =~ /^v(\d+).*$/ {
       # we need to force integer here
       $int_api_version = 0 + $1
@@ -25,17 +25,17 @@
     }
 
     $rcadmin_common_content = "unset OS_SERVICE_TOKEN
-    export OS_USERNAME=${ost_cl_keystone_admin_username}
-    export OS_PASSWORD='${ost_cl_keystone_admin_pw}'
-    export OS_REGION_NAME=${ost_cl_keystone_region}
-    export OS_AUTH_URL=${ost_cl_ctrl_keystone_url}
-    export PS1='[\\u@\\h \\W(keystone_admin)]\\$ '
-    "
+export OS_USERNAME=${ost_cl_keystone_admin_username}
+export OS_PASSWORD='${ost_cl_keystone_admin_pw}'
+export OS_REGION_NAME=${ost_cl_keystone_region}
+export OS_AUTH_URL=${ost_cl_ctrl_keystone_url}
+export PS1='[\\u@\\h \\W(keystone_admin)]\\$ '
+"
 
     if $int_api_version < 3 {
       $rcadmin_content = "${rcadmin_common_content}
 export OS_TENANT_NAME=admin
-    "
+"
     }
     else {
         $rcadmin_content = "${rcadmin_common_content}
@@ -43,7 +43,7 @@
 export OS_USER_DOMAIN_NAME=Default
 export OS_PROJECT_DOMAIN_NAME=Default
 export OS_IDENTITY_API_VERSION=${int_api_version}
-    "
+"
     }
 
     file { "${::home_dir}/keystonerc_admin":
@@ -52,26 +52,26 @@
       content => $rcadmin_content,
     }
 
-    if hiera('CONFIG_PROVISION_DEMO') == 'y' {
+    if lookup('CONFIG_PROVISION_DEMO') == 'y' {
       $demo_common_content = "unset OS_SERVICE_TOKEN
 export OS_USERNAME=demo
 export OS_PASSWORD='${ost_cl_keystone_demo_pw}'
 export PS1='[\\u@\\h \\W(keystone_demo)]\\$ '
 export OS_AUTH_URL=${ost_cl_ctrl_keystone_url}
-    "
+"
 
       if $int_api_version < 3 {
         $demo_content = "${demo_common_content}
 export OS_TENANT_NAME=demo
 export OS_IDENTITY_API_VERSION=${int_api_version}.0
-    "
+"
       } else {
         $demo_content = "${demo_common_content}
 export OS_PROJECT_NAME=demo
 export OS_USER_DOMAIN_NAME=Default
 export OS_PROJECT_DOMAIN_NAME=Default
 export OS_IDENTITY_API_VERSION=${int_api_version}
-    "
+"
       }
 
       file { "${::home_dir}/keystonerc_demo":
@@ -81,12 +81,12 @@
       }
     }
 
-    if hiera('NO_ROOT_USER_ALLINONE') == true {
-      $ost_cl_home_dir = hiera('HOME_DIR')
+    if lookup('NO_ROOT_USER_ALLINONE') == true {
+      $ost_cl_home_dir = lookup('HOME_DIR')
       file { "${ost_cl_home_dir}/keystonerc_admin":
         ensure  => file,
-        owner   => hiera('NO_ROOT_USER'),
-        group   => hiera('NO_ROOT_GROUP'),
+        owner   => lookup('NO_ROOT_USER'),
+        group   => lookup('NO_ROOT_GROUP'),
         mode    => '0600',
         content => $rcadmin_content,
       }
diff --git a/packstack/puppet/modules/packstack/manifests/panko.pp b/packstack/puppet/modules/packstack/manifests/panko.pp
deleted file mode 100644
index d4ca9a3dd..000000000
--- a/packstack/puppet/modules/packstack/manifests/panko.pp
+++ /dev/null
@@ -1,39 +0,0 @@
-class packstack::panko ()
-{
-    create_resources(packstack::firewall, hiera('FIREWALL_PANKO_RULES', {}))
-
-    $panko_cfg_db_pw = hiera('CONFIG_PANKO_DB_PW')
-    $panko_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
-
-    class { '::panko::wsgi::apache':
-      workers => hiera('CONFIG_SERVICE_WORKERS'),
-      threads => hiera('CONFIG_SERVICE_WORKERS'),
-      ssl     => false
-    }
-
-    include ::panko
-
-    class { '::panko::db':
-      database_connection => "mysql+pymysql://panko:${panko_cfg_db_pw}@${panko_cfg_mariadb_host}/panko?charset=utf8",
-    }
-
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
-     'ipv6'  => '::0',
-     default => '0.0.0.0',
-    }
-
-    class { '::panko::keystone::authtoken':
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
-      auth_version         => hiera('CONFIG_KEYSTONE_API_VERSION'),
-      password             => hiera('CONFIG_PANKO_KS_PW')
-    }
-
-    class { '::panko::api':
-      host         => $bind_host,
-      service_name => 'httpd'
-    }
-
-    include ::panko::db::sync
-
-}
diff --git a/packstack/puppet/modules/packstack/manifests/placement.pp b/packstack/puppet/modules/packstack/manifests/placement.pp
index 28e696e6e..fd462c319 100644
--- a/packstack/puppet/modules/packstack/manifests/placement.pp
+++ b/packstack/puppet/modules/packstack/manifests/placement.pp
@@ -1,30 +1,35 @@
 class packstack::placement ()
 {
-    $placement_db_pw = hiera('CONFIG_NOVA_DB_PW')
-    $placement_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    include ::packstack::keystone::placement
-    include ::placement
+    include packstack::keystone::placement
+    include placement
 
-    class { '::placement::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'placement::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
-    class { '::placement::db':
-      database_connection => "mysql+pymysql://placement:${placement_db_pw}@${placement_mariadb_host}/placement",
+    class { 'placement::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'placement',
+        'password' => lookup('CONFIG_NOVA_DB_PW'),
+        'database' => 'placement',
+      })
     }
+    include placement::db::sync
 
-    include ::placement::db::sync
-
-    class { '::placement::wsgi::apache':
+    class { 'placement::api':
+      api_service_name => 'httpd',
+    }
+    class { 'placement::wsgi::apache':
       bind_host => $bind_host,
-      api_port  => '8778',
       ssl       => false,
-      workers   => hiera('CONFIG_SERVICE_WORKERS'),
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/prereqs.pp b/packstack/puppet/modules/packstack/manifests/prereqs.pp
index 9a1dd9164..5bd39ed52 100644
--- a/packstack/puppet/modules/packstack/manifests/prereqs.pp
+++ b/packstack/puppet/modules/packstack/manifests/prereqs.pp
@@ -10,8 +10,8 @@
 
     package { 'audit':
       ensure => present,
-    } ->
-    service { 'auditd':
+    }
+    -> service { 'auditd':
       ensure => running,
       enable => true,
     }
diff --git a/packstack/puppet/modules/packstack/manifests/provision.pp b/packstack/puppet/modules/packstack/manifests/provision.pp
index eb0d93039..fda848129 100644
--- a/packstack/puppet/modules/packstack/manifests/provision.pp
+++ b/packstack/puppet/modules/packstack/manifests/provision.pp
@@ -1,24 +1,23 @@
 class packstack::provision ()
 {
-    $provision_demo            = str2bool(hiera('CONFIG_PROVISION_DEMO'))
-    $provision_tempest         = str2bool(hiera('CONFIG_PROVISION_TEMPEST'))
-    $provision_neutron         = str2bool(hiera('CONFIG_NEUTRON_INSTALL'))
-    $heat_available            = str2bool(hiera('CONFIG_HEAT_INSTALL'))
+    $provision_demo            = str2bool(lookup('CONFIG_PROVISION_DEMO'))
+    $provision_tempest         = str2bool(lookup('CONFIG_PROVISION_TEMPEST'))
+    $provision_neutron         = str2bool(lookup('CONFIG_NEUTRON_INSTALL'))
+    $heat_available            = str2bool(lookup('CONFIG_HEAT_INSTALL'))
 
     if $provision_demo {
       $username             = 'demo'
-      $password             = hiera('CONFIG_KEYSTONE_DEMO_PW')
-      $tenant_name          = 'demo'
-      $floating_range       = hiera('CONFIG_PROVISION_DEMO_FLOATRANGE')
-      $allocation_pools     = hiera(
-                              'CONFIG_PROVISION_DEMO_ALLOCATION_POOLS')
+      $password             = lookup('CONFIG_KEYSTONE_DEMO_PW')
+      $project_name         = 'demo'
+      $floating_range       = lookup('CONFIG_PROVISION_DEMO_FLOATRANGE')
+      $allocation_pools     = lookup('CONFIG_PROVISION_DEMO_ALLOCATION_POOLS')
     } elsif $provision_tempest {
-      $username             = hiera('CONFIG_PROVISION_TEMPEST_USER')
-      $password             = hiera('CONFIG_PROVISION_TEMPEST_USER_PW')
-      $tenant_name          = 'tempest'
-      $floating_range       = hiera('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
+      $username             = lookup('CONFIG_PROVISION_TEMPEST_USER')
+      $password             = lookup('CONFIG_PROVISION_TEMPEST_USER_PW')
+      $project_name         = 'tempest'
+      $floating_range       = lookup('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
       $allocation_pools     = []
-      if (empty($tempest_user) or empty($tempest_password)) {
+      if (empty($username) or empty($password)) {
         fail("Both CONFIG_PROVISION_TEMPEST_USER and
         CONFIG_PROVISION_TEMPEST_USER_PW need to be configured.")
       }
@@ -27,8 +26,8 @@
     if $provision_demo or $provision_tempest {
 
       # Keystone
-      $admin_tenant_name = 'admin'
-      keystone_tenant { $tenant_name:
+      $admin_project_name = 'admin'
+      keystone_tenant { $project_name:
         ensure      => present,
         enabled     => true,
         description => 'default tenant',
@@ -40,16 +39,9 @@
         password => $password,
       }
 
-      if $heat_available {
-        keystone_user_role { "${username}@${tenant_name}":
-          ensure => present,
-          roles  => ['_member_', 'heat_stack_owner'],
-        }
-      } else {
-        keystone_user_role { "${username}@${tenant_name}":
-          ensure => present,
-          roles  => ['_member_'],
-        }
+      keystone_user_role { "${username}@${project_name}":
+        ensure => present,
+        roles  => ['member'],
       }
 
       ## Neutron
@@ -60,14 +52,14 @@
         $private_subnet_name  = 'private_subnet'
         $fixed_range          = '10.0.0.0/24'
         $router_name          = 'router1'
-        $public_physnet       = hiera('CONFIG_NEUTRON_OVS_EXTERNAL_PHYSNET')
+        $public_physnet       = lookup('CONFIG_NEUTRON_OVS_EXTERNAL_PHYSNET')
 
         $neutron_deps = [Neutron_network[$public_network_name]]
 
         neutron_network { $public_network_name:
           ensure                    => present,
           router_external           => true,
-          tenant_name               => $admin_tenant_name,
+          project_name              => $admin_project_name,
           provider_network_type     => 'flat',
           provider_physical_network => $public_physnet,
         }
@@ -77,22 +69,22 @@
           allocation_pools => $allocation_pools,
           enable_dhcp      => false,
           network_name     => $public_network_name,
-          tenant_name      => $admin_tenant_name,
+          project_name     => $admin_project_name,
         }
         neutron_network { $private_network_name:
-          ensure      => present,
-          tenant_name => $tenant_name,
+          ensure       => present,
+          project_name => $project_name,
         }
         neutron_subnet { $private_subnet_name:
-          ensure       => present,
-          cidr         => $fixed_range,
-          network_name => $private_network_name,
-          tenant_name  => $tenant_name,
+          ensure        => present,
+          cidr          => $fixed_range,
+          network_name  => $private_network_name,
+          project_name  => $project_name,
         }
         # Tenant-owned router - assumes network namespace isolation
         neutron_router { $router_name:
           ensure               => present,
-          tenant_name          => $tenant_name,
+          project_name         => $project_name,
           gateway_network_name => $public_network_name,
           # A neutron_router resource must explicitly declare a dependency on
           # the first subnet of the gateway network.
diff --git a/packstack/puppet/modules/packstack/manifests/provision/bridge.pp b/packstack/puppet/modules/packstack/manifests/provision/bridge.pp
index dd8c71b9f..9daa8ccc1 100644
--- a/packstack/puppet/modules/packstack/manifests/provision/bridge.pp
+++ b/packstack/puppet/modules/packstack/manifests/provision/bridge.pp
@@ -1,32 +1,24 @@
 class packstack::provision::bridge ()
 {
-    $provision_neutron_br    = str2bool(hiera('CONFIG_NEUTRON_INSTALL'))
-    $setup_ovs_bridge        = str2bool(hiera('CONFIG_PROVISION_OVS_BRIDGE'))
-    $public_bridge_name      = hiera('CONFIG_NEUTRON_L3_EXT_BRIDGE', 'br-ex')
-    $provision_tempest_br    = str2bool(hiera('CONFIG_PROVISION_TEMPEST'))
-    $provision_demo_br       = str2bool(hiera('CONFIG_PROVISION_DEMO'))
+    $provision_neutron_br    = str2bool(lookup('CONFIG_NEUTRON_INSTALL'))
+    $setup_ovs_bridge        = str2bool(lookup('CONFIG_PROVISION_OVS_BRIDGE'))
+    $public_bridge_name      = lookup('CONFIG_NEUTRON_L3_EXT_BRIDGE', undef, undef, 'br-ex')
+    $provision_tempest_br    = str2bool(lookup('CONFIG_PROVISION_TEMPEST'))
+    $provision_demo_br       = str2bool(lookup('CONFIG_PROVISION_DEMO'))
 
-    $neutron_user_password   = hiera('CONFIG_NEUTRON_KS_PW')
+    $neutron_user_password   = lookup('CONFIG_NEUTRON_KS_PW')
 
     if $provision_demo_br {
-      $floating_range_br = hiera('CONFIG_PROVISION_DEMO_FLOATRANGE')
+      $floating_range_br = lookup('CONFIG_PROVISION_DEMO_FLOATRANGE')
     } elsif $provision_tempest_br {
-      $floating_range_br = hiera('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
-    }
-
-    class { '::neutron::keystone::authtoken':
-      username             => 'neutron',
-      password             => $neutron_user_password,
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
-      project_name         => 'services',
+      $floating_range_br = lookup('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
     }
 
     if $provision_neutron_br and $setup_ovs_bridge {
       Neutron_config<||> -> Neutron_l3_ovs_bridge['demo_bridge']
       neutron_l3_ovs_bridge { 'demo_bridge':
-        name        => $public_bridge_name,
         ensure      => present,
+        name        => $public_bridge_name,
         subnet_name => 'public_subnet',
       }
 
@@ -34,7 +26,7 @@
         chain    => 'POSTROUTING',
         jump     => 'MASQUERADE',
         source   => $floating_range_br,
-        outiface => $::gateway_device,
+        outiface => $facts['gateway_device'],
         table    => 'nat',
         proto    => 'all',
       }
@@ -43,14 +35,14 @@
       if $public_bridge_name != '' {
         firewall { '000 forward out':
           chain    => 'FORWARD',
-          action   => 'accept',
+          jump     => 'accept',
           outiface => $public_bridge_name,
           proto    => 'all',
         }
 
         firewall { '000 forward in':
           chain   => 'FORWARD',
-          action  => 'accept',
+          jump    => 'accept',
           iniface => $public_bridge_name,
           proto   => 'all',
         }
diff --git a/packstack/puppet/modules/packstack/manifests/provision/glance.pp b/packstack/puppet/modules/packstack/manifests/provision/glance.pp
index 4eb0785e9..dbe4863de 100644
--- a/packstack/puppet/modules/packstack/manifests/provision/glance.pp
+++ b/packstack/puppet/modules/packstack/manifests/provision/glance.pp
@@ -1,13 +1,9 @@
 class packstack::provision::glance ()
 {
-    $image_name               = hiera('CONFIG_PROVISION_IMAGE_NAME')
-    $image_source             = hiera('CONFIG_PROVISION_IMAGE_URL')
-    $image_format             = hiera('CONFIG_PROVISION_IMAGE_FORMAT')
-    $image_properties         = hiera('CONFIG_PROVISION_IMAGE_PROPERTIES')
-    $uec_image_name           = hiera('CONFIG_PROVISION_UEC_IMAGE_NAME')
-    $uec_image_source_kernel  = hiera('CONFIG_PROVISION_UEC_IMAGE_KERNEL_URL')
-    $uec_image_source_ramdisk = hiera('CONFIG_PROVISION_UEC_IMAGE_RAMDISK_URL')
-    $uec_image_source_disk    = hiera('CONFIG_PROVISION_UEC_IMAGE_DISK_URL')
+    $image_name       = lookup('CONFIG_PROVISION_IMAGE_NAME')
+    $image_source     = lookup('CONFIG_PROVISION_IMAGE_URL')
+    $image_format     = lookup('CONFIG_PROVISION_IMAGE_FORMAT')
+    $image_properties = lookup('CONFIG_PROVISION_IMAGE_PROPERTIES')
 
     glance_image { $image_name:
       ensure           => present,
@@ -15,62 +11,6 @@
       container_format => 'bare',
       disk_format      => $image_format,
       source           => $image_source,
-      properties       => $image_properties
-    }
-
-    if str2bool(hiera('CONFIG_PROVISION_TEMPEST')) {
-      $image_name_alt = "${uec_image_name}_alt"
-
-      glance_image{"${uec_image_name}-kernel":
-        ensure           => present,
-        is_public        => 'yes',
-        container_format => 'aki',
-        disk_format      => 'aki',
-        source           => $uec_image_source_kernel,
-        id               => '146d4a6b-ad1e-4d9f-8b08-98eae3c3dab4'
-      }
-
-      glance_image{"${uec_image_name}-ramdisk":
-        ensure           => present,
-        is_public        => 'yes',
-        container_format => 'ari',
-        disk_format      => 'ari',
-        source           => $uec_image_source_ramdisk,
-        id               => '0b50e2e5-1440-4654-b568-4e120ddf28c1'
-      }
-      $uec_properties = { 'kernel_id' => '146d4a6b-ad1e-4d9f-8b08-98eae3c3dab4',
-                          'ramdisk_id' => '0b50e2e5-1440-4654-b568-4e120ddf28c1' }
-      # Same properties we require for QCOW2 image, we need for UEC image too
-      if $image_format == 'qcow2' {
-        $image_properties_hash = $image_properties.split(',').map |$tok| { $tok.split('=') }.flatten.hash
-        $uec_properties_all = $uec_properties.merge($image_properties_hash)
-      } else {
-        $uec_properties_all = $uec_properties
-      }
-
-      glance_image{$uec_image_name:
-        ensure           => present,
-        is_public        => 'yes',
-        container_format => 'ami',
-        disk_format      => 'qcow2',
-        source           => $uec_image_source_disk,
-        properties       => $uec_properties_all,
-        require          => [ Glance_image["${uec_image_name}-kernel"], Glance_image["${uec_image_name}-ramdisk"] ]
-      }
-
-      glance_image{$image_name_alt:
-        ensure           => present,
-        is_public        => 'yes',
-        container_format => 'ami',
-        # FIXME(jpena): ami used to be an acceptable disk format, but we are
-        # failing to boot from volume since https://review.openstack.org/453341
-        # because qemu-img convert does not recognize is as a valid format.
-        # See https://bugs.launchpad.net/cinder/+bug/1693926
-        disk_format      => 'qcow2',
-        source           => $uec_image_source_disk,
-        properties       => $uec_properties_all,
-        require          => [ Glance_image["${uec_image_name}-kernel"], Glance_image["${uec_image_name}-ramdisk"] ]
-      }
-
+      properties       => parse_hash_from_string($image_properties)
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/provision/tempest.pp b/packstack/puppet/modules/packstack/manifests/provision/tempest.pp
index e49ebcac2..85cd95a7f 100644
--- a/packstack/puppet/modules/packstack/manifests/provision/tempest.pp
+++ b/packstack/puppet/modules/packstack/manifests/provision/tempest.pp
@@ -1,25 +1,23 @@
 class packstack::provision::tempest ()
 {
-    $provision_demo         = str2bool(hiera('CONFIG_PROVISION_DEMO'))
+    $provision_demo         = str2bool(lookup('CONFIG_PROVISION_DEMO'))
     if $provision_demo {
       $username             = 'demo'
-      $password             = hiera('CONFIG_KEYSTONE_DEMO_PW')
-      $tenant_name          = 'demo'
-      $floating_range       = hiera('CONFIG_PROVISION_DEMO_FLOATRANGE')
+      $password             = lookup('CONFIG_KEYSTONE_DEMO_PW')
+      $project_name         = 'demo'
+      $floating_range       = lookup('CONFIG_PROVISION_DEMO_FLOATRANGE')
     } else {
-      $username             = hiera('CONFIG_PROVISION_TEMPEST_USER')
-      $password             = hiera('CONFIG_PROVISION_TEMPEST_USER_PW')
-      $tenant_name          = 'tempest'
-      $floating_range       = hiera('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
+      $username             = lookup('CONFIG_PROVISION_TEMPEST_USER')
+      $password             = lookup('CONFIG_PROVISION_TEMPEST_USER_PW')
+      $project_name         = 'tempest'
+      $floating_range       = lookup('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
     }
 
     # Authentication/Keystone
-    $identity_uri          = regsubst(hiera('CONFIG_KEYSTONE_PUBLIC_URL'), 'v3', 'v2.0')
-    $identity_uri_v3       = regsubst(hiera('CONFIG_KEYSTONE_PUBLIC_URL'), 'v2.0', 'v3')
-    $auth_version          = regsubst(hiera('CONFIG_KEYSTONE_API_VERSION'), '.0', '')
-    $admin_username        = hiera('CONFIG_KEYSTONE_ADMIN_USERNAME')
-    $admin_password        = hiera('CONFIG_KEYSTONE_ADMIN_PW')
-    $admin_tenant_name     = 'admin'
+    $identity_uri_v3       = lookup('CONFIG_KEYSTONE_PUBLIC_URL')
+    $admin_username        = lookup('CONFIG_KEYSTONE_ADMIN_USERNAME')
+    $admin_password        = lookup('CONFIG_KEYSTONE_ADMIN_PW')
+    $admin_project_name    = 'admin'
     $admin_domain_name     = 'Default'
 
     # get image and network id
@@ -27,12 +25,11 @@
     $configure_networks        = true
 
     # Image
-    $uec_image_name     = hiera('CONFIG_PROVISION_UEC_IMAGE_NAME')
-    $image_ssh_user     = hiera('CONFIG_PROVISION_IMAGE_SSH_USER')
-    $image_name_alt     = "${uec_image_name}_alt"
-    $image_alt_ssh_user = hiera('CONFIG_PROVISION_IMAGE_SSH_USER')
-    $image_source       = hiera('CONFIG_PROVISION_IMAGE_URL')
-    $image_format       = hiera('CONFIG_PROVISION_IMAGE_FORMAT')
+    $image_ssh_user     = lookup('CONFIG_PROVISION_IMAGE_SSH_USER')
+    $image_name         = lookup('CONFIG_PROVISION_IMAGE_NAME')
+    $image_alt_ssh_user = lookup('CONFIG_PROVISION_IMAGE_SSH_USER')
+    $image_source       = lookup('CONFIG_PROVISION_IMAGE_URL')
+    $image_format       = lookup('CONFIG_PROVISION_IMAGE_FORMAT')
 
     # network name
     $public_network_name = 'public'
@@ -40,9 +37,8 @@
     # nova should be able to resize with packstack setup
     $resize_available          = true
 
-    $change_password_available = undef
-    $allow_tenant_isolation    = true
-    $dir_log                   = hiera('DIR_LOG')
+    $use_dynamic_credentials   = true
+    $dir_log                   = lookup('DIR_LOG')
     $log_file                  = "${dir_log}/tempest.log"
     $use_stderr                = false
     $debug                     = true
@@ -50,20 +46,20 @@
 
     # Tempest
     $tempest_workspace    = '/var/lib/tempest'
-    $tempest_user          = hiera('CONFIG_PROVISION_TEMPEST_USER')
-    $tempest_password      = hiera('CONFIG_PROVISION_TEMPEST_USER_PW')
+    $tempest_user          = lookup('CONFIG_PROVISION_TEMPEST_USER')
+    $tempest_password      = lookup('CONFIG_PROVISION_TEMPEST_USER_PW')
 
-    $tempest_flavor_name = hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_NAME')
-    $tempest_flavor_ref  = "42"
-    $tempest_flavor_ram  = hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_RAM')
-    $tempest_flavor_disk = hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_DISK')
-    $tempest_flavor_vcpus= hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_VCPUS')
+    $tempest_flavor_name = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_NAME')
+    $tempest_flavor_ref  = '42'
+    $tempest_flavor_ram  = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_RAM')
+    $tempest_flavor_disk = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_DISK')
+    $tempest_flavor_vcpus= lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_VCPUS')
 
-    $tempest_flavor_alt_name = hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_NAME')
-    $tempest_flavor_alt_ref  = "84"
-    $tempest_flavor_alt_ram  = hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_RAM')
-    $tempest_flavor_alt_disk = hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_DISK')
-    $tempest_flavor_alt_vcpus= hiera('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_VCPUS')
+    $tempest_flavor_alt_name = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_NAME')
+    $tempest_flavor_alt_ref  = '84'
+    $tempest_flavor_alt_ram  = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_RAM')
+    $tempest_flavor_alt_disk = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_DISK')
+    $tempest_flavor_alt_vcpus= lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_VCPUS')
 
     nova_flavor { $tempest_flavor_name :
       ensure => present,
@@ -71,7 +67,6 @@
       ram    => $tempest_flavor_ram,
       disk   => $tempest_flavor_disk,
       vcpus  => $tempest_flavor_vcpus,
-      require => [ Class['::nova::api'], Class['::nova::keystone::auth'] ],
     }
     nova_flavor { $tempest_flavor_alt_name :
       ensure => present,
@@ -79,42 +74,38 @@
       ram    => $tempest_flavor_alt_ram,
       disk   => $tempest_flavor_alt_disk,
       vcpus  => $tempest_flavor_alt_vcpus,
-      require => [ Class['::nova::api'], Class['::nova::keystone::auth'] ],
     }
 
     # Service availability for testing based on configuration
-    $cinder_available     = str2bool(hiera('CONFIG_CINDER_INSTALL'))
-    $glance_available     = str2bool(hiera('CONFIG_GLANCE_INSTALL'))
-    $horizon_available    = str2bool(hiera('CONFIG_HORIZON_INSTALL'))
-    $nova_available       = str2bool(hiera('CONFIG_NOVA_INSTALL'))
-    $neutron_available    = str2bool(hiera('CONFIG_NEUTRON_INSTALL'))
-    $ceilometer_available = str2bool(hiera('CONFIG_CEILOMETER_INSTALL'))
-    $aodh_available       = str2bool(hiera('CONFIG_AODH_INSTALL'))
-    $trove_available      = str2bool(hiera('CONFIG_TROVE_INSTALL'))
-    $sahara_available     = str2bool(hiera('CONFIG_SAHARA_INSTALL'))
-    $heat_available       = str2bool(hiera('CONFIG_HEAT_INSTALL'))
-    $swift_available      = str2bool(hiera('CONFIG_SWIFT_INSTALL'))
-    $configure_tempest    = str2bool(hiera('CONFIG_PROVISION_TEMPEST'))
+    $cinder_available     = str2bool(lookup('CONFIG_CINDER_INSTALL'))
+    $glance_available     = str2bool(lookup('CONFIG_GLANCE_INSTALL'))
+    $horizon_available    = str2bool(lookup('CONFIG_HORIZON_INSTALL'))
+    $nova_available       = str2bool(lookup('CONFIG_NOVA_INSTALL'))
+    $neutron_available    = str2bool(lookup('CONFIG_NEUTRON_INSTALL'))
+    $ceilometer_available = str2bool(lookup('CONFIG_CEILOMETER_INSTALL'))
+    $aodh_available       = str2bool(lookup('CONFIG_AODH_INSTALL'))
+    $trove_available      = str2bool(lookup('CONFIG_TROVE_INSTALL'))
+    $heat_available       = str2bool(lookup('CONFIG_HEAT_INSTALL'))
+    $swift_available      = str2bool(lookup('CONFIG_SWIFT_INSTALL'))
+    $configure_tempest    = str2bool(lookup('CONFIG_PROVISION_TEMPEST'))
 
     # Some API extensions as l3_agent_scheduler are not enabled by OVN plugin
-    $l2_agent  = hiera('CONFIG_NEUTRON_L2_AGENT')
+    $l2_agent  = lookup('CONFIG_NEUTRON_L2_AGENT')
     if $l2_agent == 'ovn' {
       $neutron_api_extensions = 'ext-gw-mode,binding,agent,external-net,quotas,provider,extraroute,router,extra_dhcp_opt,allowed-address-pairs,security-group,trunk'
     } else {
       $neutron_api_extensions = undef
     }
 
-    class { '::tempest':
+    class { 'tempest':
       admin_domain_name         => $admin_domain_name,
       admin_password            => $admin_password,
-      admin_tenant_name         => $admin_tenant_name,
+      admin_project_name        => $admin_project_name,
       admin_username            => $admin_username,
-      allow_tenant_isolation    => $allow_tenant_isolation,
+      use_dynamic_credentials   => $use_dynamic_credentials,
       aodh_available            => $aodh_available,
-      auth_version              => $auth_version,
       ceilometer_available      => $ceilometer_available,
       cinder_available          => $cinder_available,
-      change_password_available => $change_password_available,
       configure_images          => $configure_images,
       configure_networks        => $configure_networks,
       debug                     => $debug,
@@ -123,12 +114,10 @@
       glance_available          => $glance_available,
       heat_available            => $heat_available,
       horizon_available         => $horizon_available,
-      identity_uri              => $identity_uri,
       identity_uri_v3           => $identity_uri_v3,
-      keystone_v2               => false,
       image_alt_ssh_user        => $image_alt_ssh_user,
-      image_name_alt            => $image_name_alt,
-      image_name                => $uec_image_name,
+      image_name_alt            => $image_name,
+      image_name                => $image_name,
       image_ssh_user            => $image_ssh_user,
       run_ssh                   => true,
       log_file                  => $log_file,
@@ -138,11 +127,10 @@
       public_network_name       => $public_network_name,
       public_router_id          => $public_router_id,
       resize_available          => $resize_available,
-      sahara_available          => $sahara_available,
       swift_available           => $swift_available,
       tempest_workspace         => $tempest_workspace,
       install_from_source       => false,
-      tenant_name               => $tenant_name,
+      project_name              => $project_name,
       trove_available           => $trove_available,
       username                  => $username,
       use_stderr                => $use_stderr,
diff --git a/packstack/puppet/modules/packstack/manifests/redis.pp b/packstack/puppet/modules/packstack/manifests/redis.pp
index d4f868954..07d50554d 100644
--- a/packstack/puppet/modules/packstack/manifests/redis.pp
+++ b/packstack/puppet/modules/packstack/manifests/redis.pp
@@ -1,16 +1,15 @@
 class packstack::redis ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_REDIS_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_REDIS_RULES', undef, undef, {}))
 
-    $redis_port = Integer(hiera('CONFIG_REDIS_PORT'))
-    $redis_host = hiera('CONFIG_REDIS_HOST')
+    $redis_port = Integer(lookup('CONFIG_REDIS_PORT'))
+    $redis_host = lookup('CONFIG_REDIS_HOST')
 
-    class { '::redis':
-      bind       => $redis_host,
-      port       => $redis_port,
-      appendonly => true,
-      daemonize  => false,
-      unixsocket => undef,
-      unixsocketperm => '0700',
+    class { 'redis':
+      bind           => $redis_host,
+      port           => $redis_port,
+      appendonly     => true,
+      daemonize      => false,
+      unixsocket     => '',
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/sahara.pp b/packstack/puppet/modules/packstack/manifests/sahara.pp
deleted file mode 100644
index b9df008e7..000000000
--- a/packstack/puppet/modules/packstack/manifests/sahara.pp
+++ /dev/null
@@ -1,10 +0,0 @@
-class packstack::sahara ()
-{
-    create_resources(packstack::firewall, hiera('FIREWALL_SAHARA_CFN_RULES', {}))
-
-    class { '::sahara::service::api':
-      api_workers => hiera('CONFIG_SERVICE_WORKERS')
-    }
-
-    class { '::sahara::service::engine': }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/sahara/ceilometer.pp b/packstack/puppet/modules/packstack/manifests/sahara/ceilometer.pp
deleted file mode 100644
index 301a08eae..000000000
--- a/packstack/puppet/modules/packstack/manifests/sahara/ceilometer.pp
+++ /dev/null
@@ -1,6 +0,0 @@
-class packstack::sahara::ceilometer ()
-{
-    class { '::sahara::notify':
-      notification_driver  => 'messagingv2',
-    }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/sahara/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/sahara/rabbitmq.pp
deleted file mode 100644
index 5329f069f..000000000
--- a/packstack/puppet/modules/packstack/manifests/sahara/rabbitmq.pp
+++ /dev/null
@@ -1,47 +0,0 @@
-class packstack::sahara::rabbitmq ()
-{
-    $sahara_cfg_sahara_db_pw = hiera('CONFIG_SAHARA_DB_PW')
-    $sahara_cfg_sahara_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
-
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', $::os_service_default)
-    $kombu_ssl_keyfile = hiera('CONFIG_SAHARA_SSL_KEY', $::os_service_default)
-    $kombu_ssl_certfile = hiera('CONFIG_SAHARA_SSL_CERT', $::os_service_default)
-
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
-
-    if ! is_service_default($kombu_ssl_keyfile) {
-      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
-      file { $files_to_set_owner:
-        owner   => 'sahara',
-        group   => 'sahara',
-        require => Package['sahara-common'],
-      }
-      File[$files_to_set_owner] ~> Service<| tag == 'sahara-service' |>
-    }
-
-    class { '::sahara::keystone::authtoken':
-      username             => 'sahara',
-      password             => hiera('CONFIG_SAHARA_KS_PW'),
-      project_name         => 'services',
-      www_authenticate_uri => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url             => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
-    }
-
-    class { '::sahara::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
-    }
-
-    class { '::sahara':
-      database_connection   =>
-        "mysql+pymysql://sahara:${sahara_cfg_sahara_db_pw}@${sahara_cfg_sahara_mariadb_host}/sahara",
-      host                  => hiera('CONFIG_SAHARA_HOST'),
-      rabbit_use_ssl        => hiera('CONFIG_AMQP_SSL_ENABLED'),
-      default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
-      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
-      kombu_ssl_certfile    => $kombu_ssl_certfile,
-    }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/swift.pp b/packstack/puppet/modules/packstack/manifests/swift.pp
index 81b763e7e..f6904a297 100644
--- a/packstack/puppet/modules/packstack/manifests/swift.pp
+++ b/packstack/puppet/modules/packstack/manifests/swift.pp
@@ -2,9 +2,9 @@
 {
     # Class['swift'] -> Service <| |>
 
-    class { '::swift':
+    class { 'swift':
       # not sure how I want to deal with this shared secret
-      swift_hash_path_suffix => hiera('CONFIG_SWIFT_HASH'),
+      swift_hash_path_suffix => lookup('CONFIG_SWIFT_HASH'),
       package_ensure         => latest,
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/swift/ceilometer.pp b/packstack/puppet/modules/packstack/manifests/swift/ceilometer.pp
index d38735f35..fe825d764 100644
--- a/packstack/puppet/modules/packstack/manifests/swift/ceilometer.pp
+++ b/packstack/puppet/modules/packstack/manifests/swift/ceilometer.pp
@@ -1,18 +1,20 @@
 class packstack::swift::ceilometer ()
 {
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    Service<| name == 'rabbitmq-server' |> -> Service['swift-proxy-server']
 
-    class { '::swift::proxy::ceilometer':
-      default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
+    class { 'swift::proxy::ceilometer':
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
       topic                 => 'notifications',
       control_exchange      => 'swift',
       driver                => 'messaging',
       ignore_projects       => ['service'],
-      auth_uri              => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url              => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
-      password              => hiera('CONFIG_SWIFT_KS_PW'),
+      auth_url              => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      password              => lookup('CONFIG_SWIFT_KS_PW'),
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/swift/proxy.pp b/packstack/puppet/modules/packstack/manifests/swift/proxy.pp
index ec24f7f2e..d608c1abe 100644
--- a/packstack/puppet/modules/packstack/manifests/swift/proxy.pp
+++ b/packstack/puppet/modules/packstack/manifests/swift/proxy.pp
@@ -1,105 +1,120 @@
 class packstack::swift::proxy ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_SWIFT_PROXY_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_SWIFT_PROXY_RULES', undef, undef, {}))
     ensure_packages(['curl'], {'ensure' => 'present'})
 
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    include '::packstack::memcached'
+    include packstack::memcached
 
-    if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' and
-       hiera('CONFIG_ENABLE_CEILOMETER_MIDDLEWARE') == 'y' {
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' and
+      lookup('CONFIG_ENABLE_CEILOMETER_MIDDLEWARE') == 'y' {
       $swift_pipeline = [
         'catch_errors',
-        'bulk',
+        'gatekeeper',
         'healthcheck',
+        'proxy-logging',
         'cache',
-        'crossdomain',
+        'listing_formats',
+        'bulk',
+        'tempurl',
         'ratelimit',
+        'crossdomain',
         'authtoken',
         'keystone',
         'formpost',
         'staticweb',
-        'tempurl',
-        'slo',
-        'account_quotas',
+        'copy',
         'container_quotas',
+        'account_quotas',
+        'slo',
+        'dlo',
         'ceilometer',
+        'proxy-logging',
         'proxy-server',
       ]
     } else {
       $swift_pipeline = [
         'catch_errors',
-        'bulk',
+        'gatekeeper',
         'healthcheck',
+        'proxy-logging',
         'cache',
-        'crossdomain',
+        'listing_formats',
+        'bulk',
+        'tempurl',
         'ratelimit',
+        'crossdomain',
         'authtoken',
         'keystone',
         'formpost',
         'staticweb',
-        'tempurl',
-        'slo',
-        'account_quotas',
+        'copy',
         'container_quotas',
+        'account_quotas',
+        'slo',
+        'dlo',
+        'proxy-logging',
         'proxy-server',
       ]
     }
 
-    class { '::swift::proxy':
+    class { 'swift::proxy':
       # swift seems to require ipv6 address without brackets
-      proxy_local_net_ip => hiera('CONFIG_STORAGE_HOST'),
+      proxy_local_net_ip => lookup('CONFIG_STORAGE_HOST'),
       pipeline           => $swift_pipeline,
       account_autocreate => true,
-      workers            => hiera('CONFIG_SERVICE_WORKERS'),
+      workers            => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
     # configure all of the middlewares
     class { [
-      '::swift::proxy::catch_errors',
-      '::swift::proxy::healthcheck',
-      '::swift::proxy::cache',
-      '::swift::proxy::crossdomain',
-      '::swift::proxy::staticweb',
-      '::swift::proxy::tempurl',
-      '::swift::proxy::account_quotas',
-      '::swift::proxy::formpost',
-      '::swift::proxy::slo',
-      '::swift::proxy::container_quotas',
+      'swift::proxy::catch_errors',
+      'swift::proxy::gatekeeper',
+      'swift::proxy::healthcheck',
+      'swift::proxy::proxy_logging',
+      'swift::proxy::listing_formats',
+      'swift::proxy::bulk',
+      'swift::proxy::tempurl',
+      'swift::proxy::ratelimit',
+      'swift::proxy::crossdomain',
+      'swift::proxy::formpost',
+      'swift::proxy::staticweb',
+      'swift::proxy::copy',
+      'swift::proxy::container_quotas',
+      'swift::proxy::account_quotas',
+      'swift::proxy::slo',
+      'swift::proxy::dlo',
     ]: }
 
-    class { '::swift::proxy::bulk':
-      max_containers_per_extraction => 10000,
-      max_failed_extractions        => 1000,
-      max_deletes_per_request       => 10000,
-      yield_frequency               => 60,
+    $memcache_servers = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => ['[::1]:11211'],
+      default => ['127.0.0.1:11211'],
     }
-
-    class { '::swift::proxy::ratelimit':
-      clock_accuracy         => 1000,
-      max_sleep_time_seconds => 60,
-      log_sleep_time_seconds => 0,
-      rate_buffer_seconds    => 5,
-      account_ratelimit      => 0,
+    class {'swift::proxy::cache':
+      memcache_servers => $memcache_servers,
     }
 
-    class { '::swift::proxy::keystone':
-      operator_roles => ['admin', 'SwiftOperator', '_member_'],
+    class { 'swift::proxy::keystone':
+      operator_roles => ['admin', 'SwiftOperator', 'member'],
     }
 
-    class { '::swift::proxy::authtoken':
-      username     => 'swift',
-      project_name => 'services',
-      password     => hiera('CONFIG_SWIFT_KS_PW'),
+    class { 'swift::proxy::authtoken':
+      password             => lookup('CONFIG_SWIFT_KS_PW'),
       # assume that the controller host is the swift api server
-      auth_uri     => hiera('CONFIG_KEYSTONE_PUBLIC_URL'),
-      auth_url     => hiera('CONFIG_KEYSTONE_ADMIN_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
-    class { '::swift::objectexpirer': }
+    class { 'swift::proxy::versioned_writes':
+      allow_versioned_writes => true,
+    }
+
+    class { 'swift::objectexpirer':
+      memcache_servers => $memcache_servers,
+    }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/swift/ringbuilder.pp b/packstack/puppet/modules/packstack/manifests/swift/ringbuilder.pp
index 83eb649de..359fb2061 100644
--- a/packstack/puppet/modules/packstack/manifests/swift/ringbuilder.pp
+++ b/packstack/puppet/modules/packstack/manifests/swift/ringbuilder.pp
@@ -1,15 +1,15 @@
 class packstack::swift::ringbuilder ()
 {
-    class { '::swift::ringbuilder':
+    class { 'swift::ringbuilder':
       part_power     => '18',
-      replicas       => hiera('CONFIG_SWIFT_STORAGE_REPLICAS'),
+      replicas       => lookup('CONFIG_SWIFT_STORAGE_REPLICAS'),
       min_part_hours => 1,
       require        => Class['swift'],
     }
 
     # sets up an rsync db that can be used to sync the ring DB
-    class { '::swift::ringserver':
-      local_net_ip => hiera('CONFIG_STORAGE_HOST_URL'),
+    class { 'swift::ringserver':
+      local_net_ip => lookup('CONFIG_STORAGE_HOST_URL'),
     }
 
     if str2bool($::selinux) {
@@ -19,7 +19,7 @@
       }
     }
 
-    create_resources(ring_account_device, hiera('SWIFT_RING_ACCOUNT_DEVICES', {}))
-    create_resources(ring_object_device, hiera('SWIFT_RING_OBJECT_DEVICES', {}))
-    create_resources(ring_container_device, hiera('SWIFT_RING_CONTAINER_DEVICES', {}))
+    create_resources(ring_account_device, lookup('SWIFT_RING_ACCOUNT_DEVICES', undef, undef, {}))
+    create_resources(ring_object_device, lookup('SWIFT_RING_OBJECT_DEVICES', undef, undef, {}))
+    create_resources(ring_container_device, lookup('SWIFT_RING_CONTAINER_DEVICES', undef, undef, {}))
 }
diff --git a/packstack/puppet/modules/packstack/manifests/swift/storage.pp b/packstack/puppet/modules/packstack/manifests/swift/storage.pp
index 5df5146e7..0bfaec754 100644
--- a/packstack/puppet/modules/packstack/manifests/swift/storage.pp
+++ b/packstack/puppet/modules/packstack/manifests/swift/storage.pp
@@ -1,12 +1,11 @@
 class packstack::swift::storage ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_SWIFT_STORAGE_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_SWIFT_STORAGE_RULES', undef, undef, {}))
 
     # install all swift storage servers together
-    class { '::swift::storage::all':
+    class { 'swift::storage::all':
       # looks like ipv6 address without brackets is required here
-      storage_local_net_ip => hiera('CONFIG_STORAGE_HOST'),
-      allow_versions       => true,
+      storage_local_net_ip => lookup('CONFIG_STORAGE_HOST'),
       require              => Class['swift'],
     }
 
@@ -20,21 +19,21 @@
     }
 
     swift::ringsync{ ['account', 'container', 'object']:
-      ring_server => hiera('CONFIG_STORAGE_HOST_URL'),
+      ring_server => lookup('CONFIG_STORAGE_HOST_URL'),
       before      => Class['swift::storage::all'],
       require     => Class['swift'],
     }
 
-    if hiera('CONFIG_SWIFT_LOOPBACK') == 'y' {
+    if lookup('CONFIG_SWIFT_LOOPBACK') == 'y' {
       swift::storage::loopback { 'swiftloopback':
         base_dir     => '/srv/loopback-device',
         mnt_base_dir => '/srv/node',
         require      => Class['swift'],
-        fstype       => hiera('CONFIG_SWIFT_STORAGE_FSTYPE'),
-        seek         => hiera('CONFIG_SWIFT_STORAGE_SEEK'),
+        fstype       => lookup('CONFIG_SWIFT_STORAGE_FSTYPE'),
+        seek         => lookup('CONFIG_SWIFT_STORAGE_SEEK'),
       }
     }
     else {
-        create_resources(packstack::swift::fs, hiera('CONFIG_SWIFT_STORAGE_DEVICES', {}))
+        create_resources(packstack::swift::fs, lookup('CONFIG_SWIFT_STORAGE_DEVICES', undef, undef, {}))
     }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/trove.pp b/packstack/puppet/modules/packstack/manifests/trove.pp
index c352d7372..c94b4972c 100644
--- a/packstack/puppet/modules/packstack/manifests/trove.pp
+++ b/packstack/puppet/modules/packstack/manifests/trove.pp
@@ -1,39 +1,43 @@
 class packstack::trove ()
 {
-    create_resources(packstack::firewall, hiera('FIREWALL_TROVE_API_RULES', {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_TROVE_API_RULES', undef, undef, {}))
 
-    $bind_host = hiera('CONFIG_IP_VERSION') ? {
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
       'ipv6'  => '::0',
       default => '0.0.0.0',
       # TO-DO(mmagr): Add IPv6 support when hostnames are used
     }
 
-    class { '::trove::keystone::authtoken':
-      password => hiera('CONFIG_TROVE_KS_PW'),
-      auth_url => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+    class { 'trove::keystone::authtoken':
+      password             => lookup('CONFIG_TROVE_KS_PW'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
     }
 
-    class { '::trove::logging':
-      debug => hiera('CONFIG_DEBUG_MODE'),
+    class { 'trove::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
     }
 
-    class { '::trove::api':
+    class { 'trove::service_credentials':
+      password => lookup('CONFIG_TROVE_KS_PW'),
+      auth_url => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+    }
+
+    class { 'trove::api':
+      service_name => 'httpd',
+    }
+    class { 'trove::wsgi::apache':
       bind_host => $bind_host,
-      enabled   => true,
-      cert_file => false,
-      key_file  => false,
-      ca_file   => false,
-      workers   => hiera('CONFIG_SERVICE_WORKERS'),
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
-    class { '::trove::conductor':
-      auth_url => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      debug    => hiera('CONFIG_DEBUG_MODE'),
-      workers  => hiera('CONFIG_SERVICE_WORKERS'),
+    class { 'trove::conductor':
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
     }
 
-    class { '::trove::taskmanager':
-      auth_url => hiera('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
-      debug    => hiera('CONFIG_DEBUG_MODE'),
+    class { 'trove::guestagent::service_credentials':
+      password => lookup('CONFIG_TROVE_KS_PW'),
+      auth_url => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
     }
+    class { 'trove::taskmanager': }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/trove/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/trove/rabbitmq.pp
index 5b812a790..7b491d43e 100644
--- a/packstack/puppet/modules/packstack/manifests/trove/rabbitmq.pp
+++ b/packstack/puppet/modules/packstack/manifests/trove/rabbitmq.pp
@@ -1,42 +1,40 @@
 class packstack::trove::rabbitmq ()
 {
-    $trove_rabmq_cfg_trove_db_pw = hiera('CONFIG_TROVE_DB_PW')
-    $trove_rabmq_cfg_mariadb_host = hiera('CONFIG_MARIADB_HOST_URL')
-    $trove_rabmq_cfg_controller_host = hiera('CONFIG_KEYSTONE_HOST_URL')
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_TROVE_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_TROVE_SSL_CERT', undef, undef, undef)
 
-    $kombu_ssl_ca_certs = hiera('CONFIG_AMQP_SSL_CACERT_FILE', undef)
-    $kombu_ssl_keyfile = hiera('CONFIG_TROVE_SSL_KEY', undef)
-    $kombu_ssl_certfile = hiera('CONFIG_TROVE_SSL_CERT', undef)
-
-    $rabbit_host = hiera('CONFIG_AMQP_HOST_URL')
-    $rabbit_port = hiera('CONFIG_AMQP_CLIENTS_PORT')
-    $rabbit_userid = hiera('CONFIG_AMQP_AUTH_USER')
-    $rabbit_password = hiera('CONFIG_AMQP_AUTH_PASSWORD')
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
 
     if $kombu_ssl_keyfile {
       $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
       file { $files_to_set_owner:
-        owner   => 'trove',
-        group   => 'trove',
+        owner => 'trove',
+        group => 'trove',
       }
       Package<|tag=='trove'|> -> File[$files_to_set_owner]
       File[$files_to_set_owner] ~> Service<| tag == 'trove-service' |>
     }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'trove-service' |>
 
+    class { 'trove::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'trove',
+        'password' => lookup('CONFIG_TROVE_DB_PW'),
+        'database' => 'trove',
+      })
+    }
 
-    class { '::trove':
-      rabbit_use_ssl               => hiera('CONFIG_AMQP_SSL_ENABLED'),
-      default_transport_url        => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
-      database_connection          => "mysql+pymysql://trove:${trove_rabmq_cfg_trove_db_pw}@${trove_rabmq_cfg_mariadb_host}/trove",
-      nova_proxy_admin_user        => hiera('CONFIG_TROVE_NOVA_USER'),
-      nova_proxy_admin_tenant_name => hiera('CONFIG_TROVE_NOVA_TENANT'),
-      nova_proxy_admin_pass        => hiera('CONFIG_TROVE_NOVA_PW'),
-      nova_compute_url             => "http://${trove_rabmq_cfg_controller_host}:8774/v2",
-      cinder_url                   => "http://${trove_rabmq_cfg_controller_host}:8776/v1",
-      swift_url                    => "http://${trove_rabmq_cfg_controller_host}:8080/v1/AUTH_",
-      use_neutron                  => hiera('CONFIG_NEUTRON_INSTALL'),
-      kombu_ssl_ca_certs           => $kombu_ssl_ca_certs,
-      kombu_ssl_keyfile            => $kombu_ssl_keyfile,
-      kombu_ssl_certfile           => $kombu_ssl_certfile,
+    class { 'trove':
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
     }
 }
diff --git a/packstack/puppet/modules/packstack/templates/ssl/generate_ssl_certs.sh.erb b/packstack/puppet/modules/packstack/templates/ssl/generate_ssl_certs.sh.erb
old mode 100755
new mode 100644
index ff0656fdb..675b97656
--- a/packstack/puppet/modules/packstack/templates/ssl/generate_ssl_certs.sh.erb
+++ b/packstack/puppet/modules/packstack/templates/ssl/generate_ssl_certs.sh.erb
@@ -1,4 +1,4 @@
-#!/bin/env bash
+#!/usr/bin/env bash
 
 FQDN=`hostname`
 if [ "x${FQDN}" = "x" ]; then
diff --git a/packstack/puppet/templates/compute.pp b/packstack/puppet/templates/compute.pp
index 5d408e5ae..9f487c7b4 100644
--- a/packstack/puppet/templates/compute.pp
+++ b/packstack/puppet/templates/compute.pp
@@ -1,62 +1,60 @@
 stage { "init": before  => Stage["main"] }
 
-Exec { timeout => hiera('DEFAULT_EXEC_TIMEOUT') }
+Exec { timeout => lookup('DEFAULT_EXEC_TIMEOUT') }
 Package { allow_virtual => true }
 
-class {'::packstack::prereqs':
+class { 'packstack::prereqs':
   stage => init,
 }
 
-include ::firewall
+include firewall
 
-create_resources(sshkey, hiera('SSH_KEYS', {}))
+create_resources(sshkey, lookup('SSH_KEYS', undef, undef, {}))
 
-if hiera('CONFIG_NTP_SERVERS', '') != '' {
-  include '::packstack::chrony'
+if lookup('CONFIG_NTP_SERVERS', undef, undef, '') != '' {
+  include 'packstack::chrony'
 }
 
-if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
-  include '::packstack::nova::ceilometer::rabbitmq'
-  include '::packstack::nova::ceilometer'
+if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+  include 'packstack::nova::ceilometer::rabbitmq'
+  include 'packstack::nova::ceilometer'
 }
 
-include '::packstack::nova'
-include '::packstack::nova::common'
-include '::packstack::nova::compute'
+include 'packstack::nova'
+include 'packstack::nova::common'
+include 'packstack::nova::compute'
 
-if hiera('CONFIG_VMWARE_BACKEND') == 'y' {
-  include '::packstack::nova::compute::vmware'
-} elsif hiera('CONFIG_IRONIC_INSTALL') == 'y' {
-  include '::packstack::nova::compute::ironic'
+if lookup('CONFIG_VMWARE_BACKEND') == 'y' {
+  include 'packstack::nova::compute::vmware'
+} elsif lookup('CONFIG_IRONIC_INSTALL') == 'y' {
+  include 'packstack::nova::compute::ironic'
 } else {
-  include '::packstack::nova::compute::libvirt'
+  include 'packstack::nova::compute::libvirt'
 }
 
-if hiera('CONFIG_CINDER_INSTALL') == 'y' and
-   hiera('CONFIG_VMWARE_BACKEND') != 'y' {
-   if 'gluster' in hiera_array('CONFIG_CINDER_BACKEND') {
-    include '::packstack::nova::gluster'
-   }
-   if 'nfs' in hiera_array('CONFIG_CINDER_BACKEND') {
-    include '::packstack::nova::nfs'
+if lookup('CONFIG_CINDER_INSTALL') == 'y' {
+  include 'openstacklib::iscsid'
+}
+
+if lookup('CONFIG_CINDER_INSTALL') == 'y' and
+   lookup('CONFIG_VMWARE_BACKEND') != 'y' {
+   if 'nfs' in lookup('CONFIG_CINDER_BACKEND', { merge => 'unique' }) {
+    include 'packstack::nova::nfs'
    }
 }
 
-if hiera('CONFIG_NEUTRON_INSTALL') == 'y' {
-  include '::packstack::nova::neutron'
-  include '::packstack::neutron::rabbitmq'
-  case hiera('CONFIG_NEUTRON_L2_AGENT') {
-    'openvswitch': { include '::packstack::neutron::ovs_agent' }
-    'linuxbridge': { include '::packstack::neutron::lb_agent' }
-    'ovn':         { include '::packstack::neutron::ovn_agent'
-                     include '::packstack::neutron::ovn_metadata'
-                   }
-    default:       { include '::packstack::neutron::ovs_agent' }
-  }
-  include '::packstack::neutron::bridge'
-
-  if 'sriovnicswitch' in hiera_array('CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS') and
-     hiera ('CONFIG_NEUTRON_L2_AGENT') == 'openvswitch' {
-    include '::packstack::neutron::sriov'
-  }
+include 'packstack::nova::neutron'
+include 'packstack::neutron::rabbitmq'
+case lookup('CONFIG_NEUTRON_L2_AGENT') {
+  'openvswitch': { include 'packstack::neutron::ovs_agent' }
+  'ovn':         { include 'packstack::neutron::ovn_agent'
+                   include 'packstack::neutron::ovn_metadata'
+                 }
+  default:       { include 'packstack::neutron::ovs_agent' }
+}
+include 'packstack::neutron::bridge'
+
+if 'sriovnicswitch' in lookup('CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS', { merge => 'unique' }) and
+   lookup('CONFIG_NEUTRON_L2_AGENT') == 'openvswitch' {
+  include 'packstack::neutron::sriov'
 }
diff --git a/packstack/puppet/templates/controller.pp b/packstack/puppet/templates/controller.pp
index 393d36780..79c731216 100644
--- a/packstack/puppet/templates/controller.pp
+++ b/packstack/puppet/templates/controller.pp
@@ -1,208 +1,188 @@
 stage { "init": before  => Stage["main"] }
 
-Exec { timeout => hiera('DEFAULT_EXEC_TIMEOUT') }
+Exec { timeout => lookup('DEFAULT_EXEC_TIMEOUT') }
 Package { allow_virtual => true }
 
-class {'::packstack::prereqs':
+class { 'packstack::prereqs':
   stage => init,
 }
 
-include ::firewall
+include firewall
 
-if hiera('CONFIG_NTP_SERVERS', '') != '' {
-  include '::packstack::chrony'
+if lookup('CONFIG_NTP_SERVERS', undef, undef, '') != '' {
+  include 'packstack::chrony'
 }
 
-include '::packstack::amqp'
-include '::packstack::mariadb'
+include 'packstack::amqp'
+include 'packstack::mariadb'
 
-if hiera('CONFIG_MARIADB_INSTALL') == 'y' {
+if lookup('CONFIG_MARIADB_INSTALL') == 'y' {
   include 'packstack::mariadb::services'
 } else {
   include 'packstack::mariadb::services_remote'
 }
 
-include '::packstack::apache'
-include '::packstack::keystone'
+include 'packstack::apache'
+include 'packstack::keystone'
 
-if hiera('CONFIG_GLANCE_INSTALL') == 'y' {
-  include '::packstack::keystone::glance'
-  include '::packstack::glance'
-  if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
-    include '::packstack::glance::ceilometer'
+if lookup('CONFIG_GLANCE_INSTALL') == 'y' {
+  include 'packstack::keystone::glance'
+  include 'packstack::glance'
+  if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+    include 'packstack::glance::ceilometer'
   }
-  if hiera('CONFIG_GLANCE_BACKEND') == 'swift' {
-    include '::packstack::glance::backend::swift'
+  if lookup('CONFIG_GLANCE_BACKEND') == 'swift' {
+    include 'packstack::glance::backend::swift'
   } else {
-    include '::packstack::glance::backend::file'
+    include 'packstack::glance::backend::file'
   }
 }
 
-if hiera('CONFIG_CINDER_INSTALL') == 'y' {
-  include '::packstack::keystone::cinder'
-  include '::packstack::cinder::rabbitmq'
-  include '::packstack::cinder'
-  if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
-    include '::packstack::cinder::ceilometer'
-  }
-  if hiera('CONFIG_SWIFT_INSTALL') == 'y' {
-    include '::packstack::cinder::backup'
+if lookup('CONFIG_CINDER_INSTALL') == 'y' {
+  include 'openstacklib::iscsid'
+  include 'packstack::keystone::cinder'
+  include 'packstack::cinder::rabbitmq'
+  include 'packstack::cinder'
+  if lookup('CONFIG_SWIFT_INSTALL') == 'y' {
+    include 'packstack::cinder::backup'
   }
 
-  $cinder_backends = hiera_array('CONFIG_CINDER_BACKEND')
+  $cinder_backends = lookup('CONFIG_CINDER_BACKEND', { merge => 'unique' })
 
   case $cinder_backends[0] {
-    'lvm':       { include '::packstack::cinder::backend::lvm' }
-    'gluster':   { include '::packstack::cinder::backend::gluster' }
-    'nfs':       { include '::packstack::cinder::backend::nfs' }
-    'vmdk':      { include '::packstack::cinder::backend::vmdk' }
-    'netapp':    { include '::packstack::cinder::backend::netapp' }
-    'solidfire': { include '::packstack::cinder::backend::solidfire' }
-    default:     { include '::packstack::cinder::backend::lvm' }
+    'lvm':       { include 'packstack::cinder::backend::lvm' }
+    'nfs':       { include 'packstack::cinder::backend::nfs' }
+    'netapp':    { include 'packstack::cinder::backend::netapp' }
+    'solidfire': { include 'packstack::cinder::backend::solidfire' }
+    default:     { include 'packstack::cinder::backend::lvm' }
   }
 }
 
-if hiera('CONFIG_IRONIC_INSTALL') == 'y' {
-  include '::packstack::keystone::ironic'
-  include '::packstack::ironic'
-  include '::packstack::ironic::rabbitmq'
+if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
+  include 'packstack::keystone::ironic'
+  include 'packstack::ironic'
+  include 'packstack::ironic::rabbitmq'
 }
 
-if hiera('CONFIG_NOVA_INSTALL') == 'y' {
-  include '::packstack::keystone::nova'
-  include '::packstack::nova'
-  include '::packstack::nova::common'
-  include '::packstack::nova::api'
-  include '::packstack::nova::conductor'
-  if hiera('CONFIG_IRONIC_INSTALL') == 'y' {
-    include '::packstack::nova::sched::ironic'
+if lookup('CONFIG_NOVA_INSTALL') == 'y' {
+  include 'packstack::keystone::nova'
+  include 'packstack::nova'
+  include 'packstack::nova::common'
+  include 'packstack::nova::api'
+  include 'packstack::nova::conductor'
+  if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
+    include 'packstack::nova::sched::ironic'
   } else {
-    include '::packstack::nova::sched'
-  }
-  include '::packstack::nova::vncproxy'
-  if hiera('CONFIG_NEUTRON_INSTALL') == 'y' {
-    include '::packstack::nova::neutron'
+    include 'packstack::nova::sched'
   }
-  include '::packstack::placement'
+  include 'packstack::nova::vncproxy'
+  include 'packstack::nova::neutron'
+  include 'packstack::placement'
 }
 
-if hiera('CONFIG_NEUTRON_INSTALL') == 'y' {
-  include '::packstack::keystone::neutron'
-  include '::packstack::neutron::rabbitmq'
-  include '::packstack::neutron::api'
-  if hiera('CONFIG_NOVA_INSTALL') == 'y' {
-    include '::packstack::neutron::notifications'
+if lookup('CONFIG_NEUTRON_INSTALL') == 'y' {
+  include 'packstack::keystone::neutron'
+  include 'packstack::neutron::rabbitmq'
+  include 'packstack::neutron::api'
+  if lookup('CONFIG_NOVA_INSTALL') == 'y' {
+    include 'packstack::neutron::notifications'
   }
-  include '::packstack::neutron::ml2'
-  if hiera('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
-    include '::packstack::neutron::ovn_northd'
+  include 'packstack::neutron::ml2'
+  if lookup('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
+    include 'packstack::neutron::ovn_northd'
   }
 }
 
-if hiera('CONFIG_MANILA_INSTALL') == 'y' {
-  include '::packstack::keystone::manila'
-  include '::packstack::manila'
-  include '::packstack::manila::rabbitmq'
-  if 'generic' in hiera_array('CONFIG_MANILA_BACKEND') {
-    include '::packstack::manila::backend::generic'
+if lookup('CONFIG_MANILA_INSTALL') == 'y' {
+  include 'packstack::keystone::manila'
+  include 'packstack::manila'
+  include 'packstack::manila::rabbitmq'
+  if 'generic' in lookup('CONFIG_MANILA_BACKEND', { merge => 'unique' }) {
+    include 'packstack::manila::backend::generic'
   }
-  if 'netapp' in hiera_array('CONFIG_MANILA_BACKEND') {
-    include '::packstack::manila::backend::netapp'
+  if 'netapp' in lookup('CONFIG_MANILA_BACKEND', { merge => 'unique' }) {
+    include 'packstack::manila::backend::netapp'
   }
-  if 'glusternative' in hiera_array('CONFIG_MANILA_BACKEND') {
-    include '::packstack::manila::backend::glusternative'
+  if 'glusternative' in lookup('CONFIG_MANILA_BACKEND', { merge => 'unique' }) {
+    include 'packstack::manila::backend::glusternative'
   }
-  if 'glusternfs' in hiera_array('CONFIG_MANILA_BACKEND') {
-    include '::packstack::manila::backend::glusternfs'
+  if 'glusternfs' in lookup('CONFIG_MANILA_BACKEND', { merge => 'unique' }) {
+    include 'packstack::manila::backend::glusternfs'
   }
 }
 
-include '::packstack::openstackclient'
+include 'packstack::openstackclient'
 
-if hiera('CONFIG_HORIZON_INSTALL') == 'y' {
-  include '::packstack::horizon'
+if lookup('CONFIG_HORIZON_INSTALL') == 'y' {
+  include 'packstack::horizon'
 }
 
-if hiera('CONFIG_SWIFT_INSTALL') == 'y' {
-  include '::packstack::keystone::swift'
-  include '::packstack::swift'
-  include '::packstack::swift::ringbuilder'
-  include '::packstack::swift::proxy'
-  include '::packstack::swift::storage'
-  if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' and
-     hiera('CONFIG_ENABLE_CEILOMETER_MIDDLEWARE') == 'y' {
-    include '::packstack::swift::ceilometer'
+if lookup('CONFIG_SWIFT_INSTALL') == 'y' {
+  include 'packstack::keystone::swift'
+  include 'packstack::swift'
+  include 'packstack::swift::ringbuilder'
+  include 'packstack::swift::proxy'
+  include 'packstack::swift::storage'
+  if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' and
+     lookup('CONFIG_ENABLE_CEILOMETER_MIDDLEWARE') == 'y' {
+    include 'packstack::swift::ceilometer'
   }
 }
 
-if hiera('CONFIG_HEAT_INSTALL') == 'y' {
-  include '::packstack::keystone::heat'
-  include '::packstack::heat::rabbitmq'
-  include '::packstack::heat'
-  if hiera('CONFIG_HEAT_CFN_INSTALL') == 'y' {
-    include '::packstack::heat::cfn'
+if lookup('CONFIG_HEAT_INSTALL') == 'y' {
+  include 'packstack::keystone::heat'
+  include 'packstack::heat::rabbitmq'
+  include 'packstack::heat'
+  if lookup('CONFIG_HEAT_CFN_INSTALL') == 'y' {
+    include 'packstack::heat::cfn'
   }
 }
 
-if hiera('CONFIG_MAGNUM_INSTALL') == 'y' {
-  include '::packstack::keystone::magnum'
-  include '::packstack::magnum'
-  include '::packstack::magnum::rabbitmq'
+if lookup('CONFIG_MAGNUM_INSTALL') == 'y' {
+  include 'packstack::keystone::magnum'
+  include 'packstack::magnum'
+  include 'packstack::magnum::rabbitmq'
 }
 
-if hiera('CONFIG_PROVISION_DEMO') == 'y' or hiera('CONFIG_PROVISION_TEMPEST') == 'y' {
-  include '::packstack::provision'
-  if hiera('CONFIG_GLANCE_INSTALL') == 'y' {
-    include '::packstack::provision::glance'
+if lookup('CONFIG_PROVISION_DEMO') == 'y' or lookup('CONFIG_PROVISION_TEMPEST') == 'y' {
+  include 'packstack::provision'
+  if lookup('CONFIG_GLANCE_INSTALL') == 'y' {
+    include 'packstack::provision::glance'
   }
 }
 
-if hiera('CONFIG_PROVISION_TEMPEST') == 'y' {
-  include '::packstack::provision::tempest'
+if lookup('CONFIG_PROVISION_TEMPEST') == 'y' {
+  include 'packstack::provision::tempest'
 }
 
 
-if hiera('CONFIG_PROVISION_TEMPEST') == 'y' {
-  include '::packstack::provision::tempest'
+if lookup('CONFIG_PROVISION_TEMPEST') == 'y' {
+  include 'packstack::provision::tempest'
 }
 
 
-if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' and hiera('CONFIG_PANKO_INSTALL') == 'y' {
-  include '::packstack::keystone::panko'
-  include '::packstack::panko'
-}
-
-if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
+if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
   # setup gnocchi
-  include '::packstack::keystone::gnocchi'
-  include '::packstack::gnocchi'
+  include 'packstack::keystone::gnocchi'
+  include 'packstack::gnocchi'
   # setup ceilometer
-  include '::packstack::keystone::ceilometer'
-  include '::packstack::ceilometer::rabbitmq'
-  include '::packstack::ceilometer'
-  if hiera('CONFIG_NOVA_INSTALL') == 'n' {
-    include '::packstack::ceilometer::nova_disabled'
+  include 'packstack::keystone::ceilometer'
+  include 'packstack::ceilometer::rabbitmq'
+  include 'packstack::ceilometer'
+  if lookup('CONFIG_NOVA_INSTALL') == 'n' {
+    include 'packstack::ceilometer::nova_disabled'
   }
-  include '::packstack::redis'
+  include 'packstack::redis'
 }
 
-if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' and hiera('CONFIG_AODH_INSTALL') == 'y' {
-  include '::packstack::keystone::aodh'
-  include '::packstack::aodh::rabbitmq'
-  include '::packstack::aodh'
+if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' and lookup('CONFIG_AODH_INSTALL') == 'y' {
+  include 'packstack::keystone::aodh'
+  include 'packstack::aodh::rabbitmq'
+  include 'packstack::aodh'
 }
 
-if hiera('CONFIG_TROVE_INSTALL') == 'y' {
-  include '::packstack::keystone::trove'
-  include '::packstack::trove::rabbitmq'
-  include '::packstack::trove'
-}
-
-if hiera('CONFIG_SAHARA_INSTALL') == 'y' {
-  include '::packstack::keystone::sahara'
-  include '::packstack::sahara::rabbitmq'
-  include '::packstack::sahara'
-  if hiera('CONFIG_CEILOMETER_INSTALL') == 'y' {
-    include '::packstack::sahara::ceilometer'
-  }
+if lookup('CONFIG_TROVE_INSTALL') == 'y' {
+  include 'packstack::keystone::trove'
+  include 'packstack::trove::rabbitmq'
+  include 'packstack::trove'
 }
diff --git a/packstack/puppet/templates/controller_post.pp b/packstack/puppet/templates/controller_post.pp
new file mode 100644
index 000000000..9e5710177
--- /dev/null
+++ b/packstack/puppet/templates/controller_post.pp
@@ -0,0 +1,14 @@
+stage { "init": before  => Stage["main"] }
+
+Exec { timeout => lookup('DEFAULT_EXEC_TIMEOUT') }
+Package { allow_virtual => true }
+
+class { 'packstack::prereqs':
+  stage => init,
+}
+
+include nova::cell_v2::discover_hosts
+
+notify {'Discovering compute nodes': } ~> Class['nova::cell_v2::discover_hosts']
+
+
diff --git a/packstack/puppet/templates/network.pp b/packstack/puppet/templates/network.pp
index c23c6f505..6270de0e0 100644
--- a/packstack/puppet/templates/network.pp
+++ b/packstack/puppet/templates/network.pp
@@ -1,49 +1,45 @@
 stage { "init": before  => Stage["main"] }
 
-Exec { timeout => hiera('DEFAULT_EXEC_TIMEOUT') }
+Exec { timeout => lookup('DEFAULT_EXEC_TIMEOUT') }
 Package { allow_virtual => true }
 
-class {'::packstack::prereqs':
+class { 'packstack::prereqs':
   stage => init,
 }
 
-include ::firewall
+include firewall
 
-if hiera('CONFIG_NTP_SERVERS', '') != '' {
-  include '::packstack::chrony'
+if lookup('CONFIG_NTP_SERVERS', undef, undef, '') != '' {
+  include 'packstack::chrony'
 }
 
-if hiera('CONFIG_NEUTRON_INSTALL') == 'y' {
-  include '::packstack::neutron::rabbitmq'
+if lookup('CONFIG_NEUTRON_INSTALL') == 'y' {
+  include 'packstack::neutron::rabbitmq'
 
-  if hiera('CONFIG_NEUTRON_VPNAAS') == 'y' {
-    include '::packstack::neutron::vpnaas'
+  if lookup('CONFIG_NEUTRON_VPNAAS') == 'y' {
+    include 'packstack::neutron::vpnaas'
   }
-  if hiera('CONFIG_NEUTRON_FWAAS') == 'y' {
-    include '::packstack::neutron::fwaas'
+  if lookup('CONFIG_NEUTRON_L2_AGENT') != 'ovn' {
+    include 'packstack::neutron::l3'
   }
-  if hiera('CONFIG_NEUTRON_L2_AGENT') != 'ovn' {
-    include '::packstack::neutron::l3'
-  }
-  if hiera('CONFIG_NEUTRON_OVS_BRIDGE_CREATE') == 'y' {
-    include '::packstack::neutron::ovs_bridge'
+  if lookup('CONFIG_NEUTRON_OVS_BRIDGE_CREATE') == 'y' {
+    include 'packstack::neutron::ovs_bridge'
   }
 
-  case hiera('CONFIG_NEUTRON_L2_AGENT') {
-    'openvswitch': { include '::packstack::neutron::ovs_agent' }
-    'linuxbridge': { include '::packstack::neutron::lb_agent' }
-    'ovn':         { include '::packstack::neutron::ovn_agent' }
-    default:       { include '::packstack::neutron::ovs_agent' }
+  case lookup('CONFIG_NEUTRON_L2_AGENT') {
+    'openvswitch': { include 'packstack::neutron::ovs_agent' }
+    'ovn':         { include 'packstack::neutron::ovn_agent' }
+    default:       { include 'packstack::neutron::ovs_agent' }
   }
-  include '::packstack::neutron::bridge'
-  if hiera('CONFIG_NEUTRON_L2_AGENT') != 'ovn' {
-    include '::packstack::neutron::dhcp'
-    include '::packstack::neutron::metadata'
+  include 'packstack::neutron::bridge'
+  if lookup('CONFIG_NEUTRON_L2_AGENT') != 'ovn' {
+    include 'packstack::neutron::dhcp'
+    include 'packstack::neutron::metadata'
   }
-  if hiera('CONFIG_NEUTRON_METERING_AGENT_INSTALL') == 'y' {
-    include '::packstack::neutron::metering'
+  if lookup('CONFIG_NEUTRON_METERING_AGENT_INSTALL') == 'y' {
+    include 'packstack::neutron::metering'
   }
-  if hiera('CONFIG_PROVISION_DEMO') == 'y' or hiera('CONFIG_PROVISION_TEMPEST') == 'y' {
-    include '::packstack::provision::bridge'
+  if lookup('CONFIG_PROVISION_DEMO') == 'y' or lookup('CONFIG_PROVISION_TEMPEST') == 'y' {
+    include 'packstack::provision::bridge'
   }
 }
diff --git a/packstack/version.py b/packstack/version.py
index f77344993..5f4378191 100644
--- a/packstack/version.py
+++ b/packstack/version.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
diff --git a/playbooks/packstack-centos8-pre.yaml b/playbooks/packstack-centos8-pre.yaml
deleted file mode 100644
index 11645891a..000000000
--- a/playbooks/packstack-centos8-pre.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-- hosts: all
-  name: packstack-centos8-pre
-  tasks:
-    - name: Ensure legacy workspace directory
-      file:
-        path: '{{ ansible_user_dir }}/workspace'
-        state: directory
-
-    - shell:
-        cmd: |
-          cp -pr /home/zuul/src/opendev.org/x/packstack {{ ansible_user_dir }}/workspace
-
-    - shell:
-        cmd: |
-          set -e
-          set -x
-          rm -rf /etc/yum.repos.d/delorean*
-          dnf clean all
-          sudo sed -i '/^exclude.*/d' /etc/dnf/dnf.conf
-          dnf -y install libxml2-devel libxslt-devel ruby-devel zlib-devel
-          dnf -y install gcc gettext diffstat doxygen patch patchutils subversion systemtap git python3-setuptools wget redhat-lsb-core python3-libselinux virt-what yum
-          pip uninstall requests -y || true
-        executable: /bin/bash
-        chdir: '{{ ansible_user_dir }}/workspace'
-      become: true
-      environment: '{{ zuul }}'
diff --git a/playbooks/packstack-centos9-pre.yaml b/playbooks/packstack-centos9-pre.yaml
new file mode 100644
index 000000000..9a9b12798
--- /dev/null
+++ b/playbooks/packstack-centos9-pre.yaml
@@ -0,0 +1,36 @@
+- hosts: all
+  name: packstack-centos9-pre
+  tasks:
+    - name: Ensure legacy workspace directory
+      file:
+        path: '{{ ansible_user_dir }}/workspace'
+        state: directory
+
+    - shell:
+        cmd: |
+          cp -pr {{ ansible_user_dir }}/src/opendev.org/x/packstack {{ ansible_user_dir }}/workspace
+
+    - shell:
+        cmd: |
+          set -e
+          set -x
+          rm -rf /etc/yum.repos.d/delorean*
+          # Remove epel repos
+          rm -rf /etc/yum.repos.d/epel*
+          dnf clean all
+          sudo sed -i '/^exclude.*/d' /etc/dnf/dnf.conf
+          dnf -y install dnf-plugins-core
+          dnf config-manager --set-enabled crb
+          dnf -y install libxml2-devel libxslt-devel ruby-devel zlib-devel
+          dnf -y install gcc gettext diffstat doxygen patch patchutils subversion systemtap git python3-setuptools wget python3-libselinux virt-what yum
+        executable: /bin/bash
+        chdir: '{{ ansible_user_dir }}/workspace'
+      become: true
+      environment: '{{ zuul }}'
+
+    # mariadb-10.11 is broken https://issues.redhat.com/browse/RDO-241
+    - name: Temporary disable mariadb module
+      shell: "sudo dnf module disable -y mariadb"
+      when: ansible_distribution == "CentOS" and ansible_distribution_major_version == "9"
+      become: true
+      changed_when: False
diff --git a/playbooks/packstack-multinode.yaml b/playbooks/packstack-multinode.yaml
index 3f8cad1a0..e7d6166a6 100644
--- a/playbooks/packstack-multinode.yaml
+++ b/playbooks/packstack-multinode.yaml
@@ -32,7 +32,7 @@
       when: not selinux_enforcing|default("true")|bool
 
 - hosts: controller
-  name: packstack-multinode
+  name: packstack-ssh-preparation-1
   tasks:
     - name: Generate SSH key on controller
       shell: ssh-keygen -t rsa -f /root/.ssh/id_rsa -P ""
@@ -45,21 +45,30 @@
       become: true
       register: ssh_key
 
-    - name: Deploy SSH key on compute node
+    - name: Deploy SSH key on controller
       authorized_key:
         user: root
         state: present
         key: "{{ ssh_key.stdout }}"
-      delegate_to: "{{ hostvars['compute'].ansible_host }}"
       become: true
 
-    - name: Deploy SSH key on controller
+    - name: Set SSH key fact to be used by the compute node
+      set_fact:
+        sshkey: "{{ ssh_key.stdout }}"
+
+- hosts: compute
+  name: packstack-ssh-preparation-2
+  tasks:
+    - name: Deploy SSH key on compute node
       authorized_key:
         user: root
         state: present
-        key: "{{ ssh_key.stdout }}"
+        key: "{{ hostvars['controller'].sshkey }}"
       become: true
 
+- hosts: controller
+  name: packstack-multinode
+  tasks:
     - name: Run Packstack
       shell:
         cmd: |
diff --git a/playbooks/packstack-post-compute.yaml b/playbooks/packstack-post-compute.yaml
index 6f1e46ec0..a52c33371 100644
--- a/playbooks/packstack-post-compute.yaml
+++ b/playbooks/packstack-post-compute.yaml
@@ -13,7 +13,7 @@
 
     - shell:
         cmd: |
-          source /home/zuul/src/opendev.org/x/packstack/tools/copy-logs.sh
+          source {{ ansible_user_dir }}/src/opendev.org/x/packstack/tools/copy-logs.sh
           recover_default_logs
           mv /tmp/logs/* /tmp/compute
           mv /tmp/compute /tmp/logs
diff --git a/releasenotes/notes/Panko-has-been-removed-fb234a047231d84f.yaml b/releasenotes/notes/Panko-has-been-removed-fb234a047231d84f.yaml
new file mode 100644
index 000000000..117c74b1e
--- /dev/null
+++ b/releasenotes/notes/Panko-has-been-removed-fb234a047231d84f.yaml
@@ -0,0 +1,10 @@
+---
+other:
+  - |
+    Service panko has been removed in OpenStack project
+    in Xena. Packstack has removed support to deploying
+    this service, what implies some changes:
+
+      * CONFIG_PANKO_INSTALL option has been removed.
+      * CONFIG_PANKO_DB_PW option has been removed.
+      * CONFIG_PANKO_KS_PW option has been removed.
diff --git a/releasenotes/notes/Remove-FWaaS-deployment-41cfa0b709cd9a3f.yaml b/releasenotes/notes/Remove-FWaaS-deployment-41cfa0b709cd9a3f.yaml
new file mode 100644
index 000000000..4cbc53edc
--- /dev/null
+++ b/releasenotes/notes/Remove-FWaaS-deployment-41cfa0b709cd9a3f.yaml
@@ -0,0 +1,7 @@
+---
+prelude: >
+    Neutron FWaaS has been removed in Victoria release.
+other:
+  - |
+    Packstack does not longer support deployment of Neutron FWaaS extension as it
+    has been removed upstream. Option CONFIG_NEUTRON_FWAAS has been removed.
diff --git a/releasenotes/notes/Remove-deprecated-keystone-ldap-params-848d0eaf7a24273e.yaml b/releasenotes/notes/Remove-deprecated-keystone-ldap-params-848d0eaf7a24273e.yaml
new file mode 100644
index 000000000..d4d7f5ac3
--- /dev/null
+++ b/releasenotes/notes/Remove-deprecated-keystone-ldap-params-848d0eaf7a24273e.yaml
@@ -0,0 +1,8 @@
+---
+deprecations:
+  - |
+    The CONFIG_KEYSTONE_LDAP_USER_ALLOW_* and
+    CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_* parameters have been removed from the
+    answer file. Their corresponding options were removed from Keystone long
+    ago, and they are no longer valid in puppet-keystone since the Rocky
+    release.
diff --git a/releasenotes/notes/add-skip-tempest-tests-option-86cf59ec5a61d349.yaml b/releasenotes/notes/add-skip-tempest-tests-option-86cf59ec5a61d349.yaml
new file mode 100644
index 000000000..0bf75aaaa
--- /dev/null
+++ b/releasenotes/notes/add-skip-tempest-tests-option-86cf59ec5a61d349.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - |
+    Add new config option "CONFIG_SKIP_TEMPEST_TESTS" to allow
+    skipping of some of tempest tests which are running as part
+    of "CONFIG_RUN_TEMPEST_TESTS".
diff --git a/releasenotes/notes/remove-cinder-gluster-6c54d9f440424259.yaml b/releasenotes/notes/remove-cinder-gluster-6c54d9f440424259.yaml
new file mode 100644
index 000000000..c811e1b59
--- /dev/null
+++ b/releasenotes/notes/remove-cinder-gluster-6c54d9f440424259.yaml
@@ -0,0 +1,7 @@
+---
+upgrade:
+  - |
+    The GlusterFS volume driver was removed from Cinder in Ocata release. The options to
+    enable it in Packstack have been removed:
+    - `gluster` is not longer accepted in CONFIG_CINDER_BACKEND parameter.
+    - Parameter `CONFIG_CINDER_GLUSTER_MOUNTS` has been removed.
diff --git a/releasenotes/notes/remove-glance-registry-6076539ab6ce1a8b.yaml b/releasenotes/notes/remove-glance-registry-6076539ab6ce1a8b.yaml
new file mode 100644
index 000000000..c96ae43e3
--- /dev/null
+++ b/releasenotes/notes/remove-glance-registry-6076539ab6ce1a8b.yaml
@@ -0,0 +1,5 @@
+---
+other:
+  - |
+    Glance Registry service was deprecated in the Queens release and has been removed in Victoria.
+    Accordingly, packstack is not longer deploying glance-registry.
diff --git a/releasenotes/notes/remove-keystone-v2-f257cdb7e7e3a4df.yaml b/releasenotes/notes/remove-keystone-v2-f257cdb7e7e3a4df.yaml
new file mode 100644
index 000000000..5c3311ad2
--- /dev/null
+++ b/releasenotes/notes/remove-keystone-v2-f257cdb7e7e3a4df.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    The ``CONFIG_KEYSTONE_API_VERSION`` parameter no longer accepts ``v2.0``.
+    Identity v2 API was alreday removed from Keystone.
diff --git a/releasenotes/notes/remove-retry-filter-nova-05e84f3fd020d8ed.yaml b/releasenotes/notes/remove-retry-filter-nova-05e84f3fd020d8ed.yaml
new file mode 100644
index 000000000..e0d2e2034
--- /dev/null
+++ b/releasenotes/notes/remove-retry-filter-nova-05e84f3fd020d8ed.yaml
@@ -0,0 +1,6 @@
+---
+deprecations:
+  - |
+    Retry Filter Scheduler was deprecated since Train
+    and is recently removed in nova, hence removing
+    it from Packstack.
diff --git a/releasenotes/notes/remove-sahara-79e02a209c7128e9.yaml b/releasenotes/notes/remove-sahara-79e02a209c7128e9.yaml
new file mode 100644
index 000000000..c01db5cec
--- /dev/null
+++ b/releasenotes/notes/remove-sahara-79e02a209c7128e9.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    Sahara support has been removed because the sahara project is no longer
+    maintained.
diff --git a/releasenotes/notes/remove-uec-images-d876bd8c805d9633.yaml b/releasenotes/notes/remove-uec-images-d876bd8c805d9633.yaml
new file mode 100644
index 000000000..baae33478
--- /dev/null
+++ b/releasenotes/notes/remove-uec-images-d876bd8c805d9633.yaml
@@ -0,0 +1,10 @@
+---
+upgrade:
+  - |
+    Default cirros image for demo project has been updated to 0.5.1. With this change
+    using UEC image is not longer needed so following options have been removed from
+    packstack parameters:
+    * CONFIG_PROVISION_UEC_IMAGE_NAME
+    * CONFIG_PROVISION_UEC_IMAGE_KERNEL_URL
+    * CONFIG_PROVISION_UEC_IMAGE_RAMDISK_URL
+    * CONFIG_PROVISION_UEC_IMAGE_DISK_URL
diff --git a/requirements.txt b/requirements.txt
index 5b932c089..f99e8383c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -2,5 +2,6 @@ pbr>=1.6 # Apache-2.0
 netaddr>=0.7.6
 PyYAML>=3.10
 docutils>=0.11
-pyOpenSSL>=16.2.0
 netifaces
+distro
+cryptography>=2.1 # BSD/Apache-2.0
diff --git a/run_tests.sh b/run_tests.sh
index 44b5f454d..9e464bdfc 100755
--- a/run_tests.sh
+++ b/run_tests.sh
@@ -21,7 +21,7 @@ BRANCH=master
 
 # Find OS version and release
 source /etc/os-release
-OS_NAME_VERS=${REDHAT_SUPPORT_PRODUCT}${REDHAT_SUPPORT_PRODUCT_VERSION}
+OS_NAME_VERS=${ID}${VERSION_ID}
 
 # We could want to override the default repositories or install behavior
 INSTALL_FROM_SOURCE=${INSTALL_FROM_SOURCE:-true}
@@ -163,7 +163,7 @@ $SUDO $PKG_MGR -y install puppet \
                      openstack-selinux \
                      policycoreutils \
                      rubygems \
-                     wget \
+                     curl \
                      gettext \
                      diffstat \
                      doxygen \
@@ -176,58 +176,37 @@ $SUDO $PKG_MGR -y install puppet \
 OS_NAME=$(facter operatingsystem)
 OS_VERSION=$(facter operatingsystemmajrelease)
 
-if ([ "$OS_NAME" = "RedHat" ] || [ "$OS_NAME" = "CentOS" ]) && [ $OS_VERSION -gt 7 ]; then
-    $SUDO $PKG_MGR -y install python3-setuptools \
-                              python3-devel \
-                              python3-pyyaml
-else
-    $SUDO $PKG_MGR -y install python-setuptools \
-                              python-devel \
-                              yum-plugin-priorities
-fi
+$SUDO $PKG_MGR -y install python3-setuptools \
+                          python3-devel \
+                          python3-wheel \
+                          python3-pyyaml
 
 # Don't assume pip is installed
 which pip3 && PIP=pip3
 if [ -z $PIP ]; then
-    if ([ "$OS_NAME" = "RedHat" ] || [ "$OS_NAME" = "CentOS" ]) && [ $OS_VERSION -gt 7 ]; then
-        $SUDO $PKG_MGR -y install python3-pip
-        PIP=pip3
-    else
-        which pip || $SUDO easy_install pip
-        PIP=pip
-    fi
+    $SUDO $PKG_MGR -y install python3-pip python3-wheel
+    PIP=pip3
 fi
 
 # Try to use pre-cached cirros images, if available, otherwise download them
 rm -rf /tmp/cirros
 mkdir /tmp/cirros
 
-# Select cirros arch and image version based on system architecture, and export them for use by the test scenarios.
-# As of April 2018, Packstack on x86 has kernel panics with the 0.4.0 cirros image. However, ppc64le requires it.
-# As such, for now, we set x86 boxes to use version 0.3.5, and ppc64le boxes to use 0.4.0.
 export CIRROS_ARCH="$(uname -p)"
-
-case $CIRROS_ARCH in
-    x86_64)
-        export CIRROS_VERSION="0.3.5"
-        ;;
-    ppc64le)
-        export CIRROS_VERSION="0.4.0"
-        ;;
-esac
+export CIRROS_VERSION=${CIRROS_VERSION:-"0.6.3"}
 
 if [ -f ~/cache/files/cirros-$CIRROS_VERSION-$CIRROS_ARCH-uec.tar.gz ]; then
     tar -xzvf ~/cache/files/cirros-$CIRROS_VERSION-$CIRROS_ARCH-uec.tar.gz -C /tmp/cirros/
 else
     echo "No pre-cached uec archive found, downloading..."
-    wget --tries=10 https://download.cirros-cloud.net/$CIRROS_VERSION/cirros-$CIRROS_VERSION-$CIRROS_ARCH-uec.tar.gz -P /tmp/cirros/
+    curl -Lo /tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-uec.tar.gz --retry 10 https://download.cirros-cloud.net/$CIRROS_VERSION/cirros-$CIRROS_VERSION-$CIRROS_ARCH-uec.tar.gz
     tar -xzvf /tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-uec.tar.gz -C /tmp/cirros/
 fi
 if [ -f ~/cache/files/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img ]; then
     cp -p ~/cache/files/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img /tmp/cirros/
 else
     echo "No pre-cached disk image found, downloading..."
-    wget --tries=10 https://download.cirros-cloud.net/$CIRROS_VERSION/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img -P /tmp/cirros/
+    curl -Lo /tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img --retry 10 https://download.cirros-cloud.net/$CIRROS_VERSION/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img
 fi
 echo "Using pre-cached images:"
 find /tmp/cirros -type f -printf "%m %n %u %g %s  %t" -exec md5sum \{\} \;
@@ -267,14 +246,22 @@ $SUDO puppet config set hiera_config /etc/puppet/hiera.yaml
 
 # Setup dstat for resource usage tracing
 if type "dstat" 2>/dev/null; then
-  $SUDO dstat -tcmndrylpg \
-              --top-cpu-adv \
-              --top-io-adv \
-              --nocolor | $SUDO tee -a /var/log/dstat.log > /dev/null &
+    DSTAT_OPTS=""
+    set -e
+    if dstat --help 2>&1 | grep -q "top-io-adv"; then
+        DSTAT_OPTS="${DSTAT_OPTS} --top-io-adv"
+    fi
+
+    if dstat --help 2>&1 | grep -q "top-cpu-adv"; then
+        DSTAT_OPTS="${DSTAT_OPTS} --top-cpu-adv"
+    fi
+    set +e
+    $SUDO dstat -tcmndrylpg $DSTAT_OPTS --nocolor | $SUDO tee --append /var/log/dstat.log > /dev/null &
 fi
 
 # Setup packstack
 if [ "${INSTALL_FROM_SOURCE}" = true ]; then
+  $SUDO $PIP install -U pip
   $SUDO $PIP install --ignore-installed -c https://opendev.org/openstack/requirements/raw/branch/$BRANCH/upper-constraints.txt --prefix=/usr .
   # In Fedora when running with sudo gems are installed at /usr/local/bin/ even when GEM_HOME/GEM_BIN_DIR are set
   if [ "${PKG_MGR}" = "dnf" ]; then
@@ -284,8 +271,7 @@ if [ "${INSTALL_FROM_SOURCE}" = true ]; then
   fi
   export PUPPETFILE_DIR=/usr/share/openstack-puppet/modules
   export GEM_HOME=/tmp/packstackgems
-  $SUDO gem install gettext -v 3.2.9 --no-ri --no-rdoc
-  $SUDO gem install r10k -v 2.6.4 --no-ri --no-rdoc
+  $SUDO gem install r10k
   # make sure there is no puppet module pre-installed
   $SUDO rm -rf "${PUPPETFILE_DIR:?}/"*
   install_modules
diff --git a/setup.cfg b/setup.cfg
index 1d6ef5229..520f3d443 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,11 +1,12 @@
 [metadata]
 name = packstack
 summary = A utility to install OpenStack
-description-file = README.md
-long_description_content_type = text/markdown
+description_file = README.rst
+long_description_content_type = text/x-rst
 author = RDO
-author-email = rdo-list@redhat.com
-home-page = http://www.rdoproject.org/
+author_email = rdo-list@redhat.com
+home_page = http://www.rdoproject.org/
+python_requires = >=3.6
 classifier =
     Environment :: OpenStack
     Intended Audience :: Developers
@@ -14,14 +15,15 @@ classifier =
     License :: OSI Approved :: Apache Software License
     Operating System :: POSIX :: Linux
     Programming Language :: Python
-    Programming Language :: Python :: 2.7
+    Programming Language :: Python :: 3.6
+    Programming Language :: Python :: 3.9
 
 [files]
 packages =
     packstack
 
 data_files =
-    share/packstack = docs/packstack.rst
+    share/packstack = docs/source/packstack.rst
 
 [global]
 setup-hooks =
@@ -32,11 +34,6 @@ tag_build =
 tag_date = 0
 tag_svn_revision = 0
 
-[build_sphinx]
-all_files = 1
-build-dir = docs/build
-source-dir = docs
-
 [pbr]
 warnerrors = True
 autodoc_tree_index_modules = True
diff --git a/test-requirements.txt b/test-requirements.txt
index 421af3c32..fa9310cdb 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,7 +1,6 @@
-sphinx>=1.6.2,<2.0.0  # BSD
+sphinx>=1.6.2  # BSD
 openstackdocstheme>=1.17.0  # Apache-2.0
 reno>=0.1.1 # Apache2
 stestr>=1.0.0 # Apache-2.0
 coverage
-hacking!=0.13.0,<0.14,>=0.12.0
-mock>=2.0 # BSD
+hacking>=7.0.0,<7.1.0 # Apache-2.0
diff --git a/tests/installer/test_arch.py b/tests/installer/test_arch.py
index 33d474c10..67d179806 100644
--- a/tests/installer/test_arch.py
+++ b/tests/installer/test_arch.py
@@ -19,8 +19,7 @@
 Test cases for packstack.installer.core.arch module.
 """
 
-import mock
-
+from unittest import mock
 from unittest import TestCase
 
 from packstack.installer.core import arch
diff --git a/tests/installer/test_drones.py b/tests/installer/test_drones.py
index 5251027db..0214f65ed 100644
--- a/tests/installer/test_drones.py
+++ b/tests/installer/test_drones.py
@@ -17,25 +17,18 @@
 
 import os
 import shutil
+import tarfile
 import tempfile
 from unittest import TestCase
 
 from ..test_base import PackstackTestCaseMixin
-from packstack.installer.core.drones import *
+from packstack.installer.core import drones
 
 
 class SshTarballTransferMixinTestCase(PackstackTestCaseMixin, TestCase):
     def setUp(self):
         # Creating a temp directory that can be used by tests
         self.tempdir = tempfile.mkdtemp()
-
-    def tearDown(self):
-        # remove the temp directory
-        # shutil.rmtree(self.tempdir)
-        pass
-
-    def setUp(self):
-        self.tempdir = tempfile.mkdtemp()
         # prepare resource files
         res1path = os.path.join(self.tempdir, 'res1.txt')
         with open(res1path, 'w') as f:
@@ -55,7 +48,7 @@ def setUp(self):
         with open(rec2path, 'w') as f:
             f.write('recipe two')
         # prepare class
-        self.mixin = SshTarballTransferMixin()
+        self.mixin = drones.SshTarballTransferMixin()
         self.mixin.node = '127.0.0.1'
         self.mixin.resource_dir = os.path.join(self.tempdir, 'remote')
         self.mixin.recipe_dir = os.path.join(self.tempdir, 'remote',
@@ -70,6 +63,11 @@ def setUp(self):
                   self.mixin.local_tmpdir, self.mixin.remote_tmpdir):
             os.mkdir(i)
 
+    def tearDown(self):
+        # remove the temp directory
+        # shutil.rmtree(self.tempdir)
+        pass
+
     def test_tarball_packing(self):
         """
         Tests packing of resources and recipes
@@ -125,7 +123,7 @@ def test_transfer(self):
     '''
 
 
-class FakeDroneObserver(DroneObserver):
+class FakeDroneObserver(drones.DroneObserver):
     def __init__(self, *args, **kwargs):
         super(FakeDroneObserver, self).__init__(*args, **kwargs)
         self.log = []
@@ -152,7 +150,7 @@ def finished(self, drone, recipe):
         self.log.append('finished:%s' % recipe)
 
 
-class FakeDrone(Drone):
+class FakeDrone(drones.Drone):
     def __init__(self, *args, **kwargs):
         super(FakeDrone, self).__init__(*args, **kwargs)
         self.log = []
diff --git a/tests/installer/test_processors.py b/tests/installer/test_processors.py
index a6bff025c..6e68d9e36 100644
--- a/tests/installer/test_processors.py
+++ b/tests/installer/test_processors.py
@@ -17,7 +17,8 @@
 
 import os
 from unittest import TestCase
-from packstack.installer.processors import *
+
+from packstack.installer import processors
 
 from ..test_base import PackstackTestCaseMixin
 
@@ -25,12 +26,13 @@
 class ProcessorsTestCase(PackstackTestCaseMixin, TestCase):
     def test_process_host(self):
         """Test packstack.installer.processors.process_host."""
-        proc_local = process_host('localhost', 'HOSTNAME')
+        proc_local = processors.process_host('localhost', 'HOSTNAME')
         self.assertIn(proc_local, ['127.0.0.1', '::1'])
 
     def test_process_ssh_key(self):
         """Test packstack.installer.processors.process_ssh_key."""
-        path = process_ssh_key(os.path.join(self.tempdir, 'id_rsa'), 'SSH_KEY')
+        path = processors.process_ssh_key(
+            os.path.join(self.tempdir, 'id_rsa'), 'SSH_KEY')
         # test if key was created
         self.assertTrue(bool(path))
         # test if key exists
diff --git a/tests/installer/test_run_setup.py b/tests/installer/test_run_setup.py
index b697d3183..9e475f071 100644
--- a/tests/installer/test_run_setup.py
+++ b/tests/installer/test_run_setup.py
@@ -15,6 +15,7 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+import distro
 import os
 import shutil
 import subprocess
@@ -110,6 +111,10 @@ def test_running_install_hosts(self):
         puppet.validate_logfile = lambda a: None
         puppet.scan_logfile = lambda a: []
 
+        # mock distro.linux_distribution, it's does subprocess.check_output
+        # lsb_release -a
+        distro.linux_distribution = lambda: "CentOS"
+
         # If there is a error in a plugin sys.exit() gets called, this masks
         # the actual error that should be reported, so we replace it to
         # raise Exception, packstack logging gives a more infomrative error
@@ -126,5 +131,5 @@ def raise_(ex):
             sys.exit = orig_sys_exit
             try:
                 shutil.rmtree(basedefs.VAR_DIR)
-            except:
+            except Exception:
                 pass
diff --git a/tests/installer/test_sequences.py b/tests/installer/test_sequences.py
index 3d8a7a755..fdc07c2c2 100644
--- a/tests/installer/test_sequences.py
+++ b/tests/installer/test_sequences.py
@@ -15,12 +15,12 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import six
+import io
 import sys
 from unittest import TestCase
 
 from packstack.installer import utils
-from packstack.installer.core.sequences import *
+from packstack.installer.core import sequences
 
 from ..test_base import PackstackTestCaseMixin
 
@@ -29,7 +29,7 @@ class StepTestCase(PackstackTestCaseMixin, TestCase):
     def setUp(self):
         super(StepTestCase, self).setUp()
         self._stdout = sys.stdout
-        sys.stdout = six.StringIO()
+        sys.stdout = io.StringIO()
 
     def tearDown(self):
         super(StepTestCase, self).tearDown()
@@ -43,13 +43,13 @@ def func(config, messages):
             if 'test' not in config:
                 raise AssertionError('Missing config value.')
 
-        step = Step('test', func, title='Running test')
+        step = sequences.Step('test', func, title='Running test')
         step.run(config={'test': 'test'})
         contents = sys.stdout.getvalue()
 
         state = '[ %s ]\n' % utils.color_text('DONE', 'green')
-        if(not contents.startswith('Running test') or
-           not contents.endswith(state)):
+        if (not contents.startswith('Running test') or
+                not contents.endswith(state)):
             raise AssertionError('Step run test failed: %s' % contents)
 
 
@@ -57,7 +57,7 @@ class SequenceTestCase(PackstackTestCaseMixin, TestCase):
     def setUp(self):
         super(SequenceTestCase, self).setUp()
         self._stdout = sys.stdout
-        sys.stdout = six.StringIO()
+        sys.stdout = io.StringIO()
 
         self.steps = [{'name': '1', 'function': lambda x, y: True,
                        'title': 'Step 1'},
@@ -66,8 +66,8 @@ def setUp(self):
                       {'name': '3', 'function': lambda x, y: True,
                        'title': 'Step 3'}]
 
-        self.seq = Sequence('test', self.steps, condition='test',
-                            cond_match='test')
+        self.seq = sequences.Sequence('test', self.steps, condition='test',
+                                      cond_match='test')
 
     def tearDown(self):
         super(SequenceTestCase, self).tearDown()
diff --git a/tests/installer/test_setup_params.py b/tests/installer/test_setup_params.py
index 81c3f48b8..032fdf95e 100644
--- a/tests/installer/test_setup_params.py
+++ b/tests/installer/test_setup_params.py
@@ -19,11 +19,10 @@
 Test cases for packstack.installer.core.parameters module.
 """
 
-import six
 from unittest import TestCase
 
 from ..test_base import PackstackTestCaseMixin
-from packstack.installer.core.parameters import *
+from packstack.installer.core import parameters
 
 
 class ParameterTestCase(PackstackTestCaseMixin, TestCase):
@@ -49,15 +48,15 @@ def test_parameter_init(self):
         Test packstack.installer.core.parameters.Parameter
         initialization
         """
-        param = Parameter(self.data)
-        for key, value in six.iteritems(self.data):
+        param = parameters.Parameter(self.data)
+        for key, value in self.data.items():
             self.assertEqual(getattr(param, key), value)
 
     def test_default_attribute(self):
         """
         Test packstack.installer.core.parameters.Parameter default value
         """
-        param = Parameter()
+        param = parameters.Parameter()
         self.assertIsNone(param.PROCESSORS)
 
 
@@ -80,8 +79,8 @@ def test_group_init(self):
         """
         Test packstack.installer.core.parameters.Group initialization
         """
-        group = Group(attributes=self.attrs, parameters=self.params)
-        for key, value in six.iteritems(self.attrs):
+        group = parameters.Group(attributes=self.attrs, parameters=self.params)
+        for key, value in self.attrs.items():
             self.assertEqual(getattr(group, key), value)
         for param in self.params:
             self.assertIn(param['CONF_NAME'], group.parameters)
@@ -90,8 +89,8 @@ def test_search(self):
         """
         Test packstack.installer.core.parameters.Group search method
         """
-        group = Group(attributes=self.attrs, parameters=self.params)
+        group = parameters.Group(attributes=self.attrs, parameters=self.params)
         param_list = group.search('PROMPT', 'find_me')
         self.assertEqual(len(param_list), 1)
-        self.assertIsInstance(param_list[0], Parameter)
+        self.assertIsInstance(param_list[0], parameters.Parameter)
         self.assertEqual(param_list[0].CONF_NAME, 'CONFIG_MARIADB_HOST')
diff --git a/tests/installer/test_utils.py b/tests/installer/test_utils.py
index 2826870eb..e311fea94 100644
--- a/tests/installer/test_utils.py
+++ b/tests/installer/test_utils.py
@@ -25,7 +25,7 @@
 
 from ..test_base import FakePopen
 from ..test_base import PackstackTestCaseMixin
-from packstack.installer.utils import *
+from packstack.installer import utils
 from packstack.installer.utils.strings import STR_MASK
 from packstack.installer.exceptions import ExecuteRuntimeError
 
@@ -46,17 +46,17 @@ def tearDown(self):
 
     def test_sorteddict(self):
         """Test packstack.installer.utils.datastructures.SortedDict."""
-        sdict = SortedDict()
+        sdict = utils.SortedDict()
         sdict['1'] = 1
         sdict['2'] = 2
-        sdict.update(SortedDict([('3', 3), ('4', 4), ('5', 5)]))
+        sdict.update(utils.SortedDict([('3', 3), ('4', 4), ('5', 5)]))
         self.assertListEqual(sdict.keys(), ['1', '2', '3', '4', '5'])
         self.assertListEqual(sdict.values(), [1, 2, 3, 4, 5])
 
     def test_retry(self):
         """Test packstack.installer.utils.decorators.retry."""
 
-        @retry(count=3, delay=0, retry_on=ValueError)
+        @utils.retry(count=3, delay=0, retry_on=ValueError)
         def test_sum():
             global cnt
             cnt += 1
@@ -74,44 +74,44 @@ def test_sum():
 
     def test_network(self):
         """Test packstack.installer.utils.network functions."""
-        self.assertIn(host2ip('localhost', allow_localhost=True),
+        self.assertIn(utils.host2ip('localhost', allow_localhost=True),
                       ['127.0.0.1', '::1'])
 
     def test_shell(self):
         """Test packstack.installer.utils.shell functions."""
-        rc, out = execute(['echo', 'this is test'])
+        rc, out = utils.execute(['echo', 'this is test'])
         self.assertEqual(out.strip(), 'this is test')
-        rc, out = execute('echo "this is test"', use_shell=True)
+        rc, out = utils.execute('echo "this is test"', use_shell=True)
         self.assertEqual(out.strip(), 'this is test')
         try:
-            execute('echo "mask the password" && exit 1',
-                    use_shell=True, mask_list=['password'])
+            utils.execute('echo "mask the password" && exit 1',
+                          use_shell=True, mask_list=['password'])
             raise AssertionError('Masked execution failed.')
         except ExecuteRuntimeError as ex:
             should_be = ('Failed to execute command, stdout: mask the %s\n\n'
                          'stderr: ' % STR_MASK)
             self.assertEqual(str(ex), should_be)
 
-        script = ScriptRunner()
+        script = utils.ScriptRunner()
         script.append('echo "this is test"')
         rc, out = script.execute()
         self.assertEqual(out.strip(), 'this is test')
 
     def test_strings(self):
         """Test packstack.installer.utils.strings functions."""
-        self.assertEqual(color_text('test text', 'red'),
+        self.assertEqual(utils.color_text('test text', 'red'),
                          '\033[0;31mtest text\033[0m')
-        self.assertEqual(mask_string('test text', mask_list=['text']),
+        self.assertEqual(utils.mask_string('test text', mask_list=['text']),
                          'test %s' % STR_MASK)
-        masked = mask_string("test '\\''text'\\''",
-                             mask_list=["'text'"],
-                             replace_list=[("'", "'\\''")])
+        masked = utils.mask_string("test '\\''text'\\''",
+                                   mask_list=["'text'"],
+                                   replace_list=[("'", "'\\''")])
         self.assertEqual(masked, 'test %s' % STR_MASK)
 
     def test_shortcuts(self):
         """Test packstack.installer.utils.shortcuts functions."""
         conf = {"A_HOST": "1.1.1.1", "B_HOSTS": "2.2.2.2,1.1.1.1",
                 "C_HOSTS": "3.3.3.3/vdc"}
-        hostlist = list(hosts(conf))
+        hostlist = list(utils.hosts(conf))
         hostlist.sort()
         self.assertEqual(['1.1.1.1', '2.2.2.2', '3.3.3.3'], hostlist)
diff --git a/tests/installer/test_validators.py b/tests/installer/test_validators.py
index 4e8d6ac2b..ca8d0007a 100644
--- a/tests/installer/test_validators.py
+++ b/tests/installer/test_validators.py
@@ -19,7 +19,8 @@
 import shutil
 import tempfile
 from unittest import TestCase
-from packstack.installer.validators import *
+from packstack.installer import exceptions
+from packstack.installer import validators
 
 from ..test_base import PackstackTestCaseMixin
 
@@ -34,73 +35,87 @@ def tearDown(self):
         shutil.rmtree(self.tempdir)
 
     def test_validate_integer(self):
-        """Test packstack.installer.validators.validate_integer."""
-        validate_integer('1')
-        self.assertRaises(ParamValidationError, validate_integer, 'test')
+        """Test validate_integer."""
+        validators.validate_integer('1')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_integer, 'test')
 
     def test_validate_regexp(self):
-        """Test packstack.installer.validators.validate_regexp."""
-        validate_regexp('Test_123', options=['\w'])
-        self.assertRaises(ParamValidationError, validate_regexp,
-                          '!#$%', options=['\w'])
+        """Test validate_regexp."""
+        validators.validate_regexp('Test_123', options=[r'\w'])
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_regexp, '!#$%', options=[r'\w'])
 
     def test_validate_port(self):
-        """Test packstack.installer.validators.validate_port."""
-        validate_port('666')
-        self.assertRaises(ParamValidationError, validate_port, 'test')
-        self.assertRaises(ParamValidationError, validate_port, '-3')
+        """Test validate_port."""
+        validators.validate_port('666')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_port, 'test')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_port, '-3')
 
     def test_validate_not_empty(self):
-        """Test packstack.installer.validators.validate_not_empty."""
-        validate_not_empty('test')
-        validate_not_empty(False)
-        self.assertRaises(ParamValidationError, validate_not_empty, '')
-        self.assertRaises(ParamValidationError, validate_not_empty, [])
-        self.assertRaises(ParamValidationError, validate_not_empty, {})
+        """Test validate_not_empty."""
+        validators.validate_not_empty('test')
+        validators.validate_not_empty(False)
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_not_empty, '')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_not_empty, [])
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_not_empty, {})
 
     def test_validate_options(self):
-        """Test packstack.installer.validators.validate_options."""
-        validate_options('a', options=['a', 'b'])
-        validate_options('b', options=['a', 'b'])
-        self.assertRaises(ParamValidationError, validate_options,
-                          'c', options=['a', 'b'])
+        """Test validate_options."""
+        validators.validate_options('a', options=['a', 'b'])
+        validators.validate_options('b', options=['a', 'b'])
+        self.assertRaises(
+            exceptions.ParamValidationError,
+            validators.validate_options, 'c', options=['a', 'b'])
 
     def test_validate_ip(self):
-        """Test packstack.installer.validators.validate_ip."""
-        validate_ip('127.0.0.1')
-        validate_ip('::1')
-        self.assertRaises(ParamValidationError, validate_ip, 'test')
+        """Test validate_ip."""
+        validators.validate_ip('127.0.0.1')
+        validators.validate_ip('::1')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_ip, 'test')
 
     def test_validate_file(self):
-        """Test packstack.installer.validators.validate_file."""
+        """Test validate_file."""
         dname = os.path.join(self.tempdir, '.test_validate_file')
         bad_name = os.path.join(self.tempdir, '.me_no/exists')
         os.mkdir(dname)
-        validate_writeable_directory(dname)
-        self.assertRaises(ParamValidationError, validate_writeable_directory, bad_name)
+        validators.validate_writeable_directory(dname)
+        self.assertRaises(
+            exceptions.ParamValidationError,
+            validators.validate_writeable_directory, bad_name)
 
     def test_validate_writeable_directory(self):
-        """Test packstack.installer.validators.validate_writeable_directory."""
-        fname = os.path.join(self.tempdir, '.test_validate_writeable_directory')
+        """Test validate_writeable_directory."""
+        fname = os.path.join(
+            self.tempdir, '.test_validate_writeable_directory')
         bad_name = os.path.join(self.tempdir, '.me_no_exists')
         with open(fname, 'w') as f:
             f.write('test')
-        validate_file(fname)
-        self.assertRaises(ParamValidationError, validate_file, bad_name)
+        validators.validate_file(fname)
+        self.assertRaises(
+            exceptions.ParamValidationError,
+            validators.validate_file, bad_name)
 
     def test_validate_ping(self):
-        """Test packstack.installer.validators.validate_ping."""
+        """Test validate_ping."""
         # ping to broadcast fails
-        self.assertRaises(ParamValidationError, validate_ping,
-                          '255.255.255.255')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_ping, '255.255.255.255')
 
     def test_validate_ssh(self):
-        """Test packstack.installer.validators.validate_ssh."""
+        """Test validate_ssh."""
         # ssh to broadcast fails
-        self.assertRaises(ParamValidationError, validate_ssh,
-                          '255.255.255.255')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_ssh, '255.255.255.255')
 
     def test_validate_float(self):
-        """Test packstack.installer.validators.validate_float."""
-        validate_float('5.3')
-        self.assertRaises(ParamValidationError, validate_float, 'test')
+        """Test validate_float."""
+        validators.validate_float('5.3')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_float, 'test')
diff --git a/tests/scenario-py3.sh b/tests/scenario-py3.sh
index e9b616683..a7a594fa1 100755
--- a/tests/scenario-py3.sh
+++ b/tests/scenario-py3.sh
@@ -36,9 +36,6 @@ $SUDO packstack ${ADDITIONAL_ARGS} \
           --amqp-enable-ssl=n \
           --glance-backend=file \
           --nova-libvirt-virt-type=qemu \
-          --provision-uec-kernel-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-vmlinuz" \
-          --provision-uec-ramdisk-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-initrd" \
-          --provision-uec-disk-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img" \
           --provision-image-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img" \
           --provision-demo=y \
           --provision-tempest=y \
diff --git a/tests/scenario001.sh b/tests/scenario001.sh
index e306f424b..92b73a56a 100755
--- a/tests/scenario001.sh
+++ b/tests/scenario001.sh
@@ -38,11 +38,9 @@ $SUDO packstack ${ADDITIONAL_ARGS} \
           --amqp-enable-ssl=y \
           --glance-backend=file \
           --nova-libvirt-virt-type=qemu \
-          --provision-uec-kernel-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-vmlinuz" \
-          --provision-uec-ramdisk-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-initrd" \
-          --provision-uec-disk-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img" \
           --provision-image-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img" \
           --provision-demo=y \
           --provision-tempest=y \
           --run-tempest=y \
-          --run-tempest-tests="smoke dashboard" || export FAILURE=true
+          --run-tempest-tests="smoke dashboard" \
+          --skip-tempest-tests="test_dashboard_basic_ops" || export FAILURE=true
diff --git a/tests/scenario002.sh b/tests/scenario002.sh
index 430bdf305..89d97c08a 100755
--- a/tests/scenario002.sh
+++ b/tests/scenario002.sh
@@ -12,7 +12,6 @@ echo -e "Generating packstack config for:
 - nova
 - neutron (ovs+vxlan)
 - swift
-- sahara
 - trove
 - tempest (regex: 'smoke dashboard')"
 echo "tempest will run if packstack's installation completes successfully."
@@ -39,13 +38,8 @@ $SUDO packstack ${ADDITIONAL_ARGS} \
           --os-neutron-ml2-type-drivers="vxlan,flat" \
           --os-neutron-ml2-tenant-network-types="vxlan" \
           --os-neutron-vpnaas-install=n \
-          --os-sahara-install=y \
           --os-trove-install=y \
-          --neutron-fwaas=y \
           --nova-libvirt-virt-type=qemu \
-          --provision-uec-kernel-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-vmlinuz" \
-          --provision-uec-ramdisk-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-initrd" \
-          --provision-uec-disk-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img" \
           --provision-image-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img" \
           --provision-demo=y \
           --provision-tempest=y \
diff --git a/tests/scenario003.sh b/tests/scenario003.sh
index 0faa3cf53..fd6f61ca4 100755
--- a/tests/scenario003.sh
+++ b/tests/scenario003.sh
@@ -14,7 +14,6 @@ echo -e "Generating packstack config for:
 - ceilometer
 - aodh
 - gnocchi
-- panko
 - heat
 - magnum
 - tempest (regex: 'smoke TelemetryAlarming')"
@@ -38,11 +37,7 @@ $SUDO packstack ${ADDITIONAL_ARGS} \
           --glance-backend=file \
           --os-heat-install=y \
           --os-magnum-install=y \
-          --os-panko-install=y \
           --nova-libvirt-virt-type=qemu \
-          --provision-uec-kernel-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-vmlinuz" \
-          --provision-uec-ramdisk-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-initrd" \
-          --provision-uec-disk-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img" \
           --provision-image-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img" \
           --provision-demo=y \
           --provision-tempest=y \
diff --git a/tests/test_base.py b/tests/test_base.py
index 156889db2..42cf5ea67 100644
--- a/tests/test_base.py
+++ b/tests/test_base.py
@@ -15,10 +15,10 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+import logging
 import shutil
-import tempfile
 import subprocess
-import logging
+import tempfile
 
 
 LOG = logging.getLogger(__name__)
@@ -122,8 +122,7 @@ def assertItemsEqual(self, list1, list2, msg=None):
                        'Second has %s' % (f, s))
         self.assertEqual(f, s, msg=_msg)
 
-        _msg = msg or ('Given lists differ:\n%(list1)s'
-                       '\n%(list2)s' % locals())
+        _msg = msg or f'Given lists differ:\n{list1}\n{list2}'
         for i in list1:
             if i not in list2:
                 raise AssertionError(_msg)
@@ -134,8 +133,7 @@ def assertListEqual(self, list1, list2, msg=None):
                        'Second has %s' % (f, s))
         self.assertEqual(f, s, msg=_msg)
 
-        _msg = msg or ('Given lists differ:\n%(list1)s'
-                       '\n%(list2)s' % locals())
+        _msg = msg or f'Given lists differ:\n{list1}\n{list2}'
         for index, item in enumerate(list1):
             if item != list2[index]:
                 raise AssertionError(_msg)
diff --git a/tools/copy-logs.sh b/tools/copy-logs.sh
index 480c4acca..2e362013b 100755
--- a/tools/copy-logs.sh
+++ b/tools/copy-logs.sh
@@ -96,10 +96,10 @@ function get_config_and_logs {
         '/var/log/ceilometer'
         '/etc/gnocchi' # gnocchi is nested under telemetry in governance
         '/var/log/gnocchi'
-        '/var/log/panko'
-        '/etc/panko' # panko is nested under telemetry in governance
         '/etc/rabbitmq/'
         '/var/log/rabbitmq'
+        '/etc/redis'
+        '/var/log/redis'
         '/etc/my.cnf.d'
         '/var/log/mariadb'
         '/etc/httpd/conf.d/'
diff --git a/tox.ini b/tox.ini
index 0f5772713..188ad6379 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,7 +1,7 @@
 [tox]
-minversion = 2.0
-envlist = py27,py36,pep8,releasenotes
-skipsdist = True
+minversion = 3.18.0
+envlist = py39,py312,pep8,releasenotes,docs
+skipsdist = False
 
 [testenv]
 usedevelop = True
@@ -14,6 +14,7 @@ deps =
   -r{toxinidir}/test-requirements.txt
   -r{toxinidir}/requirements.txt
 
+allowlist_externals = /usr/bin/find
 commands = /usr/bin/find . -type f -name "*.pyc" -delete
            stestr run {posargs}
 
@@ -30,7 +31,7 @@ setenv = NOSE_WITH_COVERAGE=1
 commands = {posargs}
 
 [testenv:docs]
-commands = python setup.py build_sphinx
+commands = sphinx-build -a -E -W -d docs/build/doctrees -b html docs/source docs/build/html
 
 [testenv:releasenotes]
 deps = -r{toxinidir}/test-requirements.txt
@@ -41,6 +42,6 @@ commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasen
 # E123, E125 skipped as they are invalid PEP-8.
 #
 # All other checks should be enabled in the future.
-ignore = E123,E125,H803,F403,F821,F811,F841,E501,H302,H303,H304,H306,H405,H404,H305,H307,H501,H201,H101
+ignore = E123,E125,E501,H404,H405,H305,H306,H307,W504
 show-source = True
 exclude=.venv,.git,.tox,.eggs