diff --git a/.gitignore b/.gitignore
index 726885683..b793b5655 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,9 @@
 *.swp
 *.log
 .tox
+vendor/*
+Gemfile.lock
 packstack.egg-info
+docs/build
+releasenotes/build
+.stestr
diff --git a/.gitmodules b/.gitmodules
deleted file mode 100644
index 3b435ee38..000000000
--- a/.gitmodules
+++ /dev/null
@@ -1,96 +0,0 @@
-[submodule "packstack/puppet/modules/glance"]
-	path = packstack/puppet/modules/glance
-	url = https://github.com/stackforge/puppet-glance.git
-[submodule "packstack/puppet/modules/horizon"]
-	path = packstack/puppet/modules/horizon
-	url = https://github.com/stackforge/puppet-horizon.git
-[submodule "packstack/puppet/modules/keystone"]
-	path = packstack/puppet/modules/keystone
-	url = https://github.com/packstack/puppet-keystone.git
-[submodule "packstack/puppet/modules/nova"]
-	path = packstack/puppet/modules/nova
-	url = https://github.com/stackforge/puppet-nova.git
-[submodule "packstack/puppet/modules/openstack"]
-	path = packstack/puppet/modules/openstack
-	url = https://github.com/stackforge/puppet-openstack.git
-[submodule "packstack/puppet/modules/swift"]
-	path = packstack/puppet/modules/swift
-	url = https://github.com/stackforge/puppet-swift.git
-[submodule "packstack/puppet/modules/cinder"]
-	path = packstack/puppet/modules/cinder
-	url = https://github.com/stackforge/puppet-cinder.git
-[submodule "packstack/puppet/modules/stdlib"]
-	path = packstack/puppet/modules/stdlib
-	url = https://github.com/puppetlabs/puppetlabs-stdlib.git
-[submodule "packstack/puppet/modules/sysctl"]
-	path = packstack/puppet/modules/sysctl
-	url = https://github.com/puppetlabs/puppetlabs-sysctl.git
-[submodule "packstack/puppet/modules/mysql"]
-	path = packstack/puppet/modules/mysql
-	url = https://github.com/packstack/puppetlabs-mysql.git
-[submodule "packstack/puppet/modules/concat"]
-	path = packstack/puppet/modules/concat
-	url = https://github.com/ripienaar/puppet-concat.git
-[submodule "packstack/puppet/modules/rsync"]
-	path = packstack/puppet/modules/rsync
-	url = https://github.com/puppetlabs/puppetlabs-rsync.git
-[submodule "packstack/puppet/modules/xinetd"]
-	path = packstack/puppet/modules/xinetd
-	url = https://github.com/packstack/puppetlabs-xinetd.git
-[submodule "packstack/puppet/modules/apache"]
-	path = packstack/puppet/modules/apache
-	url = https://github.com/puppetlabs/puppetlabs-apache.git
-[submodule "packstack/puppet/modules/firewall"]
-	path = packstack/puppet/modules/firewall
-	url = https://github.com/puppetlabs/puppetlabs-firewall.git
-[submodule "packstack/puppet/modules/memcached"]
-	path = packstack/puppet/modules/memcached
-	url = https://github.com/saz/puppet-memcached.git
-[submodule "packstack/puppet/modules/ssh"]
-	path = packstack/puppet/modules/ssh
-	url = https://github.com/saz/puppet-ssh.git
-[submodule "packstack/puppet/modules/inifile"]
-	path = packstack/puppet/modules/inifile
-        url = https://github.com/puppetlabs/puppetlabs-inifile.git
-[submodule "packstack/puppet/modules/qpid"]
-	path = packstack/puppet/modules/qpid
-	url = https://github.com/dprince/puppet-qpid
-[submodule "packstack/puppet/modules/vlan"]
-	path = packstack/puppet/modules/vlan
-	url = https://github.com/derekhiggins/puppet-vlan.git
-[submodule "packstack/puppet/modules/vswitch"]
-	path = packstack/puppet/modules/vswitch
-	url = https://github.com/stackforge/puppet-vswitch.git
-[submodule "packstack/puppet/modules/tempest"]
-	path = packstack/puppet/modules/tempest
-	url = git://github.com/stackforge/puppet-tempest.git
-[submodule "packstack/puppet/modules/vcsrepo"]
-	path = packstack/puppet/modules/vcsrepo
-	url = https://github.com/puppetlabs/puppetlabs-vcsrepo.git
-[submodule "packstack/puppet/modules/neutron"]
-	path = packstack/puppet/modules/neutron
-	url = https://github.com/stackforge/puppet-neutron.git
-[submodule "packstack/puppet/modules/haproxy"]
-	path = packstack/puppet/modules/haproxy
-	url = https://github.com/puppetlabs/puppetlabs-haproxy.git
-[submodule "packstack/puppet/modules/ceilometer"]
-	path = packstack/puppet/modules/ceilometer
-	url = https://github.com/stackforge/puppet-ceilometer.git
-[submodule "packstack/puppet/modules/mongodb"]
-	path = packstack/puppet/modules/mongodb
-	url = https://github.com/puppetlabs/puppetlabs-mongodb.git
-[submodule "packstack/puppet/modules/heat"]
-	path = packstack/puppet/modules/heat
-	url = https://github.com/packstack/puppet-heat.git
-[submodule "packstack/puppet/modules/pacemaker"]
-	path = packstack/puppet/modules/pacemaker
-	url = https://github.com/radez/puppet-pacemaker.git
-[submodule "packstack/puppet/modules/certmonger"]
-	path = packstack/puppet/modules/certmonger
-	url = git://github.com/rcritten/puppet-certmonger.git
-[submodule "packstack/puppet/modules/nssdb"]
-	path = packstack/puppet/modules/nssdb
-	url = https://github.com/rcritten/puppet-nssdb.git
-[submodule "packstack/puppet/modules/gluster"]
-	path = packstack/puppet/modules/gluster
-	url = https://github.com/redhat-openstack/puppet-openstack-storage.git
diff --git a/.gitreview b/.gitreview
index 0a64477e8..463987619 100644
--- a/.gitreview
+++ b/.gitreview
@@ -1,4 +1,4 @@
 [gerrit]
-host=review.openstack.org
+host=review.opendev.org
 port=29418
-project=stackforge/packstack.git
+project=x/packstack.git
diff --git a/.stestr.conf b/.stestr.conf
new file mode 100644
index 000000000..ea359caed
--- /dev/null
+++ b/.stestr.conf
@@ -0,0 +1,3 @@
+[DEFAULT]
+test_path=./tests
+top_dir=./
diff --git a/.testr.conf b/.testr.conf
new file mode 100644
index 000000000..081907d59
--- /dev/null
+++ b/.testr.conf
@@ -0,0 +1,4 @@
+[DEFAULT]
+test_command=${PYTHON:-python} -m subunit.run discover -t ./ ./tests $LISTOPT $IDOPTION
+test_id_option=--load-list $IDFILE
+test_list_option=--list
diff --git a/.zuul.yaml b/.zuul.yaml
new file mode 100644
index 000000000..5958c5edb
--- /dev/null
+++ b/.zuul.yaml
@@ -0,0 +1,202 @@
+- job:
+    name: packstack-base
+    parent: base
+    timeout: 7200
+    post-run: playbooks/upload-logs.yaml
+    irrelevant-files:
+      - ^docs/.*$
+      - ^releasenotes/.*$
+    required-projects:
+      - x/packstack
+      - openstack/puppet-aodh
+      - openstack/puppet-ceilometer
+      - openstack/puppet-cinder
+      - openstack/puppet-glance
+      - openstack/puppet-gnocchi
+      - openstack/puppet-heat
+      - openstack/puppet-magnum
+      - openstack/puppet-horizon
+      - openstack/puppet-ironic
+      - openstack/puppet-keystone
+      - openstack/puppet-manila
+      - openstack/puppet-neutron
+      - openstack/puppet-nova
+      - openstack/puppet-openstacklib
+      - openstack/puppet-oslo
+      - openstack/puppet-ovn
+      - openstack/puppet-placement
+      - openstack/puppet-swift
+      - openstack/puppet-tempest
+      - openstack/puppet-trove
+      - openstack/puppet-vswitch
+
+- job:
+    name: packstack-centos9
+    parent: packstack-base
+    vars:
+      selinux_enforcing: "false"
+      delorean: "https://trunk.rdoproject.org/centos9-master/puppet-passed-ci/delorean.repo"
+      delorean_deps: "https://trunk.rdoproject.org/centos9-master/delorean-deps.repo"
+    pre-run: playbooks/packstack-centos9-pre.yaml
+    nodeset:
+      nodes:
+        - name: centos9s
+          label: centos-9-stream
+    run: playbooks/packstack-integration-tempest.yaml
+
+- job:
+    name: packstack-multinode-centos9
+    parent: packstack-base
+    vars:
+      selinux_enforcing: "false"
+      delorean: "https://trunk.rdoproject.org/centos9-master/puppet-passed-ci/delorean.repo"
+      delorean_deps: "https://trunk.rdoproject.org/centos9-master/delorean-deps.repo"
+    pre-run: playbooks/packstack-centos9-pre.yaml
+    post-run: playbooks/packstack-post-compute.yaml
+    nodeset:
+      nodes:
+        - name: controller
+          label: centos-9-stream
+        - name: compute
+          label: centos-9-stream
+    run: playbooks/packstack-multinode.yaml
+
+- job:
+    name: packstack-centos9s-integration-scenario001
+    parent: packstack-centos9
+    vars:
+      scenario: scenario001
+
+- job:
+    name: packstack-centos9s-integration-scenario002
+    parent: packstack-centos9
+    vars:
+      scenario: scenario002
+
+- job:
+    name: packstack-centos9s-integration-scenario003
+    parent: packstack-centos9
+    vars:
+      scenario: scenario003
+
+- job:
+    name: packstack-centos9s-multinode-scenario002-tempest
+    parent: packstack-multinode-centos9
+    post-run: playbooks/packstack-post-compute.yaml
+    vars:
+      scenario: scenario002
+
+- secret:
+    name: packstack_git_mirror_credentials_master
+    data:
+      user: git
+      host: github.com
+      host_key: github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
+      ssh_key: !encrypted/pkcs1-oaep
+        - Rd6fA6jCgfkqHDdNFG4abPZlnsV7mc8ki0AZDANf7dZmopQONSKVVmP7uQ15b57vB8BiK
+          Crk4TP0yJEDZBjOSlwGywHbEE0UhGNQU6Gm13XDE0U7gvPJ1kWqMxmDRXr96f0ibpNuNL
+          B112HZS09FSMklx+FhGFsQoZMr8xutVbmCcSHZnKPY50Sa6KrgIuvlCyL9/Py5zDEBNaZ
+          dGD9mirxn8nP8GzVmRl+r43ccc1BoVRgM0uAoQCROBabvdF6iV8x3JKKAjX0tCDZFpdQG
+          uCUNY2+E4fBEOlVrX4Oc3PzO2YkiqaPbu5oMrs56qXlZ3TCiu8EDadatU6FaSjTT96wSL
+          XoOLOqO+5yZ/n4WMua07ANbjj6Q2lvysoemJNUWKMkFhTEhVlNTOx/wnZMeJaIS+eKRDN
+          8TiYTlJbHvJ+V7t1RBSbkevjnA6UdTMMOx/yuPDiXHiGFGG8Ey0zk/2JRXpq29GK73ldv
+          xIFFwALCwT6dEIT+qs6bL3KSlexx2r723aCiItZC/v5/0PnRNg0PDxWE/Q2DpBsMa8uaH
+          LVSZSKrzpT1Lg1XiItbmi4hm55vWDhFWds1f7qjjpE3IHO2zeioTf/fFCAk3sIvpqDUUJ
+          7FmI3gnk3YKQ1F3wkQZv2UaL5UdY1f7v2cv3eryFUqQW1/9GFqs+R1Pqaapm5s=
+        - nsmXI8bBhJyjPpoQT1JdwmkQzJeWa6j82jtx46iQc+ComozmtK4AQyV+els5wn4ZWSMRu
+          pPH+4+qD5t8f8kWFd0ql0IrF9UvLF6PpQHs/Q6XQ+nxG/dM6H2cGQXxPHSEu62VQRJaQ/
+          k8MT5gWpfix391MOxiFOraQSi0H/sJ+tU7lCC+5r8O6wbVn44gYtr1VbYzsf/JNen/QIr
+          cwL+EpAO0jmrFcPel9BUEMBX6RyAZfPSC07gbva+OY5w3OUaDC6Xebi+vJzigSoYDfUTO
+          wQlGCt63UY33x+LORSzWRC4mk+q2dQ3wDJFa3BuCGbdWnxwCqdeLK7fxKiDNhNfHJbnU1
+          fJ4PALQ1n9i2X/9pxEmDmqjhQnNi5wuHjj5jeycl/fFy1QkWrOJ5evWpD2tw2spjOEpMG
+          CaydibcWuYmnxV/riXE1Qg0aPiqsEM4j370mo4pRb4CKbkwOjl/OpOW9PWn7kkWZWDOKg
+          orTXQQQpdwm9xHX/2b8OQJyDwWPBwRiPnGMcinQIFj4qk9fRs3C+d58mYwKo4i+5WcVdK
+          Q87AlIpNjuNSCE93zFOVz6Qc0TclE4a8C/M7XFvRvoExUr2dV584xDx4C/Z/mRc7ZxHK9
+          IAZaGsqr59bYwW56MnG5NlrKNrEOT66PRxQUsBxZAHvkxaoaUxNOT8HdX6Ytbw=
+        - v/Qa4NK/ojesuv83UbHJmUYuefNDrDHKrjW2Rqt37wZGuIP2Z39mPkhnmJJp68K8eQQRC
+          Y5N5x4JfQA74/fZbyOVbSLt2g7xr5Kl8uKJhTzUkigYiC4VIOoQ6ZvcFz3qHLbh1fvBbR
+          khKUanNtAoTh7VV0DFZsNsTL+TZwGWIdmOj+wSqJP2muyhSULBY3FujkIIZ2K0A8+AxUi
+          q8d6n7DtyZkfQp0E+TJ3jxf1YoFSsk84sxqz8xy3qMc/7hDGzRGiicLZaWOZ+K6ifSzMx
+          MBjYgQaYqsLGr8pt/li3uCWEEQPxYiwBvtIE485aEVX7BqrvzAtssGatXqSBIJYZOdbz8
+          suL1e4y02lBkCH4NIT0+vjsc6mozjSXg7oXg1IgA26GjjLZSYKv/Kmt6o5U973oOoX3Pi
+          qhBpf+pmFJPiHBHkIlM4UgJ9sxHT8YdGjMQh4H6Hmi/mySylxJ1v5o91jgaaXarjtO8D8
+          CufjedN1G0mzZPuS2ncwrBnY9G48BiFJd61Y0kPOgvAIWZUJ5n2/2uFcWCy+sYekXjLP5
+          6a+9MThoFCOpLwe7yf5BafP+xV8q7EKG8kkV8CI6FA3LtFokb7cwmKdqMx25ECSwNS5j8
+          bxx6/hZR6NkD38ahi0u+HYx0CmRHaSCZSm+gOsaoSUtVkmnmtN5RdNYmIbuKgU=
+        - R5mWboWaaAkDyltXfaPhlxjmfaBF4+TY8oB9uwetfcMX7kgJDui6hdGXsgcm1iyJQS+Fc
+          AY9edoRbJ98eUQKM32Zw7yB95KnnZGj24tdkk9tJV8zHBrfIO3llHUz6qbA/5mMRs/G6e
+          FMHcCKSfgP6zeXI4vc0u3p3GQZiDx/1C6JOG4ev6P++hPq2flKsHMbE4qc6Aq+6Y1hG1R
+          g3LDvVMzYHzYY/tURZWwo3ozSbWWbBOlLv0H3e8+X7xEGob6ft2oURKD251Iop/E16Frp
+          UEL9ZJnXGORchsKWuXOskQFzCwFBmuWbdVZ8KU7Z8mQ9qEJLFTssBB3UVVApbLYZ6UML/
+          Ebi3d3SjuRVP8aLoV3Mir63DMyn42IblNSvXaUXSq1pgONafZvMkr5phxCovTsrX5GFx1
+          3Yj5cWXN6rk1pMeXIB6gTc62tffJCMaDUMGQxVZNVztpYnRQP+SSzI/iiOlxkc8+VmAqr
+          2ZIu7bTVkgrQmK2VOtX0EQF7u6iYmOK7NlmXPU/ErCgzSO+5eCzbBWy6R2ghIfON8JBhN
+          exN3Pq0QS55vG6oyILIKe6WdtuK8Mr1oJ6T4V9nXhP7UzKNWV0ikK5dp/8B2aDjA0Voyr
+          dM25ECVGCiHfyTsJ4HneBunJ+Q+GjRy208z/BWH6m1sQ1VxFcS3hcu/AFbujSo=
+        - anXfbR6gw3/XbYvLnuJAT5DwSHU76P3tl51QAm+yynsP/5uh0ESEzHUHdDuIcoJFY6LPs
+          3EdOE0isz4VmRaLCMIWnuBpPoFYJmNBQ1FK6+o8Ti60LiL7XimnN5IDC7QftTYO9jAUVj
+          fdCV0pxS6gQhHA1ejUHU0ZS2SWz0FSAsj4Yo6OnnGYc+WyMjlg8CkEq55sgmTfIbCLsLE
+          BUgKTMHuxnJFgsUgrskiUm1S58+6W+rP02/WDPtl8slioZ+t47G5Qpm0QLqvQrqGgSam4
+          jtv+twPkeagqvc06cm77TpvGvTaSzB8I6h/ObAGRYZEENj2snzQPVWjhhc3upAbEdwV3D
+          Gs9VGSC5cVLRR9WqV2t7R22u+pJCAHxvXdRqlwEv7WrZYHLqC3UUbV4Qrmxsa0G1kEFPX
+          uIieK4fXHU0II3bhVbhT1t2XCpx+M6umCResx4iLL74Bi1xV2/9Gy1BSYg0FFEEaAEBPG
+          eiHCZiH5AXw7EMukcqtA4ibanBiqmxx4bPnGU9lLd6RssDIjbTssKa6YjLHqZZXMsxBes
+          rs2ApPag6U2UBgV1+8/eeqyoO2szi5BUoHw5ZXuDj54MMUjaV01WWWHDbPgVbK/nByg4h
+          toeNEkK+1+Go1OMvqfkx0D8xOFSI8hEtLa3SB/G6KLNgz8iQmZs4kfHw1bNUFk=
+        - hWi9uCZSpFC7ifCf0TbsisNdbD67Nb8SpVKE5Q47zo5QOEs3pvGnBlv+cm7Db1Qg4fNmb
+          Mfg1yL4EOFlJqcK7fYxvs0GGdYrLOthZn9Yxuc5kWv0axuyLwPaJ0xfI9M0EEWuEjazGb
+          37mPU1RLccXd9+XrrcLaXc7DRBfPkv+jleOyn08ZPOLmn08lX+sCnNgXISlaCqp7Qu3mE
+          rJWj64mwLDzeAQjg++szTELZcoZxMRG4jhH/bGsDg/+PxCrYycc1ip3jBif2k10sX1DCJ
+          JRvpTIAsChIglXEiy91QsQIEX68zid/bJ0PlgJ2FdFpaPzuVVW/zZWJp8PGNWoWJsGOCQ
+          gi8LtoUxxTe2rBvpDIaHU8Z9+MVXd9FFkOxU2vZxLxNpxz1T+WnTu9YhWOwO8zKRoJ+9/
+          8YLH9fqmWualJksiIYcB3vaQv66PQg2dkucu+jT+6bCCWrCrFozARNI9O2a10mHE1GFDU
+          mSaRbfeMZ7V9NFqPLLjWInUpcq1lY8i9NWlPm36l9QX0vX0fxRwmj1f+VKJuoksltMjXA
+          fZIkKxUYUJ/zYybxdRymCATmlvWN/+YI/xgnLwfB/mHDJiOwiM1GRrcZzKyz9pyU5oS7z
+          4xI9SSUqqnEpjki+/kTRDVnv1d3WmJSwCvty1DfyPoQ8J2LqbH3sN6JNcQs2NE=
+
+- job:
+    name: packstack-upload-git-mirror
+    parent: upload-git-mirror
+    description: Mirrors x/packstack to redhat-openstack/packstack
+    allowed-projects: x/packstack
+    vars:
+      git_mirror_repository: redhat-openstack/packstack
+    secrets:
+      - name: git_mirror_credentials
+        secret: packstack_git_mirror_credentials_master
+        pass-to-parent: true
+
+- project:
+    check:
+      jobs:
+        - openstack-tox-pep8
+        - openstack-tox-py39
+        - openstack-tox-py312
+        - build-openstack-releasenotes:
+            vars:
+              sphinx_python: python3
+        - packstack-centos9s-integration-scenario001
+        - packstack-centos9s-integration-scenario002
+        - packstack-centos9s-integration-scenario003
+        - packstack-centos9s-multinode-scenario002-tempest
+    gate:
+      jobs:
+        - openstack-tox-pep8
+        - openstack-tox-py39
+        - openstack-tox-py312
+        - build-openstack-releasenotes:
+            vars:
+              sphinx_python: python3
+        - packstack-centos9s-integration-scenario001
+        - packstack-centos9s-integration-scenario002
+        - packstack-centos9s-integration-scenario003
+        - packstack-centos9s-multinode-scenario002-tempest
+    post:
+      jobs:
+        - packstack-upload-git-mirror
+    release:
+      jobs:
+        - packstack-upload-git-mirror
+    pre-release:
+      jobs:
+        - packstack-upload-git-mirror
diff --git a/Gemfile b/Gemfile
new file mode 100644
index 000000000..30b0ca6c8
--- /dev/null
+++ b/Gemfile
@@ -0,0 +1,25 @@
+source ENV["GEM_SOURCE"] || "https://rubygems.org"
+
+group :development, :test do
+  gem 'puppetlabs_spec_helper', :require => false
+
+  gem 'puppet-lint-param-docs'
+  gem 'puppet-lint-absolute_classname-check'
+  gem 'puppet-lint-absolute_template_path'
+  gem 'puppet-lint-trailing_newline-check'
+
+  # Puppet 4.x related lint checks
+  gem 'puppet-lint-unquoted_string-check'
+  gem 'puppet-lint-leading_zero-check'
+  gem 'puppet-lint-variable_contains_upcase'
+  gem 'puppet-lint-numericvariable'
+
+end
+
+if puppetversion = ENV['PUPPET_GEM_VERSION']
+  gem 'puppet', puppetversion, :require => false
+else
+  gem 'puppet', :require => false
+end
+
+# vim:ft=ruby
diff --git a/MANIFEST.in b/MANIFEST.in
index fa1e2b820..c87312f16 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -1,5 +1,6 @@
 include docs/*
 include LICENSE
+include README.md
 recursive-include packstack/puppet *
 recursive-include packstack/templates *
 global-exclude .gitignore
diff --git a/Puppetfile b/Puppetfile
new file mode 100644
index 000000000..589ad01f6
--- /dev/null
+++ b/Puppetfile
@@ -0,0 +1,156 @@
+# Auto-generated Puppetfile for Packstack project
+
+moduledir '/usr/share/openstack-puppet/modules'
+
+## OpenStack modules
+
+mod 'aodh',
+  :git => 'https://github.com/openstack/puppet-aodh',
+  :ref => 'master'
+
+mod 'ceilometer',
+  :git => 'https://github.com/openstack/puppet-ceilometer',
+  :ref => 'master'
+
+mod 'cinder',
+  :git => 'https://github.com/openstack/puppet-cinder',
+  :ref => 'master'
+
+mod 'glance',
+  :git => 'https://github.com/openstack/puppet-glance',
+  :ref => 'master'
+
+mod 'gnocchi',
+  :git => 'https://github.com/openstack/puppet-gnocchi',
+  :ref => 'master'
+
+mod 'heat',
+  :git => 'https://github.com/openstack/puppet-heat',
+  :ref => 'master'
+
+mod 'horizon',
+  :git => 'https://github.com/openstack/puppet-horizon',
+  :ref => 'master'
+
+mod 'ironic',
+  :git => 'https://github.com/openstack/puppet-ironic',
+  :ref => 'master'
+
+mod 'keystone',
+  :git => 'https://github.com/openstack/puppet-keystone',
+  :ref => 'master'
+
+mod 'magnum',
+  :git => 'https://github.com/openstack/puppet-magnum',
+  :ref => 'master'
+
+mod 'manila',
+  :git => 'https://github.com/openstack/puppet-manila',
+  :ref => 'master'
+
+mod 'neutron',
+  :git => 'https://github.com/openstack/puppet-neutron',
+  :ref => 'master'
+
+mod 'nova',
+  :git => 'https://github.com/openstack/puppet-nova',
+  :ref => 'master'
+
+mod 'openstacklib',
+  :git => 'https://github.com/openstack/puppet-openstacklib',
+  :ref => 'master'
+
+mod 'oslo',
+  :git => 'https://github.com/openstack/puppet-oslo',
+  :ref => 'master'
+
+mod 'ovn',
+  :git => 'https://github.com/openstack/puppet-ovn',
+  :ref => 'master'
+
+mod 'placement',
+  :git => 'https://github.com/openstack/puppet-placement',
+  :ref => 'master'
+
+mod 'swift',
+  :git => 'https://github.com/openstack/puppet-swift',
+  :ref => 'master'
+
+mod 'tempest',
+  :git => 'https://github.com/openstack/puppet-tempest',
+  :ref => 'master'
+
+mod 'trove',
+  :git => 'https://github.com/openstack/puppet-trove',
+  :ref => 'master'
+
+mod 'vswitch',
+  :git => 'https://github.com/openstack/puppet-vswitch',
+  :ref => 'master'
+
+## Non-OpenStack modules
+
+mod 'apache',
+  :git => 'https://github.com/puppetlabs/puppetlabs-apache',
+  :ref => 'v12.3.1'
+
+mod 'concat',
+  :git => 'https://github.com/puppetlabs/puppetlabs-concat',
+  :ref => 'v9.1.0'
+
+mod 'firewall',
+  :git => 'https://github.com/puppetlabs/puppetlabs-firewall',
+  :ref => 'v8.1.7'
+
+mod 'inifile',
+  :git => 'https://github.com/puppetlabs/puppetlabs-inifile',
+  :ref => 'v6.2.0'
+
+mod 'memcached',
+  :git => 'https://github.com/saz/puppet-memcached',
+  :ref => 'v10.0.1'
+
+mod 'mysql',
+  :git => 'https://github.com/puppetlabs/puppetlabs-mysql',
+  :ref => 'v16.2.0'
+
+mod 'nssdb',
+  :git => 'https://github.com/rcritten/puppet-nssdb',
+  :ref => '2ed2a2df59bbeaf9cf628e1a4a499476842282fd'
+
+mod 'rabbitmq',
+  :git => 'https://github.com/voxpupuli/puppet-rabbitmq',
+  :ref => 'v14.3.0'
+
+mod 'redis',
+  :git => 'https://github.com/voxpupuli/puppet-redis',
+  :ref => 'v11.1.0'
+
+mod 'remote',
+  :git => 'https://github.com/paramite/puppet-remote',
+  :ref => '7420908328b832f4b20e1eba44bcccd926da8faa'
+
+mod 'rsync',
+  :git => 'https://github.com/puppetlabs/puppetlabs-rsync',
+  :ref => '1.2.0'
+
+mod 'stdlib',
+  :git => 'https://github.com/puppetlabs/puppetlabs-stdlib',
+  :ref => 'v9.7.0'
+
+mod 'sysctl',
+  :git => 'https://github.com/duritong/puppet-sysctl',
+  :ref => '847ec1c07ed3e231a48d8816971c0bd4afe7a72b'
+
+mod 'systemd',
+  :git => 'https://github.com/voxpupuli/puppet-systemd',
+  :ref => 'v8.2.0'
+
+mod 'vcsrepo',
+  :git => 'https://github.com/puppetlabs/puppetlabs-vcsrepo',
+  :ref => 'v7.0.0'
+
+mod 'xinetd',
+  :git => 'https://github.com/puppetlabs/puppetlabs-xinetd',
+  :ref => 'v3.4.1'
+
diff --git a/README b/README
deleted file mode 100644
index a571c1d2e..000000000
--- a/README
+++ /dev/null
@@ -1,59 +0,0 @@
-Utility to install OpenStack on Red Hat based operating system.
-See other branches for older openstack versions
-
-This utility can be used to install openstack on a single or
-group of hosts (over ssh)
-
-This utility is still in the early stages, a lot of the configuration
-options have yet to be added
-
-Installation
-$ yum install -y git
-$ git clone --recursive git://github.com/stackforge/packstack.git
-$ cd packstack
-
-Option 1 (using answer file)
-$ ./bin/packstack --gen-answer-file=ans.txt
-
-# then edit ans.txt as appropriate e.g.
-o set CONFIG_SSH_KEY to a public ssh key to be installed to remote machines
-o Edit the IP address to anywhere you want to install a piece of openstack on another server
-o Edit the 3 network interfaces to whatever makes sense in your setup
-
-you'll need to use a icehouse repository for example for RHEL
-CONFIG_REPO=http://repos.fedorapeople.org/repos/openstack/openstack-icehouse/epel-6/
-
-
-$ ./bin/packstack --answer-file=ans.txt
-
-Option 2 (prompts for configuration options)
-$ ./bin/packstack
-
-that's it, if everything went well you can now start using openstack
-$ cd
-$ . keystonerc_admin
-$ nova list
-$ swift list  # if you have installed swift
-
-
-Config options
-CONFIG_NOVA_COMPUTE_HOSTS :
-        a comma seperated list of ip addresses on which to install nova compute
-CONFIG_SWIFT_STORAGE_HOSTS :
-        a comma seperate list of swift storage devices
-        1.1.1.1  : create a testing loopback device and use this for storage
-        1.1.1.1/sdb : use /dev/sdb on 1.1.1.1 as a storage device
-
-Logging
-
-The location of the log files and generated puppet manifests are in the
-/var/tmp/packstack directory under a directory named by the date in which
-packstack was run and a random string (e.g. /var/tmp/packstack/20131022-204316-Bf3Ek2).
-Inside, we find a manifest directory and the openstack-setup.log file; puppet
-manifests and a log file for each one are found inside the manifest directory.
-
-Debugging
-
-To make packstack write more detailed information into the log file you can use the -d switch:
-
-$ packstack -d --allinone
diff --git a/README.rst b/README.rst
new file mode 100644
index 000000000..9e1ae842c
--- /dev/null
+++ b/README.rst
@@ -0,0 +1,293 @@
+Packstack
+=========
+
+Utility to install **OpenStack** on **Red Hat** based operating system.
+See other branches for older **OpenStack** versions. Details on how to
+contribute to **Packstack** may be found in the **Packstack** wiki at
+https://wiki.openstack.org/wiki/Packstack Additional information about
+involvement in the community around **Packstack** can be found at
+https://openstack.redhat.com/Get_involved
+
+This utility can be used to install **OpenStack** on a single or group
+of hosts (over ``ssh``).
+
+This utility is still in the early stages, a lot of the configuration
+options have yet to be added.
+
+Installation of packstack:
+--------------------------
+
+::
+
+   $ yum install -y git
+   $ git clone git://github.com/openstack/packstack.git
+   $ cd packstack && sudo python setup.py install
+
+Installation of Puppet modules (REQUIRED if running packstack from source):
+---------------------------------------------------------------------------
+
+::
+
+   $ export GEM_HOME=/tmp/somedir
+   $ gem install r10k
+   $ sudo -E /tmp/somedir/bin/r10k puppetfile install -v
+   $ sudo cp -r packstack/puppet/modules/packstack /usr/share/openstack-puppet/modules
+
+Option 1 (all-in-one)
+~~~~~~~~~~~~~~~~~~~~~
+
+::
+
+   $ packstack --allinone
+
+This will install all **OpenStack** services on a single host without
+prompting for any configuration information. This will generate an
+“answers” file (``packstack-answers-<date>-<time>.txt``) containing all
+the values used for the install.
+
+If you need to re-run packstack, you must use the ``--answer-file``
+option in order for packstack to use the correct values for passwords
+and other authentication credentials:
+
+::
+
+   $ packstack --answer-file packstack-answers-<date>-<time>.txt
+
+Option 2 (using answer file)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+::
+
+   $ packstack --gen-answer-file=ans.txt
+
+Then edit ``ans.txt`` as appropriate e.g.
+
+-  set ``CONFIG_SSH_KEY`` to a public ssh key to be installed to remote
+   machines
+-  Edit the IP address to anywhere you want to install a piece of
+   OpenStack on another server
+-  Edit the 3 network interfaces to whatever makes sense in your setup
+
+   $ packstack –answer-file=ans.txt
+
+Option 3 (prompts for configuration options)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+::
+
+   $ packstack
+
+that’s it, if everything went well you can now start using OpenStack
+
+::
+
+   $ cd
+   $ . keystonerc_admin
+   $ nova list
+   $ swift list  # if you have installed swift
+
+Config options
+--------------
+
+-  ``CONFIG_NOVA_COMPUTE_HOSTS`` :
+
+   -  A comma separated list of ip addresses on which to install nova
+      compute
+
+-  ``CONFIG_SWIFT_STORAGE_HOSTS`` :
+
+   -  A comma separated list of swift storage devices
+
+      -  ``1.1.1.1``: create a testing loopback device and use this for
+         storage
+      -  ``1.1.1.1/sdb``: use ``/dev/sdb`` on ``1.1.1.1`` as a storage
+         device
+
+Logging
+-------
+
+The location of the log files and generated puppet manifests are in the
+``/var/tmp/packstack`` directory under a directory named by the date in
+which **Packstack** was run and a random string
+(e.g. ``/var/tmp/packstack/20131022-204316-Bf3Ek2``). Inside, we find a
+manifest directory and the ``openstack-setup.log`` file; puppet
+manifests and a log file for each one are found inside the manifest
+directory.
+
+Debugging
+---------
+
+To make **Packstack** write more detailed information into the log file
+you can use the ``-d`` switch:
+
+::
+
+   $ packstack -d --allinone
+
+When upgrading to a new OpenStack release and reusing old answerfile it
+is useful to know if any **Packstack** option was removed. If answerfile
+is written by hand it is possible to make a mistake. The
+``--validate-answer-file`` switch allows checking if any provided option
+is not recognized by **Packstack**.
+
+::
+
+   $ packstack --validate-answer-file=ans.txt
+
+Developing
+----------
+
+To ease development of **Packstack**, it can be useful to install from
+*git* such that updates to the git repositories are immediately
+effective without reinstallation.
+
+To do this, start with a minimal **CentOS 7** installation. Then remove
+any relevant packages that might conflict:
+
+::
+
+   $ yum -y erase openstack-packstack*,puppet-*
+
+Disable **SELinux** by changing “``enforcing``” to “``permissive``” in
+``/etc/sysconfig/selinux``, then reboot to allow service changes to take
+effect and swap over networking. Then install packages:
+
+::
+
+   $ yum -y install git python-setuptools
+
+And install **RDO**:
+
+::
+
+   $ yum -y install https://www.rdoproject.org/repos/rdo-release.rpm
+   $ yum -y update
+
+Install Puppet modules as described
+`above <README.md#installation-of-puppet-modules-required-if-running-packstack-from-source>`__.
+
+Then we get **Packstack**:
+
+::
+
+   $ yum install -y python-crypto python-devel libffi-devel openssl-devel gcc-c++
+   $ git clone https://github.com/openstack/packstack
+   $ cd packstack
+   $ python setup.py develop
+
+And we’re done. Changes to the contents of **Packstack** source
+repository are picked up by the **Packstack** executable without further
+intervention, and **Packstack** is ready to install.
+
+Puppet Style Guide
+------------------
+
+**IMPORTANT** https://docs.puppetlabs.com/guides/style_guide.html
+
+Please, respect the Puppet Style Guide as much as possible !
+
+Running local Puppet-lint tests
+-------------------------------
+
+It assumes that both ``bundler`` as well as ``rubygems`` (and ``ruby``)
+are already installed on the system. If not, run this command:
+
+::
+
+   $ sudo yum install rubygems rubygem-bundler ruby ruby-devel -y
+
+Go into the **Packstack** root directory.
+
+::
+
+   $ cd packstack/
+
+A ``Rakefile`` contains all you need to run puppet-lint task
+automatically over all the puppet manifests included in the
+**Packstack** project.
+
+::
+
+   $ ls -l packstack/puppet/templates/
+
+and
+
+::
+
+   $ ls -l packstack/puppet/modules/
+
+The default puppet-lint pattern for ``.pp`` files is ``**/*.pp``. So
+there is no need to go inside those directories to run puppet-lint !
+
+::
+
+   $ mkdir vendor
+   $ export GEM_HOME=vendor
+   $ bundle install
+   $ bundle exec rake lint
+
+Packstack integration tests
+---------------------------
+
+Packstack is integration tested in the OpenStack gate and provides the
+means to reproduce these tests on your environment if you wish.
+
+Scenario000 installs packstack allinone only and doesn’t run any tests.
+This is the current matrix of available tests:
+
+============== =========== =========== =========== ===========
+-              scenario000 scenario001 scenario002 scenario003
+============== =========== =========== =========== ===========
+keystone       FERNET      FERNET      FERNET      FERNET
+glance                     file        swift       file
+nova           X           X           X           X
+neutron        X           X           X           X
+neutron plugin ovn         ovn         ovs         ovn
+vpnaas                                            
+cinder         X           X                      
+ceilometer     X                                   X
+aodh           X                                   X
+gnocchi        X                                   X
+heat                                               X
+swift          X                       X          
+trove                                  X          
+horizon                    X                      
+manila                     X                      
+SSL                        X                      
+============== =========== =========== =========== ===========
+
+To run these tests:
+
+::
+
+   export SCENARIO="scenario001"
+   ./run_tests.sh
+
+run_tests.sh will take care of installing the required dependencies,
+configure packstack to run according to the above matrix and run the
+complete installation process. If the installation is successful,
+tempest will also run smoke tests.
+
+By default, run_tests.sh will set up delorean (RDO Trunk) repositories.
+There are two ways of overriding default repositories:
+
+::
+
+   export DELOREAN="http://someotherdomain.tld/delorean.repo"
+   export DELOREAN_DEPS="http://someotherdomain.tld/delorean-deps.repo"
+   ./run_tests.sh
+
+You can also choose to disable repository management entirely:
+
+::
+
+   <setup your own custom repositories here>
+   export MANAGE_REPOS="false"
+   ./run_tests.sh
+
+Reporting Bugs
+--------------
+
+Bugs for packstack are tracked in the "packstack" component of the [RDO Jira board](https://issues.redhat.com/issues/?jql=project+%3D+RDO+AND+component+%3D+packstack).
+If you find issues, you can create an issue on that board and provide the relevant information to describe your problem.
+
diff --git a/Rakefile b/Rakefile
new file mode 100644
index 000000000..6ff42650e
--- /dev/null
+++ b/Rakefile
@@ -0,0 +1,29 @@
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+require 'puppet-syntax/tasks/puppet-syntax'
+
+PuppetLint.configuration.relative = true
+PuppetLint.configuration.log_format = "%{path}:%{linenumber}:%{check}:%{KIND}:%{message}"
+PuppetLint.configuration.fail_on_warnings = true
+PuppetLint.configuration.send('disable_class_parameter_defaults')
+PuppetLint.configuration.send('disable_class_inherits_from_params_class')
+PuppetLint.configuration.send('disable_80chars')
+PuppetLint.configuration.send('disable_containing_dash')
+PuppetLint.configuration.send('disable_quoted_booleans')
+PuppetLint.configuration.send('disable_documentation')
+
+exclude_paths = [
+"pkg/**/*",
+"vendor/**/*",
+"spec/**/*",
+]
+
+Rake::Task[:lint].clear
+PuppetLint.configuration.ignore_paths = exclude_paths
+PuppetSyntax.exclude_paths = exclude_paths
+
+desc "Run syntax, lint"
+task :test => [
+  :syntax,
+  :lint,
+]
diff --git a/bin/packstack b/bin/packstack
deleted file mode 100755
index 102778f24..000000000
--- a/bin/packstack
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/usr/bin/env python
-
-import os, sys
-
-try:
-    import packstack
-except ImportError:
-    # packstack isn't installed, running from source checkout
-    sys.path.insert(0, os.path.join(os.path.split(sys.argv[0])[0], ".."))
-    import packstack
-
-os.environ["INSTALLER_PROJECT_DIR"] = os.path.abspath(os.path.split(packstack.__file__)[0])
-
-from packstack.installer import run_setup
-run_setup.main()
diff --git a/bin/release.sh b/bin/release.sh
deleted file mode 100755
index 29502bd3b..000000000
--- a/bin/release.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-#
-
-git reset --hard
-git submodule sync
-git submodule update --init
-git status -s | grep "." && ( echo "Contains unknown files" ; exit 1 )
-
-if [ "$1" = "release" ] ; then
-    sed -i -e 's/FINAL=False/FINAL=True/g' packstack/version.py
-    SNAPTAG=""
-else
-    SNAPTAG=$(git log --oneline | wc -l)
-    sed -i -e "s/SNAPTAG=None/SNAPTAG=${SNAPTAG}/g" packstack/version.py
-fi
-
-python setup.py setopt -o tag_build -s "$SNAPTAG" -c egg_info
-python setup.py sdist
-git checkout packstack/version.py
diff --git a/bindep.txt b/bindep.txt
new file mode 100644
index 000000000..19c728b56
--- /dev/null
+++ b/bindep.txt
@@ -0,0 +1,5 @@
+libffi-dev [platform:dpkg]
+libffi-devel [platform:rpm]
+libssl-dev [platform:dpkg]
+openssl-devel [platform:rpm]
+
diff --git a/docs/packstack.rst b/docs/packstack.rst
deleted file mode 100644
index a4a42f241..000000000
--- a/docs/packstack.rst
+++ /dev/null
@@ -1,366 +0,0 @@
-==============
-Packstack
-==============
-
-SYNOPSIS
-========
-
-  packstack [options]
-
-DESCRIPTION
-===========
-  Packstack is a utility that uses uses puppet modules to install OpenStack. It can be used to install each openstack service on separate servers, all on one server or any combination of these. There are 3 ways that Packstack can be run.
-- packstack
-- packstack [options]
-- packstack --gen-answer-file=<file>  / packstack --answer-file=<file>
-
-  The third option allows the user to generate a default answer file, edit the default options and finally run Packstack a second time using this answer file. This is the easiest way to run Packstack and the one that will be documented here. When <file> is created the OPTIONS below will be contained and can be edited by the user.
-
-OPTIONS
-=======
-
-Global Options
---------------
-
-**CONFIG_GLANCE_INSTALL**      : Set to 'y' if you would like Packstack to install Glance ['y', 'n'].
-
-**CONFIG_CINDER_INSTALL**      : Set to 'y' if you would like Packstack to install Cinder ['y', 'n'].
-
-**CONFIG_NOVA_INSTALL**        : Set to 'y' if you would like Packstack to install Nova ['y', 'n'].
-
-**CONFIG_HORIZON_INSTALL**     : Set to 'y' if you would like Packstack to install Horizon ['y', 'n'].
-
-**CONFIG_SWIFT_INSTALL**       : Set to 'y' if you would like Packstack to install Swift ['y', 'n'].
-
-**CONFIG_CLIENT_INSTALL**      : Set to 'y' if you would like Packstack to install the OpenStack Client packages. An admin "rc" file will also be installed ['y', 'n'].
-
-**CONFIG_NTP_SERVERS**         : Comma separated list of NTP servers. Leave plain if Packstack should not install ntpd on instances..
-
-**CONFIG_NAGIOS_INSTALL**      : Set to 'y' if you would like Packstack to install Nagios to monitor openstack hosts ['y', 'n'].
-
-**CONFIG_CEILOMETER_INSTALL** : Set to 'y' if you would like Packstack to install OpenStack Metering (Ceilometer).
-
-**CONFIG_HEAT_INSTALL**       : Set to 'y' if you would like Packstack to install OpenStack Orchestration (Heat).
-
-**CONFIG_NEUTRON_INSTALL**    : Set to 'y' if you would like Packstack to install OpenStack Networking (Neutron).
-
-**CONFIG_MYSQL_INSTALL**      : Set to 'y' if you would like Packstack to install MySQL.
-
-
-SSH Configs
-------------
-
-**CONFIG_SSH_KEY**             : Path to a Public key to install on servers. If a usable key has not been installed on the remote servers the user will be prompted for a password and this key will be installed so the password will not be required again.
-
-MySQL Config parameters
------------------------
-
-**CONFIG_MYSQL_HOST**          : The IP address of the server on which to install MySQL.
-
-**CONFIG_MYSQL_USER**          : Username for the MySQL admin user.
-
-**CONFIG_MYSQL_PW**            : Password for the MySQL admin user.
-
-QPID Config parameters
-----------------------
-
-**CONFIG_QPID_HOST**            : The IP address of the server on which to install the QPID service.
-
-**CONFIG_QPID_ENABLE_SSL**      : Enable SSL for the QPID service.
-
-**CONFIG_QPID_NSS_CERTDB_PW**   : The password for the NSS certificate database of the QPID service.
-
-**CONFIG_QPID_SSL_PORT**        : The port in which the QPID service listens to SSL connections.
-
-**CONFIG_QPID_SSL_CERT_FILE**   : The filename of the certificate that the QPID service is going to use.
-
-**CONFIG_QPID_SSL_KEY_FILE**    : The filename of the private key that the QPID service is going to use.
-
-**CONFIG_QPID_SSL_SELF_SIGNED** : Auto Generates self signed SSL certificate and key.
-
-Keystone Config parameters
---------------------------
-
-**CONFIG_KEYSTONE_HOST**       : The IP address of the server on which to install Keystone.
-
-**CONFIG_KEYSTONE_DB_PW**      : The password to use for the Keystone to access DB.
-
-**CONFIG_KEYSTONE_ADMIN_TOKEN** : The token to use for the Keystone service api.
-
-**CONFIG_KEYSTONE_ADMIN_PW**   : The password to use for the Keystone admin user.
-
-**CONFIG_KEYSTONE_DEMO_PW**    : The password to use for the Keystone demo user
-
-**CONFIG_KEYSTONE_TOKEN_FORMAT**    : Kestone token format. Use either UUID or PKI
-
-Glance Config parameters
-------------------------
-
-**CONFIG_GLANCE_HOST**         : The IP address of the server on which to install Glance.
-
-**CONFIG_GLANCE_DB_PW**        : The password to use for the Glance to access DB.
-
-**CONFIG_GLANCE_KS_PW**        : The password to use for the Glance to authenticate with Keystone.
-
-Cinder Config parameters
-------------------------
-
-**CONFIG_CINDER_HOST**         : The IP address of the server on which to install Cinder.
-
-**CONFIG_CINDER_DB_PW**        : The password to use for the Cinder to access DB.
-
-**CONFIG_CINDER_KS_PW**        : The password to use for the Cinder to authenticate with Keystone.
-
-**CONFIG_CINDER_BACKEND**      : The Cinder backend to use ['lvm', 'gluster', 'nfs'].
-
-Cinder volume create Config parameters
---------------------------------------
-
-**CONFIG_CINDER_VOLUMES_CREATE** : Create Cinder's volumes group ['y', 'n'].
-
-Cinder volume size Config parameters
-------------------------------------
-
-**CONFIG_CINDER_VOLUMES_SIZE** : Cinder's volumes group size.
-
-Cinder gluster Config parameters
---------------------------------
-
-**CONFIG_CINDER_GLUSTER_MOUNTS** : A single or comma separated list of gluster volume shares.
-
-Cinder NFS Config parameters
-----------------------------
-
-**CONFIG_CINDER_NFS_MOUNTS**   : A single or comma seprated list of NFS exports to mount.
-
-Nova Options
-------------
-
-**CONFIG_NOVA_API_HOST**       : The IP address of the server on which to install the Nova API service.
-
-**CONFIG_NOVA_CERT_HOST**      : The IP address of the server on which to install the Nova Cert service.
-
-**CONFIG_NOVA_VNCPROXY_HOST**  : The IP address of the server on which to install the Nova VNC proxy.
-
-**CONFIG_NOVA_COMPUTE_HOSTS**  : A comma separated list of IP addresses on which to install the Nova Compute services.
-
-**CONFIG_NOVA_COMPUTE_PRIVIF** : Private interface for Flat DHCP on the Nova compute servers.
-
-**CONFIG_NOVA_NETWORK_HOSTS**  : List of IP address of the servers on which to install the Nova Network service.
-
-**CONFIG_NOVA_DB_PW**          : The password to use for the Nova to access DB.
-
-**CONFIG_NOVA_KS_PW**          : The password to use for the Nova to authenticate with Keystone.
-
-**CONFIG_NOVA_NETWORK_PUBIF**  : Public interface on the Nova network server.
-
-**CONFIG_NOVA_NETWORK_PRIVIF** : Private interface for Flat DHCP on the Nova network server.
-
-**CONFIG_NOVA_NETWORK_FIXEDRANGE** : IP Range for Flat DHCP ['^([\\d]{1,3}\\.){3}[\\d]{1,3}/\\d\\d?$'].
-
-**CONFIG_NOVA_NETWORK_FLOATRANGE** : IP Range for Floating IP's ['^([\\d]{1,3}\\.){3}[\\d]{1,3}/\\d\\d?$'].
-
-**CONFIG_NOVA_SCHED_HOST**     : The IP address of the server on which to install the Nova Scheduler service.
-
-**CONFIG_NOVA_SCHED_CPU_ALLOC_RATIO** : The overcommitment ratio for virtual to physical CPUs. Set to 1.0 to disable CPU overcommitment.
-
-**CONFIG_NOVA_SCHED_RAM_ALLOC_RATIO** : The overcommitment ratio for virtual to physical RAM. Set to 1.0 to disable RAM overcommitment.
-
-**CONFIG_NOVA_CONDUCTOR_HOST**    : The IP address of the server on which to install the Nova Conductor service.
-
-**CONFIG_NOVA_NETWORK_AUTOASSIGNFLOATINGIP**    : Automatically assign a floating IP to new instances.
-
-**CONFIG_NOVA_NETWORK_DEFAULTFLOATINGPOOL**    : Name of the default floating pool to which the specified floating ranges are added to.
-
-**CONFIG_NOVA_NETWORK_MANAGER**   : Nova network manager.
-
-**CONFIG_NOVA_NETWORK_NUMBER**    : Number of networks to support.
-
-**CONFIG_NOVA_NETWORK_SIZE**      : Number of addresses in each private subnet.
-
-**CONFIG_NOVA_NETWORK_VLAN_START**    : First VLAN for private networks.
-
-NOVACLIENT Config parameters
-----------------------------
-
-**CONFIG_OSCLIENT_HOST**       : The IP address of the server on which to install the OpenStack client packages. An admin "rc" file will also be installed.
-
-OpenStack Horizon Config parameters
------------------------------------
-
-**CONFIG_HORIZON_HOST**        : The IP address of the server on which to install Horizon.
-
-**CONFIG_HORIZON_SSL**         : To set up Horizon communication over https set this to "y" ['y', 'n'].
-
-**CONFIG_SSL_CERT**    : PEM encoded certificate to be used for ssl on the https server, leave blank if one should be generated, this certificate should not require a passphrase.
-
-**CONFIG_SSL_KEY**    : Keyfile corresponding to the certificate if one was entered.
-
-OpenStack Swift Config parameters
----------------------------------
-
-**CONFIG_SWIFT_PROXY_HOSTS**   : The IP address on which to install the Swift proxy service.
-
-**CONFIG_SWIFT_KS_PW**         : The password to use for the Swift to authenticate with Keystone.
-
-**CONFIG_SWIFT_STORAGE_HOSTS** : A comma separated list of IP addresses on which to install the Swift Storage services, each entry should take the format <ipaddress>[/dev], for example 127.0.0.1/vdb will install /dev/vdb on 127.0.0.1 as a swift storage device(packstack does not create the filesystem, you must do this first), if /dev is omitted Packstack will create a loopback device for a test setup.
-
-**CONFIG_SWIFT_STORAGE_ZONES** : Number of swift storage zones, this number MUST be no bigger than the number of storage devices configured.
-
-**CONFIG_SWIFT_STORAGE_REPLICAS** : Number of swift storage replicas, this number MUST be no bigger than the number of storage zones configured.
-
-**CONFIG_SWIFT_STORAGE_FSTYPE** : FileSystem type for storage nodes ['xfs', 'ext4'].
-
-**CONFIG_SWIFT_HASH**    : Shared secret for Swift.
-
-Server Prepare Configs
------------------------
-
-**CONFIG_USE_EPEL**            : Install OpenStack from EPEL. If set to "y" EPEL will be installed on each server ['y', 'n'].
-
-**CONFIG_REPO**                : A comma separated list of URLs to any additional yum repositories to install.
-
-**CONFIG_RH_USER**             : To subscribe each server with Red Hat subscription manager, include this with CONFIG_RH_PW.
-
-**CONFIG_RH_PW**               : To subscribe each server with Red Hat subscription manager, include this with CONFIG_RH_USER.
-
-**CONFIG_RH_BETA_REPO**        : To subscribe each server with Red Hat subscription manager, to Red Hat Beta RPM's ['y', 'n'].
-
-**CONFIG_SATELLITE_URL**       : To subscribe each server with RHN Satellite,fill Satellite's URL here. Note that either satellite's username/password or activation key has to be provided.
-
-RHN Satellite config
---------------------
-
-**CONFIG_SATELLITE_USER**      : Username to access RHN Satellite.
-
-**CONFIG_SATELLITE_PW**        : Password to access RHN Satellite.
-
-**CONFIG_SATELLITE_AKEY**      : Activation key for subscription to RHN Satellite.
-
-**CONFIG_SATELLITE_CACERT**    : Specify a path or URL to a SSL CA certificate to use.
-
-**CONFIG_SATELLITE_PROFILE**   : If required specify the profile name that should be used as an identifier for the system in RHN Satellite.
-
-**CONFIG_SATELLITE_FLAGS**     : Comma separated list of flags passed to rhnreg_ks. Valid flags are: novirtinfo, norhnsd, nopackages ['novirtinfo', 'norhnsd', 'nopackages'].
-
-**CONFIG_SATELLITE_PROXY**     : Specify a HTTP proxy to use with RHN Satellite.
-
-RHN Satellite proxy config
---------------------------
-
-**CONFIG_SATELLITE_PROXY_USER** : Specify a username to use with an authenticated HTTP proxy.
-
-**CONFIG_SATELLITE_PROXY_PW**  : Specify a password to use with an authenticated HTTP proxy.
-
-Nagios Config parameters
-------------------------
-
-**CONFIG_NAGIOS_HOST**         : The IP address of the server on which to install the Nagios server.
-
-**CONFIG_NAGIOS_PW**           : The password of the nagiosadmin user on the Nagios server.
-
-Ceilometer Config Parameters
-------------------------
-
-**CONFIG_CEILOMETER_HOST**     : The IP address of the server on which to install Ceilometer.
-
-**CONFIG_CEILOMETER_SECRET**   : Secret key for signing metering messages.
-
-**CONFIG_CEILOMETER_KS_PW**    : The password to use for Ceilometer to authenticate with Keystone.
-
-Heat Config Parameters
-------------------------
-
-**CONFIG_HEAT_HOST**               : The IP address of the server on which to install Heat service.
-
-**CONFIG_HEAT_DB_PW**              : The password used by Heat user to authenticate against MySQL.
-
-**CONFIG_HEAT_KS_PW**              : The password to use for the Heat to authenticate with Keystone.
-
-**CONFIG_HEAT_CLOUDWATCH_INSTALL** : Set to 'y' if you would like Packstack to install Heat CloudWatch API.
-
-**CONFIG_HEAT_CFN_INSTALL**        : Set to 'y' if you would like Packstack to install Heat CloudFormation API.
-
-**CONFIG_HEAT_CLOUDWATCH_HOST**    : The IP address of the server on which to install Heat CloudWatch API service.
-
-**CONFIG_HEAT_CFN_HOST**           : The IP address of the server on which to install Heat CloudFormation API.
-
-Neutron Config Parameters.
-------------------------
-
-**CONFIG_NEUTRON_SERVER_HOST**            : The IP addresses of the server on which to install the Neutron server.
-
-**CONFIG_NEUTRON_KS_PW**                  : The password to use for Neutron to authenticate with Keystone.
-
-**CONFIG_NEUTRON_DB_PW**                  : The password to use for Neutron to access DB.
-
-**CONFIG_NEUTRON_L3_HOSTS**               : A comma separated list of IP addresses on which to install Neutron L3 agent.
-
-**CONFIG_NEUTRON_L3_EXT_BRIDGE**          : The name of the bridge that the Neutron L3 agent will use for external traffic, or 'provider' if using provider networks.
-
-**CONFIG_NEUTRON_DHCP_HOSTS**             : A comma separated list of IP addresses on which to install Neutron DHCP agent.
-
-**CONFIG_NEUTRON_L2_PLUGIN**              : The name of the L2 plugin to be used with Neutron.
-
-**CONFIG_NEUTRON_METADATA_HOSTS**         : A comma separated list of IP addresses on which to install Neutron metadata agent.
-
-**CONFIG_NEUTRON_METADATA_PW**            : A comma separated list of IP addresses on which to install Neutron metadata agent.
-
-**CONFIG_NEUTRON_LB_TENANT_NETWORK_TYPE** : The type of network to allocate for tenant networks (eg. vlan, local, gre).
-
-**CONFIG_NEUTRON_LB_VLAN_RANGES**         : A comma separated list of VLAN ranges for the Neutron linuxbridge plugin (eg. physnet1:1:4094,physnet2,physnet3:3000:3999).
-
-**CONFIG_NEUTRON_LB_INTERFACE_MAPPINGS**  : A comma separated list of interface mappings for the Neutron linuxbridge plugin (eg. physnet1:br-eth1,physnet2:br-eth2,physnet3:br-eth3).
-
-**CONFIG_NEUTRON_OVS_TENANT_NETWORK_TYPE**          : Type of network to allocate for tenant networks (eg. vlan, local, gre).
-
-**CONFIG_NEUTRON_OVS_VLAN_RANGES**          : A comma separated list of VLAN ranges for the Neutron openvswitch plugin (eg. physnet1:1:4094,physnet2,physnet3:3000:3999).
-
-**CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS**          : A comma separated list of bridge mappings for the Neutron openvswitch plugin (eg. physnet1:br-eth1,physnet2:br-eth2,physnet3:br-eth3).
-
-**CONFIG_NEUTRON_OVS_BRIDGE_IFACES**          : A comma separated list of colon-separated OVS brid.
-
-**CONFIG_NEUTRON_OVS_TUNNEL_RANGES**          : A comma separated list of tunnel ranges for the Neutron openvswitch plugin.
-
-**CONFIG_NEUTRON_OVS_TUNNEL_IF**          : Override the IP used for GRE tunnels on this hypervisor to the IP found on the specified interface (defaults to the HOST IP).
-
-
-Provision Config Parameters.
-------------------------
-**CONFIG_PROVISION_ALL_IN_ONE_OVS_BRIDGE**    : Whether to configure the ovs external bridge in an all-in-one deployment.
-
-**CONFIG_PROVISION_DEMO**    : Whether to provision for demo usage and testing.
-
-**CONFIG_PROVISION_DEMO_FLOATRANGE**    : The CIDR network address for the floating IP subnet.
-
-**CONFIG_PROVISION_TEMPEST**    : Whether to configure tempest for testing.
-
-**CONFIG_PROVISION_TEMPEST_REPO_REVISION**    : The revision of the tempest git repository to use.
-
-**CONFIG_PROVISION_TEMPEST_REPO_URI**    : The uri of the tempest git repository to use.
-
-
-Log files and Debug info
-------------------------
-
-The location of the log files and generated puppet manifests are in the /var/tmp/packstack directory under a directory named by the date in which packstack was run and a random string (e.g. /var/tmp/packstack/20131022-204316-Bf3Ek2). Inside, we find a manifest directory and the openstack-setup.log file; puppet manifests and a log file for each one are found inside the manifest directory.
-
-In case debugging info is needed while running packstack the -d switch will make it write more detailed information about the installation.
-
-Examples:
-
-If we need an allinone debug session:
-
-packstack -d --allinone
-
-If we need a answer file to tailor it and then debug:
-
-packstack --gen-answer-file=ans.txt
-packstack -d --answer-file=ans.txt
-
-
-SOURCE
-======
-* `packstack      https://github.com/stackforge/packstack`
-* `puppet modules https://github.com/puppetlabs and https://github.com/packstack`
-
diff --git a/docs/conf.py b/docs/source/conf.py
similarity index 73%
rename from docs/conf.py
rename to docs/source/conf.py
index 938dcdad2..39f72ebe6 100644
--- a/docs/conf.py
+++ b/docs/source/conf.py
@@ -1,5 +1,17 @@
 # -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
 #
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # packstack documentation build configuration file, created by
 # sphinx-quickstart on Thu Nov 15 20:34:41 2012.
 #
@@ -11,24 +23,25 @@
 # All configuration values have a default; values that are commented out
 # serve to show the default.
 
-import sys, os
+import sys
+
+from packstack.version import version_info
 
 sys.path.append('..')
-from packstack import version as packstackversion
 
 # If extensions (or modules to document with autodoc) are in another directory,
 # add these directories to sys.path here. If the directory is relative to the
 # documentation root, use os.path.abspath to make it absolute, like shown here.
-#sys.path.insert(0, os.path.abspath('.'))
+# sys.path.insert(0, os.path.abspath('.'))
 
 # -- General configuration -----------------------------------------------------
 
 # If your documentation needs a minimal Sphinx version, state it here.
-#needs_sphinx = '1.0'
+# needs_sphinx = '1.0'
 
 # Add any Sphinx extension module names here, as strings. They can be extensions
 # coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = []
+extensions = ['sphinx.ext.autodoc']
 
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']
@@ -37,10 +50,10 @@
 source_suffix = '.rst'
 
 # The encoding of source files.
-#source_encoding = 'utf-8-sig'
+# source_encoding = 'utf-8-sig'
 
 # The master toctree document.
-master_doc = 'index'
+master_doc = 'packstack'
 
 # General information about the project.
 project = u'packstack'
@@ -51,43 +64,43 @@
 # built documents.
 #
 # The short X.Y version.
-version = packstackversion.version_string()
+version = version_info.version_string()
 # The full version, including alpha/beta/rc tags.
-release = version
+release = version_info.release_string()
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
-#language = None
+# language = None
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:
-#today = ''
+# today = ''
 # Else, today_fmt is used as the format for a strftime call.
-#today_fmt = '%B %d, %Y'
+# today_fmt = '%B %d, %Y'
 
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
 exclude_patterns = ['_build']
 
 # The reST default role (used for this markup: `text`) to use for all documents.
-#default_role = None
+# default_role = None
 
 # If true, '()' will be appended to :func: etc. cross-reference text.
-#add_function_parentheses = True
+# add_function_parentheses = True
 
 # If true, the current module name will be prepended to all description
 # unit titles (such as .. function::).
-#add_module_names = True
+# add_module_names = True
 
 # If true, sectionauthor and moduleauthor directives will be shown in the
 # output. They are ignored by default.
-#show_authors = False
+# show_authors = False
 
 # The name of the Pygments (syntax highlighting) style to use.
 pygments_style = 'sphinx'
 
 # A list of ignored prefixes for module index sorting.
-#modindex_common_prefix = []
+# modindex_common_prefix = []
 
 
 # -- Options for HTML output ---------------------------------------------------
@@ -99,72 +112,72 @@
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
 # documentation.
-#html_theme_options = {}
+# html_theme_options = {}
 
 # Add any paths that contain custom themes here, relative to this directory.
-#html_theme_path = []
+# html_theme_path = []
 
 # The name for this set of Sphinx documents.  If None, it defaults to
 # "<project> v<release> documentation".
-#html_title = None
+# html_title = None
 
 # A shorter title for the navigation bar.  Default is the same as html_title.
-#html_short_title = None
+# html_short_title = None
 
 # The name of an image file (relative to this directory) to place at the top
 # of the sidebar.
-#html_logo = None
+# html_logo = None
 
 # The name of an image file (within the static path) to use as favicon of the
 # docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
 # pixels large.
-#html_favicon = None
+# html_favicon = None
 
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
-html_static_path = ['_static']
+html_static_path = []
 
 # If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
 # using the given strftime format.
-#html_last_updated_fmt = '%b %d, %Y'
+# html_last_updated_fmt = '%b %d, %Y'
 
 # If true, SmartyPants will be used to convert quotes and dashes to
 # typographically correct entities.
-#html_use_smartypants = True
+# html_use_smartypants = True
 
 # Custom sidebar templates, maps document names to template names.
-#html_sidebars = {}
+# html_sidebars = {}
 
 # Additional templates that should be rendered to pages, maps page names to
 # template names.
-#html_additional_pages = {}
+# html_additional_pages = {}
 
 # If false, no module index is generated.
-#html_domain_indices = True
+# html_domain_indices = True
 
 # If false, no index is generated.
-#html_use_index = True
+# html_use_index = True
 
 # If true, the index is split into individual pages for each letter.
-#html_split_index = False
+# html_split_index = False
 
 # If true, links to the reST sources are added to the pages.
-#html_show_sourcelink = True
+# html_show_sourcelink = True
 
 # If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
-#html_show_sphinx = True
+# html_show_sphinx = True
 
 # If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
-#html_show_copyright = True
+# html_show_copyright = True
 
 # If true, an OpenSearch description file will be output, and all pages will
 # contain a <link> tag referring to it.  The value of this option must be the
 # base URL from which the finished HTML is served.
-#html_use_opensearch = ''
+# html_use_opensearch = ''
 
 # This is the file name suffix for HTML files (e.g. ".xhtml").
-#html_file_suffix = None
+# html_file_suffix = None
 
 # Output file base name for HTML help builder.
 htmlhelp_basename = 'packstackdoc'
@@ -173,41 +186,41 @@
 # -- Options for LaTeX output --------------------------------------------------
 
 latex_elements = {
-# The paper size ('letterpaper' or 'a4paper').
-#'papersize': 'letterpaper',
+    # The paper size ('letterpaper' or 'a4paper').
+    # 'papersize': 'letterpaper',
 
-# The font size ('10pt', '11pt' or '12pt').
-#'pointsize': '10pt',
+    # The font size ('10pt', '11pt' or '12pt').
+    # 'pointsize': '10pt',
 
-# Additional stuff for the LaTeX preamble.
-#'preamble': '',
+    # Additional stuff for the LaTeX preamble.
+    # 'preamble': '',
 }
 
 # Grouping the document tree into LaTeX files. List of tuples
 # (source start file, target name, title, author, documentclass [howto/manual]).
 latex_documents = [
-  ('index', 'packstack.tex', u'packstack Documentation', u'Derek Higgins', 'manual'),
+    ('index', 'packstack.tex', u'packstack Documentation', u'Derek Higgins', 'manual'),
 ]
 
 # The name of an image file (relative to this directory) to place at the top of
 # the title page.
-#latex_logo = None
+# latex_logo = None
 
 # For "manual" documents, if this is true, then toplevel headings are parts,
 # not chapters.
-#latex_use_parts = False
+# latex_use_parts = False
 
 # If true, show page references after internal links.
-#latex_show_pagerefs = False
+# latex_show_pagerefs = False
 
 # If true, show URL addresses after external links.
-#latex_show_urls = False
+# latex_show_urls = False
 
 # Documents to append as an appendix to all manuals.
-#latex_appendices = []
+# latex_appendices = []
 
 # If false, no module index is generated.
-#latex_domain_indices = True
+# latex_domain_indices = True
 
 
 # -- Options for manual page output --------------------------------------------
@@ -219,7 +232,7 @@
 ]
 
 # If true, show URL addresses after external links.
-#man_show_urls = False
+# man_show_urls = False
 
 
 # -- Options for Texinfo output ------------------------------------------------
@@ -228,16 +241,16 @@
 # (source start file, target name, title, author,
 #  dir menu entry, description, category)
 texinfo_documents = [
-  ('index', 'packstack', u'packstack Documentation',
-   u'Derek Higgins', 'packstack', 'One line description of project.',
-   'Miscellaneous'),
+    ('index', 'packstack', u'packstack Documentation',
+     u'Derek Higgins', 'packstack', 'One line description of project.',
+     'Miscellaneous'),
 ]
 
 # Documents to append as an appendix to all manuals.
-#texinfo_appendices = []
+# texinfo_appendices = []
 
 # If false, no module index is generated.
-#texinfo_domain_indices = True
+# texinfo_domain_indices = True
 
 # How to display URL addresses: 'footnote', 'no', or 'inline'.
-#texinfo_show_urls = 'footnote'
+# texinfo_show_urls = 'footnote'
diff --git a/docs/source/packstack.rst b/docs/source/packstack.rst
new file mode 100644
index 000000000..cdbe84308
--- /dev/null
+++ b/docs/source/packstack.rst
@@ -0,0 +1,1131 @@
+=========
+Packstack
+=========
+
+SYNOPSIS
+========
+
+packstack [options]
+
+DESCRIPTION
+===========
+
+Packstack is a utility that uses puppet modules to install OpenStack. It can be used to install each OpenStack service on separate servers, an 'allinone' server, or any combination of these. There are three ways that Packstack can be run.
+
+- packstack
+- packstack [options]
+- packstack --gen-answer-file=<file>
+- packstack --answer-file=<file>
+
+The third option allows the user to generate a default answer file, edit the default options, and finally run Packstack a second time using this answer file. This is the easiest way to run Packstack and the one that will be documented here. Optionally, it is possible to set additional command-line options (such as a default password), and those options will be set in the answer file.
+
+When <file> is created, it will contain the OPTIONS below, which can then be edited by the user.
+
+OPTIONS
+=======
+
+Global Options
+--------------
+
+**CONFIG_SSH_KEY**
+    Path to a public key to install on servers. If a usable key has not been installed on the remote servers, the user is prompted for a password and this key is installed so the password will not be required again.
+
+**CONFIG_DEFAULT_PASSWORD**
+    Default password to be used everywhere (overridden by passwords set for individual services or users).
+
+**CONFIG_SERVICE_WORKERS**
+    The amount of service workers/threads to use for each service. Useful to tweak when you have memory constraints. Defaults to the amount of cores on the system.
+
+**CONFIG_MARIADB_INSTALL**
+    Specify 'y' to install MariaDB. ['y', 'n']
+
+**CONFIG_GLANCE_INSTALL**
+    Specify 'y' to install OpenStack Image Service (glance). ['y', 'n']
+
+**CONFIG_CINDER_INSTALL**
+    Specify 'y' to install OpenStack Block Storage (cinder). ['y', 'n']
+
+**CONFIG_MANILA_INSTALL**
+    Specify 'y' to install OpenStack Shared File System (manila). ['y', 'n']
+
+**CONFIG_NOVA_INSTALL**
+    Specify 'y' to install OpenStack Compute (nova). ['y', 'n']
+
+**CONFIG_NEUTRON_INSTALL**
+    Specify 'y' to install OpenStack Networking (neutron) ['y', 'n']
+
+**CONFIG_HORIZON_INSTALL**
+    Specify 'y' to install OpenStack Dashboard (horizon). ['y', 'n']
+
+**CONFIG_SWIFT_INSTALL**
+    Specify 'y' to install OpenStack Object Storage (swift). ['y', 'n']
+
+**CONFIG_CEILOMETER_INSTALL**
+    Specify 'y' to install OpenStack Metering (ceilometer). Note this will also automatically install gnocchi service and configures it as the metrics backend. ['y', 'n']
+
+**CONFIG_AODH_INSTALL**
+    Specify 'y' to install OpenStack Telemetry Alarming (Aodh). Note Aodh requires Ceilometer to be installed as well. ['y', 'n']
+
+**CONFIG_HEAT_INSTALL**
+    Specify 'y' to install OpenStack Orchestration (heat). ['y', 'n']
+
+**CONFIG_MAGNUM_INSTALL**
+    Specify 'y' to install OpenStack Container Infrastructure Management Service (magnum). ['y', 'n']
+
+**CONFIG_TROVE_INSTALL**
+    Specify 'y' to install OpenStack Database (trove) ['y', 'n']
+
+**CONFIG_IRONIC_INSTALL**
+    Specify 'y' to install OpenStack Bare Metal Provisioning (ironic). ['y', 'n']
+
+**CONFIG_CLIENT_INSTALL**
+    Specify 'y' to install the OpenStack Client packages (command-line tools). An admin "rc" file will also be installed. ['y', 'n']
+
+**CONFIG_NTP_SERVERS**
+    Comma-separated list of NTP servers. Leave plain if Packstack should not install ntpd on instances.
+
+**EXCLUDE_SERVERS**
+    Comma-separated list of servers to be excluded from the installation. This is helpful if you are running Packstack a second time with the same answer file and do not want Packstack to overwrite these server's configurations. Leave empty if you do not need to exclude any servers.
+
+**CONFIG_DEBUG_MODE**
+    Specify 'y' if you want to run OpenStack services in debug mode; otherwise, specify 'n'. ['y', 'n']
+
+**CONFIG_CONTROLLER_HOST**
+    Server on which to install OpenStack services specific to the controller role (for example, API servers or dashboard).
+
+**CONFIG_COMPUTE_HOSTS**
+    List the servers on which to install the Compute service.
+
+**CONFIG_NETWORK_HOSTS**
+    List of servers on which to install the network service such as Compute networking (nova network) or OpenStack Networking (neutron).
+
+**CONFIG_VMWARE_BACKEND**
+    Specify 'y' if you want to use VMware vCenter as hypervisor and storage; otherwise, specify 'n'. ['y', 'n']
+
+**CONFIG_UNSUPPORTED**
+    Specify 'y' if you want to use unsupported parameters. This should be used only if you know what you are doing. Issues caused by using unsupported options will not be fixed before the next major release. ['y', 'n']
+
+**CONFIG_USE_SUBNETS**
+    Specify 'y' if you want to use subnet addresses (in CIDR format) instead of interface names in following options: CONFIG_NEUTRON_OVS_BRIDGE_IFACES, CONFIG_NEUTRON_OVS_TUNNEL_IF. This is useful for cases when interface names are not same on all installation hosts.
+
+SSL setup
+---------
+Packstack supports ability to be get CA certificate and use it to sign all certificates used in OpenStack deployment. Standard workflow for this would be creating Subordinate CA. If Root CA is given to Packstack it is not safe to use it for anything else. If no CA is provided and CONFIG_SSL_CACERT_SELFSIGN is set to 'y' Packstack will use Selfsigned CA.
+
+**CONFIG_SSL_CERT_DIR**
+    Enter the path to use to store generated SSL certificates in.
+
+**CONFIG_SSL_CACERT_FILE**
+    Specify filepath for CA cert file. If CONFIG_SSL_CACERT_SELFSIGN is set to 'n' it has to be preexisting file.
+
+**CONFIG_SSL_CACERT_KEY_FILE**
+    Specify filepath for CA cert key file. If CONFIG_SSL_CACERT_SELFSIGN is set to 'n' it has to be preexisting file.
+
+**CONFIG_SSL_CACERT_SELFSIGN**
+    Specify 'y' if you want Packstack to pregenerate the CA Certificate.
+
+SSL certificates options
+-----------------------------
+
+**CONFIG_SSL_CERT_SUBJECT_C**
+    Enter the ssl certificates subject country.
+
+**CONFIG_SSL_CERT_SUBJECT_ST**
+    Enter the ssl certificates subject state.
+
+**CONFIG_SSL_CERT_SUBJECT_L**
+    Enter the ssl certificates subject location.
+
+**CONFIG_SSL_CERT_SUBJECT_O**
+    Enter the ssl certificates subject organization.
+
+**CONFIG_SSL_CERT_SUBJECT_OU**
+    Enter the ssl certificates subject organizational unit.
+
+**CONFIG_SSL_CERT_SUBJECT_CN**
+    Enter the ssl certificates subject common name.
+
+vCenter Config Parameters
+-------------------------
+
+**CONFIG_VCENTER_HOST**
+    IP address of the VMware vCenter server.
+
+**CONFIG_VCENTER_USER**
+    User name for VMware vCenter server authentication.
+
+**CONFIG_VCENTER_PASSWORD**
+    Password for VMware vCenter server authentication.
+
+**CONFIG_VCENTER_CLUSTER_NAMES**
+    Comma separated list of names of the VMware vCenter clusters.
+    Note: if multiple clusters are specified each one is mapped to one compute, otherwise all computes are mapped to same cluster.
+
+Global unsupported options
+--------------------------
+
+**CONFIG_STORAGE_HOST**
+    (Unsupported!) Server on which to install OpenStack services specific to storage servers such as Image or Block Storage services.
+
+Server Prepare Configs
+-----------------------
+
+**CONFIG_REPO**
+    Comma-separated list of URLs for any additional yum repositories, to use for installation.
+
+**CONFIG_ENABLE_RDO_TESTING**
+   Specify 'y' to enable the RDO testing repository. ['y', 'n']
+
+RHEL config
+-----------
+
+**CONFIG_RH_USER**
+    To subscribe each server with Red Hat Subscription Manager, include this with CONFIG_RH_PW.
+
+**CONFIG_SATELLITE_URL**
+    To subscribe each server to receive updates from a Satellite server, provide the URL of the Satellite server. You must also provide a user name (CONFIG_SATELLITE_USERNAME) and password (CONFIG_SATELLITE_PASSWORD) or an access key (CONFIG_SATELLITE_AKEY) for authentication.
+
+**CONFIG_RH_SAT6_SERVER**
+    Specify a Satellite 6 Server to register to. If not specified, Packstack will register the system to the Red Hat server. When this option is specified, you also need to set the Satellite 6 organization (CONFIG_RH_SAT6_ORG) and an activation key (CONFIG_RH_SAT6_KEY).
+
+RH subscription manager config
+------------------------------
+
+**CONFIG_RH_PW**
+    To subscribe each server with Red Hat Subscription Manager, include this with CONFIG_RH_USER.
+
+**CONFIG_RH_OPTIONAL**
+    Specify 'y' to enable RHEL optional repositories. ['y', 'n']
+
+**CONFIG_RH_PROXY**
+    HTTP proxy to use with Red Hat Subscription Manager.
+
+**CONFIG_RH_SAT6_ORG**
+    Specify a Satellite 6 Server organization to use when registering the system.
+
+**CONFIG_RH_SAT6_KEY**
+    Specify a Satellite 6 Server activation key to use when registering the system.
+
+RH subscription manager proxy config
+------------------------------------
+
+**CONFIG_RH_PROXY_PORT**
+    Port to use for Red Hat Subscription Manager's HTTP proxy.
+
+**CONFIG_RH_PROXY_USER**
+    User name to use for Red Hat Subscription Manager's HTTP proxy.
+
+**CONFIG_RH_PROXY_PW**
+    Password to use for Red Hat Subscription Manager's HTTP proxy.
+
+RHN Satellite config
+--------------------
+
+**CONFIG_SATELLITE_USER**
+    User name to authenticate with the RHN Satellite server; if you intend to use an access key for Satellite authentication, leave this blank.
+
+**CONFIG_SATELLITE_PW**
+    Password to authenticate with the RHN Satellite server; if you intend to use an access key for Satellite authentication, leave this blank.
+
+**CONFIG_SATELLITE_AKEY**
+    Access key for the Satellite server; if you intend to use a user name and password for Satellite authentication, leave this blank.
+
+**CONFIG_SATELLITE_CACERT**
+    Certificate path or URL of the certificate authority to verify that the connection with the Satellite server is secure. If you are not using Satellite in your deployment, leave this blank.
+
+**CONFIG_SATELLITE_PROFILE**
+    Profile name that should be used as an identifier for the system in RHN Satellite (if required).
+
+**CONFIG_SATELLITE_FLAGS**
+    Comma-separated list of flags passed to the rhnreg_ks command. Valid flags are: novirtinfo, norhnsd, nopackages ['novirtinfo', 'norhnsd', 'nopackages']
+
+**CONFIG_SATELLITE_PROXY**
+    HTTP proxy to use when connecting to the RHN Satellite server (if required).
+
+RHN Satellite proxy config
+--------------------------
+
+**CONFIG_SATELLITE_PROXY_USER**
+    User name to authenticate with the Satellite-server HTTP proxy.
+
+**CONFIG_SATELLITE_PROXY_PW**
+    User password to authenticate with the Satellite-server HTTP proxy.
+
+AMQP Config parameters
+----------------------
+
+**CONFIG_AMQP_BACKEND**
+    Service to be used as the AMQP broker. Allowed values are: rabbitmq ['rabbitmq']
+
+**CONFIG_AMQP_HOST**
+    IP address of the server on which to install the AMQP service.
+
+**CONFIG_AMQP_ENABLE_SSL**
+    Specify 'y' to enable SSL for the AMQP service. ['y', 'n']
+
+**CONFIG_AMQP_ENABLE_AUTH**
+    Specify 'y' to enable authentication for the AMQP service. ['y', 'n']
+
+AMQP Config Authentication parameters
+-------------------------------------
+
+**CONFIG_AMQP_AUTH_USER**
+    User for AMQP authentication.
+
+**CONFIG_AMQP_AUTH_PASSWORD**
+    Password for AMQP authentication.
+
+MariaDB Config parameters
+-------------------------
+
+**CONFIG_MARIADB_HOST**
+    IP address of the server on which to install MariaDB. If a MariaDB installation was not specified in CONFIG_MARIADB_INSTALL, specify the IP address of an existing database server (a MariaDB cluster can also be specified).
+
+**CONFIG_MARIADB_USER**
+    User name for the MariaDB administrative user.
+
+**CONFIG_MARIADB_PW**
+    Password for the MariaDB administrative user.
+
+Keystone Config parameters
+--------------------------
+
+**CONFIG_KEYSTONE_DB_PW**
+    Password to use for the Identity service (keystone) to access the database.
+
+**CONFIG_KEYSTONE_FERNET_TOKEN_ROTATE_ENABLE**
+    Enter y if cron job to rotate Fernet tokens should be created.
+
+**CONFIG_KEYSTONE_REGION**
+    Default region name to use when creating tenants in the Identity service.
+
+**CONFIG_KEYSTONE_ADMIN_USERNAME**
+    User name for the Identity service 'admin' user.  Defaults to 'admin'.
+
+**CONFIG_KEYSTONE_ADMIN_PW**
+    Password to use for the Identity service 'admin' user.
+
+**CONFIG_KEYSTONE_ADMIN_EMAIL**
+    Email address for the Identity service 'admin' user.  Defaults to 'root@localhost'.
+
+**CONFIG_KEYSTONE_DEMO_PW**
+    Password to use for the Identity service 'demo' user.
+
+**CONFIG_KEYSTONE_API_VERSION**
+    Identity service API version string. ['v3']
+
+**CONFIG_KEYSTONE_TOKEN_FORMAT**
+    Identity service token format (FERNET). Since Rocky, only FERNET is supported. ['FERNET']
+
+**CONFIG_KEYSTONE_IDENTITY_BACKEND**
+    Type of Identity service backend (sql or ldap). ['sql', 'ldap']
+
+Keystone LDAP Identity Backend Config parameters
+------------------------------------------------
+
+**CONFIG_KEYSTONE_LDAP_URL**
+    URL for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_USER_DN**
+    User DN for the Identity service LDAP backend.  Used to bind to the LDAP server if the LDAP server does not allow anonymous authentication.
+
+**CONFIG_KEYSTONE_LDAP_USER_PASSWORD**
+    User DN password for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_SUFFIX**
+    Base suffix for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_QUERY_SCOPE**
+    Query scope for the Identity service LDAP backend. Use 'one' for onelevel/singleLevel or 'sub' for subtree/wholeSubtree ('base' is not actually used by the Identity service and is therefore deprecated). ['base', 'one', 'sub']
+
+**CONFIG_KEYSTONE_LDAP_PAGE_SIZE**
+    Query page size for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_USER_SUBTREE**
+    User subtree for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_USER_FILTER**
+    User query filter for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_USER_OBJECTCLASS**
+    User object class for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_USER_ID_ATTRIBUTE**
+    User ID attribute for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_USER_NAME_ATTRIBUTE**
+    User name attribute for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_USER_MAIL_ATTRIBUTE**
+    User email address attribute for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_USER_ENABLED_ATTRIBUTE**
+    User-enabled attribute for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_USER_ENABLED_MASK**
+    Bit mask integer applied to user-enabled attribute for the Identity service LDAP backend. Indicate the bit that the enabled value is stored in if the LDAP server represents "enabled" as a bit on an integer rather than a boolean. A value of "0" indicates the mask is not used (default). If this is not set to "0", the typical value is "2", typically used when "CONFIG_KEYSTONE_LDAP_USER_ENABLED_ATTRIBUTE = userAccountControl".
+
+**CONFIG_KEYSTONE_LDAP_USER_ENABLED_DEFAULT**
+    Value of enabled attribute which indicates user is enabled for the Identity service LDAP backend. This should match an appropriate integer value if the LDAP server uses non-boolean (bitmask) values to indicate whether a user is enabled or disabled. If this is not set as 'y', the typical value is "512". This is typically used when "CONFIG_KEYSTONE_LDAP_USER_ENABLED_ATTRIBUTE = userAccountControl".
+
+**CONFIG_KEYSTONE_LDAP_USER_ENABLED_INVERT**
+    Specify 'y' if users are disabled (not enabled) in the Identity service LDAP backend (inverts boolean-enalbed values).  Some LDAP servers use a boolean lock attribute where "y" means an account is disabled. Setting this to 'y' allows these lock attributes to be used. This setting will have no effect if "CONFIG_KEYSTONE_LDAP_USER_ENABLED_MASK" is in use. ['n', 'y']
+
+**CONFIG_KEYSTONE_LDAP_USER_ATTRIBUTE_IGNORE**
+    Comma-separated list of attributes stripped from LDAP user entry upon update.
+
+**CONFIG_KEYSTONE_LDAP_USER_DEFAULT_PROJECT_ID_ATTRIBUTE**
+    Identity service LDAP attribute mapped to default_project_id for users.
+
+**CONFIG_KEYSTONE_LDAP_USER_PASS_ATTRIBUTE**
+    Identity service LDAP attribute mapped to password.
+
+**CONFIG_KEYSTONE_LDAP_USER_ENABLED_EMULATION_DN**
+    DN of the group entry to hold enabled LDAP users when using enabled emulation.
+
+**CONFIG_KEYSTONE_LDAP_USER_ADDITIONAL_ATTRIBUTE_MAPPING**
+    List of additional LDAP attributes for mapping additional attribute mappings for users. The attribute-mapping format is <ldap_attr>:<user_attr>, where ldap_attr is the attribute in the LDAP entry and user_attr is the Identity API attribute.
+
+**CONFIG_KEYSTONE_LDAP_GROUP_SUBTREE**
+    Group subtree for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_GROUP_FILTER**
+    Group query filter for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_GROUP_OBJECTCLASS**
+    Group object class for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_GROUP_ID_ATTRIBUTE**
+    Group ID attribute for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_GROUP_NAME_ATTRIBUTE**
+    Group name attribute for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_GROUP_MEMBER_ATTRIBUTE**
+    Group member attribute for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_GROUP_DESC_ATTRIBUTE**
+    Group description attribute for the Identity service LDAP backend.
+
+**CONFIG_KEYSTONE_LDAP_GROUP_ATTRIBUTE_IGNORE**
+    Comma-separated list of attributes stripped from LDAP group entry upon update.
+
+**CONFIG_KEYSTONE_LDAP_GROUP_ADDITIONAL_ATTRIBUTE_MAPPING**
+    List of additional LDAP attributes used for mapping additional attribute mappings for groups. The attribute=mapping format is <ldap_attr>:<group_attr>, where ldap_attr is the attribute in the LDAP entry and group_attr is the Identity API attribute.
+
+**CONFIG_KEYSTONE_LDAP_USE_TLS**
+    Specify 'y' if the Identity service LDAP backend should use TLS. ['n', 'y']
+
+**CONFIG_KEYSTONE_LDAP_TLS_CACERTDIR**
+    CA certificate directory for Identity service LDAP backend (if TLS is used).
+
+**CONFIG_KEYSTONE_LDAP_TLS_CACERTFILE**
+     CA certificate file for Identity service LDAP backend (if TLS is used).
+
+**CONFIG_KEYSTONE_LDAP_TLS_REQ_CERT**
+    Certificate-checking strictness level for Identity service LDAP backend; valid options are: never, allow, demand. ['never', 'allow', 'demand']
+
+Glance Config parameters
+------------------------
+
+**CONFIG_GLANCE_DB_PW**
+    Password to use for the Image service (glance) to access the database.
+
+**CONFIG_GLANCE_KS_PW**
+    Password to use for the Image service to authenticate with the Identity service.
+
+**CONFIG_GLANCE_BACKEND**
+    Storage backend for the Image service (controls how the Image service stores disk images). Valid options are: file or swift (Object Storage). The Object Storage service must be enabled to use it as a working backend; otherwise, Packstack falls back to 'file'. ['file', 'swift']
+
+Cinder Config parameters
+------------------------
+
+**CONFIG_CINDER_DB_PW**
+    Password to use for the Block Storage service (cinder) to access the database.
+
+**CONFIG_CINDER_DB_PURGE_ENABLE**
+    Enter y if cron job for removing soft deleted DB rows should be created.
+
+**CONFIG_CINDER_KS_PW**
+    Password to use for the Block Storage service to authenticate with the Identity service.
+
+**CONFIG_CINDER_BACKEND**
+    Storage backend to use for the Block Storage service; valid options are: lvm, nfs, vmdk, netapp, solidfire. ['lvm', 'nfs', 'vmdk', 'netapp', 'solidfire']
+
+Cinder volume create Config parameters
+--------------------------------------
+
+**CONFIG_CINDER_VOLUMES_CREATE**
+    Specify 'y' to create the Block Storage volumes group. That is, Packstack creates a raw disk image in /var/lib/cinder, and mounts it using a loopback device. This should only be used for testing on a proof-of-concept installation of the Block Storage service (a file-backed volume group is not suitable for production usage). ['y', 'n']
+
+Cinder volume size Config parameters
+------------------------------------
+
+**CONFIG_CINDER_VOLUMES_SIZE**
+    Size of Block Storage volumes group. Actual volume size will be extended with 3% more space for VG metadata. Remember that the size of the volume group will restrict the amount of disk space that you can expose to Compute instances, and that the specified amount must be available on the device used for /var/lib/cinder.
+
+Cinder lvm Config parameters
+----------------------------
+
+**CONFIG_CINDER_VOLUME_NAME**
+    Specify a custom name for the lvm cinder volume group
+
+Cinder NFS Config parameters
+----------------------------
+
+**CONFIG_CINDER_NFS_MOUNTS**
+    A single or comma-separated list of NFS exports to mount. Example: 'ip-address:/export-name'
+
+Cinder NetApp main configuration
+--------------------------------
+
+**CONFIG_CINDER_NETAPP_LOGIN**
+    Administrative user account name used to access the NetApp storage system or proxy server.
+
+**CONFIG_CINDER_NETAPP_PASSWORD**
+    Password for the NetApp administrative user account specified in the CONFIG_CINDER_NETAPP_LOGIN parameter.
+
+**CONFIG_CINDER_NETAPP_HOSTNAME**
+    Hostname (or IP address) for the NetApp storage system or proxy server.
+
+**CONFIG_CINDER_NETAPP_SERVER_PORT**
+    The TCP port to use for communication with the storage system or proxy. If not specified, Data ONTAP drivers will use 80 for HTTP and 443 for HTTPS; E-Series will use 8080 for HTTP and 8443 for HTTPS. Defaults to 80.
+
+**CONFIG_CINDER_NETAPP_STORAGE_FAMILY**
+    Storage family type used on the NetApp storage system; valid options are ontap_7mode for using Data ONTAP operating in 7-Mode, ontap_cluster for using clustered Data ONTAP, or E-Series for NetApp E-Series. Defaults to ontap_cluster. ['ontap_7mode', 'ontap_cluster', 'eseries']
+
+**CONFIG_CINDER_NETAPP_TRANSPORT_TYPE**
+    The transport protocol used when communicating with the NetApp storage system or proxy server. Valid values are http or https. Defaults to 'http'. ['http', 'https']
+
+**CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL**
+    Storage protocol to be used on the data path with the NetApp storage system; valid options are iscsi, fc, nfs. Defaults to nfs. ['iscsi', 'fc', 'nfs']
+
+Cinder NetApp ONTAP-iSCSI configuration
+---------------------------------------
+
+**CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER**
+    Quantity to be multiplied by the requested volume size to ensure enough space is available on the virtual storage server (Vserver) to fulfill the volume creation request.  Defaults to 1.0.
+
+Cinder NetApp NFS configuration
+-------------------------------
+
+**CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES**
+    Time period (in minutes) that is allowed to elapse after the image is last accessed, before it is deleted from the NFS image cache. When a cache-cleaning cycle begins, images in the cache that have not been accessed in the last M minutes, where M is the value of this parameter, are deleted from the cache to create free space on the NFS share. Defaults to 720.
+
+**CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_START**
+    If the percentage of available space for an NFS share has dropped below the value specified by this parameter, the NFS image cache is cleaned.  Defaults to 20.
+
+**CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_STOP**
+    When the percentage of available space on an NFS share has reached the percentage specified by this parameter, the driver stops clearing files from the NFS image cache that have not been accessed in the last M minutes, where M is the value of the CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES parameter. Defaults to 60.
+
+**CONFIG_CINDER_NETAPP_NFS_SHARES**
+    Single or comma-separated list of NetApp NFS shares for Block Storage to use.  Format: ip-address:/export-name. Defaults to ''.
+
+**CONFIG_CINDER_NETAPP_NFS_SHARES_CONFIG**
+    File with the list of available NFS shares.   Defaults to '/etc/cinder/shares.conf'.
+
+
+Cinder NetApp iSCSI & 7-mode configuration
+------------------------------------------
+
+**CONFIG_CINDER_NETAPP_VOLUME_LIST**
+    This parameter is only utilized when the storage protocol is configured to use iSCSI or FC. This parameter is used to restrict provisioning to the specified controller volumes. Specify the value of this parameter to be a comma separated list of NetApp controller volume names to be used for provisioning. Defaults to ''.
+
+**CONFIG_CINDER_NETAPP_VFILER**
+    The vFiler unit on which provisioning of block storage volumes will be done. This parameter is only used by the driver when connecting to an instance with a storage family of Data ONTAP operating in 7-Mode Only use this parameter when utilizing the MultiStore feature on the NetApp storage system. Defaults to ''.
+
+Cinder NetApp 7-mode FC configuration
+-------------------------------------
+
+**CONFIG_CINDER_NETAPP_PARTNER_BACKEND_NAME**
+    The name of the config.conf stanza for a Data ONTAP (7-mode) HA partner.  This option is only used by the driver when connecting to an instance with a storage family of Data ONTAP operating in 7-Mode, and it is required if the storage protocol selected is FC. Defaults to ''.
+
+Cinder NetApp Vserver configuration
+-----------------------------------
+
+**CONFIG_CINDER_NETAPP_VSERVER**
+    This option specifies the virtual storage server (Vserver) name on the storage cluster on which provisioning of block storage volumes should occur. Defaults to ''.
+
+Cinder NetApp E-Series configuration
+------------------------------------
+
+**CONFIG_CINDER_NETAPP_CONTROLLER_IPS**
+    Restricts provisioning to the specified controllers. Value must be a comma-separated list of controller hostnames or IP addresses to be used for provisioning. This option is only utilized when the storage family is configured to use E-Series. Defaults to ''.
+
+**CONFIG_CINDER_NETAPP_SA_PASSWORD**
+    Password for the NetApp E-Series storage array. Defaults to ''.
+
+**CONFIG_CINDER_NETAPP_ESERIES_HOST_TYPE**
+    This option is used to define how the controllers in the E-Series storage array will work with the particular operating system on the hosts that are connected to it. Defaults to 'linux_dm_mp'
+
+**CONFIG_CINDER_NETAPP_WEBSERVICE_PATH**
+    Path to the NetApp E-Series proxy application on a proxy server. The value is combined with the value of the CONFIG_CINDER_NETAPP_TRANSPORT_TYPE, CONFIG_CINDER_NETAPP_HOSTNAME, and CONFIG_CINDER_NETAPP_HOSTNAME options to create the URL used by the driver to connect to the proxy application. Defaults to '/devmgr/v2'.
+
+**CONFIG_CINDER_NETAPP_STORAGE_POOLS**
+    Restricts provisioning to the specified storage pools. Only dynamic disk pools are currently supported. The value must be a comma-separated list of disk pool names to be used for provisioning. Defaults to ''.
+
+Cinder SolidFire configuration
+------------------------------
+
+**CONFIG_CINDER_SOLIDFIRE_LOGIN**
+    Cluster admin account name used to access the SolidFire storage system.
+
+**CONFIG_CINDER_SOLIDFIRE_PASSWORD**
+    Password for the SolidFire cluster admin user account specified in the CONFIG_CINDER_SOLIDFIRE_LOGIN parameter.
+
+**CONFIG_CINDER_SOLIDFIRE_HOSTNAME**
+    Hostname (or IP address) for the SolidFire storage system's MVIP.
+
+Manila Config parameters
+------------------------
+
+**CONFIG_MANILA_DB_PW**
+    Password to use for the OpenStack File Share service (manila) to access the database.
+
+**CONFIG_MANILA_KS_PW**
+    Password to use for the OpenStack File Share service (manila) to authenticate with the Identity service.
+
+**CONFIG_MANILA_BACKEND**
+    Backend for the OpenStack File Share service (manila); valid options are: generic, netapp, glusternative, or glusternfs. ['generic', 'netapp', 'glusternative', 'glusternfs']
+
+Manila NetApp configuration
+---------------------------
+
+**CONFIG_MANILA_NETAPP_DRV_HANDLES_SHARE_SERVERS**
+    Denotes whether the driver should handle the responsibility of managing share servers. This must be set to false if the driver is to operate without managing share servers. Defaults to 'false' ['true', 'false']
+
+**CONFIG_MANILA_NETAPP_TRANSPORT_TYPE**
+    The transport protocol used when communicating with the storage system or proxy server. Valid values are 'http' and 'https'. Defaults to 'https'. ['https', 'http']
+
+**CONFIG_MANILA_NETAPP_LOGIN**
+    Administrative user account name used to access the NetApp storage system.  Defaults to ''.
+
+**CONFIG_MANILA_NETAPP_PASSWORD**
+    Password for the NetApp administrative user account specified in the CONFIG_MANILA_NETAPP_LOGIN parameter. Defaults to ''.
+
+**CONFIG_MANILA_NETAPP_SERVER_HOSTNAME**
+    Hostname (or IP address) for the NetApp storage system or proxy server. Defaults to ''.
+
+**CONFIG_MANILA_NETAPP_STORAGE_FAMILY**
+    The storage family type used on the storage system; valid values are ontap_cluster for clustered Data ONTAP. Defaults to 'ontap_cluster'. ['ontap_cluster']
+
+**CONFIG_MANILA_NETAPP_SERVER_PORT**
+    The TCP port to use for communication with the storage system or proxy server. If not specified, Data ONTAP drivers will use 80 for HTTP and 443 for HTTPS. Defaults to '443'.
+
+**CONFIG_MANILA_NETAPP_AGGREGATE_NAME_SEARCH_PATTERN**
+    Pattern for searching available aggregates for NetApp provisioning. Defaults to '(.*)'.
+
+Manila NetApp Multi-SVM configuration
+-------------------------------------
+
+**CONFIG_MANILA_NETAPP_ROOT_VOLUME_AGGREGATE**
+    Name of aggregate on which to create the NetApp root volume. This option only applies when the option CONFIG_MANILA_NETAPP_DRV_HANDLES_SHARE_SERVERS is set to True.
+
+**CONFIG_MANILA_NETAPP_ROOT_VOLUME_NAME**
+    NetApp root volume name. Defaults to 'root'.
+
+Manila NetApp Single-SVM configuration
+--------------------------------------
+
+**CONFIG_MANILA_NETAPP_VSERVER**
+    This option specifies the storage virtual machine (previously called a Vserver) name on the storage cluster on which provisioning of shared file systems should occur. This option only applies when the option driver_handles_share_servers is set to False. Defaults to ''.
+
+Manila generic driver configuration
+-----------------------------------
+
+**CONFIG_MANILA_GENERIC_DRV_HANDLES_SHARE_SERVERS**
+    Denotes whether the driver should handle the responsibility of managing share servers. This must be set to false if the driver is to operate without managing share servers. Defaults to 'true'. ['true', 'false']
+
+**CONFIG_MANILA_GENERIC_VOLUME_NAME_TEMPLATE**
+    Volume name template for Manila service. Defaults to 'manila-share-%s'.
+
+**CONFIG_MANILA_GENERIC_SHARE_MOUNT_PATH**
+    Share mount path for Manila service. Defaults to '/shares'.
+
+**CONFIG_MANILA_SERVICE_IMAGE_LOCATION**
+    Location of disk image for Manila service instance. Defaults to 'https://www.dropbox.com/s/vi5oeh10q1qkckh/ubuntu_1204_nfs_cifs.qcow2'.
+
+**CONFIG_MANILA_SERVICE_INSTANCE_USER**
+    User in Manila service instance.
+
+**CONFIG_MANILA_SERVICE_INSTANCE_PASSWORD**
+    Password to service instance user.
+
+Manila Network configuration
+----------------------------
+
+**CONFIG_MANILA_NETWORK_TYPE**
+    Type of networking that the backend will use. A more detailed description of each option is available in the Manila docs. Defaults to 'neutron'. ['neutron', 'standalone']
+
+Manila Standalone network configuration
+---------------------------------------
+
+**CONFIG_MANILA_NETWORK_STANDALONE_GATEWAY**
+    Gateway IPv4 address that should be used. Required. Defaults to ''.
+
+**CONFIG_MANILA_NETWORK_STANDALONE_NETMASK**
+    Network mask that will be used. Can be either decimal like '24' or binary like '255.255.255.0'. Required. Defaults to ''.
+
+**CONFIG_MANILA_NETWORK_STANDALONE_SEG_ID**
+    Set it if network has segmentation (VLAN, VXLAN, etc). It will be assigned to share-network and share drivers will be able to use this for network interfaces within provisioned share servers. Optional. Example: 1001. Defaults to ''.
+
+**CONFIG_MANILA_NETWORK_STANDALONE_IP_RANGE**
+    Can be IP address, range of IP addresses or list of addresses or ranges. Contains addresses from IP network that are allowed to be used. If empty, then will be assumed that all host addresses from network can be used. Optional. Examples: 10.0.0.10 or 10.0.0.10-10.0.0.20 or 10.0.0.10-10.0.0.20,10.0.0.30-10.0.0.40,10.0.0.50. Defaults to ''.
+
+**CONFIG_MANILA_NETWORK_STANDALONE_IP_VERSION**
+    IP version of network. Optional. Defaults to '4'. ['4', '6']
+
+Ironic Options
+--------------
+
+**CONFIG_IRONIC_DB_PW**
+    Password to use for OpenStack Bare Metal Provisioning (ironic) to access the database.
+
+**CONFIG_IRONIC_KS_PW**
+    Password to use for OpenStack Bare Metal Provisioning to authenticate with the Identity service.
+
+Nova Options
+------------
+
+**CONFIG_NOVA_DB_PW**
+    Password to use for the Compute service (nova) to access the database.
+
+**CONFIG_NOVA_DB_PURGE_ENABLE**
+    Enter y if cron job for removing soft deleted DB rows should be created.
+
+**CONFIG_NOVA_KS_PW**
+    Password to use for the Compute service to authenticate with the Identity service.
+
+**CONFIG_NOVA_MANAGE_FLAVORS**
+    Whether or not Packstack should manage a default initial set of Nova flavors. Defaults to 'y'.
+
+**CONFIG_NOVA_LIBVIRT_VIRT_TYPE**
+    The hypervisor driver to use with Nova. Can be either 'qemu' or 'kvm'.
+    Defaults to 'qemu' on virtual machines and 'kvm' on bare metal hardware.
+    For nested KVM set it explicitly to 'kvm'.
+
+**CONFIG_NOVA_SCHED_CPU_ALLOC_RATIO**
+    Overcommitment ratio for virtual to physical CPUs. Specify 1.0 to disable CPU overcommitment.
+
+**CONFIG_NOVA_SCHED_RAM_ALLOC_RATIO**
+    Overcommitment ratio for virtual to physical RAM. Specify 1.0 to disable RAM overcommitment.
+
+**CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL**
+    Protocol used for instance migration. Valid options are: ssh and tcp. Note that the tcp protocol is not encrypted, so it is insecure. ['ssh', 'tcp']
+
+**CONFIG_NOVA_PCI_ALIAS**
+    Enter the PCI passthrough array of hash in JSON style for controller eg.
+    [{"vendor_id":"1234", "product_id":"5678", "name":"default"}, {...}]
+
+**CONFIG_NOVA_PCI_PASSTHROUGH_WHITELIST**
+    Enter the PCI passthrough whitelist array of hash in JSON style for controller eg.
+    [{"vendor_id":"1234", "product_id":"5678", "name':"default"}, {...}]
+
+**CONFIG_VNC_SSL_CERT**
+    PEM encoded certificate to be used for ssl on the https server, leave blank if one should be generated, this certificate should not require a passphrase. If CONFIG_HORIZON_SSL is set to 'n' this parameter is ignored.
+
+**CONFIG_VNC_SSL_KEY**
+    SSL keyfile corresponding to the certificate if one was entered. If CONFIG_HORIZON_SSL is set to 'n' this parameter is ignored.
+
+Neutron config
+--------------
+
+**CONFIG_NEUTRON_KS_PW**
+    Password to use for OpenStack Networking (neutron) to authenticate with the Identity service.
+
+**CONFIG_NEUTRON_DB_PW**
+    The password to use for OpenStack Networking to access the database.
+
+**CONFIG_NEUTRON_L3_EXT_BRIDGE**
+    The name of the Open vSwitch bridge for the OpenStack Networking L3 agent to use for external  traffic. Specify 'provider' if you intend to use a provider network to handle external traffic.
+
+**CONFIG_NEUTRON_METADATA_PW**
+    Password for the OpenStack Networking metadata agent.
+
+**CONFIG_NEUTRON_METERING_AGENT_INSTALL**
+    Specify 'y' to install OpenStack Networking's L3 Metering agent ['y', 'n']
+
+**CONFIG_NEUTRON_VPNAAS**
+     Specify 'y' to configure OpenStack Networking's VPN-as-a-Service (VPNaaS). ['y', 'n']
+
+Neutron ML2 plugin config
+-------------------------
+
+**CONFIG_NEUTRON_ML2_TYPE_DRIVERS**
+    Comma-separated list of network-type driver entry points to be loaded from the neutron.ml2.type_drivers namespace. ['local', 'flat', 'vlan', 'gre', 'vxlan', 'geneve']
+
+**CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES**
+    Comma-separated, ordered list of network types to allocate as tenant networks. The 'local' value is only useful for single-box testing and provides no connectivity between hosts. ['local', 'vlan', 'gre', 'vxlan', 'geneve']
+
+**CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS**
+    Comma-separated ordered list of networking mechanism driver entry points to be loaded from the neutron.ml2.mechanism_drivers namespace. ['logger', 'test', 'openvswitch', 'arista', 'mlnx', 'l2population', 'sriovnicswitch', 'ovn']
+
+**CONFIG_NEUTRON_ML2_FLAT_NETWORKS**
+    Comma-separated list of physical_network names with which flat networks can be created. Use * to allow flat networks with arbitrary physical_network names.
+
+**CONFIG_NEUTRON_ML2_VLAN_RANGES**
+    Comma-separated list of <physical_network>:<vlan_min>:<vlan_max> or <physical_network> specifying physical_network names usable for VLAN provider and tenant networks, as well as ranges of VLAN tags on each available for allocation to tenant networks.
+
+**CONFIG_NEUTRON_ML2_TUNNEL_ID_RANGES**
+    Comma-separated list of <tun_min>:<tun_max> tuples enumerating ranges of GRE tunnel IDs that are available for tenant-network allocation. A tuple must be an array with tun_max +1 - tun_min > 1000000.
+
+**CONFIG_NEUTRON_ML2_VXLAN_GROUP**
+    Comma-separated list of addresses for VXLAN multicast group. If left empty, disables VXLAN from sending allocate broadcast traffic (disables multicast VXLAN mode). Should be a Multicast IP (v4 or v6) address.
+
+**CONFIG_NEUTRON_ML2_VNI_RANGES**
+    Comma-separated list of <vni_min>:<vni_max> tuples enumerating ranges of VXLAN VNI IDs that are available for tenant network allocation. Minimum value is 0 and maximum value is 16777215.
+
+**CONFIG_NEUTRON_ML2_SRIOV_INTERFACE_MAPPINGS**
+    Comma-separated list of interface mappings for the OpenStack Networking ML2 SRIOV agent. Each tuple in the list must be in the format <physical_network>:<net_interface>. Example: physnet1:eth1,physnet2:eth2,physnet3:eth3.
+
+
+**CONFIG_NEUTRON_L2_AGENT**
+    Name of the L2 agent to be used with OpenStack Networking. ['openvswitch', 'ovn']
+
+Neutron OVS agent config
+------------------------
+
+**CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS**
+    Comma-separated list of bridge mappings for the OpenStack Networking Open vSwitch plugin. Each tuple in the list must be in the format <physical_network>:<ovs_bridge>. Example: physnet1:br-eth1,physnet2:br-eth2,physnet3:br-eth3
+
+**CONFIG_NEUTRON_OVS_BRIDGE_IFACES**
+    Comma-separated list of colon-separated Open vSwitch <bridge>:<interface> pairs. The interface will be added to the associated bridge. If you desire the bridge to be persistent a value must be added to this directive, also CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS must be set in order to create the proper port. This can be achieved from the command line by issuing the following command: packstack --allinone --os-neutron-ovs-bridge-mappings=ext-net:br-ex --os-neutron-ovs-bridge-interfaces=br-ex:eth0
+
+**CONFIG_NEUTRON_OVS_BRIDGES_COMPUTE**
+    Comma-separated list of Open vSwitch bridges that must be created and connected to interfaces in compute nodes when flat or vlan type drivers are enabled. These bridges must exist in CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS and CONFIG_NEUTRON_OVS_BRIDGE_IFACES. Example: --os-neutron-ovs-bridges-compute=br-vlan --os-neutron-ovs-bridge-mappings="extnet:br-ex,physnet1:br-vlan" --os-neutron-ovs-bridge-interfaces="br-ex:eth1,br-vlan:eth2"
+
+**CONFIG_NEUTRON_OVS_EXTERNAL_PHYSNET**
+    Name of physical network used for external network when enabling CONFIG_PROVISION_DEMO. Name must be one of the included in CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS. Example: --os-neutron-ovs-bridge-mappings="extnet:br-ex,physnet1:br-vlan" --os-neutron-ovs-bridge-interfaces="br-ex:eth1,br-vlan:eth2" --os-neutron-ovs-external-physnet="extnet"
+
+Neutron OVS agent config for tunnels
+------------------------------------
+
+**CONFIG_NEUTRON_OVS_TUNNEL_IF**
+    Interface for the Open vSwitch tunnel. Packstack overrides the IP address used for tunnels on this hypervisor to the IP found on the specified interface (for example, eth1).
+
+**CONFIG_NEUTRON_OVS_TUNNEL_SUBNETS**
+    Comma-separated list of subnets (for example, 192.168.10.0/24,192.168.11.0/24) used for sending tunneling packets. This is used to configure IP filtering to accept tunneling packets from these subnets instead of specific IP addresses of peer nodes. This is useful when you add existing nodes to EXCLUDE_SERVERS because, in this case, packstack cannot modify the IP filtering of the existing nodes.
+
+Neutron OVS agent config for VXLAN
+----------------------------------
+
+**CONFIG_NEUTRON_OVS_VXLAN_UDP_PORT**
+    VXLAN UDP port.
+
+Neutron OVN agent config
+------------------------
+
+**CONFIG_NEUTRON_OVN_BRIDGE_MAPPINGS**
+    Comma-separated list of bridge mappings for the OpenStack Networking Open Virtual Network plugin. Each tuple in the list must be in the format <physical_network>:<ovs_bridge>. Example: physnet1:br-eth1,physnet2:br-eth2,physnet3:br-eth3
+
+**CONFIG_NEUTRON_OVN_BRIDGE_IFACES**
+    Comma-separated list of colon-separated Open vSwitch <bridge>:<interface> pairs. The interface will be added to the associated bridge. If you desire the bridge to be persistent a value must be added to this directive, also CONFIG_NEUTRON_OVN_BRIDGE_MAPPINGS must be set in order to create the proper port. This can be achieved from the command line by issuing the following command: packstack --allinone --os-neutron-ovn-bridge-mappings=ext-net:br-ex --os-neutron-ovn-bridge-interfaces=br-ex:eth0
+
+**CONFIG_NEUTRON_OVN_BRIDGES_COMPUTE**
+    Comma-separated list of Open vSwitch bridges that must be created and connected to interfaces in compute nodes when flat or vlan type drivers are enabled. These bridges must exist in CONFIG_NEUTRON_OVN_BRIDGE_MAPPINGS and CONFIG_NEUTRON_OVN_BRIDGE_IFACES. Example: --os-neutron-ovn-bridges-compute=br-vlan --os-neutron-ovn-bridge-mappings="extnet:br-ex,physnet1:br-vlan" --os-neutron-ovn-bridge-interfaces="br-ex:eth1,br-vlan:eth2"
+
+**CONFIG_NEUTRON_OVN_EXTERNAL_PHYSNET**
+    Name of physical network used for external network when enabling CONFIG_PROVISION_DEMO. Name must be one of the included in CONFIG_NEUTRON_OVN_BRIDGE_MAPPINGS. Example: --os-neutron-ovn-bridge-mappings="extnet:br-ex,physnet1:br-vlan" --os-neutron-ovn-bridge-interfaces="br-ex:eth1,br-vlan:eth2" --os-neutron-ovn-external-physnet="extnet"
+
+Neutron OVN agent config for tunnels
+------------------------------------
+
+**CONFIG_NEUTRON_OVN_TUNNEL_IF**
+    Interface for the Open vSwitch tunnel. Packstack overrides the IP address used for tunnels on this hypervisor to the IP found on the specified interface (for example, eth1).
+
+**CONFIG_NEUTRON_OVN_TUNNEL_SUBNETS**
+    Comma-separated list of subnets (for example, 192.168.10.0/24,192.168.11.0/24) used for sending tunneling packets. This is used to configure IP filtering to accept tunneling packets from these subnets instead of specific IP addresses of peer nodes. This is useful when you add existing nodes to EXCLUDE_SERVERS because, in this case, packstack cannot modify the IP filtering of the existing nodes.
+
+
+NOVACLIENT Config parameters
+----------------------------
+
+OpenStack Horizon Config parameters
+-----------------------------------
+
+**CONFIG_HORIZON_SSL**
+    Specify 'y' to set up Horizon communication over https. ['y', 'n']
+
+**CONFIG_HORIZON_SECRET_KEY**
+    Secret key to use for Horizon Secret Encryption Key.
+
+SSL Config parameters
+---------------------
+
+**CONFIG_HORIZON_SSL_CERT**
+    PEM-encoded certificate to be used for SSL connections on the https server. To generate a certificate, leave blank.
+
+**CONFIG_HORIZON_SSL_KEY**
+    SSL keyfile corresponding to the certificate if one was specified. The certificate should not require a passphrase.
+
+**CONFIG_HORIZON_SSL_CACHAIN**
+    PEM-encoded CA certificates from which the certificate chain of the server certificate can be assembled.
+
+OpenStack Swift Config parameters
+---------------------------------
+
+**CONFIG_SWIFT_KS_PW**
+    Password to use for the Object Storage service to authenticate with the Identity service.
+
+**CONFIG_SWIFT_STORAGES**
+    Comma-separated list of devices to use as storage device for Object Storage. Each entry must take the format /path/to/dev (for example, specifying /dev/vdb installs /dev/vdb as the Object Storage storage device; Packstack does not create the filesystem, you must do this first). If left empty, Packstack creates a loopback device for test setup.
+
+**CONFIG_SWIFT_STORAGE_ZONES**
+    Number of Object Storage storage zones; this number MUST be no larger than the number of configured storage devices.
+
+**CONFIG_SWIFT_STORAGE_REPLICAS**
+    Number of Object Storage storage replicas; this number MUST be no larger than the number of configured storage zones.
+
+**CONFIG_SWIFT_STORAGE_FSTYPE**
+    File system type for storage nodes. ['xfs', 'ext4']
+
+**CONFIG_SWIFT_HASH**
+    Custom seed number to use for swift_hash_path_suffix in /etc/swift/swift.conf. If you do not provide a value, a seed number is automatically generated.
+
+**CONFIG_SWIFT_STORAGE_SIZE**
+    Size of the Object Storage loopback file storage device.
+
+Heat Config parameters
+----------------------
+
+**CONFIG_HEAT_DB_PW**
+    Password used by Orchestration service user to authenticate against the database.
+
+**CONFIG_HEAT_AUTH_ENC_KEY**
+    Encryption key to use for authentication in the Orchestration database (16, 24, or 32 chars).
+
+**CONFIG_HEAT_KS_PW**
+    Password to use for the Orchestration service to authenticate with the Identity service.
+
+**CONFIG_HEAT_CFN_INSTALL**
+    Specify 'y' to install the Orchestration CloudFormation API. ['y', 'n']
+
+**CONFIG_HEAT_DOMAIN**
+    Name of the Identity domain for Orchestration.
+
+**CONFIG_HEAT_DOMAIN_ADMIN**
+    Name of the Identity domain administrative user for Orchestration.
+
+**CONFIG_HEAT_DOMAIN_PASSWORD**
+    Password for the Identity domain administrative user for Orchestration.
+
+Provisioning demo config
+------------------------
+
+**CONFIG_PROVISION_DEMO**
+    Specify 'y' to provision for demo usage and testing. ['y', 'n']
+
+**CONFIG_PROVISION_TEMPEST**
+    Specify 'y' to configure the OpenStack Integration Test Suite (tempest) for testing. The test suite requires OpenStack Networking to be installed. ['y', 'n']
+
+Provisioning demo config
+------------------------
+
+**CONFIG_PROVISION_DEMO_FLOATRANGE**
+    CIDR network address for the floating IP subnet.
+
+**CONFIG_PROVISION_DEMO_ALLOCATION_POOLS**
+    Allocation pools in the floating IP subnet.
+
+**CONFIG_PROVISION_IMAGE_URL**
+    A URL or local file location for an image to download and provision in Glance (defaults to a URL for a recent "cirros" image).
+
+**CONFIG_PROVISION_IMAGE_NAME**
+    The name to be assigned to the demo image in Glance (default "cirros").
+
+**CONFIG_PROVISION_IMAGE_FORMAT**
+    Format for the demo image (default "qcow2").
+
+**CONFIG_PROVISION_IMAGE_PROPERTIES**
+    Properties of the demo image (none by default).
+
+**CONFIG_PROVISION_IMAGE_SSH_USER**
+    User to use when connecting to instances booted from the demo image.
+
+Provisioning tempest config
+---------------------------
+
+**CONFIG_PROVISION_TEMPEST_USER**
+    Name of the Integration Test Suite provisioning user. If you do not provide a user name, Tempest is configured in a standalone mode.
+
+**CONFIG_PROVISION_TEMPEST_USER_PW**
+    Password to use for the Integration Test Suite provisioning user.
+
+**CONFIG_PROVISION_TEMPEST_FLOATRANGE**
+    CIDR network address for the floating IP subnet.
+
+**CONFIG_PROVISION_TEMPEST_FLAVOR_NAME**
+    Primary flavor name to use in Tempest.
+
+**CONFIG_PROVISION_TEMPEST_FLAVOR_DISK**
+    Primary flavor's disk quota in Gb.
+
+**CONFIG_PROVISION_TEMPEST_FLAVOR_RAM**
+    Primary flavor's ram in Mb.
+
+**CONFIG_PROVISION_TEMPEST_FLAVOR_VCPUS**
+    Primary flavor's vcpus number.
+
+**CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_NAME**
+    Alternative flavor name to use in Tempest.
+
+**CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_DISK**
+    Alternative flavor's disk quota in Gb.
+
+**CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_RAM**
+    Alternative flavor's ram in Mb.
+
+**CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_VCPUS**
+    Alternative flavor's vcpus number.
+
+**CONFIG_RUN_TEMPEST**
+    Specify 'y' to run Tempest smoke test as last step of installation.
+
+**CONFIG_RUN_TEMPEST_TESTS**
+    Test suites to run, example: "smoke dashboard TelemetryAlarming". Optional, defaults to "smoke".
+
+**CONFIG_SKIP_TEMPEST_TESTS**
+    Tests to skip, example: "test_basic_scenario test_volume". Optional, defaults to "".
+
+**CONFIG_PROVISION_UEC_IMAGE_NAME**
+    Name of the uec image created in Glance used in tempest tests (default "cirros-uec").
+
+**CONFIG_PROVISION_UEC_IMAGE_KERNEL_URL**
+    URL of the kernel image copied to Glance image for uec image (defaults to a URL for a recent "cirros" uec image).
+
+**CONFIG_PROVISION_UEC_IMAGE_RAMDISK_URL**
+    URL of the ramdisk image copied to Glance image for uec image (defaults to a URL for a recent "cirros" uec image).
+
+**CONFIG_PROVISION_UEC_IMAGE_DISK_URL**
+    URL of the disk image copied to Glance image for uec image (defaults to a URL for a recent "cirros" uec image).
+
+Provisioning all-in-one ovs bridge config
+-----------------------------------------
+
+**CONFIG_PROVISION_OVS_BRIDGE**
+    Specify 'y' to configure the Open vSwitch external bridge for an all-in-one deployment (the L3 external bridge acts as the gateway for virtual machines). ['y', 'n']
+
+Ceilometer Config parameters
+----------------------------
+
+**CONFIG_CEILOMETER_SECRET**
+    Secret key for signing Telemetry service (ceilometer) messages.
+
+**CONFIG_CEILOMETER_KS_PW**
+    Password to use for Telemetry to authenticate with the Identity service.
+
+**CONFIG_CEILOMETER_COORDINATION_BACKEND**
+    Backend driver for Telemetry's group membership coordination. ['redis', 'none']
+
+**CONFIG_ENABLE_CEILOMETER_MIDDLEWARE**
+    Whether to enable ceilometer middleware in swift proxy. By default this should be false to avoid unnecessary load.
+
+Redis Config parameters
+-----------------------
+
+**CONFIG_REDIS_HOST**
+    IP address of the server on which to install the Redis server.
+
+**CONFIG_REDIS_PORT**
+    Port on which the Redis server listens.
+
+
+Aodh Config parameters
+----------------------
+
+**CONFIG_AODH_KS_PW**
+    Password to use for Telemetry Alarming to authenticate with the Identity service.
+
+**CONFIG_AODH_DB_PW**
+    Password to use for Telemetry Alarming (AODH) to access the database.
+
+
+Gnocchi Config parameters
+-------------------------
+
+**CONFIG_GNOCCHI_DB_PW**
+    Password to use for Gnocchi to access the database.
+
+**CONFIG_GNOCCHI_KS_PW**
+    Password to use for Gnocchi to authenticate with the Identity service.
+
+
+Trove config parameters
+-----------------------
+
+**CONFIG_TROVE_DB_PW**
+    Password to use for OpenStack Database-as-a-Service (trove) to access the database.
+
+**CONFIG_TROVE_KS_PW**
+    Password to use for OpenStack Database-as-a-Service to authenticate with the Identity service.
+
+**CONFIG_TROVE_NOVA_USER**
+    User name to use when OpenStack Database-as-a-Service connects to the Compute service.
+
+**CONFIG_TROVE_NOVA_TENANT**
+    Tenant to use when OpenStack Database-as-a-Service connects to the Compute service.
+
+**CONFIG_TROVE_NOVA_PW**
+    Password to use when OpenStack Database-as-a-Service connects to the Compute service.
+
+Magnum Options
+------------------------
+
+**CONFIG_MAGNUM_DB_PW**
+    Password to use for the Magnum to access the database.
+
+**CONFIG_MAGNUM_KS_PW**
+    Password to use for the Magnum to authenticate with the Identity service.
+
+Log files and Debug info
+------------------------
+
+Log files and generated puppet manifests can be found in the /var/tmp/packstack directory under a directory named by the date in which Packstack was run and a random string (for example, /var/tmp/packstack/20131022-204316-Bf3Ek2). Inside the directory are the openstack-setup.log file and a manifest directory, which contains puppet manifests and a log file for each one.
+
+If debugging information is needed while running packstack, the -d switch will make it write more detailed information about the installation.
+
+Examples:
+
+If we need an all-in-one debug session:
+
+packstack -d --allinone
+
+If we need a answer file to tailor it and then debug:
+
+packstack --gen-answer-file=ans.txt
+packstack -d --answer-file=ans.txt
+
+Glusterfs Native (FUSE) configuration info
+------------------------------------------
+
+**CONFIG_MANILA_GLUSTERFS_SERVERS**
+    List of GlusterFS servers that can be used to create shares. Each GlusterFS server should be of the form [remoteuser@]<volserver>, and they are assumed to belong to distinct Gluster clusters.
+
+**CONFIG_MANILA_GLUSTERFS_NATIVE_PATH_TO_PRIVATE_KEY**
+    Path of Manila host's private SSH key file.
+
+**CONFIG_MANILA_GLUSTERFS_VOLUME_PATTERN**
+    Regular expression template used to filter GlusterFS volumes for share creation. The regex template can optionally (ie. with support of the GlusterFS backend) contain the #{size} parameter which matches an integer (sequence of digits) in which case the value shall be intepreted as size of the volume in GB. Examples: "manila-share-volume-\d+$", "manila-share-volume-#{size}G-\d+$"; with matching volume names, respectively: "manila-share-volume-12", "manila-share-volume-3G-13". In latter example, the number that matches "#{size}", that is, 3, is an indication that the size of volume is 3G.
+
+GlusterNFS configuration info
+-----------------------------
+
+**CONFIG_MANILA_GLUSTERFS_TARGET**
+    Specifies the GlusterFS volume to be mounted on the Manila host. For e.g: [remoteuser@]<volserver>:/<volid>
+
+**CONFIG_MANILA_GLUSTERFS_MOUNT_POINT_BASE**
+    Base directory containing mount points for Gluster volumes.
+
+**CONFIG_MANILA_GLUSTERFS_NFS_SERVER_TYPE**
+    Type of NFS server that mediate access to the Gluster volumes (Gluster or Ganesha).
+
+**CONFIG_MANILA_GLUSTERFS_PATH_TO_PRIVATE_KEY**
+    Path of Manila host's private SSH key file.
+
+**CONFIG_MANILA_GLUSTERFS_GANESHA_SERVER_IP**
+    Remote Ganesha server node's IP address.
+
+SOURCE
+======
+* `packstack      https://github.com/openstack/packstack`
+* `puppet modules https://github.com/puppetlabs and https://github.com/packstack`
diff --git a/external_modules.txt b/external_modules.txt
new file mode 100644
index 000000000..34702db8b
--- /dev/null
+++ b/external_modules.txt
@@ -0,0 +1,16 @@
+puppetlabs/puppetlabs-apache
+puppetlabs/puppetlabs-concat
+puppetlabs/puppetlabs-firewall
+puppetlabs/puppetlabs-inifile
+saz/puppet-memcached
+puppetlabs/puppetlabs-mysql
+rcritten/puppet-nssdb,2ed2a2df59bbeaf9cf628e1a4a499476842282fd
+voxpupuli/puppet-rabbitmq
+voxpupuli/puppet-redis
+paramite/puppet-remote,7420908328b832f4b20e1eba44bcccd926da8faa
+puppetlabs/puppetlabs-rsync
+puppetlabs/puppetlabs-stdlib
+duritong/puppet-sysctl,847ec1c07ed3e231a48d8816971c0bd4afe7a72b
+voxpupuli/puppet-systemd
+puppetlabs/puppetlabs-vcsrepo
+puppetlabs/puppetlabs-xinetd
diff --git a/openstack_modules.txt b/openstack_modules.txt
new file mode 100644
index 000000000..d44325483
--- /dev/null
+++ b/openstack_modules.txt
@@ -0,0 +1,21 @@
+aodh
+ceilometer
+cinder
+glance
+gnocchi
+heat
+horizon
+ironic
+keystone
+magnum
+manila
+neutron
+nova
+openstacklib
+oslo
+ovn
+placement
+swift
+tempest
+trove
+vswitch
diff --git a/packstack/installer/basedefs.py b/packstack/installer/basedefs.py
index d4d38d89a..eddded217 100644
--- a/packstack/installer/basedefs.py
+++ b/packstack/installer/basedefs.py
@@ -1,31 +1,56 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 """
 This module provides all the predefined variables.
 """
 
+import datetime
 import os
-import pwd
 import sys
-import datetime
 import tempfile
 
-from .utils import get_current_user
+import packstack
+from packstack.installer.utils import get_current_user
 
 
-APP_NAME = "Installer"
+APP_NAME = "Packstack"
 
 FILE_YUM_VERSION_LOCK = "/etc/yum/pluginconf.d/versionlock.list"
 
-PACKSTACK_VAR_DIR = "/var/tmp/packstack"
+PACKSTACK_SRC_DOC = os.path.realpath(
+    os.path.join(os.path.abspath(
+        packstack.__path__[0]), '..', 'docs/source/packstack.rst'
+    )
+)
+if os.path.exists(PACKSTACK_SRC_DOC):
+    PACKSTACK_DOC = PACKSTACK_SRC_DOC
+elif os.path.exists(os.path.join(sys.prefix, 'share/packstack/packstack.rst')):
+    PACKSTACK_DOC = os.path.join(sys.prefix, 'share/packstack/packstack.rst')
+elif os.path.exists('/usr/local/share/packstack/packstack.rst'):
+    PACKSTACK_DOC = '/usr/local/share/packstack/packstack.rst'
+else:
+    PACKSTACK_DOC = '/usr/share/packstack/packstack.rst'
+
+PACKSTACK_VAR_DIR = '/var/tmp/packstack'
 try:
-    os.mkdir(PACKSTACK_VAR_DIR, 0700)
+    os.mkdir(PACKSTACK_VAR_DIR, 0o700)
 except OSError:
     # directory is already created, check ownership
     stat = os.stat(PACKSTACK_VAR_DIR)
     if stat.st_uid == 0 and os.getuid() != stat.st_uid:
-        print ('%s is already created and owned by root. Please change '
-               'ownership and try again.' % PACKSTACK_VAR_DIR)
+        print('%s is already created and owned by root. Please change '
+              'ownership and try again.' % PACKSTACK_VAR_DIR)
         sys.exit(1)
 finally:
     uid, gid = get_current_user()
@@ -33,25 +58,44 @@
     if uid != 0 and os.getuid() == 0:
         try:
             os.chown(PACKSTACK_VAR_DIR, uid, gid)
-        except Exception, ex:
-            print ('Unable to change owner of %s. Please fix ownership '
-                   'manually and try again.' % PACKSTACK_VAR_DIR)
+        except Exception:
+            print('Unable to change owner of %s. Please fix ownership '
+                  'manually and try again.' % PACKSTACK_VAR_DIR)
             sys.exit(1)
 
 _tmpdirprefix = datetime.datetime.now().strftime('%Y%m%d-%H%M%S-')
 VAR_DIR = tempfile.mkdtemp(prefix=_tmpdirprefix, dir=PACKSTACK_VAR_DIR)
 DIR_LOG = VAR_DIR
+FILE_LOG = 'openstack-setup.log'
 PUPPET_MANIFEST_RELATIVE = "manifests"
 PUPPET_MANIFEST_DIR = os.path.join(VAR_DIR, PUPPET_MANIFEST_RELATIVE)
+HIERADATA_FILE_RELATIVE = "hieradata"
+HIERADATA_DIR = os.path.join(VAR_DIR, HIERADATA_FILE_RELATIVE)
+
+LATEST_LOG_DIR = '%s/latest' % PACKSTACK_VAR_DIR
+if os.path.exists(LATEST_LOG_DIR):
+    try:
+        os.unlink(LATEST_LOG_DIR)
+    except OSError:
+        print('Unable to delete symbol link for log dir %s.' % LATEST_LOG_DIR)
+
+try:
+    # Extract folder name at /var/tmp/packstack/<VAR_DIR> and do a relative
+    # symlink to /var/tmp/packstack/latest
+    os.symlink(os.path.basename(VAR_DIR),
+               os.path.join(PACKSTACK_VAR_DIR, 'latest'))
+except OSError:
+    print('Unable to create symbol link for log dir %s.' % LATEST_LOG_DIR)
+
+PUPPET_DEPENDENCIES = ['puppet', 'hiera', 'openssh-clients', 'tar', 'nc']
+PUPPET_MODULES_DEPS = ['rubygem-json']
 
 FILE_INSTALLER_LOG = "setup.log"
 
-DIR_PROJECT_DIR = os.environ.get('INSTALLER_PROJECT_DIR', os.path.join(os.getcwd(), 'packstack'))
+DIR_PROJECT_DIR = os.environ.get('INSTALLER_PROJECT_DIR', os.path.abspath(os.path.join(os.path.split(__file__)[0], '..')))
 DIR_PLUGINS = os.path.join(DIR_PROJECT_DIR, "plugins")
 DIR_MODULES = os.path.join(DIR_PROJECT_DIR, "modules")
 
-
-
 EXEC_RPM = "rpm"
 EXEC_SEMANAGE = "semanage"
 EXEC_NSLOOKUP = "nslookup"
diff --git a/packstack/installer/core/arch.py b/packstack/installer/core/arch.py
new file mode 100644
index 000000000..f828ea454
--- /dev/null
+++ b/packstack/installer/core/arch.py
@@ -0,0 +1,41 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Simple routines to map host architectures as expected by various components.
+"""
+
+import os
+
+
+def kernel_arch():
+    """Return the kernel arch."""
+    return os.uname()[4]
+
+
+def dib_arch():
+    """Return the kernel arch or the more appropriate DiB arch."""
+    DIB_MAP = {
+        'x86_64': 'amd64',
+        'aarch64': 'arm64',
+    }
+    return DIB_MAP.get(kernel_arch(), kernel_arch())
+
+
+def cirros_arch():
+    """Return the kernel arch or the more appropriate cirros arch."""
+    CIRROS_MAP = {
+        'ppc64le': 'powerpc',
+        'aarch64': 'arm',
+    }
+    return CIRROS_MAP.get(kernel_arch(), kernel_arch())
diff --git a/packstack/installer/core/drones.py b/packstack/installer/core/drones.py
index 66e846855..e2869423a 100644
--- a/packstack/installer/core/drones.py
+++ b/packstack/installer/core/drones.py
@@ -1,12 +1,24 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
+import logging
 import os
+import shutil
 import stat
-import uuid
-import time
-import logging
 import tarfile
 import tempfile
+import time
+import uuid
 
 from .. import utils
 
@@ -24,11 +36,11 @@ def _transfer(self, pack_path, pack_dest, res_dir):
         script.append("scp %(pack_path)s root@%(node)s:%(pack_dest)s"
                       % args)
         script.append("ssh -o StrictHostKeyChecking=no "
-                        "-o UserKnownHostsFile=/dev/null root@%(node)s "
-                        "tar -C %(res_dir)s -xpzf %(pack_dest)s" % args)
+                      "-o UserKnownHostsFile=/dev/null root@%(node)s "
+                      "tar -C %(res_dir)s -xpzf %(pack_dest)s" % args)
         try:
             script.execute()
-        except ScriptRuntimeError as ex:
+        except utils.ScriptRuntimeError as ex:
             # TO-DO: change to appropriate exception
             raise RuntimeError('Failed to copy resources to node %s. '
                                'Reason: %s' % (node, ex))
@@ -63,7 +75,7 @@ def _pack_recipes(self):
             dest = self.recipe_dir[len(self.resource_dir):].lstrip('/')
         else:
             dest = ''
-        for marker, recipes in self._recipes.iteritems():
+        for marker, recipes in self._recipes.items():
             for path in recipes:
                 _dest = os.path.join(dest, os.path.basename(path))
                 pack.add(path, arcname=_dest)
@@ -124,15 +136,15 @@ def __init__(self, node, resource_dir=None, recipe_dir=None,
         # remote host IP or hostname
         self.node = node
         # working directories on remote host
-        self.resource_dir = resource_dir or \
-                            '/tmp/drone%s' % uuid.uuid4().hex[:8]
-        self.recipe_dir = recipe_dir or \
-                          os.path.join(self.resource_dir, 'recipes')
+        self.resource_dir = (resource_dir or
+                             '/tmp/drone%s' % uuid.uuid4().hex[:8])
+        self.recipe_dir = (recipe_dir or
+                           os.path.join(self.resource_dir, 'recipes'))
         # temporary directories
-        self.remote_tmpdir = remote_tmpdir or \
-                             '/tmp/drone%s' % uuid.uuid4().hex[:8]
-        self.local_tmpdir = local_tmpdir or \
-                            tempfile.mkdtemp(prefix='drone')
+        self.remote_tmpdir = (remote_tmpdir or
+                              '/tmp/drone%s' % uuid.uuid4().hex[:8])
+        self.local_tmpdir = (local_tmpdir or
+                             tempfile.mkdtemp(prefix='drone'))
 
     def init_node(self):
         """
@@ -249,7 +261,7 @@ def set_observer(self, observer):
         Registers an observer. Given object should be subclass of class
         DroneObserver.
         """
-        for attr in ('applying', 'checking',  'finished'):
+        for attr in ('applying', 'checking', 'finished'):
             if not hasattr(observer, attr):
                 raise ValueError('Observer object should be a subclass '
                                  'of class DroneObserver.')
@@ -266,7 +278,7 @@ def apply(self, marker=None, name=None, skip=None):
         logger = logging.getLogger()
         skip = skip or []
         lastmarker = None
-        for mark, recipelist in self._recipes.iteritems():
+        for mark, recipelist in self._recipes.items():
             if marker and marker != mark:
                 logger.debug('Skipping marker %s for node %s.' %
                              (mark, self.node))
@@ -334,8 +346,8 @@ def init_node(self):
         super(PackstackDrone, self).init_node()
         server = utils.ScriptRunner(self.node)
         for pkg in ("puppet", "openssh-clients", "tar"):
-            server.append("rpm -q --whatprovides %(pkg)s || "
-                              "yum install -y %(pkg)s" % locals())
+            server.append(f"rpm -q --whatprovides {pkg} || "
+                          f"yum install -y {pkg}")
         server.execute()
 
     def add_resource(self, path, resource_type=None):
@@ -352,15 +364,15 @@ def _finished(self, recipe):
                            recipe_base.replace(".finished", ".log"))
         local = utils.ScriptRunner()
         local.append('scp -o StrictHostKeyChecking=no '
-                         '-o UserKnownHostsFile=/dev/null '
-                         'root@%s:%s %s' % (self.node, recipe, log))
+                     '-o UserKnownHostsFile=/dev/null '
+                     'root@%s:%s %s' % (self.node, recipe, log))
         try:
             # once a remote puppet run has finished, we retrieve
             # the log file and check it for errors
             local.execute(log=False)
             # if we got to this point the puppet apply has finished
             return True
-        except utils.ScriptRuntimeError, e:
+        except utils.ScriptRuntimeError:
             # the test raises an exception if the file doesn't exist yet
             return False
 
@@ -389,9 +401,9 @@ def _apply(self, recipe):
         rdir = self.resource_dir
         mdir = self._module_dir
         server.append(
-            "( flock %(rdir)s/ps.lock "
-                "puppet apply %(loglevel)s --modulepath %(mdir)s "
-                "%(recipe)s > %(running)s 2>&1 < /dev/null; "
-            "mv %(running)s %(finished)s ) "
-            "> /dev/null 2>&1 < /dev/null &" % locals())
+            f"( flock {rdir}/ps.lock "
+            f"puppet apply {loglevel} --modulepath {mdir} "
+            f"{recipe} > {running} 2>&1 < /dev/null; "
+            f"mv {running} {finished} ) "
+            "> /dev/null 2>&1 < /dev/null &")
         server.execute()
diff --git a/packstack/installer/core/parameters.py b/packstack/installer/core/parameters.py
index 5636c1690..4078e6dce 100644
--- a/packstack/installer/core/parameters.py
+++ b/packstack/installer/core/parameters.py
@@ -1,4 +1,15 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 """
 Container set for groups and parameters
@@ -11,14 +22,15 @@ class Parameter(object):
     allowed_keys = ('CONF_NAME', 'CMD_OPTION', 'USAGE', 'PROMPT',
                     'PROCESSORS', 'VALIDATORS', 'LOOSE_VALIDATION',
                     'DEFAULT_VALUE', 'USE_DEFAULT', 'OPTION_LIST',
-                    'MASK_INPUT', 'NEED_CONFIRM','CONDITION')
+                    'MASK_INPUT', 'NEED_CONFIRM', 'CONDITION', 'DEPRECATES',
+                    'MESSAGE', 'MESSAGE_VALUES')
 
     def __init__(self, attributes=None):
         attributes = attributes or {}
         defaults = {}.fromkeys(self.allowed_keys)
         defaults.update(attributes)
 
-        for key, value in defaults.iteritems():
+        for key, value in defaults.items():
             if key not in self.allowed_keys:
                 raise KeyError('Given attribute %s is not allowed' % key)
             self.__dict__[key] = value
diff --git a/packstack/installer/core/sequences.py b/packstack/installer/core/sequences.py
index d38a39310..5d26c9745 100644
--- a/packstack/installer/core/sequences.py
+++ b/packstack/installer/core/sequences.py
@@ -1,11 +1,22 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 """
 Base class for steps & sequences
 """
-import re
-import sys
+
 import logging
+import sys
 import traceback
 
 from .. import utils
@@ -26,28 +37,28 @@ def __init__(self, name, function, title=None):
                                 "Object %s is not callable." % function)
         self.function = function
 
-    def run(self, config=None):
-        config = config or {}
+    def run(self, config=None, messages=None):
+        config = config if config is not None else {}
+        messages = messages if messages is not None else []
         # TO-DO: complete logger name when logging will be setup correctly
         logger = logging.getLogger()
         logger.debug('Running step %s.' % self.name)
 
         # execute and report state
         try:
-            self.function(config)
-        except Exception, ex:
+            self.function(config, messages)
+        except Exception:
             logger.debug(traceback.format_exc())
             state = utils.state_message(self.title, 'ERROR', 'red')
             sys.stdout.write('%s\n' % state)
             sys.stdout.flush()
-            raise SequenceError(str(ex))
+            raise
         else:
             state = utils.state_message(self.title, 'DONE', 'green')
             sys.stdout.write('%s\n' % state)
             sys.stdout.flush()
 
 
-
 class Sequence(object):
     """
     Wrapper for sequence of setup steps.
@@ -75,16 +86,17 @@ def validate_condition(self, config):
         result = config.get(self.condition)
         return result == self.cond_match
 
-    def run(self, config=None, step=None):
+    def run(self, config=None, messages=None, step=None):
         """
         Runs sequence of steps. Runs only specific step if step's name
         is given via 'step' parameter.
         """
-        config = config or {}
+        config = config if config is not None else {}
+        messages = messages if messages is not None else []
         if not self.validate_condition(config):
             return
         if step:
-            self.steps[step].run(config=config)
+            self.steps[step].run(config=config, messages=messages)
             return
 
         logger = logging.getLogger()
@@ -93,4 +105,4 @@ def run(self, config=None, step=None):
             sys.stdout.write('%s\n' % self.title)
             sys.stdout.flush()
         for step in self.steps.itervalues():
-            step.run(config=config)
+            step.run(config=config, messages=messages)
diff --git a/packstack/installer/exceptions.py b/packstack/installer/exceptions.py
index cf0dc4d4c..8ffd6cc89 100644
--- a/packstack/installer/exceptions.py
+++ b/packstack/installer/exceptions.py
@@ -1,4 +1,15 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 __all__ = (
     'PackStackError',
diff --git a/packstack/installer/output_messages.py b/packstack/installer/output_messages.py
index 32f948c58..36d28f885 100644
--- a/packstack/installer/output_messages.py
+++ b/packstack/installer/output_messages.py
@@ -1,3 +1,16 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 '''
 external text file to hold all user visible text.
 info messages begins with INFO_ and error msg with ERR_
@@ -10,36 +23,32 @@
 
 DONT CHANGE any of the params names (in UPPER-CASE)
 they are used in the engine-setup.py
-'''
-
-import basedefs
+'''     # noqa: W605
 
-#####################
-####INFO MESSAGES####
-#####################
+from packstack.installer import basedefs
 
-INFO_HEADER="Welcome to %s setup utility" % basedefs.APP_NAME
-INFO_INSTALL_SUCCESS="\n **** Installation completed successfully ******\n"
-INFO_INSTALL="Installing:"
-INFO_DSPLY_PARAMS="\n%s will be installed using the following configuration:" % basedefs.APP_NAME
-INFO_USE_PARAMS="Proceed with the configuration listed above"
-INFO_DONE="DONE"
-INFO_ERROR="ERROR"
-INFO_LOG_FILE_PATH="The installation log file is available at: %s"
-INFO_MANIFEST_PATH="The generated manifests are available at: %s"
-INFO_ADDTIONAL_MSG="Additional information:"
-INFO_ADDTIONAL_MSG_BULLET=" * %s"
-INFO_CONF_PARAMS_PASSWD_CONFIRM_PROMPT="Confirm password"
-INFO_VAL_PATH_SPACE="Error: mount point %s contains only %s of available space while a minimum of %s is required"
-INFO_VAL_NOT_INTEGER="Error: value is not an integer"
-INFO_VAL_PORT_NOT_RANGE="Error: port is outside the range of %i - 65535"
-INFO_VAL_STRING_EMPTY="Warning: The %s parameter is empty"
-INFO_VAL_NOT_IN_OPTIONS="Error: response is not part of the following accepted answers: %s"
-INFO_VAL_NOT_DOMAIN="Error: domain is not a valid domain name"
-INFO_VAL_NOT_USER="Error: user name contains illegal characters"
-INFO_VAL_PORT_OCCUPIED="Error: TCP Port %s is already open by %s (pid: %s)"
-INFO_VAL_PORT_OCCUPIED_BY_JBOSS="Error: TCP Port %s is used by JBoss"
-INFO_VAL_PASSWORD_DONT_MATCH="Error: passwords don't match"
+INFO_HEADER = "Welcome to the %s setup utility" % basedefs.APP_NAME
+INFO_INSTALL_SUCCESS = "\n **** Installation completed successfully ******\n"
+INFO_INSTALL = "Installing:"
+INFO_DSPLY_PARAMS = "\n%s will be installed using the following configuration:" % basedefs.APP_NAME
+INFO_USE_PARAMS = "Proceed with the configuration listed above"
+INFO_DONE = "DONE"
+INFO_ERROR = "ERROR"
+INFO_LOG_FILE_PATH = "The installation log file is available at: %s"
+INFO_MANIFEST_PATH = "The generated manifests are available at: %s"
+INFO_ADDTIONAL_MSG = "Additional information:"
+INFO_ADDTIONAL_MSG_BULLET = " * %s"
+INFO_CONF_PARAMS_PASSWD_CONFIRM_PROMPT = "Confirm password"
+INFO_VAL_PATH_SPACE = "Error: mount point %s contains only %s of available space while a minimum of %s is required"
+INFO_VAL_NOT_INTEGER = "Error: value is not an integer"
+INFO_VAL_PORT_NOT_RANGE = "Error: port is outside the range of %i - 65535"
+INFO_VAL_STRING_EMPTY = "Warning: The %s parameter is empty"
+INFO_VAL_NOT_IN_OPTIONS = "Error: response is not part of the following accepted answers: %s"
+INFO_VAL_NOT_DOMAIN = "Error: domain is not a valid domain name"
+INFO_VAL_NOT_USER = "Error: user name contains illegal characters"
+INFO_VAL_PORT_OCCUPIED = "Error: TCP Port %s is already open by %s (pid: %s)"
+INFO_VAL_PORT_OCCUPIED_BY_JBOSS = "Error: TCP Port %s is used by JBoss"
+INFO_VAL_PASSWORD_DONT_MATCH = "Error: passwords don't match"
 
 INFO_CHANGED_VALUE = ("Packstack changed given value %s to required "
                       "value %s")
@@ -48,39 +57,44 @@
                         "services might not run correctly when hostname"
                         " is used.")
 
-INFO_STRING_LEN_LESS_THAN_MIN="String length is less than the minimum allowed: %s"
-INFO_STRING_EXCEEDS_MAX_LENGTH="String length exceeds the maximum length allowed: %s"
-INFO_STRING_CONTAINS_ILLEGAL_CHARS="String contains illegal characters"
-INFO_CINDER_VOLUMES_EXISTS="Did not create a cinder volume group, one already existed"
-INFO_REMOVE_REMOTE_VAR="Removing %s on %s (if it is a remote host)"
+INFO_STRING_LEN_LESS_THAN_MIN = "String length is less than the minimum allowed: %s"
+INFO_STRING_EXCEEDS_MAX_LENGTH = "String length exceeds the maximum length allowed: %s"
+INFO_STRING_CONTAINS_ILLEGAL_CHARS = "String contains illegal characters"
+INFO_CINDER_VOLUMES_EXISTS = "Did not create a cinder volume group, one already existed"
+INFO_REMOVE_REMOTE_VAR = "Removing %s on %s (if it is a remote host)"
 
-WARN_WEAK_PASS="Warning: Weak Password."
+WARN_WEAK_PASS = "Warning: Weak Password."
+WARN_NM_ENABLED = ("Warning: NetworkManager is active on %s. OpenStack "
+                   "networking currently does not work on systems that have "
+                   "the Network Manager service enabled.")
+WARN_IPV6_OVS = ("Warning: IPv6 and ovs tunneling is not yet supported and "
+                 "will fail on host %s see https://bugzilla.redhat.com/show_bug.cgi?id=1100360.")
 
 ERR_PING = "Error: the provided hostname is unreachable"
 ERR_SSH = "Error: could not connect to the ssh server: %s"
 ERR_FILE = "Error: the provided file is not present"
-ERR_CHECK_LOG_FILE_FOR_MORE_INFO="Please check log file %s for more information"
-ERR_YUM_LOCK="Internal Error: Can't edit versionlock "
+ERR_CHECK_LOG_FILE_FOR_MORE_INFO = "Please check log file %s for more information"
+ERR_YUM_LOCK = "Internal Error: Can't edit versionlock "
 ERR_FAILED_START_SERVICE = "Error: Can't start the %s service"
 ERR_FAILED_STOP_SERVICE = "Error: Can't stop the %s service"
-ERR_EXP_HANDLE_PARAMS="Failed handling user parameters input"
-ERR_EXP_KEYBOARD_INTERRUPT="Keyboard interrupt caught."
-ERR_READ_RPM_VER="Error reading version number for package %s"
-ERR_EXP_READ_INPUT_PARAM="Error while trying to read parameter %s from user."
-ERR_EXP_VALIDATE_PARAM="Error validating parameter %s from user."
-ERR_EXP_HANDLE_ANSWER_FILE="Failed handling answer file: %s"
-ERR_EXP_GET_CFG_IPS="Could not get list of available IP addresses on this host"
-ERR_EXP_GET_CFG_IPS_CODES="Failed to get list of IP addresses"
-ERR_EXP_CANT_FIND_IP="Could not find any configured IP address"
-ERR_DIDNT_RESOLVED_IP="%s did not resolve into an IP address"
-ERR_IPS_NOT_CONFIGED="Some or all of the IP addresses: (%s) which were resolved from the FQDN %s are not configured on any interface on this host"
-ERR_IPS_NOT_CONFIGED_ON_INT="The IP (%s) which was resolved from the FQDN %s is not configured on any interface on this host"
-ERR_IPS_HAS_NO_PTR="None of the IP addresses on this host(%s) holds a PTR record for the FQDN: %s"
-ERR_IP_HAS_NO_PTR="The IP %s does not hold a PTR record for the FQDN: %s"
-ERR_EXP_FAILED_INIT_LOGGER="Unexpected error: Failed to initiate logger, please check file system permission"
-ERR_FAILURE="General failure"
-ERR_NO_ANSWER_FILE="Error: Could not find file %s"
-ERR_ONLY_1_FLAG="Error: The %s flag is mutually exclusive to all other command line options"
-ERR_REMOVE_REMOTE_VAR="Error: Failed to remove directory %s on %s, it contains sensitive data and should be removed"
-
+ERR_EXP_HANDLE_PARAMS = "Failed handling user parameters input"
+ERR_EXP_KEYBOARD_INTERRUPT = "Keyboard interrupt caught."
+ERR_READ_RPM_VER = "Error reading version number for package %s"
+ERR_EXP_READ_INPUT_PARAM = "Error while trying to read parameter %s from user."
+ERR_EXP_VALIDATE_PARAM = "Error validating parameter %s from user."
+ERR_EXP_HANDLE_ANSWER_FILE = "Failed handling answer file: %s"
+ERR_EXP_GET_CFG_IPS = "Could not get list of available IP addresses on this host"
+ERR_EXP_GET_CFG_IPS_CODES = "Failed to get list of IP addresses"
+ERR_EXP_CANT_FIND_IP = "Could not find any configured IP address"
+ERR_DIDNT_RESOLVED_IP = "%s did not resolve into an IP address"
+ERR_IPS_NOT_CONFIGED = "Some or all of the IP addresses: (%s) which were resolved from the FQDN %s are not configured on any interface on this host"
+ERR_IPS_NOT_CONFIGED_ON_INT = "The IP (%s) which was resolved from the FQDN %s is not configured on any interface on this host"
+ERR_IPS_HAS_NO_PTR = "None of the IP addresses on this host(%s) holds a PTR record for the FQDN: %s"
+ERR_IP_HAS_NO_PTR = "The IP %s does not hold a PTR record for the FQDN: %s"
+ERR_EXP_FAILED_INIT_LOGGER = "Unexpected error: Failed to initiate logger, please check file system permission"
+ERR_FAILURE = "General failure"
+ERR_NO_ANSWER_FILE = "Error: Could not find file %s"
+ERR_ONLY_1_FLAG = "Error: The %s flag is mutually exclusive to all other command line options"
+ERR_REMOVE_REMOTE_VAR = "Error: Failed to remove directory %s on %s, it contains sensitive data and should be removed"
+ERR_REMOVE_TMP_FILE = "Error: Failed to remove temporary file %s, it contains sensitive data and should be removed"
 #
diff --git a/packstack/installer/processors.py b/packstack/installer/processors.py
index a8edd966b..63ce386f5 100644
--- a/packstack/installer/processors.py
+++ b/packstack/installer/processors.py
@@ -1,17 +1,32 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 import netaddr
 import os
+import uuid
 
-from .utils import ScriptRunner, force_ip
-from .exceptions import ParamProcessingError, NetworkError
+from .utils import force_ip
+from .utils import ScriptRunner
+from .exceptions import NetworkError
+from .exceptions import ParamProcessingError
 
 
 __all__ = ('ParamProcessingError', 'process_cidr', 'process_host',
-           'process_ssh_key')
+           'process_ssh_key', 'process_add_quotes_around_values',
+           'process_password', 'process_string_nofloat', 'process_bool')
 
 
-def process_cidr(param, process_args=None):
+def process_cidr(param, param_name, config=None):
     """
     Corrects given CIDR if necessary.
     """
@@ -20,24 +35,22 @@ def process_cidr(param, process_args=None):
         return param
     try:
         return str(netaddr.IPNetwork(param).cidr)
-    except Exception, ex:
+    except Exception as ex:
         raise ParamProcessingError(str(ex))
 
 
-def process_host(param, process_args=None):
+def process_host(param, param_name, config=None):
     """
     Tries to change given parameter to IP address, if it is in hostname
     format
     """
-    localhost = process_args and \
-                process_args.get('allow_localhost', False)
     try:
-        return force_ip(param, allow_localhost=localhost)
-    except NetworkError, ex:
+        return force_ip(param, allow_localhost=True)
+    except NetworkError as ex:
         raise ParamProcessingError(str(ex))
 
 
-def process_ssh_key(param, process_args=None):
+def process_ssh_key(param, param_name, config=None):
     """
     Generates SSH key if given key in param doesn't exist. In case param
     is an empty string it generates default SSH key ($HOME/.ssh/id_rsa).
@@ -63,7 +76,7 @@ def create_key(path):
     return param
 
 
-def process_add_quotes_around_values(param, process_args=None):
+def process_add_quotes_around_values(param, param_name, config=None):
     """
     Add a single quote character around each element of a comma
     separated list of values
@@ -77,3 +90,68 @@ def process_add_quotes_around_values(param, process_args=None):
         params_list[index] = elem
     param = ','.join(params_list)
     return param
+
+
+def process_password(param, param_name, config=None):
+    """
+    Process passwords, checking the following:
+    1- If there is a user-entered password, use it
+    2- Otherwise, check for a global default password, and use it if available
+    3- As a last resort, generate a random password
+    """
+    if not hasattr(process_password, "pw_dict"):
+        process_password.pw_dict = {}
+
+    if param == "PW_PLACEHOLDER":
+        if config["CONFIG_DEFAULT_PASSWORD"] != "":
+            param = config["CONFIG_DEFAULT_PASSWORD"]
+        else:
+            # We need to make sure we store the random password we provide
+            # and return it once we are asked for it again
+            if param_name.endswith("_CONFIRMED"):
+                unconfirmed_param = param_name[:-10]
+                if unconfirmed_param in process_password.pw_dict:
+                    param = process_password.pw_dict[unconfirmed_param]
+                else:
+                    param = uuid.uuid4().hex[:16]
+                    process_password.pw_dict[unconfirmed_param] = param
+            elif param_name not in process_password.pw_dict:
+                param = uuid.uuid4().hex[:16]
+                process_password.pw_dict[param_name] = param
+            else:
+                param = process_password.pw_dict[param_name]
+    return param
+
+
+def process_heat(param, param_name, config=None):
+    return param
+
+
+def process_string_nofloat(param, param_name, config=None):
+    """
+    Process a string, making sure it is *not* convertible into a float
+    If it is, change it into a random 16 char string, and check again
+    """
+    while True:
+        try:
+            float(param)
+        except ValueError:
+            return param
+        else:
+            param = uuid.uuid4().hex[:16]
+
+
+def process_bool(param, param_name, config=None):
+    """Converts param to appropriate boolean representation.
+
+    Retunrs True if answer == y|yes|true, False if answer == n|no|false.
+    """
+    if param.lower() in ('y', 'yes', 'true'):
+        return True
+    elif param.lower() in ('n', 'no', 'false'):
+        return False
+
+
+# Define silent processors
+for proc_func in (process_bool, process_add_quotes_around_values):
+    proc_func.silent = True
diff --git a/packstack/installer/run_setup.py b/packstack/installer/run_setup.py
index 54875251b..7c8a266fe 100644
--- a/packstack/installer/run_setup.py
+++ b/packstack/installer/run_setup.py
@@ -1,66 +1,83 @@
-import ConfigParser
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import configparser
 import copy
 import datetime
+from functools import cmp_to_key
 import getpass
+import io
 import logging
 import os
 import re
 import sys
-from StringIO import StringIO
+import textwrap
 import traceback
 import types
-import textwrap
 
-from optparse import OptionParser, OptionGroup
+from optparse import OptionGroup
+from optparse import OptionParser
 
-import basedefs
-import validators
+from packstack.installer import basedefs
+from packstack.installer import validators
 from . import utils
-import processors
-import output_messages
-from .exceptions import FlagValidationError, ParamValidationError
+from packstack.installer import processors
+from packstack.installer import output_messages
+from .exceptions import FlagValidationError
+from .exceptions import ParamValidationError
 
-from packstack import version
-from packstack.modules.ospluginutils import gethostlist
-from setup_controller import Controller
+from packstack.modules.common import filtered_hosts
+from packstack.version import version_info
+from packstack.installer.setup_controller import Controller
 
 controller = Controller()
 commandLineValues = {}
 
 # List to hold all values to be masked in logging (i.e. passwords and sensitive data)
-#TODO: read default values from conf_param?
+# TODO(tbd): read default values from conf_param?
 masked_value_set = set()
+tmpfiles = []
 
 
-def initLogging (debug):
-    global logFile
-
+def initLogging(debug):
     try:
-        logFilename = "openstack-setup.log"
-        logFile = os.path.join(basedefs.DIR_LOG, logFilename)
+        logFile = os.path.join(basedefs.DIR_LOG, basedefs.FILE_LOG)
 
         # Create the log file with specific permissions, puppet has a habbit of putting
         # passwords in logs
-        os.close(os.open(logFile, os.O_CREAT | os.O_EXCL, 0600))
+        os.close(os.open(logFile, os.O_CREAT | os.O_EXCL, 0o600))
 
-        hdlr = logging.FileHandler (filename=logFile, mode='w')
+        hdlr = logging.FileHandler(filename=logFile, mode='w')
         if (debug):
             level = logging.DEBUG
         else:
             level = logging.INFO
 
-        fmts='%(asctime)s::%(levelname)s::%(module)s::%(lineno)d::%(name)s:: %(message)s'
-        dfmt='%Y-%m-%d %H:%M:%S'
+        fmts = '%(asctime)s::%(levelname)s::%(module)s::%(lineno)d::%(name)s:: %(message)s'
+        dfmt = '%Y-%m-%d %H:%M:%S'
         fmt = logging.Formatter(fmts, dfmt)
         hdlr.setFormatter(fmt)
 
         logging.root.handlers = []
         logging.root.addHandler(hdlr)
         logging.root.setLevel(level)
-    except:
+    except Exception:
         logging.error(traceback.format_exc())
         raise Exception(output_messages.ERR_EXP_FAILED_INIT_LOGGER)
 
+    return logFile
+
+
 def _getInputFromUser(param):
     """
     this private func reads the data from the user
@@ -76,13 +93,13 @@ def _getInputFromUser(param):
         else:
             while loop:
                 # If the value was not supplied by the command line flags
-                if not commandLineValues.has_key(param.CONF_NAME):
-                    message = StringIO()
+                if param.CONF_NAME not in commandLineValues:
+                    message = io.StringIO()
                     message.write(param.PROMPT)
 
                     val_list = param.VALIDATORS or []
-                    if validators.validate_regexp not in val_list \
-                       and param.OPTION_LIST:
+                    if (validators.validate_regexp not in val_list and
+                            param.OPTION_LIST):
                         message.write(" [%s]" % "|".join(param.OPTION_LIST))
 
                     if param.DEFAULT_VALUE:
@@ -90,12 +107,12 @@ def _getInputFromUser(param):
 
                     message.write(": ")
                     message.seek(0)
-                    #mask password or hidden fields
+                    # mask password or hidden fields
 
                     if (param.MASK_INPUT):
                         userInput = getpass.getpass("%s :" % (param.PROMPT))
                     else:
-                        userInput = raw_input(message.read())
+                        userInput = input(message.read())
                 else:
                     userInput = commandLineValues[param.CONF_NAME]
                 # If DEFAULT_VALUE is set and user did not input anything
@@ -120,20 +137,22 @@ def _getInputFromUser(param):
                             controller.CONF[param.CONF_NAME] = userInput
                             continue
                         else:
-                            if commandLineValues.has_key(param.CONF_NAME):
+                            if param.CONF_NAME in commandLineValues:
                                 del commandLineValues[param.CONF_NAME]
                     else:
                         # Delete value from commandLineValues so that we will prompt the user for input
-                        if commandLineValues.has_key(param.CONF_NAME):
+                        if param.CONF_NAME in commandLineValues:
                             del commandLineValues[param.CONF_NAME]
                         loop = True
     except KeyboardInterrupt:
-        print "" # add the new line so messages wont be displayed in the same line as the question
+        # add the new line so messages wont be displayed in the same line as the question
+        print("")
         raise
-    except:
+    except Exception:
         logging.error(traceback.format_exc())
         raise Exception(output_messages.ERR_EXP_READ_INPUT_PARAM % (param.CONF_NAME))
 
+
 def input_param(param):
     """
     this func will read input from user
@@ -141,14 +160,13 @@ def input_param(param):
     """
     # We need to check if a param needs confirmation, (i.e. ask user twice)
     # Do not validate if it was given from the command line
-    if (param.NEED_CONFIRM and not commandLineValues.has_key(param.CONF_NAME)):
-        #create a copy of the param so we can call it twice
+    if param.NEED_CONFIRM and param.CONF_NAME not in commandLineValues:
+        # create a copy of the param so we can call it twice
         confirmedParam = copy.deepcopy(param)
         confirmedParamName = param.CONF_NAME + "_CONFIRMED"
         confirmedParam.CONF_NAME = confirmedParamName
         confirmedParam.PROMPT = output_messages.INFO_CONF_PARAMS_PASSWD_CONFIRM_PROMPT
-        confirmedParam.VALIDATORS = [validators.validate_not_empty]
-        # Now get both values from user (with existing validations
+        # Now get both values from user (with existing validations)
         while True:
             _getInputFromUser(param)
             _getInputFromUser(confirmedParam)
@@ -156,34 +174,36 @@ def input_param(param):
                 logging.debug("Param confirmation passed, value for both questions is identical")
                 break
             else:
-                print output_messages.INFO_VAL_PASSWORD_DONT_MATCH
+                print(output_messages.INFO_VAL_PASSWORD_DONT_MATCH)
     else:
         _getInputFromUser(param)
 
     return param
 
+
 def _askYesNo(question=None):
-    message = StringIO()
+    message = io.StringIO()
 
     while True:
-        askString = "\r%s? (yes|no): "%(question)
-        logging.debug("asking user: %s"%askString)
+        askString = "\r%s? (yes|no): " % (question)
+        logging.debug("asking user: %s" % askString)
 
         message.write(askString)
         message.seek(0)
 
-        raw = raw_input(message.read())
+        raw = input(message.read())
         if not len(raw):
             continue
 
         answer = raw[0].lower()
-        logging.debug("user answered read: %s"%(answer))
+        logging.debug("user answered read: %s" % (answer))
 
         if answer not in 'yn':
             continue
 
         return answer == 'y'
 
+
 def _addDefaultsToMaskedValueSet():
     """
     For every param in conf_params
@@ -194,9 +214,10 @@ def _addDefaultsToMaskedValueSet():
     for group in controller.getAllGroups():
         for param in group.parameters.itervalues():
             # Keep default password values masked, but ignore default empty values
-            if ((param.MASK_INPUT == True) and param.DEFAULT_VALUE != ""):
+            if ((param.MASK_INPUT is True) and param.DEFAULT_VALUE != ""):
                 masked_value_set.add(param.DEFAULT_VALUE)
 
+
 def _updateMaskedValueSet():
     """
     For every param in conf
@@ -206,9 +227,10 @@ def _updateMaskedValueSet():
     global masked_value_set
     for confName in controller.CONF:
         # Add all needed values to masked_value_set
-        if (controller.getParamKeyValue(confName, "MASK_INPUT") == True):
+        if (controller.getParamKeyValue(confName, "MASK_INPUT") is True):
             masked_value_set.add(controller.CONF[confName])
 
+
 def mask(input):
     """
     Gets a dict/list/str and search maksked values in them.
@@ -217,25 +239,26 @@ def mask(input):
     If it finds, it replaces them with '********'
     """
     output = copy.deepcopy(input)
-    if type(input) == types.DictType:
+    if isinstance(input, dict):
         for key in input:
-            if type(input[key]) == types.StringType:
+            if isinstance(input[key], str):
                 output[key] = utils.mask_string(input[key],
                                                 masked_value_set)
-    if type(input) == types.ListType:
+    if isinstance(input, list):
         for item in input:
             org = item
             orgIndex = input.index(org)
-            if type(item) == types.StringType:
+            if isinstance(item, str):
                 item = utils.mask_string(item, masked_value_set)
             if item != org:
                 output.remove(org)
                 output.insert(orgIndex, item)
-    if type(input) == types.StringType:
-            output = utils.mask_string(input, masked_value_set)
+    if isinstance(input, str):
+        output = utils.mask_string(input, masked_value_set)
 
     return output
 
+
 def removeMaskString(maskedString):
     """
     remove an element from masked_value_set
@@ -254,6 +277,7 @@ def removeMaskString(maskedString):
     if found:
         masked_value_set.remove(maskedString)
 
+
 def validate_param_value(param, value):
     cname = param.CONF_NAME
     logging.debug("Validating parameter %s." % cname)
@@ -264,30 +288,34 @@ def validate_param_value(param, value):
         try:
             val_func(value, opt_list)
         except ParamValidationError as ex:
-            print 'Parameter %s failed validation: %s' % (cname, ex)
+            print('Parameter %s failed validation: %s' % (cname, ex))
             raise
 
+
 def process_param_value(param, value):
     _value = value
     proclist = param.PROCESSORS or []
     for proc_func in proclist:
+        is_silent = getattr(proc_func, 'silent', False)
         logging.debug("Processing value of parameter "
                       "%s." % param.CONF_NAME)
         try:
-            new_value = proc_func(_value, controller.CONF)
+            new_value = proc_func(_value, param.CONF_NAME, controller.CONF)
             if new_value != _value:
-                msg = output_messages.INFO_CHANGED_VALUE
-                print msg % (_value, new_value)
+                if param.MASK_INPUT is False and not is_silent:
+                    msg = output_messages.INFO_CHANGED_VALUE
+                    print(msg % (_value, new_value))
                 _value = new_value
             else:
                 logging.debug("Processor returned the original "
                               "value: %s" % _value)
-        except processors.ParamProcessingError, ex:
-            print ("Value processing of parameter %s "
-                   "failed.\n%s" % (param.CONF_NAME, ex))
+        except processors.ParamProcessingError as ex:
+            print("Value processing of parameter %s "
+                  "failed.\n%s" % (param.CONF_NAME, ex))
             raise
     return _value
 
+
 def _handleGroupCondition(config, conditionName, conditionValue):
     """
     handle params group pre/post condition
@@ -302,7 +330,7 @@ def _handleGroupCondition(config, conditionName, conditionValue):
 
     # If the condition is a string - just read it to global conf
     # We assume that if we get a string as a member it is the name of a member of conf_params
-    elif type(conditionName) == types.StringType:
+    elif isinstance(conditionName, str):
         conditionValue = _loadParamFromFile(config, "general", conditionName)
     else:
         # Any other type is invalid
@@ -310,30 +338,64 @@ def _handleGroupCondition(config, conditionName, conditionValue):
     return conditionValue
 
 
-def _loadParamFromFile(config, section, paramName):
+def _loadParamFromFile(config, section, param_name):
     """
     read param from file
     validate it
     and load to to global conf dict
     """
 
-    # Get paramName from answer file
+    param = controller.getParamByName(param_name)
+
+    # Get value from answer file
     try:
-        value = config.get(section, paramName)
-    except ConfigParser.NoOptionError:
-        raise KeyError('Parser cannot find option %s in '
-                       'answer file.' % paramName)
+        value = config.get(section, param_name)
+    except configparser.NoOptionError:
+        value = None
+        # Check for deprecated parameters
+        deprecated = param.DEPRECATES if param.DEPRECATES is not None else []
+        for old_name in deprecated:
+            try:
+                val = config.get(section, old_name)
+            except configparser.NoOptionError:
+                continue
+            if not val:
+                # value is empty string
+                continue
+            if value is None:
+                value = val
+            if value != val:
+                raise ValueError(f'Parameter {param_name} deprecates '
+                                 f'following parameters:\n{deprecated}.\n'
+                                 f'Please either use parameter {param_name} '
+                                 'or use same value for all deprecated '
+                                 'parameters.')
+        if deprecated and value is not None:
+            controller.MESSAGES.append('Deprecated parameter has been used '
+                                       'in answer file. Please use parameter '
+                                       f'{param_name} next time. This '
+                                       'parameter deprecates following '
+                                       f'parameters: {deprecated}.')
+        if value is None:
+            # Let's use default value if we have one
+            value = getattr(param, 'DEFAULT_VALUE', None)
+        if value is None:
+            raise KeyError('Parser cannot find option %s in answer file.'
+                           % param_name)
 
     # Validate param value using its validation func
-    param = controller.getParamByName(paramName)
     value = process_param_value(param, value)
     validate_param_value(param, value)
 
     # Keep param value in our never ending global conf
     controller.CONF[param.CONF_NAME] = value
+    # Add message to controller.MESSAGES if defined in parameter
+    if param.MESSAGE:
+        _handleParamMessage(param, value)
 
     return value
 
+
 def _handleAnswerFileParams(answerFile):
     """
     handle loading and validating
@@ -344,7 +406,7 @@ def _handleAnswerFileParams(answerFile):
         logging.debug("Starting to handle config file")
 
         # Read answer file
-        fconf = ConfigParser.ConfigParser()
+        fconf = configparser.RawConfigParser()
         fconf.read(answerFile)
 
         # Iterate all the groups and check the pre/post conditions
@@ -368,9 +430,9 @@ def _handleAnswerFileParams(answerFile):
 
                     # Handle post condition match for group
                     if postConditionValue != group.POST_CONDITION_MATCH:
-                        logging.error("The group condition (%s) returned: %s, which differs from the excpeted output: %s"%\
+                        logging.error("The group condition (%s) returned: %s, which differs from the excpeted output: %s" %
                                       (group.GROUP_NAME, postConditionValue, group.POST_CONDITION_MATCH))
-                        raise ValueError(output_messages.ERR_EXP_GROUP_VALIDATION_ANS_FILE%\
+                        raise ValueError(output_messages.ERR_EXP_GROUP_VALIDATION_ANS_FILE %
                                          (group.GROUP_NAME, postConditionValue, group.POST_CONDITION_MATCH))
                     else:
                         logging.debug("condition (%s) passed" % group.POST_CONDITION)
@@ -381,7 +443,7 @@ def _handleAnswerFileParams(answerFile):
 
     except Exception as e:
         logging.error(traceback.format_exc())
-        raise Exception(output_messages.ERR_EXP_HANDLE_ANSWER_FILE%(e))
+        raise Exception(output_messages.ERR_EXP_HANDLE_ANSWER_FILE % (e))
 
 
 def _getanswerfilepath():
@@ -392,12 +454,28 @@ def _getanswerfilepath():
 
     p = os.path.expanduser("~/")
     if os.access(p, os.W_OK):
-        path = os.path.abspath(os.path.join(p, "packstack-answers-%s.txt"%ts))
+        path = os.path.abspath(os.path.join(p, "packstack-answers-%s.txt" % ts))
         msg = "A new answerfile was created in: %s" % path
 
     controller.MESSAGES.append(msg)
     return path
 
+
+def _gettmpanswerfilepath():
+    path = None
+    msg = "Could not find a suitable path on which to create the temporary answerfile"
+
+    ts = datetime.datetime.now().strftime('%Y%m%d-%H%M%S')
+
+    p = os.path.expanduser("~/")
+    if os.access(p, os.W_OK):
+        path = os.path.abspath(os.path.join(p, "tmp-packstack-answers-%s.txt" % ts))
+        tmpfiles.append(path)
+
+    controller.MESSAGES.append(msg)
+    return path
+
+
 def _handleInteractiveParams():
     try:
         logging.debug("Groups: %s" % ', '.join([x.GROUP_NAME for x in controller.getAllGroups()]))
@@ -418,7 +496,7 @@ def _handleInteractiveParams():
                     for param in group.parameters.itervalues():
                         if not param.CONDITION:
                             input_param(param)
-                            #update password list, so we know to mask them
+                            # update password list, so we know to mask them
                             _updateMaskedValueSet()
 
                     postConditionValue = True
@@ -431,35 +509,31 @@ def _handleInteractiveParams():
                         if postConditionValue == group.POST_CONDITION_MATCH:
                             inputLoop = False
                         else:
-                            #we clear the value of all params in the group
-                            #in order to re-input them by the user
+                            # we clear the value of all params in the group
+                            # in order to re-input them by the user
                             for param in group.parameters.itervalues():
-                                if controller.CONF.has_key(param.CONF_NAME):
+                                if param.CONF_NAME in controller.CONF:
                                     del controller.CONF[param.CONF_NAME]
-                                if commandLineValues.has_key(param.CONF_NAME):
+                                if param.CONF_NAME in commandLineValues:
                                     del commandLineValues[param.CONF_NAME]
                     else:
                         inputLoop = False
             else:
                 logging.debug("no post condition check for group %s" % group.GROUP_NAME)
 
-        path = _getanswerfilepath()
-
         _displaySummary()
 
-        if path:
-            generateAnswerFile(path)
-
     except KeyboardInterrupt:
         logging.error("keyboard interrupt caught")
         raise Exception(output_messages.ERR_EXP_KEYBOARD_INTERRUPT)
     except Exception:
         logging.error(traceback.format_exc())
         raise
-    except:
+    except Exception:
         logging.error(traceback.format_exc())
         raise Exception(output_messages.ERR_EXP_HANDLE_PARAMS)
 
+
 def _handleParams(configFile):
     _addDefaultsToMaskedValueSet()
     if configFile:
@@ -467,76 +541,80 @@ def _handleParams(configFile):
     else:
         _handleInteractiveParams()
 
+
 def _getConditionValue(matchMember):
     returnValue = False
-    if type(matchMember) == types.FunctionType:
+    if isinstance(matchMember, types.FunctionType):
         returnValue = matchMember(controller.CONF)
-    elif type(matchMember) == types.StringType:
-        #we assume that if we get a string as a member it is the name
-        #of a member of conf_params
-        if not controller.CONF.has_key(matchMember):
+    elif isinstance(matchMember, str):
+        # we assume that if we get a string as a member it is the name
+        # of a member of conf_params
+        if matchMember not in controller.CONF:
             param = controller.getParamByName(matchMember)
             input_param(param)
         returnValue = controller.CONF[matchMember]
     else:
-        raise TypeError("%s type (%s) is not supported"%(matchMember, type(matchMember)))
+        raise TypeError("%s type (%s) is not supported" % (matchMember, type(matchMember)))
 
     return returnValue
 
+
 def _displaySummary():
 
-    print output_messages.INFO_DSPLY_PARAMS
-    print  "=" * (len(output_messages.INFO_DSPLY_PARAMS) - 1)
+    print(output_messages.INFO_DSPLY_PARAMS)
+    print("=" * (len(output_messages.INFO_DSPLY_PARAMS) - 1))
     logging.info("*** User input summary ***")
     for group in controller.getAllGroups():
         for param in group.parameters.itervalues():
-            if not param.USE_DEFAULT and controller.CONF.has_key(param.CONF_NAME):
+            if not param.USE_DEFAULT and param.CONF_NAME in controller.CONF:
                 cmdOption = param.CMD_OPTION
-                l = 30 - len(cmdOption)
+                length = 30 - len(cmdOption)
                 maskParam = param.MASK_INPUT
                 # Only call mask on a value if the param has MASK_INPUT set to True
                 if maskParam:
                     logging.info("%s: %s" % (cmdOption, mask(controller.CONF[param.CONF_NAME])))
-                    print "%s:" % (cmdOption) + " " * l + mask(controller.CONF[param.CONF_NAME])
+                    print("%s:" % (cmdOption) + " " * length + mask(controller.CONF[param.CONF_NAME]))
                 else:
                     # Otherwise, log & display it as it is
                     logging.info("%s: %s" % (cmdOption, str(controller.CONF[param.CONF_NAME])))
-                    print "%s:" % (cmdOption) + " " * l + str(controller.CONF[param.CONF_NAME])
+                    print("%s:" % (cmdOption) + " " * length + str(controller.CONF[param.CONF_NAME]))
     logging.info("*** User input summary ***")
     answer = _askYesNo(output_messages.INFO_USE_PARAMS)
     if not answer:
         logging.debug("user chose to re-enter the user parameters")
         for group in controller.getAllGroups():
             for param in group.parameters.itervalues():
-                if controller.CONF.has_key(param.CONF_NAME):
+                if param.CONF_NAME in controller.CONF:
                     if not param.MASK_INPUT:
                         param.DEFAULT_VALUE = controller.CONF[param.CONF_NAME]
                     # Remove the string from mask_value_set in order
                     # to remove values that might be over overwritten.
                     removeMaskString(controller.CONF[param.CONF_NAME])
                     del controller.CONF[param.CONF_NAME]
-                if commandLineValues.has_key(param.CONF_NAME):
+                if param.CONF_NAME in commandLineValues:
                     del commandLineValues[param.CONF_NAME]
-            print ""
+            print("")
         logging.debug("calling handleParams in interactive mode")
         return _handleParams(None)
     else:
         logging.debug("user chose to accept user parameters")
 
+
 def _printAdditionalMessages():
     if len(controller.MESSAGES) > 0:
-        print "\n",output_messages.INFO_ADDTIONAL_MSG
+        print(output_messages.INFO_ADDTIONAL_MSG)
     for msg in controller.MESSAGES:
-        print output_messages.INFO_ADDTIONAL_MSG_BULLET%(msg)
+        print(output_messages.INFO_ADDTIONAL_MSG_BULLET % (msg))
 
-def _addFinalInfoMsg():
+
+def _addFinalInfoMsg(logFile):
     """
     add info msg to the user finalizing the
     successfull install of rhemv
     """
-    controller.MESSAGES.append(output_messages.INFO_LOG_FILE_PATH%(logFile))
+    controller.MESSAGES.append(output_messages.INFO_LOG_FILE_PATH % (logFile))
     controller.MESSAGES.append(
-        output_messages.INFO_MANIFEST_PATH%(basedefs.PUPPET_MANIFEST_DIR))
+        output_messages.INFO_MANIFEST_PATH % (basedefs.PUPPET_MANIFEST_DIR))
 
 
 def _summaryParamsToLog():
@@ -544,20 +622,47 @@ def _summaryParamsToLog():
         logging.debug("*** The following params were used as user input:")
         for group in controller.getAllGroups():
             for param in group.parameters.itervalues():
-                if controller.CONF.has_key(param.CONF_NAME):
+                if param.CONF_NAME in controller.CONF:
                     maskedValue = mask(controller.CONF[param.CONF_NAME])
-                    logging.debug("%s: %s" % (param.CMD_OPTION, maskedValue ))
+                    logging.debug("%s: %s" % (param.CMD_OPTION, maskedValue))
+
+
+def _handleParamMessage(param, value):
+    """
+    add message to the information displayed at the end of the execution
+    for parameters with MESSAGE option. if parameter has MESSAGE_VALUES
+    option, message will be only displayed if the provided value is in
+    MESSAGE_VALUES.
+    """
+    message_values = param.MESSAGE_VALUES if param.MESSAGE_VALUES is not None else None
+    if not message_values or value in message_values:
+        message = utils.color_text('Parameter %s: %s'
+                                   % (param.CONF_NAME, param.MESSAGE), 'red')
+        if message not in controller.MESSAGES:
+            controller.MESSAGES.append(message)
 
 
 def runSequences():
     controller.runAllSequences()
 
-def _main(configFile=None):
-    print output_messages.INFO_HEADER
+
+def _main(options, configFile=None, logFile=None):
+    print(output_messages.INFO_HEADER)
+    print("\n" + output_messages.INFO_LOG_FILE_PATH % logFile)
 
     # Get parameters
     _handleParams(configFile)
 
+    # Generate answer file, only if no answer file was provided
+    if not options.answer_file:
+        path = _getanswerfilepath()
+        if path:
+            generateAnswerFile(path)
+    # If an answer file was provided, some options may have been overridden
+    # Overwrite answer file with updated options
+    else:
+        generateAnswerFile(options.answer_file)
+
     # Update masked_value_list with user input values
     _updateMaskedValueSet()
 
@@ -565,7 +670,7 @@ def _main(configFile=None):
     logging.debug(mask(controller.CONF))
 
     # Start configuration stage
-    print "\n",output_messages.INFO_INSTALL
+    print("\n" + output_messages.INFO_INSTALL)
 
     # Initialize Sequences
     initPluginsSequences()
@@ -574,33 +679,55 @@ def _main(configFile=None):
     runSequences()
 
     # Lock rhevm version
-    #_lockRpmVersion()
+    # _lockRpmVersion()
 
     # Print info
-    _addFinalInfoMsg()
-    print output_messages.INFO_INSTALL_SUCCESS
+    _addFinalInfoMsg(logFile)
+    print(output_messages.INFO_INSTALL_SUCCESS)
 
 
-def remove_remote_var_dirs():
+def remove_remote_var_dirs(options, config, messages):
     """
     Removes the temp directories on remote hosts,
     doesn't remove data on localhost
     """
-    for host in gethostlist(controller.CONF):
+    for host in filtered_hosts(config):
         try:
-            host_dir = controller.CONF['HOST_DETAILS'][host]['tmpdir']
+            host_dir = config['HOST_DETAILS'][host]['tmpdir']
         except KeyError:
             # Nothing was added to this host yet, so we have nothing to delete
             continue
+        if options.debug:
+            # we keep temporary directories on hosts in debug mode
+            messages.append(
+                'Note temporary directory {host_dir} on host {host} was '
+                'not deleted for debugging purposes.'.format(**locals())
+            )
+            continue
         logging.debug(output_messages.INFO_REMOVE_REMOTE_VAR % (host_dir, host))
         server = utils.ScriptRunner(host)
         server.append('rm -rf %s' % host_dir)
         try:
             server.execute()
-        except Exception, e:
+        except Exception as e:
             msg = output_messages.ERR_REMOVE_REMOTE_VAR % (host_dir, host)
             logging.error(msg)
             logging.exception(e)
+            messages.append(utils.color_text(msg, 'red'))
+
+
+def remove_temp_files():
+    """
+    Removes any temporary files generated during
+    configuration
+    """
+    for myfile in tmpfiles:
+        try:
+            os.unlink(myfile)
+        except Exception as e:
+            msg = output_messages.ERR_REMOVE_TMP_FILE % (myfile)
+            logging.error(msg)
+            logging.exception(e)
             controller.MESSAGES.append(utils.color_text(msg, 'red'))
 
 
@@ -614,7 +741,7 @@ def generateAnswerFile(outputFile, overrides={}):
     # the mode -rw-------
     if os.path.exists(outputFile):
         os.remove(outputFile)
-    fd = os.open(outputFile, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0600)
+    fd = os.open(outputFile, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
 
     with os.fdopen(fd, "w") as ans_file:
         ans_file.write("[general]%s" % os.linesep)
@@ -634,30 +761,46 @@ def generateAnswerFile(outputFile, overrides={}):
                         'conf_name': param.CONF_NAME}
                 ans_file.write(fmt % args)
 
-def single_step_aio_install(options):
-    """ Installs an All in One host on this host"""
+
+def validate_answer_file_options(answerfile_path):
+    if not os.path.exists(answerfile_path):
+        raise Exception(
+            output_messages.ERR_NO_ANSWER_FILE % answerfile_path)
+
+    answerfile = configparser.RawConfigParser()
+    answerfile.read(answerfile_path)
+    sections = answerfile._sections
+    general_sections = sections.get('general', None)
+
+    if len(sections) != 1:
+        raise Exception('Expected single section')
+    if not general_sections:
+        raise Exception('Expected section [general]')
+
+    general_sections.pop('__name__')
+    answerfile_options = set([key.upper() for key in general_sections])
+
+    possible_options = set()
+    for group in controller.getAllGroups():
+        possible_options.update([key.upper() for key in group.parameters])
+
+    difference = answerfile_options - possible_options
+    if difference:
+        raise Exception(
+            'Found unexpected answerfile options {}'.format(list(difference)))
+    print('Provided answerfile does not contain any unexpected options.')
+
+
+def single_step_aio_install(options, logFile):
+    """Installs an All in One host on this host."""
 
     options.install_hosts = utils.get_localhost_ip()
 
-    # Also allow the command line to set values for any of these options
-    # by testing if they have been set before we set them here
-    if not options.novanetwork_pubif:
-        options.novanetwork_pubif = utils.device_from_ip(options.install_hosts)
-    if not options.novacompute_privif:
-        options.novacompute_privif = "lo"
-    if not options.novanetwork_privif:
-        options.novanetwork_privif = "lo"
-
-    # If we are doing an all-in-one install, do demo provisioning
-    # unless specifically told not to
-    if (options.os_neutron_install != "n" and \
-        not options.provision_all_in_one_ovs_bridge):
-            options.provision_all_in_one_ovs_bridge = "y"
-
-    single_step_install(options)
-
-def single_step_install(options):
-    answerfilepath =  _getanswerfilepath()
+    single_step_install(options, logFile)
+
+
+def single_step_install(options, logFile):
+    answerfilepath = _gettmpanswerfilepath()
     if not answerfilepath:
         _printAdditionalMessages()
         return
@@ -671,23 +814,21 @@ def single_step_install(options):
     hosts = [host.strip() for host in hosts.split(',')]
     for group in controller.getAllGroups():
         for param in group.parameters.itervalues():
-            # we don't need magic in case CONFIG_NEUTRON_LBAAS_HOSTS
-            if param.CONF_NAME == 'CONFIG_NEUTRON_LBAAS_HOSTS':
-                continue
             # and directives that contain _HOST are set to the controller node
             if param.CONF_NAME.find("_HOST") != -1:
                 overrides[param.CONF_NAME] = hosts[0]
     # If there are more than one host, all but the first are a compute nodes
     if len(hosts) > 1:
-        overrides["CONFIG_NOVA_COMPUTE_HOSTS"] = ','.join(hosts[1:])
+        overrides["CONFIG_COMPUTE_HOSTS"] = ','.join(hosts[1:])
 
     # We can also override defaults with command line options
     _set_command_line_values(options)
-    for key,value in commandLineValues.items():
+    for key, value in commandLineValues.items():
         overrides[key] = value
 
     generateAnswerFile(answerfilepath, overrides)
-    _main(answerfilepath)
+    _main(options, answerfilepath, logFile)
+
 
 def initCmdLineParser():
     """
@@ -697,17 +838,18 @@ def initCmdLineParser():
 
     # Init parser and all general flags
     usage = "usage: %prog [options] [--help]"
-    parser = OptionParser(usage=usage,version="%prog {0} {1}".format(version.release_string(), version.version_string()))
-    parser.add_option("--gen-answer-file", help="Generate a template of an answer file, using this option excludes all other options")
-    parser.add_option("--answer-file", help="Runs the configuration in non-interactive mode, extracting all information from the \
-                                            configuration file. using this option excludes all other options")
+    parser = OptionParser(usage=usage, version="%prog {0}".format(version_info.version_string()))
+    parser.add_option("--gen-answer-file", help="Generate a template of an answer file.")
+    parser.add_option("--validate-answer-file", help="Check if answerfile contains unexpected options.")
+    parser.add_option("--answer-file", help="Runs the configuration in non-interactive mode, extracting all information from the"
+                                            "configuration file. using this option excludes all other options")
     parser.add_option("--install-hosts", help="Install on a set of hosts in a single step. The format should be a comma separated list "
-                                          "of hosts, the first is setup as a controller, and the others are setup as compute nodes."
-                                          "if only a single host is supplied then it is setup as an all in one installation. An answerfile "
-                                          "will also be generated and should be used if Packstack needs to be run a second time ")
+                                              "of hosts, the first is setup as a controller, and the others are setup as compute nodes."
+                                              "if only a single host is supplied then it is setup as an all in one installation. An answerfile "
+                                              "will also be generated and should be used if Packstack needs to be run a second time ")
     parser.add_option("--allinone", action="store_true", help="Shorthand for --install-hosts=<local ipaddr> --novanetwork-pubif=<dev> "
-                                          "--novacompute-privif=lo --novanetwork-privif=lo --os-swift-install=y --nagios-install=y "
-                                          ", this option can be used to install an all in one OpenStack on this host")
+                                                              "--novacompute-privif=lo --novanetwork-privif=lo --os-swift-install=y"
+                                                              ", this option can be used to install an all in one OpenStack on this host")
 
     parser.add_option("-t", "--timeout", default=300, help="The timeout for puppet Exec calls")
     parser.add_option("-o", "--options", action="store_true", dest="options", help="Print details on options available in answer file(rst format)")
@@ -721,7 +863,6 @@ def initCmdLineParser():
         for param in group.parameters.itervalues():
             cmdOption = param.CMD_OPTION
             paramUsage = param.USAGE
-            optionsList = param.OPTION_LIST
             useDefault = param.USE_DEFAULT
 
             if not useDefault:
@@ -732,6 +873,7 @@ def initCmdLineParser():
 
     return parser
 
+
 def printOptions():
     """
     print and document the available options to the answer file (rst format)
@@ -739,28 +881,28 @@ def printOptions():
 
     # For each group, create a group option
     for group in controller.getAllGroups():
-        print "%s" % group.DESCRIPTION
-        print "-" * len(group.DESCRIPTION)
-        print
+        print("%s" % group.DESCRIPTION)
+        print("-" * len(group.DESCRIPTION) + "\n")
 
         for param in group.parameters.itervalues():
             cmdOption = param.CONF_NAME
             paramUsage = param.USAGE
-            optionsList = param.OPTION_LIST or ""
-            print "%s : %s %s"%(("**%s**"%str(cmdOption)).ljust(30), paramUsage, optionsList)
-            print
+            print("%s" % (("**%s**" % str(cmdOption)).ljust(30)))
+            print("    %s" % paramUsage + "\n")
+
 
 def plugin_compare(x, y):
     """
     Used to sort the plugin file list
     according to the number at the end of the plugin module
     """
-    x_match = re.search(".+\_(\d\d\d)", x)
+    x_match = re.search(r'.+\_(\d\d\d)', x)
     x_cmp = x_match.group(1)
-    y_match = re.search(".+\_(\d\d\d)", y)
+    y_match = re.search(r'.+\_(\d\d\d)', y)
     y_cmp = y_match.group(1)
     return int(x_cmp) - int(y_cmp)
 
+
 def loadPlugins():
     """
     Load All plugins from ./plugins
@@ -769,10 +911,10 @@ def loadPlugins():
     sys.path.append(basedefs.DIR_MODULES)
 
     fileList = [f for f in os.listdir(basedefs.DIR_PLUGINS) if f[0] != "_"]
-    fileList = sorted(fileList, cmp=plugin_compare)
+    fileList = sorted(fileList, key=cmp_to_key(plugin_compare))
     for item in fileList:
         # Looking for files that end with ###.py, example: a_plugin_100.py
-        match = re.search("^(.+\_\d\d\d)\.py$", item)
+        match = re.search(r'^(.+\_\d\d\d)\.py$', item)
         if match:
             try:
                 moduleToLoad = match.group(1)
@@ -782,13 +924,14 @@ def loadPlugins():
                 globals()[moduleToLoad] = moduleobj
                 checkPlugin(moduleobj)
                 controller.addPlugin(moduleobj)
-            except:
-                 logging.error("Failed to load plugin from file %s", item)
-                 logging.error(traceback.format_exc())
-                 raise Exception("Failed to load plugin from file %s" % item)
+            except Exception:
+                logging.error("Failed to load plugin from file %s", item)
+                logging.error(traceback.format_exc())
+                raise Exception("Failed to load plugin from file %s" % item)
+
 
 def checkPlugin(plugin):
-    for funcName in ['initConfig','initSequences']:
+    for funcName in ['initConfig', 'initSequences']:
         if not hasattr(plugin, funcName):
             raise ImportError("Plugin %s does not contain the %s function" % (plugin.__class__, funcName))
 
@@ -799,8 +942,8 @@ def countCmdLineFlags(options, flag):
     """
     counter = 0
     # make sure only flag was supplied
-    for key, value  in options.__dict__.items():
-        if key in (flag, 'debug', 'timeout', 'dry_run'):
+    for key, value in options.__dict__.items():
+        if key in (flag, 'debug', 'timeout', 'dry_run', 'default_password'):
             next
         # If anything but flag was called, increment
         elif value:
@@ -812,7 +955,7 @@ def countCmdLineFlags(options, flag):
 def validateSingleFlag(options, flag):
     counter = countCmdLineFlags(options, flag)
     if counter > 0:
-        flag = flag.replace("_","-")
+        flag = flag.replace("_", "-")
         msg = output_messages.ERR_ONLY_1_FLAG % ("--%s" % flag)
         raise FlagValidationError(msg)
 
@@ -821,19 +964,24 @@ def initPluginsConfig():
     for plugin in controller.getAllPlugins():
         plugin.initConfig(controller)
 
+
 def initPluginsSequences():
     for plugin in controller.getAllPlugins():
         plugin.initSequences(controller)
 
+
 def _set_command_line_values(options):
     for key, value in options.__dict__.items():
         # Replace the _ with - in the string since optparse replace _ with -
         for group in controller.getAllGroups():
-            param = group.search("CMD_OPTION", key.replace("_","-"))
+            param = group.search("CMD_OPTION", key.replace("_", "-"))
             if len(param) > 0 and value:
                 commandLineValues[param[0].CONF_NAME] = value
 
+
 def main():
+    options = ""
+
     try:
         # Load Plugins
         loadPlugins()
@@ -850,19 +998,30 @@ def main():
             raise SystemExit
 
         # Initialize logging
-        initLogging (options.debug)
+        logFile = initLogging(options.debug)
 
         # Parse parameters
-        runConfiguration = True
-        confFile = None
+        conf_file = None
 
         controller.CONF['DEFAULT_EXEC_TIMEOUT'] = options.timeout
         controller.CONF['DRY_RUN'] = options.dry_run
-
-        # If --gen-answer-file was supplied, do not run main
-        if options.gen_answer_file:
-            # Make sure only --gen-answer-file was supplied
-            validateSingleFlag(options, "gen_answer_file")
+        controller.CONF['DIR_LOG'] = basedefs.DIR_LOG
+
+        if options.validate_answer_file:
+            answerfilepath = options.validate_answer_file
+            validate_answer_file_options(answerfilepath)
+        elif options.gen_answer_file:
+            answerfilepath = _gettmpanswerfilepath()
+            if not answerfilepath:
+                _printAdditionalMessages()
+                return
+            # We can also override defaults with command line options
+            overrides = {}
+            _set_command_line_values(options)
+            for key, value in commandLineValues.items():
+                overrides[key] = value
+            generateAnswerFile(answerfilepath, overrides)
+            _handleParams(answerfilepath)
             generateAnswerFile(options.gen_answer_file)
         # Are we installing an all in one
         elif options.allinone:
@@ -870,33 +1029,43 @@ def main():
                 msg = ('Please use either --allinone or --answer-file, '
                        'but not both.')
                 raise FlagValidationError(msg)
-            single_step_aio_install(options)
+            single_step_aio_install(options, logFile)
         # Are we installing in a single step
         elif options.install_hosts:
-            single_step_install(options)
+            single_step_install(options, logFile)
         # Otherwise, run main()
         else:
             # Make sure only --answer-file was supplied
             if options.answer_file:
                 validateSingleFlag(options, "answer_file")
-                confFile = os.path.expanduser(options.answer_file)
-                if not os.path.exists(confFile):
-                    raise Exception(output_messages.ERR_NO_ANSWER_FILE % confFile)
+                # If using an answer file, setting a default password
+                # does not really make sense
+                if getattr(options, 'default_password', None):
+                    msg = ('Please do not set --default-password '
+                           'when specifying an answer file.')
+                    raise FlagValidationError(msg)
+                conf_file = os.path.expanduser(options.answer_file)
+                if not os.path.exists(conf_file):
+                    raise Exception(output_messages.ERR_NO_ANSWER_FILE %
+                                    conf_file)
             else:
                 _set_command_line_values(options)
-            _main(confFile)
+            _main(options, conf_file, logFile)
 
-    except FlagValidationError, ex:
+    except FlagValidationError as ex:
         optParser.error(str(ex))
     except Exception as e:
         logging.error(traceback.format_exc())
-        print
-        print utils.color_text("ERROR : " + str(e), 'red')
-        print output_messages.ERR_CHECK_LOG_FILE_FOR_MORE_INFO%(logFile)
+        print("\n" + utils.color_text("ERROR : " + str(e), 'red'))
+        try:
+            print(output_messages.ERR_CHECK_LOG_FILE_FOR_MORE_INFO % (logFile))
+        except NameError:
+            pass
         sys.exit(1)
 
     finally:
-        remove_remote_var_dirs()
+        remove_remote_var_dirs(options, controller.CONF, controller.MESSAGES)
+        remove_temp_files()
 
         # Always print user params to log
         _printAdditionalMessages()
diff --git a/packstack/installer/setup_controller.py b/packstack/installer/setup_controller.py
index e9ffcb6c5..6fd895ead 100644
--- a/packstack/installer/setup_controller.py
+++ b/packstack/installer/setup_controller.py
@@ -1,3 +1,16 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 """
 Controller class is a SINGLETON which handles all groups, params, sequences,
 steps and replaces the CONF dictionary.
@@ -15,13 +28,13 @@ def steps_new_format(steplist):
 
 class Controller(object):
 
-    __GROUPS=[]
-    __SEQUENCES=[]
-    __PLUGINS=[]
-    MESSAGES=[]
-    CONF={}
+    __GROUPS = []
+    __SEQUENCES = []
+    __PLUGINS = []
+    MESSAGES = []
+    CONF = {}
 
-    __single = None # the one, true Singleton ... for god's sake why ??? :)
+    __single = None  # the one, true Singleton ... for god's sake why ??? :)
 
     def __new__(self, *args, **kwargs):
         """
@@ -31,26 +44,10 @@ def __new__(self, *args, **kwargs):
         instance from a class which inherit Controller.
         did not use isinstance because inheritence makes it behave erratically.
         """
-        if self != type(self.__single):
+        if self != type(self.__single):  # noqa: E721
             self.__single = object.__new__(self, *args, **kwargs)
         return self.__single
 
-    def __init__(self):
-        # Resources that should be copied to each host along with the puppet
-        # files, on the remote host the file will be placed in
-        # $PACKSTACK_VAR_DIR/resources. This controller should copy the files,
-        # for now the puppet plugin is doing it format
-        # {'host':[('/path/to/fileordirectory', 'filenameonremotehost'), ..]}
-        self.resources = {}
-
-
-    def addResource(self, host, localpath, remotename):
-        """ Populates self.resources """
-        current_value_for_host = self.resources.get(host, [])
-        current_value_for_host.append((localpath,remotename))
-        self.resources[host] = current_value_for_host
-
-
     # PLugins
     def addPlugin(self, plugObj):
         self.__PLUGINS.append(plugObj)
@@ -81,7 +78,7 @@ def getAllSequences(self):
 
     def runAllSequences(self):
         for sequence in self.__SEQUENCES:
-            sequence.run(self.CONF)
+            sequence.run(config=self.CONF, messages=self.MESSAGES)
 
     def getSequenceByDesc(self, desc):
         for sequence in self.getAllSequences():
@@ -102,7 +99,7 @@ def insertSequenceBeforeSequence(self, sequenceName, desc, cond, cond_match, ste
         sequence will be inserted BEFORE "update x"
         """
         index = self.__getSequenceIndexByDesc(sequenceName)
-        if index == None:
+        if index is None:
             index = len(self.getAllSequences())
         self.__SEQUENCES.insert(index, Sequence(desc,
                                                 steps_new_format(steps),
@@ -135,7 +132,7 @@ def insertGroupBeforeGroup(self, groupName, group, params):
         group will be inserted BEFORE "update x"
         """
         index = self.__getGroupIndexByDesc(groupName)
-        if index == None:
+        if index is None:
             index = len(self.getAllGroups())
         self.__GROUPS.insert(index, Group(group, params))
 
diff --git a/packstack/installer/utils/__init__.py b/packstack/installer/utils/__init__.py
index 92031e65f..80ee87de5 100644
--- a/packstack/installer/utils/__init__.py
+++ b/packstack/installer/utils/__init__.py
@@ -1,19 +1,40 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 from .datastructures import SortedDict
 from .decorators import retry
-from .network import get_localhost_ip, host2ip, force_ip, device_from_ip
-from .shell import ScriptRunner, execute
-from .shortcuts import (host_iter, hosts, get_current_user,
-                        get_current_username, split_hosts)
-from .strings import (COLORS, color_text, mask_string, state_format,
-                      state_message)
+from .network import device_from_ip
+from .network import force_ip
+from .network import get_localhost_ip
+from .network import host2ip
+from .shell import execute
+from .shell import ScriptRunner
+from .shortcuts import get_current_user
+from .shortcuts import get_current_username
+from .shortcuts import host_iter
+from .shortcuts import hosts
+from .shortcuts import split_hosts
+from .strings import color_text
+from .strings import COLORS
+from .strings import mask_string
+from .strings import state_format
+from .strings import state_message
 
 
 __all__ = ('SortedDict',
            'retry',
-           'get_localhost_ip', 'host2ip', 'force_ip', 'device_from_ip',
+           'device_from_ip', 'force_ip', 'get_localhost_ip', 'host2ip',
            'ScriptRunner', 'execute',
-           'host_iter', 'hosts', 'get_current_user', 'get_current_username',
-           'split_hosts', 'COLORS', 'color_text', 'mask_string',
+           'get_current_user', 'get_current_username', 'host_iter', 'hosts',
+           'split_hosts', 'color_text', 'COLORS', 'mask_string',
            'state_format', 'state_message')
diff --git a/packstack/installer/utils/datastructures.py b/packstack/installer/utils/datastructures.py
index 542f18dcb..e392adf12 100644
--- a/packstack/installer/utils/datastructures.py
+++ b/packstack/installer/utils/datastructures.py
@@ -1,4 +1,15 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 import copy
 from types import GeneratorType
@@ -24,7 +35,7 @@ def __init__(self, data=None):
             data = list(data)
         super(SortedDict, self).__init__(data)
         if isinstance(data, dict):
-            self.keyOrder = data.keys()
+            self.keyOrder = list(data)
         else:
             self.keyOrder = []
             seen = set()
diff --git a/packstack/installer/utils/decorators.py b/packstack/installer/utils/decorators.py
index 1f9a1fdf7..bb18f0077 100644
--- a/packstack/installer/utils/decorators.py
+++ b/packstack/installer/utils/decorators.py
@@ -1,4 +1,15 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 import time
 
@@ -24,6 +35,6 @@ def wrapper(*args, **kwargs):
                     if delay:
                         time.sleep(delay)
                     tried += 1
-        wrapper.func_name = func.func_name
+        wrapper.__name__ = func.__name__
         return wrapper
     return decorator
diff --git a/packstack/installer/utils/network.py b/packstack/installer/utils/network.py
index 5e5aa7765..ecaee413e 100644
--- a/packstack/installer/utils/network.py
+++ b/packstack/installer/utils/network.py
@@ -1,42 +1,61 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
-import re
+import logging
+import netifaces
 import socket
 
 from ..exceptions import NetworkError
-from .shell import execute, ScriptRunner
+from .shell import ScriptRunner
+
+netaddr_available = True
+try:
+    import netaddr
+except ImportError:
+    netaddr_available = False
 
 
 def get_localhost_ip():
     """
     Returns IP address of localhost.
     """
-    # TO-DO: Will probably need to find better way to find out localhost
-    #        address.
-
-    # find nameservers
-    ns_regex = re.compile('nameserver\s*(?P<ns_ip>[\d\.\:]+)')
-    rc, resolv = execute('cat /etc/resolv.conf | grep nameserver',
-                         can_fail=False, use_shell=True, log=False)
-    nsrvs = []
-    for line in resolv.split('\n'):
-        match = ns_regex.match(line.strip())
-        if match:
-            nsrvs.append(match.group('ns_ip'))
-
-    # try to connect to nameservers and return own IP address
-    nsrvs.append('8.8.8.8')  # default to google dns
-    for i in nsrvs:
+    # Try to get the IPv4 or IPv6 default gateway, then open a socket
+    # to discover our local IP
+    gw = None
+    for protocol in (socket.AF_INET, socket.AF_INET6):
         try:
-            s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-            s.connect((i, 0))
-            loc_ip = s.getsockname()[0]
-        except socket.error:
+            gw = netifaces.gateways()['default'][protocol][0]
+            if protocol == socket.AF_INET6:
+                gw = gw + '%' + netifaces.gateways()['default'][protocol][1]
+            discovered_protocol = protocol
+            break
+        except KeyError:    # No default gw for this protocol
             continue
-        else:
-            return loc_ip
-    raise NetworkError('Local IP address discovery failed. Please set '
-                       'nameserver correctly.')
+    else:
+        raise NetworkError('Local IP address discovery failed. Please set '
+                           'a default gateway for your system.')
+
+    address = socket.getaddrinfo(gw, 0, discovered_protocol,
+                                 socket.SOCK_DGRAM)[0]
+    s = socket.socket(discovered_protocol, socket.SOCK_DGRAM)
+    s.connect(address[4])
+    # Remove chars after %. Does nothing on IPv4, removes scope id in IPv6
+    loc_ip = s.getsockname()[0].split('%')[0]
+
+    return loc_ip
+
+
+_host_cache = {}
 
 
 def host2ip(hostname, allow_localhost=False):
@@ -44,32 +63,63 @@ def host2ip(hostname, allow_localhost=False):
     Converts given hostname to IP address. Raises NetworkError
     if conversion failed.
     """
+    key = '{}:{}'.format(hostname, allow_localhost)
+    if key in _host_cache:
+        return _host_cache[key]
     try:
-        ip_list = socket.gethostbyaddr(hostname)[2]
+        ip_list = list(sockets[4][0] for sockets in
+                       socket.getaddrinfo(hostname, 22, 0, 0, socket.IPPROTO_TCP))
+
         if allow_localhost:
-            return ip_list[0]
+            ip = ip_list[0]
         else:
-            local_ips = ('127.0.0.1', '::1')
-            for ip in ip_list:
-                if ip not in local_ips:
-                    break
-            else:
-                raise NameError()
-            return ip
+            routable = [ip for ip in ip_list if ip not in ('127.0.0.1', '::1')]
+            if not routable:
+                raise NameError("Host %s is not routable, please fix"
+                                "your /etc/hosts", host)
+            if len(routable) > 1:
+                logging.warning("Multiple IPs for host detected!")
+            ip = routable[0]
+
+        _host_cache[key] = ip
+        return ip
     except NameError:
         # given hostname is localhost, return appropriate IP address
         return get_localhost_ip()
     except socket.error:
         raise NetworkError('Unknown hostname %s.' % hostname)
-    except Exception, ex:
+    except Exception as ex:
         raise NetworkError('Unknown error appeared: %s' % repr(ex))
 
 
-def force_ip(host, allow_localhost=False):
+def is_ipv6(host):
+    if not netaddr_available:
+        raise ImportError(
+            "netaddr module unavailable, install with pip install netaddr"
+        )
     host = host.strip()
-    ipv4_regex = re.compile('\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}')
-    ipv6_regex = re.compile('[abcdef\d\:]+')
-    if not ipv4_regex.match(host) or not ipv6_regex.match(host):
+    try:
+        return netaddr.IPAddress(host.strip('[]')).version == 6
+    except netaddr.core.AddrFormatError:
+        # Most probably a hostname
+        return False
+
+
+def is_ipv4(host):
+    if not netaddr_available:
+        raise ImportError(
+            "netaddr module unavailable, install with pip install netaddr"
+        )
+    host = host.strip()
+    try:
+        return netaddr.IPAddress(host).version == 4
+    except netaddr.core.AddrFormatError:
+        # Most probably a hostname
+        return False
+
+
+def force_ip(host, allow_localhost=False):
+    if not (is_ipv6(host) or is_ipv4(host)):
         host = host2ip(host, allow_localhost=allow_localhost)
     return host
 
diff --git a/packstack/installer/utils/shell.py b/packstack/installer/utils/shell.py
index 37a488172..ab09c76c0 100644
--- a/packstack/installer/utils/shell.py
+++ b/packstack/installer/utils/shell.py
@@ -1,12 +1,25 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
-import re
-import types
 import logging
+import os
+import re
+import shlex
 import subprocess
 
-from ..exceptions import (ExecuteRuntimeError, ScriptRuntimeError,
-                          NetworkError)
+from ..exceptions import ExecuteRuntimeError
+from ..exceptions import NetworkError
+from ..exceptions import ScriptRuntimeError
 from .strings import mask_string
 
 
@@ -24,19 +37,26 @@ def execute(cmd, workdir=None, can_fail=True, mask_list=None,
     mask_list = mask_list or []
     repl_list = [("'", "'\\''")]
 
-    if not isinstance(cmd, types.StringType):
-        import pipes
-        masked = ' '.join((pipes.quote(i) for i in cmd))
+    if not isinstance(cmd, str):
+        masked = ' '.join((shlex.quote(i) for i in cmd))
     else:
         masked = cmd
+
     masked = mask_string(masked, mask_list, repl_list)
     if log:
         logging.info("Executing command:\n%s" % masked)
-
+    environ = os.environ
+    environ['LANG'] = 'en_US.UTF8'
     proc = subprocess.Popen(cmd, stdout=subprocess.PIPE,
                             stderr=subprocess.PIPE, cwd=workdir,
-                            shell=use_shell, close_fds=True)
+                            shell=use_shell, close_fds=True,
+                            env=environ)
     out, err = proc.communicate()
+
+    if not isinstance(out, str):
+        out = out.decode('utf-8')
+    if not isinstance(err, str):
+        err = err.decode('utf-8')
     masked_out = mask_string(out, mask_list, repl_list)
     masked_err = mask_string(err, mask_list, repl_list)
     if log:
@@ -84,11 +104,19 @@ def execute(self, can_fail=True, mask_list=None, log=True):
                           "root@%s" % self.ip, "bash -x"]
         else:
             cmd = ["bash", "-x"]
+        environ = os.environ
+        environ['LANG'] = 'en_US.UTF8'
+
         obj = subprocess.Popen(cmd, stdin=_PIPE, stdout=_PIPE, stderr=_PIPE,
-                               close_fds=True, shell=False)
+                               close_fds=True, shell=False, env=environ)
+
+        script = "function t(){ exit $? ; } \n trap t ERR \n %s" % script
 
-        script = "function t(){ exit $? ; } \n trap t ERR \n" + script
-        out, err = obj.communicate(script)
+        out, err = obj.communicate(script.encode('utf-8'))
+        if not isinstance(out, str):
+            out = out.decode('utf-8')
+        if not isinstance(err, str):
+            err = err.decode('utf-8')
         masked_out = mask_string(out, mask_list, repl_list)
         masked_err = mask_string(err, mask_list, repl_list)
         if log:
diff --git a/packstack/installer/utils/shortcuts.py b/packstack/installer/utils/shortcuts.py
index 4371d48bd..3b1e192a0 100644
--- a/packstack/installer/utils/shortcuts.py
+++ b/packstack/installer/utils/shortcuts.py
@@ -1,4 +1,15 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 import grp
 import os
@@ -6,7 +17,7 @@
 
 
 def host_iter(config):
-    for key, value in config.iteritems():
+    for key, value in config.items():
         if key.endswith("_HOST"):
             host = value.split('/')[0]
             if host:
diff --git a/packstack/installer/utils/strings.py b/packstack/installer/utils/strings.py
index 5c46eb16a..2ee1cb9e6 100644
--- a/packstack/installer/utils/strings.py
+++ b/packstack/installer/utils/strings.py
@@ -1,5 +1,17 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
+from functools import cmp_to_key
 import re
 
 
@@ -17,6 +29,10 @@ def color_text(text, color):
     return '%s%s%s' % (COLORS[color], text, COLORS['nocolor'])
 
 
+def stringcmp(x, y):
+    return len(y) - len(x)
+
+
 def mask_string(unmasked, mask_list=None, replace_list=None):
     """
     Replaces words from mask_list with MASK in unmasked string.
@@ -27,14 +43,19 @@ def mask_string(unmasked, mask_list=None, replace_list=None):
     mask_list = mask_list or []
     replace_list = replace_list or []
 
-    masked = unmasked
-    for word in sorted(mask_list, lambda x, y: len(y) - len(x)):
+    if isinstance(unmasked, str):
+        masked = unmasked.encode('utf-8')
+    else:
+        masked = unmasked
+
+    for word in sorted(mask_list, key=cmp_to_key(stringcmp)):
         if not word:
             continue
+        word = word.encode('utf-8')
         for before, after in replace_list:
-            word = word.replace(before, after)
-        masked = masked.replace(word, STR_MASK)
-    return masked
+            word = word.replace(before.encode('utf-8'), after.encode('utf-8'))
+        masked = masked.replace(word, STR_MASK.encode('utf-8'))
+    return masked.decode('utf-8')
 
 
 def state_format(msg, state, color):
diff --git a/packstack/installer/validators.py b/packstack/installer/validators.py
index 35876989a..0f9e30005 100644
--- a/packstack/installer/validators.py
+++ b/packstack/installer/validators.py
@@ -1,20 +1,27 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 """
 Contains all core validation functions.
 """
 
+import logging
 import os
 import re
 import socket
-import logging
-import tempfile
-import traceback
 
-import basedefs
 from . import utils
 
-from .setup_controller import Controller
 from .exceptions import ParamValidationError
 
 
@@ -23,13 +30,17 @@
            'validate_options', 'validate_multi_options', 'validate_ip',
            'validate_multi_ip', 'validate_file', 'validate_ping',
            'validate_multi_ping', 'validate_ssh', 'validate_multi_ssh',
-           'validate_sshkey')
+           'validate_sshkey', 'validate_ldap_url', 'validate_ldap_dn',
+           'validate_export', 'validate_multi_export',
+           'validate_writeable_directory')
 
 
 def validate_integer(param, options=None):
     """
     Raises ParamValidationError if given param is not integer.
     """
+    if not param:
+        return
     options = options or []
     try:
         int(param)
@@ -44,6 +55,8 @@ def validate_float(param, options=None):
     """
     Raises ParamValidationError if given param is not a float.
     """
+    if not param:
+        return
     options = options or []
     try:
         float(param)
@@ -59,6 +72,8 @@ def validate_regexp(param, options=None):
     Raises ParamValidationError if given param doesn't match at least
     one of regular expressions given in options.
     """
+    if not param:
+        return
     options = options or []
     for regex in options:
         if re.search(regex, param):
@@ -85,6 +100,8 @@ def validate_port(param, options=None):
     Raises ParamValidationError if given param is not a decimal number
     in range (0, 65535).
     """
+    if not param:
+        return
     options = options or []
     validate_integer(param, options)
     port = int(param)
@@ -111,9 +128,10 @@ def validate_options(param, options=None):
     """
     Raises ParamValidationError if given param is not member of options.
     """
-    options = options or []
+    if not param:
+        return
 
-    # TO-DO: to be more flexible, remove this and exit in case param is empty
+    options = options or []
     validate_not_empty(param, options)
     if param not in options:
         logging.debug('validate_options(%s, options=%s) failed.' %
@@ -139,10 +157,12 @@ def validate_ip(param, options=None):
     Raises ParamValidationError if given parameter value is not in IPv4
     or IPv6 address.
     """
+    if not param:
+        return
     for family in (socket.AF_INET, socket.AF_INET6):
         try:
             socket.inet_pton(family, param)
-            break
+            return family
         except socket.error:
             continue
     else:
@@ -166,10 +186,10 @@ def validate_file(param, options=None):
     """
     Raises ParamValidationError if provided file in param does not exist.
     """
-    options = options or []
-    # TO-DO: to be more flexible, remove this and exit in case param is empty
-    validate_not_empty(param)
+    if not param:
+        return
 
+    options = options or []
     if not os.path.isfile(param):
         logging.debug('validate_file(%s, options=%s) failed.' %
                       (param, options))
@@ -177,15 +197,33 @@ def validate_file(param, options=None):
         raise ParamValidationError(msg % param)
 
 
+def validate_writeable_directory(param, options=None):
+    """
+    Raises ParamValidationError if provided directory does not exist or
+    is not writeable.
+    """
+    if not param:
+        return
+
+    options = options or []
+    path = os.path.expanduser(param)
+    if not ((os.path.isdir(path) and os.access(path, os.W_OK)) or
+            os.access(
+            os.path.normpath(os.path.join(path, os.pardir)), os.W_OK)):
+        logging.debug('validate_writeable_directory(%s, options=%s) failed.' %
+                      (param, options))
+        msg = 'Given directory does not exist or is not writeable: %s'
+        raise ParamValidationError(msg % param)
+
+
 def validate_ping(param, options=None):
     """
     Raises ParamValidationError if provided host does not answer to ICMP
     echo request.
     """
+    if not param:
+        return
     options = options or []
-    # TO-DO: to be more flexible, remove this and exit in case param is empty
-    validate_not_empty(param)
-
     rc, out = utils.execute(['/bin/ping', '-c', '1', str(param)],
                             can_fail=False)
     if rc != 0:
@@ -201,13 +239,13 @@ def validate_multi_ping(param, options=None):
     do not answer to ICMP echo request.
     """
     options = options or []
-    # TO-DO: to be more flexible, remove this and exit in case param is empty
-    validate_not_empty(param)
     for host in param.split(","):
         validate_ping(host.strip())
 
 
 _tested_ports = []
+
+
 def touch_port(host, port):
     """
     Check that provided host is listening on provided port.
@@ -215,10 +253,9 @@ def touch_port(host, port):
     key = "%s:%d" % (host, port)
     if key in _tested_ports:
         return
-    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-    s.connect((host, port))
-    s.shutdown(socket.SHUT_RDWR)
-    s.close()
+    sock = socket.create_connection((host, port))
+    sock.shutdown(socket.SHUT_RDWR)
+    sock.close()
     _tested_ports.append(key)
 
 
@@ -227,6 +264,8 @@ def validate_ssh(param, options=None):
     Raises ParamValidationError if provided host does not listen
     on port 22.
     """
+    if not param:
+        return
     options = options or []
     try:
         touch_port(param.strip(), 22)
@@ -263,3 +302,96 @@ def validate_sshkey(param, options=None):
         msg = 'Public SSH key is required. You passed private key.'
     if msg:
         raise ParamValidationError(msg)
+
+
+def validate_ldap_url(param, options=None):
+    """
+    Raises ParamValidationError if provided param is not a valid LDAP URL
+    """
+    if not param:
+        return
+    try:
+        import ldapurl
+    except ImportError:
+        msg = (
+            'The python ldap package is required to use this functionality.'
+        )
+        raise ParamValidationError(msg)
+
+    try:
+        ldapurl.LDAPUrl(param)
+    except ValueError as ve:
+        msg = ('The given string [%s] is not a valid LDAP URL: %s' %
+               (param, ve))
+        raise ParamValidationError(msg)
+
+
+def validate_ldap_dn(param, options=None):
+    """
+    Raises ParamValidationError if provided param is not a valid LDAP DN
+    """
+    if not param:
+        return
+    try:
+        import ldap
+        import ldap.dn
+    except ImportError:
+        msg = (
+            'The python ldap package is required to use this functionality.'
+        )
+        raise ParamValidationError(msg)
+
+    try:
+        ldap.dn.str2dn(param)
+    except ldap.DECODING_ERROR as de:
+        msg = ('The given string [%s] is not a valid LDAP DN: %s' %
+               (param, de))
+        raise ParamValidationError(msg)
+
+
+def validate_export(param, options=None):
+    """
+    Raises ParamValidationError if the nfs export is not valid.
+    """
+    msg = ('The nfs export [%s] is not a valid export - use squares around ipv6 addresses -.' %
+           param)
+    try:
+        [ip, export] = param.split(':/')
+    except ValueError:
+        raise ParamValidationError(msg)
+    get_squares = re.search(r'\[([^]]+)\]', ip)
+    ip_to_test = ip
+    if get_squares:
+        # this should be a valid ipv6 address.
+        ip_to_test = get_squares.group(1)
+        if not utils.network.is_ipv6(ip_to_test):
+            raise ParamValidationError(msg)
+    else:
+        # this should be an ipv4. Cannot have ipv6 without square braquet
+        # notation here, as the mount will fail.
+        if not utils.network.is_ipv4(ip):
+            raise ParamValidationError(msg)
+    validate_ip(ip_to_test, options)
+    if not export:
+        raise ParamValidationError(msg)
+
+
+def validate_multi_export(param, options=None):
+    """
+    Raises ParamValidationError if comma separated nfs export given
+    in param is not valid
+    """
+    for export in param.split(","):
+        validate_export(export)
+
+
+def validate_neutron(param, options=None):
+    """
+    Raises ParamValidationError if neutron is not enabled.
+    This is intended to make user aware nova-network has been removed
+    in ocata cycle.
+    """
+    validate_options(param, options=options)
+    if param != 'y':
+        msg = ('Nova network support has been removed in Ocata. Neutron service must be enabled')
+        raise ParamValidationError(msg)
diff --git a/packstack/modules/common.py b/packstack/modules/common.py
index a3446ae81..2f7dd8416 100644
--- a/packstack/modules/common.py
+++ b/packstack/modules/common.py
@@ -1,4 +1,17 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import netaddr
 
 from ..installer import utils
 
@@ -6,19 +19,19 @@
 def filtered_hosts(config, exclude=True, dbhost=True):
     """
     Returns list of hosts which need installation taking into account
-    CONFIG_MYSQL_INSTAL if parameter dbhost is True and EXCLUDE_SERVERS
+    CONFIG_MARIADB_INSTALL if parameter dbhost is True and EXCLUDE_SERVERS
     if parameter exclude is True.
     """
     exclset = set([i.strip()
                    for i in config.get('EXCLUDE_SERVERS', '').split(',')
                    if i.strip()])
     result = set()
-    dbinst = config.get('CONFIG_MYSQL_INSTALL') == 'y'
+    dbinst = config.get('CONFIG_MARIADB_INSTALL') == 'y'
     vcenter = config.get('CONFIG_VMWARE_BACKEND') == 'y'
     for hosttype, hostname in utils.host_iter(config):
-        # if dbhost is being taken into account and we are not installing MySQL
-        # then we should omit the MySQL host
-        if dbhost and not dbinst and hosttype == 'CONFIG_MYSQL_HOST':
+        # if dbhost is being taken into account and we are not installing
+        # MariaDB then we should omit the MariaDB host
+        if dbhost and not dbinst and hosttype == 'CONFIG_MARIADB_HOST':
             continue
         if vcenter and hosttype == 'CONFIG_VCENTER_HOST':
             continue
@@ -34,6 +47,52 @@ def is_all_in_one(config):
     returns False.
     """
     # Even if some host have been excluded from installation, we must count
-    # with them when checking all-in-one. MySQL host should however be omitted
-    # if we are not installing MySQL
+    # with them when checking all-in-one. MariaDB host should however be
+    # omitted if we are not installing MariaDB.
     return len(filtered_hosts(config, exclude=False, dbhost=True)) == 1
+
+
+def cidr_to_ifname(cidr, host, config):
+    """
+    Returns appropriate host's interface name from given CIDR subnet. Passed
+    config dict has to contain discovered hosts details.
+    """
+    if not config or not config['HOST_DETAILS'] or '/' not in cidr:
+        raise ValueError(
+            'Cannot translate CIDR to interface, invalid parameters '
+            'were given.'
+        )
+    info = config['HOST_DETAILS'][host]
+
+    result = []
+    for item in cidr.split(','):
+        translated = []
+        for fragment in item.split(':'):
+            try:
+                subnet_a = netaddr.IPNetwork(fragment)
+            except netaddr.AddrFormatError:
+                translated.append(fragment)
+                continue
+
+            for interface in info['interfaces'].split(','):
+                interface = interface.strip()
+                ipaddr = info.get('ipaddress_{}'.format(interface))
+                netmask = info.get('netmask_{}'.format(interface))
+                if ipaddr and netmask:
+                    subnet_b = netaddr.IPNetwork('{ipaddr}/{netmask}'.format(**locals()))
+                    if subnet_a == subnet_b:
+                        translated.append(interface)
+                        break
+        result.append(':'.join(translated))
+    return ','.join(result)
+
+
+# Function find_pair_with search in a list of "key:value" pairs, one
+# containing the desired element as key (if index is 0), or value (if index
+# is 1). It returns the pair if it's found or KeyError.
+def find_pair_with(pairs_list, element, index):
+    for pair in pairs_list:
+        found_element = pair.split(':')[index].strip()
+        if found_element == element:
+            return pair
+    raise KeyError('Couldn\'t find element %s in %s.' % (element, pairs_list))
diff --git a/packstack/modules/documentation.py b/packstack/modules/documentation.py
new file mode 100644
index 000000000..e2ba026c3
--- /dev/null
+++ b/packstack/modules/documentation.py
@@ -0,0 +1,80 @@
+#
+# Copyright (C) 2015 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+from docutils import core
+
+
+# ------------------ helpers to locate option list ------------------ #
+def _iter_by_titles(tree):
+    for i in tree.children:
+        i = i.asdom()
+        for child in i.childNodes:
+            if child.nodeName != 'title':
+                continue
+            if child.childNodes and child.childNodes[0].nodeValue:
+                title = child.childNodes[0].nodeValue
+                yield title, i
+
+
+def _get_options(tree, section):
+    for title, node in _iter_by_titles(tree):
+        if title == section:
+            return node
+
+
+# --------------------- helper to locate options -------------------- #
+def _iter_options(section):
+    for subsection in section.childNodes:
+        for subsub in subsection.childNodes:
+            if subsub.nodeName != 'definition_list':
+                # TO-DO: log parsing warning
+                continue
+            for defitem in subsub.childNodes:
+                key_node = defitem.getElementsByTagName('strong')
+                val_node = defitem.getElementsByTagName('paragraph')
+                if not key_node or not val_node:
+                    # TO-DO: log parsing warning
+                    continue
+                key_node = key_node[0].childNodes[0]
+                val_node = val_node[0].childNodes[0]
+                yield key_node.nodeValue, val_node.nodeValue
+
+
+# ----------------------------- interface --------------------------- #
+_rst_cache = {}
+
+
+def update_params_usage(path, params, opt_title='OPTIONS', sectioned=True):
+    """Updates params dict with USAGE texts parsed from given rst file."""
+    def _update(section, rst):
+        for param in section:
+            if param['CONF_NAME'] not in rst:
+                # TO-DO: log warning
+                continue
+            param['USAGE'] = rst[param['CONF_NAME']]
+
+    if not _rst_cache:
+        tree = core.publish_doctree(
+            source=open(path).read(), source_path=path
+        )
+        for key, value in _iter_options(_get_options(tree, opt_title)):
+            _rst_cache.setdefault(key, value)
+
+    if sectioned:
+        for section in params.values():
+            _update(section, _rst_cache)
+    else:
+        _update(params, _rst_cache)
diff --git a/packstack/modules/ospluginutils.py b/packstack/modules/ospluginutils.py
index d69581ea0..0b59483bb 100644
--- a/packstack/modules/ospluginutils.py
+++ b/packstack/modules/ospluginutils.py
@@ -1,45 +1,43 @@
-
-import logging
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import datetime
 import os
-import re
+import yaml
+
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives import serialization
+from cryptography import x509
+from cryptography.x509 import oid
 
 from packstack.installer import basedefs
+from packstack.installer import utils
 from packstack.installer.setup_controller import Controller
-from packstack.installer.exceptions import PackStackError
 
 controller = Controller()
 
 PUPPET_DIR = os.path.join(basedefs.DIR_PROJECT_DIR, "puppet")
 PUPPET_TEMPLATE_DIR = os.path.join(PUPPET_DIR, "templates")
-
-
-class NovaConfig(object):
-    """
-    Helper class to create puppet manifest entries for nova_config
-    """
-    def __init__(self):
-        self.options = {}
-
-    def addOption(self, n, v):
-        self.options[n] = v
-
-    def getManifestEntry(self):
-        entry = ""
-        if not self.options:
-            return entry
-
-        entry += "nova_config{\n"
-        for k, v in self.options.items():
-            entry += '    "%s": value => "%s";\n' % (k, v)
-        entry += "}"
-        return entry
+HIERA_COMMON_YAML = os.path.join(basedefs.HIERADATA_DIR, "common.yaml")
+# For compatibility with hiera < 3.0
+HIERA_DEFAULTS_YAML = os.path.join(basedefs.HIERADATA_DIR, "defaults.yaml")
 
 
 class ManifestFiles(object):
     def __init__(self):
         self.filelist = []
         self.data = {}
-        self.global_data = None
 
     # continuous manifest file that have the same marker can be
     # installed in parallel, if on different servers
@@ -51,6 +49,14 @@ def addFile(self, filename, marker, data=''):
 
         self.filelist.append((filename, marker))
 
+    def prependFile(self, filename, marker, data=''):
+        self.data[filename] = data + '\n' + self.data.get(filename, '')
+        for f, p in self.filelist:
+            if f == filename:
+                return
+
+        self.filelist.append((filename, marker))
+
     def getFiles(self):
         return [f for f in self.filelist]
 
@@ -59,19 +65,20 @@ def writeManifests(self):
         Write out the manifest data to disk, this should only be called once
         write before the puppet manifests are copied to the various servers
         """
-        if not self.global_data:
-            with open(os.path.join(PUPPET_TEMPLATE_DIR, "global.pp")) as gfp:
-                self.global_data = gfp.read() % controller.CONF
-        os.mkdir(basedefs.PUPPET_MANIFEST_DIR, 0700)
+        os.mkdir(basedefs.PUPPET_MANIFEST_DIR, 0o700)
         for fname, data in self.data.items():
             path = os.path.join(basedefs.PUPPET_MANIFEST_DIR, fname)
-            fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0600)
+            fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
             with os.fdopen(fd, 'w') as fp:
-                fp.write(self.global_data + data)
+                fp.write(data)
+
+
 manifestfiles = ManifestFiles()
 
 
 def getManifestTemplate(template_name):
+    if not template_name.endswith(".pp"):
+        template_name += ".pp"
     with open(os.path.join(PUPPET_TEMPLATE_DIR, template_name)) as fp:
         return fp.read() % controller.CONF
 
@@ -80,6 +87,119 @@ def appendManifestFile(manifest_name, data, marker=''):
     manifestfiles.addFile(manifest_name, marker, data)
 
 
+def generateHieraDataFile():
+    os.mkdir(basedefs.HIERADATA_DIR, 0o700)
+    with open(HIERA_COMMON_YAML, 'w') as outfile:
+        outfile.write(yaml.dump(controller.CONF,
+                                explicit_start=True,
+                                default_flow_style=False))
+    os.symlink(os.path.basename(HIERA_COMMON_YAML), HIERA_DEFAULTS_YAML)
+
+
+def generate_ssl_cert(config, host, service, ssl_key_file, ssl_cert_file):
+    """
+    Generate SSL certificate
+    """
+    # We have to check whether the certificate already exists
+    cert_dir = os.path.join(config['CONFIG_SSL_CERT_DIR'], 'certs')
+    local_cert_name = host + os.path.basename(ssl_cert_file)
+    local_cert_path = os.path.join(cert_dir, local_cert_name)
+    if os.path.exists(local_cert_path):
+        return
+
+    with open(config['CONFIG_SSL_CACERT_FILE'], 'rb') as cacert_file:
+        ca_cert = x509.load_pem_x509_certificate(cacert_file.read())
+
+    with open(config['CONFIG_SSL_CACERT_KEY_FILE'], 'rb') as ca_key_file:
+        ca_key = serialization.load_pem_private_key(ca_key_file.read(),
+                                                    password=None)
+
+    # create a key pair
+    key = rsa.generate_private_key(
+        public_exponent=65537,
+        key_size=4096,
+    )
+
+    hostinfo = config['HOST_DETAILS'][host]
+    fqdn = hostinfo['fqdn']
+    cn = "%s/%s" % (service, fqdn)
+    # if subject.CN is more than 64 chars long, cert creation will fail
+    if len(cn) > 64:
+        cn = cn[0:63]
+
+    subject = x509.Name([
+        x509.NameAttribute(oid.NameOID.COUNTRY_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_C']),
+        x509.NameAttribute(oid.NameOID.STATE_OR_PROVINCE_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_ST']),
+        x509.NameAttribute(oid.NameOID.LOCALITY_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_L']),
+        x509.NameAttribute(oid.NameOID. ORGANIZATION_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_O']),
+        x509.NameAttribute(oid.NameOID. ORGANIZATIONAL_UNIT_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_OU']),
+        x509.NameAttribute(oid.NameOID.COMMON_NAME, cn),
+        x509.NameAttribute(oid.NameOID.EMAIL_ADDRESS,
+                           config['CONFIG_SSL_CERT_SUBJECT_MAIL']),
+    ])
+    cert = x509.CertificateBuilder().subject_name(
+        subject
+    ).issuer_name(
+        ca_cert.subject
+    ).public_key(
+        key.public_key()
+    ).serial_number(
+        x509.random_serial_number()
+    ).not_valid_before(
+        datetime.datetime.now(datetime.timezone.utc)
+    ).not_valid_after(
+        datetime.datetime.now(datetime.timezone.utc) +
+        datetime.timedelta(days=3650)
+    ).add_extension(
+        x509.KeyUsage(
+            digital_signature=True,
+            content_commitment=True,
+            key_encipherment=True,
+            data_encipherment=False,
+            key_agreement=False,
+            key_cert_sign=False,
+            crl_sign=False,
+            encipher_only=False,
+            decipher_only=False,
+        ),
+        critical=False,
+    ).add_extension(
+        x509.ExtendedKeyUsage([
+            x509.ExtendedKeyUsageOID.CLIENT_AUTH,
+            x509.ExtendedKeyUsageOID.SERVER_AUTH,
+        ]),
+        critical=False,
+    ).sign(ca_key, hashes.SHA256())
+
+    final_cacert = ca_cert.public_bytes(serialization.Encoding.PEM)
+    final_cert = cert.public_bytes(serialization.Encoding.PEM)
+    final_key = key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.TraditionalOpenSSL,
+        encryption_algorithm=serialization.NoEncryption()
+    )
+    deliver_ssl_file(final_cacert.decode(), config['CONFIG_SSL_CACERT'], host)
+    deliver_ssl_file(final_cert.decode(), ssl_cert_file, host)
+    deliver_ssl_file(final_key.decode(), ssl_key_file, host)
+
+    with open(local_cert_path, 'wb') as f:
+        f.write(final_cert)
+
+
+def deliver_ssl_file(content, path, host):
+    server = utils.ScriptRunner(host)
+    server.append("grep -- '{content}' {path} || "
+                  "echo '{content}' > {path} ".format(
+                      content=content,
+                      path=path))
+    server.execute()
+
+
 def gethostlist(CONF):
     hosts = []
     for key, value in CONF.items():
diff --git a/packstack/modules/puppet.py b/packstack/modules/puppet.py
index 01f29f8d7..83b38a70c 100644
--- a/packstack/modules/puppet.py
+++ b/packstack/modules/puppet.py
@@ -1,4 +1,15 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 import logging
 import os
@@ -7,17 +18,18 @@
 from packstack.installer.exceptions import PuppetError
 
 
-# TODO: Fill logger name when logging system will be refactored
+# TODO(tbd): Fill logger name when logging system will be refactored
 logger = logging.getLogger()
 
-re_color = re.compile('\x1b.*?\d\dm')
+re_color = re.compile(r'\x1b.*?\d\dm')
 re_error = re.compile(
-    'err:|Syntax error at|^Duplicate definition:|^Invalid tag|'
-    '^No matching value for selector param|^Parameter name failed:|Error:|'
-    '^Invalid parameter|^Duplicate declaration:|^Could not find resource|'
-    '^Could not parse for|^/usr/bin/puppet:\d+: .+|.+\(LoadError\)|'
-    '^Could not autoload|'
-    '^\/usr\/bin\/env\: jruby\: No such file or directory'
+    r'err:|Syntax error at|^Duplicate definition:|^Invalid tag|'
+    r'^No matching value for selector param|^Parameter name failed:|Error:|'
+    r'^Invalid parameter|^Duplicate declaration:|^Could not find resource|'
+    r'^Could not parse for|^/usr/bin/puppet:\d+: .+|.+\(LoadError\)|'
+    r'^Could not autoload|'
+    r'^\/usr\/bin\/env\: jruby\: No such file or directory|'
+    r'failed to execute puppet'
 )
 re_ignore = re.compile(
     # Puppet preloads a provider using the mysql command before it is installed
@@ -25,27 +37,30 @@
     # Puppet preloads a database_grant provider which fails if /root/.my.cnf
     # is missing, this is ok because it will be retried later if needed
     'Could not prefetch database_grant provider.*?\\.my\\.cnf|'
-    # Swift Puppet module tries to install swift-plugin-s3, there is no such
-    # package on RHEL, fixed in the upstream puppet module
-    'yum.*?install swift-plugin-s3'
+    # facter gives a weird NM error when it's disabled, due to
+    # https://tickets.puppetlabs.com/browse/FACT-697
+    'NetworkManager is not running|'
+    # facter logs Error even though the repository is set to be skipped
+    # if unavailable
+    'Failed to download metadata for repo'
 )
-re_notice = re.compile(r"notice: .*Notify\[packstack_info\]"
-                         "\/message: defined \'message\' as "
-                         "\'(?P<message>.*)\'")
+re_notice = re.compile(r'notice: .*Notify\[packstack_info\]'
+                       r'\/message: defined \'message\' as '
+                       r'\'(?P<message>.*)\'')
 
 surrogates = [
     # Value in /etc/sysctl.conf cannot be changed
-    ('Sysctl::Value\[.*\]\/Sysctl\[(?P<arg1>.*)\].*Field \'val\' is required',
+    (r'Sysctl::Value\[.*\]\/Sysctl\[(?P<arg1>.*)\].*Field \'val\' is required',
         'Cannot change value of %(arg1)s in /etc/sysctl.conf'),
     # Package is not found in yum repos
-    ('Package\[.*\]\/ensure.*yum.*install (?P<arg1>.*)\'.*Nothing to do',
+    (r'Package\[.*\]\/ensure.*yum.*install (?P<arg1>.*)\'.*Nothing to do',
         'Package %(arg1)s has not been found in enabled Yum repos.'),
-    ('Execution of \'.*yum.*install (?P<arg1>.*)\'.*Nothing to do',
+    (r'Execution of \'.*yum.*install (?P<arg1>.*)\'.*Nothing to do',
         'Package %(arg1)s has not been found in enabled Yum repos.'),
     # Packstack does not cooperate with jruby
-    ('jruby', 'Your Puppet installation uses jruby instead of ruby. Package '
-              'jruby does not cooperate with Packstack well. You will have to '
-              'fix this manually.'),
+    (r'jruby', 'Your Puppet installation uses jruby instead of ruby. Package '
+               'jruby does not cooperate with Packstack well. You will have to '
+               'fix this manually.'),
 ]
 
 
diff --git a/packstack/modules/shortcuts.py b/packstack/modules/shortcuts.py
deleted file mode 100644
index 3d6667f6d..000000000
--- a/packstack/modules/shortcuts.py
+++ /dev/null
@@ -1,5 +0,0 @@
-# -*- coding: utf-8 -*-
-
-
-def get_mq(config, plugin):
-    return plugin + "_%s.pp" % config.get('CONFIG_AMQP_SERVER')
diff --git a/packstack/plugins/amqp_002.py b/packstack/plugins/amqp_002.py
index c1d2f01b8..21e2d8d79 100644
--- a/packstack/plugins/amqp_002.py
+++ b/packstack/plugins/amqp_002.py
@@ -1,245 +1,176 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 """
-Installs and configures amqp
+Installs and configures AMQP
 """
 
-import logging
-import uuid
-import os
-
-from packstack.installer import validators
 from packstack.installer import basedefs
+from packstack.installer import validators
+from packstack.installer import processors
 from packstack.installer import utils
 
 from packstack.modules.common import filtered_hosts
-from packstack.modules.ospluginutils import gethostlist,\
-                                            getManifestTemplate,\
-                                            appendManifestFile
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import generate_ssl_cert
 
-# Controller object will be initialized from main flow
-controller = None
+# ------------- AMQP Packstack Plugin Initialization --------------
 
-# Plugin name
-PLUGIN_NAME = "OS-AMQP"
+PLUGIN_NAME = "AMQP"
 PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
 
-logging.debug("plugin %s loaded", __name__)
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding OpenStack AMQP configuration")
-    paramsList = [
-                  {"CMD_OPTION"      : "amqp-server",
-                   "USAGE"           : "Set the server for the AMQP service",
-                   "PROMPT"          : "Set the server for the AMQP service (qpid, rabbitmq)? ",
-                   "OPTION_LIST"     : ["qpid", "rabbitmq"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "rabbitmq",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_AMQP_SERVER",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "amqp-host",
-                   "USAGE"           : "The IP address of the server on which to install the AMQP service",
-                   "PROMPT"          : "Enter the IP address of the AMQP service",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_AMQP_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "amqp-enable-ssl",
-                   "USAGE"           : "Enable SSL for the AMQP service",
-                   "PROMPT"          : "Enable SSL for the AMQP service?",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "n",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_AMQP_ENABLE_SSL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "amqp-enable-auth",
-                   "USAGE"           : "Enable Authentication for the AMQP service",
-                   "PROMPT"          : "Enable Authentication for the AMQP service?",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "n",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_AMQP_ENABLE_AUTH",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  ]
-
-
-    groupDict = { "GROUP_NAME"            : "AMQPLANCE",
-                  "DESCRIPTION"           : "AMQP Config parameters",
-                  "PRE_CONDITION"         : False,
-                  "PRE_CONDITION_MATCH"   : True,
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
-
-    paramsList = [
-                  {"CMD_OPTION"      : "amqp-nss-certdb-pw",
-                   "USAGE"           : "The password for the NSS certificate database of the AMQP service",
-                   "PROMPT"          : "Enter the password for NSS certificate database",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:32],
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_AMQP_NSS_CERTDB_PW",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "amqp-ssl-port",
-                   "USAGE"           : "The port in which the AMQP service listens to SSL connections",
-                   "PROMPT"          : "Enter the SSL port for the AMQP service",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : "5671",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_AMQP_SSL_PORT",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "amqp-ssl-cert-file",
-                   "USAGE"           : "The filename of the certificate that the AMQP service is going to use",
-                   "PROMPT"          : "Enter the filename of the SSL certificate for the AMQP service",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : "/etc/pki/tls/certs/amqp_selfcert.pem",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_AMQP_SSL_CERT_FILE",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "amqp-ssl-key-file",
-                   "USAGE"           : "The filename of the private key that the AMQP service is going to use",
-                   "PROMPT"          : "Enter the private key filename",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : "/etc/pki/tls/private/amqp_selfkey.pem",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_AMQP_SSL_KEY_FILE",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "amqp-ssl-self-signed",
-                   "USAGE"           : "Auto Generates self signed SSL certificate and key",
-                   "PROMPT"          : "Generate Self Signed SSL Certificate",
-                   "OPTION_LIST"     : ["y","n"],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : "y",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_AMQP_SSL_SELF_SIGNED",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                 ]
-
-    groupDict = { "GROUP_NAME"            : "AMQPSSL",
-                  "DESCRIPTION"           : "AMQP Config SSL parameters",
-                  "PRE_CONDITION"         : "CONFIG_AMQP_ENABLE_SSL",
-                  "PRE_CONDITION_MATCH"   : "y",
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
-
-    paramsList = [
-                  {"CMD_OPTION"      : "amqp-auth-user",
-                   "USAGE"           : "User for amqp authentication",
-                   "PROMPT"          : "Enter the user for amqp authentication",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : "amqp_user",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_AMQP_AUTH_USER",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "amqp-auth-password",
-                   "USAGE"           : "Password for user authentication",
-                   "PROMPT"          : "Enter the password for user authentication",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_AMQP_AUTH_PASSWORD",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                  ]
-
-    groupDict = { "GROUP_NAME"            : "AMQPAUTH",
-                  "DESCRIPTION"           : "AMQP Config Athentication parameters",
-                  "PRE_CONDITION"         : "CONFIG_AMQP_ENABLE_AUTH",
-                  "PRE_CONDITION_MATCH"   : "y",
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-
-    controller.addGroup(groupDict, paramsList)
+
+def initConfig(controller):
+    params = [
+        {"CMD_OPTION": "amqp-backend",
+         "PROMPT": "Set the AMQP service backend",
+         "OPTION_LIST": ["rabbitmq"],
+         "VALIDATORS": [validators.validate_options],
+         "DEFAULT_VALUE": "rabbitmq",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_AMQP_BACKEND",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False,
+         "DEPRECATES": ['CONFIG_AMQP_SERVER']},
+
+        {"CMD_OPTION": "amqp-host",
+         "PROMPT": "Enter the host for the AMQP service",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_ssh],
+         "DEFAULT_VALUE": utils.get_localhost_ip(),
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_AMQP_HOST",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "amqp-enable-ssl",
+         "PROMPT": "Enable SSL for the AMQP service?",
+         "OPTION_LIST": ["y", "n"],
+         "VALIDATORS": [validators.validate_options],
+         "DEFAULT_VALUE": "n",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_AMQP_ENABLE_SSL",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "amqp-enable-auth",
+         "PROMPT": "Enable Authentication for the AMQP service?",
+         "OPTION_LIST": ["y", "n"],
+         "VALIDATORS": [validators.validate_options],
+         "DEFAULT_VALUE": "n",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_AMQP_ENABLE_AUTH",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+    ]
+    update_params_usage(basedefs.PACKSTACK_DOC, params, sectioned=False)
+    group = {"GROUP_NAME": "AMQP",
+             "DESCRIPTION": "AMQP Config parameters",
+             "PRE_CONDITION": False,
+             "PRE_CONDITION_MATCH": True,
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+    controller.addGroup(group, params)
+
+    params = [
+        {"CMD_OPTION": "amqp-auth-user",
+         "PROMPT": "Enter the user for amqp authentication",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "amqp_user",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_AMQP_AUTH_USER",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "amqp-auth-password",
+         "PROMPT": "Enter the password for user authentication",
+         "OPTION_LIST": ["y", "n"],
+         "VALIDATORS": [validators.validate_not_empty],
+         "PROCESSORS": [processors.process_password],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_AMQP_AUTH_PASSWORD",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+    ]
+    update_params_usage(basedefs.PACKSTACK_DOC, params, sectioned=False)
+    group = {"GROUP_NAME": "AMQPAUTH",
+             "DESCRIPTION": "AMQP Config Authentication parameters",
+             "PRE_CONDITION": "CONFIG_AMQP_ENABLE_AUTH",
+             "PRE_CONDITION_MATCH": "y",
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+    controller.addGroup(group, params)
+
 
 def initSequences(controller):
     amqpsteps = [
-             {'title': 'Adding AMQP manifest entries', 'functions':[createmanifest]}
+        {'title': 'Preparing AMQP entries',
+         'functions': [create_manifest]}
     ]
     controller.addSequence("Installing AMQP", [], [], amqpsteps)
 
-def createmanifest(config):
-    manifestfile = "%s_amqp.pp"%config['CONFIG_AMQP_HOST']
-    manifestdata = ""
-    server = utils.ScriptRunner(config['CONFIG_AMQP_HOST'])
+
+# ------------------------ step functions -------------------------
+
+def create_manifest(config, messages):
     if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
-        config['CONFIG_AMQP_ENABLE_SSL'] = 'true'
+        config['CONFIG_AMQP_SSL_ENABLED'] = True
         config['CONFIG_AMQP_PROTOCOL'] = 'ssl'
         config['CONFIG_AMQP_CLIENTS_PORT'] = "5671"
-        if config['CONFIG_AMQP_SSL_SELF_SIGNED'] == 'y':
-            server.append( "openssl req -batch -new -x509 -nodes -keyout %s -out %s -days 1095"
-                % (config['CONFIG_AMQP_SSL_KEY_FILE'], config['CONFIG_AMQP_SSL_CERT_FILE']) )
-            server.execute()
+        amqp_host = config['CONFIG_AMQP_HOST']
+        service = 'AMQP'
+        ssl_key_file = '/etc/pki/tls/private/ssl_amqp.key'
+        ssl_cert_file = '/etc/pki/tls/certs/ssl_amqp.crt'
+        config['CONFIG_AMQP_SSL_CACERT_FILE'] = config['CONFIG_SSL_CACERT']
+        generate_ssl_cert(config, amqp_host, service, ssl_key_file,
+                          ssl_cert_file)
     else:
-    #Set default values
+        # Set default values
         config['CONFIG_AMQP_CLIENTS_PORT'] = "5672"
-        config['CONFIG_AMQP_SSL_PORT'] = "5671"
-        config['CONFIG_AMQP_SSL_CERT_FILE'] = ""
-        config['CONFIG_AMQP_SSL_KEY_FILE'] = ""
-        config['CONFIG_AMQP_NSS_CERTDB_PW'] = ""
-        config['CONFIG_AMQP_ENABLE_SSL'] = 'false'
+        config['CONFIG_AMQP_SSL_ENABLED'] = False
         config['CONFIG_AMQP_PROTOCOL'] = 'tcp'
 
     if config['CONFIG_AMQP_ENABLE_AUTH'] == 'n':
         config['CONFIG_AMQP_AUTH_PASSWORD'] = 'guest'
         config['CONFIG_AMQP_AUTH_USER'] = 'guest'
 
-    manifestdata = getManifestTemplate('amqp.pp')
+    if config['CONFIG_IP_VERSION'] == 'ipv6':
+        config['CONFIG_AMQP_HOST_URL'] = "[%s]" % config['CONFIG_AMQP_HOST']
+    else:
+        config['CONFIG_AMQP_HOST_URL'] = config['CONFIG_AMQP_HOST']
 
-    #All hosts should be able to talk to amqp
-    config['FIREWALL_SERVICE_NAME'] = "amqp"
-    config['FIREWALL_PORTS'] =  "'5671', '5672'"
-    config['FIREWALL_CHAIN'] = "INPUT"
+    fw_details = dict()
+    # All hosts should be able to talk to amqp
     for host in filtered_hosts(config, exclude=False):
-        config['FIREWALL_ALLOWED'] = "'%s'" % host
-        config['FIREWALL_SERVICE_ID'] = "amqp_%s" % host
-        manifestdata += getManifestTemplate("firewall.pp")
-
-    appendManifestFile(manifestfile, manifestdata, 'pre')
+        key = "amqp_%s" % host
+        fw_details.setdefault(key, {})
+        fw_details[key]['host'] = "%s" % host
+        fw_details[key]['service_name'] = "amqp"
+        fw_details[key]['chain'] = "INPUT"
+        fw_details[key]['ports'] = ['5671', '5672']
+        fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_AMQP_RULES'] = fw_details
diff --git a/packstack/plugins/aodh_810.py b/packstack/plugins/aodh_810.py
new file mode 100644
index 000000000..1445501dc
--- /dev/null
+++ b/packstack/plugins/aodh_810.py
@@ -0,0 +1,116 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Installs and configures Aodh
+"""
+
+from packstack.installer import basedefs
+from packstack.installer import utils
+from packstack.installer import validators
+from packstack.installer import processors
+
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import generate_ssl_cert
+
+# ------------- Aodh Packstack Plugin Initialization --------------
+
+PLUGIN_NAME = "OS-Aodh"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
+
+
+def initConfig(controller):
+    aodh_params = {
+        "AODH": [
+            {"CONF_NAME": "CONFIG_AODH_KS_PW",
+             "CMD_OPTION": "aodh-ks-passwd",
+             "PROMPT": "Enter the password for the Aodh Keystone access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "aodh-db-passwd",
+             "PROMPT": "Enter the password for the aodh DB access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_AODH_DB_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+        ]
+    }
+
+    update_params_usage(basedefs.PACKSTACK_DOC, aodh_params)
+
+    def use_aodh(config):
+        return (config['CONFIG_CEILOMETER_INSTALL'] == 'y' and
+                config['CONFIG_AODH_INSTALL'] == 'y')
+
+    aodh_groups = [
+        {"GROUP_NAME": "AODH",
+         "DESCRIPTION": "Aodh Config parameters",
+         "PRE_CONDITION": use_aodh,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+    ]
+    for group in aodh_groups:
+        paramList = aodh_params[group["GROUP_NAME"]]
+        controller.addGroup(group, paramList)
+
+
+def initSequences(controller):
+    if (controller.CONF['CONFIG_AODH_INSTALL'] != 'y' or
+       controller.CONF['CONFIG_CEILOMETER_INSTALL'] != 'y'):
+        return
+
+    steps = [{'title': 'Preparing Aodh entries',
+              'functions': [create_manifest]}]
+    controller.addSequence("Installing OpenStack Aodh", [], [],
+                           steps)
+
+
+# -------------------------- step functions --------------------------
+
+def create_manifest(config, messages):
+    if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+        ssl_cert_file = config['CONFIG_AODH_SSL_CERT'] = (
+            '/etc/pki/tls/certs/ssl_amqp_aodh.crt'
+        )
+        ssl_key_file = config['CONFIG_AODH_SSL_KEY'] = (
+            '/etc/pki/tls/private/ssl_amqp_aodh.key'
+        )
+        ssl_host = config['CONFIG_CONTROLLER_HOST']
+        service = 'aodh'
+        generate_ssl_cert(config, ssl_host, service, ssl_key_file,
+                          ssl_cert_file)
+
+    fw_details = dict()
+    key = "aodh_api"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "aodh-api"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['8042']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_AODH_RULES'] = fw_details
diff --git a/packstack/plugins/ceilometer_800.py b/packstack/plugins/ceilometer_800.py
index b709d575e..6ae5c4336 100644
--- a/packstack/plugins/ceilometer_800.py
+++ b/packstack/plugins/ceilometer_800.py
@@ -1,151 +1,191 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 """
 Installs and configures Ceilometer
 """
 
-import logging
-import os
 import uuid
 
+from packstack.installer import basedefs
 from packstack.installer import utils
 from packstack.installer import validators
-from packstack.modules.shortcuts import get_mq
-from packstack.modules.ospluginutils import (getManifestTemplate,
-                                             appendManifestFile)
+from packstack.installer import processors
 
-# Controller object will be initialized from main flow
-controller = None
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import generate_ssl_cert
+
+# ------------- Ceilometer Packstack Plugin Initialization --------------
 
-# Plugin name
 PLUGIN_NAME = "OS-Ceilometer"
 PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
 
-logging.debug("plugin %s loaded", __name__)
-
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding OpenStack Ceilometer configuration")
 
+def initConfig(controller):
     ceilometer_params = {
-        "CEILOMETER" : [
-            {"CMD_OPTION"      : "ceilometer-host",
-             "USAGE"           : ("The IP address of the server on which "
-                                  "to install Ceilometer"),
-             "PROMPT"          : ("Enter the IP address of the Ceilometer "
-                                  "server"),
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_ssh],
-             "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-             "MASK_INPUT"      : False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_CEILOMETER_HOST",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False},
-            {"CMD_OPTION"      : "ceilometer-secret",
-             "USAGE"           : "Secret key for signing metering messages.",
-             "PROMPT"          : "Enter the Ceilometer secret key",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_not_empty],
-             "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-             "MASK_INPUT"      : True,
+        "CEILOMETER": [
+            {"CONF_NAME": "CONFIG_CEILOMETER_SECRET",
+             "CMD_OPTION": "ceilometer-secret",
+             "PROMPT": "Enter the Ceilometer secret key",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": uuid.uuid4().hex[:16],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CONF_NAME": "CONFIG_CEILOMETER_KS_PW",
+             "CMD_OPTION": "ceilometer-ks-passwd",
+             "PROMPT": "Enter the password for the Ceilometer Keystone access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CONF_NAME": "CONFIG_CEILOMETER_COORDINATION_BACKEND",
+             "CMD_OPTION": "ceilometer-coordination-backend",
+             "PROMPT": "Enter the coordination driver",
+             "OPTION_LIST": ['redis', 'none'],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": 'redis',
+             "MASK_INPUT": False,
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CONF_NAME": "CONFIG_ENABLE_CEILOMETER_MIDDLEWARE",
+             "CMD_OPTION": "enable-ceilometer-middleware",
+             "PROMPT": ("Enable ceilometer middleware in swift proxy"),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "n",
+             "MASK_INPUT": False,
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "REDIS": [
+            {"CMD_OPTION": "redis-host",
+             "PROMPT": "Enter the host for the Redis server",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_ssh],
+             "DEFAULT_VALUE": utils.get_localhost_ip(),
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
-             "CONF_NAME"       : "CONFIG_CEILOMETER_SECRET",
-             "USE_DEFAULT"     : True,
-             "NEED_CONFIRM"    : True,
-             "CONDITION"       : False},
-            {"CMD_OPTION"      : "ceilometer-ks-passwd",
-             "USAGE"           : "The password to use for Ceilometer to authenticate with Keystone",
-             "PROMPT"          : "Enter the password for the Ceilometer Keystone access",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_not_empty],
-             "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-             "MASK_INPUT"      : True,
+             "CONF_NAME": "CONFIG_REDIS_HOST",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ["CONFIG_REDIS_MASTER_HOST"]},
+            {"CMD_OPTION": "redis-port",
+             "PROMPT": "Enter the port of the redis server(s)",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_port],
+             "DEFAULT_VALUE": 6379,
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
-             "CONF_NAME"       : "CONFIG_CEILOMETER_KS_PW",
-             "USE_DEFAULT"     : True,
-             "NEED_CONFIRM"    : True,
-             "CONDITION"       : False},
-            ],
-        "MONGODB" : [
-            {"CMD_OPTION"      : "mongodb-host",
-             "USAGE"           : ("The IP address of the server on which "
-                                  "to install mongodb"),
-             "PROMPT"          : ("Enter the IP address of the mongodb server"),
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_ssh],
-             "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-             "MASK_INPUT"      : False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_MONGODB_HOST",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False},
+             "CONF_NAME": "CONFIG_REDIS_PORT",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
         ],
     }
+    update_params_usage(basedefs.PACKSTACK_DOC, ceilometer_params)
 
     ceilometer_groups = [
-        {"GROUP_NAME"          : "CEILOMETER",
-         "DESCRIPTION"         : "Ceilometer Config parameters",
-         "PRE_CONDITION"       : "CONFIG_CEILOMETER_INSTALL",
-         "PRE_CONDITION_MATCH" : "y",
-         "POST_CONDITION"      : False,
+        {"GROUP_NAME": "CEILOMETER",
+         "DESCRIPTION": "Ceilometer Config parameters",
+         "PRE_CONDITION": "CONFIG_CEILOMETER_INSTALL",
+         "PRE_CONDITION_MATCH": "y",
+         "POST_CONDITION": False,
          "POST_CONDITION_MATCH": True},
-        {"GROUP_NAME"          : "MONGODB",
-         "DESCRIPTION"         : "MONGODB Config parameters",
-         "PRE_CONDITION"       : "CONFIG_CEILOMETER_INSTALL",
-         "PRE_CONDITION_MATCH" : "y",
-         "POST_CONDITION"      : False,
+
+        {"GROUP_NAME": "REDIS",
+         "DESCRIPTION": "Redis Config parameters",
+         "PRE_CONDITION": "CONFIG_CEILOMETER_COORDINATION_BACKEND",
+         "PRE_CONDITION_MATCH": "redis",
+         "POST_CONDITION": False,
          "POST_CONDITION_MATCH": True},
     ]
-
     for group in ceilometer_groups:
         paramList = ceilometer_params[group["GROUP_NAME"]]
         controller.addGroup(group, paramList)
 
+
 def initSequences(controller):
     if controller.CONF['CONFIG_CEILOMETER_INSTALL'] != 'y':
         return
 
-    steps = [{'title': 'Adding MongoDB manifest entries',
-              'functions': [create_mongodb_manifest]},
-             {'title': 'Adding Ceilometer manifest entries',
-              'functions': [create_manifest]},
-             {'title': 'Adding Ceilometer Keystone manifest entries',
-              'functions': [create_keystone_manifest]}]
-    controller.addSequence("Installing OpenStack Ceilometer",[], [],
+    steps = [{'title': 'Preparing Redis entries',
+              'functions': [create_redis_manifest]},
+             {'title': 'Preparing Ceilometer entries',
+              'functions': [create_manifest]}]
+    controller.addSequence("Installing OpenStack Ceilometer", [], [],
                            steps)
 
 
-def create_manifest(config):
-    manifestfile = "%s_ceilometer.pp" % config['CONFIG_CEILOMETER_HOST']
-    manifestdata = getManifestTemplate(get_mq(config, "ceilometer"))
-    manifestdata += getManifestTemplate("ceilometer.pp")
-    config['FIREWALL_ALLOWED'] = "'ALL'"
-    config['FIREWALL_SERVICE_NAME'] = 'ceilometer-api'
-    config['FIREWALL_SERVICE_ID'] = 'ceilometer_api'
-    config['FIREWALL_PORTS'] = "'8777'"
-    config['FIREWALL_CHAIN'] = "INPUT"
-    manifestdata += getManifestTemplate("firewall.pp")
-    # Add a template that creates a group for nova because the ceilometer
-    # class needs it
-    if config['CONFIG_NOVA_INSTALL'] == 'n':
-        manifestdata += getManifestTemplate("ceilometer_nova_disabled.pp")
-    appendManifestFile(manifestfile, manifestdata)
-
-def create_mongodb_manifest(config):
-    manifestfile = "%s_mongodb.pp" % config['CONFIG_MONGODB_HOST']
-    manifestdata = getManifestTemplate("mongodb.pp")
-    config['FIREWALL_ALLOWED'] = "'%s'" % config['CONFIG_CEILOMETER_HOST']
-    config['FIREWALL_SERVICE_NAME'] = 'mongodb-server'
-    config['FIREWALL_PORTS'] = "'27017'"
-    manifestdata += getManifestTemplate("firewall.pp")
-    appendManifestFile(manifestfile, manifestdata, 'pre')
-
-def create_keystone_manifest(config):
-    manifestfile = "%s_keystone.pp" % config['CONFIG_KEYSTONE_HOST']
-    manifestdata = getManifestTemplate("keystone_ceilometer.pp")
-    appendManifestFile(manifestfile, manifestdata)
+# -------------------------- step functions --------------------------
+
+def create_manifest(config, messages):
+    if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+        ssl_cert_file = config['CONFIG_CEILOMETER_SSL_CERT'] = (
+            '/etc/pki/tls/certs/ssl_amqp_ceilometer.crt'
+        )
+        ssl_key_file = config['CONFIG_CEILOMETER_SSL_KEY'] = (
+            '/etc/pki/tls/private/ssl_amqp_ceilometer.key'
+        )
+        ssl_host = config['CONFIG_CONTROLLER_HOST']
+        service = 'ceilometer'
+        generate_ssl_cert(config, ssl_host, service, ssl_key_file,
+                          ssl_cert_file)
+
+    fw_details = dict()
+    # NOTE(tkajinam): ceilometer has no API service now
+    config['FIREWALL_CEILOMETER_RULES'] = fw_details
+
+
+def create_redis_manifest(config, messages):
+    if config['CONFIG_CEILOMETER_COORDINATION_BACKEND'] == 'redis':
+        redis_host = config['CONFIG_REDIS_HOST']
+        if config['CONFIG_IP_VERSION'] == 'ipv6':
+            config['CONFIG_REDIS_HOST_URL'] = "[%s]" % redis_host
+        else:
+            config['CONFIG_REDIS_HOST_URL'] = redis_host
+
+        # master
+        master_clients = set([config['CONFIG_CONTROLLER_HOST']])
+        config['FIREWALL_REDIS_RULES'] = _create_redis_firewall_rules(
+            master_clients, config['CONFIG_REDIS_PORT'])
+
+
+# ------------------------- helper functions -------------------------
+
+def _create_redis_firewall_rules(hosts, port):
+    fw_details = dict()
+    for host in hosts:
+        key = "redis service from %s" % host
+        fw_details.setdefault(key, {})
+        fw_details[key]['host'] = "%s" % host
+        fw_details[key]['service_name'] = "redis service"
+        fw_details[key]['chain'] = "INPUT"
+        fw_details[key]['ports'] = port
+        fw_details[key]['proto'] = "tcp"
+    return fw_details
diff --git a/packstack/plugins/cinder_250.py b/packstack/plugins/cinder_250.py
index 9d057b376..c04c84646 100644
--- a/packstack/plugins/cinder_250.py
+++ b/packstack/plugins/cinder_250.py
@@ -1,256 +1,681 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 """
 Installs and configures Cinder
 """
 
-import os
 import re
-import uuid
-import logging
 
+from packstack.installer import basedefs
 from packstack.installer import exceptions
 from packstack.installer import processors
 from packstack.installer import validators
 from packstack.installer.utils import split_hosts
 
-from packstack.installer import basedefs
 from packstack.installer import utils
 
-from packstack.modules.shortcuts import get_mq
-from packstack.modules.ospluginutils import getManifestTemplate, appendManifestFile
-from packstack.installer import exceptions
-from packstack.installer import output_messages
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import generate_ssl_cert
 
-# Controller object will
-# be initialized from main flow
-controller = None
+# ------------------ Cinder Packstack Plugin initialization ------------------
 
-# Plugin name
 PLUGIN_NAME = "OS-Cinder"
 PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
 
-logging.debug("plugin %s loaded", __name__)
-
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding OpenStack Cinder configuration")
-    paramsList = [
-                  {"CMD_OPTION"      : "cinder-host",
-                   "USAGE"           : "The IP address of the server on which to install Cinder",
-                   "PROMPT"          : "Enter the IP address of the Cinder server",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_CINDER_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "cinder-db-passwd",
-                   "USAGE"           : "The password to use for the Cinder to access DB",
-                   "PROMPT"          : "Enter the password for the Cinder DB access",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_CINDER_DB_PW",
-                   "USE_DEFAULT"     : True,
-                   "NEED_CONFIRM"    : True,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "cinder-ks-passwd",
-                   "USAGE"           : "The password to use for the Cinder to authenticate with Keystone",
-                   "PROMPT"          : "Enter the password for the Cinder Keystone access",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_CINDER_KS_PW",
-                   "USE_DEFAULT"     : True,
-                   "NEED_CONFIRM"    : True,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "cinder-backend",
-                   "USAGE"           : ("The Cinder backend to use, valid options are: "
-                                        "lvm, gluster, nfs, vmdk"),
-                   "PROMPT"          : "Enter the Cinder backend to be configured",
-                   "OPTION_LIST"     : ["lvm", "gluster", "nfs", "vmdk"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "lvm",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_CINDER_BACKEND",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                 ]
-
-    groupDict = { "GROUP_NAME"            : "CINDER",
-                  "DESCRIPTION"           : "Cinder Config parameters",
-                  "PRE_CONDITION"         : "CONFIG_CINDER_INSTALL",
-                  "PRE_CONDITION_MATCH"   : "y",
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
-
-    def check_lvm_options(config):
-        return (config.get('CONFIG_CINDER_INSTALL', 'n') == 'y' and
-                config.get('CONFIG_CINDER_BACKEND', 'lvm') == 'lvm')
-
-    paramsList = [
-                  {"CMD_OPTION"      : "cinder-volumes-create",
-                   "USAGE"           : ("Create Cinder's volumes group. This should only be done for "
-                                        "testing on a proof-of-concept installation of Cinder.  This "
-                                        "will create a file-backed volume group and is not suitable "
-                                        "for production usage."),
-                   "PROMPT"          : ("Should Cinder's volumes group be created (for proof-of-concept "
-                                        "installation)?"),
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "y",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_CINDER_VOLUMES_CREATE",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                 ]
-
-    groupDict = { "GROUP_NAME"            : "CINDERVOLUMECREATE",
-                  "DESCRIPTION"           : "Cinder volume create Config parameters",
-                  "PRE_CONDITION"         : check_lvm_options,
-                  "PRE_CONDITION_MATCH"   : True,
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
-
-    def check_lvm_vg_options(config):
-        return (config.get('CONFIG_CINDER_INSTALL', 'n') == 'y' and
-                config.get('CONFIG_CINDER_BACKEND', 'lvm') == 'lvm' and
-                config.get('CONFIG_CINDER_VOLUMES_CREATE', 'y') == 'y')
-
-    paramsList = [
-                  {"CMD_OPTION"      : "cinder-volumes-size",
-                   "USAGE"           : ("Cinder's volumes group size. Note that actual volume size "
-                                        "will be extended with 3% more space for VG metadata."),
-                   "PROMPT"          : "Enter Cinder's volumes group usable size",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : "20G",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_CINDER_VOLUMES_SIZE",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                 ]
-
-    groupDict = { "GROUP_NAME"            : "CINDERVOLUMESIZE",
-                  "DESCRIPTION"           : "Cinder volume size Config parameters",
-                  "PRE_CONDITION"         : check_lvm_vg_options,
-                  "PRE_CONDITION_MATCH"   : True,
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
-
-    def check_gluster_options(config):
-        return (config.get('CONFIG_CINDER_INSTALL', 'n') == 'y' and
-                config.get('CONFIG_CINDER_BACKEND', 'lvm') == 'gluster')
-
-    paramsList = [
-                  {"CMD_OPTION"      : "cinder-gluster-mounts",
-                   "USAGE"           : ("A single or comma separated list of gluster volume shares "
-                                        "to mount, eg: ip-address:/vol-name, domain:/vol-name "),
-                   "PROMPT"          : ("Enter a single or comma separated list of gluster volume "
-                                        "shares to use with Cinder"),
-                   "OPTION_LIST"     : ["^'([\d]{1,3}\.){3}[\d]{1,3}:/.*'", \
-                    "^'[a-zA-Z0-9][\-\.\w]*:/.*'"],
-                   "VALIDATORS"      : [validators.validate_multi_regexp],
-                   "PROCESSORS"      : [processors.process_add_quotes_around_values],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_CINDER_GLUSTER_MOUNTS",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  ]
-
-    groupDict = { "GROUP_NAME"            : "CINDERGLUSTERMOUNTS",
-                  "DESCRIPTION"           : "Cinder gluster Config parameters",
-                  "PRE_CONDITION"         : check_gluster_options,
-                  "PRE_CONDITION_MATCH"   : True,
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
-
-    def check_nfs_options(config):
-        return (config.get('CONFIG_CINDER_INSTALL', 'n') == 'y' and
-                config.get('CONFIG_CINDER_BACKEND', 'lvm') == 'nfs')
-
-    paramsList = [
-                  {"CMD_OPTION"      : "cinder-nfs-mounts",
-                   "USAGE"           : ("A single or comma seprated list of NFS exports to mount, "
-                                        "eg: ip-address:/export-name "),
-                   "PROMPT"          : ("Enter a single or comma seprated list of NFS exports to "
-                                        "use with Cinder"),
-                   "OPTION_LIST"     : ["^'([\d]{1,3}\.){3}[\d]{1,3}:/.*'"],
-                   "VALIDATORS"      : [validators.validate_multi_regexp],
-                   "PROCESSORS"      : [processors.process_add_quotes_around_values],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_CINDER_NFS_MOUNTS",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  ]
-
-    groupDict = { "GROUP_NAME"            : "CINDERNFSMOUNTS",
-                  "DESCRIPTION"           : "Cinder NFS Config parameters",
-                  "PRE_CONDITION"         : check_nfs_options,
-                  "PRE_CONDITION_MATCH"   : True,
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
+NETAPP_DEFAULT_STORAGE_FAMILY = "ontap_cluster"
+NETAPP_DEFAULT_STORAGE_PROTOCOL = "nfs"
+
+
+def initConfig(controller):
+    conf_params = {
+        "CINDER": [
+            {"CMD_OPTION": "cinder-db-passwd",
+             "PROMPT": "Enter the password for the Cinder DB access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_DB_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": 'cinder-db-purge-enable',
+             "PROMPT": (
+                 "Enter y if cron job for removing soft deleted DB rows "
+                 "should be created"
+             ),
+             "OPTION_LIST": ['y', 'n'],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [processors.process_bool],
+             "DEFAULT_VALUE": 'y',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_CINDER_DB_PURGE_ENABLE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "cinder-ks-passwd",
+             "PROMPT": "Enter the password for the Cinder Keystone access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_KS_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "cinder-backend",
+             "PROMPT": "Enter the Cinder backend to be configured",
+             "OPTION_LIST": ["lvm", "nfs", "netapp", "solidfire"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "lvm",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_BACKEND",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "CINDERVOLUMECREATE": [
+            {"CMD_OPTION": "cinder-volumes-create",
+             "PROMPT": ("Should Cinder's volumes group be created (for "
+                        "proof-of-concept installation)?"),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_VOLUMES_CREATE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "CINDERVOLUMESIZE": [
+            {"CMD_OPTION": "cinder-volumes-size",
+             "PROMPT": "Enter Cinder's volumes group usable size",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "20G",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_VOLUMES_SIZE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "CINDERVOLUMENAME": [
+            {"CMD_OPTION": "cinder-volume-name",
+             "PROMPT": "Enter a name for the Cinder volume",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "cinder-volumes",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_VOLUME_NAME",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "CINDERNFSMOUNTS": [
+            {"CMD_OPTION": "cinder-nfs-mounts",
+             "PROMPT": ("Enter a single or comma seprated list of NFS exports "
+                        "to use with Cinder"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_multi_export],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_CINDER_NFS_MOUNTS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "CINDERNETAPPMAIN": [
+            {"CMD_OPTION": "cinder-netapp-login",
+             "PROMPT": ("Enter a NetApp login"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_LOGIN",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-password",
+             "PROMPT": ("Enter a NetApp password"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_PASSWORD",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-hostname",
+             "PROMPT": ("Enter a NetApp hostname"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [processors.process_add_quotes_around_values],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_HOSTNAME",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-server-port",
+             "PROMPT": ("Enter a NetApp server port"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_port],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": 80,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_SERVER_PORT",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-storage-family",
+             "PROMPT": ("Enter a NetApp storage family"),
+             "OPTION_LIST": ["ontap_7mode", "ontap_cluster", "eseries"],
+             "VALIDATORS": [validators.validate_options],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": NETAPP_DEFAULT_STORAGE_FAMILY,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_STORAGE_FAMILY",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-transport-type",
+             "PROMPT": ("Enter a NetApp transport type"),
+             "OPTION_LIST": ["http", "https"],
+             "VALIDATORS": [validators.validate_options],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "http",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_TRANSPORT_TYPE",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-storage-protocol",
+             "PROMPT": ("Enter a NetApp storage protocol"),
+             "OPTION_LIST": ["iscsi", "fc", "nfs"],
+             "VALIDATORS": [validators.validate_options],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": NETAPP_DEFAULT_STORAGE_PROTOCOL,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "CINDERNETAPPONTAPISCSI": [
+            {"CMD_OPTION": "cinder-netapp-size-multiplier",
+             "PROMPT": ("Enter a NetApp size multiplier"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "1.0",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "CINDERNETAPPNFS": [
+            {"CMD_OPTION": "cinder-netapp-expiry-thres-minutes",
+             "PROMPT": ("Enter a threshold"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_integer],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": 720,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-thres-avl-size-perc-start",
+             "PROMPT": ("Enter a value"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_integer],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": 20,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_START",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-thres-avl-size-perc-stop",
+             "PROMPT": ("Enter a value"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_integer],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": 60,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_STOP",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-nfs-shares",
+             "PROMPT": ("Enter a single or comma-separated list of NetApp NFS shares"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_NFS_SHARES",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-nfs-shares-config",
+             "PROMPT": ("Enter a NetApp NFS share config file"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "/etc/cinder/shares.conf",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_NFS_SHARES_CONFIG",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "CINDERNETAPPISCSI7MODE": [
+            {"CMD_OPTION": "cinder-netapp-volume-list",
+             "PROMPT": ("Enter a NetApp volume list"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_VOLUME_LIST",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-vfiler",
+             "PROMPT": ("Enter a NetApp vFiler"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_VFILER",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "CINDERNETAPP7MODEFC": [
+            {"CMD_OPTION": "cinder-netapp-partner-backend-name",
+             "PROMPT": ("Enter a NetApp partner backend name"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_PARTNER_BACKEND_NAME",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "CINDERNETAPPVSERVER": [
+            {"CMD_OPTION": "cinder-netapp-vserver",
+             "PROMPT": ("Enter a NetApp Vserver"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_VSERVER",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "CINDERNETAPPESERIES": [
+            {"CMD_OPTION": "cinder-netapp-controller-ips",
+             "PROMPT": ("Enter a value"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_multi_ping],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_CONTROLLER_IPS",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-sa-password",
+             "PROMPT": ("Enter a password"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_SA_PASSWORD",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-eseries-host-type",
+             "PROMPT": ("Enter a host type"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "linux_dm_mp",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_ESERIES_HOST_TYPE",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-webservice-path",
+             "PROMPT": ("Enter a path"),
+             "OPTION_LIST": ["^[/].*$"],
+             "VALIDATORS": [validators.validate_regexp],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "/devmgr/v2",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_WEBSERVICE_PATH",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-netapp-storage-pools",
+             "PROMPT": ("Enter a value"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_CINDER_NETAPP_STORAGE_POOLS",
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            ],
+
+        "CINDERSOLIDFIRE": [
+            {"CMD_OPTION": "cinder-solidfire-login",
+             "PROMPT": ("Enter the cluster admin login"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_SOLIDFIRE_LOGIN",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-solidfire-password",
+             "PROMPT": ("Enter cluster admin password"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_SOLIDFIRE_PASSWORD",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+            {"CMD_OPTION": "cinder-solidfire-hostname",
+             "PROMPT": ("Enter a SolidFire hostname or IP"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [processors.process_add_quotes_around_values],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_SOLIDFIRE_HOSTNAME",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+            ]
+    }
+    update_params_usage(basedefs.PACKSTACK_DOC, conf_params)
+
+    conf_groups = [
+        {"GROUP_NAME": "CINDER",
+         "DESCRIPTION": "Cinder Config parameters",
+         "PRE_CONDITION": "CONFIG_CINDER_INSTALL",
+         "PRE_CONDITION_MATCH": "y",
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "CINDERVOLUMECREATE",
+         "DESCRIPTION": "Cinder volume create Config parameters",
+         "PRE_CONDITION": check_lvm_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "CINDERVOLUMENAME",
+         "DESCRIPTION": "Cinder volume custom name",
+         "PRE_CONDITION": check_lvm_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "CINDERVOLUMESIZE",
+         "DESCRIPTION": "Cinder volume size Config parameters",
+         "PRE_CONDITION": check_lvm_vg_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "CINDERNFSMOUNTS",
+         "DESCRIPTION": "Cinder NFS Config parameters",
+         "PRE_CONDITION": check_nfs_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "CINDERNETAPPMAIN",
+         "DESCRIPTION": "Cinder NetApp main configuration",
+         "PRE_CONDITION": check_netapp_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "CINDERNETAPPONTAPISCSI",
+         "DESCRIPTION": "Cinder NetApp ONTAP-iSCSI configuration",
+         "PRE_CONDITION": check_netapp_ontap_iscsi_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "CINDERNETAPPNFS",
+         "DESCRIPTION": "Cinder NetApp NFS configuration",
+         "PRE_CONDITION": check_netapp_nfs_settings,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "CINDERNETAPPISCSI7MODE",
+         "DESCRIPTION": "Cinder NetApp iSCSI & 7-mode configuration",
+         "PRE_CONDITION": check_netapp_7modeiscsi_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "CINDERNETAPP7MODEFC",
+         "DESCRIPTION": "Cinder NetApp 7-mode Fibre Channel configuration",
+         "PRE_CONDITION": check_netapp_7mode_fc_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "CINDERNETAPPVSERVER",
+         "DESCRIPTION": "Cinder NetApp Vserver configuration",
+         "PRE_CONDITION": check_netapp_vserver_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "CINDERNETAPPESERIES",
+         "DESCRIPTION": "Cinder NetApp E-Series configuration",
+         "PRE_CONDITION": check_netapp_eseries_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "CINDERSOLIDFIRE",
+         "DESCRIPTION": "Cinder SolidFire configuration",
+         "PRE_CONDITION": check_solidfire_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True}
+        ]
+    for group in conf_groups:
+        params = conf_params[group["GROUP_NAME"]]
+        controller.addGroup(group, params)
 
 
 def initSequences(controller):
-    if controller.CONF['CONFIG_CINDER_INSTALL'] != 'y':
+    config = controller.CONF
+    if config['CONFIG_CINDER_INSTALL'] != 'y':
         return
 
-    cinder_steps = [
-             {'title': 'Installing dependencies for Cinder', 'functions':[install_cinder_deps]},
-             {'title': 'Adding Cinder Keystone manifest entries', 'functions':[create_keystone_manifest]},
-             {'title': 'Adding Cinder manifest entries', 'functions':[create_manifest]}
-    ]
+    config['CONFIG_CINDER_BACKEND'] = (
+        [i.strip() for i in config['CONFIG_CINDER_BACKEND'].split(',') if i]
+    )
+
+    for key in ('CONFIG_CINDER_NETAPP_VOLUME_LIST',
+                'CONFIG_CINDER_NFS_MOUNTS'):
+        if key in config:
+            config[key] = [i.strip() for i in config[key].split(',') if i]
 
-    if controller.CONF['CONFIG_CINDER_BACKEND'] == 'lvm':
-        cinder_steps.append({'title': 'Checking if the Cinder server has a cinder-volumes vg', 'functions':[check_cinder_vg]})
+    cinder_steps = []
+
+    if 'lvm' in config['CONFIG_CINDER_BACKEND']:
+        cinder_steps.append(
+            {'title': 'Checking if the Cinder server has a cinder-volumes vg',
+             'functions': [check_cinder_vg]})
+
+    cinder_steps.append(
+        {'title': 'Preparing Cinder entries',
+         'functions': [create_manifest]}
+    )
     controller.addSequence("Installing OpenStack Cinder", [], [], cinder_steps)
 
-def install_cinder_deps(config):
-    server = utils.ScriptRunner(config['CONFIG_CINDER_HOST'])
-    pkgs = []
-    if config['CONFIG_CINDER_BACKEND'] == 'lvm':
-        pkgs.append('lvm2')
-    for p in pkgs:
-        server.append("rpm -q --whatprovides %(package)s || yum install -y %(package)s" % dict(package=p))
-    server.execute()
 
-def check_cinder_vg(config):
-    cinders_volume = 'cinder-volumes'
+# ------------------------- helper functions -------------------------
+
+def check_lvm_options(config):
+    return (config['CONFIG_CINDER_INSTALL'] == 'y' and
+            'lvm' in config['CONFIG_CINDER_BACKEND'])
+
+
+def check_lvm_vg_options(config):
+    return (config['CONFIG_CINDER_INSTALL'] == 'y' and
+            'lvm' in config['CONFIG_CINDER_BACKEND'])
+
+
+def check_nfs_options(config):
+    return (config['CONFIG_CINDER_INSTALL'] == 'y' and
+            'nfs' in config['CONFIG_CINDER_BACKEND'])
+
+
+def check_netapp_options(config):
+    return (config['CONFIG_CINDER_INSTALL'] == 'y' and
+            'netapp' in config['CONFIG_CINDER_BACKEND'])
+
+
+def check_netapp_ontap_iscsi_options(config):
+    return (check_netapp_options(config) and
+            config['CONFIG_CINDER_NETAPP_STORAGE_FAMILY'] in
+            ['ontap_cluster', 'ontap_7mode'] and
+            config['CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'] == "iscsi")
+
+
+def check_netapp_nfs_settings(config):
+    return (check_netapp_options(config) and
+            config['CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'] == "nfs")
+
+
+def check_netapp_7modeiscsi_options(config):
+    return (check_netapp_options(config) and
+            config['CONFIG_CINDER_NETAPP_STORAGE_FAMILY'] == 'ontap_7mode' and
+            config['CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'] == 'iscsi')
+
+
+def check_netapp_7mode_fc_options(config):
+    return (check_netapp_options(config) and
+            config['CONFIG_CINDER_NETAPP_STORAGE_FAMILY'] == "ontap_7mode" and
+            config['CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'] == "fc")
+
+
+def check_netapp_vserver_options(config):
+    return (
+        check_netapp_options(config) and
+        config['CONFIG_CINDER_NETAPP_STORAGE_FAMILY'] == "ontap_cluster" and
+        config['CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'] in ['nfs', 'iscsi'])
+
+
+def check_netapp_eseries_options(config):
+    return (check_netapp_options(config) and
+            config['CONFIG_CINDER_NETAPP_STORAGE_FAMILY'] == "eseries")
+
+
+def check_solidfire_options(config):
+    return (config['CONFIG_CINDER_INSTALL'] == 'y' and
+            'solidfire' in config['CONFIG_CINDER_BACKEND'])
+
+
+# -------------------------- step functions --------------------------
+
+def check_cinder_vg(config, messages):
+    cinders_volume = config["CONFIG_CINDER_VOLUME_NAME"]
 
     # Do we have a cinder-volumes vg?
     have_cinders_volume = False
-    server = utils.ScriptRunner(config['CONFIG_CINDER_HOST'])
+    server = utils.ScriptRunner(config['CONFIG_STORAGE_HOST'])
     server.append('vgdisplay %s' % cinders_volume)
     try:
         server.execute()
@@ -258,132 +683,62 @@ def check_cinder_vg(config):
     except exceptions.ScriptRuntimeError:
         pass
 
-    # Configure system LVM settings (snapshot_autoextend)
-    server = utils.ScriptRunner(config['CONFIG_CINDER_HOST'])
-    server.append('sed -i -r "s/^ *snapshot_autoextend_threshold +=.*/'
-                  '    snapshot_autoextend_threshold = 80/" '
-                  '/etc/lvm/lvm.conf')
-    server.append('sed -i -r "s/^ *snapshot_autoextend_percent +=.*/'
-                  '    snapshot_autoextend_percent = 20/" '
-                  '/etc/lvm/lvm.conf')
-    try:
-        server.execute()
-    except exceptions.ScriptRuntimeError:
-        logging.info("Warning: Unable to set system LVM settings.")
-
-
-    if config["CONFIG_CINDER_VOLUMES_CREATE"] != "y":
+    if config["CONFIG_CINDER_VOLUMES_CREATE"] == "n":
         if not have_cinders_volume:
-            raise exceptions.MissingRequirements("The cinder server should"
-                " contain a cinder-volumes volume group")
-    else:
-        if have_cinders_volume:
-            controller.MESSAGES.append(
-                output_messages.INFO_CINDER_VOLUMES_EXISTS)
-            return
-
-        server = utils.ScriptRunner(config['CONFIG_CINDER_HOST'])
-        server.append('systemctl')
-        try:
-            server.execute()
-            rst_cmd = 'systemctl restart openstack-cinder-volume.service'
-        except exceptions.ScriptRuntimeError:
-            rst_cmd = 'service openstack-cinder-volume restart'
-
-        server.clear()
-        logging.info("A new cinder volumes group will be created")
-        err = "Cinder's volume group '%s' could not be created" % \
-                            cinders_volume
-
-        cinders_volume_path = '/var/lib/cinder'
-        server.append('mkdir -p  %s' % cinders_volume_path)
-        logging.debug("Volume's path: %s" % cinders_volume_path)
-
-        match = re.match('^(?P<size>\d+)G$',
-                         config['CONFIG_CINDER_VOLUMES_SIZE'].strip())
-        if not match:
-            msg = 'Invalid Cinder volumes VG size.'
-            raise exceptions.ParamValidationError(msg)
-
-        cinders_volume_size = int(match.group('size')) * 1024
-        cinders_reserve = int(cinders_volume_size * 0.03)
-
-        cinders_volume_size = cinders_volume_size + cinders_reserve
-        cinders_volume_path = os.path.join(cinders_volume_path, cinders_volume)
-        server.append('dd if=/dev/zero of=%s bs=1 count=0 seek=%sM'
-                       % (cinders_volume_path, cinders_volume_size))
-        server.append('LOFI=$(losetup --show -f  %s)' % cinders_volume_path)
-        server.append('pvcreate $LOFI')
-        server.append('vgcreate %s $LOFI' % cinders_volume)
-
-        # Add the loop device on boot
-        server.append('grep %(volume)s /etc/rc.d/rc.local || '
-                      'echo "losetup -f %(path)s && '
-                            'vgchange -a y %(volume)s && '
-                            '%(restart_cmd)s" '
-                      '>> /etc/rc.d/rc.local' %
-                      {'volume': cinders_volume, 'restart_cmd': rst_cmd,
-                       'path': cinders_volume_path})
-        server.append('grep "#!" /etc/rc.d/rc.local || '
-                      'sed -i \'1i#!/bin/sh\' /etc/rc.d/rc.local')
-        server.append('chmod +x /etc/rc.d/rc.local')
-
-        # Let's make sure it exists
-        server.append('vgdisplay %s' % cinders_volume)
-
-        try:
-            server.execute()
-        except exceptions.ScriptRuntimeError:
-            # Release loop device if cinder's volume creation
-            # fails.
-            try:
-                logging.debug("Release loop device, volume creation failed")
-                server = utils.ScriptRunner(controller.CONF['CONFIG_CINDER_HOST'])
-                server.append('losetup -d $(losetup -j %s | cut -d : -f 1)' %
-                               cinders_volume_path
-                )
-                server.execute()
-            except:
-                pass
-
-            raise exceptions.MissingRequirements(err)
-
-
-def create_keystone_manifest(config):
-    manifestfile = "%s_keystone.pp" % controller.CONF['CONFIG_KEYSTONE_HOST']
-    manifestdata = getManifestTemplate("keystone_cinder.pp")
-    appendManifestFile(manifestfile, manifestdata)
-
-
-def create_manifest(config):
-    manifestdata = getManifestTemplate(get_mq(config, "cinder"))
-    manifestfile = "%s_cinder.pp" % controller.CONF['CONFIG_CINDER_HOST']
-    manifestdata += getManifestTemplate("cinder.pp")
-
-    if config['CONFIG_CINDER_BACKEND'] == "gluster":
-        manifestdata += getManifestTemplate("cinder_gluster.pp")
-    if config['CONFIG_CINDER_BACKEND'] == "nfs":
-        manifestdata += getManifestTemplate("cinder_nfs.pp")
-    if config['CONFIG_CINDER_BACKEND'] == "vmdk":
-        manifestdata += getManifestTemplate("cinder_vmdk.pp")
-    if config['CONFIG_CEILOMETER_INSTALL'] == 'y':
-        manifestdata += getManifestTemplate('cinder_ceilometer.pp')
-    if config['CONFIG_SWIFT_INSTALL'] == 'y':
-        config['CONFIG_SWIFT_PROXY'] = config['CONFIG_SWIFT_PROXY_HOSTS'].split(',')[0].strip()
-        manifestdata += getManifestTemplate('cinder_backup.pp')
-
-    config['FIREWALL_SERVICE_NAME'] = "cinder"
-    config['FIREWALL_PORTS'] = "'3260', '8776'"
-    config['FIREWALL_CHAIN'] = "INPUT"
-
-    if (config['CONFIG_NOVA_INSTALL'] == 'y' and config['CONFIG_VMWARE_BACKEND']=='n'):
-        for host in split_hosts(config['CONFIG_NOVA_COMPUTE_HOSTS']):
-            config['FIREWALL_ALLOWED'] = "'%s'" % host
-            config['FIREWALL_SERVICE_ID'] = "cinder_%s" % host
-            manifestdata += getManifestTemplate("firewall.pp")
-    else:
-        config['FIREWALL_ALLOWED'] = "'ALL'"
-        config['FIREWALL_SERVICE_ID'] = "cinder_ALL"
-        manifestdata += getManifestTemplate("firewall.pp")
-
-    appendManifestFile(manifestfile, manifestdata)
+            raise exceptions.MissingRequirements("The cinder server should "
+                                                 "contain a volume group")
+    match = re.match(r'^(?P<size>\d+)G$',
+                     config['CONFIG_CINDER_VOLUMES_SIZE'].strip())
+    if not match:
+        msg = 'Invalid Cinder volumes VG size.'
+        raise exceptions.ParamValidationError(msg)
+
+    cinders_volume_size = int(match.group('size')) * 1024
+    cinders_reserve = int(cinders_volume_size * 0.03)
+
+    cinders_volume_size = cinders_volume_size + cinders_reserve
+    config['CONFIG_CINDER_VOLUMES_SIZE'] = '%sM' % cinders_volume_size
+
+
+def create_manifest(config, messages):
+    if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+        ssl_host = config['CONFIG_STORAGE_HOST']
+        ssl_cert_file = config['CONFIG_CINDER_SSL_CERT'] = (
+            '/etc/pki/tls/certs/ssl_amqp_cinder.crt'
+        )
+        ssl_key_file = config['CONFIG_CINDER_SSL_KEY'] = (
+            '/etc/pki/tls/private/ssl_amqp_cinder.key'
+        )
+        service = 'cinder'
+        generate_ssl_cert(config, ssl_host, service, ssl_key_file,
+                          ssl_cert_file)
+
+    fw_details = dict()
+    for host in split_hosts(config['CONFIG_COMPUTE_HOSTS']):
+        if (config['CONFIG_NOVA_INSTALL'] == 'y' and
+                config['CONFIG_VMWARE_BACKEND'] == 'n'):
+            key = "cinder_%s" % host
+            fw_details.setdefault(key, {})
+            fw_details[key]['host'] = "%s" % host
+        else:
+            key = "cinder_all"
+            fw_details.setdefault(key, {})
+            fw_details[key]['host'] = "ALL"
+
+        fw_details[key]['service_name'] = "cinder"
+        fw_details[key]['chain'] = "INPUT"
+        fw_details[key]['ports'] = ['3260']
+        fw_details[key]['proto'] = "tcp"
+
+    config['FIREWALL_CINDER_RULES'] = fw_details
+
+    # cinder API should be open for everyone
+    fw_details = dict()
+    key = "cinder_api"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "cinder-api"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['8776']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_CINDER_API_RULES'] = fw_details
diff --git a/packstack/plugins/dashboard_500.py b/packstack/plugins/dashboard_500.py
index 30226ec40..ad9dff1f1 100644
--- a/packstack/plugins/dashboard_500.py
+++ b/packstack/plugins/dashboard_500.py
@@ -1,102 +1,126 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 """
 Installs and configures OpenStack Horizon
 """
 
-import logging
 import os
 import uuid
 
-from packstack.installer import validators
-from packstack.installer import basedefs, output_messages
+from packstack.installer import basedefs
 from packstack.installer import exceptions
 from packstack.installer import utils
+from packstack.installer import validators
 
-from packstack.modules.ospluginutils import getManifestTemplate, appendManifestFile
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import generate_ssl_cert
+from packstack.modules.ospluginutils import deliver_ssl_file
 
-# Controller object will be initialized from main flow
-controller = None
+# ------------- Horizon Packstack Plugin Initialization --------------
 
-# Plugin name
-PLUGIN_NAME = "OS-HORIZON"
+PLUGIN_NAME = "OS-Horizon"
 PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
 
-logging.debug("plugin %s loaded", __name__)
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding OpenStack Horizon configuration")
-    paramsList = [
-                  {"CMD_OPTION"      : "os-horizon-host",
-                   "USAGE"           : "The IP address of the server on which to install Horizon",
-                   "PROMPT"          : "Enter the IP address of the Horizon server",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_HORIZON_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-horizon-ssl",
-                   "USAGE"           : "To set up Horizon communication over https set this to \"y\"",
-                   "PROMPT"          : "Would you like to set up Horizon communication over https",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "n",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_HORIZON_SSL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                 ]
-
-    groupDict = { "GROUP_NAME"            : "OSHORIZON",
-                  "DESCRIPTION"           : "OpenStack Horizon Config parameters",
-                  "PRE_CONDITION"         : "CONFIG_HORIZON_INSTALL",
-                  "PRE_CONDITION_MATCH"   : "y",
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
-
-    paramsList = [
-                  {"CMD_OPTION"      : "os-ssl-cert",
-                   "USAGE"           : "PEM encoded certificate to be used for ssl on the https server, leave blank if one should be generated, this certificate should not require a passphrase",
-                   "PROMPT"          : "Enter the path to a PEM encoded certificate to be used on the https server, leave blank if one should be generated, this certificate should not require a passphrase",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [],
-                   "DEFAULT_VALUE"   : '',
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_SSL_CERT",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-ssl-key",
-                   "USAGE"           : "Keyfile corresponding to the certificate if one was entered",
-                   "PROMPT"          : "Enter the keyfile corresponding to the certificate if one was entered",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_SSL_KEY",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                 ]
-
-    groupDict = { "GROUP_NAME"            : "OSSSL",
-                  "DESCRIPTION"           : "SSL Config parameters",
-                  "PRE_CONDITION"         : "CONFIG_HORIZON_SSL",
-                  "PRE_CONDITION_MATCH"   : "y",
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
+
+def initConfig(controller):
+    params = [
+        {"CMD_OPTION": "os-horizon-ssl",
+         "PROMPT": "Would you like to set up Horizon communication over https",
+         "OPTION_LIST": ["y", "n"],
+         "VALIDATORS": [validators.validate_options],
+         "DEFAULT_VALUE": "n",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_HORIZON_SSL",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "os-horizon-secretkey",
+         "PROMPT": "Horizon Secret Encryption Key",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": uuid.uuid4().hex,
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_HORIZON_SECRET_KEY",
+         "USE_DEFAULT": True,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+    ]
+    update_params_usage(basedefs.PACKSTACK_DOC, params, sectioned=False)
+    group = {"GROUP_NAME": "OSHORIZON",
+             "DESCRIPTION": "OpenStack Horizon Config parameters",
+             "PRE_CONDITION": "CONFIG_HORIZON_INSTALL",
+             "PRE_CONDITION_MATCH": "y",
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+    controller.addGroup(group, params)
+
+    params = [
+        {"CMD_OPTION": "os-ssl-cert",
+         "PROMPT": ("Enter the path to a PEM encoded certificate to be used "
+                    "on the https server, leave blank if one should be "
+                    "generated, this certificate should not require "
+                    "a passphrase"),
+         "OPTION_LIST": [],
+         "VALIDATORS": [],
+         "DEFAULT_VALUE": '',
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_HORIZON_SSL_CERT",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False,
+         "DEPRECATES": ['CONFIG_SSL_CERT']},
+
+        {"CMD_OPTION": "os-ssl-key",
+         "PROMPT": ("Enter the SSL keyfile corresponding to the certificate "
+                    "if one was entered"),
+         "OPTION_LIST": [],
+         "VALIDATORS": [],
+         "DEFAULT_VALUE": "",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_HORIZON_SSL_KEY",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False,
+         "DEPRECATES": ['CONFIG_SSL_KEY']},
+
+        {"CMD_OPTION": "os-ssl-cachain",
+         "PROMPT": ("Enter the CA chain file corresponding to the certificate "
+                    "if one was entered"),
+         "OPTION_LIST": [],
+         "VALIDATORS": [],
+         "DEFAULT_VALUE": "",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_HORIZON_SSL_CACERT",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False,
+         "DEPRECATES": ['CONFIG_SSL_CACHAIN']},
+    ]
+    update_params_usage(basedefs.PACKSTACK_DOC, params, sectioned=False)
+    group = {"GROUP_NAME": "OSSSL",
+             "DESCRIPTION": "SSL Config parameters",
+             "PRE_CONDITION": "CONFIG_HORIZON_SSL",
+             "PRE_CONDITION_MATCH": "y",
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+    controller.addGroup(group, params)
 
 
 def initSequences(controller):
@@ -104,55 +128,76 @@ def initSequences(controller):
         return
 
     steps = [
-             {'title': 'Adding Horizon manifest entries', 'functions': [createmanifest]}
+        {'title': 'Preparing Horizon entries',
+         'functions': [create_manifest]}
     ]
     controller.addSequence("Installing OpenStack Horizon", [], [], steps)
 
 
-def createmanifest(config):
-    controller.CONF["CONFIG_HORIZON_SECRET_KEY"] = uuid.uuid4().hex
-    horizon_host = controller.CONF['CONFIG_HORIZON_HOST']
-    manifestfile = "%s_horizon.pp" % horizon_host
+# -------------------------- step functions --------------------------
+
+def create_manifest(config, messages):
+    horizon_host = config['CONFIG_CONTROLLER_HOST']
 
     proto = "http"
-    controller.CONF["CONFIG_HORIZON_PORT"] = "'80'"
-    sslmanifestdata = ''
-    if controller.CONF["CONFIG_HORIZON_SSL"] == 'y':
-        controller.CONF["CONFIG_HORIZON_PORT"] = "'443'"
+    config["CONFIG_HORIZON_PORT"] = 80
+    if config["CONFIG_HORIZON_SSL"] == 'y':
+        config["CONFIG_HORIZON_PORT"] = 443
         proto = "https"
-        sslmanifestdata += getManifestTemplate("https.pp")
 
         # Are we using the users cert/key files
-        if controller.CONF["CONFIG_SSL_CERT"]:
-            ssl_cert = controller.CONF["CONFIG_SSL_CERT"]
-            ssl_key = controller.CONF["CONFIG_SSL_KEY"]
+        if config["CONFIG_HORIZON_SSL_CERT"]:
+            ssl_cert_file = config["CONFIG_HORIZON_SSL_CERT"]
+            ssl_key_file = config["CONFIG_HORIZON_SSL_KEY"]
+            ssl_chain_file = config["CONFIG_HORIZON_SSL_CACERT"]
+
+            if not os.path.exists(ssl_cert_file):
+                raise exceptions.ParamValidationError(
+                    "The file %s doesn't exist" % ssl_cert_file)
 
-            if not os.path.exists(ssl_cert):
+            if not os.path.exists(ssl_key_file):
                 raise exceptions.ParamValidationError(
-                    "The file %s doesn't exist" % ssl_cert)
+                    "The file %s doesn't exist" % ssl_key_file)
 
-            if ssl_key and not os.path.exists(ssl_key):
+            if not os.path.exists(ssl_chain_file):
                 raise exceptions.ParamValidationError(
-                    "The file %s doesn't exist" % ssl_key)
+                    "The file %s doesn't exist" % ssl_chain_file)
+
+            final_cacert = open(ssl_chain_file, 'rt').read()
+            final_cert = open(ssl_cert_file, 'rt').read()
+            final_key = open(ssl_key_file, 'rt').read()
+            host = config['CONFIG_CONTROLLER_HOST']
+            deliver_ssl_file(final_cacert, ssl_chain_file, host)
+            deliver_ssl_file(final_cert, ssl_cert_file, host)
+            deliver_ssl_file(final_key, ssl_key_file, host)
 
-            controller.addResource(horizon_host, ssl_cert, 'ssl_ps_server.crt')
-            if ssl_key:
-                controller.addResource(
-                    horizon_host, ssl_key, 'ssl_ps_server.key'
-                )
         else:
-            controller.MESSAGES.append(
+            ssl_cert_file = config["CONFIG_HORIZON_SSL_CERT"] = (
+                '/etc/pki/tls/certs/ssl_dashboard.crt'
+            )
+            ssl_key_file = config["CONFIG_HORIZON_SSL_KEY"] = (
+                '/etc/pki/tls/private/ssl_dashboard.key'
+            )
+            cacert = config['CONFIG_SSL_CACERT']
+            config["CONFIG_HORIZON_SSL_CACERT"] = cacert
+            ssl_host = config['CONFIG_CONTROLLER_HOST']
+            service = 'dashboard'
+            generate_ssl_cert(config, ssl_host, service, ssl_key_file,
+                              ssl_cert_file)
+            messages.append(
                 "%sNOTE%s : A certificate was generated to be used for ssl, "
                 "You should change the ssl certificate configured in "
                 "/etc/httpd/conf.d/ssl.conf on %s to use a CA signed cert."
                 % (utils.COLORS['red'], utils.COLORS['nocolor'], horizon_host))
 
-    manifestdata = getManifestTemplate("horizon.pp")
-    manifestdata += sslmanifestdata
-    appendManifestFile(manifestfile, manifestdata)
+    config["CONFIG_HORIZON_NEUTRON_VPN"] = False
+
+    if config['CONFIG_NEUTRON_INSTALL'] == 'y':
+        if config["CONFIG_NEUTRON_VPNAAS"] == 'y':
+            config["CONFIG_HORIZON_NEUTRON_VPN"] = True
 
-    msg = "To access the OpenStack Dashboard browse to %s://%s/dashboard .\n" \
-          "Please, find your login credentials stored in the keystonerc_admin" \
-          " in your home directory." % \
-          (proto,  controller.CONF['CONFIG_HORIZON_HOST'])
-    controller.MESSAGES.append(msg)
+    msg = ("To access the OpenStack Dashboard browse to %s://%s/dashboard .\n"
+           "Please, find your login credentials stored in the keystonerc_admin"
+           " in your home directory."
+           % (proto, config['CONFIG_CONTROLLER_HOST']))
+    messages.append(msg)
diff --git a/packstack/plugins/glance_200.py b/packstack/plugins/glance_200.py
index 63dab3abe..c79eecc78 100644
--- a/packstack/plugins/glance_200.py
+++ b/packstack/plugins/glance_200.py
@@ -1,78 +1,83 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 """
 Installs and configures Glance
 """
 
-import uuid
-import logging
-
-from packstack.installer import validators
 from packstack.installer import basedefs
+from packstack.installer import validators
+from packstack.installer import processors
 from packstack.installer import utils
-from packstack.installer.utils import split_hosts
 
-from packstack.modules.shortcuts import get_mq
-from packstack.modules.ospluginutils import getManifestTemplate, appendManifestFile
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import generate_ssl_cert
 
-# Controller object will be initialized from main flow
-controller = None
+# ------------- Glance Packstack Plugin Initialization --------------
 
-# Plugin name
 PLUGIN_NAME = "OS-Glance"
 PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
 
-logging.debug("plugin %s loaded", __name__)
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding OpenStack Glance configuration")
-    paramsList = [
-                  {"CMD_OPTION"      : "glance-host",
-                   "USAGE"           : "The IP address of the server on which to install Glance",
-                   "PROMPT"          : "Enter the IP address of the Glance server",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_GLANCE_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "glance-db-passwd",
-                   "USAGE"           : "The password to use for the Glance to access DB",
-                   "PROMPT"          : "Enter the password for the Glance DB access",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_GLANCE_DB_PW",
-                   "USE_DEFAULT"     : True,
-                   "NEED_CONFIRM"    : True,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "glance-ks-passwd",
-                   "USAGE"           : "The password to use for the Glance to authenticate with Keystone",
-                   "PROMPT"          : "Enter the password for the Glance Keystone access",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_GLANCE_KS_PW",
-                   "USE_DEFAULT"     : True,
-                   "NEED_CONFIRM"    : True,
-                   "CONDITION"       : False },
-                 ]
-
-    groupDict = { "GROUP_NAME"            : "GLANCE",
-                  "DESCRIPTION"           : "Glance Config parameters",
-                  "PRE_CONDITION"         : "CONFIG_GLANCE_INSTALL",
-                  "PRE_CONDITION_MATCH"   : "y",
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
+
+def initConfig(controller):
+    params = [
+        {"CMD_OPTION": "glance-db-passwd",
+         "PROMPT": "Enter the password for the Glance DB access",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "PROCESSORS": [processors.process_password],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_GLANCE_DB_PW",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "glance-ks-passwd",
+         "PROMPT": "Enter the password for the Glance Keystone access",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "PROCESSORS": [processors.process_password],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_GLANCE_KS_PW",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "glance-backend",
+         "PROMPT": "Glance storage backend",
+         "OPTION_LIST": ["file", "swift"],
+         "VALIDATORS": [validators.validate_options],
+         "PROCESSORS": [process_backend],
+         "DEFAULT_VALUE": "file",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_GLANCE_BACKEND",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+    ]
+    update_params_usage(basedefs.PACKSTACK_DOC, params, sectioned=False)
+    group = {"GROUP_NAME": "GLANCE",
+             "DESCRIPTION": "Glance Config parameters",
+             "PRE_CONDITION": "CONFIG_GLANCE_INSTALL",
+             "PRE_CONDITION_MATCH": "y",
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+    controller.addGroup(group, params)
 
 
 def initSequences(controller):
@@ -84,33 +89,41 @@ def initSequences(controller):
         return
 
     glancesteps = [
-             {'title': 'Adding Glance Keystone manifest entries', 'functions':[createkeystonemanifest]},
-             {'title': 'Adding Glance manifest entries', 'functions':[createmanifest]}
+        {'title': 'Preparing Glance entries',
+         'functions': [create_manifest]}
     ]
     controller.addSequence("Installing OpenStack Glance", [], [], glancesteps)
 
-def createkeystonemanifest(config):
-    manifestfile = "%s_keystone.pp" % controller.CONF['CONFIG_KEYSTONE_HOST']
-    manifestdata = getManifestTemplate("keystone_glance.pp")
-    appendManifestFile(manifestfile, manifestdata)
-
-def createmanifest(config):
-    manifestfile = "%s_glance.pp" % controller.CONF['CONFIG_GLANCE_HOST']
-    manifestdata = getManifestTemplate("glance.pp")
-    if config['CONFIG_CEILOMETER_INSTALL'] == 'y':
-        manifestdata += getManifestTemplate(get_mq(config, "glance_ceilometer"))
-
-    config['FIREWALL_SERVICE_NAME'] = "glance"
-    config['FIREWALL_PORTS'] = "'9292'"
-    config['FIREWALL_CHAIN'] = "INPUT"
-    if config['CONFIG_NOVA_INSTALL'] == 'y':
-        for host in split_hosts(config['CONFIG_NOVA_COMPUTE_HOSTS']):
-            config['FIREWALL_ALLOWED'] = "'%s'" % host
-            config['FIREWALL_SERVICE_ID'] = "glance_%s" % host
-            manifestdata += getManifestTemplate("firewall.pp")
-    else:
-        config['FIREWALL_ALLOWED'] = "'ALL'"
-        config['FIREWALL_SERVICE_ID'] = "glance_ALL"
-        manifestdata += getManifestTemplate("firewall.pp")
-
-    appendManifestFile(manifestfile, manifestdata)
+
+# ------------------------- helper functions -------------------------
+
+def process_backend(value, param_name, config):
+    if value == 'swift' and config['CONFIG_SWIFT_INSTALL'] != 'y':
+        return 'file'
+    return value
+
+
+# -------------------------- step functions --------------------------
+
+def create_manifest(config, messages):
+    if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+        ssl_host = config['CONFIG_STORAGE_HOST']
+        ssl_cert_file = config['CONFIG_GLANCE_SSL_CERT'] = (
+            '/etc/pki/tls/certs/ssl_amqp_glance.crt'
+        )
+        ssl_key_file = config['CONFIG_GLANCE_SSL_KEY'] = (
+            '/etc/pki/tls/private/ssl_amqp_glance.key'
+        )
+        service = 'glance'
+        generate_ssl_cert(config, ssl_host, service, ssl_key_file,
+                          ssl_cert_file)
+
+    fw_details = dict()
+    key = "glance_api"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "glance"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['9292']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_GLANCE_RULES'] = fw_details
diff --git a/packstack/plugins/gnocchi_790.py b/packstack/plugins/gnocchi_790.py
new file mode 100644
index 000000000..8defe884f
--- /dev/null
+++ b/packstack/plugins/gnocchi_790.py
@@ -0,0 +1,100 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Installs and configures Gnocchi
+"""
+
+from packstack.installer import basedefs
+from packstack.installer import utils
+from packstack.installer import validators
+from packstack.installer import processors
+
+from packstack.modules.documentation import update_params_usage
+
+# ------------- Gnocchi Packstack Plugin Initialization --------------
+
+PLUGIN_NAME = "OS-Gnocchi"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
+
+
+def initConfig(controller):
+    gnocchi_params = {
+        "GNOCCHI": [
+            {"CONF_NAME": "CONFIG_GNOCCHI_DB_PW",
+             "CMD_OPTION": "gnocchi-db-passwd",
+             "PROMPT": "Enter the password for Gnocchi DB access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+            {"CONF_NAME": "CONFIG_GNOCCHI_KS_PW",
+             "CMD_OPTION": "gnocchi-ks-passwd",
+             "PROMPT": "Enter the password for the Gnocchi Keystone access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False}
+        ]
+    }
+
+    update_params_usage(basedefs.PACKSTACK_DOC, gnocchi_params)
+
+    def use_gnocchi(config):
+        return config['CONFIG_CEILOMETER_INSTALL'] == 'y'
+
+    gnocchi_groups = [
+        {"GROUP_NAME": "GNOCCHI",
+         "DESCRIPTION": "Gnocchi Config parameters",
+         "PRE_CONDITION": use_gnocchi,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+    ]
+    for group in gnocchi_groups:
+        paramList = gnocchi_params[group["GROUP_NAME"]]
+        controller.addGroup(group, paramList)
+
+
+def initSequences(controller):
+    if controller.CONF['CONFIG_CEILOMETER_INSTALL'] != 'y':
+        return
+
+    steps = [{'title': 'Preparing Gnocchi entries',
+              'functions': [create_manifest]}]
+    controller.addSequence("Installing OpenStack Gnocchi", [], [],
+                           steps)
+
+
+# -------------------------- step functions --------------------------
+
+def create_manifest(config, messages):
+    fw_details = dict()
+    key = "gnocchi_api"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "gnocchi-api"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['8041']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_GNOCCHI_RULES'] = fw_details
diff --git a/packstack/plugins/heat_650.py b/packstack/plugins/heat_650.py
new file mode 100644
index 000000000..f500d58c0
--- /dev/null
+++ b/packstack/plugins/heat_650.py
@@ -0,0 +1,187 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Installs and configures Heat
+"""
+
+import uuid
+
+from packstack.installer import basedefs
+from packstack.installer import utils
+from packstack.installer import validators
+from packstack.installer import processors
+
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import generate_ssl_cert
+
+# ------------- Heat Packstack Plugin Initialization --------------
+
+PLUGIN_NAME = "OS-Heat"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
+
+
+def initConfig(controller):
+    parameters = [
+        {"CMD_OPTION": "os-heat-mysql-password",
+         "PROMPT": "Enter the password for the Heat DB user",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",
+         "PROCESSORS": [processors.process_password],
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_HEAT_DB_PW",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "heat-auth-encryption-key",
+         "PROMPT": ("Enter the authentication key for Heat to use for "
+                    "authenticate info in database (16, 24, or 32 chars)"),
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": uuid.uuid4().hex[:16],
+         "PROCESSORS": [processors.process_string_nofloat],
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_HEAT_AUTH_ENC_KEY",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "os-heat-ks-passwd",
+         "PROMPT": "Enter the password for the Heat Keystone access",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",
+         "PROCESSORS": [processors.process_password],
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_HEAT_KS_PW",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "os-heat-cfn-install",
+         "PROMPT": "Should Packstack install Heat CloudFormation API",
+         "OPTION_LIST": ["y", "n"],
+         "VALIDATORS": [validators.validate_options],
+         "DEFAULT_VALUE": "y",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_HEAT_CFN_INSTALL",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "os-heat-domain",
+         "PROMPT": "Enter name of Keystone domain for Heat",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "heat",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_HEAT_DOMAIN",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "os-heat-domain-admin",
+         "PROMPT": "Enter name of Keystone domain admin user for Heat",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "heat_admin",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_HEAT_DOMAIN_ADMIN",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "os-heat-domain-password",
+         "PROMPT": "Enter password for Keystone domain admin user for Heat",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",
+         "PROCESSORS": [processors.process_password],
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_HEAT_DOMAIN_PASSWORD",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+    ]
+    update_params_usage(basedefs.PACKSTACK_DOC, parameters, sectioned=False)
+
+    group = {"GROUP_NAME": "Heat",
+             "DESCRIPTION": "Heat Config parameters",
+             "PRE_CONDITION": "CONFIG_HEAT_INSTALL",
+             "PRE_CONDITION_MATCH": "y",
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+    controller.addGroup(group, parameters)
+
+
+def initSequences(controller):
+    config = controller.CONF
+    if config['CONFIG_HEAT_INSTALL'] != 'y':
+        return
+    steps = [
+        {'title': 'Preparing Heat entries',
+         'functions': [create_manifest]},
+    ]
+
+    if config.get('CONFIG_HEAT_CFN_INSTALL', 'n') == 'y':
+        steps.append(
+            {'title': 'Preparing Heat CloudFormation API entries',
+             'functions': [create_cfn_manifest]})
+    controller.addSequence("Installing Heat", [], [], steps)
+
+
+# ------------------------ step functions -------------------------
+
+def create_manifest(config, messages):
+    if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+        ssl_host = config['CONFIG_CONTROLLER_HOST']
+        ssl_cert_file = config['CONFIG_HEAT_SSL_CERT'] = (
+            '/etc/pki/tls/certs/ssl_amqp_heat.crt'
+        )
+        ssl_key_file = config['CONFIG_HEAT_SSL_KEY'] = (
+            '/etc/pki/tls/private/ssl_amqp_heat.key'
+        )
+        service = 'heat'
+        generate_ssl_cert(config, ssl_host, service, ssl_key_file,
+                          ssl_cert_file)
+
+    fw_details = dict()
+    key = "heat"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "heat"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['8004']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_HEAT_RULES'] = fw_details
+
+
+def create_cfn_manifest(config, messages):
+    fw_details = dict()
+    key = "heat_cfn"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "heat cfn"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['8000']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_HEAT_CFN_RULES'] = fw_details
diff --git a/packstack/plugins/heat_750.py b/packstack/plugins/heat_750.py
deleted file mode 100644
index acaaf9ed8..000000000
--- a/packstack/plugins/heat_750.py
+++ /dev/null
@@ -1,229 +0,0 @@
-"""
-Installs and configures heat
-"""
-
-import uuid
-import logging
-import os
-
-from packstack.installer import utils
-from packstack.installer import validators
-
-from packstack.modules.shortcuts import get_mq
-from packstack.modules.ospluginutils import (getManifestTemplate,
-                                             manifestfiles,
-                                             appendManifestFile)
-
-controller = None
-
-# Plugin name
-PLUGIN_NAME = "OS-HEAT"
-PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
-
-logging.debug("plugin %s loaded", __name__)
-
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding OpenStack Heat configuration")
-    parameters = [
-        {"CMD_OPTION"      : "heat-host",
-         "USAGE"           : ('The IP address of the server on which '
-                              'to install Heat service'),
-         "PROMPT"          : 'Enter the IP address of the Heat service',
-         "OPTION_LIST"     : [],
-         "VALIDATORS"      : [validators.validate_ssh],
-         "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-         "MASK_INPUT"      : False,
-         "LOOSE_VALIDATION": True,
-         "CONF_NAME"       : "CONFIG_HEAT_HOST",
-         "USE_DEFAULT"     : False,
-         "NEED_CONFIRM"    : False,
-         "CONDITION"       : False },
-
-        {"CMD_OPTION"      : "heat-mysql-password",
-         "USAGE"	         : 'The password used by Heat user to authenticate against MySQL',
-         "PROMPT"          : "Enter the password for the Heat MySQL user",
-         "OPTION_LIST"     : [],
-         "VALIDATORS"      : [validators.validate_not_empty],
-         "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-         "MASK_INPUT"      : True,
-         "LOOSE_VALIDATION": False,
-         "CONF_NAME"       : "CONFIG_HEAT_DB_PW",
-         "USE_DEFAULT"     : True,
-         "NEED_CONFIRM"    : True,
-         "CONDITION"       : False },
-
-        {"CMD_OPTION"      : "heat-auth-encryption-key",
-         "USAGE"           : "The encryption key to use for authentication info in database",
-         "PROMPT"          : "Enter the authentication key for Heat to use for authenticate info in database",
-         "OPTION_LIST"     : [],
-         "VALIDATORS"      : [validators.validate_not_empty],
-         "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-         "MASK_INPUT"      : True,
-         "LOOSE_VALIDATION": False,
-         "CONF_NAME"       : "CONFIG_HEAT_AUTH_ENC_KEY",
-         "USE_DEFAULT"     : True,
-         "NEED_CONFIRM"    : True,
-         "CONDITION"       : False },
-
-        {"CMD_OPTION"      : "heat-ks-passwd",
-         "USAGE"           : "The password to use for the Heat to authenticate with Keystone",
-         "PROMPT"          : "Enter the password for the Heat Keystone access",
-         "OPTION_LIST"     : [],
-         "VALIDATORS"      : [validators.validate_not_empty],
-         "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-         "MASK_INPUT"      : True,
-         "LOOSE_VALIDATION": False,
-         "CONF_NAME"       : "CONFIG_HEAT_KS_PW",
-         "USE_DEFAULT"     : True,
-         "NEED_CONFIRM"    : True,
-         "CONDITION"       : False },
-
-        {"CMD_OPTION"      : "os-heat-cloudwatch-install",
-         "USAGE"           : ("Set to 'y' if you would like Packstack to "
-                              "install Heat CloudWatch API"),
-         "PROMPT"          : "Should Packstack install Heat CloudWatch API",
-         "OPTION_LIST"     : ["y", "n"],
-         "VALIDATORS"      : [validators.validate_options],
-         "DEFAULT_VALUE"   : "n",
-         "MASK_INPUT"      : False,
-         "LOOSE_VALIDATION": False,
-         "CONF_NAME"       : "CONFIG_HEAT_CLOUDWATCH_INSTALL",
-         "USE_DEFAULT"     : False,
-         "NEED_CONFIRM"    : False,
-         "CONDITION"       : False },
-
-        {"CMD_OPTION"      : "os-heat-cfn-install",
-         "USAGE"           : ("Set to 'y' if you would like Packstack to "
-                              "install Heat CloudFormation API"),
-         "PROMPT"          : "Should Packstack install Heat CloudFormation API",
-         "OPTION_LIST"     : ["y", "n"],
-         "VALIDATORS"      : [validators.validate_options],
-         "DEFAULT_VALUE"   : "n",
-         "MASK_INPUT"      : False,
-         "LOOSE_VALIDATION": False,
-         "CONF_NAME"       : "CONFIG_HEAT_CFN_INSTALL",
-         "USE_DEFAULT"     : False,
-         "NEED_CONFIRM"    : False,
-         "CONDITION"       : False },
-        ]
-    group = {"GROUP_NAME"          : "Heat",
-             "DESCRIPTION"         : "Heat Config parameters",
-             "PRE_CONDITION"       : "CONFIG_HEAT_INSTALL",
-             "PRE_CONDITION_MATCH" : "y",
-             "POST_CONDITION"      : False,
-             "POST_CONDITION_MATCH": True}
-    controller.addGroup(group, parameters)
-
-    parameters = [
-        {"CMD_OPTION"      : "heat-api-cloudwatch-host",
-         "USAGE"           : ('The IP address of the server on which '
-                              'to install Heat CloudWatch API service'),
-         "PROMPT"          : ('Enter the IP address of the Heat CloudWatch API '
-                              'server'),
-         "OPTION_LIST"     : [],
-         "VALIDATORS"      : [validators.validate_ssh],
-         "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-         "MASK_INPUT"      : False,
-         "LOOSE_VALIDATION": True,
-         "CONF_NAME"       : "CONFIG_HEAT_CLOUDWATCH_HOST",
-         "USE_DEFAULT"     : False,
-         "NEED_CONFIRM"    : False,
-         "CONDITION"       : False },
-    ]
-
-    def check_cloudwatch(config):
-        return config["CONFIG_HEAT_INSTALL"] == 'y' and \
-            config["CONFIG_HEAT_CLOUDWATCH_INSTALL"] == 'y'
-
-    group = {"GROUP_NAME"          : "Heat CloudWatch API",
-             "DESCRIPTION"         : "Heat CloudWatch API config parameters",
-             "PRE_CONDITION"       : check_cloudwatch,
-             "PRE_CONDITION_MATCH" : True,
-             "POST_CONDITION"      : False,
-             "POST_CONDITION_MATCH": True}
-    controller.addGroup(group, parameters)
-
-    parameters = [
-        {"CMD_OPTION"      : "heat-api-cfn-host",
-         "USAGE"           : ('The IP address of the server on which '
-                              'to install Heat CloudFormation API service'),
-         "PROMPT"          : ('Enter the IP address of the Heat CloudFormation '
-                              'API server'),
-         "OPTION_LIST"     : [],
-         "VALIDATORS"      : [validators.validate_ssh],
-         "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-         "MASK_INPUT"      : False,
-         "LOOSE_VALIDATION": True,
-         "CONF_NAME"       : "CONFIG_HEAT_CFN_HOST",
-         "USE_DEFAULT"     : False,
-         "NEED_CONFIRM"    : False,
-         "CONDITION"       : False },
-    ]
-
-    def check_cloudformation(config):
-        return config["CONFIG_HEAT_INSTALL"] == 'y' and \
-            config["CONFIG_HEAT_CFN_INSTALL"] == 'y'
-
-    group = {"GROUP_NAME"          : "Heat CloudFormation API",
-             "DESCRIPTION"         : "Heat CloudFormation API config parameters",
-             "PRE_CONDITION"       : check_cloudformation,
-             "PRE_CONDITION_MATCH" : True,
-             "POST_CONDITION"      : False,
-             "POST_CONDITION_MATCH": True}
-    controller.addGroup(group, parameters)
-
-
-def initSequences(controller):
-    if controller.CONF['CONFIG_HEAT_INSTALL'] != 'y':
-        return
-    steps = [{'title': 'Adding Heat manifest entries',
-              'functions': [create_manifest]},
-             {'title': 'Adding Heat Keystone manifest entries',
-              'functions':[create_keystone_manifest]}]
-
-    if controller.CONF.get('CONFIG_HEAT_CLOUDWATCH_INSTALL', 'n') == 'y':
-        steps.append({'title': 'Adding Heat CloudWatch API manifest entries',
-                      'functions': [create_cloudwatch_manifest]})
-    if controller.CONF.get('CONFIG_HEAT_CFN_INSTALL', 'n') == 'y':
-        steps.append({'title': 'Adding Heat CloudFormation API manifest entries',
-                      'functions': [create_cfn_manifest]})
-    controller.addSequence("Installing Heat", [], [], steps)
-
-
-def create_manifest(config):
-    if config['CONFIG_HEAT_CLOUDWATCH_INSTALL'] == 'y':
-        config['CONFIG_HEAT_WATCH_HOST'] = config['CONFIG_HEAT_CLOUDWATCH_HOST']
-    else:
-        config['CONFIG_HEAT_WATCH_HOST'] = config['CONFIG_HEAT_HOST']
-    if config['CONFIG_HEAT_CFN_INSTALL'] == 'y':
-        config['CONFIG_HEAT_METADATA_HOST'] = config['CONFIG_HEAT_CFN_HOST']
-    else:
-        config['CONFIG_HEAT_METADATA_HOST'] = config['CONFIG_HEAT_HOST']
-
-    manifestfile = "%s_heat.pp" % controller.CONF['CONFIG_HEAT_HOST']
-    manifestdata = getManifestTemplate(get_mq(config, "heat"))
-    manifestdata += getManifestTemplate("heat.pp")
-    appendManifestFile(manifestfile, manifestdata)
-
-
-def create_keystone_manifest(config):
-    manifestfile = "%s_keystone.pp" % controller.CONF['CONFIG_KEYSTONE_HOST']
-    manifestdata = getManifestTemplate("keystone_heat.pp")
-    appendManifestFile(manifestfile, manifestdata)
-
-
-def create_cloudwatch_manifest(config):
-    manifestfile = "%s_heatcw.pp" % controller.CONF['CONFIG_HEAT_CLOUDWATCH_HOST']
-    manifestdata = getManifestTemplate(get_mq(config, "heat"))
-    manifestdata += getManifestTemplate("heat_cloudwatch.pp")
-    appendManifestFile(manifestfile, manifestdata, marker='heat')
-
-
-def create_cfn_manifest(config):
-    manifestfile = "%s_heatcnf.pp" % controller.CONF['CONFIG_HEAT_CFN_HOST']
-    manifestdata = getManifestTemplate(get_mq(config, "heat"))
-    manifestdata += getManifestTemplate("heat_cfn.pp")
-    appendManifestFile(manifestfile, manifestdata, marker='heat')
diff --git a/packstack/plugins/ironic_275.py b/packstack/plugins/ironic_275.py
new file mode 100644
index 000000000..911f4a8b7
--- /dev/null
+++ b/packstack/plugins/ironic_275.py
@@ -0,0 +1,107 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Installs and configures Ironic
+"""
+
+from packstack.installer import basedefs
+from packstack.installer import utils
+from packstack.installer import validators
+from packstack.installer import processors
+
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import generate_ssl_cert
+
+# ------------------ Ironic Packstack Plugin initialization ------------------
+
+PLUGIN_NAME = "OS-Ironic"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
+
+
+def initConfig(controller):
+    ironic_params = [
+        {"CONF_NAME": "CONFIG_IRONIC_DB_PW",
+         "CMD_OPTION": "os-ironic-db-passwd",
+         "PROMPT": "Enter the password for the Ironic DB user",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",
+         "PROCESSORS": [processors.process_password],
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+
+        {"CONF_NAME": "CONFIG_IRONIC_KS_PW",
+         "CMD_OPTION": "os-ironic-ks-passwd",
+         "PROMPT": "Enter the password for Ironic Keystone access",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",
+         "PROCESSORS": [processors.process_password],
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+    ]
+    update_params_usage(basedefs.PACKSTACK_DOC, ironic_params, sectioned=False)
+    ironic_group = {"GROUP_NAME": "IRONIC",
+                    "DESCRIPTION": "Ironic Options",
+                    "PRE_CONDITION": "CONFIG_IRONIC_INSTALL",
+                    "PRE_CONDITION_MATCH": "y",
+                    "POST_CONDITION": False,
+                    "POST_CONDITION_MATCH": True}
+
+    controller.addGroup(ironic_group, ironic_params)
+
+
+def initSequences(controller):
+    if controller.CONF['CONFIG_IRONIC_INSTALL'] != 'y':
+        return
+
+    steps = [
+        {'title': 'Preparing Ironic entries',
+         'functions': [create_manifest]},
+    ]
+
+    controller.addSequence("Installing OpenStack Ironic", [], [],
+                           steps)
+
+
+# -------------------------- step functions --------------------------
+
+def create_manifest(config, messages):
+    if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+        ssl_host = config['CONFIG_CONTROLLER_HOST']
+        ssl_cert_file = config['CONFIG_IRONIC_SSL_CERT'] = (
+            '/etc/pki/tls/certs/ssl_amqp_ironic.crt'
+        )
+        ssl_key_file = config['CONFIG_IRONIC_SSL_KEY'] = (
+            '/etc/pki/tls/private/ssl_amqp_ironic.key'
+        )
+        service = 'ironic'
+        generate_ssl_cert(config, ssl_host, service, ssl_key_file,
+                          ssl_cert_file)
+
+    fw_details = dict()
+    key = "ironic-api"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "ironic-api"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['6385']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_IRONIC_API_RULES'] = fw_details
diff --git a/packstack/plugins/keystone_100.py b/packstack/plugins/keystone_100.py
index a13d09d63..1b5cd2e27 100644
--- a/packstack/plugins/keystone_100.py
+++ b/packstack/plugins/keystone_100.py
@@ -1,130 +1,686 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 """
 Installs and configures Keystone
 """
 
-import logging
-import uuid
-
-from packstack.installer import validators
 from packstack.installer import basedefs
+from packstack.installer import validators
+from packstack.installer import processors
 from packstack.installer import utils
 
-from packstack.modules.ospluginutils import getManifestTemplate, appendManifestFile
-from packstack.installer.utils import host_iter
+from packstack.modules.documentation import update_params_usage
 
-# Controller object will be initialized from main flow
-controller = None
+# ------------- Keystone Packstack Plugin Initialization --------------
 
-# Plugin name
 PLUGIN_NAME = "OS-Keystone"
 PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
 
-logging.debug("plugin %s loaded", __name__)
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding OpenStack Keystone configuration")
-    paramsList = [
-                  {"CMD_OPTION"      : "keystone-host",
-                   "USAGE"           : "The IP address of the server on which to install Keystone",
-                   "PROMPT"          : "Enter the IP address of the Keystone server",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_KEYSTONE_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "keystone-db-passwd",
-                   "USAGE"           : "The password to use for the Keystone to access DB",
-                   "PROMPT"          : "Enter the password for the Keystone DB access",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_KEYSTONE_DB_PW",
-                   "USE_DEFAULT"     : True,
-                   "NEED_CONFIRM"    : True,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "keystone-admin-token",
-                   "USAGE"           : "The token to use for the Keystone service api",
-                   "PROMPT"          : "The token to use for the Keystone service api",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex,
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_KEYSTONE_ADMIN_TOKEN",
-                   "USE_DEFAULT"     : True,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "keystone-admin-passwd",
-                   "USAGE"           : "The password to use for the Keystone admin user",
-                   "PROMPT"          : "Enter the password for the Keystone admin user",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_KEYSTONE_ADMIN_PW",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : True,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "keystone-demo-passwd",
-                   "USAGE"           : "The password to use for the Keystone demo user",
-                   "PROMPT"          : "Enter the password for the Keystone demo user",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_KEYSTONE_DEMO_PW",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : True,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "keystone-token-format",
-                   "USAGE"           : "Kestone token format. Use either UUID or PKI",
-                   "PROMPT"          : "Enter the Keystone token format.",
-                   "OPTION_LIST"     : ['UUID', 'PKI'],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : 'PKI',
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : 'CONFIG_KEYSTONE_TOKEN_FORMAT',
-                   "USE_DEFAULT"     : True,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                 ]
-
-    groupDict = { "GROUP_NAME"            : "KEYSTONE",
-                  "DESCRIPTION"           : "Keystone Config parameters",
-                  "PRE_CONDITION"         : lambda x: 'yes',
-                  "PRE_CONDITION_MATCH"   : "yes",
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
+
+def initConfig(controller):
+    keystone_params = {
+        "KEYSTONE": [  # base keystone options
+            {"CMD_OPTION": "keystone-db-passwd",
+             "PROMPT": "Enter the password for the Keystone DB access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [processors.process_password],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_KEYSTONE_DB_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": 'keystone-fernet-token-rotate-enable',
+             "PROMPT": (
+                 "Enter y if cron job to rotate Fernet tokens should be "
+                 "created"
+             ),
+             "OPTION_LIST": ['y', 'n'],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [processors.process_bool],
+             "DEFAULT_VALUE": 'y',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_FERNET_TOKEN_ROTATE_ENABLE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-region",
+             "PROMPT": "Region name",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "RegionOne",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_KEYSTONE_REGION",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-admin-email",
+             "PROMPT": "Enter the email address for the Keystone admin user",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "root@localhost",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_KEYSTONE_ADMIN_EMAIL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-admin-username",
+             "PROMPT": "Enter the username for the Keystone admin user",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "admin",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_KEYSTONE_ADMIN_USERNAME",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-admin-passwd",
+             "PROMPT": "Enter the password for the Keystone admin user",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_KEYSTONE_ADMIN_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-demo-passwd",
+             "PROMPT": "Enter the password for the Keystone demo user",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_KEYSTONE_DEMO_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-api-version",
+             "PROMPT": "Enter the Keystone API version string.",
+             "OPTION_LIST": ['v3'],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": 'v3',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_API_VERSION',
+             "USE_DEFAULT": True,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-token-format",
+             "PROMPT": "Enter the Keystone token format.",
+             "OPTION_LIST": ['FERNET'],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": 'FERNET',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_TOKEN_FORMAT',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-identity-backend",
+             "PROMPT": "Enter the Keystone identity backend type.",
+             "OPTION_LIST": ['sql', 'ldap'],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "sql",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_IDENTITY_BACKEND',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False}
+        ],
+
+        "KEYSTONE_LDAP": [  # keystone ldap identity backend options
+            {"CMD_OPTION": "keystone-ldap-url",
+             "PROMPT": "Enter the Keystone LDAP backend URL.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_ldap_url],
+             "DEFAULT_VALUE": host_to_ldap_url(utils.get_localhost_ip()),
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_URL',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-dn",
+             "PROMPT": "Enter the Keystone LDAP user DN.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_ldap_dn],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_DN',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-password",
+             "PROMPT": "Enter the Keystone LDAP user password.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_PASSWORD',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-suffix",
+             "PROMPT": "Enter the Keystone LDAP suffix.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty,
+                            validators.validate_ldap_dn],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_SUFFIX',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-query-scope",
+             "PROMPT": "Enter the Keystone LDAP query scope.",
+             "OPTION_LIST": ['base', 'one', 'sub'],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "one",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_QUERY_SCOPE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-page-size",
+             "PROMPT": "Enter the Keystone LDAP query page size.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_integer],
+             "DEFAULT_VALUE": "-1",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_PAGE_SIZE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-subtree",
+             "PROMPT": "Enter the Keystone LDAP user subtree.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty,
+                            validators.validate_ldap_dn],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_SUBTREE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-filter",
+             "PROMPT": "Enter the Keystone LDAP user query filter.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_FILTER',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-objectclass",
+             "PROMPT": "Enter the Keystone LDAP user objectclass.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_OBJECTCLASS',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-id-attribute",
+             "PROMPT": "Enter the Keystone LDAP user ID attribute.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_ID_ATTRIBUTE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-name-attribute",
+             "PROMPT": "Enter the Keystone LDAP user name attribute.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_NAME_ATTRIBUTE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-mail-attribute",
+             "PROMPT": "Enter the Keystone LDAP user email address attribute.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_MAIL_ATTRIBUTE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-enabled-attribute",
+             "PROMPT": "Enter the Keystone LDAP user enabled attribute.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_ENABLED_ATTRIBUTE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-enabled-mask",
+             "PROMPT": "Enter the Keystone LDAP user enabled mask.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_integer],
+             "DEFAULT_VALUE": "-1",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_ENABLED_MASK',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-enabled-default",
+             "PROMPT": "Enter the Keystone LDAP user enabled default.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "TRUE",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_ENABLED_DEFAULT',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-enabled-invert",
+             "PROMPT": "Enter the Keystone LDAP user enabled invert (n or y).",
+             "OPTION_LIST": ['n', 'y'],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": 'n',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_ENABLED_INVERT',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-attribute-ignore",
+             "PROMPT": (
+                 "Enter the comma separated Keystone LDAP user "
+                 "attributes to ignore."
+             ),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_ATTRIBUTE_IGNORE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-default-project-id-attribute",
+             "PROMPT": (
+                 "Enter the Keystone LDAP user default_project_id attribute."
+             ),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME":
+             'CONFIG_KEYSTONE_LDAP_USER_DEFAULT_PROJECT_ID_ATTRIBUTE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-pass-attribute",
+             "PROMPT": "Enter the Keystone LDAP user password attribute.",
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_PASS_ATTRIBUTE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-enabled-emulation-dn",
+             "PROMPT": "Enter the Keystone LDAP enabled emulation DN.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_ldap_dn],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USER_ENABLED_EMULATION_DN',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-user-additional-attribute-mapping",
+             "PROMPT": (
+                 "Enter the comma separated Keystone LDAP user additional "
+                 "attribute mappings in the form "
+                 "ldap_attr:user_attr[,ldap_attr:user_attr]...."
+             ),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME":
+             'CONFIG_KEYSTONE_LDAP_USER_ADDITIONAL_ATTRIBUTE_MAPPING',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-group-subtree",
+             "PROMPT": "Enter the Keystone LDAP group subtree.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty,
+                            validators.validate_ldap_dn],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_GROUP_SUBTREE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-group-filter",
+             "PROMPT": "Enter the Keystone LDAP group query filter.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_GROUP_FILTER',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-group-objectclass",
+             "PROMPT": "Enter the Keystone LDAP group objectclass.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_GROUP_OBJECTCLASS',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-group-id-attribute",
+             "PROMPT": "Enter the Keystone LDAP group ID attribute.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_GROUP_ID_ATTRIBUTE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-group-name-attribute",
+             "PROMPT": "Enter the Keystone LDAP group name attribute.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_GROUP_NAME_ATTRIBUTE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-group-member-attribute",
+             "PROMPT": "Enter the Keystone LDAP group member attribute.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_GROUP_MEMBER_ATTRIBUTE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-group-desc-attribute",
+             "PROMPT": "Enter the Keystone LDAP group description attribute.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_GROUP_DESC_ATTRIBUTE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-group-attribute-ignore",
+             "PROMPT": (
+                 "Enter the comma separated Keystone LDAP group "
+                 "attributes to ignore."
+             ),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_GROUP_ATTRIBUTE_IGNORE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-group-additional-attribute-mapping",
+             "PROMPT": (
+                 "Enter the comma separated Keystone LDAP group additional "
+                 "attribute mappings in the form "
+                 "ldap_attr:group_attr[,ldap_attr:group_attr]...."
+             ),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME":
+             'CONFIG_KEYSTONE_LDAP_GROUP_ADDITIONAL_ATTRIBUTE_MAPPING',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-use-tls",
+             "PROMPT": (
+                 "Enable TLS for Keystone communicating with "
+                 "LDAP servers (n or y)."
+             ),
+             "OPTION_LIST": ['n', 'y'],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": 'n',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_USE_TLS',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-tls-cacertdir",
+             "PROMPT": "CA Certificate directory for Keystone LDAP.",
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_TLS_CACERTDIR',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-tls-cacertfile",
+             "PROMPT": "CA Certificate file for Keystone LDAP.",
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_TLS_CACERTFILE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "keystone-ldap-tls-req-cert",
+             "PROMPT": (
+                 "Keystone LDAP certificate checking strictness "
+                 "(never, allow, demand)"
+             ),
+             "OPTION_LIST": ["never", "allow", "demand"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "demand",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_KEYSTONE_LDAP_TLS_REQ_CERT',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False}
+        ]
+    }
+    update_params_usage(basedefs.PACKSTACK_DOC, keystone_params)
+    keystone_groups = [
+        {"GROUP_NAME": "KEYSTONE",
+         "DESCRIPTION": "Keystone Config parameters",
+         "PRE_CONDITION": lambda x: 'yes',
+         "PRE_CONDITION_MATCH": "yes",
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "KEYSTONE_LDAP",
+         "DESCRIPTION": "Keystone LDAP Identity Backend Config parameters",
+         "PRE_CONDITION": 'CONFIG_KEYSTONE_IDENTITY_BACKEND',
+         "PRE_CONDITION_MATCH": "ldap",
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True}
+    ]
+    for group in keystone_groups:
+        params = keystone_params[group["GROUP_NAME"]]
+        controller.addGroup(group, params)
 
 
 def initSequences(controller):
     keystonesteps = [
-        {'title': 'Adding Keystone manifest entries',
-            'functions': [create_manifest]},
+        {'title':
+         'Fixing Keystone LDAP config parameters to be undef if empty',
+         'functions': [munge_ldap_config_params]},
+        {'title': 'Preparing Keystone entries',
+         'functions': [create_manifest]},
     ]
     controller.addSequence("Installing OpenStack Keystone", [], [],
                            keystonesteps)
 
-def create_manifest(config):
-    manifestfile = "%s_keystone.pp" % config['CONFIG_KEYSTONE_HOST']
-    manifestdata = getManifestTemplate("keystone.pp")
-    config['FIREWALL_ALLOWED'] = "'ALL'"
-    config['FIREWALL_SERVICE_NAME'] = "keystone"
-    config['FIREWALL_SERVICE_ID'] = "keystone"
-    config['FIREWALL_PORTS'] = "'5000', '35357'"
-    config['FIREWALL_CHAIN'] = "INPUT"
-    manifestdata += getManifestTemplate("firewall.pp")
-    appendManifestFile(manifestfile, manifestdata)
+
+# ------------------------- helper functions -------------------------
+
+def host_to_ldap_url(hostfqdn):
+    """Converts a host fqdn into an appropriate default
+    LDAP URL.
+    """
+    return "ldap://%s" % hostfqdn
+
+
+# -------------------------- step functions --------------------------
+
+def munge_ldap_config_params(config, messages):
+    def is_bool(keyname):
+        return keyname in (
+            'CONFIG_KEYSTONE_LDAP_USER_ENABLED_INVERT',
+            'CONFIG_KEYSTONE_LDAP_USE_TLS'
+        )
+
+    def yn_to_bool(val):
+        return {'n': False, 'y': True}.get(val, False)
+
+    for key in config:
+        if not key.startswith('CONFIG_KEYSTONE_LDAP_'):
+            continue
+        if key in ('CONFIG_KEYSTONE_LDAP_PAGE_SIZE',
+                   'CONFIG_KEYSTONE_LDAP_USER_ENABLED_MASK'):
+            if config[key] == '-1':
+                config[key] = None
+        elif is_bool(key):
+            config[key] = yn_to_bool(config[key])
+        elif config[key] == '':
+            config[key] = None
+
+
+def create_manifest(config, messages):
+    if config['CONFIG_IP_VERSION'] == 'ipv6':
+        host = config['CONFIG_CONTROLLER_HOST']
+        config['CONFIG_KEYSTONE_HOST_URL'] = "[%s]" % host
+    else:
+        config['CONFIG_KEYSTONE_HOST_URL'] = config['CONFIG_CONTROLLER_HOST']
+
+    config['CONFIG_KEYSTONE_PUBLIC_URL'] = "http://%s:5000/%s" % (
+        config['CONFIG_KEYSTONE_HOST_URL'],
+        config['CONFIG_KEYSTONE_API_VERSION']
+    )
+    config['CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'] = "http://%s:5000/" % (
+        config['CONFIG_KEYSTONE_HOST_URL']
+    )
+    config['CONFIG_KEYSTONE_ADMIN_URL'] = "http://%s:5000" % (
+        config['CONFIG_KEYSTONE_HOST_URL']
+    )
+
+    fw_details = dict()
+    key = "keystone"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "keystone"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['5000']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_KEYSTONE_RULES'] = fw_details
diff --git a/packstack/plugins/magnum_920.py b/packstack/plugins/magnum_920.py
new file mode 100644
index 000000000..bcd21a9c7
--- /dev/null
+++ b/packstack/plugins/magnum_920.py
@@ -0,0 +1,114 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Installs and configures Magnum
+"""
+
+from packstack.installer import basedefs
+from packstack.installer import processors
+from packstack.installer import utils
+from packstack.installer import validators
+
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import generate_ssl_cert
+
+# ------------- Magnum Packstack Plugin Initialization --------------
+PLUGIN_NAME = "OS-Magnum"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
+
+
+def initConfig(controller):
+    magnum_params = {
+        "MAGNUM": [
+            {"CMD_OPTION": "magnum-db-passwd",
+             "PROMPT": "Enter the password for the Magnum DB access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MAGNUM_DB_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "magnum-ks-passwd",
+             "PROMPT": "Enter the password for the Magnum Keystone access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MAGNUM_KS_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+        ]
+
+    }
+    update_params_usage(basedefs.PACKSTACK_DOC, magnum_params)
+
+    magnum_groups = [
+        {"GROUP_NAME": "MAGNUM",
+         "DESCRIPTION": "Magnum Options",
+         "PRE_CONDITION": "CONFIG_MAGNUM_INSTALL",
+         "PRE_CONDITION_MATCH": "y",
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+    ]
+    for group in magnum_groups:
+        params = magnum_params[group["GROUP_NAME"]]
+        controller.addGroup(group, params)
+
+
+def initSequences(controller):
+    if controller.CONF['CONFIG_MAGNUM_INSTALL'] != 'y':
+        return
+
+    magnum_steps = [
+        {'title': 'Adding Magnum manifest entries',
+         'functions': [create_all_manifest]},
+    ]
+
+    controller.addSequence("Installing OpenStack Magnum", [], [],
+                           magnum_steps)
+
+
+# ------------------------- helper functions -------------------------
+
+# ------------------------ Step Functions ----------------------------
+def create_all_manifest(config, messages):
+    if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+        ssl_cert_file = config['CONFIG_MAGNUM_SSL_CERT'] = (
+            '/etc/pki/tls/certs/ssl_amqp_magnum.crt'
+        )
+        ssl_key_file = config['CONFIG_MAGNUM_SSL_KEY'] = (
+            '/etc/pki/tls/private/ssl_amqp_magnum.key'
+        )
+        ssl_host = config['CONFIG_CONTROLLER_HOST']
+        service = 'magnum'
+        generate_ssl_cert(config, ssl_host, service, ssl_key_file,
+                          ssl_cert_file)
+
+    fw_details = dict()
+    key = "magnum"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "magnum api"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['9511']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_MAGNUM_API_RULES'] = fw_details
diff --git a/packstack/plugins/manila_355.py b/packstack/plugins/manila_355.py
new file mode 100644
index 000000000..557b79e3a
--- /dev/null
+++ b/packstack/plugins/manila_355.py
@@ -0,0 +1,636 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Installs and configures Manila
+"""
+
+from packstack.installer import basedefs
+from packstack.installer import processors
+from packstack.installer import validators
+from packstack.installer import utils
+
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import generate_ssl_cert
+
+# ------------- Manila Packstack Plugin Initialization --------------
+
+PLUGIN_NAME = "OS-Manila"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
+
+
+def initConfig(controller):
+    conf_params = {
+        "MANILA": [
+            {"CMD_OPTION": "manila-db-passwd",
+             "PROMPT": "Enter the password for the Manila DB access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_DB_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-ks-passwd",
+             "PROMPT": "Enter the password for the Manila Keystone access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_KS_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-backend",
+             "PROMPT": "Enter the Manila backend to be configured",
+             "OPTION_LIST": ["generic", "netapp", "glusternative",
+                             "glusternfs"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "generic",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_BACKEND",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "MANILANETAPP": [
+            {"CMD_OPTION": "manila-netapp-driver-handles-share-servers",
+             "PROMPT": ("Enter whether the driver handles share servers"),
+             "OPTION_LIST": ["true", "false"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "false",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETAPP_DRV_HANDLES_SHARE_SERVERS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-netapp-transport-type",
+             "PROMPT": ("Enter a NetApp transport type"),
+             "OPTION_LIST": ["http", "https"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "https",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETAPP_TRANSPORT_TYPE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-netapp-login",
+             "PROMPT": ("Enter a NetApp login"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "admin",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETAPP_LOGIN",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-netapp-password",
+             "PROMPT": ("Enter a NetApp password"),
+             "OPTION_LIST": [""],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETAPP_PASSWORD",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-netapp-server-hostname",
+             "PROMPT": ("Enter a NetApp hostname"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETAPP_SERVER_HOSTNAME",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-netapp-storage-family",
+             "PROMPT": ("Enter a NetApp storage family"),
+             "OPTION_LIST": ['ontap_cluster'],
+             "VALIDATORS": [validators.validate_options],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "ontap_cluster",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETAPP_STORAGE_FAMILY",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-netapp-server-port",
+             "PROMPT": ("Enter a NetApp server port"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "443",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETAPP_SERVER_PORT",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-netapp-aggregate-name-search-pattern",
+             "PROMPT": ("Enter a NetApp aggregate name search pattern"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "(.*)",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETAPP_AGGREGATE_NAME_SEARCH_PATTERN",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "MANILANETAPPMULTISVM": [
+            {"CMD_OPTION": "manila-netapp-root-volume-aggregate",
+             "PROMPT": ("Enter a NetApp root volume aggregate"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETAPP_ROOT_VOLUME_AGGREGATE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-netapp-root-volume-name",
+             "PROMPT": ("Enter a NetApp root volume name."),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "root",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETAPP_ROOT_VOLUME_NAME",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "MANILANETAPPSINGLESVM": [
+            {"CMD_OPTION": "manila-netapp-vserver",
+             "PROMPT": ("Enter a NetApp Vserver"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETAPP_VSERVER",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "MANILAGENERIC": [
+            {"CMD_OPTION": "manila-generic-driver-handles-share-servers",
+             "USAGE": ("Denotes whether the driver should handle the "
+                       "responsibility of managing share servers. This must be "
+                       "set to false if the driver is to operate without "
+                       "managing share servers."),
+             "PROMPT": ("Enter whether the driver handles share servers"),
+             "OPTION_LIST": ["true", "false"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "true",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_GENERIC_DRV_HANDLES_SHARE_SERVERS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-generic-volume-name-template",
+             "PROMPT": ("Enter a volume name template"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "manila-share-%s",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_GENERIC_VOLUME_NAME_TEMPLATE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-generic-share-mount-path",
+             "PROMPT": ("Enter a share mount path"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "/shares",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_GENERIC_SHARE_MOUNT_PATH",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-service-image-location",
+             "PROMPT": ("Enter a service image location"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": ('https://tarballs.opendev.org/openstack/'
+                               'manila-image-elements/images/'
+                               'manila-service-image-master.qcow2'),
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_SERVICE_IMAGE_LOCATION",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-service-instance-user",
+             "PROMPT": ("Enter a service instance user"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": 'ubuntu',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_SERVICE_INSTANCE_USER",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "manila-service-instance-password",
+             "PROMPT": ("Enter a service instance password"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": 'ubuntu',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_SERVICE_INSTANCE_PASSWORD",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "MANILANETWORK": [
+            {"CMD_OPTION": "manila-network-type",
+             "PROMPT": ("Enter a network type"),
+             "OPTION_LIST": ['neutron', 'standalone'],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "neutron",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETWORK_TYPE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "MANILANETWORKSTANDALONE": [
+            {"CMD_OPTION": "standalone_network_plugin_gateway",
+             "PROMPT": ("Enter a plugin gateway"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETWORK_STANDALONE_GATEWAY",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "standalone_network_plugin_mask",
+             "PROMPT": ("Enter a network mask"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETWORK_STANDALONE_NETMASK",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "standalone_network_plugin_segmentation_id",
+             "PROMPT": ("Enter a segmentation ID"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETWORK_STANDALONE_SEG_ID",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "standalone_network_plugin_ip_range",
+             "PROMPT": ("Enter a network mask"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETWORK_STANDALONE_IP_RANGE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "standalone_network_plugin_ip_version",
+             "PROMPT": ("Enter an IP version"),
+             "OPTION_LIST": ['4', '6'],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "4",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_NETWORK_STANDALONE_IP_VERSION",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "MANILAGLUSTERNATIVE": [
+            {"CMD_OPTION": "glusterfs-servers",
+             "PROMPT": ("Enter GlusterFS servers"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_GLUSTERFS_SERVERS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "glusterfs-native-path-to-private_key",
+             "PROMPT": ("Enter path to the GlusterFS private key"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_GLUSTERFS_NATIVE_PATH_TO_PRIVATE_KEY",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "glusterfs-volume-pattern",
+             "PROMPT": ("Enter volume pattern for GlusterFS"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_GLUSTERFS_VOLUME_PATTERN",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "MANILAGLUSTERNFS": [
+            {"CMD_OPTION": "glusterfs-target",
+             "PROMPT": ("Enter GlusterFS target"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_GLUSTERFS_TARGET",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "glusterfs-mount-point-base",
+             "PROMPT": ("Enter a mount point for GlusterFS mount"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_GLUSTERFS_MOUNT_POINT_BASE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "glusterfs-nfs-server-type",
+             "PROMPT": ("Enter NFS server type (gluster/ganesha)"),
+             "OPTION_LIST": ['gluster', 'ganesha'],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "gluster",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_GLUSTERFS_NFS_SERVER_TYPE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "glusterfs-path-to-private-key",
+             "PROMPT": ("Enter path to GlusterFS server private key"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_GLUSTERFS_PATH_TO_PRIVATE_KEY",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "glusterfs-ganesha-server-ip",
+             "PROMPT": ("Enter ip address of GlusterFS ganesha server"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_GLUSTERFS_GANESHA_SERVER_IP",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+    }
+    update_params_usage(basedefs.PACKSTACK_DOC, conf_params)
+    conf_groups = [
+        {"GROUP_NAME": "MANILA",
+         "DESCRIPTION": "Manila Config parameters",
+         "PRE_CONDITION": "CONFIG_MANILA_INSTALL",
+         "PRE_CONDITION_MATCH": "y",
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "MANILANETAPP",
+         "DESCRIPTION": "Manila NetApp configuration",
+         "PRE_CONDITION": check_netapp_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "MANILANETAPPMULTISVM",
+         "DESCRIPTION": "Manila NetApp multi-SVM configuration",
+         "PRE_CONDITION": check_netapp_options_multi_svm,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "MANILANETAPPSINGLESVM",
+         "DESCRIPTION": "Manila NetApp single-SVM configuration",
+         "PRE_CONDITION": check_netapp_options_single_svm,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "MANILAGENERIC",
+         "DESCRIPTION": "Manila generic driver configuration",
+         "PRE_CONDITION": check_generic_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "MANILANETWORK",
+         "DESCRIPTION": "Manila general network configuration",
+         "PRE_CONDITION": "CONFIG_MANILA_INSTALL",
+         "PRE_CONDITION_MATCH": "y",
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "MANILANETWORKSTANDALONE",
+         "DESCRIPTION": "Manila standalone network configuration",
+         "PRE_CONDITION": check_network_standalone_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "MANILAGLUSTERNATIVE",
+         "DESCRIPTION": "Manila GlusterFS native configuration",
+         "PRE_CONDITION": check_glusternative_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "MANILAGLUSTERNFS",
+         "DESCRIPTION": "Manila GlusterNFS configuration",
+         "PRE_CONDITION": check_glusternfs_options,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+    ]
+    for group in conf_groups:
+        params = conf_params[group["GROUP_NAME"]]
+        controller.addGroup(group, params)
+
+
+def initSequences(controller):
+    config = controller.CONF
+    if config['CONFIG_MANILA_INSTALL'] != 'y':
+        return
+
+    config['CONFIG_MANILA_BACKEND'] = (
+        [i.strip() for i in config['CONFIG_MANILA_BACKEND'].split(',') if i]
+    )
+
+    manila_steps = [
+        {'title': 'Preparing Manila entries',
+         'functions': [create_manifest]}
+    ]
+
+    controller.addSequence("Installing OpenStack Manila", [], [], manila_steps)
+
+
+# ------------------------- helper functions -------------------------
+
+def check_netapp_options(config):
+    return (config['CONFIG_MANILA_INSTALL'] == 'y' and
+            'netapp' in config['CONFIG_MANILA_BACKEND'])
+
+
+def check_netapp_options_multi_svm(config):
+    key_name = 'CONFIG_MANILA_NETAPP_DRV_HANDLES_SHARE_SERVERS'
+    return (check_netapp_options(config) and
+            config[key_name] == "true")
+
+
+def check_netapp_options_single_svm(config):
+    key_name = 'CONFIG_MANILA_NETAPP_DRV_HANDLES_SHARE_SERVERS'
+    return (check_netapp_options(config) and
+            config[key_name] == "false")
+
+
+def check_generic_options(config):
+    return (config['CONFIG_MANILA_INSTALL'] == 'y' and
+            'generic' in config['CONFIG_MANILA_BACKEND'])
+
+
+def check_network_standalone_options(config):
+    return (config['CONFIG_MANILA_INSTALL'] == 'y' and
+            config['CONFIG_MANILA_NETWORK_TYPE'] == 'standalone')
+
+
+def check_glusternative_options(config):
+    return (config['CONFIG_MANILA_INSTALL'] == 'y' and
+            'glusternative' in config['CONFIG_MANILA_BACKEND'])
+
+
+def check_glusternfs_options(config):
+    return (config['CONFIG_MANILA_INSTALL'] == 'y' and
+            'glusternfs' in config['CONFIG_MANILA_BACKEND'])
+
+
+# -------------------------- step functions --------------------------
+
+def create_manifest(config, messages):
+    if config['CONFIG_UNSUPPORTED'] != 'y':
+        config['CONFIG_STORAGE_HOST'] = config['CONFIG_CONTROLLER_HOST']
+
+    if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+        ssl_host = config['CONFIG_STORAGE_HOST']
+        ssl_cert_file = config['CONFIG_MANILA_SSL_CERT'] = (
+            '/etc/pki/tls/certs/ssl_amqp_manila.crt'
+        )
+        ssl_key_file = config['CONFIG_MANILA_SSL_KEY'] = (
+            '/etc/pki/tls/private/ssl_amqp_manila.key'
+        )
+        service = 'manila'
+        generate_ssl_cert(config, ssl_host, service, ssl_key_file,
+                          ssl_cert_file)
+
+    # Change these from text to Boolean values
+    boolean_keys = ['CONFIG_MANILA_GENERIC_DRV_HANDLES_SHARE_SERVERS',
+                    'CONFIG_MANILA_NETAPP_DRV_HANDLES_SHARE_SERVERS']
+    for key in [k for k in boolean_keys if k in config]:
+        if config[key].lower() == "true":
+            config[key] = True
+
+        elif config[key].lower() == "false":
+            config[key] = False
+
+    # manila API should be open for everyone
+    fw_details = dict()
+    key = "manila_api"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "manila-api"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['8786']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_MANILA_API_RULES'] = fw_details
diff --git a/packstack/plugins/mariadb_003.py b/packstack/plugins/mariadb_003.py
new file mode 100644
index 000000000..de0e0a6fa
--- /dev/null
+++ b/packstack/plugins/mariadb_003.py
@@ -0,0 +1,116 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Installs and configures MariaDB
+"""
+
+from packstack.installer import basedefs
+from packstack.installer import validators
+from packstack.installer import processors
+from packstack.installer import utils
+
+from packstack.modules.common import filtered_hosts
+from packstack.modules.documentation import update_params_usage
+
+# ------------- MariaDB Packstack Plugin Initialization --------------
+
+PLUGIN_NAME = "MariaDB"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
+
+
+def initConfig(controller):
+    params = [
+        {"CMD_OPTION": "mariadb-host",
+         "PROMPT": "Enter the IP address of the MariaDB server",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_ssh],
+         "DEFAULT_VALUE": utils.get_localhost_ip(),
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_MARIADB_HOST",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False,
+         "DEPRECATES": ['CONFIG_MYSQL_HOST']},
+
+        {"CMD_OPTION": "mariadb-user",
+         "USAGE": "Username for the MariaDB admin user",
+         "PROMPT": "Enter the username for the MariaDB admin user",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "root",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_MARIADB_USER",
+         "USE_DEFAULT": True,
+         "NEED_CONFIRM": False,
+         "CONDITION": False,
+         "DEPRECATES": ['CONFIG_MYSQL_USER']},
+
+        {"CMD_OPTION": "mariadb-pw",
+         "USAGE": "Password for the MariaDB admin user",
+         "PROMPT": "Enter the password for the MariaDB admin user",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "PROCESSORS": [processors.process_password],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_MARIADB_PW",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False,
+         "DEPRECATES": ['CONFIG_MYSQL_PW']},
+    ]
+    update_params_usage(basedefs.PACKSTACK_DOC, params, sectioned=False)
+    group = {"GROUP_NAME": "MARIADB",
+             "DESCRIPTION": "MariaDB Config parameters",
+             "PRE_CONDITION": lambda x: 'yes',
+             "PRE_CONDITION_MATCH": "yes",
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+    controller.addGroup(group, params)
+
+
+def initSequences(controller):
+    mariadbsteps = [
+        {'title': 'Preparing MariaDB entries',
+         'functions': [create_manifest]}
+    ]
+    controller.addSequence("Installing MariaDB", [], [], mariadbsteps)
+
+
+# -------------------------- step functions --------------------------
+
+def create_manifest(config, messages):
+    if config['CONFIG_MARIADB_INSTALL'] == 'y':
+        host = config['CONFIG_CONTROLLER_HOST']
+    else:
+        host = config['CONFIG_MARIADB_HOST']
+
+    if config['CONFIG_IP_VERSION'] == 'ipv6':
+        config['CONFIG_MARIADB_HOST_URL'] = "[%s]" % host
+    else:
+        config['CONFIG_MARIADB_HOST_URL'] = host
+
+    fw_details = dict()
+    for host in filtered_hosts(config, exclude=False, dbhost=True):
+        key = "mariadb_%s" % host
+        fw_details.setdefault(key, {})
+        fw_details[key]['host'] = "%s" % host
+        fw_details[key]['service_name'] = "mariadb"
+        fw_details[key]['chain'] = "INPUT"
+        fw_details[key]['ports'] = ['3306']
+        fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_MARIADB_RULES'] = fw_details
diff --git a/packstack/plugins/mysql_001.py b/packstack/plugins/mysql_001.py
deleted file mode 100644
index 4c4ec0a10..000000000
--- a/packstack/plugins/mysql_001.py
+++ /dev/null
@@ -1,138 +0,0 @@
-"""
-Installs and configures MySQL
-"""
-
-import uuid
-import logging
-
-from packstack.installer import validators
-from packstack.installer import utils
-from packstack.installer.utils import split_hosts
-
-from packstack.modules.ospluginutils import getManifestTemplate, appendManifestFile
-
-# Controller object will be initialized from main flow
-controller = None
-
-# Plugin name
-PLUGIN_NAME = "OS-MySQL"
-PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
-
-logging.debug("plugin %s loaded", __name__)
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding MySQL OpenStack configuration")
-    paramsList = [
-                  {"CMD_OPTION"      : "mysql-host",
-                   "USAGE"           : "The IP address of the server on which to install MySQL",
-                   "PROMPT"          : "Enter the IP address of the MySQL server",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_MYSQL_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "mysql-user",
-                   "USAGE"           : "Username for the MySQL admin user",
-                   "PROMPT"          : "Enter the username for the MySQL admin user",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : "root",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_MYSQL_USER",
-                   "USE_DEFAULT"     : True,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "mysql-pw",
-                   "USAGE"           : "Password for the MySQL admin user",
-                   "PROMPT"          : "Enter the password for the MySQL admin user",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_MYSQL_PW",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : True,
-                   "CONDITION"       : False },
-                 ]
-
-    groupDict = { "GROUP_NAME"            : "MYSQL",
-                  "DESCRIPTION"           : "MySQL Config parameters",
-                  "PRE_CONDITION"         : lambda x: 'yes',
-                  "PRE_CONDITION_MATCH"   : "yes",
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
-
-
-def initSequences(controller):
-    mysqlsteps = [
-             {'title': 'Adding MySQL manifest entries',
-              'functions':[createmanifest]}
-    ]
-    controller.addSequence("Installing MySQL", [], [], mysqlsteps)
-
-
-def createmanifest(config):
-    if config['CONFIG_MYSQL_INSTALL'] == 'y':
-        install = True
-        suffix = 'install'
-    else:
-        install = False
-        suffix = 'noinstall'
-
-    # In case we are not installing MySQL server, mysql* manifests have
-    # to be run from Keystone host
-    host = install and config['CONFIG_MYSQL_HOST'] \
-                    or config['CONFIG_KEYSTONE_HOST']
-    manifestfile = "%s_mysql.pp" % host
-    manifestdata = [getManifestTemplate('mysql_%s.pp' % suffix)]
-
-    def append_for(module, suffix):
-        # Modules have to be appended to the existing mysql.pp
-        # otherwise pp will fail for some of them saying that
-        # Mysql::Config definition is missing.
-        template = "mysql_%s_%s.pp" % (module, suffix)
-        manifestdata.append(getManifestTemplate(template))
-
-    append_for("keystone", suffix)
-    hosts = set()
-    for mod in ['nova', 'cinder', 'glance', 'neutron', 'heat']:
-        if config['CONFIG_%s_INSTALL' % mod.upper()] == 'y':
-            append_for(mod, suffix)
-            # Check wich modules are enabled so we can allow their
-            # hosts on the firewall
-            if mod != 'nova' and mod != 'neutron':
-                hosts.add(config.get('CONFIG_%s_HOST' % mod.upper()).strip())
-            elif mod == 'neutron':
-                hosts.add(config.get('CONFIG_NEUTRON_SERVER_HOST').strip())
-            elif config['CONFIG_NOVA_INSTALL'] != 'n':
-                #In that remote case that we have lot's of nova hosts
-                hosts.add(config.get('CONFIG_NOVA_API_HOST').strip())
-                hosts.add(config.get('CONFIG_NOVA_CERT_HOST').strip())
-                hosts.add(config.get('CONFIG_NOVA_VNCPROXY_HOST').strip())
-                hosts.add(config.get('CONFIG_NOVA_CONDUCTOR_HOST').strip())
-                hosts.add(config.get('CONFIG_NOVA_SCHED_HOST').strip())
-                if config['CONFIG_NEUTRON_INSTALL'] != 'y':
-                    dbhosts = split_hosts(config['CONFIG_NOVA_NETWORK_HOSTS'])
-                    hosts |= dbhosts
-                for host in config.get('CONFIG_NOVA_COMPUTE_HOSTS').split(','):
-                    hosts.add(host.strip())
-
-    config['FIREWALL_SERVICE_NAME'] = "mysql"
-    config['FIREWALL_PORTS'] = "'3306'"
-    config['FIREWALL_CHAIN'] = "INPUT"
-    for host in hosts:
-        config['FIREWALL_ALLOWED'] = "'%s'" % host
-        config['FIREWALL_SERVICE_ID'] = "mysql_%s" % host
-        manifestdata.append(getManifestTemplate("firewall.pp"))
-
-    appendManifestFile(manifestfile, "\n".join(manifestdata), 'pre')
diff --git a/packstack/plugins/nagios_910.py b/packstack/plugins/nagios_910.py
deleted file mode 100644
index aba02feba..000000000
--- a/packstack/plugins/nagios_910.py
+++ /dev/null
@@ -1,188 +0,0 @@
-"""
-Installs and configures Nagios
-"""
-
-import uuid
-import logging
-
-from packstack.installer import validators
-from packstack.installer import basedefs, output_messages
-from packstack.installer import utils
-
-from packstack.modules.common import filtered_hosts
-from packstack.modules.ospluginutils import gethostlist,\
-                                            getManifestTemplate,\
-                                            appendManifestFile
-
-# Controller object will be initialized from main flow
-controller = None
-
-# Plugin name
-PLUGIN_NAME = "OS-Nagios"
-PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
-
-logging.debug("plugin %s loaded", __name__)
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding OpenStack Nagios configuration")
-    paramsList = [
-                  {"CMD_OPTION"      : "nagios-host",
-                   "USAGE"           : "The IP address of the server on which to install the Nagios server",
-                   "PROMPT"          : "Enter the IP address of the Nagios server",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NAGIOS_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "nagios-passwd",
-                   "USAGE"           : "The password of the nagiosadmin user on the Nagios server",
-                   "PROMPT"          : "Enter the password for the nagiosadmin user",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NAGIOS_PW",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                 ]
-
-    groupDict = { "GROUP_NAME"            : "NAGIOS",
-                  "DESCRIPTION"           : "Nagios Config parameters",
-                  "PRE_CONDITION"         : "CONFIG_NAGIOS_INSTALL",
-                  "PRE_CONDITION_MATCH"   : "y",
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
-
-
-def initSequences(controller):
-    conf = controller.CONF
-    if conf['CONFIG_NAGIOS_INSTALL'] != 'y':
-        return
-
-    nagiossteps = [
-             {'title': 'Adding Nagios server manifest entries', 'functions':[createmanifest]},
-             {'title': 'Adding Nagios host manifest entries', 'functions':[createnrpemanifests]}
-    ]
-    controller.addSequence("Installing Nagios", [], [], nagiossteps)
-
-
-def _serviceentry(**kwargs):
-    s = 'define service {\n'
-    for key in sorted(kwargs.keys()):
-        s += "\t%s\t%s\n" % (key, kwargs[key])
-    s += "\t}\n"
-    return s
-
-def _copy_script(**kwargs):
-    # TODO : Replace all these shell templates with with python
-    return ('file{"/usr/lib64/nagios/plugins/%(name)s":'
-              'mode => 755, owner => "nagios", '
-              'seltype => "nagios_unconfined_plugin_exec_t", '
-              'content => template("packstack/%(name)s.erb"),}\n'
-            'nagios_command {"%(name)s": '
-              'command_line => "/usr/lib64/nagios/plugins/%(name)s",}\n'
-            % kwargs)
-
-def nagios_host(hostname, **kwargs):
-    out = ("nagios_host { '%s': " % hostname)
-    for key, value in kwargs.items():
-        out = "%s, %s => '%s'" % (out, key, value)
-    return "%s}\n" % out
-
-
-def createmanifest(config):
-    manifest_entries = ''
-    # I should be adding service entries with nagios_service but it appears to  be broken
-    # http://projects.puppetlabs.com/issues/3420
-    service_entries = ''
-    for hostname in gethostlist(config):
-        manifest_entries += nagios_host(hostname, address=hostname, use='linux-server')
-
-        service_entries += _serviceentry(name='load5-%s'%hostname, service_description='5 minute load average',
-                                         host_name=hostname, check_command="check_nrpe!load5", use="generic-service",
-                                         normal_check_interval='5')
-
-        service_entries += _serviceentry(name='df_var-%s'%hostname,
-                                         service_description='Percent disk space used on /var',
-                                         host_name=hostname,
-                                         check_command="check_nrpe!df_var", use="generic-service")
-
-    manifest_entries += _copy_script(name="keystone-user-list")
-    service_entries += _serviceentry(name='keystone-user-list',
-        service_description='number of keystone users',
-        host_name=controller.CONF['CONFIG_NAGIOS_HOST'],
-        check_command="keystone-user-list", use="generic-service",
-        normal_check_interval='5')
-
-    if controller.CONF['CONFIG_GLANCE_INSTALL'] == 'y':
-        manifest_entries += _copy_script(name="glance-index")
-        service_entries += _serviceentry(name='glance-index',
-            service_description='number of glance images',
-            host_name=controller.CONF['CONFIG_NAGIOS_HOST'],
-            check_command="glance-index", use="generic-service",
-            normal_check_interval='5')
-
-    if controller.CONF['CONFIG_NOVA_INSTALL'] == 'y':
-        manifest_entries += _copy_script(name="nova-list")
-        service_entries += _serviceentry(name='nova-list',
-            service_description='number of nova vm instances',
-            host_name=controller.CONF['CONFIG_NAGIOS_HOST'],
-            check_command="nova-list", use="generic-service",
-            normal_check_interval='5')
-
-    if controller.CONF['CONFIG_CINDER_INSTALL'] == 'y':
-        manifest_entries += _copy_script(name="cinder-list")
-        service_entries += _serviceentry(name='cinder-list',
-            service_description='number of cinder volumes',
-            host_name=controller.CONF['CONFIG_NAGIOS_HOST'],
-            check_command="cinder-list", use="generic-service",
-            normal_check_interval='5')
-
-    if controller.CONF['CONFIG_SWIFT_INSTALL'] == 'y':
-        manifest_entries += _copy_script(name="swift-list")
-        service_entries += _serviceentry(name='swift-list',
-            service_description='number of swift containers',
-            host_name=controller.CONF['CONFIG_NAGIOS_HOST'],
-            check_command="swift-list", use="generic-service",
-            normal_check_interval='5')
-
-    manifest_entries += ("file { '/etc/nagios/nagios_service.cfg': \n"
-                            "ensure => present, mode => 644,\n"
-                            "owner => 'nagios', group => 'nagios',\n"
-                            "before => Service['nagios'],\n"
-                            "content => '%s'}" % service_entries)
-
-    controller.CONF['CONFIG_NAGIOS_MANIFEST_CONFIG'] = manifest_entries
-
-    manifestfile = "%s_nagios.pp" % controller.CONF['CONFIG_NAGIOS_HOST']
-    manifestdata = getManifestTemplate("nagios_server.pp")
-    appendManifestFile(manifestfile, manifestdata)
-
-def createnrpemanifests(config):
-    for hostname in filtered_hosts(controller.CONF):
-        controller.CONF['CONFIG_NRPE_HOST'] = hostname
-        manifestfile = "%s_nagios_nrpe.pp" % hostname
-        manifestdata = getManifestTemplate("nagios_nrpe.pp")
-        #Only the Nagios host is allowed to talk to nrpe
-        config['FIREWALL_ALLOWED'] = "'%s'" % config['CONFIG_NAGIOS_HOST']
-        config['FIREWALL_SERVICE_NAME'] = "nagios-nrpe"
-        config['FIREWALL_SERVICE_ID'] = "nagios_nrpe"
-        config['FIREWALL_PORTS'] = '5666'
-        config['FIREWALL_CHAIN'] = "INPUT"
-        manifestdata += getManifestTemplate("firewall.pp")
-        appendManifestFile(manifestfile, manifestdata)
-
-    controller.MESSAGES.append("To use Nagios, browse to http://%s/nagios "
-                               "username : nagiosadmin, password : %s" %
-                               (controller.CONF['CONFIG_NAGIOS_HOST'],
-                                controller.CONF['CONFIG_NAGIOS_PW']))
diff --git a/packstack/plugins/neutron_350.py b/packstack/plugins/neutron_350.py
index 76c1d7a5f..d1ab1d760 100644
--- a/packstack/plugins/neutron_350.py
+++ b/packstack/plugins/neutron_350.py
@@ -1,837 +1,967 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 """
-Installs and configures neutron
+Installs and configures Neutron
 """
 
-import logging
-import os
-import re
-import uuid
-
+import netifaces
+from packstack.installer import basedefs
 from packstack.installer import utils
 from packstack.installer import validators
+from packstack.installer import processors
+from packstack.installer import output_messages
 from packstack.installer.utils import split_hosts
 
-from packstack.modules.shortcuts import get_mq
-from packstack.modules.ospluginutils import getManifestTemplate, appendManifestFile
-
-# Controller object will be initialized from main flow
-controller = None
+from packstack.modules import common
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import generate_ssl_cert
 
-# Plugin name
-PLUGIN_NAME = "OS-NEUTRON"
+# ------------- Neutron Packstack Plugin Initialization --------------
 
-logging.debug("plugin %s loaded", __name__)
+PLUGIN_NAME = "OS-Neutron"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
 
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-
-    logging.debug("Adding OpenStack Neutron configuration")
 
+def initConfig(controller):
     conf_params = {
-        "NEUTRON" : [
-            {"CMD_OPTION"      : "neutron-server-host",
-             "USAGE"           : "The IP addresses of the server on which to install the Neutron server",
-             "PROMPT"          : "Enter the IP address of the Neutron server",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_ip, validators.validate_ssh],
-             "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-             "MASK_INPUT"      : False,
+        "NEUTRON": [
+            {"CMD_OPTION": "os-neutron-ks-password",
+             "PROMPT": "Enter the password for Neutron Keystone access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_NEUTRON_KS_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-db-password",
+             "PROMPT": "Enter the password for Neutron DB access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_NEUTRON_DB_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-l3-ext-bridge",
+             "PROMPT": ("Enter the ovs bridge the Neutron L3 agent will use "
+                        "for external traffic, or 'provider' if using "
+                        "provider networks."),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "br-ex",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_SERVER_HOST",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-ks-password",
-             "USAGE"           : "The password to use for Neutron to authenticate with Keystone",
-             "PROMPT"          : "Enter the password for Neutron Keystone access",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_not_empty],
-             "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-             "MASK_INPUT"      : True,
+             "CONF_NAME": "CONFIG_NEUTRON_L3_EXT_BRIDGE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-metadata-pw",
+             "PROMPT": "Enter Neutron metadata agent password",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
              "LOOSE_VALIDATION": False,
-             "CONF_NAME"       : "CONFIG_NEUTRON_KS_PW",
-             "USE_DEFAULT"     : True,
-             "NEED_CONFIRM"    : True,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-db-password",
-             "USAGE"           : "The password to use for Neutron to access DB",
-             "PROMPT"          : "Enter the password for Neutron DB access",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_not_empty],
-             "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-             "MASK_INPUT"      : True,
+             "CONF_NAME": "CONFIG_NEUTRON_METADATA_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-metering-agent-install",
+             "PROMPT": ("Should Packstack install Neutron L3 Metering agent"),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
-             "CONF_NAME"       : "CONFIG_NEUTRON_DB_PW",
-             "USE_DEFAULT"     : True,
-             "NEED_CONFIRM"    : True,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-l3-hosts",
-             "USAGE"           : "A comma separated list of IP addresses on which to install Neutron L3 agent",
-             "PROMPT"          : "Enter a comma separated list of IP addresses on which to install the Neutron L3 agent",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_multi_ssh],
-             "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_METERING_AGENT_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-vpnaas-install",
+             "PROMPT": "Would you like to configure neutron VPNaaS?",
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "n",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_L3_HOSTS",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-l3-ext-bridge",
-             "USAGE"           : "The name of the bridge that the Neutron L3 agent will use for external traffic, or 'provider' if using provider networks",
-             "PROMPT"          : "Enter the bridge the Neutron L3 agent will use for external traffic, or 'provider' if using provider networks",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_not_empty],
-             "DEFAULT_VALUE"   : "br-ex",
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_VPNAAS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "NEUTRON_OVS_AGENT": [
+            {"CMD_OPTION": "os-neutron-ovs-bridge-mappings",
+             "PROMPT": ("Enter a comma separated list of bridge mappings for "
+                        "the Neutron openvswitch plugin"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "extnet:br-ex",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_L3_EXT_BRIDGE",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-dhcp-hosts",
-             "USAGE"           : "A comma separated list of IP addresses on which to install Neutron DHCP agent",
-             "PROMPT"          : "Enter a comma separated list of IP addresses on which to install Neutron DHCP agent",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_multi_ssh],
-             "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ovs-bridge-interfaces",
+             "PROMPT": ("Enter a comma separated list of OVS bridge:interface "
+                        "pairs for the Neutron openvswitch plugin"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_DHCP_HOSTS",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-lbaas-hosts",
-             "USAGE"           : "A comma separated list of IP addresses on which to install Neutron LBaaS agent",
-             "PROMPT"          : "Enter a comma separated list of IP addresses on which to install Neutron LBaaS agent",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_multi_ssh],
-             "DEFAULT_VALUE"   : "",
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_OVS_BRIDGE_IFACES",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ovs-bridges-compute",
+             "PROMPT": ("Enter a comma separated list of bridges for the "
+                        "Neutron OVS plugin in compute nodes. They must "
+                        "be included in os-neutron-ovs-bridge-mappings and "
+                        "os-neutron-ovs-bridge-interfaces."),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_LBAAS_HOSTS",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-l2-plugin",
-             "USAGE"           : "The name of the L2 plugin to be used with Neutron",
-             "PROMPT"          : "Enter the name of the L2 plugin to be used with Neutron",
-             "OPTION_LIST"     : ["linuxbridge", "openvswitch", "ml2"],
-             "VALIDATORS"      : [validators.validate_options],
-             "DEFAULT_VALUE"   : "openvswitch",
-             "MASK_INPUT"      : False,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME"       : "CONFIG_NEUTRON_L2_PLUGIN",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-metadata-hosts",
-             "USAGE"           : "A comma separated list of IP addresses on which to install Neutron metadata agent",
-             "PROMPT"          : "Enter a comma separated list of IP addresses on which to install the Neutron metadata agent",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_multi_ssh],
-             "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_OVS_BRIDGES_COMPUTE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ovs-external-physnet",
+             "PROMPT": ("Enter the name of the physical external network as"
+                        "defined in bridge mappings"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "extnet",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_METADATA_HOSTS",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-metadata-pw",
-             "USAGE"           : "A comma separated list of IP addresses on which to install Neutron metadata agent",
-             "PROMPT"          : "Enter a comma separated list of IP addresses on which to install the Neutron metadata agent",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_not_empty],
-             "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-             "MASK_INPUT"      : True,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME"       : "CONFIG_NEUTRON_METADATA_PW",
-             "USE_DEFAULT"     : True,
-             "NEED_CONFIRM"    : True,
-             "CONDITION"       : False },
-            ],
-        "NEUTRON_LB_PLUGIN" : [
-            {"CMD_OPTION"      : "neutron-lb-tenant-network-type",
-             "USAGE"           : "The type of network to allocate for tenant networks (eg. vlan, local)",
-             "PROMPT"          : "Enter the type of network to allocate for tenant networks",
-             "OPTION_LIST"     : ["local", "vlan"],
-             "VALIDATORS"      : [validators.validate_options],
-             "DEFAULT_VALUE"   : "local",
-             "MASK_INPUT"      : False,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME"       : "CONFIG_NEUTRON_LB_TENANT_NETWORK_TYPE",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-lb-vlan-ranges",
-             "USAGE"           : "A comma separated list of VLAN ranges for the Neutron linuxbridge plugin (eg. physnet1:1:4094,physnet2,physnet3:3000:3999)",
-             "PROMPT"          : "Enter a comma separated list of VLAN ranges for the Neutron linuxbridge plugin",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [],
-             "DEFAULT_VALUE"   : "",
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_OVS_EXTERNAL_PHYSNET",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "NEUTRON_OVS_AGENT_TUNNEL": [
+            {"CMD_OPTION": "os-neutron-ovs-tunnel-if",
+             "PROMPT": ("Enter interface with IP to override the default "
+                        "tunnel local_ip"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_LB_VLAN_RANGES",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            ],
-        "NEUTRON_LB_PLUGIN_AND_AGENT" : [
-            {"CMD_OPTION"      : "neutron-lb-interface-mappings",
-             "USAGE"           : "A comma separated list of interface mappings for the Neutron linuxbridge plugin (eg. physnet1:br-eth1,physnet2:br-eth2,physnet3:br-eth3)",
-             "PROMPT"          : "Enter a comma separated list of interface mappings for the Neutron linuxbridge plugin",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [],
-             "DEFAULT_VALUE"   : "",
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_OVS_TUNNEL_IF",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ovs-tunnel-subnets",
+             "PROMPT": ("Enter comma separated list of subnets used for "
+                        "tunneling to make them allowed by IP filtering."),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_LB_INTERFACE_MAPPINGS",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            ],
-        "NEUTRON_OVS_PLUGIN" : [
-            {"CMD_OPTION"      : "neutron-ovs-tenant-network-type",
-             "USAGE"           : "Type of network to allocate for tenant networks (eg. vlan, local, gre, vxlan)",
-             "PROMPT"          : "Enter the type of network to allocate for tenant networks",
-             "OPTION_LIST"     : ["local", "vlan", "gre", "vxlan"],
-             "VALIDATORS"      : [validators.validate_options],
-             "DEFAULT_VALUE"   : "local",
-             "MASK_INPUT"      : False,
-             "LOOSE_VALIDATION": False,
-             "CONF_NAME"       : "CONFIG_NEUTRON_OVS_TENANT_NETWORK_TYPE",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-ovs-vlan-ranges",
-             "USAGE"           : "A comma separated list of VLAN ranges for the Neutron openvswitch plugin (eg. physnet1:1:4094,physnet2,physnet3:3000:3999)",
-             "PROMPT"          : "Enter a comma separated list of VLAN ranges for the Neutron openvswitch plugin",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [],
-             "DEFAULT_VALUE"   : "",
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_OVS_TUNNEL_SUBNETS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "NEUTRON_OVS_AGENT_VXLAN": [
+            {"CMD_OPTION": "os-neutron-ovs-vxlan-udp-port",
+             "CONF_NAME": "CONFIG_NEUTRON_OVS_VXLAN_UDP_PORT",
+             "PROMPT": "Enter VXLAN UDP port number",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_port],
+             "DEFAULT_VALUE": 4789,
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_OVS_VLAN_RANGES",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            ],
-        "NEUTRON_OVS_PLUGIN_AND_AGENT" : [
-            {"CMD_OPTION"      : "neutron-ovs-bridge-mappings",
-             "USAGE"           : "A comma separated list of bridge mappings for the Neutron openvswitch plugin (eg. physnet1:br-eth1,physnet2:br-eth2,physnet3:br-eth3)",
-             "PROMPT"          : "Enter a comma separated list of bridge mappings for the Neutron openvswitch plugin",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [],
-             "DEFAULT_VALUE"   : "",
-             "MASK_INPUT"      : False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "NEUTRON_OVN_AGENT": [
+            {"CMD_OPTION": "os-neutron-ovn-bridge-mappings",
+             "PROMPT": ("Enter a comma separated list of bridge mappings for "
+                        "the Neutron Open Virtual Network plugin"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "extnet:br-ex",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-ovs-bridge-interfaces",
-             "USAGE"           : "A comma separated list of colon-separated OVS bridge:interface pairs. The interface will be added to the associated bridge.",
-             "PROMPT"          : "Enter a comma separated list of OVS bridge:interface pairs for the Neutron openvswitch plugin",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [],
-             "DEFAULT_VALUE"   : "",
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_OVN_BRIDGE_MAPPINGS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ovn-bridge-interfaces",
+             "PROMPT": ("Enter a comma separated list of OVS bridge:interface "
+                        "pairs for the Neutron Open Virtual Network plugin"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_OVS_BRIDGE_IFACES",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            ],
-        "NEUTRON_OVS_PLUGIN_TUNNEL" : [
-            {"CMD_OPTION"      : "neutron-ovs-tunnel-ranges",
-             "USAGE"           : "A comma separated list of tunnel ranges for the Neutron openvswitch plugin (eg. 1:1000)",
-             "PROMPT"          : "Enter a comma separated list of tunnel ranges for the Neutron openvswitch plugin",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [],
-             "DEFAULT_VALUE"   : "",
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_OVN_BRIDGE_IFACES",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ovn-bridges-compute",
+             "PROMPT": ("Enter a comma separated list of bridges for the "
+                        "Neutron Open Virtual Network plugin in compute nodes."
+                        "They must be included in os-neutron-ovs-bridge-mappings "
+                        "and os-neutron-ovs-bridge-interfaces."),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_OVS_TUNNEL_RANGES",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            ],
-        "NEUTRON_OVS_PLUGIN_AND_AGENT_TUNNEL" : [
-            {"CMD_OPTION"      : "neutron-ovs-tunnel-if",
-             "USAGE"           : "The interface for the OVS tunnel. Packstack will override the IP address used for tunnels on this hypervisor to the IP found on the specified interface. (eg. eth1) ",
-             "PROMPT"          : "Enter interface with IP to override the default tunnel local_ip",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [],
-             "DEFAULT_VALUE"   : "",
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_OVN_BRIDGES_COMPUTE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ovn-external-physnet",
+             "PROMPT": ("Enter the name of the physical external network as"
+                        "defined in bridge mappings"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "extnet",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_NEUTRON_OVS_TUNNEL_IF",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            ],
-        "NEUTRON_OVS_PLUGIN_AND_AGENT_VXLAN" : [
-            {"CMD_OPTION"      : "neutron-ovs-vxlan-udp-port",
-             "CONF_NAME"       : "CONFIG_NEUTRON_OVS_VXLAN_UDP_PORT",
-             "USAGE"           : "VXLAN UDP port",
-             "PROMPT"          : "Enter VXLAN UDP port number",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_port],
-             "DEFAULT_VALUE"   : 4789,
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_OVN_EXTERNAL_PHYSNET",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "NEUTRON_OVN_AGENT_TUNNEL": [
+            {"CMD_OPTION": "os-neutron-ovn-tunnel-if",
+             "PROMPT": ("Enter interface with IP to override the default "
+                        "tunnel local IP"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": True,
-
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            ],
-        "NEUTRON_ML2_PLUGIN" : [
-            {"CMD_OPTION"      : "neutron-ml2-type-drivers",
-             "CONF_NAME"       : "CONFIG_NEUTRON_ML2_TYPE_DRIVERS",
-             "USAGE"           : ("A comma separated list of network type "
-                                  "driver entrypoints to be loaded from the "
-                                  "neutron.ml2.type_drivers namespace."),
-             "PROMPT"          : ("Enter a comma separated list of network "
-                                  "type driver entrypoints"),
-             "OPTION_LIST"     : ["local", "flat", "vlan", "gre", "vxlan"],
-             "VALIDATORS"      : [validators.validate_multi_options],
-             "DEFAULT_VALUE"   : "local",
-             "MASK_INPUT"      : False,
+             "CONF_NAME": "CONFIG_NEUTRON_OVN_TUNNEL_IF",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ovn-tunnel-subnets",
+             "PROMPT": ("Enter comma separated list of subnets used for "
+                        "tunneling to make them allowed by IP filtering."),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_NEUTRON_OVN_TUNNEL_SUBNETS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "NEUTRON_ML2_PLUGIN": [
+            {"CMD_OPTION": "os-neutron-ml2-type-drivers",
+             "CONF_NAME": "CONFIG_NEUTRON_ML2_TYPE_DRIVERS",
+             "PROMPT": ("Enter a comma separated list of network type driver "
+                        "entrypoints"),
+             "OPTION_LIST": ["local", "flat", "vlan", "gre", "vxlan", "geneve"],
+             "VALIDATORS": [validators.validate_multi_options],
+             "DEFAULT_VALUE": "geneve,flat",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-ml2-tenant-network-types",
-             "CONF_NAME"       : "CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES",
-             "USAGE"           : ("A comma separated ordered list of "
-                                  "network_types to allocate as tenant "
-                                  "networks. The value 'local' is only useful "
-                                  "for single-box testing but provides no "
-                                  "connectivity between hosts."),
-             "PROMPT"          : ("Enter a comma separated ordered list of "
-                                  "network_types to allocate as tenant "
-                                  "networks"),
-             "OPTION_LIST"     : ["local", "vlan", "gre", "vxlan"],
-             "VALIDATORS"      : [validators.validate_multi_options],
-             "DEFAULT_VALUE"   : "local",
-             "MASK_INPUT"      : False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ml2-tenant-network-types",
+             "CONF_NAME": "CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES",
+             "PROMPT": ("Enter a comma separated ordered list of "
+                        "network_types to allocate as tenant networks"),
+             "OPTION_LIST": ["local", "vlan", "gre", "vxlan", "geneve"],
+             "VALIDATORS": [validators.validate_multi_options],
+             "DEFAULT_VALUE": "geneve",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-ml2-mechanism-drivers",
-             "CONF_NAME"       : "CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS",
-             "USAGE"           : ("A comma separated ordered list of "
-                                  "networking mechanism driver entrypoints "
-                                  "to be loaded from the "
-                                  "neutron.ml2.mechanism_drivers namespace."),
-             "PROMPT"          : ("Enter a comma separated ordered list of "
-                                  "networking mechanism driver entrypoints"),
-             "OPTION_LIST"     : ["logger", "test", "linuxbridge",
-                                  "openvswitch", "hyperv", "ncs", "arista",
-                                  "cisco_nexus", "l2population"],
-             "VALIDATORS"      : [validators.validate_multi_options],
-             "DEFAULT_VALUE"   : "openvswitch",
-             "MASK_INPUT"      : False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ml2-mechanism-drivers",
+             "CONF_NAME": "CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS",
+             "PROMPT": ("Enter a comma separated ordered list of networking "
+                        "mechanism driver entrypoints"),
+             "OPTION_LIST": ["logger", "test", "openvswitch",
+                             "arista", "mlnx", "l2population",
+                             "sriovnicswitch", "ovn"],
+             "VALIDATORS": [validators.validate_multi_options],
+             "DEFAULT_VALUE": "ovn",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-ml2-flat-networks",
-             "CONF_NAME"       : "CONFIG_NEUTRON_ML2_FLAT_NETWORKS",
-             "USAGE"           : ("A comma separated  list of physical_network"
-                                  " names with which flat networks can be "
-                                  "created. Use * to allow flat networks with "
-                                  "arbitrary physical_network names."),
-             "PROMPT"          : ("Enter a comma separated  list of "
-                                  "physical_network names with which flat "
-                                  "networks can be created"),
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [],
-             "DEFAULT_VALUE"   : "*",
-             "MASK_INPUT"      : False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ml2-flat-networks",
+             "CONF_NAME": "CONFIG_NEUTRON_ML2_FLAT_NETWORKS",
+             "PROMPT": ("Enter a comma separated  list of physical_network "
+                        "names with which flat networks can be created"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "*",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-ml2-vlan-ranges",
-             "CONF_NAME"       : "CONFIG_NEUTRON_ML2_VLAN_RANGES",
-             "USAGE"           : ("A comma separated list of "
-                                  "<physical_network>:<vlan_min>:<vlan_max> "
-                                  "or <physical_network> specifying "
-                                  "physical_network names usable for VLAN "
-                                  "provider and tenant networks, as well as "
-                                  "ranges of VLAN tags on each available for "
-                                  "allocation to tenant networks."),
-             "PROMPT"          : ("Enter a comma separated list of "
-                                  "physical_network names usable for VLAN"),
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [],
-             "DEFAULT_VALUE"   : "",
-             "MASK_INPUT"      : False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ml2-vlan-ranges",
+             "CONF_NAME": "CONFIG_NEUTRON_ML2_VLAN_RANGES",
+             "PROMPT": ("Enter a comma separated list of physical_network "
+                        "names usable for VLAN"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-ml2-tunnel-id-ranges",
-             "CONF_NAME"       : "CONFIG_NEUTRON_ML2_TUNNEL_ID_RANGES",
-             "USAGE"           : ("A comma separated list of <tun_min>:"
-                                  "<tun_max> tuples enumerating ranges of GRE "
-                                  "tunnel IDs that are available for tenant "
-                                  "network allocation. Should be an array with"
-                                  " tun_max +1 - tun_min > 1000000"),
-             "PROMPT"          : ("Enter a comma separated list of <tun_min>:"
-                                  "<tun_max> tuples enumerating ranges of GRE "
-                                  "tunnel IDs that are available for tenant "
-                                  "network allocation"),
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [],
-             "DEFAULT_VALUE"   : "",
-             "MASK_INPUT"      : False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ml2-tunnel-id-ranges",
+             "CONF_NAME": "CONFIG_NEUTRON_ML2_TUNNEL_ID_RANGES",
+             "PROMPT": ("Enter a comma separated list of <tun_min>:<tun_max> "
+                        "tuples enumerating ranges of GRE tunnel IDs that "
+                        "are available for tenant network allocation"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-ml2-vxlan-group",
-             "CONF_NAME"       : "CONFIG_NEUTRON_ML2_VXLAN_GROUP",
-             "USAGE"           : ("Multicast group for VXLAN. If unset, "
-                                  "disables VXLAN enable sending allocate "
-                                  "broadcast traffic to this multicast group. "
-                                  "When left unconfigured, will disable "
-                                  "multicast VXLAN mode. Should be an "
-                                  "Multicast IP (v4 or v6) address."),
-             "PROMPT"          : "Enter a multicast group for VXLAN",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [],
-             "DEFAULT_VALUE"   : "",
-             "MASK_INPUT"      : False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ml2-vxlan-group",
+             "CONF_NAME": "CONFIG_NEUTRON_ML2_VXLAN_GROUP",
+             "PROMPT": "Enter a multicast group for VXLAN",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-ml2-vni-ranges",
-             "CONF_NAME"       : "CONFIG_NEUTRON_ML2_VNI_RANGES",
-             "USAGE"           : ("A comma separated list of <vni_min>:"
-                                  "<vni_max> tuples enumerating ranges of "
-                                  "VXLAN VNI IDs that are available for tenant"
-                                  " network allocation. Min value is 0 and Max"
-                                  " value is 16777215."),
-             "PROMPT"          : ("Enter a comma separated list of <vni_min>:"
-                                  "<vni_max> tuples enumerating ranges of "
-                                  "VXLAN VNI IDs that are available for tenant"
-                                  " network allocation"),
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [],
-             "DEFAULT_VALUE"   : "",
-             "MASK_INPUT"      : False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-ml2-vni-ranges",
+             "CONF_NAME": "CONFIG_NEUTRON_ML2_VNI_RANGES",
+             "PROMPT": ("Enter a comma separated list of <vni_min>:<vni_max> "
+                        "tuples enumerating ranges of VXLAN VNI IDs that are "
+                        "available for tenant network allocation"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "10:100",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "neutron-l2-agent", # We need to ask for this only in case of ML2 plugins
-             "USAGE"           : "The name of the L2 agent to be used with Neutron",
-             "PROMPT"          : "Enter the name of the L2 agent to be used with Neutron",
-             "OPTION_LIST"     : ["linuxbridge", "openvswitch"],
-             "VALIDATORS"      : [validators.validate_options],
-             "DEFAULT_VALUE"   : "openvswitch",
-             "MASK_INPUT"      : False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            # We need to ask for this only in case of ML2 plugins
+            {"CMD_OPTION": "os-neutron-l2-agent",
+             "PROMPT": ("Enter the name of the L2 agent to be used "
+                        "with Neutron"),
+             "OPTION_LIST": ["openvswitch", "ovn"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "ovn",
+             "MASK_INPUT": False,
              "LOOSE_VALIDATION": False,
-             "CONF_NAME"       : "CONFIG_NEUTRON_L2_AGENT",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            ],
-        }
-
-    def use_ml2_plugin(config):
-        return (config['CONFIG_NEUTRON_INSTALL'] == 'y' and
-                config['CONFIG_NEUTRON_L2_PLUGIN'] == 'ml2')
-
-    def use_linuxbridge_plugin(config):
-        result = (config['CONFIG_NEUTRON_INSTALL'] == 'y' and
-                  config['CONFIG_NEUTRON_L2_PLUGIN'] == 'linuxbridge')
-        if result:
-            config["CONFIG_NEUTRON_L2_AGENT"] = 'linuxbridge'
-        return result
-
-    def use_linuxbridge_agent(config):
-        ml2_used = (use_ml2_plugin(config) and
-                    config["CONFIG_NEUTRON_L2_AGENT"] == 'linuxbridge')
-        return use_linuxbridge_plugin(config) or ml2_used
-
-    def use_openvswitch_plugin(config):
-        result = (config['CONFIG_NEUTRON_INSTALL'] == 'y' and
-                  config['CONFIG_NEUTRON_L2_PLUGIN'] == 'openvswitch')
-        if result:
-            config["CONFIG_NEUTRON_L2_AGENT"] = 'openvswitch'
-        return result
-
-    def use_openvswitch_plugin_tunnel(config):
-        tun_types = ('gre', 'vxlan')
-        return (use_openvswitch_plugin(config) and
-                config['CONFIG_NEUTRON_OVS_TENANT_NETWORK_TYPE'] in tun_types)
-
-    def use_ml2_with_ovs(config):
-        return (use_ml2_plugin(config) and
-                config["CONFIG_NEUTRON_L2_AGENT"] == 'openvswitch')
-
-    def use_openvswitch_agent(config):
-        return use_openvswitch_plugin(config) or use_ml2_with_ovs(config)
-
-    def use_openvswitch_agent_tunnel(config):
-        return use_openvswitch_plugin_tunnel(config) or use_ml2_with_ovs(config)
-
-    def use_openvswitch_vxlan(config):
-        ovs_vxlan = (
-            use_openvswitch_plugin_tunnel(config) and
-            config['CONFIG_NEUTRON_OVS_TENANT_NETWORK_TYPE'] == 'vxlan'
-        )
-        ml2_vxlan = (
-            use_ml2_with_ovs(config) and
-            'vxlan' in config['CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES']
-        )
-        return ovs_vxlan or ml2_vxlan
-
-
+             "CONF_NAME": "CONFIG_NEUTRON_L2_AGENT",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "MESSAGE": ("You have chosen OVN Neutron backend. Note that this backend does not support the VPNaaS plugin. "
+                         "Geneve will be used as the encapsulation method for tenant networks"),
+             "MESSAGE_VALUES": ["ovn"]},
+
+            {"CMD_OPTION": "os-neutron-ml2-sriov-interface-mappings",
+             "PROMPT": ("Enter a comma separated list of interface mappings "
+                        "for the Neutron ML2 sriov agent"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_NEUTRON_ML2_SRIOV_INTERFACE_MAPPINGS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+    }
+    update_params_usage(basedefs.PACKSTACK_DOC, conf_params)
     conf_groups = [
-        { "GROUP_NAME"            : "NEUTRON",
-          "DESCRIPTION"           : "Neutron config",
-          "PRE_CONDITION"         : "CONFIG_NEUTRON_INSTALL",
-          "PRE_CONDITION_MATCH"   : "y",
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        { "GROUP_NAME"            : "NEUTRON_ML2_PLUGIN",
-          "DESCRIPTION"           : "Neutron ML2 plugin config",
-          "PRE_CONDITION"         : use_ml2_plugin,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        { "GROUP_NAME"            : "NEUTRON_LB_PLUGIN",
-          "DESCRIPTION"           : "Neutron LB plugin config",
-          "PRE_CONDITION"         : use_linuxbridge_plugin,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        { "GROUP_NAME"            : "NEUTRON_LB_PLUGIN_AND_AGENT",
-          "DESCRIPTION"           : "Neutron LB agent config",
-          "PRE_CONDITION"         : use_linuxbridge_agent,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        { "GROUP_NAME"            : "NEUTRON_OVS_PLUGIN",
-          "DESCRIPTION"           : "Neutron OVS plugin config",
-          "PRE_CONDITION"         : use_openvswitch_plugin,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        { "GROUP_NAME"            : "NEUTRON_OVS_PLUGIN_AND_AGENT",
-          "DESCRIPTION"           : "Neutron OVS agent config",
-          "PRE_CONDITION"         : use_openvswitch_agent,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        { "GROUP_NAME"            : "NEUTRON_OVS_PLUGIN_TUNNEL",
-          "DESCRIPTION"           : "Neutron OVS plugin config for tunnels",
-          "PRE_CONDITION"         : use_openvswitch_plugin_tunnel,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        { "GROUP_NAME"            : "NEUTRON_OVS_PLUGIN_AND_AGENT_TUNNEL",
-          "DESCRIPTION"           : "Neutron OVS agent config for tunnels",
-          "PRE_CONDITION"         : use_openvswitch_agent_tunnel,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        { "GROUP_NAME"            : "NEUTRON_OVS_PLUGIN_AND_AGENT_VXLAN",
-          "DESCRIPTION"           : "Neutron OVS agent config for VXLAN",
-          "PRE_CONDITION"         : use_openvswitch_vxlan,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        ]
-
+        {"GROUP_NAME": "NEUTRON",
+         "DESCRIPTION": "Neutron config",
+         "PRE_CONDITION": "CONFIG_NEUTRON_INSTALL",
+         "PRE_CONDITION_MATCH": "y",
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "NEUTRON_ML2_PLUGIN",
+         "DESCRIPTION": "Neutron ML2 plugin config",
+         "PRE_CONDITION": neutron_install,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "NEUTRON_OVS_AGENT",
+         "DESCRIPTION": "Neutron OVS agent config",
+         "PRE_CONDITION": use_ml2_with_ovs,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "NEUTRON_OVS_AGENT_TUNNEL",
+         "DESCRIPTION": "Neutron OVS agent config for tunnels",
+         "PRE_CONDITION": use_ml2_with_ovs,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "NEUTRON_OVS_AGENT_VXLAN",
+         "DESCRIPTION": "Neutron OVS agent config for VXLAN",
+         "PRE_CONDITION": use_openvswitch_vxlan,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "NEUTRON_OVN_AGENT",
+         "DESCRIPTION": "Neutron OVN agent config",
+         "PRE_CONDITION": use_ml2_with_ovn,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "NEUTRON_OVN_AGENT_TUNNEL",
+         "DESCRIPTION": "Neutron OVN agent config for tunnels",
+         "PRE_CONDITION": use_ml2_with_ovn,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+    ]
     for group in conf_groups:
-        paramList = conf_params[group["GROUP_NAME"]]
-        controller.addGroup(group, paramList)
-
-
-def get_if_driver(config):
-    agent = config['CONFIG_NEUTRON_L2_AGENT']
-    if agent == "openvswitch":
-        return 'neutron.agent.linux.interface.OVSInterfaceDriver'
-    elif agent == 'linuxbridge':
-        return 'neutron.agent.linux.interface.BridgeInterfaceDriver'
+        params = conf_params[group["GROUP_NAME"]]
+        controller.addGroup(group, params)
 
 
 def initSequences(controller):
     config = controller.CONF
     if config['CONFIG_NEUTRON_INSTALL'] != 'y':
+        if config['CONFIG_NOVA_INSTALL'] == 'y':
+            raise RuntimeError('Neutron is required to install Nova properly. '
+                               'Please set CONFIG_NEUTRON_INSTALL=y')
         return
 
-    if config['CONFIG_NEUTRON_L2_PLUGIN'] == 'openvswitch':
-        plugin_db = 'ovs_neutron'
-        plugin_path = ('neutron.plugins.openvswitch.ovs_neutron_plugin.'
-                       'OVSNeutronPluginV2')
-    elif config['CONFIG_NEUTRON_L2_PLUGIN'] == 'linuxbridge':
-        plugin_db = 'neutron_linux_bridge'
-        plugin_path = ('neutron.plugins.linuxbridge.lb_neutron_plugin.'
-                       'LinuxBridgePluginV2')
-    elif config['CONFIG_NEUTRON_L2_PLUGIN'] == 'ml2':
-        plugin_db = 'neutron'
-        plugin_path = 'neutron.plugins.ml2.plugin.Ml2Plugin'
-        # values modification
-        for key in ('CONFIG_NEUTRON_ML2_TYPE_DRIVERS',
-                    'CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES',
-                    'CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS',
-                    'CONFIG_NEUTRON_ML2_FLAT_NETWORKS',
-                    'CONFIG_NEUTRON_ML2_VLAN_RANGES',
-                    'CONFIG_NEUTRON_ML2_TUNNEL_ID_RANGES',
-                    'CONFIG_NEUTRON_ML2_VNI_RANGES'):
-            config[key] = str([i.strip() for i in config[key].split(',') if i])
-        key = 'CONFIG_NEUTRON_ML2_VXLAN_GROUP'
-        config[key] = "'%s'" % config[key] if config[key] else 'undef'
-
-    config['CONFIG_NEUTRON_L2_DBNAME']  = plugin_db
+    has_ovs = 'openvswitch' in config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS']
+    has_ovn = 'ovn' in config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS']
+
+    if config['CONFIG_IRONIC_INSTALL'] == 'y':
+        config['CONFIG_NEUTRON_ML2_TYPE_DRIVERS'] += ', flat'
+        config['CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES'] += ', flat'
+        if not has_ovs:
+            config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS'] += ', openvswitch'
+        config['CONFIG_NEUTRON_ML2_FLAT_NETWORKS'] = 'extnet'
+
+    if use_ml2_with_sriovnicswitch(config):
+        if not has_ovs:
+            config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS'] += ', openvswitch'
+
+    if use_ml2_with_ovn(config):
+        if not has_ovn:
+            config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS'] = 'ovn'
+        # OVN only supports geneve encapsulation
+        if ('geneve' not in config['CONFIG_NEUTRON_ML2_TYPE_DRIVERS']):
+            config['CONFIG_NEUTRON_ML2_TYPE_DRIVERS'] += ', geneve'
+        config['CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES'] = 'geneve'
+        # VPNaaS is not supported with OVN
+        config['CONFIG_NEUTRON_VPNAAS'] = 'n'
+        config['CONFIG_NEUTRON_METERING_AGENT_INSTALL'] = 'n'
+        # When using OVN we need to create the same L2 infrastucture as
+        # for OVS, so I'm copying value for required variables and use
+        # the same logic
+        ovs_tunnel_sub = 'CONFIG_NEUTRON_OVS_TUNNEL_SUBNETS'
+        ovn_tunnel_sub = 'CONFIG_NEUTRON_OVN_TUNNEL_SUBNETS'
+        config[ovs_tunnel_sub] = config[ovn_tunnel_sub]
+        ovs_tunnel_if = 'CONFIG_NEUTRON_OVS_TUNNEL_IF'
+        ovn_tunnel_if = 'CONFIG_NEUTRON_OVN_TUNNEL_IF'
+        config[ovs_tunnel_if] = config[ovn_tunnel_if]
+        ovs_mappings = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS'
+        ovn_mappings = 'CONFIG_NEUTRON_OVN_BRIDGE_MAPPINGS'
+        config[ovs_mappings] = config[ovn_mappings]
+        ovs_ifaces = 'CONFIG_NEUTRON_OVS_BRIDGE_IFACES'
+        ovn_ifaces = 'CONFIG_NEUTRON_OVN_BRIDGE_IFACES'
+        config[ovs_ifaces] = config[ovn_ifaces]
+        ovs_compute = 'CONFIG_NEUTRON_OVS_BRIDGES_COMPUTE'
+        ovn_compute = 'CONFIG_NEUTRON_OVN_BRIDGES_COMPUTE'
+        config[ovs_compute] = config[ovn_compute]
+        ovs_external = 'CONFIG_NEUTRON_OVS_EXTERNAL_PHYSNET'
+        ovn_external = 'CONFIG_NEUTRON_OVN_EXTERNAL_PHYSNET'
+        config[ovs_external] = config[ovn_external]
+    elif use_ml2_with_ovs(config):
+        if not has_ovs:
+            config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS'] = 'openvswitch'
+
+    plugin_db = 'neutron'
+    plugin_path = 'neutron.plugins.ml2.plugin.Ml2Plugin'
+    # values modification
+    for key in ('CONFIG_NEUTRON_ML2_TYPE_DRIVERS',
+                'CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES',
+                'CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS',
+                'CONFIG_NEUTRON_ML2_FLAT_NETWORKS',
+                'CONFIG_NEUTRON_ML2_VLAN_RANGES',
+                'CONFIG_NEUTRON_ML2_TUNNEL_ID_RANGES',
+                'CONFIG_NEUTRON_ML2_VNI_RANGES'):
+        if config[key] == '':
+            config[key] = []
+        else:
+            config[key] = [i.strip() for i in config[key].split(',') if i]
+    key = 'CONFIG_NEUTRON_ML2_VXLAN_GROUP'
+    config[key] = "%s" % config[key] if config[key] else ''
+
+    config['CONFIG_NEUTRON_L2_DBNAME'] = plugin_db
     config['CONFIG_NEUTRON_CORE_PLUGIN'] = plugin_path
 
-    global api_hosts, l3_hosts, dhcp_hosts, lbaas_hosts, compute_hosts, meta_hosts, q_hosts
-    api_hosts = split_hosts(config['CONFIG_NEUTRON_SERVER_HOST'])
-    l3_hosts = split_hosts(config['CONFIG_NEUTRON_L3_HOSTS'])
-    dhcp_hosts = split_hosts(config['CONFIG_NEUTRON_DHCP_HOSTS'])
-    lbaas_hosts = split_hosts(config['CONFIG_NEUTRON_LBAAS_HOSTS'])
-    meta_hosts = split_hosts(config['CONFIG_NEUTRON_METADATA_HOSTS'])
+    global api_hosts, network_hosts, compute_hosts, q_hosts
+    api_hosts = split_hosts(config['CONFIG_CONTROLLER_HOST'])
+    network_hosts = split_hosts(config['CONFIG_NETWORK_HOSTS'])
     compute_hosts = set()
     if config['CONFIG_NOVA_INSTALL'] == 'y':
-        compute_hosts = split_hosts(config['CONFIG_NOVA_COMPUTE_HOSTS'])
-    q_hosts = api_hosts | l3_hosts | dhcp_hosts | lbaas_hosts | compute_hosts | meta_hosts
+        compute_hosts = split_hosts(config['CONFIG_COMPUTE_HOSTS'])
+    q_hosts = api_hosts | network_hosts | compute_hosts
 
     neutron_steps = [
-        {'title': 'Adding Neutron API manifest entries',
+        {'title': 'Preparing Neutron API entries',
          'functions': [create_manifests]},
-        {'title': 'Adding Neutron Keystone manifest entries',
-         'functions': [create_keystone_manifest]},
-        {'title': 'Adding Neutron L3 manifest entries',
+        {'title': 'Preparing Neutron L3 entries',
          'functions': [create_l3_manifests]},
-        {'title': 'Adding Neutron L2 Agent manifest entries',
+        {'title': 'Preparing Neutron L2 Agent entries',
          'functions': [create_l2_agent_manifests]},
-        {'title': 'Adding Neutron DHCP Agent manifest entries',
+        {'title': 'Preparing Neutron DHCP Agent entries',
          'functions': [create_dhcp_manifests]},
-        {'title': 'Adding Neutron LBaaS Agent manifest entries',
-         'functions': [create_lbaas_manifests]},
-        {'title': 'Adding Neutron Metadata Agent manifest entries',
-         'functions': [create_metadata_manifests]},
+        {'title': 'Preparing Neutron Metering Agent entries',
+         'functions': [create_metering_agent_manifests]},
+        {'title': 'Checking if NetworkManager is enabled and running',
+         'functions': [check_nm_status]},
     ]
     controller.addSequence("Installing OpenStack Neutron", [], [],
                            neutron_steps)
 
 
-def create_manifests(config):
-    global q_hosts
+# ------------------------- helper functions -------------------------
 
-    service_plugins = []
-    if config['CONFIG_NEUTRON_LBAAS_HOSTS']:
-        service_plugins.append(
-            'neutron.services.loadbalancer.plugin.LoadBalancerPlugin'
-        )
-    if config['CONFIG_NEUTRON_L2_PLUGIN'] == 'ml2':
-        # ML2 uses the L3 Router service plugin to implement l3 agent
-        service_plugins.append(
-            'neutron.services.l3_router.l3_router_plugin.L3RouterPlugin'
-        )
+def neutron_install(config):
+    return config['CONFIG_NEUTRON_INSTALL'] == 'y'
 
-    config['SERVICE_PLUGINS'] = (str(service_plugins) if service_plugins
-                                 else 'undef')
 
-    if config['CONFIG_NEUTRON_L2_PLUGIN'] == 'openvswitch':
-        nettype = config.get("CONFIG_NEUTRON_OVS_TENANT_NETWORK_TYPE", "local")
-        plugin_manifest = 'neutron_ovs_plugin_%s.pp' % nettype
-    elif config['CONFIG_NEUTRON_L2_PLUGIN'] == 'linuxbridge':
-        plugin_manifest = 'neutron_lb_plugin.pp'
-    elif config['CONFIG_NEUTRON_L2_PLUGIN'] == 'ml2':
-        plugin_manifest = 'neutron_ml2_plugin.pp'
-
-    # host to which allow neutron server
-    allowed_hosts = set(q_hosts)
-    if config['CONFIG_CLIENT_INSTALL'] == 'y':
-        allowed_hosts.add(config['CONFIG_OSCLIENT_HOST'])
-    if config['CONFIG_HORIZON_INSTALL'] == 'y':
-        allowed_hosts.add(config['CONFIG_HORIZON_HOST'])
-    if config['CONFIG_NOVA_INSTALL'] == 'y':
-        allowed_hosts.add(config['CONFIG_NOVA_API_HOST'])
+def use_ml2_with_ovs(config):
+    return (neutron_install(config) and
+            config["CONFIG_NEUTRON_L2_AGENT"] == 'openvswitch')
 
-    config['FIREWALL_SERVICE_NAME'] = "neutron server"
-    config['FIREWALL_PORTS'] = "'9696'"
-    config['FIREWALL_CHAIN'] = "INPUT"
 
-    for host in q_hosts:
-        manifest_file = "%s_neutron.pp" % (host,)
-        manifest_data = getManifestTemplate("neutron.pp")
-        manifest_data += getManifestTemplate(get_mq(config, "neutron"))
-        appendManifestFile(manifest_file, manifest_data, 'neutron')
+def use_ml2_with_ovn(config):
+    return (neutron_install(config) and
+            config["CONFIG_NEUTRON_L2_AGENT"] == 'ovn')
+
+
+def use_openvswitch_vxlan(config):
+    ml2_vxlan = (
+        use_ml2_with_ovs(config) and
+        'vxlan' in config['CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES']
+    )
+    return ml2_vxlan
 
-        if host in api_hosts:
-            manifest_file = "%s_neutron.pp" % (host,)
-            manifest_data = getManifestTemplate("neutron_api.pp")
-            manifest_data += getManifestTemplate("neutron_notifications.pp")
 
-            # Firewall Rules
-            for f_host in allowed_hosts:
-                config['FIREWALL_ALLOWED'] = "'%s'" % f_host
-                config['FIREWALL_SERVICE_ID'] = "neutron_server_%s_%s" % (host, f_host)
-                manifest_data += getManifestTemplate("firewall.pp")
+def use_openvswitch_gre(config):
+    ml2_vxlan = (
+        use_ml2_with_ovs(config) and
+        'gre' in config['CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES']
+    )
+    return ml2_vxlan
 
-            appendManifestFile(manifest_file, manifest_data, 'neutron')
 
-        # Set up any l2 plugin configs we need anywhere we install neutron
-        # XXX I am not completely sure about this, but it seems necessary:
-        manifest_data = getManifestTemplate(plugin_manifest)
-        appendManifestFile(manifest_file, manifest_data, 'neutron')
+def use_ovn_geneve(config):
+    ml2_vxlan = (
+        use_ml2_with_ovn(config) and
+        'geneve' in config['CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES']
+    )
+    return ml2_vxlan
 
 
-def create_keystone_manifest(config):
-    manifestfile = "%s_keystone.pp" % config['CONFIG_KEYSTONE_HOST']
-    manifestdata = getManifestTemplate("keystone_neutron.pp")
-    appendManifestFile(manifestfile, manifestdata)
+def use_ml2_with_sriovnicswitch(config):
+    ml2_sriovnic = (
+        use_ml2_with_ovs(config) and
+        'sriovnicswitch' in config['CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS']
+    )
+    return ml2_sriovnic
+
+
+def get_if_driver(config):
+    agent = config['CONFIG_NEUTRON_L2_AGENT']
+    if agent == "openvswitch":
+        return 'neutron.agent.linux.interface.OVSInterfaceDriver'
+    else:
+        # OVN does not provides a interface driver
+        return ''
 
 
 def find_mapping(haystack, needle):
     return needle in [x.split(':')[1].strip() for x in get_values(haystack)]
 
 
-def create_l3_manifests(config):
-    global l3_hosts
+def get_values(val):
+    return [x.strip() for x in val.split(',')] if val else []
+
+
+def tunnel_fw_details(config, host, src, fw_details):
+    key = "neutron_tunnel_%s_%s" % (host, src)
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "%s" % src
+    fw_details[key]['service_name'] = "neutron tunnel port"
+    fw_details[key]['chain'] = "INPUT"
+    if use_openvswitch_vxlan(config):
+        fw_details[key]['proto'] = 'udp'
+        tun_port = ("%s" % config['CONFIG_NEUTRON_OVS_VXLAN_UDP_PORT'])
+    elif use_ovn_geneve(config):
+        fw_details[key]['proto'] = 'udp'
+        tun_port = "6081"
+    else:
+        fw_details[key]['proto'] = 'gre'
+        tun_port = None
+    fw_details[key]['ports'] = tun_port
+
+
+# -------------------------- step functions --------------------------
+
+def create_manifests(config, messages):
+    global q_hosts
+
+    service_plugins = ['qos', 'trunk']
+    service_providers = []
+
+    if use_ml2_with_ovn(config):
+        service_plugins.append('ovn-router')
+    else:
+        # ML2 uses the L3 Router service plugin to implement l3 agent for ovs
+        service_plugins.append('router')
+
+    if config['CONFIG_NEUTRON_METERING_AGENT_INSTALL'] == 'y':
+        service_plugins.append('metering')
+
+    if config['CONFIG_NEUTRON_VPNAAS'] == 'y':
+        service_plugins.append('vpnaas')
+        vpnaas_sp = ('VPN:libreswan:neutron_vpnaas.services.vpn.'
+                     'service_drivers.ipsec.IPsecVPNDriver:default')
+        service_providers.append(vpnaas_sp)
+
+    config['SERVICE_PLUGINS'] = (service_plugins if service_plugins
+                                 else 'undef')
+
+    config['SERVICE_PROVIDERS'] = (service_providers if service_providers
+                                   else [])
+
+    config['FIREWALL_DRIVER'] = ("neutron.agent.linux.iptables_firewall."
+                                 "OVSHybridIptablesFirewallDriver")
+
+    if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+        ssl_cert_file = config['CONFIG_NEUTRON_SSL_CERT'] = (
+            '/etc/pki/tls/certs/ssl_amqp_neutron.crt'
+        )
+        ssl_key_file = config['CONFIG_NEUTRON_SSL_KEY'] = (
+            '/etc/pki/tls/private/ssl_amqp_neutron.key'
+        )
+        service = 'neutron'
+
+    for host in q_hosts:
+        if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+            generate_ssl_cert(config, host, service, ssl_key_file,
+                              ssl_cert_file)
+
+        if host in api_hosts:
+            # Firewall
+            fw_details = dict()
+            key = "neutron_server_%s" % host
+            fw_details.setdefault(key, {})
+            fw_details[key]['host'] = "ALL"
+            fw_details[key]['service_name'] = "neutron server"
+            fw_details[key]['chain'] = "INPUT"
+            fw_details[key]['ports'] = ['9696']
+            fw_details[key]['proto'] = "tcp"
+            if use_ml2_with_ovn(config):
+                key = "ovn_northd_%s" % host
+                fw_details.setdefault(key, {})
+                fw_details[key]['host'] = "ALL"
+                fw_details[key]['service_name'] = "ovn northd"
+                fw_details[key]['chain'] = "INPUT"
+                fw_details[key]['ports'] = ['6641']
+                fw_details[key]['proto'] = "tcp"
+                key = "ovn_southd_%s" % host
+                fw_details.setdefault(key, {})
+                fw_details[key]['host'] = "ALL"
+                fw_details[key]['service_name'] = "ovn southd"
+                fw_details[key]['chain'] = "INPUT"
+                fw_details[key]['ports'] = ['6642']
+                fw_details[key]['proto'] = "tcp"
+            config['FIREWALL_NEUTRON_SERVER_RULES'] = fw_details
+
+        # We also need to open VXLAN/GRE port for agent
+        if (use_openvswitch_vxlan(config) or use_openvswitch_gre(config) or
+                use_ovn_geneve(config)):
+            if config['CONFIG_IP_VERSION'] == 'ipv6':
+                msg = output_messages.WARN_IPV6_OVS
+                messages.append(utils.color_text(msg % host, 'red'))
+            fw_details = dict()
+            if (config['CONFIG_NEUTRON_OVS_TUNNEL_SUBNETS']):
+                tunnel_subnets = map(
+                    str.strip,
+                    config['CONFIG_NEUTRON_OVS_TUNNEL_SUBNETS'].split(',')
+                )
+                cf_fw_nt_key = ("FIREWALL_NEUTRON_TUNNEL_RULES_%s" %
+                                host.replace('.', '_'))
+                for subnet in tunnel_subnets:
+                    tunnel_fw_details(config, host, subnet, fw_details)
+                config[cf_fw_nt_key] = fw_details
+            else:
+                cf_fw_nt_key = ("FIREWALL_NEUTRON_TUNNEL_RULES_%s" %
+                                host.replace('.', '_'))
+                for n_host in network_hosts | compute_hosts:
+                    if config['CONFIG_NEUTRON_OVS_TUNNEL_IF']:
+                        if config['CONFIG_USE_SUBNETS'] == 'y':
+                            iface = common.cidr_to_ifname(
+                                config['CONFIG_NEUTRON_OVS_TUNNEL_IF'],
+                                n_host, config)
+                        else:
+                            iface = config['CONFIG_NEUTRON_OVS_TUNNEL_IF']
+                        try:
+                            src_host = (netifaces.ifaddresses(iface)
+                                        [netifaces.AF_INET][0]['addr'])
+                        except Exception:
+                            raise KeyError('Couldn\'t detect ipaddress of '
+                                           'interface %s on node %s' %
+                                           (iface, n_host))
+                    else:
+                        src_host = n_host
+                    tunnel_fw_details(config, host, src_host, fw_details)
+                config[cf_fw_nt_key] = fw_details
+
+
+def create_l3_manifests(config, messages):
+    global network_hosts
 
-    plugin = config['CONFIG_NEUTRON_L2_PLUGIN']
     if config['CONFIG_NEUTRON_L3_EXT_BRIDGE'] == 'provider':
         config['CONFIG_NEUTRON_L3_EXT_BRIDGE'] = ''
 
-    for host in l3_hosts:
+    for host in network_hosts:
         config['CONFIG_NEUTRON_L3_HOST'] = host
         config['CONFIG_NEUTRON_L3_INTERFACE_DRIVER'] = get_if_driver(config)
-        manifestdata = getManifestTemplate("neutron_l3.pp")
-        manifestfile = "%s_neutron.pp" % (host,)
-        appendManifestFile(manifestfile, manifestdata + '\n')
-        if (config['CONFIG_NEUTRON_L2_PLUGIN'] == 'openvswitch' and
-                config['CONFIG_NEUTRON_L3_EXT_BRIDGE'] and
-                not find_mapping(config['CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS'],
-                                 config['CONFIG_NEUTRON_L3_EXT_BRIDGE'])):
-            config['CONFIG_NEUTRON_OVS_BRIDGE'] = config['CONFIG_NEUTRON_L3_EXT_BRIDGE']
-            manifestdata = getManifestTemplate('neutron_ovs_bridge.pp')
-            appendManifestFile(manifestfile, manifestdata + '\n')
 
+        if (config['CONFIG_NEUTRON_L2_AGENT'] == 'openvswitch' or
+                config['CONFIG_NEUTRON_L2_AGENT'] == 'ovn'):
+            ext_bridge = config['CONFIG_NEUTRON_L3_EXT_BRIDGE']
+            mapping = find_mapping(
+                config['CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS'],
+                ext_bridge) if ext_bridge else None
+            if (ext_bridge and not mapping):
+                config['CONFIG_NEUTRON_OVS_BRIDGE'] = ext_bridge
+                config['CONFIG_NEUTRON_OVS_BRIDGE_CREATE'] = 'y'
+            else:
+                config['CONFIG_NEUTRON_OVS_BRIDGE_CREATE'] = 'n'
+        else:
+            config['CONFIG_NEUTRON_OVS_BRIDGE_CREATE'] = 'n'
 
-def create_dhcp_manifests(config):
-    global dhcp_hosts
 
-    plugin = config['CONFIG_NEUTRON_L2_PLUGIN']
+def create_dhcp_manifests(config, messages):
+    if use_ml2_with_ovn(config):
+        return
 
-    for host in dhcp_hosts:
+    global network_hosts
+    for host in network_hosts:
         config["CONFIG_NEUTRON_DHCP_HOST"] = host
         config['CONFIG_NEUTRON_DHCP_INTERFACE_DRIVER'] = get_if_driver(config)
-        manifest_data = getManifestTemplate("neutron_dhcp.pp")
-        manifest_file = "%s_neutron.pp" % (host,)
-
-        # Firewall Rules
-        for f_host in q_hosts:
-            config['FIREWALL_ALLOWED'] = "'%s'" % f_host
-            config['FIREWALL_SERVICE_NAME'] = "neutron dhcp in"
-            config['FIREWALL_SERVICE_ID'] = "neutron_dhcp_in_%s_%s" % (host, f_host)
-            config['FIREWALL_PORTS'] = "'67'"
-            config['FIREWALL_CHAIN'] = "INPUT"
-            manifest_data += getManifestTemplate("firewall.pp")
-            config['FIREWALL_SERVICE_NAME'] = "neutron dhcp out"
-            config['FIREWALL_SERVICE_ID'] = "neutron_dhcp_out_%s_%s" % (host, f_host)
-            config['FIREWALL_PORTS'] = "'68'"
-            config['FIREWALL_CHAIN'] = "OUTPUT"
-            manifest_data += getManifestTemplate("firewall.pp")
-
-        appendManifestFile(manifest_file, manifest_data, 'neutron')
-
-
-
-def create_lbaas_manifests(config):
-    global lbaas_hosts
-    for host in lbaas_hosts:
-        controller.CONF['CONFIG_NEUTRON_LBAAS_INTERFACE_DRIVER'] = get_if_driver(config)
-        manifestdata = getManifestTemplate("neutron_lbaas.pp")
-        manifestfile = "%s_neutron.pp" % (host,)
-        appendManifestFile(manifestfile, manifestdata + "\n")
 
+        # Firewall Rules for dhcp in
+        fw_details = dict()
+        key = "neutron_dhcp_in_%s" % host
+        fw_details.setdefault(key, {})
+        fw_details[key]['host'] = "ALL"
+        fw_details[key]['service_name'] = "neutron dhcp in"
+        fw_details[key]['chain'] = "INPUT"
+        fw_details[key]['ports'] = ['67']
+        fw_details[key]['proto'] = "udp"
+        config['FIREWALL_NEUTRON_DHCPIN_RULES'] = fw_details
+
+        # Firewall Rules for dhcp out
+        fw_details = dict()
+        key = "neutron_dhcp_out_%s" % host
+        fw_details.setdefault(key, {})
+        fw_details[key]['host'] = "ALL"
+        fw_details[key]['service_name'] = "neutron dhcp out"
+        fw_details[key]['chain'] = "OUTPUT"
+        fw_details[key]['ports'] = ['68']
+        fw_details[key]['proto'] = "udp"
+        config['FIREWALL_NEUTRON_DHCPOUT_RULES'] = fw_details
+
+
+def create_metering_agent_manifests(config, messages):
+    if use_ml2_with_ovn(config):
+        return
+    global network_hosts
 
-def get_values(val):
-    return [x.strip() for x in val.split(',')] if val else []
+    if not config['CONFIG_NEUTRON_METERING_AGENT_INSTALL'] == 'y':
+        return
 
-def get_agent_type(config):
-    # The only real use case I can think of for multiples right now is to list
-    # "vlan,gre" or "vlan,vxlan" so that VLANs are used if available,
-    # but tunnels are used if not.
-    tenant_types = config.get('CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES',
-                              "['local']").strip('[]')
-    tenant_types = [i.strip('"\'') for i in tenant_types.split(',')]
+    for host in network_hosts:
+        config['CONFIG_NEUTRON_METERING_IFCE_DRIVER'] = get_if_driver(config)
 
-    for i in ['gre', 'vxlan', 'vlan']:
-        if i in tenant_types:
-            return i
-    return tenant_types[0]
 
-def create_l2_agent_manifests(config):
-    global api_hosts, compute_hosts, dhcp_host, l3_hosts
+def create_l2_agent_manifests(config, messages):
+    global network_hosts, compute_hosts
 
-    plugin = config['CONFIG_NEUTRON_L2_PLUGIN']
     agent = config["CONFIG_NEUTRON_L2_AGENT"]
 
-    if agent == "openvswitch":
-        host_var = 'CONFIG_NEUTRON_OVS_HOST'
-        if plugin == agent:
-            # monolithic plugin installation
-            ovs_type = 'CONFIG_NEUTRON_OVS_TENANT_NETWORK_TYPE'
-            ovs_type = config.get(ovs_type, 'local')
-        elif plugin == 'ml2':
-            ovs_type = get_agent_type(config)
-        else:
-            raise RuntimeError('Invalid combination of plugin and agent.')
-        template_name = "neutron_ovs_agent_%s.pp" % ovs_type
+    # CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS will be available only for ML2
+    # plugin deployment, but we need CONFIG_NEUTRON_USE_L2POPULATION also
+    # for other plugin template generation
+    if ('l2population' in
+            config.get('CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS', [])):
+        config['CONFIG_NEUTRON_USE_L2POPULATION'] = True
+    else:
+        config['CONFIG_NEUTRON_USE_L2POPULATION'] = False
+
+    if agent in ["openvswitch", "ovn"]:
+        ovs_type = 'CONFIG_NEUTRON_ML2_TYPE_DRIVERS'
+        ovs_type = config.get(ovs_type, 'local')
+        tunnel_types = set(ovs_type) & set(['gre', 'vxlan'])
+        config["CONFIG_NEUTRON_OVS_TUNNEL_TYPES"] = list(tunnel_types)
 
         bm_arr = get_values(config["CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS"])
         iface_arr = get_values(config["CONFIG_NEUTRON_OVS_BRIDGE_IFACES"])
 
         # The CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS parameter contains a
         # comma-separated list of bridge mappings. Since the puppet module
-        # expects this parameter to be an array, this parameter must be properly
-        # formatted by packstack, then consumed by the puppet module.
-        # For example, the input string 'A, B, C' should formatted as '['A','B','C']'.
-        config["CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS"] = str(bm_arr)
-    elif agent == "linuxbridge":
-        host_var = 'CONFIG_NEUTRON_LB_HOST'
-        template_name = 'neutron_lb_agent.pp'
+        # expects this parameter to be an array, this parameter must be
+        # properly formatted by packstack, then consumed by the puppet module.
+        # For example, the input string 'A, B' should formatted as '['A','B']'.
+        config["CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS"] = bm_arr
+        config["CONFIG_NEUTRON_OVS_BRIDGE_IFACES"] = []
+
+        # Bridge configuration and mappings for compute nodes can be different.
+        # Parameter CONFIG_NEUTRON_OVS_BRIDGES_COMPUTE contains the list of
+        # bridge names, included in bridge mappings and bridge interfaces, that
+        # must be created in compute nodes.
+        brd_arr_cmp = get_values(config["CONFIG_NEUTRON_OVS_BRIDGES_COMPUTE"])
+        if_arr_cmp = []
+        mapp_arr_cmp = []
+        for brd in brd_arr_cmp:
+            if_arr_cmp.append(common.find_pair_with(iface_arr, brd, 0))
+            mapp_arr_cmp.append(common.find_pair_with(bm_arr, brd, 1))
+
+        config["CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS_COMPUTE"] = mapp_arr_cmp
+        config["CONFIG_NEUTRON_OVS_BRIDGE_IFACES_COMPUTE"] = []
+        no_local_types = set(ovs_type) & set(['gre', 'vxlan', 'vlan', 'flat'])
+        no_tunnel_types = set(ovs_type) & set(['vlan', 'flat'])
     else:
         raise KeyError("Unknown layer2 agent")
 
-    # Install l2 agents on every compute host in addition to any hosts listed
-    # specifically for the l2 agent
-    for host in api_hosts | compute_hosts | dhcp_hosts | l3_hosts:
-        config[host_var] = host
-        manifestfile = "%s_neutron.pp" % (host,)
-        manifestdata = getManifestTemplate(template_name)
-        appendManifestFile(manifestfile, manifestdata + "\n")
-        if agent == "openvswitch" and ovs_type == 'vlan':
-            for if_map in iface_arr:
-                config['CONFIG_NEUTRON_OVS_BRIDGE'], config['CONFIG_NEUTRON_OVS_IFACE'] = if_map.split(':')
-                manifestdata = getManifestTemplate("neutron_ovs_port.pp")
-                appendManifestFile(manifestfile, manifestdata + "\n")
-        # Additional configurations required for compute hosts
-        if host in compute_hosts:
-            manifestdata = getManifestTemplate('neutron_bridge_module.pp')
-            appendManifestFile(manifestfile, manifestdata + '\n')
-
-
-def create_metadata_manifests(config):
-    global meta_hosts
-    if config.get('CONFIG_NOVA_INSTALL') == 'n':
-        return
-    for host in meta_hosts:
-        controller.CONF['CONFIG_NEUTRON_METADATA_HOST'] = host
-        manifestdata = getManifestTemplate('neutron_metadata.pp')
-        manifestfile = "%s_neutron.pp" % (host,)
-        appendManifestFile(manifestfile, manifestdata + "\n")
+    for host in network_hosts | compute_hosts:
+        # NICs connected to OVS bridges can be required in network nodes if
+        # vlan, flat, vxlan or gre are enabled. For compute nodes, they are
+        # only required if vlan or flat are enabled.
+        if (
+            agent in ["openvswitch", "ovn"] and (
+                (host in network_hosts and no_local_types) or no_tunnel_types)
+        ):
+            if config['CONFIG_USE_SUBNETS'] == 'y':
+                iface_arr = [
+                    common.cidr_to_ifname(i, host, config) for i in iface_arr
+                ]
+                if_arr_cmp = [
+                    common.cidr_to_ifname(i, host, config) for i in if_arr_cmp
+                ]
+            config["CONFIG_NEUTRON_OVS_BRIDGE_IFACES"] = iface_arr
+            config["CONFIG_NEUTRON_OVS_BRIDGE_IFACES_COMPUTE"] = if_arr_cmp
+            config['CREATE_BRIDGES'] = 'y'
+        else:
+            config['CREATE_BRIDGES'] = 'n'
+
+
+def check_nm_status(config, messages):
+    hosts_with_nm = []
+    for host in common.filtered_hosts(config):
+        server = utils.ScriptRunner(host)
+        server.append("systemctl")
+        rc, out = server.execute(can_fail=False)
+        server.clear()
+
+        if rc < 1:
+            server.append("systemctl is-enabled NetworkManager")
+            rc, is_enabled = server.execute(can_fail=False)
+            is_enabled = is_enabled.strip("\n ")
+            server.clear()
+
+            server.append("systemctl is-active NetworkManager")
+            rc, is_active = server.execute(can_fail=False)
+            is_active = is_active.strip("\n ")
+
+            if is_enabled == "enabled" or is_active == "active":
+                hosts_with_nm.append(host)
+        else:
+            server.clear()
+            server.append("service NetworkManager status")
+            rc, out = server.execute(can_fail=False)
+
+            if rc < 1:
+                hosts_with_nm.append(host)
+
+        server.clear()
+
+    if hosts_with_nm:
+        hosts_list = ', '.join("%s" % x for x in hosts_with_nm)
+        msg = output_messages.WARN_NM_ENABLED
+        messages.append(utils.color_text(msg % hosts_list, 'yellow'))
diff --git a/packstack/plugins/nova_300.py b/packstack/plugins/nova_300.py
index 0587ca081..f0821b20b 100644
--- a/packstack/plugins/nova_300.py
+++ b/packstack/plugins/nova_300.py
@@ -1,458 +1,260 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 """
-Installs and configures nova
+Installs and configures Nova
 """
 
 import os
-import uuid
-import logging
-import platform
 import socket
 
-from packstack.installer import basedefs, processors, utils, validators
-from packstack.installer.exceptions import ScriptRuntimeError
-
-from packstack.modules.shortcuts import get_mq
-from packstack.modules.ospluginutils import NovaConfig, getManifestTemplate, appendManifestFile, manifestfiles
+from packstack.installer import basedefs
+from packstack.installer import exceptions
+from packstack.installer import processors
+from packstack.installer import utils
+from packstack.installer import validators
 
-# Controller object will be initialized from main flow
-controller = None
+from packstack.modules.common import filtered_hosts
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import deliver_ssl_file
+from packstack.modules.ospluginutils import generate_ssl_cert
 
-PLUGIN_NAME = "OS-NOVA"
+# ------------- Nova Packstack Plugin Initialization --------------
 
-logging.debug("plugin %s loaded", __name__)
+PLUGIN_NAME = "OS-Nova"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
 
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-
-    if platform.linux_distribution()[0] == "Fedora":
-        primary_netif = "em1"
-        secondary_netif = "em2"
-    else:
-        primary_netif = "eth0"
-        secondary_netif = "eth1"
 
+def initConfig(controller):
     nova_params = {
-            "NOVA" : [
-                  {"CMD_OPTION"      : "novaapi-host",
-                   "USAGE"           : "The IP address of the server on which to install the Nova API service",
-                   "PROMPT"          : "Enter the IP address of the Nova API service",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ip, validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_API_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novacert-host",
-                   "USAGE"           : "The IP address of the server on which to install the Nova Cert service",
-                   "PROMPT"          : "Enter the IP address of the Nova Cert service",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_CERT_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novavncproxy-hosts",
-                   "USAGE"           : "The IP address of the server on which to install the Nova VNC proxy",
-                   "PROMPT"          : "Enter the IP address of the Nova VNC proxy",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_VNCPROXY_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novacompute-hosts",
-                   "USAGE"           : "A comma separated list of IP addresses on which to install the Nova Compute services",
-                   "PROMPT"          : "Enter a comma separated list of IP addresses on which to install the Nova Compute services",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty, validators.validate_multi_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_COMPUTE_HOSTS",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novaconductor-host",
-                   "USAGE"           : "The IP address of the server on which to install the Nova Conductor service",
-                   "PROMPT"          : "Enter the IP address of the Nova Conductor service",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ip, validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_CONDUCTOR_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "nova-db-passwd",
-                   "USAGE"           : "The password to use for the Nova to access DB",
-                   "PROMPT"          : "Enter the password for the Nova DB access",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_NOVA_DB_PW",
-                   "USE_DEFAULT"     : True,
-                   "NEED_CONFIRM"    : True,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "nova-ks-passwd",
-                   "USAGE"           : "The password to use for the Nova to authenticate with Keystone",
-                   "PROMPT"          : "Enter the password for the Nova Keystone access",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_NOVA_KS_PW",
-                   "USE_DEFAULT"     : True,
-                   "NEED_CONFIRM"    : True,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novasched-host",
-                   "USAGE"           : "The IP address of the server on which to install the Nova Scheduler service",
-                   "PROMPT"          : "Enter the IP address of the Nova Scheduler service",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_SCHED_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novasched-cpu-allocation-ratio",
-                   "USAGE"           : "The overcommitment ratio for virtual to physical CPUs. "
-                                       "Set to 1.0 to disable CPU overcommitment",
-                   "PROMPT"          : "Enter the CPU overcommitment ratio. "
-                                       "Set to 1.0 to disable CPU overcommitment",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_float],
-                   "DEFAULT_VALUE"   : 16.0,
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_SCHED_CPU_ALLOC_RATIO",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novasched-ram-allocation-ratio",
-                   "USAGE"           : "The overcommitment ratio for virtual to physical RAM. "
-                                       "Set to 1.0 to disable RAM overcommitment",
-                   "PROMPT"          : "Enter the RAM overcommitment ratio. "
-                                       "Set to 1.0 to disable RAM overcommitment",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_float],
-                   "DEFAULT_VALUE"   : 1.5,
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_SCHED_RAM_ALLOC_RATIO",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  ],
-             "NOVA_NETWORK" : [
-                  {"CMD_OPTION"      : "novacompute-privif",
-                   "USAGE"           : "Private interface for Flat DHCP on the Nova compute servers",
-                   "PROMPT"          : "Enter the Private interface for Flat DHCP on the Nova compute servers",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : secondary_netif,
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_COMPUTE_PRIVIF",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novanetwork-hosts",
-                   "USAGE"           : "The list of IP addresses of the server on which to install the Nova Network service",
-                   "PROMPT"          : "Enter list of IP addresses on which to install the Nova Network service",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_multi_ip, validators.validate_multi_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_NETWORK_HOSTS",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novanetwork-manager",
-                   "USAGE"           : "Nova network manager",
-                   "PROMPT"          : "Enter the Nova network manager",
-                   "OPTION_LIST"     : [r'^nova\.network\.manager\.\w+Manager$'],
-                   "VALIDATORS"      : [validators.validate_regexp],
-                   "DEFAULT_VALUE"   : "nova.network.manager.FlatDHCPManager",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_NETWORK_MANAGER",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novanetwork-pubif",
-                   "USAGE"           : "Public interface on the Nova network server",
-                   "PROMPT"          : "Enter the Public interface on the Nova network server",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : primary_netif,
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_NETWORK_PUBIF",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novanetwork-privif",
-                   "USAGE"           : "Private interface for network manager on the Nova network server",
-                   "PROMPT"          : "Enter the Private interface for network manager on the Nova network server",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : secondary_netif,
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_NETWORK_PRIVIF",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novanetwork-fixed-range",
-                   "USAGE"           : "IP Range for network manager",
-                   "PROMPT"          : "Enter the IP Range for network manager",
-                   "OPTION_LIST"     : ["^[\:\.\da-fA-f]+(\/\d+){0,1}$"],
-                   "PROCESSORS"      : [processors.process_cidr],
-                   "VALIDATORS"      : [validators.validate_regexp],
-                   "DEFAULT_VALUE"   : "192.168.32.0/22",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_NETWORK_FIXEDRANGE",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novanetwork-floating-range",
-                   "USAGE"           : "IP Range for Floating IP's",
-                   "PROMPT"          : "Enter the IP Range for Floating IP's",
-                   "OPTION_LIST"     : ["^[\:\.\da-fA-f]+(\/\d+){0,1}$"],
-                   "PROCESSORS"      : [processors.process_cidr],
-                   "VALIDATORS"      : [validators.validate_regexp],
-                   "DEFAULT_VALUE"   : "10.3.4.0/22",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_NETWORK_FLOATRANGE",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novanetwork-default-floating-pool",
-                   "USAGE"           : "Name of the default floating pool to which the specified floating ranges are added to",
-                   "PROMPT"          : "What should the default floating pool be called?",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : "nova",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_NOVA_NETWORK_DEFAULTFLOATINGPOOL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novanetwork-auto-assign-floating-ip",
-                   "USAGE"           : "Automatically assign a floating IP to new instances",
-                   "PROMPT"          : "Should new instances automatically have a floating IP assigned?",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "n",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_NOVA_NETWORK_AUTOASSIGNFLOATINGIP",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  ],
-             "NOVA_NETWORK_VLAN" : [
-                  {"CMD_OPTION"      : "novanetwork-vlan-start",
-                   "USAGE"           : "First VLAN for private networks",
-                   "PROMPT"          : "Enter first VLAN for private networks",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : 100,
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_NETWORK_VLAN_START",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novanetwork-num-networks",
-                   "USAGE"           : "Number of networks to support",
-                   "PROMPT"          : "How many networks should be supported",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : 1,
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_NETWORK_NUMBER",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "novanetwork-network-size",
-                   "USAGE"           : "Number of addresses in each private subnet",
-                   "PROMPT"          : "How many addresses should be in each private subnet",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : 255,
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_NOVA_NETWORK_SIZE",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  ],
-              }
-
-    def use_nova_network(config):
-        return config['CONFIG_NOVA_INSTALL'] == 'y' and \
-               config['CONFIG_NEUTRON_INSTALL'] != 'y'
-
-    def use_nova_network_vlan(config):
-        manager = 'nova.network.manager.VlanManager'
-        return config['CONFIG_NOVA_INSTALL'] == 'y' and \
-               config['CONFIG_NEUTRON_INSTALL'] != 'y' and \
-               config['CONFIG_NOVA_NETWORK_MANAGER'] == manager
+        "NOVA": [
+            {"CMD_OPTION": 'nova-db-purge-enable',
+             "PROMPT": (
+                 "Enter y if cron job for removing soft deleted DB rows "
+                 "should be created"
+             ),
+             "OPTION_LIST": ['y', 'n'],
+             "VALIDATORS": [validators.validate_not_empty],
+             "PROCESSORS": [processors.process_bool],
+             "DEFAULT_VALUE": 'y',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_NOVA_DB_PURGE_ENABLE',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "nova-db-passwd",
+             "PROMPT": "Enter the password for the Nova DB access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_NOVA_DB_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "nova-ks-passwd",
+             "PROMPT": "Enter the password for the Nova Keystone access",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_NOVA_KS_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "nova-manage-flavors",
+             "PROMPT": (
+                 "Should Packstack manage default Nova flavors"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_NOVA_MANAGE_FLAVORS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "novasched-cpu-allocation-ratio",
+             "PROMPT": "Enter the CPU overcommitment ratio. Set to 1.0 to "
+                       "disable CPU overcommitment",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_float],
+             "DEFAULT_VALUE": 16.0,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_NOVA_SCHED_CPU_ALLOC_RATIO",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "novasched-ram-allocation-ratio",
+             "PROMPT": ("Enter the RAM overcommitment ratio. Set to 1.0 to "
+                        "disable RAM overcommitment"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_float],
+             "DEFAULT_VALUE": 1.5,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_NOVA_SCHED_RAM_ALLOC_RATIO",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "novacompute-migrate-protocol",
+             "PROMPT": ("Enter protocol which will be used for instance "
+                        "migration"),
+             "OPTION_LIST": ['tcp', 'ssh'],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": 'ssh',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "nova-ssl-cert",
+             "PROMPT": ("Enter the path to a PEM encoded certificate to be used "
+                        "on the https server, leave blank if one should be "
+                        "generated, this certificate should not require "
+                        "a passphrase"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": '',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_VNC_SSL_CERT",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "nova-ssl-key",
+             "PROMPT": ("Enter the SSL keyfile corresponding to the certificate "
+                        "if one was entered"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_VNC_SSL_KEY",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "nova-pci-alias",
+             "PROMPT": ("Enter the PCI passthrough array of hash in JSON style for controller eg. "
+                        "[{'vendor_id':'1234', 'product_id':'5678', "
+                        "'name':'default'}, {...}] "),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "[]",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_NOVA_PCI_ALIAS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "nova-pci-passthrough-whitelist",
+             "PROMPT": ("Enter the PCI passthrough whitelist as array of hash in JSON style for "
+                        "controller eg. "
+                        "[{'vendor_id':'1234', 'product_id':'5678', "
+                        "'name':'default'}, {...}]"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "[]",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_NOVA_PCI_PASSTHROUGH_WHITELIST",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "nova-libvirt-virt-type",
+             "PROMPT": (
+                 "The nova hypervisor that should be used. Either qemu or kvm."
+             ),
+             "OPTION_LIST": ['qemu', 'kvm'],
+             "DEFAULT_VALUE": '%{::default_hypervisor}',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_NOVA_LIBVIRT_VIRT_TYPE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+        ],
+    }
+    update_params_usage(basedefs.PACKSTACK_DOC, nova_params)
 
     nova_groups = [
-         {"GROUP_NAME"            : "NOVA",
-          "DESCRIPTION"           : "Nova Options",
-          "PRE_CONDITION"         : "CONFIG_NOVA_INSTALL",
-          "PRE_CONDITION_MATCH"   : "y",
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True},
-         {"GROUP_NAME"            : "NOVA_NETWORK",
-          "DESCRIPTION"           : "Nova Network Options",
-          "PRE_CONDITION"         : use_nova_network,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True},
-         {"GROUP_NAME"            : "NOVA_NETWORK_VLAN",
-          "DESCRIPTION"           : "Nova Network VLAN Options",
-          "PRE_CONDITION"         : use_nova_network_vlan,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True},
-        ]
-
+        {"GROUP_NAME": "NOVA",
+         "DESCRIPTION": "Nova Options",
+         "PRE_CONDITION": "CONFIG_NOVA_INSTALL",
+         "PRE_CONDITION_MATCH": "y",
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+    ]
     for group in nova_groups:
-        paramList = nova_params[group["GROUP_NAME"]]
-        controller.addGroup(group, paramList)
+        params = nova_params[group["GROUP_NAME"]]
+        controller.addGroup(group, params)
+
 
 def initSequences(controller):
     if controller.CONF['CONFIG_NOVA_INSTALL'] != 'y':
         return
 
     novaapisteps = [
-             {'title': 'Adding Nova API manifest entries', 'functions':[createapimanifest]},
-             {'title': 'Adding Nova Keystone manifest entries', 'functions':[createkeystonemanifest]},
-             {'title': 'Adding Nova Cert manifest entries', 'functions':[createcertmanifest]},
-             {'title': 'Adding Nova Conductor manifest entries', 'functions':[createconductormanifest]},
-             {'title': 'Creating ssh keys for Nova migration',
-              'functions':[create_ssh_keys]},
-             {'title': 'Gathering ssh host keys for Nova migration',
-              'functions':[gather_host_keys]},
-             {'title': 'Adding Nova Compute manifest entries', 'functions':[createcomputemanifest]},
-             {'title': 'Adding Nova Scheduler manifest entries', 'functions':[createschedmanifest]},
-             {'title': 'Adding Nova VNC Proxy manifest entries', 'functions':[createvncproxymanifest]},
-             {'title': 'Adding Nova Common manifest entries', 'functions':[createcommonmanifest]},
+        {'title': 'Preparing Nova API entries',
+         'functions': [create_api_manifest]},
+        {'title': 'Creating ssh keys for Nova migration',
+         'functions': [create_ssh_keys]},
+        {'title': 'Gathering ssh host keys for Nova migration',
+         'functions': [gather_host_keys]},
+        {'title': 'Preparing Nova Compute entries',
+         'functions': [create_compute_manifest]},
+        {'title': 'Preparing Nova Scheduler entries',
+         'functions': [create_sched_manifest]},
+        {'title': 'Preparing Nova VNC Proxy entries',
+         'functions': [create_vncproxy_manifest]},
+        {'title': 'Preparing OpenStack Network-related Nova entries',
+         'functions': [create_neutron_manifest]},
+        {'title': 'Preparing Nova Common entries',
+         'functions': [create_common_manifest]},
     ]
 
-    if controller.CONF['CONFIG_NEUTRON_INSTALL'] == 'y':
-        novaapisteps.append({'title': 'Adding Openstack Network-related Nova manifest entries', 'functions':[createneutronmanifest]})
-    else:
-        novaapisteps.append({'title': 'Adding Nova Network manifest entries', 'functions':[createnetworkmanifest]})
-
-    controller.addSequence("Installing OpenStack Nova API", [], [], novaapisteps)
+    controller.addSequence("Installing OpenStack Nova API", [], [],
+                           novaapisteps)
 
 
-def createapimanifest(config):
-    # Since this step is running first, let's create necesary variables here
-    # and make them global
-    global compute_hosts, network_hosts
-    com_var = config.get("CONFIG_NOVA_COMPUTE_HOSTS", "")
-    compute_hosts = set([i.strip() for i in com_var.split(",") if i.strip()])
-    net_var = config.get("CONFIG_NOVA_NETWORK_HOSTS", "")
-    network_hosts = set([i.strip() for i in net_var.split(",") if i.strip()])
-
-    # This is a hack around us needing to generate the neutron metadata
-    # password, but the nova puppet plugin uses the existence of that
-    # password to determine whether or not to configure neutron metadata
-    # proxy support. So the nova_api.pp template needs unquoted 'undef'
-    # to disable metadata support if neutron is not being installed.
-    if controller.CONF['CONFIG_NEUTRON_INSTALL'] != 'y':
-        controller.CONF['CONFIG_NEUTRON_METADATA_PW_UNQUOTED'] = 'undef'
-    else:
-        controller.CONF['CONFIG_NEUTRON_METADATA_PW_UNQUOTED'] = \
-            "'%s'" % controller.CONF['CONFIG_NEUTRON_METADATA_PW']
-    manifestfile = "%s_api_nova.pp"%controller.CONF['CONFIG_NOVA_API_HOST']
-    manifestdata = getManifestTemplate("nova_api.pp")
-    appendManifestFile(manifestfile, manifestdata, 'novaapi')
-
-
-def createkeystonemanifest(config):
-    manifestfile = "%s_keystone.pp"%controller.CONF['CONFIG_KEYSTONE_HOST']
-    manifestdata = getManifestTemplate("keystone_nova.pp")
-    appendManifestFile(manifestfile, manifestdata)
-
-
-def createcertmanifest(config):
-    manifestfile = "%s_nova.pp"%controller.CONF['CONFIG_NOVA_CERT_HOST']
-    manifestdata = getManifestTemplate("nova_cert.pp")
-    appendManifestFile(manifestfile, manifestdata)
-
-
-def createconductormanifest(config):
-    manifestfile = "%s_nova.pp"%controller.CONF['CONFIG_NOVA_CONDUCTOR_HOST']
-    manifestdata = getManifestTemplate("nova_conductor.pp")
-    appendManifestFile(manifestfile, manifestdata)
-
-
-def check_ifcfg(host, device):
-    """
-    Raises ScriptRuntimeError if given host does not have give device.
-    """
-    server = utils.ScriptRunner(host)
-    cmd = "ip addr show dev %s || ( echo Device %s does not exist && exit 1 )"
-    server.append(cmd % (device, device))
-    server.execute()
-
-
-def bring_up_ifcfg(host, device):
-    """
-    Brings given device up if it's down. Raises ScriptRuntimeError in case
-    of failure.
-    """
-    server = utils.ScriptRunner(host)
-    server.append('ip link show up | grep "%s"' % device)
-    try:
-        server.execute()
-    except ScriptRuntimeError:
-        server.clear()
-        cmd = 'ip link set dev %s up'
-        server.append(cmd % device)
-        try:
-            server.execute()
-        except ScriptRuntimeError:
-            msg = ('Failed to bring up network interface %s on host %s.'
-                   ' Interface should be up so Openstack can work'
-                   ' properly.' % (device, host))
-            raise ScriptRuntimeError(msg)
-
+# ------------------------ Step Functions -------------------------
 
-def create_ssh_keys(config):
+def create_ssh_keys(config, messages):
     migration_key = os.path.join(basedefs.VAR_DIR, 'nova_migration_key')
-    # Generate key
-    local = utils.ScriptRunner()
-    local.append('ssh-keygen -t rsa -b 2048 -f "%s" -N ""' % migration_key)
-    local.execute()
+    # Generate key if it does not exist
+    if not os.path.exists(migration_key):
+        local = utils.ScriptRunner()
+        local.append('ssh-keygen -t rsa -b 2048 -f "%s" -N ""' % migration_key)
+        local.execute()
 
     with open(migration_key) as fp:
         secret = fp.read().strip()
@@ -461,187 +263,222 @@ def create_ssh_keys(config):
 
     config['NOVA_MIGRATION_KEY_TYPE'] = 'ssh-rsa'
     config['NOVA_MIGRATION_KEY_PUBLIC'] = public.split()[1]
-    config['NOVA_MIGRATION_KEY_SECRET'] = secret
+    config['NOVA_MIGRATION_KEY_SECRET'] = secret + '\n'
 
-def gather_host_keys(config):
+
+def gather_host_keys(config, messages):
     global compute_hosts
 
     for host in compute_hosts:
         local = utils.ScriptRunner()
-        local.append('ssh-keyscan %s' % host)
+        local.append('ssh-keyscan -q %s' % host)
         retcode, hostkey = local.execute()
         config['HOST_KEYS_%s' % host] = hostkey
 
-def createcomputemanifest(config):
+
+def create_api_manifest(config, messages):
+    # Since this step is running first, let's create necessary variables here
+    # and make them global
     global compute_hosts, network_hosts
+    com_var = config.get("CONFIG_COMPUTE_HOSTS", "")
+    compute_hosts = set([i.strip() for i in com_var.split(",") if i.strip()])
+    net_var = config.get("CONFIG_NETWORK_HOSTS", "")
+    network_hosts = set([i.strip() for i in net_var.split(",") if i.strip()])
+
+    # This is a hack around us needing to generate the neutron metadata
+    # password, but the nova puppet plugin uses the existence of that
+    # password to determine whether or not to configure neutron metadata
+    # proxy support. So the nova_api.pp template needs to be set to None
+    # to disable metadata support if neutron is not being installed.
+    if config['CONFIG_NEUTRON_INSTALL'] != 'y':
+        config['CONFIG_NEUTRON_METADATA_PW_UNQUOTED'] = None
+    else:
+        config['CONFIG_NEUTRON_METADATA_PW_UNQUOTED'] = "%s" % config['CONFIG_NEUTRON_METADATA_PW']
+
+    fw_details = dict()
+    key = "nova_api"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "nova api"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['8773', '8774', '8775', '8778']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_NOVA_API_RULES'] = fw_details
 
-    ssh_hostkeys = ''
+
+def create_compute_manifest(config, messages):
+    global compute_hosts, network_hosts
+
+    if config["CONFIG_HORIZON_SSL"] == 'y':
+        config["CONFIG_VNCPROXY_PROTOCOL"] = "https"
+    else:
+        config["CONFIG_VNCPROXY_PROTOCOL"] = "http"
+
+    config["CONFIG_NOVA_ALLOW_RESIZE_TO_SAME"] = len(compute_hosts) == 1
+
+    ssh_keys_details = {}
     for host in compute_hosts:
         try:
-            host_name, host_aliases, host_addrs = socket.gethostbyaddr(host)
+            hostname, aliases, addrs = socket.gethostbyaddr(host)
         except socket.herror:
-            host_name, host_aliases, host_addrs = (host, [], [])
+            hostname, aliases, addrs = (host, [], [])
 
-        for hostkey in config['HOST_KEYS_%s' %host].split('\n'):
+        for hostkey in config['HOST_KEYS_%s' % host].split('\n'):
             hostkey = hostkey.strip()
             if not hostkey:
                 continue
 
             _, host_key_type, host_key_data = hostkey.split()
-            config['SSH_HOST_NAME'] = host_name
-            config['SSH_HOST_ALIASES'] = ','.join('"%s"' % addr
-                   for addr in host_aliases + host_addrs)
-            config['SSH_HOST_KEY'] = host_key_data
-            config['SSH_HOST_KEY_TYPE'] = host_key_type
-            ssh_hostkeys += getManifestTemplate("sshkey.pp")
+            key = "%s.%s" % (host_key_type, hostname)
+            ssh_keys_details.setdefault(key, {})
+            ssh_keys_details[key]['ensure'] = 'present'
+            ssh_keys_details[key]['host_aliases'] = [hostname] + aliases + addrs
+            ssh_keys_details[key]['key'] = host_key_data
+            ssh_keys_details[key]['type'] = host_key_type
+
+    config['SSH_KEYS'] = ssh_keys_details
+
+    if config['CONFIG_VMWARE_BACKEND'] == 'y':
+        vcenters = [i.strip() for i in
+                    config['CONFIG_VCENTER_CLUSTER_NAMES'].split(',')
+                    if i.strip()]
+        if not vcenters:
+            raise exceptions.ParamValidationError(
+                "Please specify at least one VMware vCenter cluster in"
+                " CONFIG_VCENTER_CLUSTER_NAMES"
+            )
+        if len(vcenters) != len(compute_hosts):
+            if len(vcenters) > 1:
+                raise exceptions.ParamValidationError(
+                    "Number of vmware clusters %s is not same"
+                    " as number of nova computes %s", (vcenters, compute_hosts)
+                )
+            else:
+                vcenters = len(compute_hosts) * [vcenters[0]]
+        vmware_clusters = dict(zip(compute_hosts, vcenters))
+        config['CONFIG_VCENTER_CLUSTERS'] = vmware_clusters
 
     for host in compute_hosts:
-        config["CONFIG_NOVA_COMPUTE_HOST"] = host
-        manifestdata = getManifestTemplate("nova_compute.pp")
-        if config['CONFIG_VMWARE_BACKEND'] == 'y':
-            manifestdata += getManifestTemplate("nova_compute_vmware.pp")
-        else:
-            manifestdata += getManifestTemplate("nova_compute_libvirt.pp")
-        if (config['CONFIG_VMWARE_BACKEND'] != 'y' and
-            config['CONFIG_CINDER_INSTALL'] == 'y' and
-            config['CONFIG_CINDER_BACKEND'] == 'gluster'):
-            manifestdata += getManifestTemplate("nova_gluster.pp")
-        if (config['CONFIG_VMWARE_BACKEND'] != 'y' and
-            config['CONFIG_CINDER_INSTALL'] == 'y' and
-            config['CONFIG_CINDER_BACKEND'] == 'nfs'):
-            manifestdata += getManifestTemplate("nova_nfs.pp")
-        manifestfile = "%s_nova.pp" % host
-
-        nova_config_options = NovaConfig()
-        if config['CONFIG_NEUTRON_INSTALL'] != 'y':
-            if host not in network_hosts:
-                nova_config_options.addOption("DEFAULT/flat_interface",
-                                        config['CONFIG_NOVA_COMPUTE_PRIVIF'])
-            check_ifcfg(host, config['CONFIG_NOVA_COMPUTE_PRIVIF'])
-            try:
-                bring_up_ifcfg(host, config['CONFIG_NOVA_COMPUTE_PRIVIF'])
-            except ScriptRuntimeError as ex:
-                # just warn user to do it by himself
-                controller.MESSAGES.append(str(ex))
+        fw_details = dict()
+        cf_fw_qemu_mig_key = ("FIREWALL_NOVA_QEMU_MIG_RULES_%s" %
+                              host.replace('.', '_'))
+        for c_host in compute_hosts:
+            key = "nova_qemu_migration_%s_%s" % (host, c_host)
+            fw_details.setdefault(key, {})
+            fw_details[key]['host'] = "%s" % c_host
+            fw_details[key]['service_name'] = "nova qemu migration"
+            fw_details[key]['chain'] = "INPUT"
+            fw_details[key]['ports'] = ['16509', '49152-49215']
+            fw_details[key]['proto'] = "tcp"
+
+        config[cf_fw_qemu_mig_key] = fw_details
 
         if config['CONFIG_CEILOMETER_INSTALL'] == 'y':
-            manifestdata += getManifestTemplate(get_mq(config, "nova_ceilometer"))
-
-        # According to the docs the only element that connects directly to nova compute
-        # is nova scheduler
-        # http://docs.openstack.org/developer/nova/nova.concepts.html#concept-system-architecture
-        config['FIREWALL_ALLOWED'] = "'%s'" % (config['CONFIG_NOVA_SCHED_HOST'].strip())
-        config['FIREWALL_SERVICE_NAME'] = "nova compute"
-        config['FIREWALL_SERVICE_ID'] = "nova_compute"
-        config['FIREWALL_PORTS'] = "'5900-5999'"
-        config['FIREWALL_CHAIN'] = "INPUT"
-        manifestdata += getManifestTemplate("firewall.pp")
+            if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+                ssl_cert_file = config['CONFIG_CEILOMETER_SSL_CERT'] = (
+                    '/etc/pki/tls/certs/ssl_amqp_ceilometer.crt'
+                )
+                ssl_key_file = config['CONFIG_CEILOMETER_SSL_KEY'] = (
+                    '/etc/pki/tls/private/ssl_amqp_ceilometer.key'
+                )
+                ssl_host = config['CONFIG_CONTROLLER_HOST']
+                service = 'ceilometer'
+                generate_ssl_cert(config, ssl_host, service, ssl_key_file,
+                                  ssl_cert_file)
+
+        fw_details = dict()
+        key = "nova_compute"
+        fw_details.setdefault(key, {})
+        fw_details[key]['host'] = "%s" % config['CONFIG_CONTROLLER_HOST']
+        fw_details[key]['service_name'] = "nova compute"
+        fw_details[key]['chain'] = "INPUT"
+        fw_details[key]['ports'] = ['5900-5999']
+        fw_details[key]['proto'] = "tcp"
+        config['FIREWALL_NOVA_COMPUTE_RULES'] = fw_details
+
+
+def create_sched_manifest(config, messages):
+    if config['CONFIG_IRONIC_INSTALL'] == 'y':
+        ram_alloc = '1.0'
+        config['CONFIG_NOVA_SCHED_RAM_ALLOC_RATIO'] = ram_alloc
+
+
+def create_vncproxy_manifest(config, messages):
+    if config["CONFIG_HORIZON_SSL"] == 'y':
+        if config["CONFIG_VNC_SSL_CERT"]:
+            ssl_cert_file = config["CONFIG_VNC_SSL_CERT"]
+            ssl_key_file = config["CONFIG_VNC_SSL_KEY"]
+            if not os.path.exists(ssl_cert_file):
+                raise exceptions.ParamValidationError(
+                    "The file %s doesn't exist" % ssl_cert_file)
+
+            if not os.path.exists(ssl_key_file):
+                raise exceptions.ParamValidationError(
+                    "The file %s doesn't exist" % ssl_key_file)
+
+            final_cert = open(ssl_cert_file, 'rt').read()
+            final_key = open(ssl_key_file, 'rt').read()
+            deliver_ssl_file(final_cert, ssl_cert_file, config['CONFIG_CONTROLLER_HOST'])
+            deliver_ssl_file(final_key, ssl_key_file, config['CONFIG_CONTROLLER_HOST'])
 
-        manifestdata += "\n" + nova_config_options.getManifestEntry()
-        manifestdata += "\n" + ssh_hostkeys
-        appendManifestFile(manifestfile, manifestdata)
+        else:
+            config["CONFIG_VNC_SSL_CERT"] = '/etc/pki/tls/certs/ssl_vnc.crt'
+            config["CONFIG_VNC_SSL_KEY"] = '/etc/pki/tls/private/ssl_vnc.key'
+            ssl_key_file = config["CONFIG_VNC_SSL_KEY"]
+            ssl_cert_file = config["CONFIG_VNC_SSL_CERT"]
+            ssl_host = config['CONFIG_CONTROLLER_HOST']
+            service = 'vnc'
+            generate_ssl_cert(config, ssl_host, service, ssl_key_file,
+                              ssl_cert_file)
 
 
-def createnetworkmanifest(config):
+def create_common_manifest(config, messages):
     global compute_hosts, network_hosts
-    if config['CONFIG_NEUTRON_INSTALL'] == "y":
-        return
-
-    # set default values for VlanManager in case this values are not in config
-    for key, value in [('CONFIG_NOVA_NETWORK_VLAN_START', 100),
-                       ('CONFIG_NOVA_NETWORK_SIZE', 255),
-                       ('CONFIG_NOVA_NETWORK_NUMBER', 1)]:
-        config[key] = config.get(key, value)
-
-    api_host = config['CONFIG_NOVA_API_HOST']
-    multihost = len(network_hosts) > 1
-    config['CONFIG_NOVA_NETWORK_MULTIHOST'] = multihost and 'true' or 'false'
-    for host in network_hosts:
-        for i in ('CONFIG_NOVA_NETWORK_PRIVIF', 'CONFIG_NOVA_NETWORK_PUBIF'):
-            check_ifcfg(host, config[i])
-            try:
-                bring_up_ifcfg(host, config[i])
-            except ScriptRuntimeError as ex:
-                # just warn user to do it by himself
-                controller.MESSAGES.append(str(ex))
-
-        key = 'CONFIG_NOVA_NETWORK_AUTOASSIGNFLOATINGIP'
-        config[key] = config[key] == "y"
-
-        # We need to explicitly set the network size
-        routing_prefix = config['CONFIG_NOVA_NETWORK_FIXEDRANGE'].split('/')[1]
-        net_size = 2**(32 - int(routing_prefix))
-        config['CONFIG_NOVA_NETWORK_FIXEDSIZE'] = str(net_size)
-
-        manifestfile = "%s_nova.pp" % host
-        manifestdata = getManifestTemplate("nova_network.pp")
-
-        # in multihost mode each compute host runs nova-api-metadata
-        if multihost and host != api_host and host in compute_hosts:
-            manifestdata += getManifestTemplate("nova_metadata.pp")
-        appendManifestFile(manifestfile, manifestdata)
 
-
-def createschedmanifest(config):
-    manifestfile = "%s_nova.pp"%controller.CONF['CONFIG_NOVA_SCHED_HOST']
-    manifestdata = getManifestTemplate("nova_sched.pp")
-    appendManifestFile(manifestfile, manifestdata)
-
-
-def createvncproxymanifest(config):
-    manifestfile = "%s_nova.pp"%controller.CONF['CONFIG_NOVA_VNCPROXY_HOST']
-    manifestdata = getManifestTemplate("nova_vncproxy.pp")
-    appendManifestFile(manifestfile, manifestdata)
-
-
-def createcommonmanifest(config):
-    global compute_hosts, network_hosts
-    network_type = (config['CONFIG_NEUTRON_INSTALL'] == "y" and
-                    'neutron' or 'nova')
-    network_multi = len(network_hosts) > 1
-    dirty = [config.get('CONFIG_NOVA_CONDUCTOR_HOST'),
-             config.get('CONFIG_NOVA_API_HOST'),
-             config.get('CONFIG_NOVA_CERT_HOST'),
-             config.get('CONFIG_NOVA_VNCPROXY_HOST'),
-             config.get('CONFIG_NOVA_SCHED_HOST')]
-    dbacces_hosts = set([i.strip() for i in dirty if i and i.strip()])
+    dbacces_hosts = set([config.get('CONFIG_CONTROLLER_HOST')])
     dbacces_hosts |= network_hosts
 
-    for manifestfile, marker in manifestfiles.getFiles():
-        if manifestfile.endswith("_nova.pp"):
-            host, manifest = manifestfile.split('_', 1)
-            host = host.strip()
-
-            if host in compute_hosts and host not in dbacces_hosts:
-                # we should omit password in case we are installing only
-                # nova-compute to the host
-                perms = "nova"
-            else:
-                perms = "nova:%(CONFIG_NOVA_DB_PW)s"
-            sqlconn = "mysql://%s@%%(CONFIG_MYSQL_HOST)s/nova" % perms
-            config['CONFIG_NOVA_SQL_CONN'] = sqlconn % config
-
-            # for nova-network in multihost mode each compute host is metadata
-            # host otherwise we use api host
-            if (network_type == 'nova' and network_multi and
-                host in compute_hosts):
-                metadata = host
-            else:
-                metadata = config['CONFIG_NOVA_API_HOST']
-            config['CONFIG_NOVA_METADATA_HOST'] = metadata
-
-            data = getManifestTemplate(get_mq(config, "nova_common"))
-            data += getManifestTemplate("nova_common.pp")
-            appendManifestFile(os.path.split(manifestfile)[1], data)
-
-
-def createneutronmanifest(config):
-    if controller.CONF['CONFIG_NEUTRON_INSTALL'] != "y":
-        return
+    for host in filtered_hosts(config):
+        pw_in_sqlconn = False
+        host = host.strip()
 
-    controller.CONF['CONFIG_NOVA_LIBVIRT_VIF_DRIVER'] = 'nova.virt.libvirt.vif.LibvirtGenericVIFDriver'
+        if host in compute_hosts and host not in dbacces_hosts:
+            # we should omit password in case we are installing only
+            # nova-compute to the host
+            perms = "nova"
+            pw_in_sqlconn = False
+        else:
+            perms = "nova:%s" % config['CONFIG_NOVA_DB_PW']
+            pw_in_sqlconn = True
 
-    for manifestfile, marker in manifestfiles.getFiles():
-        if manifestfile.endswith("_nova.pp"):
-            data = getManifestTemplate("nova_neutron.pp")
-            appendManifestFile(os.path.split(manifestfile)[1], data)
+        mariadb_host_url = config['CONFIG_MARIADB_HOST_URL']
+        sqlconn = "mysql+pymysql://%s@%s/nova" % (perms, mariadb_host_url)
+        if pw_in_sqlconn:
+            config['CONFIG_NOVA_SQL_CONN_PW'] = sqlconn
+        else:
+            config['CONFIG_NOVA_SQL_CONN_NOPW'] = sqlconn
+
+        config['CONFIG_NOVA_METADATA_HOST'] = config['CONFIG_CONTROLLER_HOST']
+
+    if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+        nova_hosts = compute_hosts
+        nova_hosts |= set([config.get('CONFIG_CONTROLLER_HOST')])
+        ssl_cert_file = config['CONFIG_NOVA_SSL_CERT'] = (
+            '/etc/pki/tls/certs/ssl_amqp_nova.crt'
+        )
+        ssl_key_file = config['CONFIG_NOVA_SSL_KEY'] = (
+            '/etc/pki/tls/private/ssl_amqp_nova.key'
+        )
+        service = 'nova'
+        for host in nova_hosts:
+            generate_ssl_cert(config, host, service,
+                              ssl_key_file, ssl_cert_file)
+
+
+def create_neutron_manifest(config, messages):
+    if config['CONFIG_IRONIC_INSTALL'] == 'y':
+        virt_driver = 'nova.virt.firewall.NoopFirewallDriver'
+        config['CONFIG_NOVA_LIBVIRT_VIF_DRIVER'] = virt_driver
+    else:
+        virt_driver = 'nova.virt.libvirt.vif.LibvirtGenericVIFDriver'
+        config['CONFIG_NOVA_LIBVIRT_VIF_DRIVER'] = virt_driver
diff --git a/packstack/plugins/openstack_client_400.py b/packstack/plugins/openstack_client_400.py
index d11597c08..bc082acc0 100644
--- a/packstack/plugins/openstack_client_400.py
+++ b/packstack/plugins/openstack_client_400.py
@@ -1,52 +1,38 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 """
 Installs and configures an OpenStack Client
 """
 
-import logging
 import os
 
-from packstack.installer import validators
-from packstack.installer import basedefs, output_messages
 from packstack.installer import utils
 
-from packstack.modules.ospluginutils import getManifestTemplate, appendManifestFile
-
-# Controller object will be initialized from main flow
-controller = None
+# ------------- OpenStack Client Packstack Plugin Initialization --------------
 
-# Plugin name
-PLUGIN_NAME = "OS-CLIENT"
+PLUGIN_NAME = "OS-Client"
 PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
 
-logging.debug("plugin %s loaded", __name__)
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding OpenStack Client configuration")
-    paramsList = [
-                  {"CMD_OPTION"      : "osclient-host",
-                   "USAGE"           : "The IP address of the server on which to install the OpenStack client packages. An admin \"rc\" file will also be installed",
-                   "PROMPT"          : "Enter the IP address of the client server",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_OSCLIENT_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                 ]
-
-    groupDict = { "GROUP_NAME"            : "NOVACLIENT",
-                  "DESCRIPTION"           : "NOVACLIENT Config parameters",
-                  "PRE_CONDITION"         : "CONFIG_CLIENT_INSTALL",
-                  "PRE_CONDITION_MATCH"   : "y",
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
+
+def initConfig(controller):
+    group = {"GROUP_NAME": "NOVACLIENT",
+             "DESCRIPTION": "NOVACLIENT Config parameters",
+             "PRE_CONDITION": "CONFIG_CLIENT_INSTALL",
+             "PRE_CONDITION_MATCH": "y",
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+    controller.addGroup(group, [])
 
 
 def initSequences(controller):
@@ -54,14 +40,17 @@ def initSequences(controller):
         return
 
     osclientsteps = [
-             {'title': 'Adding OpenStack Client manifest entries', 'functions':[createmanifest]}
+        {'title': 'Preparing OpenStack Client entries',
+         'functions': [create_manifest]}
     ]
-    controller.addSequence("Installing OpenStack Client", [], [], osclientsteps)
+    controller.addSequence("Installing OpenStack Client", [], [],
+                           osclientsteps)
 
 
-def createmanifest(config):
-    client_host = config['CONFIG_OSCLIENT_HOST'].strip()
-    manifestfile = "%s_osclient.pp" % client_host
+# -------------------------- step functions --------------------------
+
+def create_manifest(config, messages):
+    client_host = config['CONFIG_CONTROLLER_HOST'].strip()
 
     server = utils.ScriptRunner(client_host)
     server.append('echo $HOME')
@@ -76,16 +65,13 @@ def createmanifest(config):
 
     no_root_allinone = (client_host == utils.get_localhost_ip() and
                         root_home != homedir)
-    config['NO_ROOT_USER_ALLINONE'] = no_root_allinone and 'true' or 'false'
-
-    manifestdata = getManifestTemplate("openstack_client.pp")
-    appendManifestFile(manifestfile, manifestdata)
+    config['NO_ROOT_USER_ALLINONE'] = no_root_allinone and True or False
 
     msg = ("File %s/keystonerc_admin has been created on OpenStack client host"
            " %s. To use the command line tools you need to source the file.")
-    controller.MESSAGES.append(msg % (root_home, client_host))
+    messages.append(msg % (root_home, client_host))
 
     if no_root_allinone:
         msg = ("Copy of keystonerc_admin file has been created for non-root "
                "user in %s.")
-        controller.MESSAGES.append(msg % homedir)
+        messages.append(msg % homedir)
diff --git a/packstack/plugins/postscript_948.py b/packstack/plugins/postscript_948.py
deleted file mode 100644
index 498ce23aa..000000000
--- a/packstack/plugins/postscript_948.py
+++ /dev/null
@@ -1,50 +0,0 @@
-"""
-Installs and configures an OpenStack Client
-"""
-
-import logging
-
-from packstack.modules.common import filtered_hosts
-from packstack.modules.ospluginutils import (getManifestTemplate,
-                                             appendManifestFile)
-
-# Controller object will be initialized from main flow
-controller = None
-
-# Plugin name
-PLUGIN_NAME = "OS-POSTSCRIPT"
-
-logging.debug("plugin %s loaded", __name__)
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Executing post run scripts")
-
-
-    groupDict = {"GROUP_NAME"            : "POSTSCRIPT",
-                 "DESCRIPTION"           : "POSTSCRIPT Config parameters",
-                 "PRE_CONDITION"         : lambda x: 'yes',
-                 "PRE_CONDITION_MATCH"   : "yes",
-                 "POST_CONDITION"        : False,
-                 "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, [])
-
-
-def initSequences(controller):
-    osclientsteps = [
-             {'title': 'Adding post install manifest entries', 'functions':[createmanifest]}
-    ]
-    controller.addSequence("Running post install scripts", [], [], osclientsteps)
-
-
-def createmanifest(config):
-    for hostname in filtered_hosts(config):
-        manifestfile = "%s_postscript.pp" % hostname
-        manifestdata = getManifestTemplate("postscript.pp")
-        appendManifestFile(manifestfile, manifestdata, 'postscript')
-        if config.get("CONFIG_PROVISION_ALL_IN_ONE_OVS_BRIDGE") != 'n':
-            config['EXT_BRIDGE_VAR'] = config['CONFIG_NEUTRON_L3_EXT_BRIDGE'].replace('-','_')
-            manifestdata = getManifestTemplate("persist_ovs_bridge.pp")
-            appendManifestFile(manifestfile, manifestdata, 'postscript')
diff --git a/packstack/plugins/postscript_951.py b/packstack/plugins/postscript_951.py
new file mode 100644
index 000000000..857835964
--- /dev/null
+++ b/packstack/plugins/postscript_951.py
@@ -0,0 +1,63 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Plugin responsible for post-installation configuration
+"""
+
+from packstack.installer import utils
+from packstack.installer import basedefs
+
+
+# ------------- Postscript Packstack Plugin Initialization --------------
+
+PLUGIN_NAME = "Postscript"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
+
+
+def initConfig(controller):
+    group = {"GROUP_NAME": "POSTSCRIPT",
+             "DESCRIPTION": "POSTSCRIPT Config parameters",
+             "PRE_CONDITION": lambda x: 'yes',
+             "PRE_CONDITION_MATCH": "yes",
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+    controller.addGroup(group, [])
+
+
+def initSequences(controller):
+    config = controller.CONF
+    postscript_steps = []
+    if (config['CONFIG_PROVISION_TEMPEST'] == "y" and
+            config['CONFIG_RUN_TEMPEST'] == "y"):
+        postscript_steps.append(
+            {'title': 'Running Tempest',
+             'functions': [run_tempest]}
+        )
+    controller.addSequence("Running post install scripts", [], [],
+                           postscript_steps)
+
+
+# -------------------------- step functions --------------------------
+
+def run_tempest(config, messages):
+    logfile = basedefs.DIR_LOG + "/tempest.log"
+    print("Running Tempest on %s" % config['CONFIG_TEMPEST_HOST'])
+    server = utils.ScriptRunner(config['CONFIG_TEMPEST_HOST'])
+    server.append('pushd /var/lib/tempest')
+    server.append('tempest run --regex \'(%s)\' --black-regex \'%s\' --concurrency 2  > %s'
+                  % (config['CONFIG_RUN_TEMPEST_TESTS'].replace(' ', '|'),
+                     config['CONFIG_SKIP_TEMPEST_TESTS'].replace(' ', '|'),
+                     logfile))
+    server.append('popd')
+    server.execute()
diff --git a/packstack/plugins/prescript_000.py b/packstack/plugins/prescript_000.py
index fb4ec5131..cf4b70f6a 100644
--- a/packstack/plugins/prescript_000.py
+++ b/packstack/plugins/prescript_000.py
@@ -1,398 +1,1346 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 """
 Plugin responsible for setting OpenStack global options
 """
 
+import distro
 import glob
 import logging
 import os
 import re
 import uuid
 
-from packstack.installer import (basedefs, exceptions, processors, utils,
-                                 validators)
+from packstack.installer import basedefs
+from packstack.installer import exceptions
+from packstack.installer import processors
+from packstack.installer import utils
+from packstack.installer import validators
 
 from packstack.modules.common import filtered_hosts
-from packstack.modules.ospluginutils import (getManifestTemplate,
-                                             appendManifestFile)
-
-
-# Controller object will be initialized from main flow
-controller = None
-
-# Plugin name
-PLUGIN_NAME = "OS-PRESCRIPT"
-
-logging.debug("plugin %s loaded", __name__)
-
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-
-    paramsList = [{"CMD_OPTION"      : "ssh-public-key",
-                   "USAGE"           : "Path to a Public key to install on servers. If a usable key has not been installed on the remote servers the user will be prompted for a password and this key will be installed so the password will not be required again",
-                   "PROMPT"          : "Enter the path to your ssh Public key to install on servers",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_file,
-                                        validators.validate_sshkey],
-                   "PROCESSORS"      : [processors.process_ssh_key],
-                   "DEFAULT_VALUE"   : (glob.glob(os.path.join(os.environ["HOME"], ".ssh/*.pub"))+[""])[0],
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SSH_KEY",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-mysql-install",
-                   "USAGE"           : "Set to 'y' if you would like Packstack to install MySQL",
-                   "PROMPT"          : "Should Packstack install MySQL DB",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "y",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_MYSQL_INSTALL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-glance-install",
-                   "USAGE"           : "Set to 'y' if you would like Packstack to install OpenStack Image Service (Glance)",
-                   "PROMPT"          : "Should Packstack install OpenStack Image Service (Glance)",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "y",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_GLANCE_INSTALL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-cinder-install",
-                   "USAGE"           : "Set to 'y' if you would like Packstack to install OpenStack Block Storage (Cinder)",
-                   "PROMPT"          : "Should Packstack install OpenStack Block Storage (Cinder) service",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "y",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_CINDER_INSTALL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-nova-install",
-                   "USAGE"           : "Set to 'y' if you would like Packstack to install OpenStack Compute (Nova)",
-                   "PROMPT"          : "Should Packstack install OpenStack Compute (Nova) service",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "y",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_NOVA_INSTALL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-neutron-install",
-                   "USAGE"           : "Set to 'y' if you would like Packstack to install OpenStack Networking (Neutron)",
-                   "PROMPT"          : "Should Packstack install OpenStack Networking (Neutron) service",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "y",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_NEUTRON_INSTALL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-horizon-install",
-                   "USAGE"           : "Set to 'y' if you would like Packstack to install OpenStack Dashboard (Horizon)",
-                   "PROMPT"          : "Should Packstack install OpenStack Dashboard (Horizon)",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "y",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_HORIZON_INSTALL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-swift-install",
-                   "USAGE"           : "Set to 'y' if you would like Packstack to install OpenStack Object Storage (Swift)",
-                   "PROMPT"          : "Should Packstack install OpenStack Object Storage (Swift)",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "y",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SWIFT_INSTALL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-ceilometer-install",
-                   "USAGE"           : "Set to 'y' if you would like Packstack to install OpenStack Metering (Ceilometer)",
-                   "PROMPT"          : "Should Packstack install OpenStack Metering (Ceilometer)",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "y",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_CEILOMETER_INSTALL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-heat-install",
-                   "USAGE"           : "Set to 'y' if you would like Packstack to install OpenStack Orchestration (Heat)",
-                   "PROMPT"          : "Should Packstack install OpenStack Orchestration (Heat)",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "n",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_HEAT_INSTALL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-client-install",
-                   "USAGE"           : "Set to 'y' if you would like Packstack to install the OpenStack Client packages. An admin \"rc\" file will also be installed",
-                   "PROMPT"          : "Should Packstack install OpenStack client tools",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "y",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_CLIENT_INSTALL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "ntp-servers",
-                   "USAGE"           : "Comma separated list of NTP servers. Leave plain if Packstack should not install ntpd on instances.",
-                   "PROMPT"          : "Enter a comma separated list of NTP server(s). Leave plain if Packstack should not install ntpd on instances.",
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : '',
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_NTP_SERVERS",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "nagios-install",
-                   "USAGE"           : "Set to 'y' if you would like Packstack to install Nagios to monitor OpenStack hosts",
-                   "PROMPT"          : "Should Packstack install Nagios to monitor OpenStack hosts",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : 'y',
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_NAGIOS_INSTALL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "exclude-servers",
-                   "USAGE"           : "Comma separated list of servers to be excluded from installation in case you are running Packstack the second time with the same answer file and don't want Packstack to touch these servers. Leave plain if you don't need to exclude any server.",
-                   "PROMPT"          : "Enter a comma separated list of server(s) to be excluded. Leave plain if you don't need to exclude any server.",
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : '',
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "EXCLUDE_SERVERS",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-debug-mode",
-                   "USAGE"           : ("Set to 'y' if you want to run "
-                                        "OpenStack services in debug mode. "
-                                        "Otherwise set to 'n'."),
-                   "PROMPT"          : ("Do you want to run OpenStack services"
-                                        " in debug mode"),
-                   "OPTION_LIST"     : ["y", "n"],
-                   "DEFAULT_VALUE"   : "n",
-                   "VALIDATORS"      : [validators.validate_options],
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_DEBUG_MODE",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-vmware",
-                   "USAGE"           : ("Set to 'y' if you want to use "
-                                        "VMware vCenter as hypervisor and storage"
-                                        "Otherwise set to 'n'."),
-                   "PROMPT"          : ("Do you want to use VMware vCenter as"
-                                        " hypervisor and datastore"),
-                   "OPTION_LIST"     : ["y","n"],
-                   "DEFAULT_VALUE"   : "n",
-                   "VALIDATORS"      : [validators.validate_options],
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_VMWARE_BACKEND",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                 ]
-    groupDict = { "GROUP_NAME"            : "GLOBAL",
-                  "DESCRIPTION"           : "Global Options",
-                  "PRE_CONDITION"         : lambda x: 'yes',
-                  "PRE_CONDITION_MATCH"   : "yes",
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-    controller.addGroup(groupDict, paramsList)
+from packstack.modules.common import is_all_in_one
+from packstack.modules.documentation import update_params_usage
+
+# ------------- Prescript Packstack Plugin Initialization --------------
+
+PLUGIN_NAME = "Prescript"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
+
+
+def initConfig(controller):
+    default_ssh_key = os.path.expanduser('~/.ssh/*.pub')
+    default_ssh_key = (glob.glob(default_ssh_key) + [""])[0]
+    params = {
+        "GLOBAL": [
+            {"CMD_OPTION": "ssh-public-key",
+             "PROMPT": (
+                 "Enter the path to your ssh Public key to install on servers"
+             ),
+             "OPTION_LIST": [],
+             "VALIDATORS": [
+                 validators.validate_file,
+                 validators.validate_sshkey
+             ],
+             "PROCESSORS": [processors.process_ssh_key],
+             "DEFAULT_VALUE": default_ssh_key,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_SSH_KEY",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "default-password",
+             "PROMPT": (
+                 "Enter a default password to be used. Leave blank for a "
+                 "randomly generated one."
+             ),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": '',
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_DEFAULT_PASSWORD",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "service-workers",
+             "PROMPT": (
+                 "Enter the amount of service workers/threads to use for each "
+                 "service. Leave blank to use the default."
+             ),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": '%{::processorcount}',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_SERVICE_WORKERS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "mariadb-install",
+             "PROMPT": "Should Packstack install MariaDB",
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MARIADB_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_MYSQL_INSTALL']},
+
+            {"CMD_OPTION": "os-glance-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Image Service (Glance)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_GLANCE_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-cinder-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Block Storage (Cinder)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CINDER_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-manila-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Shared File System "
+                 "(Manila)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "n",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MANILA_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-nova-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Compute (Nova)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_NOVA_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-neutron-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Networking (Neutron)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_neutron],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_NEUTRON_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-horizon-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Dashboard (Horizon)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_HORIZON_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-swift-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Object Storage (Swift)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_SWIFT_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-ceilometer-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Metering (Ceilometer)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CEILOMETER_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-aodh-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Telemetry Alarming (Aodh)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_AODH_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-heat-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Orchestration (Heat)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "PROCESSORS": [processors.process_heat],
+             "DEFAULT_VALUE": "n",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_HEAT_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-magnum-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Container Infrastructure Management Service (Magnum)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "n",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_MAGNUM_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-trove-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Database (Trove)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "n",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_TROVE_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-ironic-install",
+             "PROMPT": (
+                 "Should Packstack install OpenStack Bare Metal (Ironic)"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "n",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_IRONIC_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-client-install",
+             "PROMPT": "Should Packstack install OpenStack client tools",
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_CLIENT_INSTALL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "ntp-servers",
+             "PROMPT": ("Enter a comma separated list of NTP server(s). Leave "
+                        "plain if Packstack should not install ntpd "
+                        "on instances."),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": '',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_NTP_SERVERS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "exclude-servers",
+             "PROMPT": (
+                 "Enter a comma separated list of server(s) to be excluded."
+                 " Leave plain if you don't need to exclude any server."
+             ),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": '',
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "EXCLUDE_SERVERS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "os-debug-mode",
+             "PROMPT": "Do you want to run OpenStack services in debug mode",
+             "OPTION_LIST": ["y", "n"],
+             "DEFAULT_VALUE": "n",
+             "VALIDATORS": [validators.validate_options],
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_DEBUG_MODE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CONF_NAME": "CONFIG_CONTROLLER_HOST",
+             "CMD_OPTION": "os-controller-host",
+             "PROMPT": "Enter the controller host",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_ssh],
+             "DEFAULT_VALUE": utils.get_localhost_ip(),
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_CEILOMETER_HOST',
+                            'CONFIG_CINDER_HOST',
+                            'CONFIG_GLANCE_HOST',
+                            'CONFIG_HORIZON_HOST',
+                            'CONFIG_HEAT_HOST',
+                            'CONFIG_IRONIC_HOST',
+                            'CONFIG_KEYSTONE_HOST',
+                            'CONFIG_NAGIOS_HOST',
+                            'CONFIG_NEUTRON_SERVER_HOST',
+                            'CONFIG_NOVA_API_HOST',
+                            'CONFIG_NOVA_CERT_HOST',
+                            'CONFIG_NOVA_VNCPROXY_HOST',
+                            'CONFIG_NOVA_SCHED_HOST',
+                            'CONFIG_OSCLIENT_HOST',
+                            'CONFIG_SWIFT_PROXY_HOSTS']},
+
+            {"CONF_NAME": "CONFIG_COMPUTE_HOSTS",
+             "CMD_OPTION": "os-compute-hosts",
+             "PROMPT": "Enter list of compute hosts",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_multi_ssh],
+             "DEFAULT_VALUE": utils.get_localhost_ip(),
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_NOVA_COMPUTE_HOSTS']},
+
+            {"CONF_NAME": "CONFIG_NETWORK_HOSTS",
+             "CMD_OPTION": "os-network-hosts",
+             "PROMPT": "Enter list of network hosts",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_multi_ssh],
+             "DEFAULT_VALUE": utils.get_localhost_ip(),
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_NEUTRON_L3_HOSTS',
+                            'CONFIG_NEUTRON_DHCP_HOSTS',
+                            'CONFIG_NEUTRON_METADATA_HOSTS',
+                            'CONFIG_NOVA_NETWORK_HOSTS']},
+
+            {"CMD_OPTION": "os-vmware",
+             "PROMPT": (
+                 "Do you want to use VMware vCenter as hypervisor and "
+                 "datastore"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "DEFAULT_VALUE": "n",
+             "VALIDATORS": [validators.validate_options],
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_VMWARE_BACKEND",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "unsupported",
+             "PROMPT": (
+                 "Enable this on your own risk. Do you want to use "
+                 "unsupported parameters"
+             ),
+             "OPTION_LIST": ["y", "n"],
+             "DEFAULT_VALUE": "n",
+             "VALIDATORS": [validators.validate_options],
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_UNSUPPORTED",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "use-subnets",
+             "PROMPT": ("Should interface names be automatically recognized "
+                        "based on subnet CIDR"),
+             "OPTION_LIST": ['y', 'n'],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "n",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_USE_SUBNETS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "VMWARE": [
+            {"CMD_OPTION": "vcenter-host",
+             "PROMPT": (
+                 "Enter the IP address of the VMware vCenter server to use "
+                 "with Nova"
+             ),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_ip],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_VCENTER_HOST",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "vcenter-username",
+             "PROMPT": ("Enter the username to authenticate on VMware "
+                        "vCenter server"),
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_VCENTER_USER",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "vcenter-password",
+             "PROMPT": ("Enter the password to authenticate on VMware "
+                        "vCenter server"),
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_VCENTER_PASSWORD",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "vcenter-clusters",
+             "PROMPT": "Enter a comma separated list of vCenter datastores",
+             "DEFAULT_VALUE": "",
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_VCENTER_CLUSTER_NAMES",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_VCENTER_CLUSTER_NAME']},
+        ],
+
+        "UNSUPPORTED": [
+            {"CONF_NAME": "CONFIG_STORAGE_HOST",
+             "CMD_OPTION": "os-storage-host",
+             "PROMPT": "Enter the host for the storage services",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_ssh],
+             "DEFAULT_VALUE": utils.get_localhost_ip(),
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "SERVERPREPARE": [
+            {"CMD_OPTION": "additional-repo",
+             "PROMPT": ("Enter a comma separated list of URLs to any "
+                        "additional yum repositories to install"),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_REPO",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "enable-rdo-testing",
+             "PROMPT": "To enable rdo testing enter \"y\"",
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "n",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_ENABLE_RDO_TESTING",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "RHEL": [
+            {"CMD_OPTION": "rh-username",
+             "PROMPT": "To subscribe each server to Red Hat enter a username ",
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_RH_USER",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rhn-satellite-server",
+             "PROMPT": ("To subscribe each server with RHN Satellite enter "
+                        "RHN Satellite server URL"),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_SATELLITE_URL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rh-sat6-server",
+             "PROMPT": ("Specify a Satellite 6 Server to register to. If not"
+                        " specified, Packstack will register the system to"
+                        " the Red Hat server. When this option is specified,"
+                        " you also need to set the Satellite 6 organization"
+                        " and an activation key."),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_RH_SAT6_SERVER",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False}
+        ],
+
+        "RHSM": [
+            {"CMD_OPTION": "rh-password",
+             "PROMPT": ("To subscribe each server to Red Hat enter your "
+                        "password"),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_RH_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rh-enable-optional",
+             "PROMPT": "To enable RHEL optional repos use value \"y\"",
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_RH_OPTIONAL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rh-proxy-host",
+             "PROMPT": ("Specify a HTTP proxy to use with Red Hat subscription"
+                        " manager"),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_RH_PROXY",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rh-sat6-org",
+             "PROMPT": ("Specify a Satellite 6 Server organization to use when"
+                        " registering the system."),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_RH_SAT6_ORG",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rh-sat6-key",
+             "PROMPT": ("Specify a Satellite 6 Server activation key to use"
+                        " when registering the system."),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_RH_SAT6_KEY",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False}
+        ],
+
+        "RHSM_PROXY": [
+            {"CMD_OPTION": "rh-proxy-port",
+             "PROMPT": ("Specify port of Red Hat subscription manager HTTP "
+                        "proxy"),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_RH_PROXY_PORT",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rh-proxy-user",
+             "PROMPT": ("Specify a username to use with Red Hat subscription "
+                        "manager HTTP proxy"),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_RH_PROXY_USER",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rh-proxy-password",
+             "PROMPT": ("Specify a password to use with Red Hat subscription "
+                        "manager HTTP proxy"),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_RH_PROXY_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False}
+        ],
+
+        "SATELLITE": [
+            {"CMD_OPTION": "rhn-satellite-username",
+             "PROMPT": ("Enter RHN Satellite username or leave plain if you "
+                        "will use activation key instead"),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_SATELLITE_USER",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rhn-satellite-password",
+             "PROMPT": ("Enter RHN Satellite password or leave plain if you "
+                        "will use activation key instead"),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_SATELLITE_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rhn-satellite-activation-key",
+             "PROMPT": ("Enter RHN Satellite activation key or leave plain if "
+                        "you used username/password instead"),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_SATELLITE_AKEY",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rhn-satellite-cacert",
+             "PROMPT": "Specify a path or URL to a SSL CA certificate to use",
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_SATELLITE_CACERT",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rhn-satellite-profile",
+             "PROMPT": ("If required specify the profile name that should be "
+                        "used as an identifier for the system "
+                        "in RHN Satellite"),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_SATELLITE_PROFILE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rhn-satellite-flags",
+             "PROMPT": ("Enter comma separated list of flags passed "
+                        "to rhnreg_ks"),
+             "OPTION_LIST": ['novirtinfo', 'norhnsd', 'nopackages'],
+             "VALIDATORS": [validators.validate_multi_options],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_SATELLITE_FLAGS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rhn-satellite-proxy-host",
+             "PROMPT": "Specify a HTTP proxy to use with RHN Satellite",
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_SATELLITE_PROXY",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False}
+        ],
+
+        "SATELLITE_PROXY": [
+            {"CMD_OPTION": "rhn-satellite-proxy-username",
+             "PROMPT": ("Specify a username to use with an authenticated "
+                        "HTTP proxy"),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_SATELLITE_PROXY_USER",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "rhn-satellite-proxy-password",
+             "PROMPT": ("Specify a password to use with an authenticated "
+                        "HTTP proxy."),
+             "OPTION_LIST": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_SATELLITE_PROXY_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False}
+        ]
+    }
+    update_params_usage(basedefs.PACKSTACK_DOC, params)
 
     def use_vcenter(config):
-         return (config['CONFIG_NOVA_INSTALL'] == 'y' and
+        return (config['CONFIG_NOVA_INSTALL'] == 'y' and
                 config['CONFIG_VMWARE_BACKEND'] == 'y')
 
-    paramsList = [
-                  {"CMD_OPTION"      : "vcenter-host",
-                   "USAGE"           : ("The IP address of the VMware vCenter server"),
-                   "PROMPT"          : ("Enter the IP address of the VMware vCenter server to use with Nova"),
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_ip],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_VCENTER_HOST",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "vcenter-username",
-                   "USAGE"           : ("The username to authenticate to VMware vCenter server"),
-                   "PROMPT"          : ("Enter the username to authenticate on VMware vCenter server"),
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_VCENTER_USER",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False,},
-                  {"CMD_OPTION"      : "vcenter-password",
-                   "USAGE"           : ("The password to authenticate to VMware vCenter server"),
-                   "PROMPT"          : ("Enter the password to authenticate on VMware vCenter server"),
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_VCENTER_PASSWORD",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False,},
-                  {"CMD_OPTION"      : "vcenter-cluster",
-                   "USAGE"           : ("The name of the vCenter cluster"),
-                   "PROMPT"          : ("Enter the name of the vCenter datastore"),
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_VCENTER_CLUSTER_NAME",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False,},
-                  ]
-
-    groupDict = {"GROUP_NAME"            : "VMWARE",
-                  "DESCRIPTION"           : "vCenter Config Parameters",
-                  "PRE_CONDITION"         : use_vcenter,
-                  "PRE_CONDITION_MATCH"   : True,
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
+    def unsupported_enabled(config):
+        return config['CONFIG_UNSUPPORTED'] == 'y'
+
+    def filled_rhsm(config):
+        return bool(config.get('CONFIG_RH_USER') or
+                    config.get('CONFIG_RH_SAT6_SERVER'))
+
+    def filled_rhsm_proxy(config):
+        return bool(config.get('CONFIG_RH_PROXY'))
+
+    def filled_satellite(config):
+        return bool(config.get('CONFIG_SATELLITE_URL'))
+
+    def filled_satellite_proxy(config):
+        return bool(config.get('CONFIG_SATELLITE_PROXY'))
+
+    groups = [
+        {"GROUP_NAME": "GLOBAL",
+         "DESCRIPTION": "Global Options",
+         "PRE_CONDITION": lambda x: 'yes',
+         "PRE_CONDITION_MATCH": "yes",
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "VMWARE",
+         "DESCRIPTION": "vCenter Config Parameters",
+         "PRE_CONDITION": use_vcenter,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "UNSUPPORTED",
+         "DESCRIPTION": "Global unsupported options",
+         "PRE_CONDITION": unsupported_enabled,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "SERVERPREPARE",
+         "DESCRIPTION": "Server Prepare Configs ",
+         "PRE_CONDITION": lambda x: 'yes',
+         "PRE_CONDITION_MATCH": "yes",
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+    ]
+
+    config = controller.CONF
+    if (is_all_in_one(config) and is_rhel()) or not is_all_in_one(config):
+        groups.extend([
+            {"GROUP_NAME": "RHEL",
+             "DESCRIPTION": "RHEL config",
+             "PRE_CONDITION": lambda x: 'yes',
+             "PRE_CONDITION_MATCH": "yes",
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True},
+
+            {"GROUP_NAME": "RHSM",
+             "DESCRIPTION": "RH subscription manager config",
+             "PRE_CONDITION": filled_rhsm,
+             "PRE_CONDITION_MATCH": True,
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True},
+
+            {"GROUP_NAME": "RHSM_PROXY",
+             "DESCRIPTION": "RH subscription manager proxy config",
+             "PRE_CONDITION": filled_rhsm_proxy,
+             "PRE_CONDITION_MATCH": True,
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True},
+
+            {"GROUP_NAME": "SATELLITE",
+             "DESCRIPTION": "RHN Satellite config",
+             "PRE_CONDITION": filled_satellite,
+             "PRE_CONDITION_MATCH": True,
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True},
+
+            {"GROUP_NAME": "SATELLITE_PROXY",
+             "DESCRIPTION": "RHN Satellite proxy config",
+             "PRE_CONDITION": filled_satellite_proxy,
+             "PRE_CONDITION_MATCH": True,
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+        ])
+
+    for group in groups:
+        controller.addGroup(group, params[group['GROUP_NAME']])
+
 
 def initSequences(controller):
     prescript_steps = [
+        {'title': 'Discovering ip protocol version',
+         'functions': [choose_ip_version]},
         {'title': 'Setting up ssh keys',
-            'functions':[install_keys]},
-        {'title': 'Discovering hosts\' details',
-            'functions': [discover]},
-        {'title': 'Adding pre install manifest entries',
-            'functions':[create_manifest]},
+         'functions': [install_keys]},
+        {'title': 'Preparing servers',
+         'functions': [server_prep]},
+        {'title': 'Pre installing Puppet and discovering hosts\' details',
+         'functions': [preinstall_and_discover]},
+        {'title': 'Preparing pre-install entries',
+         'functions': [create_manifest]},
     ]
 
     if controller.CONF['CONFIG_NTP_SERVERS']:
-        prescript_steps.append({
-            'title': 'Installing time synchronization via NTP',
-            'functions': [create_ntp_manifest],
-        })
+        prescript_steps.append(
+            {'title': 'Installing time synchronization via NTP',
+             'functions': [create_ntp_manifest]})
     else:
-        controller.MESSAGES.append('Time synchronization installation '
-                                   'was skipped. Please note that '
-                                   'unsynchronized time on server '
-                                   'instances might be problem for '
-                                   'some OpenStack components.')
+        controller.MESSAGES.append('Time synchronization installation was '
+                                   'skipped. Please note that unsynchronized '
+                                   'time on server instances might be problem '
+                                   'for some OpenStack components.')
     controller.addSequence("Running pre install scripts", [], [],
                            prescript_steps)
 
+# ------------------------- helper functions -------------------------
 
-def install_keys(config):
-    with open(config["CONFIG_SSH_KEY"]) as fp:
-        sshkeydata = fp.read().strip()
+
+def is_rhel():
+    return 'Red Hat Enterprise Linux' in distro.linux_distribution()[0]
+
+
+def detect_os_and_version(host):
+    server = utils.ScriptRunner(host)
+    server.append(
+        'python -c "import distro; '
+        'print distro.linux_distribution(full_distribution_name=0)[0]'
+        '+\',\'+'
+        'distro.linux_distribution()[1]"'
+    )
+    try:
+        rc, out = server.execute()
+        out = out.split(",")
+        return out
+    except exceptions.ScriptRuntimeError:
+        logging.warning('Could not detect OS release')
+        return ['Unknown', 'Unknown']
+
+
+def run_rhn_reg(host, server_url, username=None, password=None,
+                cacert=None, activation_key=None, profile_name=None,
+                proxy_host=None, proxy_user=None, proxy_pass=None,
+                flags=None):
+    """
+    Registers given host to given RHN Satellite server. To successfully
+    register either activation_key or username/password is required.
+    """
+    logging.debug('Setting RHN Satellite server: %s.' % server_url)
+
+    mask = []
+    cmd = ['/usr/sbin/rhnreg_ks']
+    server = utils.ScriptRunner(host)
+
+    # check satellite server url
+    server_url = (server_url.rstrip('/').endswith('/XMLRPC') and
+                  server_url or '%s/XMLRPC' % server_url)
+    cmd.extend(['--serverUrl', server_url])
+
+    if activation_key:
+        cmd.extend(['--activationkey', activation_key])
+    elif username:
+        cmd.extend(['--username', username])
+        if password:
+            cmd.extend(['--password', password])
+            mask.append(password)
+    else:
+        raise exceptions.InstallError('Either RHN Satellite activation '
+                                      'key or username/password must '
+                                      'be provided.')
+
+    if cacert:
+        # use and if required download given certificate
+        location = "/etc/sysconfig/rhn/%s" % os.path.basename(cacert)
+        if not os.path.isfile(location):
+            logging.debug('Downloading cacert from %s.' % server_url)
+            wget_cmd = (f'ls {location} &> /dev/null && echo -n "" || '
+                        'wget -nd --no-check-certificate --timeout=30 '
+                        f'--tries=3 -O "{location}" "{cacert}"')
+            server.append(wget_cmd)
+        cmd.extend(['--sslCACert', location])
+
+    if profile_name:
+        cmd.extend(['--profilename', profile_name])
+    if proxy_host:
+        cmd.extend(['--proxy', proxy_host])
+        if proxy_user:
+            cmd.extend(['--proxyUser', proxy_user])
+            if proxy_pass:
+                cmd.extend(['--proxyPassword', proxy_pass])
+                mask.append(proxy_pass)
+
+    flags = flags or []
+    flags.append('force')
+    for i in flags:
+        cmd.append('--%s' % i)
+
+    server.append(' '.join(cmd))
+    server.append('yum clean metadata')
+    server.execute(mask_list=mask)
+
+
+def run_rhsm_reg(host, username, password, optional=False, proxy_server=None,
+                 proxy_port=None, proxy_user=None, proxy_password=None,
+                 sat6_server=None, sat6_org=None, sat6_key=None):
+    """
+    Registers given host to Red Hat Repositories via subscription manager.
+    """
+    releasever = detect_os_and_version(host)[1].split('.')[0]
+    server = utils.ScriptRunner(host)
+
+    # configure proxy if it is necessary
+    if proxy_server:
+        cmd = ['subscription-manager', 'config',
+               f'--server.proxy_hostname={proxy_server}',
+               f'--server.proxy_port={proxy_port}']
+        if proxy_user:
+            cmd += [f'--server.proxy_user={proxy_user}',
+                    f'--server.proxy_password={proxy_password}']
+        server.append(cmd.join(' '))
+
+    if sat6_server:
+        # Register to Satellite 6 host
+        cmd = ('curl -k -O'
+               ' https://%s/pub/katello-ca-consumer-latest.noarch.rpm && '
+               ' yum -y install katello-ca-consumer-latest.noarch.rpm &&'
+               ' rm -f katello-ca-consumer-latest.noarch.rpm')
+        server.append(cmd % sat6_server)
+        cmd = ('subscription-manager register --org %s --activationkey %s')
+        server.append(cmd % (sat6_org, sat6_key))
+    else:
+        # Register to Hosted RHSM
+        cmd = ('subscription-manager register --username=\"%s\" '
+               '--password=\"%s\" --autosubscribe || true')
+        server.append(cmd % (username, password.replace('"', '\\"')))
+
+        # subscribe to required channel
+        cmd = ('subscription-manager list --consumed | grep -i openstack || '
+               'subscription-manager subscribe --pool %s')
+        pool = ("$(subscription-manager list --available | sed -n "
+                "\'/Red Hat OpenStack/, /Pool ID:/"
+                " { s/Pool ID:[[:space:]]*\\([[:alnum:]]*\\)/\\1/ p} \'"
+                " | head -1 )")
+        server.append(cmd % pool)
+
+    if optional:
+        server.append("subscription-manager repos "
+                      "--enable rhel-%s-server-optional-rpms" % releasever)
+        server.append("subscription-manager repos "
+                      "--enable rhel-%s-server-extras-rpms" % releasever)
+    server.append("subscription-manager repos "
+                  "--enable rhel-%s-server-openstack-10-rpms" % releasever)
+
+    server.append("yum clean all")
+    server.append("rpm -q --whatprovides yum-utils || "
+                  "yum install -y yum-utils")
+    server.append("yum clean metadata")
+    server.execute(mask_list=[password])
+
+
+def manage_centos_release_openstack(host, config):
+    """
+    Installs and enables CentOS OpenStack release package if installed locally.
+    """
+    try:
+        cmd = "rpm -qa --qf='%{name}-%{version}-%{release}.%{arch}\n' | grep centos-release-openstack"
+        rc, out = utils.execute(cmd, use_shell=True)
+    except exceptions.ExecuteRuntimeError:
+        # No CentOS Cloud SIG repo, so we don't need to continue
+        return
+
+    match = re.match(r'^centos-release-openstack-(?P<branch>\w+)\-(?P<version>\w+)\-(?P<release>\d+\.[\d\w]+)', out)
+    if not match:
+        # No CentOS Cloud SIG repo, so we don't need to continue
+        return
+    branch = match.group('branch')
+
+    server = utils.ScriptRunner(host)
+    server.append(
+        f"(rpm -q 'centos-release-openstack-{branch}' ||"
+        f" yum -y install centos-release-openstack-{branch}) || true")
+
+    try:
+        server.execute()
+    except exceptions.ScriptRuntimeError as ex:
+        msg = ('Failed to set CentOS Cloud SIG repo on host %s:\n%s'
+               % (host, ex))
+        raise exceptions.ScriptRuntimeError(msg)
+
+
+def manage_rdo(host, config):
+    """
+    Installs and enables RDO repo on host in case it is installed locally.
+    """
+    try:
+        cmd = "rpm -q rdo-release --qf='%{version}-%{release}.%{arch}\n'"
+        rc, out = utils.execute(cmd, use_shell=True)
+    except exceptions.ExecuteRuntimeError:
+        # RDO repo is not installed, so we don't need to continue
+        return
+
+    match = re.match(r'^(?P<version>\w+)\-.*\n', out)
+    version = match.group('version')
+    if re.match(r'^(.*\.el8.*\n)', out):
+        dist_tag = '.el8'
+    elif re.match(r'^(.*\.el9s.*\n)', out):
+        dist_tag = '.el9s'
+    else:
+        dist_tag = ''
+    rdo_url = (f"https://www.rdoproject.org/repos/openstack-{version}/"
+               f"rdo-release-{version}{dist_tag}.rpm")
+
+    server = utils.ScriptRunner(host)
+    server.append(f"(rpm -q 'rdo-release-{version}' ||"
+                  f" yum install -y --nogpg {rdo_url}) || true")
+    try:
+        server.execute()
+    except exceptions.ScriptRuntimeError as ex:
+        msg = 'Failed to set RDO repo on host %s:\n%s' % (host, ex)
+        raise exceptions.ScriptRuntimeError(msg)
+
+    reponame = 'openstack-%s' % version
+    server.clear()
+    server.append('yum-config-manager --enable %s' % reponame)
+
+    if config['CONFIG_ENABLE_RDO_TESTING'] == 'y':
+        server.append('yum-config-manager --disable %s' % reponame)
+        server.append('yum-config-manager --enable %s-testing' % reponame)
+
+    rc, out = server.execute()
+    match = re.search(r'enabled\s*=\s*(1|True)', out)
+    # In CentOS 7 yum-config-manager returns 0 always, but returns current setup
+    # if succeeds
+    # In CentOS 8 yum-config-manager returns 1 when failing but doesn't return current
+    # setup if succeeds
+    # In CentOS 9 yum-config-manager returns 1 when failing but doesn't return current
+    # setup if succeeds
+    if ((dist_tag == '.el9s' and rc != 0) or (dist_tag == '.el8' and rc != 0) or
+            (dist_tag == '' and not match)):
+        msg = ('Failed to set RDO repo on host %s:\nRPM file seems to be '
+               'installed, but appropriate repo file is probably missing '
+               'in /etc/yum.repos.d/' % host)
+        raise exceptions.ScriptRuntimeError(msg)
+# -------------------------- step functions --------------------------
+
+
+def choose_ip_version(config, messages):
+    use_ipv6 = None
+    use_ipv4 = None
     for hostname in filtered_hosts(config):
         if '/' in hostname:
             hostname = hostname.split('/')[0]
-        server = utils.ScriptRunner(hostname)
-        # TODO replace all that with ssh-copy-id
-        server.append("mkdir -p ~/.ssh")
-        server.append("chmod 500 ~/.ssh")
-        server.append("grep '%s' ~/.ssh/authorized_keys > /dev/null 2>&1 || "
-                      "echo %s >> ~/.ssh/authorized_keys"
-                      % (sshkeydata, sshkeydata))
-        server.append("chmod 400 ~/.ssh/authorized_keys")
-        server.append("restorecon -r ~/.ssh")
-        server.execute()
+        if use_ipv6 is None and use_ipv4 is None:
+            use_ipv6 = utils.network.is_ipv6(hostname)
+            use_ipv4 = utils.network.is_ipv4(hostname)
+        # check consistency
+        if (use_ipv6 and not utils.network.is_ipv6(hostname) or
+                use_ipv4 and not utils.network.is_ipv4(hostname)):
+            raise ValueError(
+                "Inconsistent host format. Please use either IPv4 addresses, "
+                "IPv6 adresses or hostnames for all host variables. "
+            )
+    if use_ipv6 and use_ipv4:
+        msg = "IPv6 together with IPv4 installation is not supported"
+        raise exceptions.ParamValidationError(msg)
+    elif use_ipv6:
+        config['CONFIG_IP_VERSION'] = 'ipv6'
+    elif use_ipv4:
+        config['CONFIG_IP_VERSION'] = 'ipv4'
+    else:
+        config['CONFIG_IP_VERSION'] = 'none'
 
 
-def discover(config):
-    """
-    Discovers details about hosts.
+def install_keys_on_host(hostname, sshkeydata):
+    server = utils.ScriptRunner(hostname)
+    # TODO(tbd) replace all that with ssh-copy-id
+    server.append("mkdir -p ~/.ssh")
+    server.append("chmod 500 ~/.ssh")
+    server.append("grep '%s' ~/.ssh/authorized_keys > /dev/null 2>&1 || "
+                  "echo %s >> ~/.ssh/authorized_keys"
+                  % (sshkeydata, sshkeydata))
+    server.append("chmod 400 ~/.ssh/authorized_keys")
+    server.append("restorecon -r ~/.ssh")
+    server.execute()
+
+
+def install_keys(config, messages):
+    with open(config["CONFIG_SSH_KEY"]) as fp:
+        sshkeydata = fp.read().strip()
+
+    # If this is a --allinone install *and* we are running as root,
+    # we can configure the authorized_keys file locally, avoid problems
+    # if PasswordAuthentication is disabled.
+    if is_all_in_one(config) and os.getuid() == 0:
+        install_keys_on_host(None, sshkeydata)
+    else:
+        for hostname in filtered_hosts(config):
+            if '/' in hostname:
+                hostname = hostname.split('/')[0]
+            install_keys_on_host(hostname, sshkeydata)
+
+
+def preinstall_and_discover(config, messages):
+    """Installs Puppet and it's dependencies and dependencies of Puppet
+    modules' package and discovers information about all hosts.
     """
-    # TODO: Once Controller is refactored, move this function to it (facter can
-    #       be used for that too).
+    config['HOST_LIST'] = list(filtered_hosts(config))
+
+    deps = list(basedefs.PUPPET_DEPENDENCIES) + list(basedefs.PUPPET_MODULES_DEPS)
+
     details = {}
-    release_regexp = re.compile(r'^(?P<OS>.*) release (?P<release>[\d\.]*)')
-    for host in filtered_hosts(config):
-        details.setdefault(host, {})
-        server = utils.ScriptRunner(host)
-        # discover OS and release
-        server.append('cat /etc/redhat-release')
-        try:
-            rc, out = server.execute()
-            match = release_regexp.search(out)
-            if not match:
-                raise exceptions.ScriptRuntimeError()
-        except exceptions.ScriptRuntimeError:
-            details[host]['os'] = 'Unknown'
-            details[host]['release'] = 'Unknown'
-        else:
-            opsys = match.group('OS')
-            for pattern, surr in [('^Red Hat Enterprise Linux.*', 'RHEL'),
-                                  ('^Fedora.*', 'Fedora'),
-                                  ('^CentOS.*', 'CentOS'),
-                                  ('^Scientific Linux.*', 'SL')]:
-                opsys = re.sub(pattern, surr, opsys)
-            details[host]['os'] = opsys
-            details[host]['release'] = match.group('release')
-
-        # Create the packstack tmp directory
+    for hostname in config['HOST_LIST']:
+        # install Puppet and it's dependencies
+        server = utils.ScriptRunner(hostname)
+        packages = ' '.join(deps)
+        server.append('yum install -y %s' % packages)
+        server.append('yum update -y %s' % packages)
+        # yum does not fail if one of the packages is missing
+        for package in deps:
+            server.append('rpm -q --whatprovides %s' % package)
+        server.execute()
+
+        # create the packstack tmp directory
         server.clear()
-        server.append("mkdir -p %s" % basedefs.PACKSTACK_VAR_DIR)
+        server.append('mkdir -p %s' % basedefs.PACKSTACK_VAR_DIR)
         # Separately create the tmp directory for this packstack run, this will
         # fail if the directory already exists
         host_dir = os.path.join(basedefs.PACKSTACK_VAR_DIR, uuid.uuid4().hex)
-        server.append("mkdir --mode 0700 %s" % host_dir)
+        server.append('mkdir --mode 0700 %s' % host_dir)
         for i in ('modules', 'resources'):
-            server.append("mkdir --mode 0700 %s" % os.path.join(host_dir, i))
+            server.append('mkdir --mode 0700 %s' % os.path.join(host_dir, i))
+        server.execute()
+        details.setdefault(hostname, {})['tmpdir'] = host_dir
+
+        # discover other host info; Facter is installed as Puppet dependency,
+        # so we let it do the work
+        server.clear()
+        server.append('facter -p')
+        rc, stdout = server.execute()
+        for line in stdout.split('\n'):
+            try:
+                key, value = line.split('=>', 1)
+            except ValueError:
+                # this line is probably some warning, so let's skip it
+                continue
+            else:
+                details[hostname][key.strip()] = value.strip()
+
+        # create a symbolic link to /etc/hiera.yaml to avoid warning messages
+        # such as "Warning: Config file /etc/puppet/hiera.yaml not found,
+        # using Hiera defaults"
+        server.clear()
+        server.append('[[ -f /etc/hiera.yaml ]] && '
+                      '[[ ! -L /etc/puppet/hiera.yaml ]] && '
+                      'ln -s /etc/hiera.yaml /etc/puppet/hiera.yaml || '
+                      'echo "skipping creation of  hiera.yaml symlink"')
+        server.append("sed -i 's;:datadir:.*;:datadir: "
+                      "%s/hieradata;g' $(puppet config print hiera_config)"
+                      % details[hostname]['tmpdir'])
         server.execute()
-        details[host]['tmpdir'] = host_dir
     config['HOST_DETAILS'] = details
 
 
-def create_manifest(config):
-    key = 'CONFIG_DEBUG_MODE'
-    config[key] = config[key] == 'y' and 'true' or 'false'
+def server_prep(config, messages):
+    rh_username = None
+    sat_url = None
+    sat6_server = None
+    if is_rhel():
+        rh_username = config.get("CONFIG_RH_USER")
+        rh_password = config.get("CONFIG_RH_PW")
+        sat6_server = config.get("CONFIG_RH_SAT6_SERVER")
+
+        sat_registered = set()
+
+        sat_url = config["CONFIG_SATELLITE_URL"].strip()
+        if sat_url:
+            flag_list = config["CONFIG_SATELLITE_FLAGS"].split(',')
+            sat_flags = [i.strip() for i in flag_list if i.strip()]
+            sat_proxy_user = config.get("CONFIG_SATELLITE_PROXY_USER", '')
+            sat_proxy_pass = config.get("CONFIG_SATELLITE_PROXY_PW", '')
+            sat_args = {
+                'username': config["CONFIG_SATELLITE_USER"].strip(),
+                'password': config["CONFIG_SATELLITE_PW"].strip(),
+                'cacert': config["CONFIG_SATELLITE_CACERT"].strip(),
+                'activation_key': config["CONFIG_SATELLITE_AKEY"].strip(),
+                'profile_name': config["CONFIG_SATELLITE_PROFILE"].strip(),
+                'proxy_host': config["CONFIG_SATELLITE_PROXY"].strip(),
+                'proxy_user': sat_proxy_user.strip(),
+                'proxy_pass': sat_proxy_pass.strip(),
+                'flags': sat_flags
+            }
 
     for hostname in filtered_hosts(config):
-        manifestfile = "%s_prescript.pp" % hostname
-        manifestdata = getManifestTemplate("prescript.pp")
-        appendManifestFile(manifestfile, manifestdata)
+        # Subscribe to Red Hat Repositories if configured
+        if rh_username or sat6_server:
+            run_rhsm_reg(hostname, rh_username, rh_password,
+                         optional=(config.get('CONFIG_RH_OPTIONAL') == 'y'),
+                         proxy_server=config.get('CONFIG_RH_PROXY'),
+                         proxy_port=config.get('CONFIG_RH_PROXY_PORT'),
+                         proxy_user=config.get('CONFIG_RH_PROXY_USER'),
+                         proxy_password=config.get('CONFIG_RH_PROXY_PASSWORD'),
+                         sat6_server=config.get('CONFIG_RH_SAT6_SERVER'),
+                         sat6_org=config.get('CONFIG_RH_SAT6_ORG'),
+                         sat6_key=config.get('CONFIG_RH_SAT6_KEY'))
+
+        # Subscribe to RHN Satellite if configured
+        if sat_url and hostname not in sat_registered:
+            run_rhn_reg(hostname, sat_url, **sat_args)
+            sat_registered.add(hostname)
+
+        server = utils.ScriptRunner(hostname)
+        server.append('rpm -q --whatprovides yum-utils || '
+                      'yum install -y yum-utils')
+
+        if is_rhel():
+            # Installing rhos-log-collector if it is available from yum.
+            server.append('yum list available rhos-log-collector && '
+                          'yum -y install rhos-log-collector || '
+                          'echo "no rhos-log-collector available"')
+
+        server.execute()
+
+        # enable CentOS Cloud SIG repo if installed locally
+        manage_centos_release_openstack(hostname, config)
+        # enable RDO if it is installed locally
+        manage_rdo(hostname, config)
 
+        # Add yum repositories if configured
+        CONFIG_REPO = config["CONFIG_REPO"].strip()
+        if CONFIG_REPO:
+            for i, repourl in enumerate(CONFIG_REPO.split(',')):
+                reponame = 'packstack_%d' % i
+                server.append(f'echo "[{reponame}]\nname={reponame}\n'
+                              f'baseurl={repourl}\nenabled=1\n'
+                              'priority=1\ngpgcheck=0"'
+                              f' > /etc/yum.repos.d/{reponame}.repo')
 
-def create_ntp_manifest(config):
+        server.append("yum clean metadata")
+        server.execute()
+
+
+def create_manifest(config, messages):
+    key = 'CONFIG_DEBUG_MODE'
+    config[key] = config[key] == 'y' and True or False
+
+    if config['CONFIG_UNSUPPORTED'] != 'y':
+        config['CONFIG_STORAGE_HOST'] = config['CONFIG_CONTROLLER_HOST']
+    if config['CONFIG_IP_VERSION'] == 'ipv6':
+        storage_host = config['CONFIG_STORAGE_HOST']
+        config['CONFIG_STORAGE_HOST_URL'] = "[%s]" % storage_host
+    else:
+        config['CONFIG_STORAGE_HOST_URL'] = config['CONFIG_STORAGE_HOST']
+
+
+def create_ntp_manifest(config, messages):
     srvlist = [i.strip()
                for i in config['CONFIG_NTP_SERVERS'].split(',')
                if i.strip()]
@@ -400,10 +1348,3 @@ def create_ntp_manifest(config):
 
     definiton = '\n'.join(['server %s' % i for i in srvlist])
     config['CONFIG_NTP_SERVER_DEF'] = '%s\n' % definiton
-
-    marker = uuid.uuid4().hex[:16]
-    for hostname in filtered_hosts(config):
-        manifestdata = getManifestTemplate('ntpd.pp')
-        appendManifestFile('%s_ntpd.pp' % hostname,
-                           manifestdata,
-                           marker=marker)
diff --git a/packstack/plugins/provision_700.py b/packstack/plugins/provision_700.py
index 1e3dc023a..6ed489a3e 100644
--- a/packstack/plugins/provision_700.py
+++ b/packstack/plugins/provision_700.py
@@ -1,169 +1,417 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 """
-Installs and configures neutron
+Installs and configures Provisioning for demo usage and testing
 """
+import json
 
-import logging
-
+from packstack.installer import basedefs
+from packstack.installer import utils
 from packstack.installer import validators
+from packstack.installer import processors
+from packstack.installer.core import arch
 
-from packstack.modules.common import is_all_in_one
-from packstack.modules.ospluginutils import (appendManifestFile,
-                                             getManifestTemplate)
+from packstack.modules.documentation import update_params_usage
 
+# ------------- Provision Packstack Plugin Initialization --------------
 
-# Controller object will be initialized from main flow
-controller = None
-
-# Plugin name
 PLUGIN_NAME = "OS-Provision"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
 
-logging.debug("plugin %s loaded", __name__)
-
+DEMO_IMAGE_NAME = 'cirros'
+DEMO_IMAGE_URL = (
+    'https://download.cirros-cloud.net/0.5.1/cirros-0.5.1-%s-disk.img'
+    % (arch.cirros_arch())
+)
+DEMO_IMAGE_SSH_USER = 'cirros'
+DEMO_IMAGE_FORMAT = 'qcow2'
 
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
 
-    logging.debug("Provisioning OpenStack resources for demo usage and testing")
+def initConfig(controller):
 
-    def process_provision(param, process_args=None):
-        return param if is_all_in_one(controller.CONF) else 'n'
+    def process_tempest(param, param_name, config=None):
+        if param == "":
+            # In case of multinode installs by default we deploy
+            # Tempest on network node
+            return config['CONFIG_NETWORK_HOSTS'].split(',')[0]
+        return param
 
     conf_params = {
-        "PROVISION_INIT" : [
-            {"CMD_OPTION"      : "provision-demo",
-             "USAGE"           : ("Whether to provision for demo usage and testing. Note "
-                                  "that provisioning is only supported for all-in-one "
-                                  "installations."),
-             "PROMPT"          : "Would you like to provision for demo usage and testing?",
-             "OPTION_LIST"     : ["y", "n"],
-             "VALIDATORS"      : [validators.validate_options],
-             "PROCESSORS"      : [process_provision],
-             "DEFAULT_VALUE"   : "y",
-             "MASK_INPUT"      : False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_PROVISION_DEMO",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "provision-tempest",
-             "USAGE"           : ("Whether to configure tempest for testing. Note "
-                                  "that provisioning is only supported for all-in-one "
-                                  "installations."),
-             "PROMPT"          : "Would you like to configure Tempest (OpenStack test suite)?",
-             "OPTION_LIST"     : ["y", "n"],
-             "VALIDATORS"      : [validators.validate_options],
-             "PROCESSORS"      : [process_provision],
-             "DEFAULT_VALUE"   : "n",
-             "MASK_INPUT"      : False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_PROVISION_TEMPEST",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            ],
-        "PROVISION_DEMO" : [
-            {"CMD_OPTION"      : "provision-demo-floatrange",
-             "USAGE"           : "The CIDR network address for the floating IP subnet",
-             "PROMPT"          : "Enter the network address for the floating IP subnet:",
-             "OPTION_LIST"     : False,
-             "VALIDATORS"      : False,
-             "DEFAULT_VALUE"   : "172.24.4.224/28",
-             "MASK_INPUT"      : False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_PROVISION_DEMO_FLOATRANGE",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            ],
-        "TEMPEST_GIT_REFS" : [
-            {"CMD_OPTION"      : "provision-tempest-repo-uri",
-             "USAGE"           : "The uri of the tempest git repository to use",
-             "PROMPT"          : "What is the uri of the Tempest git repository?",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_not_empty],
-             "DEFAULT_VALUE"   : "https://github.com/openstack/tempest.git",
-             "MASK_INPUT"      : False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_PROVISION_TEMPEST_REPO_URI",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            {"CMD_OPTION"      : "provision-tempest-repo-revision",
-             "USAGE"           : "The revision of the tempest git repository to use",
-             "PROMPT"          : "What revision, branch, or tag of the Tempest git repository should be used?",
-             "OPTION_LIST"     : [],
-             "VALIDATORS"      : [validators.validate_not_empty],
-             "DEFAULT_VALUE"   : "master",
-             "MASK_INPUT"      : False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_PROVISION_TEMPEST_REPO_REVISION",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            ],
-        "PROVISION_ALL_IN_ONE_OVS_BRIDGE" : [
-            {"CMD_OPTION"      : "provision-all-in-one-ovs-bridge",
-             "USAGE"           : "Whether to configure the ovs external bridge in an all-in-one deployment",
-             "PROMPT"          : "Would you like to configure the external ovs bridge?",
-             "OPTION_LIST"     : ["y", "n"],
-             "VALIDATORS"      : [validators.validate_options],
-             "DEFAULT_VALUE"   : "n",
-             "MASK_INPUT"      : False,
-             "LOOSE_VALIDATION": True,
-             "CONF_NAME"       : "CONFIG_PROVISION_ALL_IN_ONE_OVS_BRIDGE",
-             "USE_DEFAULT"     : False,
-             "NEED_CONFIRM"    : False,
-             "CONDITION"       : False },
-            ],
-        }
-
-    def allow_provisioning(config):
-        # Provisioning is currently supported only for all-in-one (due
-        # to a limitation with how the custom types for OpenStack
-        # resources are implemented).
-        return is_all_in_one(config)
+        "PROVISION_INIT": [
+            {"CMD_OPTION": "provision-demo",
+             "PROMPT": ("Would you like to provision for demo usage "
+                        "and testing"),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_DEMO",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-tempest",
+             "PROMPT": ("Would you like to configure Tempest (OpenStack test "
+                        "suite). Note that provisioning is only supported for "
+                        "all-in-one installations."),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "n",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_TEMPEST",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "PROVISION_DEMO": [
+            {"CMD_OPTION": "provision-demo-floatrange",
+             "PROMPT": "Enter the network address for the floating IP subnet",
+             "OPTION_LIST": False,
+             "VALIDATORS": False,
+             "DEFAULT_VALUE": "172.24.4.0/24",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_DEMO_FLOATRANGE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-demo-allocation-pools",
+             "PROMPT": ("Enter the allocation pools from the floating IP "
+                        "subnet, as JSON list [\"start=ip1,end=ip2\", ...]"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "[]",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_PROVISION_DEMO_ALLOCATION_POOLS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-image-name",
+             "PROMPT": "Enter the name to be assigned to the demo image",
+             "OPTION_LIST": False,
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": DEMO_IMAGE_NAME,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_IMAGE_NAME",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-image-url",
+             "PROMPT": ("Enter the location of an image to be loaded "
+                        "into Glance"),
+             "OPTION_LIST": False,
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": DEMO_IMAGE_URL,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_IMAGE_URL",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-image-format",
+             "PROMPT": ("Enter the format of the demo image"),
+             "OPTION_LIST": False,
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": DEMO_IMAGE_FORMAT,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_IMAGE_FORMAT",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-image-properties",
+             "PROMPT": ("Enter the comma-separated list of key=value pairs "
+                        "to set as the properties of the demo image"),
+             "OPTION_LIST": False,
+             "VALIDATORS": [],
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_IMAGE_PROPERTIES",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-image-ssh-user",
+             "PROMPT": ("Enter the name of a user to use when connecting "
+                        "to the demo image via ssh"),
+             "OPTION_LIST": False,
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": DEMO_IMAGE_SSH_USER,
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_IMAGE_SSH_USER",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+        ],
+
+        "PROVISION_TEMPEST": [
+            {"CMD_OPTION": "tempest-host",
+             "PROMPT": "Enter the host where to deploy Tempest",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_ssh],
+             "DEFAULT_VALUE": "",
+             "PROCESSORS": [process_tempest],
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_TEMPEST_HOST",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-tempest-user",
+             "PROMPT": ("Enter the name of the Tempest Provisioning user "
+                        "(if blank, Tempest will be configured in a "
+                        "standalone mode) "),
+             "OPTION_LIST": False,
+             "VALIDATORS": False,
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_TEMPEST_USER",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-tempest-user-passwd",
+             "PROMPT": "Enter the password for the Tempest Provisioning user",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "PW_PLACEHOLDER",
+             "PROCESSORS": [processors.process_password],
+             "MASK_INPUT": True,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": "CONFIG_PROVISION_TEMPEST_USER_PW",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": True,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-tempest-floatrange",
+             "PROMPT": "Enter the network address for the floating IP subnet",
+             "OPTION_LIST": False,
+             "VALIDATORS": False,
+             "DEFAULT_VALUE": "172.24.4.0/24",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_TEMPEST_FLOATRANGE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-tempest-flavor-name",
+             "PROMPT": "What is the name of the primary Tempest flavor?",
+             "OPTION_LIST": False,
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "m1.nano",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_TEMPEST_FLAVOR_NAME",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-tempest-flavor-disk",
+             "PROMPT": ("How much of disk space has "
+                        "the primary Tempest flavor (Gb)?"),
+             "OPTION_LIST": False,
+             "VALIDATORS": [validators.validate_integer],
+             "DEFAULT_VALUE": "1",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_TEMPEST_FLAVOR_DISK",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-tempest-flavor-ram",
+             "PROMPT": "How much is the primary Tempest flavor's ram (Mb)?",
+             "OPTION_LIST": False,
+             "VALIDATORS": [validators.validate_integer],
+             "DEFAULT_VALUE": "128",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_TEMPEST_FLAVOR_RAM",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-tempest-flavor-vcpus",
+             "PROMPT": "How many vcpus is in the primary Tempest flavor?",
+             "OPTION_LIST": False,
+             "VALIDATORS": [validators.validate_integer],
+             "DEFAULT_VALUE": "1",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_TEMPEST_FLAVOR_VCPUS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-tempest-flavor-alt-name",
+             "PROMPT": "What is the name of the alternative Tempest flavor?",
+             "OPTION_LIST": False,
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "m1.micro",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_NAME",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-tempest-flavor-alt-disk",
+             "PROMPT": ("How much of disk space has "
+                        "the alternative Tempest flavor (Gb)?"),
+             "OPTION_LIST": False,
+             "VALIDATORS": [validators.validate_integer],
+             "DEFAULT_VALUE": "1",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_DISK",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-tempest-flavor-alt-ram",
+             "PROMPT": "How much is the alternative Tempest flavor's ram?",
+             "OPTION_LIST": False,
+             "VALIDATORS": [validators.validate_integer],
+             "DEFAULT_VALUE": "128",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_RAM",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "provision-tempest-flavor-alt-vcpus",
+             "PROMPT": "How many vcpus has the alternative Tempest flavor?",
+             "OPTION_LIST": False,
+             "VALIDATORS": [validators.validate_integer],
+             "DEFAULT_VALUE": "1",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_VCPUS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "run-tempest",
+             "PROMPT": ("Do you wish to run tempest?"),
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "n",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_RUN_TEMPEST",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "run-tempest-tests",
+             "PROMPT": ("What tempest tests should run ?"
+                        " (If blank, Tempest will run smoke tests)"),
+             "OPTION_LIST": [],
+             "VALIDATORS": False,
+             "DEFAULT_VALUE": "smoke",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_RUN_TEMPEST_TESTS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "skip-tempest-tests",
+             "PROMPT": ("What tempest tests should skipped ?"
+                        " (If blank, Tempest will not skip any tests)"),
+             "OPTION_LIST": [],
+             "VALIDATORS": False,
+             "DEFAULT_VALUE": "",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_SKIP_TEMPEST_TESTS",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False}
+        ],
+
+        "PROVISION_OVS_BRIDGE": [
+            {"CMD_OPTION": "provision-ovs-bridge",
+             "PROMPT": "Would you like to configure the external ovs bridge",
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_PROVISION_OVS_BRIDGE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_PROVISION_ALL_IN_ONE_OVS_BRIDGE']},
+        ],
+    }
+    update_params_usage(basedefs.PACKSTACK_DOC, conf_params)
 
     def check_provisioning_demo(config):
-        return (allow_provisioning(config) and
-                (config.get('CONFIG_PROVISION_DEMO', 'n') == 'y' or
-                 config.get('CONFIG_PROVISION_TEMPEST', 'n') == 'y'))
+        return (config.get('CONFIG_PROVISION_DEMO', 'n') == 'y')
 
     def check_provisioning_tempest(config):
-        return allow_provisioning(config) and \
-               config.get('CONFIG_PROVISION_TEMPEST', 'n') == 'y'
+        return (config.get('CONFIG_PROVISION_TEMPEST', 'n') == 'y')
 
     def allow_all_in_one_ovs_bridge(config):
-        return allow_provisioning(config) and \
-               config['CONFIG_NEUTRON_INSTALL'] == 'y' and \
-               config['CONFIG_NEUTRON_L2_PLUGIN'] == 'openvswitch'
+        return (config['CONFIG_NEUTRON_INSTALL'] == 'y')
 
     conf_groups = [
-        { "GROUP_NAME"            : "PROVISION_INIT",
-          "DESCRIPTION"           : "Provisioning demo config",
-          "PRE_CONDITION"         : lambda x: 'yes',
-          "PRE_CONDITION_MATCH"   : "yes",
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        { "GROUP_NAME"            : "PROVISION_DEMO",
-          "DESCRIPTION"           : "Provisioning demo config",
-          "PRE_CONDITION"         : check_provisioning_demo,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        { "GROUP_NAME"            : "TEMPEST_GIT_REFS",
-          "DESCRIPTION"           : "Optional tempest git uri and branch",
-          "PRE_CONDITION"         : check_provisioning_tempest,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        { "GROUP_NAME"            : "PROVISION_ALL_IN_ONE_OVS_BRIDGE",
-          "DESCRIPTION"           : "Provisioning all-in-one ovs bridge config",
-          "PRE_CONDITION"         : allow_all_in_one_ovs_bridge,
-          "PRE_CONDITION_MATCH"   : True,
-          "POST_CONDITION"        : False,
-          "POST_CONDITION_MATCH"  : True },
-        ]
+        {"GROUP_NAME": "PROVISION_INIT",
+         "DESCRIPTION": "Provisioning demo config",
+         "PRE_CONDITION": lambda x: 'yes',
+         "PRE_CONDITION_MATCH": "yes",
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "PROVISION_DEMO",
+         "DESCRIPTION": "Provisioning demo config",
+         "PRE_CONDITION": check_provisioning_demo,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "PROVISION_TEMPEST",
+         "DESCRIPTION": "Provisioning tempest config",
+         "PRE_CONDITION": check_provisioning_tempest,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+
+        {"GROUP_NAME": "PROVISION_OVS_BRIDGE",
+         "DESCRIPTION": "Provisioning all-in-one ovs bridge config",
+         "PRE_CONDITION": allow_all_in_one_ovs_bridge,
+         "PRE_CONDITION_MATCH": True,
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+    ]
     for group in conf_groups:
         paramList = conf_params[group["GROUP_NAME"]]
         controller.addGroup(group, paramList)
@@ -172,62 +420,18 @@ def allow_all_in_one_ovs_bridge(config):
     # provision.pp needs them all. So we will initialize them with default
     # values
     params = [
-        controller.getParamByName(x)
-        for x in ['CONFIG_PROVISION_TEMPEST_REPO_URI',
-                  'CONFIG_PROVISION_TEMPEST_REPO_REVISION',
-                  'CONFIG_PROVISION_ALL_IN_ONE_OVS_BRIDGE']
+        controller.getParamByName('CONFIG_PROVISION_OVS_BRIDGE')
     ]
     for param in params:
         value = controller.CONF.get(param.CONF_NAME, param.DEFAULT_VALUE)
         controller.CONF[param.CONF_NAME] = value
 
 
-def marshall_conf_bool(conf, key):
-    if conf[key] == 'y':
-        conf[key] = 'true'
-    else:
-        conf[key] = 'false'
-
-
 def initSequences(controller):
-    provisioning_required = (
-        controller.CONF['CONFIG_PROVISION_DEMO'] == 'y'
-        or
-        controller.CONF['CONFIG_PROVISION_TEMPEST'] == 'y'
-    )
-    if not provisioning_required:
-        return
-    marshall_conf_bool(controller.CONF, 'CONFIG_PROVISION_TEMPEST')
-    marshall_conf_bool(controller.CONF,
-                       'CONFIG_PROVISION_ALL_IN_ONE_OVS_BRIDGE')
-    provision_steps = [
-        {
-            'title': 'Adding Provisioning manifest entries',
-            'functions': [create_manifest],
-        }
-    ]
-    controller.addSequence("Provisioning for Demo and Testing Usage",
-                           [], [], provision_steps)
-
-
-def create_manifest(config):
-    # Using the neutron or nova api servers as the provisioning target
-    # will suffice for the all-in-one case.
-    if config['CONFIG_NEUTRON_INSTALL'] == "y":
-        host = config['CONFIG_NEUTRON_SERVER_HOST']
-    else:
-        host = config['CONFIG_NOVA_API_HOST']
-        # The provisioning template requires the name of the external
-        # bridge but the value will be missing if neutron isn't
-        # configured to be installed.
-        config['CONFIG_NEUTRON_L3_EXT_BRIDGE'] = 'br-ex'
-
-    # Set template-specific parameter to configure whether neutron is
-    # available.  The value needs to be true/false rather than the y/n.
-    # provided by CONFIG_NEUTRON_INSTALL.
-    config['PROVISION_NEUTRON_AVAILABLE'] = config['CONFIG_NEUTRON_INSTALL']
-    marshall_conf_bool(config, 'PROVISION_NEUTRON_AVAILABLE')
-
-    manifest_file = '%s_provision.pp' % host
-    manifest_data = getManifestTemplate("provision.pp")
-    appendManifestFile(manifest_file, manifest_data)
+    config = controller.CONF
+    # params modification
+    key = 'CONFIG_PROVISION_DEMO_ALLOCATION_POOLS'
+    value = config.get(key, "[]")
+    config[key] = json.loads(value)
+    if type(config[key]) is not list:
+        raise KeyError("Key %s is not a list: %s" % (key, config[key]))
diff --git a/packstack/plugins/puppet_950.py b/packstack/plugins/puppet_950.py
index 114a4883f..619f9a168 100644
--- a/packstack/plugins/puppet_950.py
+++ b/packstack/plugins/puppet_950.py
@@ -1,143 +1,85 @@
-# -*- coding: utf-8 -*-
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 """
-Installs and configures puppet
+Installs and configures Puppet
 """
-import sys
+
 import logging
 import os
-import platform
+import sys
 import time
 
 from packstack.installer import utils
-from packstack.installer import basedefs, output_messages
-from packstack.installer.exceptions import ScriptRuntimeError, PuppetError
+from packstack.installer import basedefs
+from packstack.installer.exceptions import PuppetError
+from packstack.installer.exceptions import ScriptRuntimeError
+from packstack.installer.utils import split_hosts
 
 from packstack.modules.common import filtered_hosts
+from packstack.modules.ospluginutils import appendManifestFile
+from packstack.modules.ospluginutils import generateHieraDataFile
+from packstack.modules.ospluginutils import getManifestTemplate
 from packstack.modules.ospluginutils import manifestfiles
-from packstack.modules.puppet import scan_logfile, validate_logfile
+from packstack.modules.puppet import validate_logfile
+from packstack.modules.puppet import scan_logfile
 
-# Controller object will be initialized from main flow
-controller = None
 
-# Plugin name
-PLUGIN_NAME = "OSPUPPET"
+# ------------- Puppet Packstack Plugin Initialization --------------
+
+PLUGIN_NAME = "Puppet"
 PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
 
-logging.debug("plugin %s loaded", __name__)
 
-PUPPET_DIR = os.environ.get('PACKSTACK_PUPPETDIR', '/usr/share/openstack-puppet/')
+PUPPET_DIR = os.environ.get('PACKSTACK_PUPPETDIR',
+                            '/usr/share/openstack-puppet/')
 MODULE_DIR = os.path.join(PUPPET_DIR, 'modules')
 
 
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding OpenStack Puppet configuration")
-    paramsList = [
-                 ]
-
-    groupDict = {"GROUP_NAME"            : "PUPPET",
-                 "DESCRIPTION"           : "Puppet Config parameters",
-                 "PRE_CONDITION"         : lambda x: 'yes',
-                 "PRE_CONDITION_MATCH"   : "yes",
-                 "POST_CONDITION"        : False,
-                 "POST_CONDITION_MATCH"  : True}
-
-    controller.addGroup(groupDict, paramsList)
+def initConfig(controller):
+    group = {"GROUP_NAME": "PUPPET",
+             "DESCRIPTION": "Puppet Config parameters",
+             "PRE_CONDITION": lambda x: 'yes',
+             "PRE_CONDITION_MATCH": "yes",
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+    controller.addGroup(group, [])
 
 
 def initSequences(controller):
     puppetpresteps = [
-             {'title': 'Clean Up', 'functions':[runCleanup]},
+        {'title': 'Clean Up', 'functions': [run_cleanup]},
     ]
     controller.insertSequence("Clean Up", [], [], puppetpresteps, index=0)
 
     puppetsteps = [
-        {'title': 'Installing Dependencies',
-            'functions': [installdeps]},
+        {'title': 'Preparing Puppet manifests',
+            'functions': [prepare_puppet_modules]},
         {'title': 'Copying Puppet modules and manifests',
-            'functions': [copyPuppetModules]},
+            'functions': [copy_puppet_modules]},
         {'title': 'Applying Puppet manifests',
-            'functions': [applyPuppetManifest]},
+            'functions': [apply_puppet_manifest]},
         {'title': 'Finalizing',
             'functions': [finalize]}
     ]
     controller.addSequence("Puppet", [], [], puppetsteps)
 
 
-def runCleanup(config):
-    localserver = utils.ScriptRunner()
-    localserver.append("rm -rf %s/*pp" % basedefs.PUPPET_MANIFEST_DIR)
-    localserver.execute()
-
-
-def installdeps(config):
-    deps = ["puppet", "openssh-clients", "tar", "nc"]
-    modules_pkg = 'openstack-puppet-modules'
-
-    local = utils.ScriptRunner()
-    local.append('rpm -q --requires %s | egrep -v "^(rpmlib|\/|perl)"'
-                 % modules_pkg)
-    rc, modules_deps = local.execute()
-
-    # Modules package might not be installed if we are running from source.
-    # In this case we assume user knows what (s)he's doing and we don't
-    # install modules dependencies
-    if ('%s is not installed' % modules_pkg) not in modules_deps:
-        modules_deps = [i.strip() for i in modules_deps.split() if i.strip()]
-        deps.extend(modules_deps)
-
-    for hostname in filtered_hosts(config):
-        server = utils.ScriptRunner(hostname)
-        for package in deps:
-            server.append("rpm -q --whatprovides %s || yum install -y %s" % (package, package))
-        server.execute()
-
-
-def copyPuppetModules(config):
-    os_modules = ' '.join(('apache', 'ceilometer', 'certmonger', 'cinder',
-                           'concat', 'firewall', 'glance', 'heat', 'horizon',
-                           'inifile', 'keystone', 'memcached', 'mongodb',
-                           'mysql', 'neutron', 'nova', 'nssdb', 'openstack',
-                           'packstack', 'qpid', 'rabbitmq', 'rsync', 'ssh', 'stdlib',
-                           'swift', 'sysctl', 'tempest', 'vcsrepo', 'vlan',
-                           'vswitch', 'xinetd'))
-
-        # write puppet manifest to disk
-    manifestfiles.writeManifests()
-
-    server = utils.ScriptRunner()
-    for hostname in filtered_hosts(config):
-        host_dir = config['HOST_DETAILS'][hostname]['tmpdir']
-        # copy Packstack manifests
-        server.append("cd %s/puppet" % basedefs.DIR_PROJECT_DIR)
-        server.append("cd %s" % basedefs.PUPPET_MANIFEST_DIR)
-        server.append("tar --dereference -cpzf - ../manifests | "
-                      "ssh -o StrictHostKeyChecking=no "
-                          "-o UserKnownHostsFile=/dev/null "
-                          "root@%s tar -C %s -xpzf -" % (hostname, host_dir))
-
-        # copy resources
-        for path, localname in controller.resources.get(hostname, []):
-            server.append("scp -o StrictHostKeyChecking=no "
-                "-o UserKnownHostsFile=/dev/null %s root@%s:%s/resources/%s" %
-                (path, hostname, host_dir, localname))
-
-        # copy Puppet modules required by Packstack
-        server.append("cd %s" % MODULE_DIR)
-        server.append("tar --dereference -cpzf - %s | "
-                      "ssh -o StrictHostKeyChecking=no "
-                          "-o UserKnownHostsFile=/dev/null "
-                          "root@%s tar -C %s -xpzf -" %
-                      (os_modules, hostname, os.path.join(host_dir, 'modules')))
-    server.execute()
+# ------------------------- helper functions -------------------------
 
-
-def waitforpuppet(currently_running):
-    global controller
+def wait_for_puppet(currently_running, messages):
     log_len = 0
-    twirl = ["-","\\","|","/"]
+    twirl = ["-", "\\", "|", "/"]
     while currently_running:
         for hostname, finished_logfile in currently_running:
             log_file = os.path.splitext(os.path.basename(finished_logfile))[0]
@@ -145,7 +87,8 @@ def waitforpuppet(currently_running):
                 log_len = len(log_file)
             if hasattr(sys.stdout, "isatty") and sys.stdout.isatty():
                 twirl = twirl[-1:] + twirl[:-1]
-                sys.stdout.write(("\rTesting if puppet apply is finished: %s" % log_file).ljust(40 + log_len))
+                sys.stdout.write(("\rTesting if puppet apply is finished: %s"
+                                 % log_file).ljust(40 + log_len))
                 sys.stdout.write("[ %s ]" % twirl[0])
                 sys.stdout.flush()
             try:
@@ -153,8 +96,12 @@ def waitforpuppet(currently_running):
                 # file and check it for errors
                 local_server = utils.ScriptRunner()
                 log = os.path.join(basedefs.PUPPET_MANIFEST_DIR,
-                                   os.path.basename(finished_logfile).replace(".finished", ".log"))
-                local_server.append('scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@%s:%s %s' % (hostname, finished_logfile, log))
+                                   os.path.basename(finished_logfile))
+                log = log.replace(".finished", ".log")
+                local_server.append('scp -o StrictHostKeyChecking=no '
+                                    '-o UserKnownHostsFile=/dev/null '
+                                    'root@[%s]:%s %s'
+                                    % (hostname, finished_logfile, log))
                 # To not pollute logs we turn of logging of command execution
                 local_server.execute(log=False)
 
@@ -163,7 +110,7 @@ def waitforpuppet(currently_running):
 
                 # clean off the last "testing apply" msg
                 if hasattr(sys.stdout, "isatty") and sys.stdout.isatty():
-                    sys.stdout.write(('\r').ljust(45 + log_len))
+                    sys.stdout.write(("\r").ljust(45 + log_len))
 
             except ScriptRuntimeError:
                 # the test raises an exception if the file doesn't exist yet
@@ -172,7 +119,7 @@ def waitforpuppet(currently_running):
                 continue
 
             # check log file for relevant notices
-            controller.MESSAGES.extend(scan_logfile(log))
+            messages.extend(scan_logfile(log))
 
             # check the log file for errors
             sys.stdout.write('\r')
@@ -188,7 +135,67 @@ def waitforpuppet(currently_running):
                 raise
 
 
-def applyPuppetManifest(config):
+# -------------------------- step functions --------------------------
+
+def run_cleanup(config, messages):
+    localserver = utils.ScriptRunner()
+    localserver.append("rm -rf %s/*pp" % basedefs.PUPPET_MANIFEST_DIR)
+    localserver.execute()
+
+
+def copy_puppet_modules(config, messages):
+    os_modules = ' '.join(('aodh', 'apache', 'ceilometer', 'cinder', 'concat',
+                           'firewall', 'glance', 'gnocchi', 'heat', 'horizon',
+                           'inifile', 'ironic', 'keystone', 'magnum', 'manila',
+                           'memcached', 'mysql', 'neutron', 'nova', 'nssdb',
+                           'openstacklib', 'oslo', 'ovn', 'packstack',
+                           'placement', 'rabbitmq', 'redis', 'remote', 'rsync',
+                           'ssh', 'stdlib', 'swift', 'sysctl', 'systemd',
+                           'tempest', 'trove', 'vcsrepo', 'vswitch', 'xinetd'))
+
+    # write puppet manifest to disk
+    manifestfiles.writeManifests()
+    # write hieradata file to disk
+    generateHieraDataFile()
+
+    server = utils.ScriptRunner()
+    for hostname in filtered_hosts(config):
+        host_dir = config['HOST_DETAILS'][hostname]['tmpdir']
+        # copy hiera defaults.yaml file
+        server.append("cd %s" % basedefs.HIERADATA_DIR)
+        server.append("tar --dereference -cpzf - ../hieradata | "
+                      "ssh -o StrictHostKeyChecking=no "
+                      "-o UserKnownHostsFile=/dev/null "
+                      "root@%s tar -C %s -xpzf -" % (hostname, host_dir))
+
+        # copy Packstack manifests
+        server.append("cd %s/puppet" % basedefs.DIR_PROJECT_DIR)
+        server.append("cd %s" % basedefs.PUPPET_MANIFEST_DIR)
+        server.append("tar --dereference -cpzf - ../manifests | "
+                      "ssh -o StrictHostKeyChecking=no "
+                      "-o UserKnownHostsFile=/dev/null "
+                      "root@%s tar -C %s -xpzf -" % (hostname, host_dir))
+
+        # copy resources
+        resources = config.get('RESOURCES', {})
+        for path, localname in resources.get(hostname, []):
+            server.append("scp -o StrictHostKeyChecking=no "
+                          "-o UserKnownHostsFile=/dev/null "
+                          "%s root@[%s]:%s/resources/%s" %
+                          (path, hostname, host_dir, localname))
+
+        # copy Puppet modules required by Packstack
+        server.append("cd %s" % MODULE_DIR)
+        server.append("tar --dereference -cpzf - %s | "
+                      "ssh -o StrictHostKeyChecking=no "
+                      "-o UserKnownHostsFile=/dev/null "
+                      "root@%s tar -C %s -xpzf -" %
+                      (os_modules, hostname,
+                       os.path.join(host_dir, 'modules')))
+    server.execute()
+
+
+def apply_puppet_manifest(config, messages):
     if config.get("DRY_RUN"):
         return
     currently_running = []
@@ -201,8 +208,8 @@ def applyPuppetManifest(config):
     for manifest, marker in manifestfiles.getFiles():
         # if the marker has changed then we don't want to proceed until
         # all of the previous puppet runs have finished
-        if lastmarker != None and lastmarker != marker:
-            waitforpuppet(currently_running)
+        if lastmarker is not None and lastmarker != marker:
+            wait_for_puppet(currently_running, messages)
         lastmarker = marker
 
         for hostname in filtered_hosts(config):
@@ -210,7 +217,7 @@ def applyPuppetManifest(config):
                 continue
 
             host_dir = config['HOST_DETAILS'][hostname]['tmpdir']
-            print "Applying %s" % manifest
+            print("Applying %s" % manifest)
             server = utils.ScriptRunner(hostname)
 
             man_path = os.path.join(config['HOST_DETAILS'][hostname]['tmpdir'],
@@ -220,30 +227,56 @@ def applyPuppetManifest(config):
             running_logfile = "%s.running" % man_path
             finished_logfile = "%s.finished" % man_path
             currently_running.append((hostname, finished_logfile))
-            # The apache puppet module doesn't work if we set FACTERLIB
-            # https://github.com/puppetlabs/puppetlabs-apache/pull/138
-            if not (manifest.endswith('_horizon.pp') or manifest.endswith('_nagios.pp')):
-                server.append("export FACTERLIB=$FACTERLIB:%s/facts" % host_dir)
+
             server.append("touch %s" % running_logfile)
             server.append("chmod 600 %s" % running_logfile)
             server.append("export PACKSTACK_VAR_DIR=%s" % host_dir)
-            command = "( flock %s/ps.lock puppet apply %s --modulepath %s/modules %s > %s 2>&1 < /dev/null ; mv %s %s ) > /dev/null 2>&1 < /dev/null &" % (host_dir, loglevel, host_dir, man_path, running_logfile, running_logfile, finished_logfile)
-            server.append(command)
+            server.append("export LANG=C.UTF-8")
+            cmd = ("( flock %s/ps.lock "
+                   "puppet apply %s --modulepath %s/modules %s > %s "
+                   "2>&1 < /dev/null ; "
+                   "mv %s %s ) > /dev/null 2>&1 < /dev/null &"
+                   % (host_dir, loglevel, host_dir, man_path, running_logfile,
+                      running_logfile, finished_logfile))
+            server.append(cmd)
             server.execute(log=logcmd)
 
-    # wait for outstanding puppet runs befor exiting
-    waitforpuppet(currently_running)
+    # wait for outstanding puppet runs before exiting
+    wait_for_puppet(currently_running, messages)
+
+
+def prepare_puppet_modules(config, messages):
+    network_hosts = split_hosts(config['CONFIG_NETWORK_HOSTS'])
+    compute_hosts = split_hosts(config['CONFIG_COMPUTE_HOSTS'])
+
+    manifestdata = getManifestTemplate("controller")
+    manifestfile = "%s_controller.pp" % config['CONFIG_CONTROLLER_HOST']
+    appendManifestFile(manifestfile, manifestdata, marker='controller')
+
+    for host in network_hosts:
+        manifestdata = getManifestTemplate("network")
+        manifestfile = "%s_network.pp" % host
+        appendManifestFile(manifestfile, manifestdata, marker='network')
+
+    for host in compute_hosts:
+        manifestdata = getManifestTemplate("compute")
+        manifestfile = "%s_compute.pp" % host
+        appendManifestFile(manifestfile, manifestdata, marker='compute')
+
+    manifestdata = getManifestTemplate("controller_post")
+    manifestfile = "%s_controller_post.pp" % config['CONFIG_CONTROLLER_HOST']
+    appendManifestFile(manifestfile, manifestdata, marker='controller')
 
 
-def finalize(config):
+def finalize(config, messages):
     for hostname in filtered_hosts(config):
         server = utils.ScriptRunner(hostname)
         server.append("installed=$(rpm -q kernel --last | head -n1 | "
-                      "sed 's/kernel-\([a-z0-9\.\_\-]*\).*/\\1/g')")
+                      "sed 's/kernel-\([a-z0-9\.\_\-]*\).*/\\1/g')")    # noqa: W605
         server.append("loaded=$(uname -r | head -n1)")
         server.append('[ "$loaded" == "$installed" ]')
         try:
             rc, out = server.execute()
         except ScriptRuntimeError:
-            controller.MESSAGES.append('Because of the kernel update the host '
-                                       '%s requires reboot.' % hostname)
+            messages.append('Because of the kernel update the host %s '
+                            'requires reboot.' % hostname)
diff --git a/packstack/plugins/serverprep_949.py b/packstack/plugins/serverprep_949.py
deleted file mode 100644
index 333470407..000000000
--- a/packstack/plugins/serverprep_949.py
+++ /dev/null
@@ -1,540 +0,0 @@
-"""
-prepare server
-"""
-
-import os
-import re
-import uuid
-import logging
-import platform
-
-from packstack.installer import basedefs
-from packstack.installer import exceptions
-from packstack.installer import utils
-from packstack.installer import validators
-
-from packstack.modules.common import filtered_hosts, is_all_in_one
-
-# Controller object will be initialized from main flow
-controller = None
-
-# Plugin name
-PLUGIN_NAME = "OS-SERVERPREPARE"
-PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
-
-logging.debug("plugin %s loaded", __name__)
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding SERVERPREPARE KEY configuration")
-    conf_params = {
-            "SERVERPREPARE": [
-                  {"CMD_OPTION"      : "use-epel",
-                   "USAGE"           : "To subscribe each server to EPEL enter \"y\"",
-                   "PROMPT"          : "To subscribe each server to EPEL enter \"y\"",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "n",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_USE_EPEL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                  {"CMD_OPTION"      : "additional-repo",
-                   "USAGE"           : "A comma separated list of URLs to any additional yum repositories to install",
-                   "PROMPT"          : "Enter a comma separated list of URLs to any additional yum repositories to install",
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_REPO",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False }],
-
-            "RHEL": [
-                  {"CMD_OPTION"      : "rh-username",
-                   "USAGE"           : "To subscribe each server with Red Hat subscription manager, include this with CONFIG_RH_PW",
-                   "PROMPT"          : "To subscribe each server to Red Hat enter a username here",
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_RH_USER",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                  {"CMD_OPTION"      : "rh-password",
-                   "USAGE"           : "To subscribe each server with Red Hat subscription manager, include this with CONFIG_RH_USER",
-                   "PROMPT"          : "To subscribe each server to Red Hat enter your password here",
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_RH_PW",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                  {"CMD_OPTION"      : "rh-beta-repo",
-                   "USAGE"           : "To subscribe each server to Red Hat Enterprise Linux 6 Server Beta channel (only needed for Preview versions of RHOS) enter \"y\"",
-                   "PROMPT"          : "To subscribe each server to Red Hat Enterprise Linux 6 Server Beta channel (only needed for Preview versions of RHOS) enter \"y\"",
-                   "OPTION_LIST"     : ["y", "n"],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "n",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_RH_BETA_REPO",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                  {"CMD_OPTION"      : "rhn-satellite-server",
-                   "USAGE"           : ("To subscribe each server with RHN Satellite,"
-                                        "fill Satellite's URL here. Note that either "
-                                        "satellite's username/password or activation "
-                                        "key has to be provided"),
-                   "PROMPT"          : ("To subscribe each server with RHN Satellite "
-                                        "enter RHN Satellite server URL"),
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SATELLITE_URL",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False }],
-
-            "SATELLITE": [
-                  {"CMD_OPTION"      : "rhn-satellite-username",
-                   "USAGE"           : "Username to access RHN Satellite",
-                   "PROMPT"          : ("Enter RHN Satellite username or leave plain "
-                                        "if you will use activation key instead"),
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_SATELLITE_USER",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                  {"CMD_OPTION"      : "rhn-satellite-password",
-                   "USAGE"           : "Password to access RHN Satellite",
-                   "PROMPT"          : ("Enter RHN Satellite password or leave plain "
-                                        "if you will use activation key instead"),
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SATELLITE_PW",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                  {"CMD_OPTION"      : "rhn-satellite-activation-key",
-                   "USAGE"           : "Activation key for subscription to RHN Satellite",
-                   "PROMPT"          : ("Enter RHN Satellite activation key or leave plain "
-                                        "if you used username/password instead"),
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SATELLITE_AKEY",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                  {"CMD_OPTION"      : "rhn-satellite-cacert",
-                   "USAGE"           : "Specify a path or URL to a SSL CA certificate to use",
-                   "PROMPT"          : "Specify a path or URL to a SSL CA certificate to use",
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SATELLITE_CACERT",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                  {"CMD_OPTION"      : "rhn-satellite-profile",
-                   "USAGE"           : ("If required specify the profile name that should "
-                                        "be used as an identifier for the system in RHN "
-                                        "Satellite"),
-                   "PROMPT"          : ("If required specify the profile name that should "
-                                        "be used as an identifier for the system in RHN "
-                                        "Satellite"),
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SATELLITE_PROFILE",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                  {"CMD_OPTION"      : "rhn-satellite-flags",
-                   "USAGE"           : ("Comma separated list of flags passed to rhnreg_ks. Valid "
-                                        "flags are: novirtinfo, norhnsd, nopackages"),
-                   "PROMPT"          : "Enter comma separated list of flags passed to rhnreg_ks",
-                   "OPTION_LIST"     : ['novirtinfo', 'norhnsd', 'nopackages'],
-                   "VALIDATORS"      : [validators.validate_multi_options],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SATELLITE_FLAGS",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                  {"CMD_OPTION"      : "rhn-satellite-proxy-host",
-                   "USAGE"           : "Specify a HTTP proxy to use with RHN Satellite",
-                   "PROMPT"          : "Specify a HTTP proxy to use with RHN Satellite",
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SATELLITE_PROXY",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False }],
-
-            "SATELLITE_PROXY": [
-                  {"CMD_OPTION"      : "rhn-satellite-proxy-username",
-                   "USAGE"           : "Specify a username to use with an authenticated HTTP proxy",
-                   "PROMPT"          : "Specify a username to use with an authenticated HTTP proxy",
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SATELLITE_PROXY_USER",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                  {"CMD_OPTION"      : "rhn-satellite-proxy-password",
-                   "USAGE"           : "Specify a password to use with an authenticated HTTP proxy.",
-                   "PROMPT"          : "Specify a password to use with an authenticated HTTP proxy.",
-                   "OPTION_LIST"     : [],
-                   "DEFAULT_VALUE"   : "",
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SATELLITE_PROXY_PW",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False }]}
-
-    def filled_satellite(config):
-        return bool(config.get('CONFIG_SATELLITE_URL'))
-
-    def filled_satellite_proxy(config):
-        return bool(config.get('CONFIG_SATELLITE_PROXY'))
-
-    conf_groups = [
-             {"GROUP_NAME"            : "SERVERPREPARE",
-              "DESCRIPTION"           : "Server Prepare Configs ",
-              "PRE_CONDITION"         : lambda x: 'yes',
-              "PRE_CONDITION_MATCH"   : "yes",
-              "POST_CONDITION"        : False,
-              "POST_CONDITION_MATCH"  : True},
-        ]
-
-    if ((is_all_in_one(controller.CONF) and is_rhel()) or
-        not is_all_in_one(controller.CONF)):
-        conf_groups.append({"GROUP_NAME"            : "RHEL",
-                            "DESCRIPTION"           : "RHEL config",
-                            "PRE_CONDITION"         : lambda x: 'yes',
-                            "PRE_CONDITION_MATCH"   : "yes",
-                            "POST_CONDITION"        : False,
-                            "POST_CONDITION_MATCH"  : True})
-
-        conf_groups.append({"GROUP_NAME"            : "SATELLITE",
-                            "DESCRIPTION"           : "RHN Satellite config",
-                            "PRE_CONDITION"         : filled_satellite,
-                            "PRE_CONDITION_MATCH"   : True,
-                            "POST_CONDITION"        : False,
-                            "POST_CONDITION_MATCH"  : True})
-
-        conf_groups.append({"GROUP_NAME"            : "SATELLITE_PROXY",
-                            "DESCRIPTION"           : "RHN Satellite proxy config",
-                            "PRE_CONDITION"         : filled_satellite_proxy,
-                            "PRE_CONDITION_MATCH"   : True,
-                            "POST_CONDITION"        : False,
-                            "POST_CONDITION_MATCH"  : True})
-
-    for group in conf_groups:
-        paramList = conf_params[group["GROUP_NAME"]]
-        controller.addGroup(group, paramList)
-
-
-def is_rhel():
-    return 'Red Hat Enterprise Linux' in platform.linux_distribution()[0]
-
-
-def run_rhn_reg(host, server_url, username=None, password=None,
-                cacert=None, activation_key=None, profile_name=None,
-                proxy_host=None, proxy_user=None, proxy_pass=None,
-                flags=None):
-    """
-    Registers given host to given RHN Satellite server. To successfully
-    register either activation_key or username/password is required.
-    """
-    logging.debug('Setting RHN Satellite server: %s.' % locals())
-
-    mask = []
-    cmd = ['/usr/sbin/rhnreg_ks']
-    server = utils.ScriptRunner(host)
-
-    # check satellite server url
-    server_url = server_url.rstrip('/').endswith('/XMLRPC') \
-                    and server_url \
-                    or '%s/XMLRPC' % server_url
-    cmd.extend(['--serverUrl', server_url])
-
-    if activation_key:
-        cmd.extend(['--activationkey', activation_key])
-    elif username:
-        cmd.extend(['--username', username])
-        if password:
-            cmd.extend(['--password', password])
-            mask.append(password)
-    else:
-        raise exceptions.InstallError('Either RHN Satellite activation '
-                                      'key or username/password must '
-                                      'be provided.')
-
-    if cacert:
-        # use and if required download given certificate
-        location = "/etc/sysconfig/rhn/%s" % os.path.basename(cacert)
-        if not os.path.isfile(location):
-            logging.debug('Downloading cacert from %s.' % server_url)
-            wget_cmd = ('ls %(location)s &> /dev/null && echo -n "" || '
-                        'wget -nd --no-check-certificate --timeout=30 '
-                        '--tries=3 -O "%(location)s" "%(cacert)s"' %
-                        locals())
-            server.append(wget_cmd)
-        cmd.extend(['--sslCACert', location])
-
-    if profile_name:
-        cmd.extend(['--profilename', profile_name])
-    if proxy_host:
-        cmd.extend(['--proxy', proxy_host])
-        if proxy_user:
-            cmd.extend(['--proxyUser', proxy_user])
-            if proxy_pass:
-                cmd.extend(['--proxyPassword', proxy_pass])
-                mask.append(proxy_pass)
-
-    flags = flags or []
-    flags.append('force')
-    for i in flags:
-        cmd.append('--%s' % i)
-
-    server.append(' '.join(cmd))
-    server.append('yum clean metadata')
-    server.execute(mask_list=mask)
-
-
-def run_rhsm_reg(host, username, password, beta):
-    """
-    Registers given host to Red Hat Repositories via subscription manager.
-    """
-    server = utils.ScriptRunner(host)
-
-    # register host
-    cmd = ('subscription-manager register --username=\"%s\" '
-                            '--password=\"%s\" --autosubscribe || true')
-    server.append(cmd % (username, password.replace('"','\\"')))
-
-    # subscribe to required channel
-    cmd = ('subscription-manager list --consumed | grep -i openstack || '
-           'subscription-manager subscribe --pool %s')
-    pool = ("$(subscription-manager list --available | "
-            "grep -e 'Red Hat OpenStack' -m 1 -A 2 | grep 'Pool Id' | "
-            "awk '{print $3}')")
-    server.append(cmd % pool)
-    server.append("subscription-manager repos --enable rhel-6-server-optional-rpms")
-
-    server.append("yum clean all")
-    server.append("rpm -q --whatprovides yum-utils || yum install -y yum-utils")
-    if beta:
-        server.append("yum-config-manager --enable rhel-6-server-beta-rpms")
-    server.append("yum clean metadata")
-    server.execute(mask_list=[password])
-
-
-def manage_epel(host, config):
-    """
-    Installs and/or enables EPEL repo if it is required or disables it if it
-    is not required.
-    """
-    if config['HOST_DETAILS'][host]['os'] in ('Fedora', 'Unknown'):
-        return
-
-    mirrors = ('https://mirrors.fedoraproject.org/metalink?repo=epel-6&'
-               'arch=$basearch')
-    server = utils.ScriptRunner(host)
-    if config['CONFIG_USE_EPEL'] == 'y':
-        server.append('REPOFILE=$(mktemp)')
-        server.append('cat /etc/yum.conf > $REPOFILE')
-        server.append("echo -e '[packstack-epel]\nname=packstack-epel\n"
-                      "enabled=1\nmirrorlist=%(mirrors)s' >> $REPOFILE"
-                      % locals())
-        server.append('( rpm -q --whatprovides epel-release ||'
-                      ' yum install -y --nogpg -c $REPOFILE epel-release ) '
-                      '|| true')
-        server.append('rm -rf $REPOFILE')
-        try:
-            server.execute()
-        except exceptions.ScriptRuntimeError as ex:
-            msg = 'Failed to set EPEL repo on host %s:\n%s' % (host, ex)
-            raise exceptions.ScriptRuntimeError(msg)
-
-    # if there's an epel repo explicitly enables or disables it
-    # according to: CONFIG_USE_EPEL
-    if config['CONFIG_USE_EPEL'] == 'y':
-        cmd = 'enable'
-        enabled = '(1|True)'
-    else:
-        cmd = 'disable'
-        enabled = '(0|False)'
-
-    server.clear()
-    server.append('yum-config-manager --%(cmd)s epel' % locals())
-    rc, out = server.execute()
-
-    # yum-config-manager returns 0 always, but returns current setup if succeeds
-    match = re.search('enabled\s*\=\s*%(enabled)s' % locals(), out)
-    if match:
-        return
-    msg = 'Failed to set EPEL repo on host %s:\n'
-    if cmd == 'enable':
-        # fail in case user wants to have EPEL enabled
-        msg += ('RPM file seems to be installed, but appropriate repo file is '
-                'probably missing in /etc/yum.repos.d/')
-        raise exceptions.ScriptRuntimeError(msg % host)
-    else:
-        # just warn in case disabling failed which might happen when EPEL repo
-        # is not installed at all
-        msg += 'This is OK in case you don\'t want EPEL installed and enabled.'
-        # TO-DO: fill logger name when logging will be refactored.
-        logger = logging.getLogger()
-        logger.warn(msg % host)
-
-
-
-def manage_rdo(host, config):
-    """
-    Installs and enables RDO repo on host in case it is installed locally.
-    """
-    try:
-        cmd = "rpm -q rdo-release --qf='%{version}-%{release}.%{arch}\n'"
-        rc, out = utils.execute(cmd, use_shell=True)
-    except exceptions.ExecuteRuntimeError:
-        # RDO repo is not installed, so we don't need to continue
-        return
-    match = re.match(r'^(?P<version>\w+)\-(?P<release>\d+\.[\d\w]+)\n', out)
-    version, release = match.group('version'), match.group('release')
-    rdo_url = ("http://rdo.fedorapeople.org/openstack/openstack-%(version)s/"
-               "rdo-release-%(version)s-%(release)s.rpm" % locals())
-
-    server = utils.ScriptRunner(host)
-    server.append("(rpm -q 'rdo-release-%(version)s' ||"
-                  " yum install -y --nogpg %(rdo_url)s) || true"
-                  % locals())
-    try:
-        server.execute()
-    except exceptions.ScriptRuntimeError as ex:
-        msg = 'Failed to set RDO repo on host %s:\n%s' % (host, ex)
-        raise exceptions.ScriptRuntimeError(msg)
-
-    reponame = 'openstack-%s' % version
-    server.clear()
-    server.append('yum-config-manager --enable %(reponame)s' % locals())
-    # yum-config-manager returns 0 always, but returns current setup if succeeds
-    rc, out = server.execute()
-    match = re.search('enabled\s*=\s*(1|True)', out)
-    if not match:
-        msg = ('Failed to set RDO repo on host %s:\nRPM file seems to be '
-               'installed, but appropriate repo file is probably missing '
-               'in /etc/yum.repos.d/' % host)
-        raise exceptions.ScriptRuntimeError(msg)
-
-
-def initSequences(controller):
-    preparesteps = [
-             {'title': 'Preparing servers', 'functions':[serverprep]}
-    ]
-    controller.addSequence("Preparing servers", [], [], preparesteps)
-
-
-def serverprep(config):
-    rh_username = None
-    sat_url = None
-    if is_rhel():
-        rh_username = config["CONFIG_RH_USER"].strip()
-        rh_password = config["CONFIG_RH_PW"].strip()
-
-        sat_registered = set()
-
-        sat_url = config["CONFIG_SATELLITE_URL"].strip()
-        if sat_url:
-            flag_list = config["CONFIG_SATELLITE_FLAGS"].split(',')
-            sat_flags = [i.strip() for i in flag_list if i.strip()]
-            sat_proxy_user = config.get("CONFIG_SATELLITE_PROXY_USER", '')
-            sat_proxy_pass = config.get("CONFIG_SATELLITE_PROXY_PW", '')
-            sat_args = {'username': config["CONFIG_SATELLITE_USER"].strip(),
-                        'password': config["CONFIG_SATELLITE_PW"].strip(),
-                        'cacert': config["CONFIG_SATELLITE_CACERT"].strip(),
-                        'activation_key': config["CONFIG_SATELLITE_AKEY"].strip(),
-                        'profile_name': config["CONFIG_SATELLITE_PROFILE"].strip(),
-                        'proxy_host': config["CONFIG_SATELLITE_PROXY"].strip(),
-                        'proxy_user': sat_proxy_user.strip(),
-                        'proxy_pass': sat_proxy_pass.strip(),
-                        'flags': sat_flags}
-
-    for hostname in filtered_hosts(config):
-        # Subscribe to Red Hat Repositories if configured
-        if rh_username:
-            run_rhsm_reg(hostname, rh_username, rh_password,
-                         config["CONFIG_RH_BETA_REPO"] == 'y')
-
-        # Subscribe to RHN Satellite if configured
-        if sat_url and hostname not in sat_registered:
-            run_rhn_reg(hostname, sat_url, **sat_args)
-            sat_registered.add(hostname)
-
-        server = utils.ScriptRunner(hostname)
-        server.append('rpm -q --whatprovides yum-utils || '
-                      'yum install -y yum-utils')
-        server.execute()
-
-        # enable or disable EPEL according to configuration
-        manage_epel(hostname, config)
-        # enable RDO if it is installed locally
-        manage_rdo(hostname, config)
-
-        reponame = 'rhel-server-ost-6-4-rpms'
-        server.clear()
-        server.append('yum install -y yum-plugin-priorities || true')
-        server.append('rpm -q epel-release && yum-config-manager '
-                        '--setopt="%(reponame)s.priority=1" '
-                        '--save %(reponame)s' % locals())
-
-        # Add yum repositories if configured
-        CONFIG_REPO = config["CONFIG_REPO"].strip()
-        if CONFIG_REPO:
-            for i, repourl in enumerate(CONFIG_REPO.split(',')):
-                reponame = 'packstack_%d' % i
-                server.append('echo "[%(reponame)s]\nname=%(reponame)s\n'
-                                    'baseurl=%(repourl)s\nenabled=1\n'
-                                    'priority=1\ngpgcheck=0"'
-                              ' > /etc/yum.repos.d/%(reponame)s.repo'
-                              % locals())
-
-        server.append("yum clean metadata")
-        server.execute()
diff --git a/packstack/plugins/ssl_001.py b/packstack/plugins/ssl_001.py
new file mode 100644
index 000000000..636685d67
--- /dev/null
+++ b/packstack/plugins/ssl_001.py
@@ -0,0 +1,324 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Plugin responsible for managing SSL options
+"""
+import datetime
+import os
+from socket import gethostname
+
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives import serialization
+from cryptography import x509
+from cryptography.x509 import oid
+
+from packstack.installer import basedefs
+from packstack.installer import utils
+from packstack.installer import validators
+
+from packstack.modules.documentation import update_params_usage
+
+# ------------- SSL Packstack Plugin Initialization --------------
+
+PLUGIN_NAME = "SSL"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
+
+
+def initConfig(controller):
+    params = {
+        "SSL": [
+            {"CMD_OPTION": "ssl-cacert-file",
+             "PROMPT": ("Enter the filename of the SSL CAcertificate, if the"
+                        " CONFIG_SSL_CACERT_SELFSIGN is set to y the path "
+                        "will be CONFIG_SSL_CERT_DIR/certs/selfcert.crt"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "/etc/pki/tls/certs/selfcert.crt",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_SSL_CACERT_FILE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "ssl-cacert-key-file",
+             "PROMPT": ("Enter the filename of the SSL CAcertificate Key file"
+                        ", if the CONFIG_SSL_CACERT_SELFSIGN is set to y the "
+                        "path will be CONFIG_SSL_CERT_DIR/keys/selfkey.key"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "/etc/pki/tls/private/selfkey.key",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_SSL_CACERT_KEY_FILE",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "ssl-cert-dir",
+             "PROMPT": ("Enter the path to use to store generated SSL certificates in"),
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty,
+                            validators.validate_writeable_directory],
+             "DEFAULT_VALUE": "~/packstackca/",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": True,
+             "CONF_NAME": "CONFIG_SSL_CERT_DIR",
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "ssl-cacert-selfsign",
+             "PROMPT": "Should packstack use selfsigned CAcert.",
+             "OPTION_LIST": ["y", "n"],
+             "VALIDATORS": [validators.validate_options],
+             "DEFAULT_VALUE": "y",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_SSL_CACERT_SELFSIGN',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False},
+
+            {"CMD_OPTION": "ssl-cert-subject-country",
+             "PROMPT": "Enter the ssl certificates subject country.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "--",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_SSL_CERT_SUBJECT_C',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_SELFSIGN_CACERT_SUBJECT_C']},
+
+            {"CMD_OPTION": "ssl-cert-subject-state",
+             "PROMPT": "Enter the ssl certificates subject state.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "State",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_SSL_CERT_SUBJECT_ST',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_SELFSIGN_CACERT_SUBJECT_ST']},
+
+            {"CMD_OPTION": "ssl-cert-subject-location",
+             "PROMPT": "Enter the ssl certificate subject location.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "City",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_SSL_CERT_SUBJECT_L',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_SELFSIGN_CACERT_SUBJECT_L']},
+
+            {"CMD_OPTION": "ssl-cert-subject-organization",
+             "PROMPT": "Enter the ssl certificate subject organization.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "openstack",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_SSL_CERT_SUBJECT_O',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_SELFSIGN_CACERT_SUBJECT_O']},
+
+            {"CMD_OPTION": "ssl-cert-subject-organizational-unit",
+             "PROMPT": "Enter the ssl certificate subject organizational unit.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "packstack",
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_SSL_CERT_SUBJECT_OU',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_SELFSIGN_CACERT_SUBJECT_OU']},
+
+            {"CMD_OPTION": "ssl-cert-subject-common-name",
+             "PROMPT": "Enter the ssl certificaate subject common name.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": gethostname(),
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_SSL_CERT_SUBJECT_CN',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_SELFSIGN_CACERT_SUBJECT_CN']},
+
+            {"CMD_OPTION": "ssl-cert-subject-email",
+             "PROMPT": "Enter the ssl certificate subject admin email.",
+             "OPTION_LIST": [],
+             "VALIDATORS": [validators.validate_not_empty],
+             "DEFAULT_VALUE": "admin@%s" % gethostname(),
+             "MASK_INPUT": False,
+             "LOOSE_VALIDATION": False,
+             "CONF_NAME": 'CONFIG_SSL_CERT_SUBJECT_MAIL',
+             "USE_DEFAULT": False,
+             "NEED_CONFIRM": False,
+             "CONDITION": False,
+             "DEPRECATES": ['CONFIG_SELFSIGN_CACERT_SUBJECT_MAIL']},
+        ]
+    }
+    update_params_usage(basedefs.PACKSTACK_DOC, params)
+
+    groups = [
+        {"GROUP_NAME": "SSL",
+         "DESCRIPTION": "SSL Config parameters",
+         "PRE_CONDITION": lambda x: 'yes',
+         "PRE_CONDITION_MATCH": "yes",
+         "POST_CONDITION": False,
+         "POST_CONDITION_MATCH": True},
+    ]
+    for group in groups:
+        controller.addGroup(group, params[group['GROUP_NAME']])
+
+
+def initSequences(controller):
+    ssl_steps = [
+        {'title': 'Setting up CACERT',
+         'functions': [create_self_signed_cert]}
+    ]
+    controller.addSequence("Setting up SSL", [], [],
+                           ssl_steps)
+
+
+# ------------------------- helper functions -------------------------
+
+def create_self_signed_cert(config, messages):
+    """
+    Generate selfsigned CA.
+    """
+
+    # for now hardcoded place for landing CACert file on servers
+    config['CONFIG_SSL_CACERT'] = '/etc/pki/tls/certs/packstack_cacert.crt'
+
+    if (config['CONFIG_AMQP_ENABLE_SSL'] != 'y' and
+       config["CONFIG_HORIZON_SSL"] != 'y'):
+        return
+
+    config['CONFIG_SSL_CERT_DIR'] = os.path.expanduser(
+        config['CONFIG_SSL_CERT_DIR']
+    )
+
+    if not os.path.isdir(config['CONFIG_SSL_CERT_DIR']):
+        os.mkdir(config['CONFIG_SSL_CERT_DIR'])
+    certs = os.path.join(config['CONFIG_SSL_CERT_DIR'], 'certs')
+    if not os.path.isdir(certs):
+        os.mkdir(certs)
+    keys = os.path.join(config['CONFIG_SSL_CERT_DIR'], 'keys')
+    if not os.path.isdir(keys):
+        os.mkdir(keys)
+
+    if config['CONFIG_SSL_CACERT_SELFSIGN'] != 'y':
+        return
+
+    CERT_FILE = config['CONFIG_SSL_CACERT_FILE'] = (
+        '%s/certs/selfcert.crt' % config['CONFIG_SSL_CERT_DIR']
+    )
+    KEY_FILE = config['CONFIG_SSL_CACERT_KEY_FILE'] = (
+        '%s/keys/selfcert.crt' % config['CONFIG_SSL_CERT_DIR']
+    )
+
+    if os.path.exists(CERT_FILE) and os.path.exists(KEY_FILE):
+        return
+
+    # create a key pair
+    key = rsa.generate_private_key(
+        public_exponent=65537,
+        key_size=4096,
+    )
+
+    subject = issuer = x509.Name([
+        x509.NameAttribute(oid.NameOID.COUNTRY_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_C']),
+        x509.NameAttribute(oid.NameOID.STATE_OR_PROVINCE_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_ST']),
+        x509.NameAttribute(oid.NameOID.LOCALITY_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_L']),
+        x509.NameAttribute(oid.NameOID. ORGANIZATION_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_O']),
+        x509.NameAttribute(oid.NameOID. ORGANIZATIONAL_UNIT_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_OU']),
+        x509.NameAttribute(oid.NameOID.COMMON_NAME,
+                           config['CONFIG_SSL_CERT_SUBJECT_CN']),
+        x509.NameAttribute(oid.NameOID.EMAIL_ADDRESS,
+                           config['CONFIG_SSL_CERT_SUBJECT_MAIL']),
+    ])
+    cert = x509.CertificateBuilder().subject_name(
+        subject
+    ).issuer_name(
+        issuer
+    ).public_key(
+        key.public_key()
+    ).serial_number(
+        x509.random_serial_number()
+    ).not_valid_before(
+        datetime.datetime.now(datetime.timezone.utc)
+    ).not_valid_after(
+        datetime.datetime.now(datetime.timezone.utc) +
+        datetime.timedelta(days=3650)
+    ).add_extension(
+        x509.BasicConstraints(ca=True, path_length=None),
+        critical=False,
+    ).add_extension(
+        x509.KeyUsage(
+            digital_signature=False,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=False,
+            key_cert_sign=True,
+            crl_sign=True,
+            encipher_only=False,
+            decipher_only=False,
+        ),
+        critical=False,
+    ).add_extension(
+        x509.SubjectKeyIdentifier.from_public_key(key.public_key()),
+        critical=False,
+    ).add_extension(
+        x509.AuthorityKeyIdentifier.from_issuer_public_key(key.public_key()),
+        critical=False,
+    ).sign(key, hashes.SHA256())
+
+    with open(CERT_FILE, 'wb') as certfile:
+        certfile.write(cert.public_bytes(serialization.Encoding.PEM))
+
+    with open(KEY_FILE, 'wb') as keyfile:
+        keyfile.write(key.private_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PrivateFormat.TraditionalOpenSSL,
+            encryption_algorithm=serialization.NoEncryption()
+        ))
+
+    messages.append(
+        "%sNOTE%s : A selfsigned CA certificate was generated to be used "
+        "for ssl, you should still change it do subordinate CA cert. In "
+        "any case please save the contents of %s."
+        % (utils.COLORS['red'], utils.COLORS['nocolor'],
+            config['CONFIG_SSL_CERT_DIR']))
diff --git a/packstack/plugins/swift_600.py b/packstack/plugins/swift_600.py
index 24629d897..3bb85a67e 100644
--- a/packstack/plugins/swift_600.py
+++ b/packstack/plugins/swift_600.py
@@ -1,227 +1,208 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 """
-Installs and configures an OpenStack Swift
+Installs and configures Swift
 """
 
-import os
+import netaddr
 import re
 import uuid
-import logging
 
+from packstack.installer import basedefs
 from packstack.installer import validators
+from packstack.installer import processors
 from packstack.installer.exceptions import ParamValidationError
-from packstack.installer import basedefs
 from packstack.installer import utils
 from packstack.installer.utils import split_hosts
 
-from packstack.modules.ospluginutils import getManifestTemplate, appendManifestFile, manifestfiles
+from packstack.modules.documentation import update_params_usage
 
-# Controller object will be initialized from main flow
-controller = None
+# ------------- Swift Packstack Plugin Initialization --------------
 
-# Plugin name
-PLUGIN_NAME = "OS-SWIFT"
+PLUGIN_NAME = "OS-Swift"
 PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
 
-logging.debug("plugin %s loaded", __name__)
-
-def initConfig(controllerObject):
-    global controller
-    controller = controllerObject
-    logging.debug("Adding OpenStack Swift configuration")
-    paramsList = [
-                  {"CMD_OPTION"      : "os-swift-proxy",
-                   "USAGE"           : "The IP address on which to install the Swift proxy service (currently only single proxy is supported)",
-                   "PROMPT"          : "Enter the IP address of the Swift proxy service",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_multi_ip, validators.validate_multi_ssh],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_SWIFT_PROXY_HOSTS",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-swift-ks-passwd",
-                   "USAGE"           : "The password to use for the Swift to authenticate with Keystone",
-                   "PROMPT"          : "Enter the password for the Swift Keystone access",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SWIFT_KS_PW",
-                   "USE_DEFAULT"     : True,
-                   "NEED_CONFIRM"    : True,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-swift-storage",
-                   "USAGE"           : "A comma separated list of IP addresses on which to install the Swift Storage services, each entry should take the format <ipaddress>[/dev], for example 127.0.0.1/vdb will install /dev/vdb on 127.0.0.1 as a swift storage device(packstack does not create the filesystem, you must do this first), if /dev is omitted Packstack will create a loopback device for a test setup",
-                   "PROMPT"          : "Enter the Swift Storage servers e.g. host/dev,host/dev",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty, validate_storage],
-                   "DEFAULT_VALUE"   : utils.get_localhost_ip(),
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_SWIFT_STORAGE_HOSTS",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-swift-storage-zones",
-                   "USAGE"           : "Number of swift storage zones, this number MUST be no bigger than the number of storage devices configured",
-                   "PROMPT"          : "Enter the number of swift storage zones, MUST be no bigger than the number of storage devices configured",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_integer],
-                   "DEFAULT_VALUE"   : "1",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_SWIFT_STORAGE_ZONES",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-swift-storage-replicas",
-                   "USAGE"           : "Number of swift storage replicas, this number MUST be no bigger than the number of storage zones configured",
-                   "PROMPT"          : "Enter the number of swift storage replicas, MUST be no bigger than the number of storage zones configured",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_integer],
-                   "DEFAULT_VALUE"   : "1",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_SWIFT_STORAGE_REPLICAS",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-swift-storage-fstype",
-                   "USAGE"           : "FileSystem type for storage nodes",
-                   "PROMPT"          : "Enter FileSystem type for storage nodes",
-                   "OPTION_LIST"     : ['xfs','ext4'],
-                   "VALIDATORS"      : [validators.validate_options],
-                   "DEFAULT_VALUE"   : "ext4",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_SWIFT_STORAGE_FSTYPE",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-swift-hash",
-                   "USAGE"           : "Shared secret for Swift",
-                   "PROMPT"          : "Enter hash for Swift shared secret",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validators.validate_not_empty],
-                   "DEFAULT_VALUE"   : uuid.uuid4().hex[:16],
-                   "MASK_INPUT"      : True,
-                   "LOOSE_VALIDATION": False,
-                   "CONF_NAME"       : "CONFIG_SWIFT_HASH",
-                   "USE_DEFAULT"     : True,
-                   "NEED_CONFIRM"    : True,
-                   "CONDITION"       : False },
-                  {"CMD_OPTION"      : "os-swift-storage-size",
-                   "USAGE"           : "Size of the swift loopback file storage device",
-                   "PROMPT"          : "Enter the size of the storage device (eg. 2G, 2000M, 2000000K)",
-                   "OPTION_LIST"     : [],
-                   "VALIDATORS"      : [validate_storage_size],
-                   "DEFAULT_VALUE"   : "2G",
-                   "MASK_INPUT"      : False,
-                   "LOOSE_VALIDATION": True,
-                   "CONF_NAME"       : "CONFIG_SWIFT_STORAGE_SIZE",
-                   "USE_DEFAULT"     : False,
-                   "NEED_CONFIRM"    : False,
-                   "CONDITION"       : False },
-
-                 ]
-
-    groupDict = { "GROUP_NAME"            : "OSSWIFT",
-                  "DESCRIPTION"           : "OpenStack Swift Config parameters",
-                  "PRE_CONDITION"         : "CONFIG_SWIFT_INSTALL",
-                  "PRE_CONDITION_MATCH"   : "y",
-                  "POST_CONDITION"        : False,
-                  "POST_CONDITION_MATCH"  : True}
-
-
-    controller.addGroup(groupDict, paramsList)
 
+def initConfig(controller):
+    params = [
+        {"CMD_OPTION": "os-swift-ks-passwd",
+         "PROMPT": "Enter the password for the Swift Keystone access",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",
+         "PROCESSORS": [processors.process_password],
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_SWIFT_KS_PW",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "os-swift-storages",
+         "PROMPT": "Enter the Swift Storage devices e.g. /path/to/dev",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validate_storage],
+         "DEFAULT_VALUE": '',
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_SWIFT_STORAGES",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False,
+         "DEPRECATES": ['CONFIG_SWIFT_STORAGE_HOSTS']},
+
+        {"CMD_OPTION": "os-swift-storage-zones",
+         "PROMPT": ("Enter the number of swift storage zones, MUST be no "
+                    "bigger than the number of storage devices configured"),
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_integer],
+         "DEFAULT_VALUE": "1",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_SWIFT_STORAGE_ZONES",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "os-swift-storage-replicas",
+         "PROMPT": ("Enter the number of swift storage replicas, MUST be no "
+                    "bigger than the number of storage zones configured"),
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_integer],
+         "DEFAULT_VALUE": "1",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_SWIFT_STORAGE_REPLICAS",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "os-swift-storage-fstype",
+         "PROMPT": "Enter FileSystem type for storage nodes",
+         "OPTION_LIST": ['xfs', 'ext4'],
+         "VALIDATORS": [validators.validate_options],
+         "DEFAULT_VALUE": "ext4",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_SWIFT_STORAGE_FSTYPE",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "os-swift-hash",
+         "PROMPT": "Enter hash for Swift shared secret",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": uuid.uuid4().hex[:16],
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_SWIFT_HASH",
+         "USE_DEFAULT": True,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+
+        {"CMD_OPTION": "os-swift-storage-size",
+         "PROMPT": ("Enter the size of the storage device (eg. 2G, 2000M, "
+                    "2000000K)"),
+         "OPTION_LIST": [],
+         "VALIDATORS": [validate_storage_size],
+         "DEFAULT_VALUE": "2G",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": True,
+         "CONF_NAME": "CONFIG_SWIFT_STORAGE_SIZE",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False},
+    ]
+    update_params_usage(basedefs.PACKSTACK_DOC, params, sectioned=False)
+    group = {"GROUP_NAME": "OSSWIFT",
+             "DESCRIPTION": "OpenStack Swift Config parameters",
+             "PRE_CONDITION": "CONFIG_SWIFT_INSTALL",
+             "PRE_CONDITION_MATCH": "y",
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+    controller.addGroup(group, params)
 
-def validate_storage(param, options=None):
-    for host in param.split(','):
-        host = host.split('/', 1)[0]
-        validators.validate_ip(host.strip(), options)
-
-def validate_storage_size(param, options=None):
-    match = re.match(r'\d+G|\d+M|\d+K', param, re.IGNORECASE)
-    if not match:
-        msg = 'Storage size not have a valid value (eg. 1G, 1000M, 1000000K)'
-        raise ParamValidationError(msg)
 
 def initSequences(controller):
     if controller.CONF['CONFIG_SWIFT_INSTALL'] != 'y':
         return
 
     steps = [
-             {'title': 'Adding Swift Keystone manifest entries', 'functions':[createkeystonemanifest]},
-             {'title': 'Adding Swift builder manifest entries', 'functions':[createbuildermanifest]},
-             {'title': 'Adding Swift proxy manifest entries', 'functions':[createproxymanifest]},
-             {'title': 'Adding Swift storage manifest entries', 'functions':[createstoragemanifest]},
-             {'title': 'Adding Swift common manifest entries', 'functions':[createcommonmanifest]},
+        {'title': 'Preparing Swift builder entries',
+         'functions': [create_builder_manifest]},
+        {'title': 'Preparing Swift proxy entries',
+         'functions': [create_proxy_manifest]},
+        {'title': 'Preparing Swift storage entries',
+         'functions': [create_storage_manifest]},
     ]
-
     controller.addSequence("Installing OpenStack Swift", [], [], steps)
 
 
-def createkeystonemanifest(config):
-    manifestfile = "%s_keystone.pp"%controller.CONF['CONFIG_KEYSTONE_HOST']
-    controller.CONF['CONFIG_SWIFT_PROXY'] = controller.CONF['CONFIG_SWIFT_PROXY_HOSTS'].split(',')[0]
-    manifestdata = getManifestTemplate("keystone_swift.pp")
-    appendManifestFile(manifestfile, manifestdata)
+# ------------------------- helper functions -------------------------
 
+def validate_storage(param, options=None):
+    if not param:
+        return
+    if not param.startswith('/'):
+        raise ParamValidationError(
+            'Storage value has to be in format "/path/to/device".'
+        )
+
+
+def validate_storage_size(param, options=None):
+    match = re.match(r'\d+G|\d+M|\d+K', param, re.IGNORECASE)
+    if not match:
+        msg = 'Storage size not have a valid value (eg. 1G, 1000M, 1000000K)'
+        raise ParamValidationError(msg)
 
-devices = []
-def parse_devices(config_swift_storage_hosts):
+
+def parse_devices(config):
     """
     Returns dict containing information about Swift storage devices.
     """
+    devices = []
     device_number = 0
-    num_zones = int(controller.CONF["CONFIG_SWIFT_STORAGE_ZONES"])
-    for host in config_swift_storage_hosts.split(","):
-        host = host.strip()
+    num_zones = int(config["CONFIG_SWIFT_STORAGE_ZONES"])
+    for device in config["CONFIG_SWIFT_STORAGES"].split(","):
+        # we have to get rid of host part in case deprecated parameter
+        # CONFIG_SWIFT_STORAGE_HOSTS has been used
+        if ':' in device:
+            device = device.split(':')[1]
+        # device should be empty string in case only IP address has been used
+        try:
+            netaddr.IPAddress(device)
+        except Exception:
+            device = device.strip()
+        else:
+            device = ''
+
+        if not device:
+            continue
         device_number += 1
-        device = None
-        if '/' in host:
-            host, device = map(lambda x: x.strip(), host.split('/', 1))
         zone = str((device_number % num_zones) + 1)
-        devices.append({'host': host, 'device': device, 'zone': zone,
+        devices.append({'device': device, 'zone': zone,
                         'device_name': 'device%s' % device_number})
+    if not devices:
+        devices.append({'device': None, 'zone': 1,
+                        'device_name': 'swiftloopback'})
+        config['CONFIG_SWIFT_LOOPBACK'] = 'y'
+    else:
+        config['CONFIG_SWIFT_LOOPBACK'] = 'n'
     return devices
 
 
-# The ring file should be built and distributed befor the storage services
-# come up. Specifically the replicator crashes if the ring isn't present
-def createbuildermanifest(config):
-    # TODO : put this on the proxy server, will need to change this later
-    controller.CONF['CONFIG_SWIFT_BUILDER_HOST'] = controller.CONF['CONFIG_SWIFT_PROXY_HOSTS'].split(',')[0]
-    manifestfile = "%s_ring_swift.pp"%controller.CONF['CONFIG_SWIFT_BUILDER_HOST']
-    manifestdata = getManifestTemplate("swift_builder.pp")
-
-    # Add each device to the ring
-    devicename = 0
-    for device in parse_devices(controller.CONF["CONFIG_SWIFT_STORAGE_HOSTS"]):
-        host = device['host']
-        devicename = device['device_name']
-        zone = device['zone']
-
-        manifestdata = manifestdata + '\n@@ring_object_device { "%s:6000/%s":\n zone        => %s,\n weight      => 10, }'%(host, devicename, zone)
-        manifestdata = manifestdata + '\n@@ring_container_device { "%s:6001/%s":\n zone        => %s,\n weight      => 10, }'%(host, devicename, zone)
-        manifestdata = manifestdata + '\n@@ring_account_device { "%s:6002/%s":\n zone        => %s,\n weight      => 10, }'%(host, devicename, zone)
-
-    appendManifestFile(manifestfile, manifestdata, 'swiftbuilder')
-
-
-def createproxymanifest(config):
-    manifestfile = "%s_swift.pp"%controller.CONF['CONFIG_SWIFT_PROXY_HOSTS']
-    manifestdata = getManifestTemplate("swift_proxy.pp")
-    # If the proxy server is also a storage server then swift::ringsync will be included for the storage server
-    if controller.CONF['CONFIG_SWIFT_PROXY_HOSTS'] not in [h['host'] for h in devices]:
-        manifestdata += 'swift::ringsync{["account","container","object"]:\n    ring_server => "%s"\n}'%controller.CONF['CONFIG_SWIFT_BUILDER_HOST']
-    appendManifestFile(manifestfile, manifestdata)
-
-
 def check_device(host, device):
     """
     Raises ScriptRuntimeError if given device is not mounted on given
@@ -230,88 +211,114 @@ def check_device(host, device):
     server = utils.ScriptRunner(host)
 
     # the device MUST exist
-    cmd = 'ls -l /dev/%s'
+    cmd = 'ls -l %s'
     server.append(cmd % device)
 
     # if it is not mounted then we can use it
-    cmd = 'grep "/dev/%s " /proc/self/mounts || exit 0'
+    cmd = 'grep "%s " /proc/self/mounts || exit 0'
     server.append(cmd % device)
 
     # if it is mounted then the mount point has to be in /srv/node
-    cmd = 'grep "/dev/%s /srv/node" /proc/self/mounts && exit 0'
+    cmd = 'grep "%s /srv/node" /proc/self/mounts && exit 0'
     server.append(cmd % device)
 
     # if we got here without exiting then we can't use this device
     server.append('exit 1')
     server.execute()
-    return False
 
-def get_storage_size(size):
+
+def get_storage_size(config):
     ranges = {'G': 1048576, 'M': 1024, 'K': 1}
-    size.strip()
+    size = config['CONFIG_SWIFT_STORAGE_SIZE'].strip()
     for measure in ['G', 'M', 'K']:
-        if re.match('\d+' + measure, size, re.IGNORECASE):
+        if re.match(r'\d+' + measure, size, re.IGNORECASE):
             intsize = int(size.rstrip(measure)) * ranges[measure]
             return intsize
 
-def createstoragemanifest(config):
 
-    # this need to happen once per storage host
-    for host in set([device['host'] for device in devices]):
-        controller.CONF["CONFIG_SWIFT_STORAGE_CURRENT"] = host
-        manifestfile = "%s_swift.pp"%host
-        manifestdata = getManifestTemplate("swift_storage.pp")
-        appendManifestFile(manifestfile, manifestdata)
+# -------------------------- step functions --------------------------
+
+
+def create_builder_manifest(config, messages):
+    global devices
+    devices = parse_devices(config)
+    # The ring file should be built and distributed before the storage services
+    # come up. Specifically the replicator crashes if the ring isn't present
+
+    def device_def(dev_type, host, dev_port, devicename, zone):
+        # device host has to be IP address
+        host = utils.force_ip(host)
+        fmt = ('\n@@%s { "%s:%s/%s":\n'
+               '  zone   => %s,\n'
+               '  weight => 10, }\n')
+        return fmt % (dev_type, host, dev_port, devicename, zone)
+
+    # Add each device to the ring
+    devicename = 0
+    for configkey, dev_type, dev_port in (
+        [('SWIFT_RING_OBJECT_DEVICES', 'ring_object_device', 6000),
+         ('SWIFT_RING_CONTAINER_DEVICES', 'ring_container_device', 6001),
+         ('SWIFT_RING_ACCOUNT_DEVICES', 'ring_account_device', 6002)]):
+        swift_dev_details = dict()
+        host = utils.force_ip(config['CONFIG_STORAGE_HOST_URL'])
+        for device in devices:
+            devicename = device['device_name']
+            key = "dev_%s_%s" % (host, devicename)
+            swift_dev_details.setdefault(key, {})
+            zone = device['zone']
+            swift_dev_details[key]['name'] = "%s:%s/%s" % (host, dev_port,
+                                                           devicename)
+            swift_dev_details[key]['weight'] = "%s" % 10
+            swift_dev_details[key]['zone'] = "%s" % zone
+        config[configkey] = swift_dev_details
+
+
+def create_proxy_manifest(config, messages):
+    fw_details = dict()
+    key = "swift_proxy"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "swift proxy"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['8080']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_SWIFT_PROXY_RULES'] = fw_details
+
+
+def create_storage_manifest(config, messages):
+    global devices
+
+    devicename = 0
+    swift_dev_details = dict()
+    host = utils.force_ip(config['CONFIG_STORAGE_HOST_URL'])
+    fstype = config["CONFIG_SWIFT_STORAGE_FSTYPE"]
 
     # this need to happen once per storage device
     for device in devices:
-        host = device['host']
-        devicename = device['device_name']
-        device = device['device']
-        if device:
-            check_device(host, device)
-
-        manifestfile = "%s_swift.pp"%host
-        if device:
-            manifestdata = "\n" + 'swift::storage::%s{"%s":\n  device => "/dev/%s",\n}'% (controller.CONF["CONFIG_SWIFT_STORAGE_FSTYPE"], devicename, device)
+        if device['device'] is None:
+            config['CONFIG_SWIFT_STORAGE_SEEK'] = get_storage_size(config)
         else:
-            config['SWIFT_STORAGE_SEEK'] = get_storage_size(config['CONFIG_SWIFT_STORAGE_SIZE'])
-            controller.CONF["SWIFT_STORAGE_DEVICES"] = "'%s'"%devicename
-            manifestdata = "\n" + getManifestTemplate("swift_loopback.pp")
-        appendManifestFile(manifestfile, manifestdata)
+            devicename = device['device_name']
+            devicedev = device['device']
+            key = "dev_%s_%s" % (host, devicename)
+            swift_dev_details.setdefault(key, {})
+            swift_dev_details[key]['device'] = "%s" % devicename
+            swift_dev_details[key]['dev'] = "%s" % devicedev
+            swift_dev_details[key]['fstype'] = "%s" % fstype
+    config['CONFIG_SWIFT_STORAGE_DEVICES'] = swift_dev_details
 
     # set allowed hosts for firewall
-    swift_hosts = get_swift_hosts(config)
-    hosts = swift_hosts.copy()
-    manifestdata = ""
+    hosts = set([config['CONFIG_STORAGE_HOST']])
     if config['CONFIG_NOVA_INSTALL'] == 'y':
-        hosts |= split_hosts(config['CONFIG_NOVA_COMPUTE_HOSTS'])
-
-    config['FIREWALL_SERVICE_NAME'] = "swift storage and rsync"
-    config['FIREWALL_PORTS'] = "'6000', '6001', '6002', '873'"
-    config['FIREWALL_CHAIN'] = "INPUT"
+        hosts |= split_hosts(config['CONFIG_COMPUTE_HOSTS'])
 
+    fw_details = dict()
     for host in hosts:
-        config['FIREWALL_ALLOWED'] = "'%s'" % host
-        config['FIREWALL_SERVICE_ID'] = "swift_storage_and_rsync_%s" % host
-        manifestdata += getManifestTemplate("firewall.pp")
-
-    for host in swift_hosts:
-        manifestfile = "%s_swift.pp" % host
-        appendManifestFile(manifestfile, manifestdata)
-
-
-def createcommonmanifest(config):
-    for manifestfile, marker in manifestfiles.getFiles():
-        if manifestfile.endswith("_swift.pp"):
-            data = getManifestTemplate("swift_common.pp")
-            appendManifestFile(os.path.split(manifestfile)[1], data)
-
-
-def get_swift_hosts(config):
-    """Get a set of all the Swift hosts"""
-    hosts = split_hosts(config['CONFIG_SWIFT_STORAGE_HOSTS'])
-    # remove "/device" from the storage host names
-    hosts = set(host.split('/', 1)[0] for host in hosts)
-    hosts |= split_hosts(config['CONFIG_SWIFT_PROXY_HOSTS'])
-    return hosts
+        key = "swift_storage_and_rsync_%s" % host
+        fw_details.setdefault(key, {})
+        fw_details[key]['host'] = "%s" % host
+        fw_details[key]['service_name'] = "swift storage and rsync"
+        fw_details[key]['chain'] = "INPUT"
+        fw_details[key]['ports'] = ['6000', '6001', '6002', '873']
+        fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_SWIFT_STORAGE_RULES'] = fw_details
diff --git a/packstack/plugins/trove_850.py b/packstack/plugins/trove_850.py
new file mode 100644
index 000000000..a6e23b02b
--- /dev/null
+++ b/packstack/plugins/trove_850.py
@@ -0,0 +1,157 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Installs and configures Trove
+"""
+
+from packstack.installer import basedefs
+from packstack.installer import utils
+from packstack.installer import validators
+from packstack.installer import processors
+
+from packstack.modules.documentation import update_params_usage
+from packstack.modules.ospluginutils import generate_ssl_cert
+
+# ------------------ Trove Packstack Plugin initialization ------------------
+
+PLUGIN_NAME = "OS-Trove"
+PLUGIN_NAME_COLORED = utils.color_text(PLUGIN_NAME, 'blue')
+
+
+# NOVA_USER, NOVA_TENANT, NOVA_PW
+
+def process_trove_nova_pw(param, param_name, config=None):
+    if (param == 'PW_PLACEHOLDER' and
+            config['CONFIG_TROVE_NOVA_USER'] == 'trove'):
+        return config['CONFIG_TROVE_KS_PW']
+    else:
+        return param
+
+
+def initConfig(controller):
+    parameters = [
+        {"CONF_NAME": "CONFIG_TROVE_DB_PW",
+         "CMD_OPTION": "trove-db-passwd",
+         "PROMPT": "Enter the password to use for Trove to access the DB",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",
+         "PROCESSORS": [processors.process_password],
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+
+        {"CONF_NAME": "CONFIG_TROVE_KS_PW",
+         "CMD_OPTION": "trove-ks-passwd",
+         "PROMPT": "Enter the password for Trove Keystone access",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",
+         "PROCESSORS": [processors.process_password],
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+
+        {"CONF_NAME": "CONFIG_TROVE_NOVA_USER",
+         "CMD_OPTION": "trove-nova-user",
+         "PROMPT": "Enter the user for Trove to use to connect to Nova",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "trove",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": False,
+         "USE_DEFAULT": True,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+
+        {"CONF_NAME": "CONFIG_TROVE_NOVA_TENANT",
+         "CMD_OPTION": "trove-nova-tenant",
+         "PROMPT": "Enter the tenant for Trove to use to connect to Nova",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "services",
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": False,
+         "USE_DEFAULT": True,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+
+        {"CONF_NAME": "CONFIG_TROVE_NOVA_PW",
+         "CMD_OPTION": "trove-nova-passwd",
+         "PROMPT": "Enter the password for Trove to use to connect to Nova",
+         "OPTION_LIST": [],
+         "VALIDATORS": [validators.validate_not_empty],
+         "DEFAULT_VALUE": "PW_PLACEHOLDER",  # default is trove pass
+         "PROCESSORS": [process_trove_nova_pw],
+         "MASK_INPUT": True,
+         "LOOSE_VALIDATION": False,
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": True,
+         "CONDITION": False},
+    ]
+    update_params_usage(basedefs.PACKSTACK_DOC, parameters, sectioned=False)
+    group = {"GROUP_NAME": "Trove",
+             "DESCRIPTION": "Trove config parameters",
+             "PRE_CONDITION": "CONFIG_TROVE_INSTALL",
+             "PRE_CONDITION_MATCH": "y",
+             "POST_CONDITION": False,
+             "POST_CONDITION_MATCH": True}
+
+    controller.addGroup(group, parameters)
+
+
+def initSequences(controller):
+    config = controller.CONF
+    if config['CONFIG_TROVE_INSTALL'] != 'y':
+        return
+
+    steps = [
+        {'title': 'Preparing Trove entries',
+         'functions': [create_manifest]}
+    ]
+
+    controller.addSequence("Installing Trove", [], [], steps)
+
+
+# ------------------------ step functions --------------------------
+def create_manifest(config, messages):
+    if config['CONFIG_AMQP_ENABLE_SSL'] == 'y':
+        ssl_cert_file = config['CONFIG_TROVE_SSL_CERT'] = (
+            '/etc/pki/tls/certs/ssl_amqp_trove.crt'
+        )
+        ssl_key_file = config['CONFIG_TROVE_SSL_KEY'] = (
+            '/etc/pki/tls/private/ssl_amqp_trove.key'
+        )
+        ssl_host = config['CONFIG_CONTROLLER_HOST']
+        service = 'trove'
+        generate_ssl_cert(config, ssl_host, service, ssl_key_file,
+                          ssl_cert_file)
+
+    if (config['CONFIG_TROVE_NOVA_USER'] == 'trove' and
+            config['CONFIG_TROVE_NOVA_PW'] == ''):
+        config['CONFIG_TROVE_NOVA_PW'] = config['CONFIG_TROVE_KS_PW']
+
+    fw_details = dict()
+    key = "trove"
+    fw_details.setdefault(key, {})
+    fw_details[key]['host'] = "ALL"
+    fw_details[key]['service_name'] = "trove api"
+    fw_details[key]['chain'] = "INPUT"
+    fw_details[key]['ports'] = ['8779']
+    fw_details[key]['proto'] = "tcp"
+    config['FIREWALL_TROVE_API_RULES'] = fw_details
diff --git a/packstack/puppet/modules/packstack/Gemfile b/packstack/puppet/modules/packstack/Gemfile
new file mode 100644
index 000000000..41a1cae68
--- /dev/null
+++ b/packstack/puppet/modules/packstack/Gemfile
@@ -0,0 +1,14 @@
+source 'https://rubygems.org'
+
+group :development, :test do
+  gem 'puppetlabs_spec_helper', :require => false
+  gem 'puppet-lint', '>= 1.0.0'
+  gem 'rake', '< 13.0.0'
+  gem 'rspec'
+end
+
+if puppetversion = ENV['PUPPET_GEM_VERSION']
+  gem 'puppet', puppetversion, :require => false
+else
+  gem 'puppet', :require => false
+end
diff --git a/packstack/puppet/modules/packstack/Rakefile b/packstack/puppet/modules/packstack/Rakefile
new file mode 100644
index 000000000..4c2b2ed07
--- /dev/null
+++ b/packstack/puppet/modules/packstack/Rakefile
@@ -0,0 +1,6 @@
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+
+PuppetLint.configuration.fail_on_warnings = true
+PuppetLint.configuration.send('disable_80chars')
+PuppetLint.configuration.send('disable_class_parameter_defaults')
diff --git a/packstack/puppet/modules/packstack/lib/facter/default_hypervisor.rb b/packstack/puppet/modules/packstack/lib/facter/default_hypervisor.rb
new file mode 100644
index 000000000..0ce77b3da
--- /dev/null
+++ b/packstack/puppet/modules/packstack/lib/facter/default_hypervisor.rb
@@ -0,0 +1,16 @@
+
+# Custom fact to keep backwards compatibility to default to qemu when the
+# is_virtual fact is true and otherwise default to kvm
+# This fact is then used as a default value for the
+# CONFIG_NOVA_LIBVIRT_VIRT_TYPE packstack parameter.
+
+Facter.add(:default_hypervisor) do
+  setcode do
+    if Facter.value(:is_virtual) == true
+      output = 'qemu'
+    else
+      output = 'kvm'
+    end
+    output
+  end
+end
diff --git a/packstack/puppet/modules/packstack/lib/facter/is_virtual_packstack.rb b/packstack/puppet/modules/packstack/lib/facter/is_virtual_packstack.rb
deleted file mode 100644
index f792b3a66..000000000
--- a/packstack/puppet/modules/packstack/lib/facter/is_virtual_packstack.rb
+++ /dev/null
@@ -1,9 +0,0 @@
-
-# is_virtual doesn't seem to work on all kvm vm's
-# this custom one seem to do better
-
-Facter.add("is_virtual_packstack") do
-  setcode do
-    Facter::Util::Resolution.exec('grep hypervisor /proc/cpuinfo > /dev/null && echo true || echo false')
-  end
-end
diff --git a/packstack/puppet/modules/packstack/lib/facter/netns.py b/packstack/puppet/modules/packstack/lib/facter/netns.py
deleted file mode 100644
index 076e50ee8..000000000
--- a/packstack/puppet/modules/packstack/lib/facter/netns.py
+++ /dev/null
@@ -1,207 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-
-import contextlib
-import inspect
-import os
-import random
-import subprocess
-import sys
-import tempfile
-import time
-import uuid
-import unittest
-
-
-def execute(cmd_string, check_error=True, return_code=0, input=None,
-            block=True, error_msg='Error executing cmd'):
-    print cmd_string
-    cmd = cmd_string.split(' ')
-    proc = subprocess.Popen(cmd,
-                            stdin=subprocess.PIPE,
-                            stdout=subprocess.PIPE,
-                            stderr=subprocess.PIPE)
-    if input:
-        proc.communicate(input=input)
-    elif block:
-        proc.wait()
-    if (check_error and
-            proc.returncode is not None and
-            proc.returncode != return_code):
-        msg = """
-%(error_msg)s
- Command: %(cmd)s
- Exit Code: %(code)s
-""".strip() % dict(cmd=' '.join(cmd),
-                   code=proc.returncode,
-                   error_msg=error_msg)
-        if input:
-            msg += "\n Stdin: %s" % input
-        if not proc.stdout.closed:
-            msg += "\n Stdout: %s" % proc.stdout.read()
-        if not proc.stderr.closed:
-            msg += "\n Stderr: %s" % proc.stderr.read()
-        raise Exception(msg)
-    return proc
-
-
-def e(cmd, prefix='ip netns exec ', sudo=False, **kwargs):
-    frame_locals = inspect.getargvalues(sys._getframe(1))[3]
-    if sudo:
-        prefix = 'sudo ' + prefix
-    return execute(prefix + cmd % frame_locals, **kwargs)
-
-
-def rand_name(name='test'):
-    return '%s-%s' % (name, str(random.randint(1, 0x7fffffff)))
-
-
-@contextlib.contextmanager
-def add_namespace():
-    name = rand_name('testns')
-    try:
-        e('ip netns add %(name)s', prefix='')
-        e('%(name)s ip link set lo up')
-        yield name
-    finally:
-        e('ip netns delete %(name)s', prefix='')
-
-
-@contextlib.contextmanager
-def add_namespaces():
-    with add_namespace() as ns1:
-        with add_namespace() as ns2:
-            yield ns1, ns2
-
-
-def add_veth_pair(ns1, ns2, veth1, veth2, address1, address2):
-    e('ip link add %(veth1)s netns %(ns1)s type veth '
-      'peer name %(veth2)s netns %(ns2)s', prefix='')
-    e('%(ns1)s ip link show %(veth1)s')
-    e('%(ns2)s ip link show %(veth2)s')
-    e('%(ns1)s ip -4 addr add %(address1)s/24 brd 255.255.255.0 '
-      'scope global dev %(veth1)s')
-    e('%(ns2)s ip -4 addr add %(address2)s/24 brd 255.255.255.0 '
-      'scope global dev %(veth2)s')
-    e('%(ns1)s ip link set %(veth1)s up')
-    e('%(ns2)s ip link set %(veth2)s up')
-
-
-class TestNetns(unittest.TestCase):
-
-    def test_neutron_netns_cmds(self):
-        """Exercise the netns functionality required by neutron.
-
-          - Check that a veth pair can be configured to transit traffic
-            between 2 namespaces
-          - Check that iptables filtering can be configured
-          - Check that iptables routing can be configured
-
-        """
-        # Naming scheme [resource][id]_[namespace id]
-        veth1_1 = 'veth1_1'
-        veth1_2 = 'veth1_2'
-        address1_1 = '192.168.0.1'
-        address1_2 = '192.168.0.2'
-        with add_namespaces() as (ns1, ns2):
-            # Check that inter-namespace connectivity can be established
-            add_veth_pair(ns1, ns2, veth1_1, veth1_2, address1_1, address1_2)
-            e('%(ns1)s ip link list')
-            e('%(ns1)s ip link show %(veth1_1)s')
-            e('%(ns1)s arping -A -U -I %(veth1_1)s '
-              '-c 1 %(address1_1)s')
-            e('%(ns2)s route add default gw %(address1_1)s')
-            e('%(ns2)s ping -c 1 -w 1 %(address1_1)s')
-            e('ping -c 1 -w 1 %(address1_1)s', prefix='', return_code=1,
-              error_msg='Namespace isolation not supported!')
-
-            # Check that iptables filtering and save/restore can be performed
-            try:
-                iptables_filename = os.path.join(
-                                        tempfile.gettempdir(),
-                                        'iptables-%s' % str(uuid.uuid4()))
-                e('%%(ns1)s iptables-save > %s' % iptables_filename)
-                e('%(ns1)s iptables -A INPUT -p icmp --icmp-type 8 -j DROP')
-                e('%(ns2)s ping -c 1 -w 1 %(address1_1)s', return_code=1)
-                e('%%(ns1)s iptables-restore < %s' % iptables_filename)
-                e('%(ns2)s ping -c 1 -w 1 %(address1_1)s')
-            finally:
-                if os.path.exists(iptables_filename):
-                    os.unlink(iptables_filename)
-
-            # Create another namespace (ns3) that is connected to ns1
-            # via a different subnet, so that traffic between ns3 and
-            # ns2 will have to be routed by ns1:
-            #
-            #  ns2 <- 192.168.0.0/24 -> ns1 <- 192.168.1.0/24 -> ns3
-            #
-            with add_namespace() as ns3:
-                veth2_1 = 'veth2_1'
-                veth2_3 = 'veth2_3'
-                address2_1 = '192.168.1.1'
-                address2_3 = '192.168.1.2'
-                add_veth_pair(ns1, ns3, veth2_1, veth2_3,
-                              address2_1, address2_3)
-                e('%(ns1)s sysctl -w net.ipv4.ip_forward=1')
-                e('%(ns1)s iptables -t nat -A POSTROUTING -o %(veth2_1)s -j '
-                  'MASQUERADE')
-                e('%(ns1)s iptables -A FORWARD -i %(veth2_1)s -o %(veth1_1)s '
-                  '-m state --state RELATED,ESTABLISHED -j ACCEPT')
-                e('%(ns1)s iptables -A FORWARD -i %(veth1_1)s -o %(veth2_1)s '
-                  '-j ACCEPT')
-                e('%(ns2)s ping -c 1 -w 1 %(address2_3)s')
-
-            # Check that links can be torn down
-            e('%(ns1)s ip -4 addr del %(address1_1)s/24 '
-              'dev %(veth1_1)s')
-            e('%(ns1)s ip link delete %(veth1_1)s')
-
-    def test_domain_socket_access(self):
-        """Check that a domain socket can be accessed regardless of namespace.
-
-        Neutron extends nova' metadata service - which identifies VM's
-        by their ip addresses - to configurations with overlapping
-        ips.  Support is provided by:
-
-          - a proxy in each namespace (neutron-ns-metadata-proxy)
-
-            - the proxy can uniquely identify a given VM by its ip
-              address in the context of the router or network of the
-              namespace.
-
-          - a metadata agent (neutron-metadata-agent) that forwards
-            requests from the namespace proxies to nova's metadata
-            service.
-
-        Communication between the proxies and the agent is over a unix
-        domain socket.  It is necessary that access to a domain socket
-        not be restricted by namespace, or such communication will not
-        be possible.
-
-        """
-        try:
-            execute('which nc')
-        except Exception:
-            self.fail("The 'nc' command is not available - please install it.")
-
-        sock_filename = os.path.join(tempfile.gettempdir(),
-                                     'testsock-%s' % str(uuid.uuid4()))
-        server = None
-        try:
-            # Create a server in the root namespace attached to a domain socket
-            server = e('nc -lU %(sock_filename)s', sudo=False, prefix='',
-                       block=False)
-            # Attempt to connect to the domain socket from within a namespace
-            with add_namespace() as ns:
-                e('%(ns)s nc -U %(sock_filename)s', input='magic',
-                  error_msg='Unable to communicate between namespaces via '
-                            'domain sockets.')
-        finally:
-            if server:
-                server.kill()
-            if os.path.exists(sock_filename):
-                os.unlink(sock_filename)
-
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/packstack/puppet/modules/packstack/lib/facter/netns_support.rb b/packstack/puppet/modules/packstack/lib/facter/netns_support.rb
deleted file mode 100644
index 783dd3375..000000000
--- a/packstack/puppet/modules/packstack/lib/facter/netns_support.rb
+++ /dev/null
@@ -1,16 +0,0 @@
-Facter.add(:netns_support) do
-  setcode do
-    oldout = $stdout.clone
-    olderr = $stderr.clone
-    $stdout.reopen("/dev/null", "w")
-    $stderr.reopen("/dev/null", "w")
-
-    script_path = File.join(File.dirname(__FILE__), 'netns.py')
-    passed = system "python #{script_path}"
-
-    $stdout.reopen(oldout)
-    $stderr.reopen(olderr)
-
-    passed
-  end
-end
diff --git a/packstack/puppet/modules/packstack/lib/puppet/functions/parse_hash_from_string.rb b/packstack/puppet/modules/packstack/lib/puppet/functions/parse_hash_from_string.rb
new file mode 100644
index 000000000..c03797ed1
--- /dev/null
+++ b/packstack/puppet/modules/packstack/lib/puppet/functions/parse_hash_from_string.rb
@@ -0,0 +1,12 @@
+Puppet::Functions.create_function(:parse_hash_from_string) do
+  def parse_hash_from_string(*args)
+    if args.length > 1
+      raise Puppet::Error, 'Argument must be one'
+    elsif !(args[0].kind_of?(String))
+      raise Puppet::Error, 'Argument must be a string'
+    end
+
+    value = args[0]
+    return Hash[value.scan(/(\S+)='([^']*)'/)]
+  end
+end
diff --git a/packstack/puppet/modules/packstack/lib/puppet/parser/functions/choose_my_ip.rb b/packstack/puppet/modules/packstack/lib/puppet/parser/functions/choose_my_ip.rb
new file mode 100644
index 000000000..4a0c7c7b7
--- /dev/null
+++ b/packstack/puppet/modules/packstack/lib/puppet/parser/functions/choose_my_ip.rb
@@ -0,0 +1,32 @@
+
+# Function returns host's IP selected from list of IPs
+module Puppet::Parser::Functions
+  newfunction(:choose_my_ip, :type => :rvalue) do |args|
+
+    if args.size < 1
+      raise(
+        Puppet::ParseError,
+        "choose_my_ip(): Wrong number of arguments given (#{args.size} for 1)"
+      )
+    end
+
+    host_list = args[0]
+    if not host_list.kind_of?(Array)
+      host_list = [host_list]
+    end
+    my_ips = Array.new
+    lookupvar('interfaces').split(',').each do |interface|
+        interface.strip!
+        my_ips.push(lookupvar("ipaddress_#{interface}"))
+        my_ips.push(lookupvar("ipaddress6_#{interface}"))
+    end
+
+    result = nil
+    host_list.each do |ip|
+      if my_ips.include? ip
+        result = ip
+      end
+    end
+    result
+  end
+end
diff --git a/packstack/puppet/modules/packstack/lib/puppet/parser/functions/force_interface.rb b/packstack/puppet/modules/packstack/lib/puppet/parser/functions/force_interface.rb
new file mode 100644
index 000000000..a958b9dbb
--- /dev/null
+++ b/packstack/puppet/modules/packstack/lib/puppet/parser/functions/force_interface.rb
@@ -0,0 +1,55 @@
+
+require 'ipaddr'
+
+# Returns value
+module Puppet::Parser::Functions
+  newfunction(:force_interface, :type => :rvalue) do |args|
+
+    if args.size < 2
+      raise(
+        Puppet::ParseError,
+        "force_interface(): Wrong number of arguments given (#{args.size} for 2)"
+      )
+    end
+
+    value = args[0]
+    allow = args[1]
+
+    was_array = value.kind_of?(Array)
+    if not was_array
+      value = [value]
+    end
+
+    result = []
+    if allow
+      value.each do |val|
+        translated = []
+        val.split(':').each do |fragment|
+          if fragment.include?('/') # this is CIDR, so translate it
+            cidr = IPAddr.new fragment
+            lookupvar('interfaces').split(',').each do |interface|
+              interface.strip!
+              ifaddr = lookupvar("ipaddress_#{interface}")
+              if ifaddr == nil
+                next
+              end
+              ifcidr = IPAddr.new ifaddr
+              if cidr.include?(ifcidr)
+                translated.push(interface)
+              end
+            end
+          else
+            translated.push(fragment)
+          end
+        end
+        result.push(translated.join(':'))
+      end
+    else
+      result = value
+    end
+    if not was_array
+      result = result[0]
+    end
+    result
+  end
+end
diff --git a/packstack/puppet/modules/packstack/lib/puppet/parser/functions/force_ip.rb b/packstack/puppet/modules/packstack/lib/puppet/parser/functions/force_ip.rb
new file mode 100644
index 000000000..9599849e0
--- /dev/null
+++ b/packstack/puppet/modules/packstack/lib/puppet/parser/functions/force_ip.rb
@@ -0,0 +1,20 @@
+
+require 'resolv'
+require 'ipaddr'
+
+
+module Puppet::Parser::Functions
+  newfunction(:force_ip, :type => :rvalue) do |args|
+    if args.size < 1
+      raise(
+        Puppet::ParseError,
+        "force_ip(): Wrong number of arguments given (#{args.size} for 1)"
+      )
+    end
+    if (!!IPAddr.new(args[0]) rescue false)
+      args[0]
+    else
+      Resolv.getaddress args[0]
+    end
+  end
+end
diff --git a/packstack/puppet/modules/packstack/lib/puppet/provider/remote_database/mysql.rb b/packstack/puppet/modules/packstack/lib/puppet/provider/remote_database/mysql.rb
deleted file mode 100644
index 08a7c9da3..000000000
--- a/packstack/puppet/modules/packstack/lib/puppet/provider/remote_database/mysql.rb
+++ /dev/null
@@ -1,47 +0,0 @@
-Puppet::Type.type(:remote_database).provide(:mysql) do
-
-  desc "Manages remote MySQL database."
-
-  defaultfor :kernel => 'Linux'
-
-  optional_commands :mysql      => 'mysql'
-  optional_commands :mysqladmin => 'mysqladmin'
-
-  def self.instances
-    mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}",
-          "--password=#{@resource[:db_password]}", '-NBe', "show databases").split("\n").collect do |name|
-      new(:name => name)
-    end
-  end
-
-  def create
-    mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}",
-          "--password=#{@resource[:db_password]}", '-NBe', "create database `#{@resource[:name]}` character set #{resource[:charset]}")
-  end
-
-  def destroy
-    mysqladmin("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}",
-               "--password=#{@resource[:db_password]}", '-f', 'drop', @resource[:name])
-  end
-
-  def charset
-    mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}",
-          "--password=#{@resource[:db_password]}", '-NBe', "show create database `#{resource[:name]}`").match(/.*?(\S+)\s\*\//)[1]
-  end
-
-  def charset=(value)
-    mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}",
-          "--password=#{@resource[:db_password]}", '-NBe', "alter database `#{resource[:name]}` CHARACTER SET #{value}")
-  end
-
-  def exists?
-    begin
-      mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}",
-            "--password=#{@resource[:db_password]}", '-NBe', "show databases").match(/^#{@resource[:name]}$/)
-    rescue => e
-      debug(e.message)
-      return nil
-    end
-  end
-
-end
diff --git a/packstack/puppet/modules/packstack/lib/puppet/provider/remote_database_grant/mysql.rb b/packstack/puppet/modules/packstack/lib/puppet/provider/remote_database_grant/mysql.rb
deleted file mode 100644
index e9c747be4..000000000
--- a/packstack/puppet/modules/packstack/lib/puppet/provider/remote_database_grant/mysql.rb
+++ /dev/null
@@ -1,194 +0,0 @@
-# A grant is either global or per-db. This can be distinguished by the syntax
-# of the name:
-#   user@host => global
-#   user@host/db => per-db
-
-Puppet::Type.type(:remote_database_grant).provide(:mysql) do
-
-  desc "Uses mysql as database."
-
-  defaultfor :kernel => 'Linux'
-
-  optional_commands :mysql      => 'mysql'
-  optional_commands :mysqladmin => 'mysqladmin'
-
-  def user_privs
-    @_user_privs || query_user_privs
-  end
-
-  def db_privs
-    @_db_privs || query_db_privs
-  end
-
-  def query_user_privs
-    results = mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-                    "mysql", "-Be", "describe user")
-    column_names = results.split(/\n/).map { |l| l.chomp.split(/\t/)[0] }
-    @_user_privs = column_names.delete_if { |e| !( e =~/_priv$/) }
-  end
-
-  def query_db_privs
-    results = mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-                    "mysql", "-Be", "describe db")
-    column_names = results.split(/\n/).map { |l| l.chomp.split(/\t/)[0] }
-    @_db_privs = column_names.delete_if { |e| !(e =~/_priv$/) }
-  end
-
-  def mysql_flush
-    mysqladmin("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}", "flush-privileges")
-  end
-
-  # this parses the
-  def split_name(string)
-    matches = /^([^@]*)@([^\/]*)(\/(.*))?$/.match(string).captures.compact
-    case matches.length
-    when 2
-      {
-        :type => :user,
-        :user => matches[0],
-        :host => matches[1]
-      }
-    when 4
-      {
-        :type => :db,
-        :user => matches[0],
-        :host => matches[1],
-        :db => matches[3]
-      }
-    end
-  end
-
-  def create_row
-    unless @resource.should(:privileges).empty?
-      name = split_name(@resource[:name])
-      case name[:type]
-      when :user
-        mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-              "mysql", "-e", "INSERT INTO user (host, user) VALUES ('%s', '%s')" % [
-          name[:host], name[:user],
-        ])
-      when :db
-        mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-              "mysql", "-e", "INSERT INTO db (host, user, db) VALUES ('%s', '%s', '%s')" % [
-          name[:host], name[:user], name[:db],
-        ])
-      end
-      mysql_flush
-    end
-  end
-
-  def destroy
-    mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-          "mysql", "-e", "REVOKE ALL ON '%s'.* FROM '%s@%s'" % [ @resource[:privileges], @resource[:database], @resource[:name], @resource[:host] ])
-  end
-
-  def row_exists?
-    name = split_name(@resource[:name])
-    fields = [:user, :host]
-    if name[:type] == :db
-      fields << :db
-    end
-    not mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-              "mysql", '-NBe', 'SELECT "1" FROM %s WHERE %s' % [ name[:type], fields.map do |f| "%s=\"%s\"" % [f, name[f]] end.join(' AND ')]).empty?
-  end
-
-  def all_privs_set?
-    all_privs = case split_name(@resource[:name])[:type]
-                when :user
-                  user_privs
-                when :db
-                  db_privs
-                end
-    all_privs = all_privs.collect do |p| p.downcase end.sort.join("|")
-    privs = privileges.collect do |p| p.downcase end.sort.join("|")
-
-    all_privs == privs
-  end
-
-  def privileges
-    name = split_name(@resource[:name])
-    privs = ""
-
-    case name[:type]
-    when :user
-      privs = mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-                    "mysql", "-Be", 'select * from mysql.user where user="%s" and host="%s"' % [ name[:user], name[:host] ])
-    when :db
-      privs = mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-                    "mysql", "-Be", 'select * from mysql.db where user="%s" and host="%s" and db="%s"' % [ name[:user], name[:host], name[:db] ])
-    end
-
-    if privs.match(/^$/)
-      privs = [] # no result, no privs
-    else
-      # returns a line with field names and a line with values, each tab-separated
-      privs = privs.split(/\n/).map! do |l| l.chomp.split(/\t/) end
-      # transpose the lines, so we have key/value pairs
-      privs = privs[0].zip(privs[1])
-      privs = privs.select do |p| p[0].match(/_priv$/) and p[1] == 'Y' end
-    end
-
-    privs.collect do |p| p[0] end
-  end
-
-  def privileges=(privs)
-    unless row_exists?
-      create_row
-    end
-
-    # puts "Setting privs: ", privs.join(", ")
-    name = split_name(@resource[:name])
-    stmt = ''
-    where = ''
-    all_privs = []
-    case name[:type]
-    when :user
-      stmt = 'update user set '
-      where = ' where user="%s" and host="%s"' % [ name[:user], name[:host] ]
-      all_privs = user_privs
-    when :db
-      stmt = 'update db set '
-      where = ' where user="%s" and host="%s" and db="%s"' % [ name[:user], name[:host], name[:db] ]
-      all_privs = db_privs
-    end
-
-    if privs[0].downcase == 'all'
-      privs = all_privs
-    end
-
-    # Downcase the requested priviliges for case-insensitive selection
-    # we don't map! here because the all_privs object has to remain in
-    # the same case the DB gave it to us in
-    privs = privs.map { |p| p.downcase }
-
-    # puts "stmt:", stmt
-    set = all_privs.collect do |p| "%s = '%s'" % [p, privs.include?(p.downcase) ? 'Y' : 'N'] end.join(', ')
-    # puts "set:", set
-    stmt = stmt << set << where
-
-    validate_privs privs, all_privs
-    mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-          "mysql", "-Be", stmt)
-    mysql_flush
-  end
-
-  def validate_privs(set_privs, all_privs)
-    all_privs = all_privs.collect { |p| p.downcase }
-    set_privs = set_privs.collect { |p| p.downcase }
-    invalid_privs = Array.new
-    hints = Array.new
-    # Test each of the user provided privs to see if they exist in all_privs
-    set_privs.each do |priv|
-      invalid_privs << priv unless all_privs.include?(priv)
-      hints << "#{priv}_priv" if all_privs.include?("#{priv}_priv")
-    end
-    unless invalid_privs.empty?
-      # Print a decently helpful and gramatically correct error message
-      hints = "Did you mean '#{hints.join(',')}'?" unless hints.empty?
-      p = invalid_privs.size > 1 ? ['s', 'are not valid'] : ['', 'is not valid']
-      detail = ["The privilege#{p[0]} '#{invalid_privs.join(',')}' #{p[1]}."]
-      fail [detail, hints].join(' ')
-    end
-  end
-
-end
diff --git a/packstack/puppet/modules/packstack/lib/puppet/provider/remote_database_user/mysql.rb b/packstack/puppet/modules/packstack/lib/puppet/provider/remote_database_user/mysql.rb
deleted file mode 100644
index 6a942ab64..000000000
--- a/packstack/puppet/modules/packstack/lib/puppet/provider/remote_database_user/mysql.rb
+++ /dev/null
@@ -1,48 +0,0 @@
-Puppet::Type.type(:remote_database_user).provide(:mysql) do
-
-  desc "manage users for a mysql database."
-
-  defaultfor :kernel => 'Linux'
-
-  optional_commands :mysql      => 'mysql'
-  optional_commands :mysqladmin => 'mysqladmin'
-
-  def self.instances
-    users = mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-                  "mysql", '-BNe', "select concat(User, '@', Host) as User from mysql.user").split("\n")
-    users.select{ |user| user =~ /.+@/ }.collect do |name|
-      new(:name => name)
-    end
-  end
-
-  def create
-    mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-          "mysql", "-e", "create user '%s' identified by PASSWORD '%s'" % [ @resource[:name].sub("@", "'@'"), @resource.value(:password_hash) ])
-  end
-
-  def destroy
-    mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-          "mysql", "-e", "drop user '%s'" % @resource.value(:name).sub("@", "'@'") )
-  end
-
-  def password_hash
-    mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-          "mysql", "-NBe", "select password from mysql.user where CONCAT(user, '@', host) = '%s'" % @resource.value(:name)).chomp
-  end
-
-  def password_hash=(string)
-    mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-          "mysql", "-e", "SET PASSWORD FOR '%s' = '%s'" % [ @resource[:name].sub("@", "'@'"), string ] )
-  end
-
-  def exists?
-    not mysql("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}",
-              "mysql", "-NBe", "select '1' from mysql.user where CONCAT(user, '@', host) = '%s'" % @resource.value(:name)).empty?
-  end
-
-  def flush
-    @property_hash.clear
-    mysqladmin("--host=#{@resource[:db_host]}", "--user=#{@resource[:db_user]}", "--password=#{@resource[:db_password]}", "flush-privileges")
-  end
-
-end
diff --git a/packstack/puppet/modules/packstack/lib/puppet/type/remote_database.rb b/packstack/puppet/modules/packstack/lib/puppet/type/remote_database.rb
deleted file mode 100644
index ac272cd3c..000000000
--- a/packstack/puppet/modules/packstack/lib/puppet/type/remote_database.rb
+++ /dev/null
@@ -1,29 +0,0 @@
-
-Puppet::Type.newtype(:remote_database) do
-  @doc = "Manage databases remotely."
-
-  ensurable
-
-  newparam(:name, :namevar=>true) do
-    desc "The name of the database."
-  end
-
-  newparam(:db_host) do
-    desc "The hostname of the database server to connect."
-  end
-
-  newparam(:db_user) do
-    desc "The user name to use when connecting to the server."
-  end
-
-  newparam(:db_password) do
-    desc "The password with which to connect to the database server."
-  end
-
-  newproperty(:charset) do
-    desc "The characterset to use for a database"
-    defaultto :utf8
-    newvalue(/^\S+$/)
-  end
-
-end
diff --git a/packstack/puppet/modules/packstack/lib/puppet/type/remote_database_grant.rb b/packstack/puppet/modules/packstack/lib/puppet/type/remote_database_grant.rb
deleted file mode 100644
index 36ce077a8..000000000
--- a/packstack/puppet/modules/packstack/lib/puppet/type/remote_database_grant.rb
+++ /dev/null
@@ -1,86 +0,0 @@
-
-Puppet::Type.newtype(:remote_database_grant) do
-  @doc = "Manage a database user's rights remotely."
-  #ensurable
-
-  autorequire :remote_database do
-    # puts "Starting db autoreq for %s" % self[:name]
-    reqs = []
-    matches = self[:name].match(/^([^@]+)@([^\/]+)\/(.+)$/)
-    unless matches.nil?
-      reqs << matches[3]
-    end
-    # puts "Autoreq: '%s'" % reqs.join(" ")
-    reqs
-  end
-
-  autorequire :remote_database_user do
-    # puts "Starting user autoreq for %s" % self[:name]
-    reqs = []
-    matches = self[:name].match(/^([^@]+)@([^\/]+).*$/)
-    unless matches.nil?
-      reqs << "%s@%s" % [ matches[1], matches[2] ]
-    end
-    # puts "Autoreq: '%s'" % reqs.join(" ")
-    reqs
-  end
-
-  newparam(:name, :namevar=>true) do
-    desc "The primary key: either user@host for global privilges or user@host/database for database specific privileges"
-  end
-
-  newparam(:db_host) do
-    desc "The hostname of the database server to connect."
-  end
-
-  newparam(:db_user) do
-    desc "The user name to use when connecting to the server."
-  end
-
-  newparam(:db_password) do
-    desc "The password with which to connect to the database server."
-  end
-
-  newproperty(:privileges, :array_matching => :all) do
-    desc "The privileges the user should have. The possible values are implementation dependent."
-
-    def should_to_s(newvalue = @should)
-      if newvalue
-        unless newvalue.is_a?(Array)
-          newvalue = [ newvalue ]
-        end
-        newvalue.collect do |v| v.downcase end.sort.join ", "
-      else
-        nil
-      end
-    end
-
-    def is_to_s(currentvalue = @is)
-      if currentvalue
-        unless currentvalue.is_a?(Array)
-          currentvalue = [ currentvalue ]
-        end
-        currentvalue.collect do |v| v.downcase end.sort.join ", "
-      else
-        nil
-      end
-    end
-
-    # use the sorted outputs for comparison
-    def insync?(is)
-      if defined? @should and @should
-        case self.should_to_s
-        when "all"
-          self.provider.all_privs_set?
-        when self.is_to_s(is)
-          true
-        else
-          false
-        end
-      else
-        true
-      end
-    end
-  end
-
-end
diff --git a/packstack/puppet/modules/packstack/lib/puppet/type/remote_database_user.rb b/packstack/puppet/modules/packstack/lib/puppet/type/remote_database_user.rb
deleted file mode 100644
index 0db0ef024..000000000
--- a/packstack/puppet/modules/packstack/lib/puppet/type/remote_database_user.rb
+++ /dev/null
@@ -1,37 +0,0 @@
-
-Puppet::Type.newtype(:remote_database_user) do
-  @doc = "Manage a database user remotely. This includes management of users password as well as priveleges"
-
-  ensurable
-
-  newparam(:name, :namevar=>true) do
-    desc "The name of the user. This uses the 'username@hostname' or username@hostname."
-    validate do |value|
-      # https://dev.mysql.com/doc/refman/5.1/en/account-names.html
-      # Regex should problably be more like this: /^[`'"]?[^`'"]*[`'"]?@[`'"]?[\w%\.]+[`'"]?$/
-      raise(ArgumentError, "Invalid database user #{value}") unless value =~ /[\w-]*@[\w%\.:]+/
-      username = value.split('@')[0]
-      if username.size > 16
-        raise ArgumentError, "MySQL usernames are limited to a maximum of 16 characters"
-      end
-    end
-  end
-
-  newproperty(:password_hash) do
-    desc "The password hash of the user. Use mysql_password() for creating such a hash."
-    newvalue(/\w+/)
-  end
-
-  newparam(:db_host) do
-    desc "The hostname of the database server to connect."
-  end
-
-  newparam(:db_user) do
-    desc "The user name to use when connecting to the server."
-  end
-
-  newparam(:db_password) do
-    desc "The password with which to connect to the database server."
-  end
-
-end
diff --git a/packstack/puppet/modules/packstack/manifests/amqp.pp b/packstack/puppet/modules/packstack/manifests/amqp.pp
new file mode 100644
index 000000000..69ce90cb2
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/amqp.pp
@@ -0,0 +1,26 @@
+class packstack::amqp ()
+{
+  $amqp = lookup('CONFIG_AMQP_BACKEND')
+
+  case $amqp  {
+    'rabbitmq': {
+      packstack::amqp::enable_rabbitmq { 'rabbitmq': }
+
+        # The following kernel parameters help alleviate some RabbitMQ
+        # connection issues
+
+        sysctl::value { 'net.ipv4.tcp_keepalive_intvl':
+          value => '1',
+        }
+
+        sysctl::value { 'net.ipv4.tcp_keepalive_probes':
+          value => '5',
+        }
+
+        sysctl::value { 'net.ipv4.tcp_keepalive_time':
+          value => '5',
+        }
+    }
+    default: {}
+  }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/amqp/enable_rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/amqp/enable_rabbitmq.pp
new file mode 100644
index 000000000..2060e6154
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/amqp/enable_rabbitmq.pp
@@ -0,0 +1,59 @@
+define packstack::amqp::enable_rabbitmq {
+  create_resources(packstack::firewall, lookup('FIREWALL_AMQP_RULES', undef, undef, {}))
+  $amqp_enable_ssl = lookup('CONFIG_AMQP_SSL_ENABLED')
+
+  if $amqp_enable_ssl {
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = '/etc/pki/tls/private/ssl_amqp.key'
+    $kombu_ssl_certfile = '/etc/pki/tls/certs/ssl_amqp.crt'
+
+    $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+    file { $files_to_set_owner:
+      owner   => 'rabbitmq',
+      group   => 'rabbitmq',
+      require => Package['rabbitmq-server'],
+      notify  => Service['rabbitmq-server'],
+    }
+
+    file { $kombu_ssl_ca_certs:
+      mode    => '0644',
+      require => Package['rabbitmq-server'],
+      notify  => Service['rabbitmq-server'],
+    }
+
+    class { 'rabbitmq':
+      port                     => undef,
+      ssl_port                 => 0 + lookup('CONFIG_AMQP_CLIENTS_PORT'),
+      ssl_only                 => true,
+      ssl                      => true,
+      ssl_cacert               => $kombu_ssl_ca_certs,
+      ssl_cert                 => $kombu_ssl_certfile,
+      ssl_key                  => $kombu_ssl_keyfile,
+      default_user             => lookup('CONFIG_AMQP_AUTH_USER'),
+      default_pass             => lookup('CONFIG_AMQP_AUTH_PASSWORD'),
+      package_provider         => 'yum',
+      repos_ensure             => false,
+      admin_enable             => false,
+      loopback_users           => [],
+      ssl_verify               => 'verify_peer',
+      ssl_fail_if_no_peer_cert => true,
+      config_ranch             => false,
+      tcp_keepalive            => true,
+      tcp_backlog              => 128,
+    }
+  } else {
+    class { 'rabbitmq':
+      port             => 0 + lookup('CONFIG_AMQP_CLIENTS_PORT'),
+      ssl              => false,
+      default_user     => lookup('CONFIG_AMQP_AUTH_USER'),
+      default_pass     => lookup('CONFIG_AMQP_AUTH_PASSWORD'),
+      package_provider => 'yum',
+      repos_ensure     => false,
+      admin_enable     => false,
+      loopback_users   => [],
+      config_ranch     => false,
+      tcp_keepalive    => true,
+      tcp_backlog      => 128,
+    }
+  }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/aodh.pp b/packstack/puppet/modules/packstack/manifests/aodh.pp
new file mode 100644
index 000000000..6667b41c9
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/aodh.pp
@@ -0,0 +1,47 @@
+class packstack::aodh ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_AODH_RULES', undef, undef, {}))
+
+    $config_aodh_coordination_backend = lookup('CONFIG_CEILOMETER_COORDINATION_BACKEND')
+
+    if $config_aodh_coordination_backend == 'redis' {
+      $coordination_url = os_url({
+        'scheme' => 'redis',
+        'host'   => lookup('CONFIG_REDIS_HOST_URL'),
+        'port'   => lookup('CONFIG_REDIS_PORT'),
+      })
+      Service<| title == 'redis' |> -> Anchor['aodh::service::begin']
+    } else {
+      $coordination_url = undef
+    }
+
+    class { 'aodh::keystone::authtoken':
+      password             => lookup('CONFIG_AODH_KS_PW'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
+
+    class { 'aodh::api':
+      enabled      => true,
+      service_name => 'httpd',
+      sync_db      => true,
+    }
+
+    class { 'aodh::wsgi::apache':
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
+      ssl     => false
+    }
+
+    class { 'aodh::service_credentials':
+      password    => lookup('CONFIG_AODH_KS_PW'),
+      auth_url    => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      region_name => lookup('CONFIG_KEYSTONE_REGION'),
+    }
+    class { 'aodh::coordination':
+      backend_url => $coordination_url,
+    }
+    class { 'aodh::evaluator': }
+    class { 'aodh::notifier': }
+    class { 'aodh::listener': }
+    class { 'aodh::client': }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/aodh/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/aodh/rabbitmq.pp
new file mode 100644
index 000000000..72b4ef279
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/aodh/rabbitmq.pp
@@ -0,0 +1,45 @@
+class packstack::aodh::rabbitmq ()
+{
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_AODH_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_AODH_SSL_CERT', undef, undef, undef)
+
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
+        owner   => 'aodh',
+        group   => 'aodh',
+        require => Package['aodh'],
+      }
+      File[$files_to_set_owner] ~> Service<| tag == 'aodh-service' |>
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'aodh-service' |>
+
+    class { 'aodh::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'aodh::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'aodh',
+        'password' => lookup('CONFIG_AODH_DB_PW'),
+        'database' => 'aodh',
+      })
+    }
+
+    class { 'aodh':
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/apache.pp b/packstack/puppet/modules/packstack/manifests/apache.pp
new file mode 100644
index 000000000..487bb9184
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/apache.pp
@@ -0,0 +1,5 @@
+class packstack::apache ()
+{
+    class { 'apache': }
+}
+
diff --git a/packstack/puppet/modules/packstack/manifests/ceilometer.pp b/packstack/puppet/modules/packstack/manifests/ceilometer.pp
new file mode 100644
index 000000000..bb22ea607
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/ceilometer.pp
@@ -0,0 +1,44 @@
+class packstack::ceilometer ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_CEILOMETER_RULES', undef, undef, {}))
+
+    $config_ceilometer_coordination_backend = lookup('CONFIG_CEILOMETER_COORDINATION_BACKEND')
+
+    $config_gnocchi_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+
+    if $config_ceilometer_coordination_backend == 'redis' {
+      $coordination_url = os_url({
+        'scheme' => 'redis',
+        'host'   => lookup('CONFIG_REDIS_HOST_URL'),
+        'port'   => lookup('CONFIG_REDIS_PORT'),
+      })
+      Service<| title == 'redis' |> -> Anchor['ceilometer::service::begin']
+    } else {
+      $coordination_url = undef
+    }
+
+    include ceilometer
+
+    include ceilometer::db::sync
+
+    Keystone::Resource::Service_identity<||> -> Anchor['ceilometer::dbsync::begin']
+
+    class { 'ceilometer::agent::notification':
+      manage_event_pipeline     => true,
+      event_pipeline_publishers => ['gnocchi://'],
+    }
+
+    class { 'ceilometer::agent::service_credentials':
+      auth_url    => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      password    => lookup('CONFIG_CEILOMETER_KS_PW'),
+      region_name => lookup('CONFIG_KEYSTONE_REGION'),
+    }
+
+    class { 'ceilometer::coordination':
+      backend_url => $coordination_url,
+    }
+
+    class { 'ceilometer::agent::polling':
+      manage_polling   => true,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/ceilometer/nova_disabled.pp b/packstack/puppet/modules/packstack/manifests/ceilometer/nova_disabled.pp
new file mode 100644
index 000000000..5f4214e43
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/ceilometer/nova_disabled.pp
@@ -0,0 +1,8 @@
+class packstack::ceilometer::nova_disabled ()
+{
+    group { 'nova':
+      ensure => present,
+    }
+
+    Group['nova'] -> Class['ceilometer']
+}
diff --git a/packstack/puppet/modules/packstack/manifests/ceilometer/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/ceilometer/rabbitmq.pp
new file mode 100644
index 000000000..53f55a0a2
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/ceilometer/rabbitmq.pp
@@ -0,0 +1,36 @@
+class packstack::ceilometer::rabbitmq ()
+{
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_CEILOMETER_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_CEILOMETER_SSL_CERT', undef, undef, undef)
+
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
+        owner   => 'ceilometer',
+        group   => 'ceilometer',
+        require => Package['ceilometer-common'],
+      }
+      File[$files_to_set_owner] ~> Service<| tag == 'ceilometer-service' |>
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'ceilometer-service' |>
+
+    class { 'ceilometer::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'ceilometer':
+      telemetry_secret      => lookup('CONFIG_CEILOMETER_SECRET'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/chrony.pp b/packstack/puppet/modules/packstack/manifests/chrony.pp
new file mode 100644
index 000000000..131406085
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/chrony.pp
@@ -0,0 +1,88 @@
+class packstack::chrony ()
+{
+    $cfg_ntp_server_def = lookup('CONFIG_NTP_SERVER_DEF')
+    $cfg_ntp_servers    = lookup('CONFIG_NTP_SERVERS')
+
+    $config_content = "
+    # Use public servers from the pool.ntp.org project.
+    # Please consider joining the pool (http://www.pool.ntp.org/join.html).
+    ${cfg_ntp_server_def}
+
+    # Ignore stratum in source selection.
+    stratumweight 0
+
+    # Record the rate at which the system clock gains/losses time.
+    driftfile /var/lib/chrony/drift
+
+    # Enable kernel RTC synchronization.
+    rtcsync
+
+    # In first three updates step the system clock instead of slew
+    # if the adjustment is larger than 10 seconds.
+    makestep 10 3
+
+    # Allow NTP client access from local network.
+    #allow 192.168/16
+
+    # Listen for commands only on localhost.
+    bindcmdaddress 127.0.0.1
+    bindcmdaddress ::1
+
+    # Serve time even if not synchronized to any NTP server.
+    #local stratum 10
+
+    keyfile /etc/chrony.keys
+
+    # Specify the key used as password for chronyc.
+    commandkey 1
+
+    # Generate command key if missing.
+    generatecommandkey
+
+    # Disable logging of client accesses.
+    noclientlog
+
+    # Send a message to syslog if a clock adjustment is larger than 0.5 seconds.
+    logchange 0.5
+
+    logdir /var/log/chrony
+    #log measurements statistics tracking
+    "
+
+    package { 'chrony':
+      ensure => 'installed',
+      name   => 'chrony',
+    }
+
+    file { 'chrony_conf':
+      ensure  => file,
+      path    => '/etc/chrony.conf',
+      mode    => '0644',
+      content => $config_content,
+    }
+
+    exec { 'stop-chronyd':
+      path    => '/bin:/usr/bin:/sbin:/usr/sbin',
+      command => 'systemctl stop chronyd.service',
+      onlyif  => 'systemctl status chronyd.service'
+    }
+
+    exec { 'ntpdate':
+      command => "/usr/bin/chronyc makestep",
+      tries   => 3,
+    }
+
+    service { 'chronyd':
+      ensure     => running,
+      enable     => true,
+      name       => 'chronyd',
+      hasstatus  => true,
+      hasrestart => true,
+    }
+
+    Package['chrony']
+    -> File['chrony_conf']
+    -> Exec['stop-chronyd']
+    -> Service['chronyd']
+    -> Exec['ntpdate']
+}
diff --git a/packstack/puppet/modules/packstack/manifests/cinder.pp b/packstack/puppet/modules/packstack/manifests/cinder.pp
new file mode 100644
index 000000000..319542e5a
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/cinder.pp
@@ -0,0 +1,69 @@
+class packstack::cinder ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_CINDER_RULES', undef, undef, {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_CINDER_API_RULES', undef, undef, {}))
+
+    $cinder_backends = lookup('CONFIG_CINDER_BACKEND', { merge => 'unique' })
+
+    case $cinder_backends[0] {
+      'lvm':       { $default_volume_type = 'lvm' }
+      'nfs':       { $default_volume_type = 'nfs' }
+      'netapp':    { $default_volume_type = 'netapp' }
+      'solidfire': { $default_volume_type = 'solidfire' }
+      default:     { $default_volume_type = 'lvm' }
+    }
+
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    class { 'cinder::keystone::authtoken':
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      password             => lookup('CONFIG_CINDER_KS_PW'),
+    }
+
+    class { 'cinder::api':
+      service_name        => 'httpd',
+      default_volume_type => $default_volume_type,
+    }
+    class { 'cinder::wsgi::apache':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    class { 'cinder::scheduler': }
+
+    class { 'cinder::volume': }
+
+    class { 'cinder::client': }
+
+    class { 'cinder::glance': }
+
+    class { 'cinder::nova':
+      auth_type => 'password',
+      password  => lookup('CONFIG_NOVA_KS_PW'),
+      auth_url  => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
+
+    class { 'cinder::keystone::service_user':
+      send_service_user_token => true,
+      password                => lookup('CONFIG_CINDER_KS_PW'),
+      auth_url                => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
+
+    class { 'cinder::backends':
+      enabled_backends => lookup('CONFIG_CINDER_BACKEND', { merge => 'unique' }),
+    }
+
+    $db_purge = lookup('CONFIG_CINDER_DB_PURGE_ENABLE')
+    if $db_purge {
+      class { 'cinder::cron::db_purge':
+        hour        => '*/24',
+        destination => '/dev/null',
+        age         => 1
+      }
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/backend/lvm.pp b/packstack/puppet/modules/packstack/manifests/cinder/backend/lvm.pp
new file mode 100644
index 000000000..269d4fdac
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/cinder/backend/lvm.pp
@@ -0,0 +1,75 @@
+class packstack::cinder::backend::lvm ()
+{
+    $create_cinder_volume = lookup('CONFIG_CINDER_VOLUMES_CREATE')
+    $cinder_volume_name = lookup('CONFIG_CINDER_VOLUME_NAME')
+
+    if $create_cinder_volume == 'y' {
+        # Find an available loop device
+        $loop_dev = chomp(generate('/usr/sbin/losetup', '-f'))
+
+        class { 'cinder::setup_test_volume':
+          size            => lookup('CONFIG_CINDER_VOLUMES_SIZE'),
+          loopback_device => $loop_dev,
+          volume_path     => '/var/lib/cinder',
+          volume_name     => $cinder_volume_name,
+        }
+
+        file { 'openstack-losetup':
+          path    => '/usr/lib/systemd/system/openstack-losetup.service',
+          before  => Service['openstack-losetup'],
+          notify  => Exec['reload systemd files for cinder-volume'],
+          content => "[Unit]
+Description=Setup cinder-volume loop device
+DefaultDependencies=false
+Before=openstack-cinder-volume.service
+After=local-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/sh -c \'/usr/sbin/losetup -j /var/lib/cinder/${cinder_volume_name} | /usr/bin/grep /var/lib/cinder/${cinder_volume_name} || /usr/sbin/losetup -f /var/lib/cinder/${cinder_volume_name}\'
+ExecStop=/usr/bin/sh -c \'/usr/sbin/losetup -j /var/lib/cinder/${cinder_volume_name} | /usr/bin/cut -d : -f 1 | /usr/bin/xargs /usr/sbin/losetup -d\'
+TimeoutSec=60
+RemainAfterExit=yes
+
+[Install]
+RequiredBy=openstack-cinder-volume.service",
+      }
+
+      exec { 'reload systemd files for cinder-volume':
+        command     => '/usr/bin/systemctl daemon-reload',
+        refreshonly => true,
+        before      => Service['openstack-losetup'],
+      }
+
+      service { 'openstack-losetup':
+        ensure  => running,
+        enable  => true,
+        require => Class['cinder::setup_test_volume'],
+      }
+    }
+    else {
+        ensure_packages(['lvm2'], {'ensure' => 'present'})
+    }
+
+
+    file_line { 'snapshot_autoextend_threshold':
+      path    => '/etc/lvm/lvm.conf',
+      match   => '^\s*snapshot_autoextend_threshold +=.*',
+      line    => '   snapshot_autoextend_threshold = 80',
+      require => Package['lvm2'],
+    }
+
+    file_line { 'snapshot_autoextend_percent':
+      path    => '/etc/lvm/lvm.conf',
+      match   => '^\s*snapshot_autoextend_percent +=.*',
+      line    => '   snapshot_autoextend_percent = 20',
+      require => Package['lvm2'],
+    }
+
+    cinder::backend::iscsi { 'lvm':
+      target_ip_address  => lookup('CONFIG_STORAGE_HOST_URL'),
+      require            => Package['lvm2'],
+      volume_group       => $cinder_volume_name,
+      manage_volume_type => true,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/backend/netapp.pp b/packstack/puppet/modules/packstack/manifests/cinder/backend/netapp.pp
new file mode 100644
index 000000000..be5fc13f6
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/cinder/backend/netapp.pp
@@ -0,0 +1,134 @@
+# Copyright (c) – 2014, Ryan Hefner.  All rights reserved.
+class packstack::cinder::backend::netapp ()
+{
+    $netapp_storage_family = lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY')
+    $netapp_storage_protocol = lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL')
+    $netapp_backend_name = 'netapp'
+
+    if $netapp_storage_family == 'ontap_cluster' {
+      if $netapp_storage_protocol == 'nfs' {
+        cinder::backend::netapp { $netapp_backend_name:
+          netapp_login              => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_password           => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_server_hostname    => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_port        => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_storage_family     => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_protocol   => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_transport_type     => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_vserver            => lookup('CONFIG_CINDER_NETAPP_VSERVER'),
+          expiry_thres_minutes      => lookup('CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES'),
+          thres_avl_size_perc_start => lookup('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_START'),
+          thres_avl_size_perc_stop  => lookup('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_STOP'),
+          nfs_shares                => lookup('CONFIG_CINDER_NETAPP_NFS_SHARES', { merge => 'unique' }),
+          nfs_shares_config         => lookup('CONFIG_CINDER_NETAPP_NFS_SHARES_CONFIG'),
+          manage_volume_type        => true,
+        }
+        ensure_packages(['nfs-utils'], {'ensure' => 'present'})
+      }
+      elsif $netapp_storage_protocol == 'iscsi' {
+        cinder::backend::netapp { $netapp_backend_name:
+          netapp_login            => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_password         => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_server_hostname  => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_port      => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_size_multiplier  => lookup('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
+          netapp_storage_family   => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_protocol => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_transport_type   => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_vserver          => lookup('CONFIG_CINDER_NETAPP_VSERVER'),
+          manage_volume_type      => true,
+        }
+
+        ensure_packages(['iscsi-initiator-utils'], {'ensure' => 'present'})
+      }
+
+      elsif $netapp_storage_protocol == 'fc' {
+        cinder::backend::netapp { $netapp_backend_name:
+          netapp_login            => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_password         => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_server_hostname  => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_port      => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_size_multiplier  => lookup('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
+          netapp_storage_family   => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_protocol => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_transport_type   => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_vserver          => lookup('CONFIG_CINDER_NETAPP_VSERVER'),
+          manage_volume_type      => true,
+        }
+      }
+    }
+    elsif $netapp_storage_family == 'ontap_7mode' {
+      if $netapp_storage_protocol == 'nfs' {
+        cinder::backend::netapp { $netapp_backend_name:
+          netapp_login              => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_password           => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_server_hostname    => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_port        => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_storage_family     => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_protocol   => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_transport_type     => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          expiry_thres_minutes      => lookup('CONFIG_CINDER_NETAPP_EXPIRY_THRES_MINUTES'),
+          thres_avl_size_perc_start => lookup('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_START'),
+          thres_avl_size_perc_stop  => lookup('CONFIG_CINDER_NETAPP_THRES_AVL_SIZE_PERC_STOP'),
+          nfs_shares                => lookup('CONFIG_CINDER_NETAPP_NFS_SHARES', { merge => 'unique' }),
+          nfs_shares_config         => lookup('CONFIG_CINDER_NETAPP_NFS_SHARES_CONFIG'),
+          manage_volume_type        => true,
+        }
+
+        ensure_packages(['nfs-utils'], {'ensure' => 'present'})
+      }
+      elsif $netapp_storage_protocol == 'iscsi' {
+        cinder::backend::netapp { $netapp_backend_name:
+          netapp_login            => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_password         => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_server_hostname  => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_port      => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_size_multiplier  => lookup('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
+          netapp_storage_family   => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_protocol => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_transport_type   => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_vfiler           => lookup('CONFIG_CINDER_NETAPP_VFILER'),
+          netapp_volume_list      => lookup('CONFIG_CINDER_NETAPP_VOLUME_LIST'),
+          manage_volume_type      => true,
+        }
+
+        ensure_packages(['iscsi-initiator-utils'], {'ensure' => 'present'})
+      }
+
+      elsif $netapp_storage_protocol == 'fc' {
+        cinder::backend::netapp { $netapp_backend_name:
+          netapp_login                => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+          netapp_password             => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+          netapp_server_hostname      => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+          netapp_server_port          => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+          netapp_size_multiplier      => lookup('CONFIG_CINDER_NETAPP_SIZE_MULTIPLIER'),
+          netapp_storage_family       => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+          netapp_storage_protocol     => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+          netapp_transport_type       => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+          netapp_vfiler               => lookup('CONFIG_CINDER_NETAPP_VFILER'),
+          netapp_partner_backend_name => lookup('CONFIG_CINDER_NETAPP_PARTNER_BACKEND_NAME'),
+          netapp_volume_list          => lookup('CONFIG_CINDER_NETAPP_VOLUME_LIST'),
+          manage_volume_type          => true,
+        }
+      }
+    }
+    elsif $netapp_storage_family == 'eseries' {
+      cinder::backend::netapp { $netapp_backend_name:
+        netapp_login             => lookup('CONFIG_CINDER_NETAPP_LOGIN'),
+        netapp_password          => lookup('CONFIG_CINDER_NETAPP_PASSWORD'),
+        netapp_server_hostname   => lookup('CONFIG_CINDER_NETAPP_HOSTNAME'),
+        netapp_server_port       => lookup('CONFIG_CINDER_NETAPP_SERVER_PORT'),
+        netapp_storage_family    => lookup('CONFIG_CINDER_NETAPP_STORAGE_FAMILY'),
+        netapp_storage_protocol  => lookup('CONFIG_CINDER_NETAPP_STORAGE_PROTOCOL'),
+        netapp_transport_type    => lookup('CONFIG_CINDER_NETAPP_TRANSPORT_TYPE'),
+        netapp_controller_ips    => lookup('CONFIG_CINDER_NETAPP_CONTROLLER_IPS'),
+        netapp_sa_password       => lookup('CONFIG_CINDER_NETAPP_SA_PASSWORD'),
+        netapp_storage_pools     => lookup('CONFIG_CINDER_NETAPP_STORAGE_POOLS'),
+        netapp_eseries_host_type => lookup('CONFIG_CINDER_NETAPP_ESERIES_HOST_TYPE'),
+        netapp_webservice_path   => lookup('CONFIG_CINDER_NETAPP_WEBSERVICE_PATH'),
+        manage_volume_type       => true,
+      }
+
+      ensure_packages(['iscsi-initiator-utils'], {'ensure' => 'present'})
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/backend/nfs.pp b/packstack/puppet/modules/packstack/manifests/cinder/backend/nfs.pp
new file mode 100644
index 000000000..8b0010b33
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/cinder/backend/nfs.pp
@@ -0,0 +1,12 @@
+class packstack::cinder::backend::nfs ()
+{
+    ensure_packages(['nfs-utils'], {'ensure' => 'present'})
+
+    cinder::backend::nfs { 'nfs':
+      nfs_servers          => lookup('CONFIG_CINDER_NFS_MOUNTS', { merge => 'unique' }),
+      require              => Package['nfs-utils'],
+      nfs_shares_config    => '/etc/cinder/nfs_shares.conf',
+      nfs_snapshot_support => true,
+      manage_volume_type   => true,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/backend/solidfire.pp b/packstack/puppet/modules/packstack/manifests/cinder/backend/solidfire.pp
new file mode 100644
index 000000000..1027238a8
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/cinder/backend/solidfire.pp
@@ -0,0 +1,15 @@
+# Copyright (c) – 2016, Edward Balduf. All rights reserved.
+class packstack::cinder::backend::solidfire ()
+{
+    $solidfire_backend_name = 'solidfire'
+
+    cinder::backend::solidfire { $solidfire_backend_name :
+      san_ip              => lookup('CONFIG_CINDER_SOLIDFIRE_LOGIN'),
+      san_login           => lookup('CONFIG_CINDER_SOLIDFIRE_PASSWORD'),
+      san_password        => lookup('CONFIG_CINDER_SOLIDFIRE_HOSTNAME'),
+      volume_backend_name => $solidfire_backend_name,
+      manage_volume_type  => true,
+    }
+
+    ensure_packages(['iscsi-initiator-utils'], {'ensure' => 'present'})
+}
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/backup.pp b/packstack/puppet/modules/packstack/manifests/cinder/backup.pp
new file mode 100644
index 000000000..33aa143e2
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/cinder/backup.pp
@@ -0,0 +1,11 @@
+class packstack::cinder::backup ()
+{
+    class { 'cinder::backup': }
+
+    $cinder_backup_conf_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+
+    class { 'cinder::backup::swift':
+      backup_swift_url          => "http://${cinder_backup_conf_ctrl_host}:8080/v1/AUTH_",
+      backup_swift_service_auth => true
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/cinder/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/cinder/rabbitmq.pp
new file mode 100644
index 000000000..ddcdcf2f3
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/cinder/rabbitmq.pp
@@ -0,0 +1,46 @@
+class packstack::cinder::rabbitmq ()
+{
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_CINDER_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_CINDER_SSL_CERT', undef, undef, undef)
+
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
+        owner   => 'cinder',
+        group   => 'cinder',
+        require => Class['cinder'],
+      }
+      File[$files_to_set_owner] ~> Service<| tag == 'cinder-service' |>
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'cinder-service' |>
+
+    class { 'cinder::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'cinder::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'cinder',
+        'password' => lookup('CONFIG_CINDER_DB_PW'),
+        'database' => 'cinder',
+      })
+    }
+
+    class { 'cinder':
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
+      notification_driver   => 'messagingv2',
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/firewall.pp b/packstack/puppet/modules/packstack/manifests/firewall.pp
index 05429888f..b8e2847cc 100644
--- a/packstack/puppet/modules/packstack/manifests/firewall.pp
+++ b/packstack/puppet/modules/packstack/manifests/firewall.pp
@@ -2,22 +2,51 @@
 # hosts that need to connect via FIREWALL_PORTS
 # using FIREWALL_CHAIN
 
-define packstack::firewall($host, $service_name, $chain = "INPUT", $ports) {
+define packstack::firewall (
+  $host,
+  $service_name,
+  $chain = 'INPUT',
+  $ports = undef,
+  $proto = 'tcp'
+) {
+  $ip_version = lookup('CONFIG_IP_VERSION')
+
+  $protocol = $ip_version ? {
+    'ipv6'  => 'ip6tables',
+    default => 'iptables',
+    # TO-DO(mmagr): Add IPv6 support when hostnames are used
+  }
+
   $source = $host ? {
-    'ALL' => '0.0.0.0/0',
+    'ALL' => $ip_version ? {
+      'ipv6'  => '::/0',
+      default => '0.0.0.0/0'
+    },
     default => $host,
   }
+
   $heading = $chain ? {
     'OUTPUT' => 'outgoing',
     default => 'incoming',
   }
 
-  firewall { "001 ${service_name} ${heading} ${title}":
-    chain => $chain,
-    proto  => ['tcp', 'udp'],
-    dport  => $ports,
-    action => 'accept',
-    source => $source,
+  if $ports == undef {
+    firewall { "001 ${service_name} ${heading} ${title}":
+      chain    => $chain,
+      proto    => $proto,
+      jump     => 'accept',
+      source   => $source,
+      protocol => $protocol,
+    }
+  }
+  else {
+    firewall { "001 ${service_name} ${heading} ${title}":
+      chain    => $chain,
+      proto    => $proto,
+      dport    => $ports,
+      jump     => 'accept',
+      source   => $source,
+      protocol => $protocol,
+    }
   }
 }
-
diff --git a/packstack/puppet/modules/packstack/manifests/glance.pp b/packstack/puppet/modules/packstack/manifests/glance.pp
new file mode 100644
index 000000000..2f614da9e
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/glance.pp
@@ -0,0 +1,48 @@
+class packstack::glance ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_GLANCE_RULES', undef, undef, {}))
+
+    # glance option bind_host requires address without brackets
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    $default_store = lookup('CONFIG_GLANCE_BACKEND') ? {
+      'swift' => 'swift',
+      default => 'file',
+    }
+
+    class { 'glance::api::authtoken':
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      password             => lookup('CONFIG_GLANCE_KS_PW'),
+    }
+
+    class { 'glance::api::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'glance::api::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'glance',
+        'password' => lookup('CONFIG_GLANCE_DB_PW'),
+        'database' => 'glance',
+      })
+    }
+
+    class { 'glance::api':
+      service_name     => 'httpd',
+      enabled_backends => ["${default_store}:${default_store}", "http:http"],
+      default_backend  => $default_store,
+    }
+    class { 'glance::wsgi::apache':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    glance::backend::multistore::http { 'http': }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/glance/backend/file.pp b/packstack/puppet/modules/packstack/manifests/glance/backend/file.pp
new file mode 100644
index 000000000..59d8661ae
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/glance/backend/file.pp
@@ -0,0 +1,6 @@
+class packstack::glance::backend::file ()
+{
+    glance::backend::multistore::file { 'file':
+      filesystem_store_datadir => '/var/lib/glance/images/',
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/glance/backend/swift.pp b/packstack/puppet/modules/packstack/manifests/glance/backend/swift.pp
new file mode 100644
index 000000000..f8c7b4629
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/glance/backend/swift.pp
@@ -0,0 +1,19 @@
+class packstack::glance::backend::swift ()
+{
+    Service<| tag == 'swift-service' |> -> Service['glance-api']
+
+    $swift_auth_version = lookup('CONFIG_KEYSTONE_API_VERSION') ? {
+      'v2.0'  => '2',
+      default => '3',
+    }
+
+    glance::backend::multistore::swift { 'swift':
+      swift_store_user                    => 'services:glance',
+      swift_store_key                     => lookup('CONFIG_GLANCE_KS_PW'),
+      swift_store_auth_address            => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
+      swift_store_container               => 'glance',
+      swift_store_auth_version            => $swift_auth_version,
+      swift_store_large_object_size       => '5120',
+      swift_store_create_container_on_put => true,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/glance/ceilometer.pp b/packstack/puppet/modules/packstack/manifests/glance/ceilometer.pp
new file mode 100644
index 000000000..5ee6b36c1
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/glance/ceilometer.pp
@@ -0,0 +1,33 @@
+class packstack::glance::ceilometer ()
+{
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_GLANCE_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_GLANCE_SSL_CERT', undef, undef, undef)
+
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
+        owner   => 'glance',
+        group   => 'glance',
+        require => Class['::glance::notify::rabbitmq'],
+        notify  => Service['glance-api'],
+      }
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service['glance-api']
+
+    class { 'glance::notify::rabbitmq':
+      rabbit_notification_topic => 'notifications',
+      rabbit_use_ssl            => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url     => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      kombu_ssl_ca_certs        => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile         => $kombu_ssl_keyfile,
+      kombu_ssl_certfile        => $kombu_ssl_certfile,
+      notification_driver       => 'messagingv2',
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/gnocchi.pp b/packstack/puppet/modules/packstack/manifests/gnocchi.pp
new file mode 100644
index 000000000..c3cd179af
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/gnocchi.pp
@@ -0,0 +1,60 @@
+class packstack::gnocchi ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_GNOCCHI_RULES', undef, undef, {}))
+
+    $config_gnocchi_coordination_backend = lookup('CONFIG_CEILOMETER_COORDINATION_BACKEND')
+
+    if $config_gnocchi_coordination_backend == 'redis' {
+      $coordination_url = os_url({
+        'scheme' => 'redis',
+        'host'   => lookup('CONFIG_REDIS_HOST_URL'),
+        'port'   => lookup('CONFIG_REDIS_PORT'),
+      })
+      Service<| title == 'redis' |> -> Anchor['gnocchi::service::begin']
+    } else {
+      $coordination_url = uhdef
+    }
+
+    class { 'gnocchi::wsgi::apache':
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
+      ssl     => false
+    }
+
+    class { 'gnocchi':
+      coordination_url => $coordination_url,
+    }
+
+    class { 'gnocchi::keystone::authtoken':
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      password             => lookup('CONFIG_GNOCCHI_KS_PW')
+    }
+
+    class { 'gnocchi::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'gnocchi',
+        'password' => lookup('CONFIG_GNOCCHI_DB_PW'),
+        'database' => 'gnocchi',
+        'charset'  => 'utf8',
+      })
+    }
+
+    class { 'gnocchi::api':
+      service_name => 'httpd',
+      sync_db      => true,
+    }
+
+    class { 'gnocchi::storage': }
+    class { 'gnocchi::storage::file': }
+
+    class { 'gnocchi::metricd': }
+
+    class { 'gnocchi::statsd':
+      resource_id         => '5e3fcbe2-7aab-475d-b42c-a440aa42e5ad',
+      archive_policy_name => 'high',
+    }
+
+    include gnocchi::client
+}
diff --git a/packstack/puppet/modules/packstack/manifests/heat.pp b/packstack/puppet/modules/packstack/manifests/heat.pp
new file mode 100644
index 000000000..f395e08e7
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/heat.pp
@@ -0,0 +1,44 @@
+class packstack::heat ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_HEAT_RULES', undef, undef, {}))
+
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+    }
+
+    class { 'heat::api':
+      service_name => 'httpd',
+    }
+    class { 'heat::wsgi::apache_api':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    $memcache_servers = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => ['[::1]:11211'],
+      default => ['127.0.0.1:11211'],
+    }
+    class {'heat::cache':
+      enabled          => true,
+      backend          => 'dogpile.cache.pymemcache',
+      memcache_servers => $memcache_servers,
+    }
+    include packstack::memcached
+    Class['memcached'] -> Anchor['heat::service::begin']
+
+    $heat_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+
+    class { 'heat::engine':
+      heat_metadata_server_url      => "http://${heat_cfg_ctrl_host}:8000",
+      heat_waitcondition_server_url => "http://${heat_cfg_ctrl_host}:8000/v1/waitcondition",
+      auth_encryption_key           => lookup('CONFIG_HEAT_AUTH_ENC_KEY'),
+      num_engine_workers            => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    class { 'heat::keystone::domain':
+      domain_name     => lookup('CONFIG_HEAT_DOMAIN'),
+      domain_admin    => lookup('CONFIG_HEAT_DOMAIN_ADMIN'),
+      domain_password => lookup('CONFIG_HEAT_DOMAIN_PASSWORD'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/heat/cfn.pp b/packstack/puppet/modules/packstack/manifests/heat/cfn.pp
new file mode 100644
index 000000000..94608220f
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/heat/cfn.pp
@@ -0,0 +1,26 @@
+class packstack::heat::cfn ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_HEAT_CFN_RULES', undef, undef, {}))
+
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+    }
+
+    class { 'heat::api_cfn':
+      service_name => 'httpd',
+    }
+    class { 'heat::wsgi::apache_api_cfn':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    $heat_cfn_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+
+    class { 'heat::keystone::auth_cfn':
+      admin_url    => "http://${heat_cfn_cfg_ctrl_host}:8000/v1",
+      public_url   => "http://${heat_cfn_cfg_ctrl_host}:8000/v1",
+      internal_url => "http://${heat_cfn_cfg_ctrl_host}:8000/v1",
+      password     => lookup('CONFIG_HEAT_KS_PW'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/heat/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/heat/rabbitmq.pp
new file mode 100644
index 000000000..80a025c20
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/heat/rabbitmq.pp
@@ -0,0 +1,63 @@
+class packstack::heat::rabbitmq ()
+{
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_HEAT_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_HEAT_SSL_CERT', undef, undef, undef)
+
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
+        owner   => 'heat',
+        group   => 'heat',
+        require => Package['heat-common'],
+      }
+      File[$files_to_set_owner] ~> Service<| tag == 'heat-service' |>
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'heat-service' |>
+
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+      $heat_notification_driver = 'messagingv2'
+    } else {
+      $heat_notification_driver = $facts['os_service_default']
+    }
+
+    class { 'heat::trustee':
+      password => lookup('CONFIG_HEAT_KS_PW'),
+      auth_url => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
+    class { 'heat::keystone::authtoken':
+      password             => lookup('CONFIG_HEAT_KS_PW'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
+
+    class { 'heat::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'heat::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'heat',
+        'password' => lookup('CONFIG_HEAT_DB_PW'),
+        'database' => 'heat',
+      })
+    }
+
+    class { 'heat':
+      keystone_ec2_uri      => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
+      notification_driver   => $heat_notification_driver,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/horizon.pp b/packstack/puppet/modules/packstack/manifests/horizon.pp
new file mode 100644
index 000000000..bd9617b37
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/horizon.pp
@@ -0,0 +1,81 @@
+class packstack::horizon ()
+{
+    $log_level = lookup('CONFIG_DEBUG_MODE') ? {
+      true    => 'DEBUG',
+      default => 'INFO',
+    }
+
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    $horizon_ssl = lookup('CONFIG_HORIZON_SSL') ? {
+      'y'     => true,
+      default => false,
+    }
+
+    include packstack::memcached
+    $cache_server_ip = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::1',
+      default => '127.0.0.1',
+    }
+
+    class { 'horizon':
+      secret_key            => lookup('CONFIG_HORIZON_SECRET_KEY'),
+      keystone_url          => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
+      server_aliases        => [lookup('CONFIG_CONTROLLER_HOST'), $facts['networking']['fqdn'], 'localhost'],
+      allowed_hosts         => '*',
+      django_session_engine => 'django.contrib.sessions.backends.cache',
+      cache_backend         => 'django.core.cache.backends.memcached.PyMemcacheCache',
+      cache_server_ip       => $cache_server_ip,
+      cache_server_port     => '11211',
+      file_upload_temp_dir  => '/var/tmp',
+      listen_ssl            => $horizon_ssl,
+      ssl_cert              => lookup('CONFIG_HORIZON_SSL_CERT', undef, undef, undef),
+      ssl_key               => lookup('CONFIG_HORIZON_SSL_KEY', undef, undef, undef),
+      ssl_ca                => lookup('CONFIG_HORIZON_SSL_CACERT', undef, undef, undef),
+      ssl_verify_client     => 'optional',
+      log_level             => $log_level,
+      django_log_level      => 'INFO',
+      neutron_options       => {
+        'enable_vpn' => lookup('CONFIG_HORIZON_NEUTRON_VPN'),
+      },
+    }
+
+    if lookup('CONFIG_MAGNUM_INSTALL') == 'y' {
+      horizon::dashboard { 'magnum': }
+    }
+
+    if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
+      include horizon::dashboards::ironic
+    }
+
+    if lookup('CONFIG_TROVE_INSTALL') == 'y' {
+      horizon::dashboard { 'trove': }
+    }
+
+    if lookup('CONFIG_HEAT_INSTALL') == 'y' {
+      include horizon::dashboards::heat
+    }
+
+    if lookup('CONFIG_MANILA_INSTALL') == 'y' {
+      include horizon::dashboards::manila
+    }
+
+    $firewall_port = lookup('CONFIG_HORIZON_PORT')
+
+    firewall { "001 horizon ${firewall_port} incoming":
+      proto  => 'tcp',
+      dport  => [$firewall_port],
+      jump   => 'accept',
+    }
+
+    if str2bool($facts['os']['selinux']['enabled']) {
+      selboolean{ 'httpd_can_network_connect':
+        value      => on,
+        persistent => true,
+      }
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/ironic.pp b/packstack/puppet/modules/packstack/manifests/ironic.pp
new file mode 100644
index 000000000..49af33165
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/ironic.pp
@@ -0,0 +1,16 @@
+class packstack::ironic ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_IRONIC_API_RULES', undef, undef, {}))
+
+    class { 'ironic::api::authtoken':
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      password             => lookup('CONFIG_IRONIC_KS_PW'),
+    }
+
+    class { 'ironic::api': }
+
+    class { 'ironic::client': }
+
+    class { 'ironic::conductor': }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/ironic/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/ironic/rabbitmq.pp
new file mode 100644
index 000000000..beaa8b29a
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/ironic/rabbitmq.pp
@@ -0,0 +1,45 @@
+class packstack::ironic::rabbitmq ()
+{
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_IRONIC_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_IRONIC_SSL_CERT', undef, undef, undef)
+
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
+        owner   => 'ironic',
+        group   => 'ironic',
+        require => Package['ironic-common'],
+      }
+      File[$files_to_set_owner] ~> Service<| tag == 'ironic-service' |>
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'ironic-service' |>
+
+    class { 'ironic::logging':
+      debug => true,
+    }
+
+    class { 'ironic::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'ironic',
+        'password' => lookup('CONFIG_IRONIC_DB_PW'),
+        'database' => 'ironic',
+      })
+    }
+
+    class { 'ironic':
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone.pp b/packstack/puppet/modules/packstack/manifests/keystone.pp
new file mode 100644
index 000000000..c997c8e13
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone.pp
@@ -0,0 +1,124 @@
+class packstack::keystone ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_KEYSTONE_RULES', undef, undef, {}))
+
+    $keystone_token_provider_str = downcase(lookup('CONFIG_KEYSTONE_TOKEN_FORMAT'))
+    $keystone_url = regsubst(regsubst(lookup('CONFIG_KEYSTONE_PUBLIC_URL'),'/v2.0',''),'/v3','')
+    $keystone_admin_url = lookup('CONFIG_KEYSTONE_ADMIN_URL')
+
+    if lookup('CONFIG_KEYSTONE_FERNET_TOKEN_ROTATE_ENABLE', undef, undef, false) {
+      class { 'keystone::cron::fernet_rotate':
+        require     => Service['crond'],
+      }
+      package { 'cronie':
+        ensure => 'installed',
+        name   => 'cronie',
+      }
+      service { 'crond':
+        ensure  => 'running',
+        enable  => true,
+        require => Package['cronie'],
+      }
+    }
+
+    class { 'keystone::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'keystone::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'keystone_admin',
+        'password' => lookup('CONFIG_KEYSTONE_DB_PW'),
+        'database' => 'keystone',
+      })
+    }
+
+    class { 'keystone':
+      token_provider      => $keystone_token_provider_str,
+      enable_fernet_setup => true,
+      service_name        => 'httpd',
+      default_domain      => 'Default',
+    }
+
+    class { 'keystone::wsgi::apache':
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    class { 'keystone::bootstrap':
+      password     => lookup('CONFIG_KEYSTONE_ADMIN_PW'),
+      username     => lookup('CONFIG_KEYSTONE_ADMIN_USERNAME'),
+      email        => lookup('CONFIG_KEYSTONE_ADMIN_EMAIL'),
+      project_name => 'admin',
+      role_name    => 'admin',
+      admin_url    => $keystone_admin_url,
+      public_url   => $keystone_url,
+      internal_url => $keystone_url,
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+    }
+
+    $memcache_servers = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => ['[::1]:11211'],
+      default => ['127.0.0.1:11211'],
+    }
+    class { 'keystone::cache':
+      enabled          => true,
+      backend          => 'dogpile.cache.pymemcache',
+      memcache_servers => $memcache_servers,
+    }
+    include packstack::memcached
+    Class['memcached'] -> Anchor['keystone::dbsync::begin']
+
+    # default assignment driver is SQL
+    $assignment_driver = 'keystone.assignment.backends.sql.Assignment'
+
+    if lookup('CONFIG_KEYSTONE_IDENTITY_BACKEND') == 'ldap' {
+
+      if lookup('CONFIG_KEYSTONE_LDAP_USER_ENABLED_EMULATION_DN', undef, undef, undef) {
+        $user_enabled_emulation = true
+      } else {
+        $user_enabled_emulation = false
+      }
+
+      class { 'keystone::ldap':
+        url                                => lookup('CONFIG_KEYSTONE_LDAP_URL', undef, undef, undef),
+        user                               => lookup('CONFIG_KEYSTONE_LDAP_USER_DN', undef, undef, undef),
+        password                           => lookup('CONFIG_KEYSTONE_LDAP_USER_PASSWORD', undef, undef, undef),
+        suffix                             => lookup('CONFIG_KEYSTONE_LDAP_SUFFIX', undef, undef, undef),
+        query_scope                        => lookup('CONFIG_KEYSTONE_LDAP_QUERY_SCOPE', undef, undef, undef),
+        page_size                          => lookup('CONFIG_KEYSTONE_LDAP_PAGE_SIZE', undef, undef, undef),
+        user_tree_dn                       => lookup('CONFIG_KEYSTONE_LDAP_USER_SUBTREE', undef, undef, undef),
+        user_filter                        => lookup('CONFIG_KEYSTONE_LDAP_USER_FILTER', undef, undef, undef),
+        user_objectclass                   => lookup('CONFIG_KEYSTONE_LDAP_USER_OBJECTCLASS', undef, undef, undef),
+        user_id_attribute                  => lookup('CONFIG_KEYSTONE_LDAP_USER_ID_ATTRIBUTE', undef, undef, undef),
+        user_name_attribute                => lookup('CONFIG_KEYSTONE_LDAP_USER_NAME_ATTRIBUTE', undef, undef, undef),
+        user_mail_attribute                => lookup('CONFIG_KEYSTONE_LDAP_USER_MAIL_ATTRIBUTE', undef, undef, undef),
+        user_enabled_attribute             => lookup('CONFIG_KEYSTONE_LDAP_USER_ENABLED_ATTRIBUTE', undef, undef, undef),
+        user_enabled_mask                  => lookup('CONFIG_KEYSTONE_LDAP_USER_ENABLED_MASK', undef, undef, undef),
+        user_enabled_default               => lookup('CONFIG_KEYSTONE_LDAP_USER_ENABLED_DEFAULT', undef, undef, undef),
+        user_enabled_invert                => lookup('CONFIG_KEYSTONE_LDAP_USER_ENABLED_INVERT', undef, undef, undef),
+        user_attribute_ignore              => lookup('CONFIG_KEYSTONE_LDAP_USER_ATTRIBUTE_IGNORE', undef, undef, undef),
+        user_default_project_id_attribute  => lookup('CONFIG_KEYSTONE_LDAP_USER_DEFAULT_PROJECT_ID_ATTRIBUTE', undef, undef, undef),
+        user_pass_attribute                => lookup('CONFIG_KEYSTONE_LDAP_USER_PASS_ATTRIBUTE', undef, undef, undef),
+        user_enabled_emulation             => $user_enabled_emulation,
+        user_enabled_emulation_dn          => lookup('CONFIG_KEYSTONE_LDAP_USER_ENABLED_EMULATION_DN', undef, undef, undef),
+        user_additional_attribute_mapping  => lookup('CONFIG_KEYSTONE_LDAP_USER_ADDITIONAL_ATTRIBUTE_MAPPING', undef, undef, undef),
+        group_tree_dn                      => lookup('CONFIG_KEYSTONE_LDAP_GROUP_SUBTREE', undef, undef, undef),
+        group_filter                       => lookup('CONFIG_KEYSTONE_LDAP_GROUP_FILTER', undef, undef, undef),
+        group_objectclass                  => lookup('CONFIG_KEYSTONE_LDAP_GROUP_OBJECTCLASS', undef, undef, undef),
+        group_id_attribute                 => lookup('CONFIG_KEYSTONE_LDAP_GROUP_ID_ATTRIBUTE', undef, undef, undef),
+        group_name_attribute               => lookup('CONFIG_KEYSTONE_LDAP_GROUP_NAME_ATTRIBUTE', undef, undef, undef),
+        group_member_attribute             => lookup('CONFIG_KEYSTONE_LDAP_GROUP_MEMBER_ATTRIBUTE', undef, undef, undef),
+        group_desc_attribute               => lookup('CONFIG_KEYSTONE_LDAP_GROUP_DESC_ATTRIBUTE', undef, undef, undef),
+        group_attribute_ignore             => lookup('CONFIG_KEYSTONE_LDAP_GROUP_ATTRIBUTE_IGNORE', undef, undef, undef),
+        group_additional_attribute_mapping => lookup('CONFIG_KEYSTONE_LDAP_GROUP_ADDITIONAL_ATTRIBUTE_MAPPING', undef, undef, undef),
+        use_tls                            => lookup('CONFIG_KEYSTONE_LDAP_USE_TLS', undef, undef, undef),
+        tls_cacertdir                      => lookup('CONFIG_KEYSTONE_LDAP_TLS_CACERTDIR', undef, undef, undef),
+        tls_cacertfile                     => lookup('CONFIG_KEYSTONE_LDAP_TLS_CACERTFILE', undef, undef, undef),
+        tls_req_cert                       => lookup('CONFIG_KEYSTONE_LDAP_TLS_REQ_CERT', undef, undef, undef),
+        identity_driver                    => 'keystone.identity.backends.ldap.Identity',
+        assignment_driver                  => $assignment_driver,
+      }
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/aodh.pp b/packstack/puppet/modules/packstack/manifests/keystone/aodh.pp
new file mode 100644
index 000000000..67f4bab75
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/aodh.pp
@@ -0,0 +1,12 @@
+class packstack::keystone::aodh ()
+{
+    $keystone_host_url = lookup('CONFIG_KEYSTONE_HOST_URL')
+
+    class { 'aodh::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_AODH_KS_PW'),
+      public_url   => "http://${keystone_host_url}:8042",
+      admin_url    => "http://${keystone_host_url}:8042",
+      internal_url => "http://${keystone_host_url}:8042",
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/ceilometer.pp b/packstack/puppet/modules/packstack/manifests/keystone/ceilometer.pp
new file mode 100644
index 000000000..40724873c
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/ceilometer.pp
@@ -0,0 +1,7 @@
+class packstack::keystone::ceilometer ()
+{
+    class { 'ceilometer::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_CEILOMETER_KS_PW'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/cinder.pp b/packstack/puppet/modules/packstack/manifests/keystone/cinder.pp
new file mode 100644
index 000000000..ff4170292
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/cinder.pp
@@ -0,0 +1,16 @@
+class packstack::keystone::cinder ()
+{
+    $cinder_protocol = 'http'
+    $cinder_host = lookup('CONFIG_STORAGE_HOST_URL')
+    $cinder_port = '8776'
+    $cinder_url = "${cinder_protocol}://${cinder_host}:${cinder_port}"
+
+    class { 'cinder::keystone::auth':
+      region          => lookup('CONFIG_KEYSTONE_REGION'),
+      password        => lookup('CONFIG_CINDER_KS_PW'),
+      roles           => ['admin', 'service'],
+      public_url_v3   => "${cinder_url}/v3",
+      internal_url_v3 => "${cinder_url}/v3",
+      admin_url_v3    => "${cinder_url}/v3",
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/glance.pp b/packstack/puppet/modules/packstack/manifests/keystone/glance.pp
new file mode 100644
index 000000000..84eb8a59d
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/glance.pp
@@ -0,0 +1,15 @@
+class packstack::keystone::glance ()
+{
+    $glance_protocol = 'http'
+    $glance_port = '9292'
+    $glance_api_host = lookup('CONFIG_STORAGE_HOST_URL')
+    $glance_url = "${glance_protocol}://${glance_api_host}:${glance_port}"
+
+    class { 'glance::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_GLANCE_KS_PW'),
+      public_url   => $glance_url,
+      admin_url    => $glance_url,
+      internal_url => $glance_url,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/gnocchi.pp b/packstack/puppet/modules/packstack/manifests/keystone/gnocchi.pp
new file mode 100644
index 000000000..65be0f049
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/gnocchi.pp
@@ -0,0 +1,12 @@
+class packstack::keystone::gnocchi ()
+{
+    $gnocchi_keystone_host_url = lookup('CONFIG_KEYSTONE_HOST_URL')
+
+    class { 'gnocchi::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_GNOCCHI_KS_PW'),
+      public_url   => "http://${gnocchi_keystone_host_url}:8041",
+      admin_url    => "http://${gnocchi_keystone_host_url}:8041",
+      internal_url => "http://${gnocchi_keystone_host_url}:8041",
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/heat.pp b/packstack/puppet/modules/packstack/manifests/keystone/heat.pp
new file mode 100644
index 000000000..75cb9c3f3
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/heat.pp
@@ -0,0 +1,17 @@
+class packstack::keystone::heat ()
+{
+    $heat_protocol = 'http'
+    $heat_port = '8004'
+    $heat_api_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+    $heat_url = "${heat_protocol}://${heat_api_host}:${heat_port}/v1/%(tenant_id)s"
+
+    # heat::keystone::auth
+    class { 'heat::keystone::auth':
+      region                    => lookup('CONFIG_KEYSTONE_REGION'),
+      password                  => lookup('CONFIG_HEAT_KS_PW'),
+      public_url                => $heat_url,
+      admin_url                 => $heat_url,
+      internal_url              => $heat_url,
+      configure_delegated_roles => true,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/ironic.pp b/packstack/puppet/modules/packstack/manifests/keystone/ironic.pp
new file mode 100644
index 000000000..e90de995e
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/ironic.pp
@@ -0,0 +1,15 @@
+class packstack::keystone::ironic ()
+{
+    $ironic_protocol = 'http'
+    $ironic_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+    $ironic_port = '6385'
+    $ironic_url = "${ironic_protocol}://${ironic_host}:${ironic_port}"
+
+    class { 'ironic::keystone::auth':
+        region       => lookup('CONFIG_KEYSTONE_REGION'),
+        password     => lookup('CONFIG_IRONIC_KS_PW'),
+        public_url   => $ironic_url,
+        admin_url    => $ironic_url,
+        internal_url => $ironic_url,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/magnum.pp b/packstack/puppet/modules/packstack/manifests/keystone/magnum.pp
new file mode 100644
index 000000000..d503ce13b
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/magnum.pp
@@ -0,0 +1,19 @@
+class packstack::keystone::magnum ()
+{
+    $magnum_protocol = 'http'
+    $magnum_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+    $magnum_port = '9511'
+    $magnum_url = "${magnum_protocol}://${magnum_host}:${magnum_port}/v1"
+
+    class { 'magnum::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_MAGNUM_KS_PW'),
+      public_url   => $magnum_url,
+      admin_url    => $magnum_url,
+      internal_url => $magnum_url
+    }
+
+    class { 'magnum::keystone::domain':
+      domain_password => lookup('CONFIG_MAGNUM_KS_PW'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/manila.pp b/packstack/puppet/modules/packstack/manifests/keystone/manila.pp
new file mode 100644
index 000000000..334e5125e
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/manila.pp
@@ -0,0 +1,18 @@
+class packstack::keystone::manila ()
+{
+    $manila_protocol = 'http'
+    $manila_host = lookup('CONFIG_STORAGE_HOST_URL')
+    $manila_port = '8786'
+    $manila_url = "${manila_protocol}://${manila_host}:${manila_port}/v1/%(tenant_id)s"
+    $manila_url_v2 = "${manila_protocol}://${manila_host}:${manila_port}/v2/"
+
+    class { 'manila::keystone::auth':
+      password        => lookup('CONFIG_MANILA_KS_PW'),
+      public_url      => $manila_url,
+      admin_url       => $manila_url,
+      internal_url    => $manila_url,
+      public_url_v2   => $manila_url_v2,
+      admin_url_v2    => $manila_url_v2,
+      internal_url_v2 => $manila_url_v2,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/neutron.pp b/packstack/puppet/modules/packstack/manifests/keystone/neutron.pp
new file mode 100644
index 000000000..2fbc68e1f
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/neutron.pp
@@ -0,0 +1,15 @@
+class packstack::keystone::neutron ()
+{
+    $neutron_protocol = 'http'
+    $neutron_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+    $neutron_port = '9696'
+    $neutron_url = "${neutron_protocol}://${neutron_host}:${neutron_port}"
+
+    class { 'neutron::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_NEUTRON_KS_PW'),
+      public_url   => $neutron_url,
+      admin_url    => $neutron_url,
+      internal_url => $neutron_url,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/nova.pp b/packstack/puppet/modules/packstack/manifests/keystone/nova.pp
new file mode 100644
index 000000000..48f53d9a5
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/nova.pp
@@ -0,0 +1,17 @@
+class packstack::keystone::nova ()
+{
+    $nova_protocol = 'http'
+    $nova_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+    $nova_port = '8774'
+    $nova_url = "${nova_protocol}://${nova_host}:${nova_port}/v2.1"
+
+
+    class { 'nova::keystone::auth':
+      roles        => ['admin', 'service'],
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_NOVA_KS_PW'),
+      public_url   => $nova_url,
+      admin_url    => $nova_url,
+      internal_url => $nova_url,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/placement.pp b/packstack/puppet/modules/packstack/manifests/keystone/placement.pp
new file mode 100644
index 000000000..06f1a30df
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/placement.pp
@@ -0,0 +1,20 @@
+class packstack::keystone::placement ()
+{
+    $placement_protocol = 'http'
+    $placement_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+    $placement_port = '8778'
+    $placement_url = "${placement_protocol}://${placement_host}:${placement_port}"
+
+    class { 'placement::keystone::authtoken':
+      password             => lookup('CONFIG_NOVA_KS_PW'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+    }
+
+    class { 'placement::keystone::auth':
+      public_url   => $placement_url,
+      internal_url => $placement_url,
+      admin_url    => $placement_url,
+      password     => lookup('CONFIG_NOVA_KS_PW'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/swift.pp b/packstack/puppet/modules/packstack/manifests/keystone/swift.pp
new file mode 100644
index 000000000..550a74955
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/swift.pp
@@ -0,0 +1,17 @@
+class packstack::keystone::swift ()
+{
+    $swift_protocol = 'http'
+    $swift_host = lookup('CONFIG_STORAGE_HOST_URL')
+    $swift_port = '8080'
+    $swift_url = "${swift_protocol}://${swift_host}:${swift_port}/v1/AUTH_%(tenant_id)s"
+
+    class { 'swift::keystone::auth':
+      region                => lookup('CONFIG_KEYSTONE_REGION'),
+      password              => lookup('CONFIG_SWIFT_KS_PW'),
+      operator_roles        => ['admin', 'SwiftOperator', 'ResellerAdmin'],
+      public_url            => $swift_url,
+      internal_url          => $swift_url,
+      admin_url             => $swift_url,
+      configure_s3_endpoint => false,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/keystone/trove.pp b/packstack/puppet/modules/packstack/manifests/keystone/trove.pp
new file mode 100644
index 000000000..b6ef5aa22
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/keystone/trove.pp
@@ -0,0 +1,15 @@
+class packstack::keystone::trove ()
+{
+    $trove_protocol = 'http'
+    $trove_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+    $trove_port = '8779'
+    $trove_url = "${trove_protocol}://${trove_host}:${trove_port}/v1.0/%(tenant_id)s"
+
+    class { 'trove::keystone::auth':
+      region       => lookup('CONFIG_KEYSTONE_REGION'),
+      password     => lookup('CONFIG_TROVE_KS_PW'),
+      public_url   => $trove_url,
+      admin_url    => $trove_url,
+      internal_url => $trove_url,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/magnum.pp b/packstack/puppet/modules/packstack/manifests/magnum.pp
new file mode 100644
index 000000000..862840943
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/magnum.pp
@@ -0,0 +1,58 @@
+class packstack::magnum ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_MAGNUM_API_RULES', undef, undef, {}))
+
+    class { 'magnum::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'magnum',
+        'password' => lookup('CONFIG_MAGNUM_DB_PW'),
+        'database' => 'magnum',
+      })
+    }
+
+    $magnum_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+    class { 'magnum::keystone::authtoken':
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      password             => lookup('CONFIG_MAGNUM_KS_PW'),
+    }
+
+    class { 'magnum::keystone::keystone_auth':
+      username            => 'magnum',
+      password            => lookup('CONFIG_MAGNUM_KS_PW'),
+      auth_url            => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      project_name        => 'services',
+      user_domain_name    => 'Default',
+      project_domain_name => 'Default',
+    }
+
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    class { 'magnum::api':
+      service_name => 'httpd',
+    }
+    class { 'magnum::wsgi::apache':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    class { 'magnum::conductor':
+    }
+
+    class { 'magnum::client':
+    }
+
+    class { 'magnum::clients':
+      region_name => lookup('CONFIG_KEYSTONE_REGION')
+    }
+
+    class { 'magnum::certificates':
+      cert_manager_type => 'local'
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/magnum/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/magnum/rabbitmq.pp
new file mode 100644
index 000000000..4f2d867d3
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/magnum/rabbitmq.pp
@@ -0,0 +1,32 @@
+class packstack::magnum::rabbitmq ()
+{
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_MAGNUM_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_MAGNUM_SSL_CERT', undef, undef, undef)
+
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
+        owner   => 'magnum',
+        group   => 'magnum',
+        require => Package['magnum-common'],
+      }
+      File[$files_to_set_owner] ~> Service<| tag == 'magnum-service' |>
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'magnum-service' |>
+
+    class { 'magnum':
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
+      notification_driver   => 'messagingv2'
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/manila.pp b/packstack/puppet/modules/packstack/manifests/manila.pp
new file mode 100644
index 000000000..68bd03e12
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/manila.pp
@@ -0,0 +1,34 @@
+class packstack::manila ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_MANILA_API_RULES', undef, undef, {}))
+
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    class { 'manila::keystone::authtoken':
+      password             => lookup('CONFIG_MANILA_KS_PW'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
+
+    class { 'manila::api':
+      service_name => 'httpd',
+    }
+    class { 'manila::wsgi::apache':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    class { 'manila::scheduler':
+    }
+
+    class { 'manila::share':
+    }
+
+    class { 'manila::backends':
+      enabled_share_backends => lookup('CONFIG_MANILA_BACKEND'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/manila/backend/generic.pp b/packstack/puppet/modules/packstack/manifests/manila/backend/generic.pp
new file mode 100644
index 000000000..1cf617050
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/manila/backend/generic.pp
@@ -0,0 +1,43 @@
+class packstack::manila::backend::generic ()
+{
+    ensure_packages(['nfs-utils'], {'ensure' => 'present'})
+
+    manila::backend::generic{ 'generic':
+      driver_handles_share_servers => lookup('CONFIG_MANILA_GENERIC_DRV_HANDLES_SHARE_SERVERS'),
+      volume_name_template         => lookup('CONFIG_MANILA_GENERIC_VOLUME_NAME_TEMPLATE'),
+      share_mount_path             => lookup('CONFIG_MANILA_GENERIC_SHARE_MOUNT_PATH'),
+    }
+
+    packstack::manila::network{ 'generic': }
+
+    $admin_username = lookup('CONFIG_KEYSTONE_ADMIN_USERNAME')
+    $admin_password = lookup('CONFIG_KEYSTONE_ADMIN_PW')
+    $admin_tenant   = 'admin'
+    $keystone_url   = lookup('CONFIG_KEYSTONE_PUBLIC_URL')
+
+    nova_flavor { 'm1.manila':
+      ensure => present,
+      id     => '66',
+      ram    => '512',
+      disk   => '1',
+      vcpus  => '1',
+    }
+    manila::backend::service_instance{ 'generic':
+      service_image_location     => lookup('CONFIG_MANILA_SERVICE_IMAGE_LOCATION'),
+      service_instance_user      => lookup('CONFIG_MANILA_SERVICE_INSTANCE_USER'),
+      service_instance_password  => lookup('CONFIG_MANILA_SERVICE_INSTANCE_PASSWORD'),
+      service_instance_flavor_id => 66,
+    }
+
+    class { 'manila::compute::nova':
+      auth_type => 'password',
+      auth_url  => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      password  => lookup('CONFIG_NOVA_KS_PW'),
+    }
+
+    class { 'manila::volume::cinder':
+      auth_type => 'password',
+      auth_url  => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      password  => lookup('CONFIG_CINDER_KS_PW'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/manila/backend/glusternative.pp b/packstack/puppet/modules/packstack/manifests/manila/backend/glusternative.pp
new file mode 100644
index 000000000..3aba5bba5
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/manila/backend/glusternative.pp
@@ -0,0 +1,10 @@
+class packstack::manila::backend::glusternative ()
+{
+    manila::backend::glusternative{ 'glusternative':
+      glusterfs_servers                    => lookup('CONFIG_MANILA_GLUSTERFS_SERVERS'),
+      glusterfs_path_to_private_key        => lookup('CONFIG_MANILA_GLUSTERFS_NATIVE_PATH_TO_PRIVATE_KEY'),
+      glusterfs_volume_pattern             => lookup('CONFIG_MANILA_GLUSTERFS_VOLUME_PATTERN'),
+    }
+
+    packstack::manila::network{ 'glusternative': }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/manila/backend/glusternfs.pp b/packstack/puppet/modules/packstack/manifests/manila/backend/glusternfs.pp
new file mode 100644
index 000000000..5ff6223d7
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/manila/backend/glusternfs.pp
@@ -0,0 +1,14 @@
+class packstack::manila::backend::glusternfs ()
+{
+    manila::backend::glusternfs{ 'glusternfs':
+      glusterfs_target              => lookup('CONFIG_MANILA_GLUSTERFS_TARGET'),
+      glusterfs_mount_point_base    => lookup('CONFIG_MANILA_GLUSTERFS_MOUNT_POINT_BASE'),
+      glusterfs_nfs_server_type     => lookup('CONFIG_MANILA_GLUSTERFS_NFS_SERVER_TYPE'),
+      glusterfs_path_to_private_key => lookup('CONFIG_MANILA_GLUSTERFS_PATH_TO_PRIVATE_KEY'),
+      glusterfs_ganesha_server_ip   => lookup('CONFIG_MANILA_GLUSTERFS_GANESHA_SERVER_IP'),
+    }
+
+    packstack::manila::network{ 'glusternfs': }
+
+    include  '::manila::ganesha'
+}
diff --git a/packstack/puppet/modules/packstack/manifests/manila/backend/netapp.pp b/packstack/puppet/modules/packstack/manifests/manila/backend/netapp.pp
new file mode 100644
index 000000000..0818d8d78
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/manila/backend/netapp.pp
@@ -0,0 +1,18 @@
+class packstack::manila::backend::netapp ()
+{
+    manila::backend::netapp{ 'netapp':
+      driver_handles_share_servers         => lookup('CONFIG_MANILA_NETAPP_DRV_HANDLES_SHARE_SERVERS'),
+      netapp_transport_type                => lookup('CONFIG_MANILA_NETAPP_TRANSPORT_TYPE'),
+      netapp_login                         => lookup('CONFIG_MANILA_NETAPP_LOGIN'),
+      netapp_password                      => lookup('CONFIG_MANILA_NETAPP_PASSWORD'),
+      netapp_server_hostname               => lookup('CONFIG_MANILA_NETAPP_SERVER_HOSTNAME'),
+      netapp_storage_family                => lookup('CONFIG_MANILA_NETAPP_STORAGE_FAMILY'),
+      netapp_server_port                   => lookup('CONFIG_MANILA_NETAPP_SERVER_PORT'),
+      netapp_vserver                       => lookup('CONFIG_MANILA_NETAPP_VSERVER', undef, undef, undef),
+      netapp_aggregate_name_search_pattern => lookup('CONFIG_MANILA_NETAPP_AGGREGATE_NAME_SEARCH_PATTERN'),
+      netapp_root_volume_aggregate         => lookup('CONFIG_MANILA_NETAPP_ROOT_VOLUME_AGGREGATE', undef, undef, undef),
+      netapp_root_volume_name              => lookup('CONFIG_MANILA_NETAPP_ROOT_VOLUME_NAME', undef, undef, undef),
+    }
+
+    packstack::manila::network{ 'netapp': }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/manila/network.pp b/packstack/puppet/modules/packstack/manifests/manila/network.pp
new file mode 100644
index 000000000..85ae6c126
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/manila/network.pp
@@ -0,0 +1,27 @@
+
+define packstack::manila::network ($backend_name = $name) {
+  $manila_network_type = lookup('CONFIG_MANILA_NETWORK_TYPE')
+
+  case $manila_network_type {
+    'neutron': {
+      class { 'manila::network::neutron':
+        auth_type => 'password',
+        auth_url  => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+        password  => lookup('CONFIG_NEUTRON_KS_PW'),
+      }
+    }
+    'standalone': {
+      manila::network::standalone{ $backend_name:
+        standalone_network_plugin_gateway           => lookup('CONFIG_MANILA_NETWORK_STANDALONE_GATEWAY'),
+        standalone_network_plugin_mask              => lookup('CONFIG_MANILA_NETWORK_STANDALONE_NETMASK'),
+        standalone_network_plugin_segmentation_id   => lookup('CONFIG_MANILA_NETWORK_STANDALONE_SEG_ID'),
+        standalone_network_plugin_allowed_ip_ranges => lookup('CONFIG_MANILA_NETWORK_STANDALONE_IP_RANGE'),
+        standalone_network_plugin_ip_version        => lookup('CONFIG_MANILA_NETWORK_STANDALONE_IP_VERSION'),
+      }
+    }
+    default: {
+      fail("The value ${manila_network_type} is not a valid value for the Manila network type.")
+    }
+  }
+}
+
diff --git a/packstack/puppet/modules/packstack/manifests/manila/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/manila/rabbitmq.pp
new file mode 100644
index 000000000..d57ca25f1
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/manila/rabbitmq.pp
@@ -0,0 +1,45 @@
+class packstack::manila::rabbitmq ()
+{
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_MANILA_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_MANILA_SSL_CERT', undef, undef, undef)
+
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
+
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
+        owner   => 'manila',
+        group   => 'manila',
+        # manila user on RH/Fedora is provided by python-manila
+        require => Package['manila'],
+      }
+      File[$files_to_set_owner] ~> Service<| tag == 'manila-service' |>
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'manila-service' |>
+
+    class { 'manila::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'manila::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'manila',
+        'password' => lookup('CONFIG_MANILA_DB_PW'),
+        'database' => 'manila',
+      })
+    }
+
+    class { 'manila':
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/mariadb.pp b/packstack/puppet/modules/packstack/manifests/mariadb.pp
new file mode 100644
index 000000000..08d96b7e8
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/mariadb.pp
@@ -0,0 +1,60 @@
+class packstack::mariadb ()
+{
+  if lookup('CONFIG_MARIADB_INSTALL') == 'y' {
+    create_resources(packstack::firewall, lookup('FIREWALL_MARIADB_RULES', undef, undef, {}))
+    $max_connections = lookup('CONFIG_SERVICE_WORKERS') * 128
+
+    $bind_address = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    $mysql_root_password = lookup('CONFIG_MARIADB_PW')
+
+    class { 'mysql::server':
+      package_name     => 'mariadb-server-galera',
+      restart          => true,
+      root_password    => $mysql_root_password,
+      override_options => {
+        'mysqld' => {
+          'bind_address'           => $bind_address,
+          'default_storage_engine' => 'InnoDB',
+          'max_connections'        => $max_connections,
+          'open_files_limit'       => '-1',
+          # galera options
+          'wsrep_provider'         => 'none',
+          'wsrep_cluster_name'     => 'galera_cluster',
+          'wsrep_sst_method'       => 'rsync',
+          'wsrep_sst_auth'         => "root:${mysql_root_password}",
+        },
+      },
+    }
+
+    # deleting database users for security
+    # this is done in mysql::server::account_security but has problems
+    # when there is no fqdn, so we're defining a slightly different one here
+    mysql_user { [ 'root@127.0.0.1', 'root@::1', '@localhost', '@%' ]:
+      ensure  => 'absent',
+      require => Class['mysql::server'],
+    }
+
+    $fqdn = $facts['networking']['fqdn']
+    $hostname = $facts['networking']['hostname']
+
+    if ($fqdn != '' and $fqdn != 'localhost') {
+      mysql_user { [ "root@${fqdn}", "@${fqdn}"]:
+        ensure  => 'absent',
+        require => Class['mysql::server'],
+      }
+    }
+    if ($fqdn != $hostname and $hostname != 'localhost') {
+      mysql_user { ["root@${hostname}", "@${hostname}"]:
+        ensure  => 'absent',
+        require => Class['mysql::server'],
+      }
+    }
+  } else {
+        class { 'remote::db': }
+  }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/mariadb/services.pp b/packstack/puppet/modules/packstack/manifests/mariadb/services.pp
new file mode 100644
index 000000000..8a1efd3bf
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/mariadb/services.pp
@@ -0,0 +1,120 @@
+class packstack::mariadb::services ()
+{
+    class { 'keystone::db::mysql':
+      user          => 'keystone_admin',
+      password      => lookup('CONFIG_KEYSTONE_DB_PW'),
+      allowed_hosts => '%',
+      charset       => 'utf8',
+    }
+
+    if lookup('CONFIG_CINDER_INSTALL') == 'y' {
+      class { 'cinder::db::mysql':
+        password      => lookup('CONFIG_CINDER_DB_PW'),
+        host          => '%',
+        allowed_hosts => '%',
+        charset       => 'utf8',
+      }
+    }
+
+    if lookup('CONFIG_GLANCE_INSTALL') == 'y' {
+        class { 'glance::db::mysql':
+          password      => lookup('CONFIG_GLANCE_DB_PW'),
+          host          => '%',
+          allowed_hosts => '%',
+          charset       => 'utf8',
+        }
+    }
+
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+        class { 'gnocchi::db::mysql':
+          password      => lookup('CONFIG_GNOCCHI_DB_PW'),
+          host          => '%',
+          allowed_hosts => '%',
+        }
+    }
+
+    if lookup('CONFIG_AODH_INSTALL') == 'y' and
+      lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+        class { 'aodh::db::mysql':
+          password      => lookup('CONFIG_AODH_DB_PW'),
+          host          => '%',
+          allowed_hosts => '%',
+        }
+    }
+
+    if lookup('CONFIG_HEAT_INSTALL') == 'y' {
+      class { 'heat::db::mysql':
+        password      => lookup('CONFIG_HEAT_DB_PW'),
+        host          => '%',
+        allowed_hosts => '%',
+        charset       => 'utf8',
+      }
+    }
+
+    if lookup('CONFIG_MAGNUM_INSTALL') == 'y' {
+      class { 'magnum::db::mysql':
+        password      => lookup('CONFIG_MAGNUM_DB_PW'),
+        host          => '%',
+        allowed_hosts => '%',
+        charset       => 'utf8',
+      }
+    }
+
+    if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
+      class { 'ironic::db::mysql':
+        password      => lookup('CONFIG_IRONIC_DB_PW'),
+        host          => '%',
+        allowed_hosts => '%',
+        charset       => 'utf8',
+      }
+    }
+
+    if lookup('CONFIG_MANILA_INSTALL') == 'y' {
+        class { 'manila::db::mysql':
+          password      => lookup('CONFIG_MANILA_DB_PW'),
+          allowed_hosts => '%',
+          charset       => 'utf8',
+        }
+    }
+
+    if lookup('CONFIG_NEUTRON_INSTALL') == 'y' {
+        class { 'neutron::db::mysql':
+          password      => lookup('CONFIG_NEUTRON_DB_PW'),
+          host          => '%',
+          allowed_hosts => '%',
+          dbname        => lookup('CONFIG_NEUTRON_L2_DBNAME'),
+          charset       => 'utf8',
+        }
+    }
+
+    if lookup('CONFIG_NOVA_INSTALL') == 'y' {
+        class { 'nova::db::mysql':
+          password      => lookup('CONFIG_NOVA_DB_PW'),
+          host          => '%',
+          allowed_hosts => '%',
+          charset       => 'utf8',
+        }
+        class { 'nova::db::mysql_api':
+          password      => lookup('CONFIG_NOVA_DB_PW'),
+          host          => '%',
+          allowed_hosts => '%',
+          charset       => 'utf8',
+        }
+        class { 'placement::db::mysql':
+          password      => lookup('CONFIG_NOVA_DB_PW'),
+          host          => '%',
+          allowed_hosts => '%',
+          charset       => 'utf8',
+        }
+    }
+
+    if lookup('CONFIG_TROVE_INSTALL') == 'y' {
+        class { 'trove::db::mysql':
+            password      => lookup('CONFIG_TROVE_DB_PW'),
+            host          => '%',
+            allowed_hosts => '%',
+            charset       => 'utf8',
+        }
+    }
+
+}
diff --git a/packstack/puppet/modules/packstack/manifests/mariadb/services_remote.pp b/packstack/puppet/modules/packstack/manifests/mariadb/services_remote.pp
new file mode 100644
index 000000000..ef3448986
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/mariadb/services_remote.pp
@@ -0,0 +1,447 @@
+class packstack::mariadb::services_remote () {
+    remote_database { 'keystone':
+      ensure      => 'present',
+      charset     => 'utf8',
+      db_host     => lookup('CONFIG_MARIADB_HOST'),
+      db_user     => lookup('CONFIG_MARIADB_USER'),
+      db_password => lookup('CONFIG_MARIADB_PW'),
+      provider    => 'mysql',
+    }
+
+    $mariadb_keystone_noinstall_db_pw = lookup('CONFIG_KEYSTONE_DB_PW')
+
+    remote_database_user { 'keystone_admin@%':
+      password_hash => mysql_password($mariadb_keystone_noinstall_db_pw),
+      db_host       => lookup('CONFIG_MARIADB_HOST'),
+      db_user       => lookup('CONFIG_MARIADB_USER'),
+      db_password   => lookup('CONFIG_MARIADB_PW'),
+      provider      => 'mysql',
+      require       => Remote_database['keystone'],
+    }
+
+    remote_database_grant { 'keystone_admin@%/keystone':
+      privileges  => 'all',
+      db_host     => lookup('CONFIG_MARIADB_HOST'),
+      db_user     => lookup('CONFIG_MARIADB_USER'),
+      db_password => lookup('CONFIG_MARIADB_PW'),
+      provider    => 'mysql',
+      require     => Remote_database_user['keystone_admin@%'],
+    }
+
+    if lookup('CONFIG_CINDER_INSTALL') == 'y' {
+      remote_database { 'cinder':
+        ensure      => 'present',
+        charset     => 'utf8',
+        db_host     => lookup('CONFIG_MARIADB_HOST'),
+        db_user     => lookup('CONFIG_MARIADB_USER'),
+        db_password => lookup('CONFIG_MARIADB_PW'),
+        provider    => 'mysql',
+      }
+
+      $mariadb_cinder_noinstall_db_pw = lookup('CONFIG_CINDER_DB_PW')
+
+      remote_database_user { 'cinder@%':
+        password_hash => mysql_password($mariadb_cinder_noinstall_db_pw),
+        db_host       => lookup('CONFIG_MARIADB_HOST'),
+        db_user       => lookup('CONFIG_MARIADB_USER'),
+        db_password   => lookup('CONFIG_MARIADB_PW'),
+        provider      => 'mysql',
+        require       => Remote_database['cinder'],
+      }
+
+      remote_database_grant { 'cinder@%/cinder':
+        privileges  => 'all',
+        db_host     => lookup('CONFIG_MARIADB_HOST'),
+        db_user     => lookup('CONFIG_MARIADB_USER'),
+        db_password => lookup('CONFIG_MARIADB_PW'),
+        provider    => 'mysql',
+        require     => Remote_database_user['cinder@%'],
+      }
+    }
+
+    if lookup('CONFIG_GLANCE_INSTALL') == 'y' {
+        remote_database { 'glance':
+          ensure      => 'present',
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        $mariadb_glance_noinstall_db_pw = lookup('CONFIG_GLANCE_DB_PW')
+
+        remote_database_user { 'glance@%':
+          password_hash => mysql_password($mariadb_glance_noinstall_db_pw),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
+          provider      => 'mysql',
+          require       => Remote_database['glance'],
+        }
+
+        remote_database_grant { 'glance@%/glance':
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => Remote_database_user['glance@%'],
+        }
+    }
+
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+        remote_database { 'gnocchi':
+          ensure      => 'present',
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        $gnocchi_cfg_db_pw = lookup('CONFIG_GNOCCHI_DB_PW')
+
+        remote_database_user { 'gnocchi@%':
+          password_hash => mysql_password($gnocchi_cfg_db_pw),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
+          provider      => 'mysql',
+          require       => Remote_database['gnocchi'],
+        }
+
+        remote_database_grant { 'gnocchi@%/gnocchi':
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => Remote_database_user['gnocchi@%'],
+        }
+    }
+
+    if lookup('CONFIG_AODH_INSTALL') == 'y' {
+        remote_database { 'aodh':
+          ensure      => 'present',
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        $aodh_cfg_db_pw = lookup('CONFIG_AODH_DB_PW')
+
+        remote_database_user { 'aodh@%':
+          password_hash => mysql_password($aodh_cfg_db_pw),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
+          provider      => 'mysql',
+          require       => Remote_database['aodh'],
+        }
+
+        remote_database_grant { 'aodh@%/aodh':
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => Remote_database_user['aodh@%'],
+        }
+    }
+
+    if lookup('CONFIG_HEAT_INSTALL') == 'y' {
+        remote_database { 'heat':
+          ensure      => 'present',
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        $mariadb_heat_noinstall_db_pw = lookup('CONFIG_HEAT_DB_PW')
+
+        remote_database_user { 'heat@%':
+          password_hash => mysql_password($mariadb_heat_noinstall_db_pw),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
+          provider      => 'mysql',
+          require       => Remote_database['heat'],
+        }
+
+        remote_database_grant { 'heat@%/heat':
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => Remote_database_user['heat@%'],
+        }
+    }
+
+    if lookup('CONFIG_MAGNUM_INSTALL') == 'y' {
+        remote_database { 'magnum':
+          ensure      => 'present',
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        $mariadb_magnum_noinstall_db_pw = lookup('CONFIG_MAGNUM_DB_PW')
+
+        remote_database_user { 'magnum@%':
+          password_hash => mysql_password($mariadb_magnum_noinstall_db_pw),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
+          provider      => 'mysql',
+          require       => Remote_database['magnum'],
+        }
+
+        remote_database_grant { 'magnum@%/magnum':
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => Remote_database_user['magnum@%'],
+        }
+    }
+
+    if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
+        remote_database { 'ironic':
+          ensure      => 'present',
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        $mariadb_ironic_noinstall_db_pw = lookup('CONFIG_IRONIC_DB_PW')
+
+        remote_database_user { 'ironic@%':
+          password_hash => mysql_password($mariadb_ironic_noinstall_db_pw),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
+          provider      => 'mysql',
+          require       => Remote_database['ironic'],
+        }
+
+        remote_database_grant { 'ironic@%/ironic':
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => Remote_database_user['ironic@%'],
+        }
+    }
+
+    if lookup('CONFIG_MANILA_INSTALL') == 'y' {
+        remote_database { 'manila':
+          ensure      => 'present',
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        $mariadb_manila_noinstall_db_pw = lookup('CONFIG_MANILA_DB_PW')
+
+        remote_database_user { 'manila@%':
+          password_hash => mysql_password($mariadb_manila_noinstall_db_pw),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
+          provider      => 'mysql',
+          require       => Remote_database['manila'],
+        }
+
+        remote_database_grant { 'manila@%/manila':
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => Remote_database_user['manila@%'],
+        }
+    }
+
+    if lookup('CONFIG_NEUTRON_INSTALL') == 'y' {
+        $mariadb_neutron_noinstall_db_pw     = lookup('CONFIG_NEUTRON_DB_PW')
+        $mariadb_neutron_noinstall_l2_dbname = lookup('CONFIG_NEUTRON_L2_DBNAME')
+
+        remote_database { $mariadb_neutron_noinstall_l2_dbname:
+          ensure      => present,
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        remote_database_user { 'neutron@%':
+          password_hash => mysql_password($mariadb_neutron_noinstall_db_pw),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
+          provider      => 'mysql',
+          require       => Remote_database[$mariadb_neutron_noinstall_l2_dbname],
+        }
+
+        remote_database_grant { "neutron@%/${mariadb_neutron_noinstall_l2_dbname}":
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => Remote_database_user['neutron@%'],
+        }
+    }
+
+    if lookup('CONFIG_NOVA_INSTALL') == 'y' {
+        remote_database { 'nova':
+          ensure      => 'present',
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        $mariadb_nova_noinstall_db_pw = lookup('CONFIG_NOVA_DB_PW')
+
+        remote_database_user { 'nova@%':
+          password_hash => mysql_password($mariadb_nova_noinstall_db_pw),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
+          provider      => 'mysql',
+          require       => Remote_database['nova'],
+        }
+
+        remote_database_grant { 'nova@%/nova':
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => Remote_database_user['nova@%'],
+        }
+
+        remote_database { 'nova_api':
+          ensure      => 'present',
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        remote_database_user { 'nova_api@%':
+          password_hash => mysql_password($mariadb_nova_noinstall_db_pw),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
+          provider      => 'mysql',
+          require       => Remote_database['nova_api'],
+        }
+
+        remote_database_grant { 'nova_api@%/nova_api':
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => Remote_database_user['nova_api@%'],
+        }
+
+        remote_database { 'placement':
+          ensure      => 'present',
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        remote_database_user { 'placement@%':
+          password_hash => mysql_password($mariadb_nova_noinstall_db_pw),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
+          provider      => 'mysql',
+          require       => Remote_database['placement'],
+        }
+
+        remote_database_grant { 'placement@%/placement':
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => Remote_database_user['placement@%'],
+        }
+
+        remote_database { 'nova_cell0':
+          ensure      => 'present',
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        remote_database_grant { 'nova@%/nova_cell0':
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => [ Remote_database_user['nova@%'],
+                          Remote_database['nova_cell0'] ],
+        }
+
+    }
+
+    if lookup('CONFIG_TROVE_INSTALL') == 'y' {
+        remote_database { 'trove':
+          ensure      => 'present',
+          charset     => 'utf8',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+        }
+
+        $trove_cfg_trove_db_pw = lookup('CONFIG_TROVE_DB_PW')
+
+        remote_database_user { 'trove@%':
+          password_hash => mysql_password($trove_cfg_trove_db_pw),
+          db_host       => lookup('CONFIG_MARIADB_HOST'),
+          db_user       => lookup('CONFIG_MARIADB_USER'),
+          db_password   => lookup('CONFIG_MARIADB_PW'),
+          provider      => 'mysql',
+          require       => Remote_database['trove'],
+        }
+
+        remote_database_grant { 'trove@%/trove':
+          privileges  => 'all',
+          db_host     => lookup('CONFIG_MARIADB_HOST'),
+          db_user     => lookup('CONFIG_MARIADB_USER'),
+          db_password => lookup('CONFIG_MARIADB_PW'),
+          provider    => 'mysql',
+          require     => Remote_database_user['trove@%'],
+        }
+    }
+
+}
diff --git a/packstack/puppet/modules/packstack/manifests/memcached.pp b/packstack/puppet/modules/packstack/manifests/memcached.pp
new file mode 100644
index 000000000..0dcd14298
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/memcached.pp
@@ -0,0 +1,13 @@
+class packstack::memcached ()
+{
+    $memcached_bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    class { 'memcached':
+      listen_ip  => $memcached_bind_host,
+      max_memory => '10%',
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/netns.pp b/packstack/puppet/modules/packstack/manifests/netns.pp
deleted file mode 100644
index 20e63d257..000000000
--- a/packstack/puppet/modules/packstack/manifests/netns.pp
+++ /dev/null
@@ -1,21 +0,0 @@
-#
-# Checks if netns is supported and if not updates kernel, iputils
-# and iproute
-
-class packstack::netns (
-    $warning = "Kernel package with netns support has been installed."
-)
-{
-    if $::netns_support != "true" {
-        exec { "netns_dependecy_install":
-            path => "/usr/bin/",
-            command => "yum update -y kernel iputils iproute",
-            timeout => 900,
-        }
-
-        notify { "packstack_info":
-            message => $warning,
-            require => Exec["netns_dependecy_install"],
-        }
-    }
-}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron.pp b/packstack/puppet/modules/packstack/manifests/neutron.pp
new file mode 100644
index 000000000..6190b5c9c
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron.pp
@@ -0,0 +1,3 @@
+class packstack::neutron ()
+{
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/api.pp b/packstack/puppet/modules/packstack/manifests/neutron/api.pp
new file mode 100644
index 000000000..8fdb38fa0
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/api.pp
@@ -0,0 +1,55 @@
+class packstack::neutron::api ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_NEUTRON_SERVER_RULES', undef, undef, {}))
+
+    $neutron_vpnaas_enabled = str2bool(lookup('CONFIG_NEUTRON_VPNAAS'))
+
+    class { 'neutron::keystone::authtoken':
+      password             => lookup('CONFIG_NEUTRON_KS_PW'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
+
+    class { 'neutron::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'neutron',
+        'password' => lookup('CONFIG_NEUTRON_DB_PW'),
+        'database' => lookup('CONFIG_NEUTRON_L2_DBNAME'),
+      })
+    }
+
+    $rpc_workrers = lookup('CONFIG_NEUTRON_L2_AGENT') ? {
+      'ovn'   => 0,
+      default => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+    $rpc_service_name = $rpc_workers ? {
+      0       => false,
+      default => undef,
+    }
+    $rpc_state_report_workers = lookup('CONFIG_NEUTRON_L2_AGENT') ? {
+      'ovn'   => 0,
+      default => undef,
+    }
+
+    class { 'neutron::wsgi::apache':
+      bind_host => $bind_host,
+      ssl       => false,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+    class { 'neutron::server':
+      sync_db                  => true,
+      enabled                  => true,
+      api_workers              => lookup('CONFIG_SERVICE_WORKERS'),
+      rpc_workers              => $rpc_workers,
+      rpc_state_report_workers => $rpc_state_report_workers,
+      api_service_name         => 'httpd',
+      rpc_service_name         => $rpc_service_name,
+      service_providers        => lookup('SERVICE_PROVIDERS', { merge => 'unique' }),
+    }
+
+    if $neutron_vpnaas_enabled {
+      class { 'neutron::services::vpnaas': }
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/bridge.pp b/packstack/puppet/modules/packstack/manifests/neutron/bridge.pp
index 27e803769..bd0852399 100644
--- a/packstack/puppet/modules/packstack/manifests/neutron/bridge.pp
+++ b/packstack/puppet/modules/packstack/manifests/neutron/bridge.pp
@@ -2,24 +2,35 @@
 # Loads bridge modules and sets appropriate sysctl.conf variables
 
 class packstack::neutron::bridge {
-    file { 'bridge-module-loader':
-        path => '/etc/sysconfig/modules/openstack-neutron.modules',
-        ensure => present,
-        mode => 0700,
-        content => template('packstack/openstack-neutron.modules.erb'),
-    }
-
-    file_line { '/etc/sysctl.conf bridge-nf-call-ip6tables':
-        path  => '/etc/sysctl.conf',
-        line  => 'net.bridge.bridge-nf-call-ip6tables=1',
-        match => 'net.bridge.bridge-nf-call-ip6tables\s*=',
-    } -> file_line { '/etc/sysctl.conf bridge-nf-call-iptables':
-        path  => '/etc/sysctl.conf',
-        line  => 'net.bridge.bridge-nf-call-iptables=1',
-        match => 'net.bridge.bridge-nf-call-iptables\s*=',
-    } -> file_line { '/etc/sysctl.conf bridge-nf-call-arptables':
-        path  => '/etc/sysctl.conf',
-        line  => 'net.bridge.bridge-nf-call-arptables=1',
-        match => 'net.bridge.bridge-nf-call-arptables\s*=',
-    }
+  file { 'bridge-module-loader':
+    ensure  => file,
+    path    => '/etc/sysconfig/modules/openstack-neutron.modules',
+    mode    => '0700',
+    content => template('packstack/openstack-neutron.modules.erb'),
+  } -> exec { 'load-bridge':
+    path      => ['/sbin', '/usr/sbin'],
+    command   => 'modprobe -b bridge',
+    logoutput => 'on_failure',
+  } -> exec { 'load-bridge-netfilter':
+    path      => ['/sbin', '/usr/sbin', '/bin', '/usr/bin'],
+    command   => 'modprobe -b br_netfilter',
+    logoutput => 'on_failure',
+    unless    => 'test -d /proc/sys/net/bridge',
+  } -> file_line { '/etc/sysctl.conf bridge-nf-call-ip6tables':
+    path  => '/etc/sysctl.conf',
+    line  => 'net.bridge.bridge-nf-call-ip6tables=1',
+    match => 'net.bridge.bridge-nf-call-ip6tables\s*=',
+  } -> file_line { '/etc/sysctl.conf bridge-nf-call-iptables':
+    path  => '/etc/sysctl.conf',
+    line  => 'net.bridge.bridge-nf-call-iptables=1',
+    match => 'net.bridge.bridge-nf-call-iptables\s*=',
+  } -> file_line { '/etc/sysctl.conf bridge-nf-call-arptables':
+    path  => '/etc/sysctl.conf',
+    line  => 'net.bridge.bridge-nf-call-arptables=1',
+    match => 'net.bridge.bridge-nf-call-arptables\s*=',
+  } -> exec { 'sysctl_refresh':
+    path      => ['/usr/sbin', '/sbin', '/usr/bin', '/bin'],
+    command   => 'sysctl -p /etc/sysctl.conf',
+    logoutput => 'on_failure',
+  }
 }
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/dhcp.pp b/packstack/puppet/modules/packstack/manifests/neutron/dhcp.pp
new file mode 100644
index 000000000..e6a53c434
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/dhcp.pp
@@ -0,0 +1,10 @@
+class packstack::neutron::dhcp ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_NEUTRON_DHCPIN_RULES', undef, undef, {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_NEUTRON_DHCPOUT_RULES', undef, undef, {}))
+
+    class { 'neutron::agents::dhcp':
+      interface_driver => lookup('CONFIG_NEUTRON_DHCP_INTERFACE_DRIVER'),
+      debug            => lookup('CONFIG_DEBUG_MODE'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/l3.pp b/packstack/puppet/modules/packstack/manifests/neutron/l3.pp
new file mode 100644
index 000000000..3de7d8277
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/l3.pp
@@ -0,0 +1,18 @@
+class packstack::neutron::l3 ()
+{
+    $start_l3_agent = lookup('CONFIG_NEUTRON_VPNAAS') ? {
+        'y'     => false,
+        default => true
+    }
+
+    class { 'neutron::agents::l3':
+      interface_driver => lookup('CONFIG_NEUTRON_L3_INTERFACE_DRIVER'),
+      manage_service   => $start_l3_agent,
+      enabled          => $start_l3_agent,
+      debug            => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    sysctl::value { 'net.ipv4.ip_forward':
+      value => '1',
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/metadata.pp b/packstack/puppet/modules/packstack/manifests/neutron/metadata.pp
new file mode 100644
index 000000000..9acc203e3
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/metadata.pp
@@ -0,0 +1,9 @@
+class packstack::neutron::metadata ()
+{
+    class { 'neutron::agents::metadata':
+      shared_secret    => lookup('CONFIG_NEUTRON_METADATA_PW'),
+      metadata_host    => force_ip(lookup('CONFIG_KEYSTONE_HOST_URL')),
+      debug            => lookup('CONFIG_DEBUG_MODE'),
+      metadata_workers => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/metering.pp b/packstack/puppet/modules/packstack/manifests/neutron/metering.pp
new file mode 100644
index 000000000..6f9565385
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/metering.pp
@@ -0,0 +1,7 @@
+class packstack::neutron::metering ()
+{
+    class { 'neutron::agents::metering':
+      interface_driver => lookup('CONFIG_NEUTRON_METERING_IFCE_DRIVER'),
+      debug            => lookup('CONFIG_DEBUG_MODE'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/ml2.pp b/packstack/puppet/modules/packstack/manifests/neutron/ml2.pp
new file mode 100644
index 000000000..408a32cf4
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/ml2.pp
@@ -0,0 +1,38 @@
+class packstack::neutron::ml2 ()
+{
+    if lookup('CONFIG_NEUTRON_ML2_VXLAN_GROUP') == '' {
+      $vxlan_group_value = undef
+    } else {
+      $vxlan_group_value = lookup('CONFIG_NEUTRON_ML2_VXLAN_GROUP')
+    }
+
+    class { 'neutron::plugins::ml2':
+      type_drivers          => lookup('CONFIG_NEUTRON_ML2_TYPE_DRIVERS', { merge => 'unique' }),
+      tenant_network_types  => lookup('CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES', { merge => 'unique' }),
+      mechanism_drivers     => lookup('CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS', { merge => 'unique' }),
+      flat_networks         => lookup('CONFIG_NEUTRON_ML2_FLAT_NETWORKS', { merge => 'unique' }),
+      network_vlan_ranges   => lookup('CONFIG_NEUTRON_ML2_VLAN_RANGES', { merge => 'unique' }),
+      tunnel_id_ranges      => lookup('CONFIG_NEUTRON_ML2_TUNNEL_ID_RANGES', { merge => 'unique' }),
+      vxlan_group           => $vxlan_group_value,
+      vni_ranges            => lookup('CONFIG_NEUTRON_ML2_VNI_RANGES', { merge => 'unique' }),
+      enable_security_group => true,
+      extension_drivers     => 'port_security,qos',
+      max_header_size       => 38,
+    }
+
+    if lookup('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
+      class { 'neutron::plugins::ml2::ovn':
+        ovn_nb_connection    => "tcp:${lookup('CONFIG_CONTROLLER_HOST')}:6641",
+        ovn_sb_connection    => "tcp:${lookup('CONFIG_CONTROLLER_HOST')}:6642",
+        ovn_metadata_enabled => true,
+      }
+    }
+
+    # For cases where "neutron-db-manage upgrade" command is called
+    # we need to fill config file first
+    if defined(Exec['neutron-db-manage upgrade']) {
+      Neutron_plugin_ml2<||>
+      -> File['/etc/neutron/plugin.ini']
+      -> Exec['neutron-db-manage upgrade']
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/notifications.pp b/packstack/puppet/modules/packstack/manifests/neutron/notifications.pp
new file mode 100644
index 000000000..e22ac99a6
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/notifications.pp
@@ -0,0 +1,16 @@
+class packstack::neutron::notifications ()
+{
+    $neutron_notif_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+
+    # Configure nova notifications system
+    class { 'neutron::server::notifications':
+    }
+
+    class { 'neutron::server::notifications::nova':
+      username     => 'nova',
+      password     => lookup('CONFIG_NOVA_KS_PW'),
+      project_name => 'services',
+      auth_url     => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      region_name  => lookup('CONFIG_KEYSTONE_REGION'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/ovn_agent.pp b/packstack/puppet/modules/packstack/manifests/neutron/ovn_agent.pp
new file mode 100644
index 000000000..bafa3ff3f
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/ovn_agent.pp
@@ -0,0 +1,56 @@
+class packstack::neutron::ovn_agent ()
+{
+    $my_ip = choose_my_ip(lookup('HOST_LIST'))
+    $my_ip_without_dot = regsubst($my_ip, '[\.\:]', '_', 'G')
+    $neutron_tunnel_rule_name = "FIREWALL_NEUTRON_TUNNEL_RULES_${my_ip_without_dot}"
+    create_resources(packstack::firewall, lookup($neutron_tunnel_rule_name, undef, undef, {}))
+
+    $neutron_ovn_tunnel_if = lookup('CONFIG_NEUTRON_OVN_TUNNEL_IF', undef, undef, undef)
+
+    $use_subnets_value = lookup('CONFIG_USE_SUBNETS')
+    $use_subnets = $use_subnets_value ? {
+      'y'     => true,
+      default => false,
+    }
+
+    if $neutron_ovn_tunnel_if {
+      $ovn_agent_tunnel_cfg_neut_ovs_tun_if = force_interface($neutron_ovn_tunnel_if, $use_subnets)
+    } else {
+      $ovn_agent_tunnel_cfg_neut_ovs_tun_if = undef
+    }
+
+    if $ovn_agent_tunnel_cfg_neut_ovs_tun_if != '' {
+      $iface = regsubst($ovn_agent_tunnel_cfg_neut_ovs_tun_if, '[\.\-\:]', '_', 'G')
+      $localip = inline_template("<%= scope.lookupvar('::ipaddress_${iface}') %>")
+    } else {
+      $localip = choose_my_ip(lookup('HOST_LIST'))
+    }
+
+    $network_hosts =  split(lookup('CONFIG_NETWORK_HOSTS'),',')
+    if member($network_hosts, choose_my_ip(lookup('HOST_LIST'))) {
+      $bridge_ifaces_param = 'CONFIG_NEUTRON_OVS_BRIDGE_IFACES'
+      $bridge_mappings_param = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS'
+    } else {
+      $bridge_ifaces_param = 'CONFIG_NEUTRON_OVS_BRIDGE_IFACES_COMPUTE'
+      $bridge_mappings_param = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS_COMPUTE'
+    }
+
+    if lookup('CREATE_BRIDGES') == 'y' {
+      $bridge_uplinks  = lookup($bridge_ifaces_param, { merge => 'unique' })
+      $bridge_mappings = lookup($bridge_mappings_param, { merge => 'unique' })
+    } else {
+      $bridge_uplinks  = []
+      $bridge_mappings = []
+    }
+
+    $ovn_southd = "tcp:${lookup('CONFIG_CONTROLLER_HOST')}:6642"
+
+    class { 'ovn::controller':
+      ovn_remote                => $ovn_southd,
+      ovn_bridge_mappings       => $bridge_mappings,
+      bridge_interface_mappings => $bridge_uplinks,
+      ovn_encap_ip              => force_ip($localip),
+      hostname                  => $facts['networking']['fqdn'],
+      ovn_cms_options           => 'enable-chassis-as-gw',
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/ovn_metadata.pp b/packstack/puppet/modules/packstack/manifests/neutron/ovn_metadata.pp
new file mode 100644
index 000000000..c4e019332
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/ovn_metadata.pp
@@ -0,0 +1,13 @@
+class packstack::neutron::ovn_metadata ()
+{
+    $ovn_southd = "tcp:${lookup('CONFIG_CONTROLLER_HOST')}:6642"
+
+    class { 'neutron::agents::ovn_metadata':
+      ovn_sb_connection => $ovn_southd,
+      shared_secret     => lookup('CONFIG_NEUTRON_METADATA_PW'),
+      metadata_host     => force_ip(lookup('CONFIG_KEYSTONE_HOST_URL')),
+      debug             => lookup('CONFIG_DEBUG_MODE'),
+      metadata_workers  => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+    Service<| title == 'controller' |> -> Service<| title == 'ovn-metadata' |>
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/ovn_northd.pp b/packstack/puppet/modules/packstack/manifests/neutron/ovn_northd.pp
new file mode 100644
index 000000000..067ce6869
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/ovn_northd.pp
@@ -0,0 +1,4 @@
+class packstack::neutron::ovn_northd ()
+{
+    include ovn::northd
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/ovs_agent.pp b/packstack/puppet/modules/packstack/manifests/neutron/ovs_agent.pp
new file mode 100644
index 000000000..634894a7b
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/ovs_agent.pp
@@ -0,0 +1,55 @@
+class packstack::neutron::ovs_agent ()
+{
+    $my_ip = choose_my_ip(lookup('HOST_LIST'))
+    $my_ip_without_dot = regsubst($my_ip, '[\.\:]', '_', 'G')
+    $neutron_tunnel_rule_name = "FIREWALL_NEUTRON_TUNNEL_RULES_${my_ip_without_dot}"
+    create_resources(packstack::firewall, lookup($neutron_tunnel_rule_name, undef, undef, {}))
+
+    $neutron_ovs_tunnel_if = lookup('CONFIG_NEUTRON_OVS_TUNNEL_IF', undef, undef, undef)
+
+    $use_subnets_value = lookup('CONFIG_USE_SUBNETS')
+    $use_subnets = $use_subnets_value ? {
+      'y'     => true,
+      default => false,
+    }
+
+    if $neutron_ovs_tunnel_if {
+      $ovs_agent_vxlan_cfg_neut_ovs_tun_if = force_interface($neutron_ovs_tunnel_if, $use_subnets)
+    } else {
+      $ovs_agent_vxlan_cfg_neut_ovs_tun_if = undef
+    }
+
+    if $ovs_agent_vxlan_cfg_neut_ovs_tun_if != '' {
+      $iface = regsubst($ovs_agent_vxlan_cfg_neut_ovs_tun_if, '[\.\-\:]', '_', 'G')
+      $localip = inline_template("<%= scope.lookupvar('::ipaddress_${iface}') %>")
+    } else {
+      $localip = choose_my_ip(lookup('HOST_LIST'))
+    }
+
+    $network_hosts =  split(lookup('CONFIG_NETWORK_HOSTS'),',')
+    if member($network_hosts, choose_my_ip(lookup('HOST_LIST'))) {
+      $bridge_ifaces_param = 'CONFIG_NEUTRON_OVS_BRIDGE_IFACES'
+      $bridge_mappings_param = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS'
+    } else {
+      $bridge_ifaces_param = 'CONFIG_NEUTRON_OVS_BRIDGE_IFACES_COMPUTE'
+      $bridge_mappings_param = 'CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS_COMPUTE'
+    }
+
+    if lookup('CREATE_BRIDGES') == 'y' {
+      $bridge_uplinks  = lookup($bridge_ifaces_param, { merge => 'unique' })
+      $bridge_mappings = lookup($bridge_mappings_param, { merge => 'unique' })
+    } else {
+      $bridge_uplinks  = []
+      $bridge_mappings = []
+    }
+
+    class { 'neutron::agents::ml2::ovs':
+      bridge_uplinks  => $bridge_uplinks,
+      bridge_mappings => $bridge_mappings,
+      tunnel_types    => lookup('CONFIG_NEUTRON_OVS_TUNNEL_TYPES', { merge => 'unique' }),
+      local_ip        => force_ip($localip),
+      vxlan_udp_port  => lookup('CONFIG_NEUTRON_OVS_VXLAN_UDP_PORT', undef, undef, undef),
+      l2_population   => lookup('CONFIG_NEUTRON_USE_L2POPULATION'),
+      firewall_driver => lookup('FIREWALL_DRIVER'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/ovs_bridge.pp b/packstack/puppet/modules/packstack/manifests/neutron/ovs_bridge.pp
new file mode 100644
index 000000000..0675cfc76
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/ovs_bridge.pp
@@ -0,0 +1,11 @@
+class packstack::neutron::ovs_bridge ()
+{
+  $agent_service = 'neutron-ovs-agent-service'
+
+  $config_neutron_ovs_bridge = lookup('CONFIG_NEUTRON_OVS_BRIDGE')
+
+  vs_bridge { $config_neutron_ovs_bridge:
+    ensure  => present,
+    require => Service[$agent_service],
+  }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/neutron/rabbitmq.pp
new file mode 100644
index 000000000..fb67efbcd
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/rabbitmq.pp
@@ -0,0 +1,44 @@
+class packstack::neutron::rabbitmq ()
+{
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_NEUTRON_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_NEUTRON_SSL_CERT', undef, undef, undef)
+
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
+        owner   => 'neutron',
+        group   => 'neutron',
+        require => Package['neutron'],
+      }
+      File[$files_to_set_owner] ~> Service<| tag == 'neutron-service' |>
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'neutron-service' |>
+
+    class { 'neutron::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'neutron':
+      bind_host             => $bind_host,
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      core_plugin           => lookup('CONFIG_NEUTRON_CORE_PLUGIN'),
+      service_plugins       => lookup('SERVICE_PLUGINS', { merge => 'unique' }),
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/sriov.pp b/packstack/puppet/modules/packstack/manifests/neutron/sriov.pp
new file mode 100644
index 000000000..001c94bba
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/sriov.pp
@@ -0,0 +1,6 @@
+class packstack::neutron::sriov ()
+{
+    class { 'neutron::agents::ml2::sriov' :
+      physical_device_mappings => lookup('CONFIG_NEUTRON_ML2_SRIOV_INTERFACE_MAPPINGS', { merge => 'unique' }),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/neutron/vpnaas.pp b/packstack/puppet/modules/packstack/manifests/neutron/vpnaas.pp
new file mode 100644
index 000000000..e60bd9ed1
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/neutron/vpnaas.pp
@@ -0,0 +1,6 @@
+class packstack::neutron::vpnaas ()
+{
+    class { 'neutron::agents::vpnaas':
+      vpn_device_driver => 'neutron_vpnaas.services.vpn.device_drivers.libreswan_ipsec.LibreSwanDriver',
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova.pp b/packstack/puppet/modules/packstack/manifests/nova.pp
new file mode 100644
index 000000000..775e69387
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova.pp
@@ -0,0 +1,102 @@
+class packstack::nova ()
+{
+    $private_key = {
+      'type' => lookup('NOVA_MIGRATION_KEY_TYPE'),
+      'key'  => lookup('NOVA_MIGRATION_KEY_SECRET'),
+    }
+    $public_key = {
+      'type' => lookup('NOVA_MIGRATION_KEY_TYPE'),
+      'key'  => lookup('NOVA_MIGRATION_KEY_PUBLIC'),
+    }
+
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_NOVA_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_NOVA_SSL_CERT', undef, undef, undef)
+
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
+        owner   => 'nova',
+        group   => 'nova',
+        require => Package['nova-common'],
+      }
+      File[$files_to_set_owner] ~> Service<| tag == 'nova-service' |>
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'nova-service' |>
+
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+      $nova_common_notification_driver = 'messagingv2'
+      $notify_on_state_change = 'vm_and_task_state'
+    } else {
+      $nova_common_notification_driver = undef
+      $notify_on_state_change = undef
+    }
+
+    if lookup('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
+      $novahost = $facts['networking']['fqdn']
+    } else {
+      $novahost = undef
+    }
+
+    if lookup('CONFIG_HORIZON_SSL') == 'y' {
+      $ssl_only = true
+      $cert = lookup('CONFIG_VNC_SSL_CERT')
+      $key = lookup('CONFIG_VNC_SSL_KEY')
+    } else {
+      $ssl_only = false
+      $cert = undef
+      $key = undef
+    }
+
+    class { 'nova::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'nova::db':
+      database_connection     => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'nova',
+        'password' => lookup('CONFIG_NOVA_DB_PW'),
+        'database' => 'nova',
+      }),
+      api_database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'nova_api',
+        'password' => lookup('CONFIG_NOVA_DB_PW'),
+        'database' => 'nova_api',
+      })
+    }
+
+    class { 'nova':
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      rabbit_use_ssl          => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      nova_public_key         => $public_key,
+      nova_private_key        => $private_key,
+      kombu_ssl_ca_certs      => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile       => $kombu_ssl_keyfile,
+      kombu_ssl_certfile      => $kombu_ssl_certfile,
+      notification_driver     => $nova_common_notification_driver,
+      notify_on_state_change  => $notify_on_state_change,
+      cpu_allocation_ratio    => lookup('CONFIG_NOVA_SCHED_CPU_ALLOC_RATIO'),
+      ram_allocation_ratio    => lookup('CONFIG_NOVA_SCHED_RAM_ALLOC_RATIO'),
+      host                    => $novahost,
+      ssl_only                => $ssl_only,
+      cert                    => $cert,
+      key                     => $key,
+    }
+
+    class { 'nova::keystone::service_user':
+      send_service_user_token => true,
+      password                => lookup('CONFIG_NOVA_KS_PW'),
+      auth_url                => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
+
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/api.pp b/packstack/puppet/modules/packstack/manifests/nova/api.pp
new file mode 100644
index 000000000..52100562a
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/api.pp
@@ -0,0 +1,118 @@
+class packstack::nova::api ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_NOVA_API_RULES', undef, undef, {}))
+
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    $admin_password = lookup('CONFIG_NOVA_KS_PW')
+
+    class { 'nova::keystone::authtoken':
+      password             => $admin_password,
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
+
+    $pci_alias = parsejson(lookup('CONFIG_NOVA_PCI_ALIAS'))
+
+    class { 'nova::pci':
+      aliases => $pci_alias,
+    }
+
+    class { 'nova::api':
+      api_bind_address           => $bind_host,
+      enabled                    => true,
+      sync_db                    => false,
+      sync_db_api                => false,
+      osapi_compute_workers      => lookup('CONFIG_SERVICE_WORKERS'),
+      allow_resize_to_same_host  => lookup('CONFIG_NOVA_ALLOW_RESIZE_TO_SAME'),
+      service_name               => 'httpd',
+    }
+
+    include packstack::nova::cache
+    class { 'nova::metadata':
+      neutron_metadata_proxy_shared_secret => lookup('CONFIG_NEUTRON_METADATA_PW_UNQUOTED', undef, undef, undef),
+    }
+
+    class { 'nova::wsgi::apache_api':
+      bind_host => $bind_host,
+      ssl       => false,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    class { 'nova::wsgi::apache_metadata':
+      bind_host => $bind_host,
+      ssl       => false,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    class { 'nova::db::sync':
+      db_sync_timeout => 600,
+    }
+
+    class { 'nova::db::sync_api':
+      db_sync_timeout => 600,
+    }
+
+    class { 'nova::placement':
+      auth_url    => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      password    => $admin_password,
+      region_name => lookup('CONFIG_KEYSTONE_REGION'),
+    }
+
+    $db_purge = lookup('CONFIG_NOVA_DB_PURGE_ENABLE')
+    if $db_purge {
+      class { 'nova::cron::archive_deleted_rows':
+        hour        => '*/12',
+        destination => '/dev/null',
+      }
+    }
+
+    include nova::cell_v2::simple_setup
+
+    $manage_flavors = str2bool(lookup('CONFIG_NOVA_MANAGE_FLAVORS'))
+    if $manage_flavors {
+      nova_flavor { 'm1.tiny':
+        ensure => present,
+        id     => '1',
+        ram    => '512',
+        disk   => '1',
+        vcpus  => '1',
+      }
+
+      nova_flavor { 'm1.small':
+        ensure => present,
+        id     => '2',
+        ram    => '2048',
+        disk   => '20',
+        vcpus  => '1',
+      }
+
+      nova_flavor { 'm1.medium':
+        ensure => present,
+        id     => '3',
+        ram    => '4096',
+        disk   => '40',
+        vcpus  => '2',
+      }
+
+      nova_flavor { 'm1.large':
+        ensure => present,
+        id     => '4',
+        ram    => '8192',
+        disk   => '80',
+        vcpus  => '4',
+      }
+
+      nova_flavor { 'm1.xlarge':
+        ensure => present,
+        id     => '5',
+        ram    => '16384',
+        disk   => '160',
+        vcpus  => '8',
+      }
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/cache.pp b/packstack/puppet/modules/packstack/manifests/nova/cache.pp
new file mode 100644
index 000000000..376715079
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/cache.pp
@@ -0,0 +1,14 @@
+class packstack::nova::cache ()
+{
+    $memcache_servers = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => ['[::1]:11211'],
+      default => ['127.0.0.1:11211'],
+    }
+    class { 'nova::cache':
+      enabled          => true,
+      backend          => 'dogpile.cache.pymemcache',
+      memcache_servers => $memcache_servers,
+    }
+    include packstack::memcached
+    Class['memcached'] -> Anchor['nova::service::begin']
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/ceilometer.pp b/packstack/puppet/modules/packstack/manifests/nova/ceilometer.pp
new file mode 100644
index 000000000..e004d6179
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/ceilometer.pp
@@ -0,0 +1,14 @@
+class packstack::nova::ceilometer ()
+{
+    class { 'ceilometer::agent::service_credentials':
+      auth_url     => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      password     => lookup('CONFIG_CEILOMETER_KS_PW'),
+      region_name  => lookup('CONFIG_KEYSTONE_REGION'),
+    }
+
+    ensure_packages(['openstack-ceilometer-ipmi'], {'ensure' => 'present'})
+
+    class { 'ceilometer::agent::polling': }
+
+    Package['openstack-ceilometer-ipmi'] -> Service['ceilometer-polling']
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/ceilometer/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/nova/ceilometer/rabbitmq.pp
new file mode 100644
index 000000000..100759e68
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/ceilometer/rabbitmq.pp
@@ -0,0 +1,38 @@
+class packstack::nova::ceilometer::rabbitmq ()
+{
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_CEILOMETER_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_CEILOMETER_SSL_CERT', undef, undef, undef)
+
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
+        owner   => 'ceilometer',
+        group   => 'ceilometer',
+        require => Package['nova-common'],
+      }
+      File[$files_to_set_owner] ~> Service<| tag == 'ceilometer-service' |>
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'ceilometer-service' |>
+
+    class { 'ceilometer::logging':
+        debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'ceilometer':
+      telemetry_secret      => lookup('CONFIG_CEILOMETER_SECRET'),
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      # for some strange reason ceilometer needs to be in nova group
+      require               => Package['nova-common'],
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/common.pp b/packstack/puppet/modules/packstack/manifests/nova/common.pp
new file mode 100644
index 000000000..f300fab76
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/common.pp
@@ -0,0 +1,6 @@
+class packstack::nova::common ()
+{
+    # Ensure Firewall changes happen before nova services start
+    # preventing a clash with rules being set by nova-compute and nova-network
+    Firewall <| |> -> Class['nova']
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/compute.pp b/packstack/puppet/modules/packstack/manifests/nova/compute.pp
new file mode 100644
index 000000000..856d32651
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/compute.pp
@@ -0,0 +1,108 @@
+class packstack::nova::compute ()
+{
+    $my_ip = choose_my_ip(lookup('HOST_LIST'))
+    $my_ip_without_dot = regsubst($my_ip, '\.', '_', 'G')
+    $qemu_rule_name = "FIREWALL_NOVA_QEMU_MIG_RULES_${my_ip_without_dot}"
+    create_resources(packstack::firewall, lookup($qemu_rule_name, undef, undef, {}))
+    create_resources(packstack::firewall, lookup('FIREWALL_NOVA_COMPUTE_RULES', undef, undef, {}))
+
+    ensure_packages(['/usr/bin/cinder'], {'ensure' => 'present'})
+    Package['/usr/bin/cinder'] -> Class['nova']
+
+    # Install the private key to be used for live migration.  This needs to be
+    # configured into libvirt/live_migration_uri in nova.conf.
+    $migrate_transport = lookup('CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL')
+    if $migrate_transport == 'ssh' {
+      ensure_packages(['openstack-nova-migration'], {'ensure' => 'present'})
+
+      file { '/etc/nova/migration/identity':
+        content => lookup('NOVA_MIGRATION_KEY_SECRET'),
+        mode    => '0600',
+        owner   => nova,
+        group   => nova,
+        require => Package['openstack-nova-migration'],
+      }
+
+      $key_type = lookup('NOVA_MIGRATION_KEY_TYPE')
+      $key_content = lookup('NOVA_MIGRATION_KEY_PUBLIC')
+
+      file { '/etc/nova/migration/authorized_keys':
+        content => "${key_type} ${key_content}",
+        mode    => '0640',
+        owner   => root,
+        group   => nova_migration,
+        require => Package['openstack-nova-migration'],
+      }
+
+      augeas{'Match block for user nova_migration':
+        context => '/files/etc/ssh/sshd_config',
+        changes => [
+          'set Match[User nova_migration]/Condition/User nova_migration',
+          'set Match[Condition/User = "nova_migration"]/Settings/AllowTcpForwarding no',
+          'set Match[Condition/User = "nova_migration"]/Settings/AuthorizedKeysFile /etc/nova/migration/authorized_keys',
+          'set Match[Condition/User = "nova_migration"]/Settings/ForceCommand /bin/nova-migration-wrapper',
+          'set Match[Condition/User = "nova_migration"]/Settings/PasswordAuthentication no',
+          'set Match[Condition/User = "nova_migration"]/Settings/X11Forwarding no',
+        ],
+        onlyif  => 'match Match[Condition/User = "nova_migration"] size == 0',
+        notify  => Service['sshd']
+      }
+
+      service {'sshd':
+        ensure  => running,
+      }
+    }
+
+    if ($facts['networking']['fqdn'] == '' or $facts['networking']['fqdn'] =~ /localhost/) {
+      # For cases where FQDNs have not been correctly set
+      $vncproxy_server = choose_my_ip(lookup('HOST_LIST'))
+    } else {
+      $vncproxy_server = $facts['networking']['fqdn']
+    }
+
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+      $instance_usage_audit = true
+      $instance_usage_audit_period = 'hour'
+    } else {
+      $instance_usage_audit = false
+      $instance_usage_audit_period = 'month'
+    }
+
+    class { 'nova::compute::pci':
+      passthrough => parsejson(lookup('CONFIG_NOVA_PCI_PASSTHROUGH_WHITELIST'))
+    }
+
+    class { 'nova::compute':
+      enabled                       => true,
+      vncproxy_host                 => lookup('CONFIG_KEYSTONE_HOST_URL'),
+      vncproxy_protocol             => lookup('CONFIG_VNCPROXY_PROTOCOL'),
+      vncserver_proxyclient_address => $vncproxy_server,
+      instance_usage_audit          => $instance_usage_audit,
+      instance_usage_audit_period   => $instance_usage_audit_period,
+      force_config_drive            => false,
+      mkisofs_cmd                   => 'mkisofs',
+    }
+
+    class { 'nova::placement':
+      auth_url    => lookup('CONFIG_KEYSTONE_PUBLIC_URL'),
+      password    => lookup('CONFIG_NOVA_KS_PW'),
+      region_name => lookup('CONFIG_KEYSTONE_REGION'),
+    }
+
+    # Tune the host with a virtual hosts profile
+    ensure_packages(['tuned'], {'ensure' => 'present'})
+
+    service { 'tuned':
+      ensure  => running,
+      require => Package['tuned'],
+    }
+
+    # tries/try_sleep to try and circumvent rhbz1320744
+    exec { 'tuned-virtual-host':
+      unless    => '/usr/sbin/tuned-adm active | /bin/grep virtual-host',
+      command   => '/usr/sbin/tuned-adm profile virtual-host',
+      require   => Service['tuned'],
+      tries     => 3,
+      try_sleep => 5
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/compute/ironic.pp b/packstack/puppet/modules/packstack/manifests/nova/compute/ironic.pp
new file mode 100644
index 000000000..034ad7fa4
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/compute/ironic.pp
@@ -0,0 +1,15 @@
+class packstack::nova::compute::ironic ()
+{
+  $ironic_config_controller_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+  $ironic_config_keystone_admin = lookup('CONFIG_KEYSTONE_ADMIN_URL')
+
+  class { 'nova::ironic::common':
+      username     => 'ironic',
+      password     => lookup('CONFIG_IRONIC_KS_PW'),
+      auth_url     => $ironic_config_keystone_admin,
+      project_name => 'services',
+      api_endpoint => "http://${ironic_config_controller_host}:6385/v1",
+  }
+
+   include nova::compute::ironic
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/compute/libvirt.pp b/packstack/puppet/modules/packstack/manifests/nova/compute/libvirt.pp
new file mode 100644
index 000000000..04b3c57be
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/compute/libvirt.pp
@@ -0,0 +1,82 @@
+class packstack::nova::compute::libvirt ()
+{
+    # Ensure Firewall changes happen before libvirt service start
+    # preventing a clash with rules being set by libvirt
+    Firewall <| |> -> Class['::nova::compute::libvirt']
+
+    $libvirt_vnc_bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    $libvirt_virt_type = lookup('CONFIG_NOVA_LIBVIRT_VIRT_TYPE')
+    if $libvirt_virt_type == 'kvm' {
+        # Workaround for bad /dev/kvm permissions
+        # https://bugzilla.redhat.com/show_bug.cgi?id=950436
+        file { '/dev/kvm':
+          owner => 'root',
+          group => 'kvm',
+          mode  => '0666',
+        }
+
+        # We have to fix the permissions after the installation has been done
+        # and before the service is started.
+        Package <| title == 'libvirt' |>
+        -> File['/dev/kvm']
+        -> Service <| title == 'libvirt' |>
+    }
+
+    $migrate_transport = lookup('CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL')
+    if $migrate_transport == 'ssh' {
+      $client_extraparams = {
+        keyfile   => '/etc/nova/migration/identity',
+      }
+    } else {
+      $client_extraparams = {}
+    }
+
+    class { 'nova::migration::libvirt':
+      transport          => $migrate_transport,
+      client_user        => 'nova_migration',
+      client_extraparams => $client_extraparams,
+      require            => Class['::nova::compute::libvirt']
+    }
+
+    class { 'nova::compute::libvirt':
+      virt_type         => $libvirt_virt_type,
+      vncserver_listen  => $libvirt_vnc_bind_host,
+      migration_support => true,
+    }
+
+    # Remove libvirt's default network (usually virbr0) as it's unnecessary and
+    # can be confusing
+    exec {'virsh-net-destroy-default':
+      onlyif  => '/usr/bin/virsh net-list | grep default',
+      command => '/usr/bin/virsh net-destroy default',
+      require => Service['libvirt'],
+    }
+
+    exec {'virsh-net-undefine-default':
+      onlyif  => '/usr/bin/virsh net-list --inactive | grep default',
+      command => '/usr/bin/virsh net-undefine default',
+      require => Exec['virsh-net-destroy-default'],
+    }
+
+    $libvirt_debug = lookup('CONFIG_DEBUG_MODE')
+    if $libvirt_debug {
+      file_line { '/etc/libvirt/libvirt.conf log_filters':
+        path   => '/etc/libvirt/libvirtd.conf',
+        line   => 'log_filters = "1:libvirt 1:qemu 1:conf 1:security 3:event 3:json 3:file 1:util"',
+        match  => 'log_filters =',
+        notify => Service['libvirt'],
+      }
+
+      file_line { '/etc/libvirt/libvirt.conf log_outputs':
+        path   => '/etc/libvirt/libvirtd.conf',
+        line   => 'log_outputs = "1:file:/var/log/libvirt/libvirtd.log"',
+        match  => 'log_outputs =',
+        notify => Service['libvirt'],
+      }
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/compute/vmware.pp b/packstack/puppet/modules/packstack/manifests/nova/compute/vmware.pp
new file mode 100644
index 000000000..02a6d4c94
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/compute/vmware.pp
@@ -0,0 +1,13 @@
+class packstack::nova::compute::vmware ()
+{
+    $cluster_list = lookup('CONFIG_VCENTER_CLUSTERS')
+    $my_ip = choose_my_ip(lookup('HOST_LIST'))
+    $nova_vcenter_cluster_name = $cluster_list[$my_ip]
+
+    class { 'nova::compute::vmware':
+      host_ip       => lookup('CONFIG_VCENTER_HOST'),
+      host_username => lookup('CONFIG_VCENTER_USER'),
+      host_password => lookup('CONFIG_VCENTER_PASSWORD'),
+      cluster_name  => $nova_vcenter_cluster_name,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/conductor.pp b/packstack/puppet/modules/packstack/manifests/nova/conductor.pp
new file mode 100644
index 000000000..0dc14a46a
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/conductor.pp
@@ -0,0 +1,11 @@
+class packstack::nova::conductor ()
+{
+    include packstack::nova::cache
+    class { 'nova::conductor':
+      enabled => true,
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    Keystone_endpoint <||> -> Service['nova-conductor']
+    Keystone_service <||> -> Service['nova-conductor']
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/neutron.pp b/packstack/puppet/modules/packstack/manifests/nova/neutron.pp
new file mode 100644
index 000000000..402d6e451
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/neutron.pp
@@ -0,0 +1,14 @@
+class packstack::nova::neutron ()
+{
+    $nova_neutron_cfg_ctrl_host = lookup('CONFIG_KEYSTONE_HOST_URL')
+    $neutron_auth_url = lookup('CONFIG_KEYSTONE_ADMIN_URL')
+
+    class { 'nova::network::neutron':
+      default_floating_pool => 'public',
+      password              => lookup('CONFIG_NEUTRON_KS_PW'),
+      auth_type             => 'v3password',
+      project_name          => 'services',
+      auth_url              => "${neutron_auth_url}/v3",
+      region_name           => lookup('CONFIG_KEYSTONE_REGION'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/nfs.pp b/packstack/puppet/modules/packstack/manifests/nova/nfs.pp
new file mode 100644
index 000000000..36397d8f7
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/nfs.pp
@@ -0,0 +1,4 @@
+class packstack::nova::nfs ()
+{
+  ensure_packages(['nfs-utils'], {'ensure' => 'present'})
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/sched.pp b/packstack/puppet/modules/packstack/manifests/nova/sched.pp
new file mode 100644
index 000000000..aed1a5007
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/sched.pp
@@ -0,0 +1,12 @@
+class packstack::nova::sched ()
+{
+    include packstack::nova::cache
+    include nova::scheduler::filter
+    class { 'nova::scheduler':
+      enabled => true,
+    }
+
+    Keystone_endpoint <||> -> Service['nova-scheduler']
+    Keystone_service <||> -> Service['nova-scheduler']
+
+}
diff --git a/packstack/puppet/modules/packstack/manifests/nova/sched/ironic.pp b/packstack/puppet/modules/packstack/manifests/nova/sched/ironic.pp
new file mode 100644
index 000000000..5a1633e4d
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/sched/ironic.pp
@@ -0,0 +1,6 @@
+class packstack::nova::sched::ironic ()
+{
+  class { 'nova::scheduler':
+    enabled => true,
+  }
+}
\ No newline at end of file
diff --git a/packstack/puppet/modules/packstack/manifests/nova/vncproxy.pp b/packstack/puppet/modules/packstack/manifests/nova/vncproxy.pp
new file mode 100644
index 000000000..83bf2afbf
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/nova/vncproxy.pp
@@ -0,0 +1,19 @@
+class packstack::nova::vncproxy ()
+{
+    $vnc_bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    class { 'nova::vncproxy':
+      enabled => true,
+      host    => $vnc_bind_host,
+    }
+
+    firewall { '001 novncproxy incoming':
+      proto  => 'tcp',
+      dport  => ['6080'],
+      jump   => 'accept',
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/openstackclient.pp b/packstack/puppet/modules/packstack/manifests/openstackclient.pp
new file mode 100644
index 000000000..b91d40f37
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/openstackclient.pp
@@ -0,0 +1,94 @@
+class packstack::openstackclient ()
+{
+    $clientlibs = ['/usr/bin/nova',
+      '/usr/bin/glance',
+      '/usr/bin/cinder', '/usr/bin/openstack']
+
+    ensure_packages($clientlibs, {'ensure' => 'present'})
+
+    if lookup('CONFIG_MANILA_INSTALL') == 'y' {
+      ensure_packages(['/usr/bin/manila'], {'ensure' => 'present'})
+    }
+
+    $ost_cl_keystone_admin_username = lookup('CONFIG_KEYSTONE_ADMIN_USERNAME')
+    $ost_cl_keystone_admin_pw       = lookup('CONFIG_KEYSTONE_ADMIN_PW')
+    $ost_cl_ctrl_keystone_url       = lookup('CONFIG_KEYSTONE_PUBLIC_URL')
+    $ost_cl_keystone_region         = lookup('CONFIG_KEYSTONE_REGION')
+    $ost_cl_keystone_demo_pw        = lookup('CONFIG_KEYSTONE_DEMO_PW')
+
+    $config_keystone_api_version = lookup('CONFIG_KEYSTONE_API_VERSION')
+    if $config_keystone_api_version =~ /^v(\d+).*$/ {
+      # we need to force integer here
+      $int_api_version = 0 + $1
+    } else {
+      fail("${config_keystone_api_version} is an incorrect Keystone API Version!")
+    }
+
+    $rcadmin_common_content = "unset OS_SERVICE_TOKEN
+export OS_USERNAME=${ost_cl_keystone_admin_username}
+export OS_PASSWORD='${ost_cl_keystone_admin_pw}'
+export OS_REGION_NAME=${ost_cl_keystone_region}
+export OS_AUTH_URL=${ost_cl_ctrl_keystone_url}
+export PS1='[\\u@\\h \\W(keystone_admin)]\\$ '
+"
+
+    if $int_api_version < 3 {
+      $rcadmin_content = "${rcadmin_common_content}
+export OS_TENANT_NAME=admin
+"
+    }
+    else {
+        $rcadmin_content = "${rcadmin_common_content}
+export OS_PROJECT_NAME=admin
+export OS_USER_DOMAIN_NAME=Default
+export OS_PROJECT_DOMAIN_NAME=Default
+export OS_IDENTITY_API_VERSION=${int_api_version}
+"
+    }
+
+    file { "${::home_dir}/keystonerc_admin":
+      ensure  => file,
+      mode    => '0600',
+      content => $rcadmin_content,
+    }
+
+    if lookup('CONFIG_PROVISION_DEMO') == 'y' {
+      $demo_common_content = "unset OS_SERVICE_TOKEN
+export OS_USERNAME=demo
+export OS_PASSWORD='${ost_cl_keystone_demo_pw}'
+export PS1='[\\u@\\h \\W(keystone_demo)]\\$ '
+export OS_AUTH_URL=${ost_cl_ctrl_keystone_url}
+"
+
+      if $int_api_version < 3 {
+        $demo_content = "${demo_common_content}
+export OS_TENANT_NAME=demo
+export OS_IDENTITY_API_VERSION=${int_api_version}.0
+"
+      } else {
+        $demo_content = "${demo_common_content}
+export OS_PROJECT_NAME=demo
+export OS_USER_DOMAIN_NAME=Default
+export OS_PROJECT_DOMAIN_NAME=Default
+export OS_IDENTITY_API_VERSION=${int_api_version}
+"
+      }
+
+      file { "${::home_dir}/keystonerc_demo":
+        ensure  => file,
+        mode    => '0600',
+        content => $demo_content,
+      }
+    }
+
+    if lookup('NO_ROOT_USER_ALLINONE') == true {
+      $ost_cl_home_dir = lookup('HOME_DIR')
+      file { "${ost_cl_home_dir}/keystonerc_admin":
+        ensure  => file,
+        owner   => lookup('NO_ROOT_USER'),
+        group   => lookup('NO_ROOT_GROUP'),
+        mode    => '0600',
+        content => $rcadmin_content,
+      }
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/placement.pp b/packstack/puppet/modules/packstack/manifests/placement.pp
new file mode 100644
index 000000000..fd462c319
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/placement.pp
@@ -0,0 +1,35 @@
+class packstack::placement ()
+{
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    include packstack::keystone::placement
+    include placement
+
+    class { 'placement::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'placement::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'placement',
+        'password' => lookup('CONFIG_NOVA_DB_PW'),
+        'database' => 'placement',
+      })
+    }
+    include placement::db::sync
+
+    class { 'placement::api':
+      api_service_name => 'httpd',
+    }
+    class { 'placement::wsgi::apache':
+      bind_host => $bind_host,
+      ssl       => false,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/prereqs.pp b/packstack/puppet/modules/packstack/manifests/prereqs.pp
new file mode 100644
index 000000000..5bd39ed52
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/prereqs.pp
@@ -0,0 +1,18 @@
+class packstack::prereqs ()
+{
+    package{ 'openstack-selinux':
+      ensure => present,
+    }
+
+    package { 'sos':
+      ensure => present,
+    }
+
+    package { 'audit':
+      ensure => present,
+    }
+    -> service { 'auditd':
+      ensure => running,
+      enable => true,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/provision.pp b/packstack/puppet/modules/packstack/manifests/provision.pp
new file mode 100644
index 000000000..fda848129
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/provision.pp
@@ -0,0 +1,98 @@
+class packstack::provision ()
+{
+    $provision_demo            = str2bool(lookup('CONFIG_PROVISION_DEMO'))
+    $provision_tempest         = str2bool(lookup('CONFIG_PROVISION_TEMPEST'))
+    $provision_neutron         = str2bool(lookup('CONFIG_NEUTRON_INSTALL'))
+    $heat_available            = str2bool(lookup('CONFIG_HEAT_INSTALL'))
+
+    if $provision_demo {
+      $username             = 'demo'
+      $password             = lookup('CONFIG_KEYSTONE_DEMO_PW')
+      $project_name         = 'demo'
+      $floating_range       = lookup('CONFIG_PROVISION_DEMO_FLOATRANGE')
+      $allocation_pools     = lookup('CONFIG_PROVISION_DEMO_ALLOCATION_POOLS')
+    } elsif $provision_tempest {
+      $username             = lookup('CONFIG_PROVISION_TEMPEST_USER')
+      $password             = lookup('CONFIG_PROVISION_TEMPEST_USER_PW')
+      $project_name         = 'tempest'
+      $floating_range       = lookup('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
+      $allocation_pools     = []
+      if (empty($username) or empty($password)) {
+        fail("Both CONFIG_PROVISION_TEMPEST_USER and
+        CONFIG_PROVISION_TEMPEST_USER_PW need to be configured.")
+      }
+    }
+
+    if $provision_demo or $provision_tempest {
+
+      # Keystone
+      $admin_project_name = 'admin'
+      keystone_tenant { $project_name:
+        ensure      => present,
+        enabled     => true,
+        description => 'default tenant',
+      }
+
+      keystone_user { $username:
+        ensure   => present,
+        enabled  => true,
+        password => $password,
+      }
+
+      keystone_user_role { "${username}@${project_name}":
+        ensure => present,
+        roles  => ['member'],
+      }
+
+      ## Neutron
+      if $provision_neutron {
+        $public_network_name  = 'public'
+        $public_subnet_name   = 'public_subnet'
+        $private_network_name = 'private'
+        $private_subnet_name  = 'private_subnet'
+        $fixed_range          = '10.0.0.0/24'
+        $router_name          = 'router1'
+        $public_physnet       = lookup('CONFIG_NEUTRON_OVS_EXTERNAL_PHYSNET')
+
+        $neutron_deps = [Neutron_network[$public_network_name]]
+
+        neutron_network { $public_network_name:
+          ensure                    => present,
+          router_external           => true,
+          project_name              => $admin_project_name,
+          provider_network_type     => 'flat',
+          provider_physical_network => $public_physnet,
+        }
+        neutron_subnet { $public_subnet_name:
+          ensure           => 'present',
+          cidr             => $floating_range,
+          allocation_pools => $allocation_pools,
+          enable_dhcp      => false,
+          network_name     => $public_network_name,
+          project_name     => $admin_project_name,
+        }
+        neutron_network { $private_network_name:
+          ensure       => present,
+          project_name => $project_name,
+        }
+        neutron_subnet { $private_subnet_name:
+          ensure        => present,
+          cidr          => $fixed_range,
+          network_name  => $private_network_name,
+          project_name  => $project_name,
+        }
+        # Tenant-owned router - assumes network namespace isolation
+        neutron_router { $router_name:
+          ensure               => present,
+          project_name         => $project_name,
+          gateway_network_name => $public_network_name,
+          # A neutron_router resource must explicitly declare a dependency on
+          # the first subnet of the gateway network.
+          require              => Neutron_subnet[$public_subnet_name],
+        }
+        neutron_router_interface { "${router_name}:${private_subnet_name}":
+          ensure => present,
+        }
+      }
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/provision/bridge.pp b/packstack/puppet/modules/packstack/manifests/provision/bridge.pp
new file mode 100644
index 000000000..9daa8ccc1
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/provision/bridge.pp
@@ -0,0 +1,51 @@
+class packstack::provision::bridge ()
+{
+    $provision_neutron_br    = str2bool(lookup('CONFIG_NEUTRON_INSTALL'))
+    $setup_ovs_bridge        = str2bool(lookup('CONFIG_PROVISION_OVS_BRIDGE'))
+    $public_bridge_name      = lookup('CONFIG_NEUTRON_L3_EXT_BRIDGE', undef, undef, 'br-ex')
+    $provision_tempest_br    = str2bool(lookup('CONFIG_PROVISION_TEMPEST'))
+    $provision_demo_br       = str2bool(lookup('CONFIG_PROVISION_DEMO'))
+
+    $neutron_user_password   = lookup('CONFIG_NEUTRON_KS_PW')
+
+    if $provision_demo_br {
+      $floating_range_br = lookup('CONFIG_PROVISION_DEMO_FLOATRANGE')
+    } elsif $provision_tempest_br {
+      $floating_range_br = lookup('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
+    }
+
+    if $provision_neutron_br and $setup_ovs_bridge {
+      Neutron_config<||> -> Neutron_l3_ovs_bridge['demo_bridge']
+      neutron_l3_ovs_bridge { 'demo_bridge':
+        ensure      => present,
+        name        => $public_bridge_name,
+        subnet_name => 'public_subnet',
+      }
+
+      firewall { '000 nat':
+        chain    => 'POSTROUTING',
+        jump     => 'MASQUERADE',
+        source   => $floating_range_br,
+        outiface => $facts['gateway_device'],
+        table    => 'nat',
+        proto    => 'all',
+      }
+
+
+      if $public_bridge_name != '' {
+        firewall { '000 forward out':
+          chain    => 'FORWARD',
+          jump     => 'accept',
+          outiface => $public_bridge_name,
+          proto    => 'all',
+        }
+
+        firewall { '000 forward in':
+          chain   => 'FORWARD',
+          jump    => 'accept',
+          iniface => $public_bridge_name,
+          proto   => 'all',
+        }
+      }
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/provision/glance.pp b/packstack/puppet/modules/packstack/manifests/provision/glance.pp
new file mode 100644
index 000000000..dbe4863de
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/provision/glance.pp
@@ -0,0 +1,16 @@
+class packstack::provision::glance ()
+{
+    $image_name       = lookup('CONFIG_PROVISION_IMAGE_NAME')
+    $image_source     = lookup('CONFIG_PROVISION_IMAGE_URL')
+    $image_format     = lookup('CONFIG_PROVISION_IMAGE_FORMAT')
+    $image_properties = lookup('CONFIG_PROVISION_IMAGE_PROPERTIES')
+
+    glance_image { $image_name:
+      ensure           => present,
+      is_public        => 'yes',
+      container_format => 'bare',
+      disk_format      => $image_format,
+      source           => $image_source,
+      properties       => parse_hash_from_string($image_properties)
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/provision/tempest.pp b/packstack/puppet/modules/packstack/manifests/provision/tempest.pp
new file mode 100644
index 000000000..85cd95a7f
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/provision/tempest.pp
@@ -0,0 +1,144 @@
+class packstack::provision::tempest ()
+{
+    $provision_demo         = str2bool(lookup('CONFIG_PROVISION_DEMO'))
+    if $provision_demo {
+      $username             = 'demo'
+      $password             = lookup('CONFIG_KEYSTONE_DEMO_PW')
+      $project_name         = 'demo'
+      $floating_range       = lookup('CONFIG_PROVISION_DEMO_FLOATRANGE')
+    } else {
+      $username             = lookup('CONFIG_PROVISION_TEMPEST_USER')
+      $password             = lookup('CONFIG_PROVISION_TEMPEST_USER_PW')
+      $project_name         = 'tempest'
+      $floating_range       = lookup('CONFIG_PROVISION_TEMPEST_FLOATRANGE')
+    }
+
+    # Authentication/Keystone
+    $identity_uri_v3       = lookup('CONFIG_KEYSTONE_PUBLIC_URL')
+    $admin_username        = lookup('CONFIG_KEYSTONE_ADMIN_USERNAME')
+    $admin_password        = lookup('CONFIG_KEYSTONE_ADMIN_PW')
+    $admin_project_name    = 'admin'
+    $admin_domain_name     = 'Default'
+
+    # get image and network id
+    $configure_images          = true
+    $configure_networks        = true
+
+    # Image
+    $image_ssh_user     = lookup('CONFIG_PROVISION_IMAGE_SSH_USER')
+    $image_name         = lookup('CONFIG_PROVISION_IMAGE_NAME')
+    $image_alt_ssh_user = lookup('CONFIG_PROVISION_IMAGE_SSH_USER')
+    $image_source       = lookup('CONFIG_PROVISION_IMAGE_URL')
+    $image_format       = lookup('CONFIG_PROVISION_IMAGE_FORMAT')
+
+    # network name
+    $public_network_name = 'public'
+
+    # nova should be able to resize with packstack setup
+    $resize_available          = true
+
+    $use_dynamic_credentials   = true
+    $dir_log                   = lookup('DIR_LOG')
+    $log_file                  = "${dir_log}/tempest.log"
+    $use_stderr                = false
+    $debug                     = true
+    $public_router_id          = undef
+
+    # Tempest
+    $tempest_workspace    = '/var/lib/tempest'
+    $tempest_user          = lookup('CONFIG_PROVISION_TEMPEST_USER')
+    $tempest_password      = lookup('CONFIG_PROVISION_TEMPEST_USER_PW')
+
+    $tempest_flavor_name = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_NAME')
+    $tempest_flavor_ref  = '42'
+    $tempest_flavor_ram  = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_RAM')
+    $tempest_flavor_disk = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_DISK')
+    $tempest_flavor_vcpus= lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_VCPUS')
+
+    $tempest_flavor_alt_name = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_NAME')
+    $tempest_flavor_alt_ref  = '84'
+    $tempest_flavor_alt_ram  = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_RAM')
+    $tempest_flavor_alt_disk = lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_DISK')
+    $tempest_flavor_alt_vcpus= lookup('CONFIG_PROVISION_TEMPEST_FLAVOR_ALT_VCPUS')
+
+    nova_flavor { $tempest_flavor_name :
+      ensure => present,
+      id     => $tempest_flavor_ref,
+      ram    => $tempest_flavor_ram,
+      disk   => $tempest_flavor_disk,
+      vcpus  => $tempest_flavor_vcpus,
+    }
+    nova_flavor { $tempest_flavor_alt_name :
+      ensure => present,
+      id     => $tempest_flavor_alt_ref,
+      ram    => $tempest_flavor_alt_ram,
+      disk   => $tempest_flavor_alt_disk,
+      vcpus  => $tempest_flavor_alt_vcpus,
+    }
+
+    # Service availability for testing based on configuration
+    $cinder_available     = str2bool(lookup('CONFIG_CINDER_INSTALL'))
+    $glance_available     = str2bool(lookup('CONFIG_GLANCE_INSTALL'))
+    $horizon_available    = str2bool(lookup('CONFIG_HORIZON_INSTALL'))
+    $nova_available       = str2bool(lookup('CONFIG_NOVA_INSTALL'))
+    $neutron_available    = str2bool(lookup('CONFIG_NEUTRON_INSTALL'))
+    $ceilometer_available = str2bool(lookup('CONFIG_CEILOMETER_INSTALL'))
+    $aodh_available       = str2bool(lookup('CONFIG_AODH_INSTALL'))
+    $trove_available      = str2bool(lookup('CONFIG_TROVE_INSTALL'))
+    $heat_available       = str2bool(lookup('CONFIG_HEAT_INSTALL'))
+    $swift_available      = str2bool(lookup('CONFIG_SWIFT_INSTALL'))
+    $configure_tempest    = str2bool(lookup('CONFIG_PROVISION_TEMPEST'))
+
+    # Some API extensions as l3_agent_scheduler are not enabled by OVN plugin
+    $l2_agent  = lookup('CONFIG_NEUTRON_L2_AGENT')
+    if $l2_agent == 'ovn' {
+      $neutron_api_extensions = 'ext-gw-mode,binding,agent,external-net,quotas,provider,extraroute,router,extra_dhcp_opt,allowed-address-pairs,security-group,trunk'
+    } else {
+      $neutron_api_extensions = undef
+    }
+
+    class { 'tempest':
+      admin_domain_name         => $admin_domain_name,
+      admin_password            => $admin_password,
+      admin_project_name        => $admin_project_name,
+      admin_username            => $admin_username,
+      use_dynamic_credentials   => $use_dynamic_credentials,
+      aodh_available            => $aodh_available,
+      ceilometer_available      => $ceilometer_available,
+      cinder_available          => $cinder_available,
+      configure_images          => $configure_images,
+      configure_networks        => $configure_networks,
+      debug                     => $debug,
+      flavor_ref                => $tempest_flavor_ref,
+      flavor_ref_alt            => $tempest_flavor_alt_ref,
+      glance_available          => $glance_available,
+      heat_available            => $heat_available,
+      horizon_available         => $horizon_available,
+      identity_uri_v3           => $identity_uri_v3,
+      image_alt_ssh_user        => $image_alt_ssh_user,
+      image_name_alt            => $image_name,
+      image_name                => $image_name,
+      image_ssh_user            => $image_ssh_user,
+      run_ssh                   => true,
+      log_file                  => $log_file,
+      neutron_available         => $neutron_available,
+      nova_available            => $nova_available,
+      password                  => $password,
+      public_network_name       => $public_network_name,
+      public_router_id          => $public_router_id,
+      resize_available          => $resize_available,
+      swift_available           => $swift_available,
+      tempest_workspace         => $tempest_workspace,
+      install_from_source       => false,
+      project_name              => $project_name,
+      trove_available           => $trove_available,
+      username                  => $username,
+      use_stderr                => $use_stderr,
+      neutron_api_extensions    => $neutron_api_extensions,
+    }
+
+    tempest_config { 'object-storage/operator_role':
+      value => 'SwiftOperator',
+      path  => "${tempest_workspace}/etc/tempest.conf",
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/redis.pp b/packstack/puppet/modules/packstack/manifests/redis.pp
new file mode 100644
index 000000000..07d50554d
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/redis.pp
@@ -0,0 +1,15 @@
+class packstack::redis ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_REDIS_RULES', undef, undef, {}))
+
+    $redis_port = Integer(lookup('CONFIG_REDIS_PORT'))
+    $redis_host = lookup('CONFIG_REDIS_HOST')
+
+    class { 'redis':
+      bind           => $redis_host,
+      port           => $redis_port,
+      appendonly     => true,
+      daemonize      => false,
+      unixsocket     => '',
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/swift.pp b/packstack/puppet/modules/packstack/manifests/swift.pp
new file mode 100644
index 000000000..f6904a297
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/swift.pp
@@ -0,0 +1,10 @@
+class packstack::swift ()
+{
+    # Class['swift'] -> Service <| |>
+
+    class { 'swift':
+      # not sure how I want to deal with this shared secret
+      swift_hash_path_suffix => lookup('CONFIG_SWIFT_HASH'),
+      package_ensure         => latest,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/swift/ceilometer.pp b/packstack/puppet/modules/packstack/manifests/swift/ceilometer.pp
new file mode 100644
index 000000000..fe825d764
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/swift/ceilometer.pp
@@ -0,0 +1,20 @@
+class packstack::swift::ceilometer ()
+{
+    Service<| name == 'rabbitmq-server' |> -> Service['swift-proxy-server']
+
+    class { 'swift::proxy::ceilometer':
+      default_transport_url => os_transport_url({
+        'transport' => 'rabbit',
+        'host'      => lookup('CONFIG_AMQP_HOST_URL'),
+        'port'      => lookup('CONFIG_AMQP_CLIENTS_PORT'),
+        'username'  => lookup('CONFIG_AMQP_AUTH_USER'),
+        'password'  => lookup('CONFIG_AMQP_AUTH_PASSWORD')
+      }),
+      topic                 => 'notifications',
+      control_exchange      => 'swift',
+      driver                => 'messaging',
+      ignore_projects       => ['service'],
+      auth_url              => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+      password              => lookup('CONFIG_SWIFT_KS_PW'),
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/swift/fs.pp b/packstack/puppet/modules/packstack/manifests/swift/fs.pp
new file mode 100644
index 000000000..e6e37939f
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/swift/fs.pp
@@ -0,0 +1,12 @@
+define packstack::swift::fs (
+  $device,
+  $dev,
+  $fstype
+)
+{
+  case $fstype {
+    'xfs':   { swift::storage::xfs {$device: device => $dev }  }
+    'ext4':  { swift::storage::ext4 {$device: device => $dev }  }
+    default: { fail('Unsupported fs for Swift storage') }
+  }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/swift/proxy.pp b/packstack/puppet/modules/packstack/manifests/swift/proxy.pp
new file mode 100644
index 000000000..d608c1abe
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/swift/proxy.pp
@@ -0,0 +1,120 @@
+class packstack::swift::proxy ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_SWIFT_PROXY_RULES', undef, undef, {}))
+    ensure_packages(['curl'], {'ensure' => 'present'})
+
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    include packstack::memcached
+
+    if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' and
+      lookup('CONFIG_ENABLE_CEILOMETER_MIDDLEWARE') == 'y' {
+      $swift_pipeline = [
+        'catch_errors',
+        'gatekeeper',
+        'healthcheck',
+        'proxy-logging',
+        'cache',
+        'listing_formats',
+        'bulk',
+        'tempurl',
+        'ratelimit',
+        'crossdomain',
+        'authtoken',
+        'keystone',
+        'formpost',
+        'staticweb',
+        'copy',
+        'container_quotas',
+        'account_quotas',
+        'slo',
+        'dlo',
+        'ceilometer',
+        'proxy-logging',
+        'proxy-server',
+      ]
+    } else {
+      $swift_pipeline = [
+        'catch_errors',
+        'gatekeeper',
+        'healthcheck',
+        'proxy-logging',
+        'cache',
+        'listing_formats',
+        'bulk',
+        'tempurl',
+        'ratelimit',
+        'crossdomain',
+        'authtoken',
+        'keystone',
+        'formpost',
+        'staticweb',
+        'copy',
+        'container_quotas',
+        'account_quotas',
+        'slo',
+        'dlo',
+        'proxy-logging',
+        'proxy-server',
+      ]
+    }
+
+    class { 'swift::proxy':
+      # swift seems to require ipv6 address without brackets
+      proxy_local_net_ip => lookup('CONFIG_STORAGE_HOST'),
+      pipeline           => $swift_pipeline,
+      account_autocreate => true,
+      workers            => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    # configure all of the middlewares
+    class { [
+      'swift::proxy::catch_errors',
+      'swift::proxy::gatekeeper',
+      'swift::proxy::healthcheck',
+      'swift::proxy::proxy_logging',
+      'swift::proxy::listing_formats',
+      'swift::proxy::bulk',
+      'swift::proxy::tempurl',
+      'swift::proxy::ratelimit',
+      'swift::proxy::crossdomain',
+      'swift::proxy::formpost',
+      'swift::proxy::staticweb',
+      'swift::proxy::copy',
+      'swift::proxy::container_quotas',
+      'swift::proxy::account_quotas',
+      'swift::proxy::slo',
+      'swift::proxy::dlo',
+    ]: }
+
+    $memcache_servers = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => ['[::1]:11211'],
+      default => ['127.0.0.1:11211'],
+    }
+    class {'swift::proxy::cache':
+      memcache_servers => $memcache_servers,
+    }
+
+    class { 'swift::proxy::keystone':
+      operator_roles => ['admin', 'SwiftOperator', 'member'],
+    }
+
+    class { 'swift::proxy::authtoken':
+      password             => lookup('CONFIG_SWIFT_KS_PW'),
+      # assume that the controller host is the swift api server
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
+
+    class { 'swift::proxy::versioned_writes':
+      allow_versioned_writes => true,
+    }
+
+    class { 'swift::objectexpirer':
+      memcache_servers => $memcache_servers,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/swift/ringbuilder.pp b/packstack/puppet/modules/packstack/manifests/swift/ringbuilder.pp
new file mode 100644
index 000000000..359fb2061
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/swift/ringbuilder.pp
@@ -0,0 +1,25 @@
+class packstack::swift::ringbuilder ()
+{
+    class { 'swift::ringbuilder':
+      part_power     => '18',
+      replicas       => lookup('CONFIG_SWIFT_STORAGE_REPLICAS'),
+      min_part_hours => 1,
+      require        => Class['swift'],
+    }
+
+    # sets up an rsync db that can be used to sync the ring DB
+    class { 'swift::ringserver':
+      local_net_ip => lookup('CONFIG_STORAGE_HOST_URL'),
+    }
+
+    if str2bool($::selinux) {
+      selboolean { 'rsync_export_all_ro':
+        value      => on,
+        persistent => true,
+      }
+    }
+
+    create_resources(ring_account_device, lookup('SWIFT_RING_ACCOUNT_DEVICES', undef, undef, {}))
+    create_resources(ring_object_device, lookup('SWIFT_RING_OBJECT_DEVICES', undef, undef, {}))
+    create_resources(ring_container_device, lookup('SWIFT_RING_CONTAINER_DEVICES', undef, undef, {}))
+}
diff --git a/packstack/puppet/modules/packstack/manifests/swift/storage.pp b/packstack/puppet/modules/packstack/manifests/swift/storage.pp
new file mode 100644
index 000000000..0bfaec754
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/swift/storage.pp
@@ -0,0 +1,39 @@
+class packstack::swift::storage ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_SWIFT_STORAGE_RULES', undef, undef, {}))
+
+    # install all swift storage servers together
+    class { 'swift::storage::all':
+      # looks like ipv6 address without brackets is required here
+      storage_local_net_ip => lookup('CONFIG_STORAGE_HOST'),
+      require              => Class['swift'],
+    }
+
+    if (!defined(File['/srv/node'])) {
+      file { '/srv/node':
+        ensure  => directory,
+        owner   => 'swift',
+        group   => 'swift',
+        require => Package['swift'],
+      }
+    }
+
+    swift::ringsync{ ['account', 'container', 'object']:
+      ring_server => lookup('CONFIG_STORAGE_HOST_URL'),
+      before      => Class['swift::storage::all'],
+      require     => Class['swift'],
+    }
+
+    if lookup('CONFIG_SWIFT_LOOPBACK') == 'y' {
+      swift::storage::loopback { 'swiftloopback':
+        base_dir     => '/srv/loopback-device',
+        mnt_base_dir => '/srv/node',
+        require      => Class['swift'],
+        fstype       => lookup('CONFIG_SWIFT_STORAGE_FSTYPE'),
+        seek         => lookup('CONFIG_SWIFT_STORAGE_SEEK'),
+      }
+    }
+    else {
+        create_resources(packstack::swift::fs, lookup('CONFIG_SWIFT_STORAGE_DEVICES', undef, undef, {}))
+    }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/trove.pp b/packstack/puppet/modules/packstack/manifests/trove.pp
new file mode 100644
index 000000000..c94b4972c
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/trove.pp
@@ -0,0 +1,43 @@
+class packstack::trove ()
+{
+    create_resources(packstack::firewall, lookup('FIREWALL_TROVE_API_RULES', undef, undef, {}))
+
+    $bind_host = lookup('CONFIG_IP_VERSION') ? {
+      'ipv6'  => '::0',
+      default => '0.0.0.0',
+      # TO-DO(mmagr): Add IPv6 support when hostnames are used
+    }
+
+    class { 'trove::keystone::authtoken':
+      password             => lookup('CONFIG_TROVE_KS_PW'),
+      www_authenticate_uri => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+      auth_url             => lookup('CONFIG_KEYSTONE_ADMIN_URL'),
+    }
+
+    class { 'trove::logging':
+      debug => lookup('CONFIG_DEBUG_MODE'),
+    }
+
+    class { 'trove::service_credentials':
+      password => lookup('CONFIG_TROVE_KS_PW'),
+      auth_url => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+    }
+
+    class { 'trove::api':
+      service_name => 'httpd',
+    }
+    class { 'trove::wsgi::apache':
+      bind_host => $bind_host,
+      workers   => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    class { 'trove::conductor':
+      workers => lookup('CONFIG_SERVICE_WORKERS'),
+    }
+
+    class { 'trove::guestagent::service_credentials':
+      password => lookup('CONFIG_TROVE_KS_PW'),
+      auth_url => lookup('CONFIG_KEYSTONE_PUBLIC_URL_VERSIONLESS'),
+    }
+    class { 'trove::taskmanager': }
+}
diff --git a/packstack/puppet/modules/packstack/manifests/trove/rabbitmq.pp b/packstack/puppet/modules/packstack/manifests/trove/rabbitmq.pp
new file mode 100644
index 000000000..7b491d43e
--- /dev/null
+++ b/packstack/puppet/modules/packstack/manifests/trove/rabbitmq.pp
@@ -0,0 +1,40 @@
+class packstack::trove::rabbitmq ()
+{
+    $kombu_ssl_ca_certs = lookup('CONFIG_AMQP_SSL_CACERT_FILE', undef, undef, undef)
+    $kombu_ssl_keyfile = lookup('CONFIG_TROVE_SSL_KEY', undef, undef, undef)
+    $kombu_ssl_certfile = lookup('CONFIG_TROVE_SSL_CERT', undef, undef, undef)
+
+    $rabbit_host = lookup('CONFIG_AMQP_HOST_URL')
+    $rabbit_port = lookup('CONFIG_AMQP_CLIENTS_PORT')
+    $rabbit_userid = lookup('CONFIG_AMQP_AUTH_USER')
+    $rabbit_password = lookup('CONFIG_AMQP_AUTH_PASSWORD')
+
+    if $kombu_ssl_keyfile {
+      $files_to_set_owner = [ $kombu_ssl_keyfile, $kombu_ssl_certfile ]
+      file { $files_to_set_owner:
+        owner => 'trove',
+        group => 'trove',
+      }
+      Package<|tag=='trove'|> -> File[$files_to_set_owner]
+      File[$files_to_set_owner] ~> Service<| tag == 'trove-service' |>
+    }
+    Service<| name == 'rabbitmq-server' |> -> Service<| tag == 'trove-service' |>
+
+    class { 'trove::db':
+      database_connection => os_database_connection({
+        'dialect'  => 'mysql+pymysql',
+        'host'     => lookup('CONFIG_MARIADB_HOST_URL'),
+        'username' => 'trove',
+        'password' => lookup('CONFIG_TROVE_DB_PW'),
+        'database' => 'trove',
+      })
+    }
+
+    class { 'trove':
+      rabbit_use_ssl        => lookup('CONFIG_AMQP_SSL_ENABLED'),
+      default_transport_url => "rabbit://${rabbit_userid}:${rabbit_password}@${rabbit_host}:${rabbit_port}/",
+      kombu_ssl_ca_certs    => $kombu_ssl_ca_certs,
+      kombu_ssl_keyfile     => $kombu_ssl_keyfile,
+      kombu_ssl_certfile    => $kombu_ssl_certfile,
+    }
+}
diff --git a/packstack/puppet/modules/packstack/spec/spec_helper.rb b/packstack/puppet/modules/packstack/spec/spec_helper.rb
new file mode 100644
index 000000000..7cbc76a1e
--- /dev/null
+++ b/packstack/puppet/modules/packstack/spec/spec_helper.rb
@@ -0,0 +1,10 @@
+require 'puppetlabs_spec_helper/module_spec_helper'
+
+fixture_path = File.expand_path(File.join(__FILE__, '..', 'fixtures'))
+
+RSpec.configure do |c|
+  c.alias_it_should_behave_like_to :it_configures, 'configures'
+  c.alias_it_should_behave_like_to :it_raises, 'raises'
+  c.module_path = File.join(fixture_path, 'modules')
+  c.manifest_dir = File.join(fixture_path, 'manifests')
+end
diff --git a/packstack/puppet/modules/packstack/spec/unit/puppet/parser/functions/choose_my_ip_spec.rb b/packstack/puppet/modules/packstack/spec/unit/puppet/parser/functions/choose_my_ip_spec.rb
new file mode 100644
index 000000000..2283e509e
--- /dev/null
+++ b/packstack/puppet/modules/packstack/spec/unit/puppet/parser/functions/choose_my_ip_spec.rb
@@ -0,0 +1,36 @@
+
+require 'spec_helper'
+
+describe "choose_my_ip function" do
+
+  let :scope do
+    PuppetlabsSpec::PuppetInternals.scope
+  end
+
+  let :subject do
+    function_name = Puppet::Parser::Functions.function(:choose_my_ip)
+    scope.method(function_name)
+  end
+
+  context "basic unit tests" do
+    before :each do
+      scope.stubs(:lookupvar).with('interfaces').returns('eth0,eth1,lo')
+      scope.stubs(:lookupvar).with('ipaddress_eth1').returns('1.2.3.4')
+      scope.stubs(:lookupvar).with('ipaddress_eth0').returns('2.3.4.5')
+      scope.stubs(:lookupvar).with('ipaddress_lo').returns('127.0.0.1')
+    end
+
+    it 'should select correct ip' do
+       result = subject.call([['1.1.1.1', '2.3.4.5', '3.3.3.3']])
+       result.should(eq('2.3.4.5'))
+    end
+
+    it "should raise a ParseError if there is less than 1 arguments" do
+      lambda { scope.function_choose_my_ip([]) }.should(
+        raise_error(Puppet::ParseError)
+      )
+    end
+
+  end
+
+end
diff --git a/packstack/puppet/modules/packstack/templates/cinder-list.erb b/packstack/puppet/modules/packstack/templates/cinder-list.erb
deleted file mode 100644
index 739b9d750..000000000
--- a/packstack/puppet/modules/packstack/templates/cinder-list.erb
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/env bash
-
-. /etc/nagios/keystonerc_admin
-
-data=$(cinder list 2>&1)
-rv=$?
-
-if [ "$rv" != "0" ] ; then
-    echo $data
-    exit $rv
-fi
-
-echo "$data" | grep -v -e '--------' -e ' Status ' | wc -l
-
diff --git a/packstack/puppet/modules/packstack/templates/glance-index.erb b/packstack/puppet/modules/packstack/templates/glance-index.erb
deleted file mode 100644
index 5fbea5e48..000000000
--- a/packstack/puppet/modules/packstack/templates/glance-index.erb
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/env bash
-
-. /etc/nagios/keystonerc_admin
-
-data=$(glance index 2>&1)
-rv=$?
-
-if [ "$rv" != "0" ] ; then
-    echo $data
-    exit $rv
-fi
-
-echo "$data" | grep -v -e "^ID " -e "---------------" | wc -l
diff --git a/packstack/puppet/modules/packstack/templates/keystone-user-list.erb b/packstack/puppet/modules/packstack/templates/keystone-user-list.erb
deleted file mode 100644
index b40641ce6..000000000
--- a/packstack/puppet/modules/packstack/templates/keystone-user-list.erb
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/env bash
-
-. /etc/nagios/keystonerc_admin
-
-data=$(keystone user-list 2>&1)
-rv=$?
-
-if [ "$rv" != "0" ] ; then
-    echo $data
-    exit $rv
-fi
-
-echo "$data" | grep -v -e "   id    " -e "---------------"  | wc -l
diff --git a/packstack/puppet/modules/packstack/templates/nova-list.erb b/packstack/puppet/modules/packstack/templates/nova-list.erb
deleted file mode 100644
index 9d3491f26..000000000
--- a/packstack/puppet/modules/packstack/templates/nova-list.erb
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/env bash
-
-. /etc/nagios/keystonerc_admin
-
-data=$(nova list  2>&1)
-rv=$?
-
-if [ "$rv" != "0" ] ; then
-    echo $data
-    exit $rv
-fi
-
-echo "$data" | grep -v -e '--------' -e '| Status |' -e '^$' | wc -l
diff --git a/packstack/puppet/modules/packstack/templates/openstack-neutron.modules.erb b/packstack/puppet/modules/packstack/templates/openstack-neutron.modules.erb
index 8ac4fea87..81cc1b110 100644
--- a/packstack/puppet/modules/packstack/templates/openstack-neutron.modules.erb
+++ b/packstack/puppet/modules/packstack/templates/openstack-neutron.modules.erb
@@ -1,3 +1,4 @@
 #!/bin/sh
 modprobe -b bridge >/dev/null 2>&1
+modprobe -b br_netfilter >/dev/null 2>&1
 exit 0
diff --git a/packstack/puppet/modules/packstack/templates/ssl/generate_ssl_certs.sh.erb b/packstack/puppet/modules/packstack/templates/ssl/generate_ssl_certs.sh.erb
old mode 100755
new mode 100644
index a39a127bb..675b97656
--- a/packstack/puppet/modules/packstack/templates/ssl/generate_ssl_certs.sh.erb
+++ b/packstack/puppet/modules/packstack/templates/ssl/generate_ssl_certs.sh.erb
@@ -1,4 +1,4 @@
-#!/bin/env bash
+#!/usr/bin/env bash
 
 FQDN=`hostname`
 if [ "x${FQDN}" = "x" ]; then
@@ -7,15 +7,23 @@ fi
 
 SSLKEY=/etc/pki/tls/private/ssl_ps_server.key
 SSLCERT=/etc/pki/tls/certs/ssl_ps_server.crt
+SSLCHAIN=/etc/pki/tls/certs/ssl_ps_chain.crt
 
 # If packstack dropped a cert in the resources directory then we
 # use that instead of generating one
 if [ -f $PACKSTACK_VAR_DIR/resources/ssl_ps_server.crt ] ; then
     cp  $PACKSTACK_VAR_DIR/resources/ssl_ps_server.crt $SSLCERT
     cp  $PACKSTACK_VAR_DIR/resources/ssl_ps_server.key $SSLKEY
+    cp  $PACKSTACK_VAR_DIR/resources/ssl_ps_chain.crt $SSLCHAIN
     exit 0
 fi
 
+# If we already generated a cert then we
+# use that instead of generating one
+if [ -f $SSLCERT ] ; then
+     exit 0
+fi
+
 umask 277
 
 answers() {
@@ -30,8 +38,23 @@ answers() {
         echo
 }
 
+echo 10 > /etc/pki/CA/serial
+touch /etc/pki/CA/index.txt
 
 # gen key and self signed host cert
-openssl genrsa 2048 > $SSLKEY 2> /dev/null
-answers $FQDN | openssl req -new -x509 -days 1096 -key $SSLKEY -text -out $SSLCERT
+openssl genrsa 2048 > /etc/pki/CA/private/cakey.pem 2> /dev/null
 
+answers $FQDN | openssl req -new -x509 -days 3650 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem
+
+cp /etc/pki/CA/cacert.pem $SSLCHAIN
+
+openssl genrsa 2048 > $SSLKEY 2> /dev/null
+answers $FQDN | openssl req -new -nodes -key $SSLKEY -out ${SSLCERT}.req
+yes | openssl ca -in ${SSLCERT}.req -out ${SSLCERT}
+
+# gen key and self signed cert for novnc
+SSL_NOVA_NOVNC_CERT=/etc/nova/nova.crt
+SSL_NOVA_NOVNC_KEY=/etc/nova/nova.key
+answers $FQDN | openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -keyout $SSL_NOVA_NOVNC_KEY -out $SSL_NOVA_NOVNC_CERT
+chown root.nova $SSL_NOVA_NOVNC_CERT $SSL_NOVA_NOVNC_KEY
+chmod 440 $SSL_NOVA_NOVNC_CERT $SSL_NOVA_NOVNC_KEY
diff --git a/packstack/puppet/modules/packstack/templates/swift-list.erb b/packstack/puppet/modules/packstack/templates/swift-list.erb
deleted file mode 100644
index 770add64a..000000000
--- a/packstack/puppet/modules/packstack/templates/swift-list.erb
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/env bash
-
-. /etc/nagios/keystonerc_admin
-
-data=$(swift list 2>&1)
-rv=$?
-
-if [ "$rv" != "0" ] ; then
-    echo $data
-    exit $rv
-fi
-
-echo "$data" |wc -l
-
diff --git a/packstack/puppet/templates/amqp.pp b/packstack/puppet/templates/amqp.pp
deleted file mode 100644
index 080d2ae75..000000000
--- a/packstack/puppet/templates/amqp.pp
+++ /dev/null
@@ -1,133 +0,0 @@
-$amqp = '%(CONFIG_AMQP_SERVER)s'
-case $amqp  {
-  'qpid': {
-    enable_qpid {"qpid":
-      enable_ssl  => %(CONFIG_AMQP_ENABLE_SSL)s,
-      enable_auth => '%(CONFIG_AMQP_ENABLE_AUTH)s',
-    }
-  }
-  'rabbitmq': {
-    enable_rabbitmq {"rabbitmq":}
-
-  }
-}
-
-
-define enable_rabbitmq {
-  package { "erlang":
-    ensure => "installed"
-  }
-
-  class {"rabbitmq":
-    port             => '%(CONFIG_AMQP_CLIENTS_PORT)s',
-    ssl_management_port      => '%(CONFIG_AMQP_SSL_PORT)s',
-    ssl              => %(CONFIG_AMQP_ENABLE_SSL)s,
-    ssl_cert         => '%(CONFIG_AMQP_SSL_CERT_FILE)s',
-    ssl_key          => '%(CONFIG_AMQP_SSL_KEY_FILE)s',
-    default_user     => '%(CONFIG_AMQP_AUTH_USER)s',
-    default_pass     => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-    package_provider => 'yum',
-    admin_enable     => false,
-  }
-
-  Package['erlang']->Class['rabbitmq']
-}
-
-define enable_qpid($enable_ssl = 'n', $enable_auth = 'n') {
-  case $::operatingsystem {
-    'Fedora': {
-      if (is_integer($::operatingsystemrelease) and $::operatingsystemrelease >= 20) or $::operatingsystemrelease == "Rawhide" {
-        $config = '/etc/qpid/qpidd.conf'
-      } else {
-        $config = '/etc/qpidd.conf'
-      }
-    }
-
-    'RedHat', 'CentOS': {
-      if $::operatingsystemrelease >= 7 {
-        $config = '/etc/qpid/qpidd.conf'
-      } else {
-        $config = '/etc/qpidd.conf'
-      }
-    }
-
-    default: {
-      $config = '/etc/qpidd.conf'
-    }
-  }
-
-  class {"qpid::server":
-    config_file => $config,
-    auth => $enable_auth ? {
-	    'y'  => 'yes',
-	    default => 'no',
-	    },
-    clustered => false,
-	    ssl_port      => '%(CONFIG_AMQP_SSL_PORT)s',
-	    ssl           => %(CONFIG_AMQP_ENABLE_SSL)s,
-	    ssl_cert      => '%(CONFIG_AMQP_SSL_CERT_FILE)s',
-	    ssl_key       => '%(CONFIG_AMQP_SSL_KEY_FILE)s',
-	    ssl_database_password => '%(CONFIG_AMQP_NSS_CERTDB_PW)s',
-  }
-
-  if $enable_ssl {
-    enable_qpid_ssl {"qpid":}
-  }
-  if $enable_auth == 'y' {
-    add_qpid_user {"qpid_user":}
-  }
-
-}
-
-define enable_qpid_ssl {
-  # User and group for the nss database
-  group { 'qpidd':
-    ensure => 'present',
-  }
-
-  exec { 'stop_qpid' :
-    command => '/sbin/service qpidd stop',
-    onlyif  => '/sbin/service qpidd status',
-  }
-
-  user { 'qpidd':
-    ensure     => 'present',
-    managehome => true,
-    home       => '/var/run/qpidd',
-    gid        => 'qpidd',
-    before     => Class['qpid::server']
-  }
-
-  Exec['stop_qpid']->User['qpidd']
-
-  file { 'pid_dir':
-    path => '/var/run/qpidd',
-    ensure => directory,
-    owner => 'qpidd',
-    group => 'qpidd',
-    require => User['qpidd'],
-  }
-
-  file_line { 'pid_dir_conf':
-    path => $qpid::server::config_file,
-    line => 'pid-dir=/var/run/qpidd',
-    require => File['pid_dir'],
-  }
-}
-
-define add_qpid_user {
-  qpid_user { '%(CONFIG_AMQP_AUTH_USER)s':
-    password  => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-    file  => '/var/lib/qpidd/qpidd.sasldb',
-    realm  => 'AMQP',
-    provider => 'saslpasswd2',
-    require   => Class['qpid::server'],
-  }
-
-  file { 'sasldb_file':
-    path => '/var/lib/qpidd/qpidd.sasldb',
-    ensure => file,
-    owner => 'qpidd',
-    group => 'qpidd',
-  }
-}
diff --git a/packstack/puppet/templates/ceilometer.pp b/packstack/puppet/templates/ceilometer.pp
deleted file mode 100644
index 7bf6766c3..000000000
--- a/packstack/puppet/templates/ceilometer.pp
+++ /dev/null
@@ -1,25 +0,0 @@
-class { 'ceilometer::db':
-    database_connection => 'mongodb://%(CONFIG_MONGODB_HOST)s:27017/ceilometer',
-}
-
-class { 'ceilometer::collector':
-}
-
-class { 'ceilometer::agent::auth':
-    auth_url      => 'http://%(CONFIG_KEYSTONE_HOST)s:35357/v2.0',
-    auth_password => '%(CONFIG_CEILOMETER_KS_PW)s',
-}
-
-class { 'ceilometer::agent::central':
-}
-
-class { 'ceilometer::alarm::notifier':
-}
-
-class { 'ceilometer::alarm::evaluator':
-}
-
-class { 'ceilometer::api':
-    keystone_host     => '%(CONFIG_KEYSTONE_HOST)s',
-    keystone_password => '%(CONFIG_CEILOMETER_KS_PW)s',
-}
diff --git a/packstack/puppet/templates/ceilometer_nova_disabled.pp b/packstack/puppet/templates/ceilometer_nova_disabled.pp
deleted file mode 100644
index fa360ac54..000000000
--- a/packstack/puppet/templates/ceilometer_nova_disabled.pp
+++ /dev/null
@@ -1,6 +0,0 @@
-group { "nova":
-        ensure => present,
-}
-
-Group['nova'] -> Class['ceilometer']
-
diff --git a/packstack/puppet/templates/ceilometer_qpid.pp b/packstack/puppet/templates/ceilometer_qpid.pp
deleted file mode 100644
index fa54c6f68..000000000
--- a/packstack/puppet/templates/ceilometer_qpid.pp
+++ /dev/null
@@ -1,11 +0,0 @@
-class { 'ceilometer':
-    metering_secret => '%(CONFIG_CEILOMETER_SECRET)s',
-    qpid_hostname   => '%(CONFIG_AMQP_HOST)s',
-    qpid_username   => '%(CONFIG_AMQP_AUTH_USER)s',
-    qpid_password   => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-    rpc_backend     => 'ceilometer.openstack.common.rpc.impl_qpid',
-    verbose         => true,
-    debug           => %(CONFIG_DEBUG_MODE)s,
-    qpid_port       => '%(CONFIG_AMQP_CLIENTS_PORT)s',
-    qpid_protocol   => '%(CONFIG_AMQP_PROTOCOL)s'
-}
diff --git a/packstack/puppet/templates/ceilometer_rabbitmq.pp b/packstack/puppet/templates/ceilometer_rabbitmq.pp
deleted file mode 100644
index 914c6bc10..000000000
--- a/packstack/puppet/templates/ceilometer_rabbitmq.pp
+++ /dev/null
@@ -1,9 +0,0 @@
-class { 'ceilometer':
-    metering_secret => '%(CONFIG_CEILOMETER_SECRET)s',
-    rabbit_host     => '%(CONFIG_AMQP_HOST)s',
-    verbose         => true,
-    debug           => %(CONFIG_DEBUG_MODE)s,
-    rabbit_port     => '%(CONFIG_AMQP_CLIENTS_PORT)s',
-    rabbit_userid   => '%(CONFIG_AMQP_AUTH_USER)s',
-    rabbit_password => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-}
diff --git a/packstack/puppet/templates/cinder.pp b/packstack/puppet/templates/cinder.pp
deleted file mode 100644
index d5b9920c6..000000000
--- a/packstack/puppet/templates/cinder.pp
+++ /dev/null
@@ -1,24 +0,0 @@
-cinder_config {
-    "DEFAULT/glance_host": value => "%(CONFIG_GLANCE_HOST)s";
-}
-
-package {'python-keystone':
-    notify => Class['cinder::api'],
-}
-
-class {'cinder::api':
-    keystone_password => '%(CONFIG_CINDER_KS_PW)s',
-    keystone_tenant => "services",
-    keystone_user => "cinder",
-    keystone_auth_host => "%(CONFIG_KEYSTONE_HOST)s",
-}
-
-class {'cinder::scheduler':
-}
-
-class {'cinder::volume':
-}
-
-class {'cinder::volume::iscsi':
-    iscsi_ip_address => '%(CONFIG_CINDER_HOST)s'
-}
diff --git a/packstack/puppet/templates/cinder_backup.pp b/packstack/puppet/templates/cinder_backup.pp
deleted file mode 100644
index 74fb5191c..000000000
--- a/packstack/puppet/templates/cinder_backup.pp
+++ /dev/null
@@ -1,8 +0,0 @@
-class {'cinder::backup':
-}
-
-class {'cinder::backup::swift':
-    backup_swift_url => 'http://%(CONFIG_SWIFT_PROXY)s:8080/v1/AUTH_'
-}
-
-Class['cinder::api'] ~> Service['cinder-backup']
diff --git a/packstack/puppet/templates/cinder_ceilometer.pp b/packstack/puppet/templates/cinder_ceilometer.pp
deleted file mode 100644
index 1d58636ae..000000000
--- a/packstack/puppet/templates/cinder_ceilometer.pp
+++ /dev/null
@@ -1,2 +0,0 @@
-
-class { 'cinder::ceilometer': }
diff --git a/packstack/puppet/templates/cinder_gluster.pp b/packstack/puppet/templates/cinder_gluster.pp
deleted file mode 100644
index e3621f789..000000000
--- a/packstack/puppet/templates/cinder_gluster.pp
+++ /dev/null
@@ -1,6 +0,0 @@
-package { 'glusterfs-fuse': ensure => present }
-
-class { 'cinder::volume::glusterfs':
-    glusterfs_shares => [%(CONFIG_CINDER_GLUSTER_MOUNTS)s],
-    require => Package['glusterfs-fuse'],
-}
diff --git a/packstack/puppet/templates/cinder_nfs.pp b/packstack/puppet/templates/cinder_nfs.pp
deleted file mode 100644
index d6f4c376f..000000000
--- a/packstack/puppet/templates/cinder_nfs.pp
+++ /dev/null
@@ -1,6 +0,0 @@
-package { 'nfs-utils': ensure => present }
-
-class { 'cinder::volume::nfs':
-    nfs_servers => [%(CONFIG_CINDER_NFS_MOUNTS)s],
-    require => Package['nfs-utils'],
-}
diff --git a/packstack/puppet/templates/cinder_qpid.pp b/packstack/puppet/templates/cinder_qpid.pp
deleted file mode 100644
index 33fd39de3..000000000
--- a/packstack/puppet/templates/cinder_qpid.pp
+++ /dev/null
@@ -1,12 +0,0 @@
-
-class {'cinder':
-    rpc_backend    => 'cinder.openstack.common.rpc.impl_qpid',
-    qpid_hostname  => "%(CONFIG_AMQP_HOST)s",
-    qpid_port      => '%(CONFIG_AMQP_CLIENTS_PORT)s',
-    qpid_protocol  => '%(CONFIG_AMQP_PROTOCOL)s',
-    qpid_username  => '%(CONFIG_AMQP_AUTH_USER)s',
-    qpid_password  => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-    sql_connection => "mysql://cinder:%(CONFIG_CINDER_DB_PW)s@%(CONFIG_MYSQL_HOST)s/cinder",
-    verbose        => true,
-    debug          => %(CONFIG_DEBUG_MODE)s,
-}
diff --git a/packstack/puppet/templates/cinder_rabbitmq.pp b/packstack/puppet/templates/cinder_rabbitmq.pp
deleted file mode 100644
index da12e38cd..000000000
--- a/packstack/puppet/templates/cinder_rabbitmq.pp
+++ /dev/null
@@ -1,10 +0,0 @@
-
-class {'cinder':
-    rabbit_host      => "%(CONFIG_AMQP_HOST)s",
-    rabbit_port      => '%(CONFIG_AMQP_CLIENTS_PORT)s',
-    rabbit_userid    => '%(CONFIG_AMQP_AUTH_USER)s',
-    rabbit_password  => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-    sql_connection   => "mysql://cinder:%(CONFIG_CINDER_DB_PW)s@%(CONFIG_MYSQL_HOST)s/cinder",
-    verbose          => true,
-    debug            => %(CONFIG_DEBUG_MODE)s,
-}
diff --git a/packstack/puppet/templates/cinder_vmdk.pp b/packstack/puppet/templates/cinder_vmdk.pp
deleted file mode 100644
index 95728deaa..000000000
--- a/packstack/puppet/templates/cinder_vmdk.pp
+++ /dev/null
@@ -1,5 +0,0 @@
-class { 'cinder::volume::vmdk':
-  host_ip       => "%(CONFIG_VCENTER_HOST)s",
-  host_username => "%(CONFIG_VCENTER_USER)s",
-  host_password => "%(CONFIG_VCENTER_PASSWORD)s",
-}
diff --git a/packstack/puppet/templates/compute.pp b/packstack/puppet/templates/compute.pp
new file mode 100644
index 000000000..9f487c7b4
--- /dev/null
+++ b/packstack/puppet/templates/compute.pp
@@ -0,0 +1,60 @@
+stage { "init": before  => Stage["main"] }
+
+Exec { timeout => lookup('DEFAULT_EXEC_TIMEOUT') }
+Package { allow_virtual => true }
+
+class { 'packstack::prereqs':
+  stage => init,
+}
+
+include firewall
+
+create_resources(sshkey, lookup('SSH_KEYS', undef, undef, {}))
+
+if lookup('CONFIG_NTP_SERVERS', undef, undef, '') != '' {
+  include 'packstack::chrony'
+}
+
+if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+  include 'packstack::nova::ceilometer::rabbitmq'
+  include 'packstack::nova::ceilometer'
+}
+
+include 'packstack::nova'
+include 'packstack::nova::common'
+include 'packstack::nova::compute'
+
+if lookup('CONFIG_VMWARE_BACKEND') == 'y' {
+  include 'packstack::nova::compute::vmware'
+} elsif lookup('CONFIG_IRONIC_INSTALL') == 'y' {
+  include 'packstack::nova::compute::ironic'
+} else {
+  include 'packstack::nova::compute::libvirt'
+}
+
+if lookup('CONFIG_CINDER_INSTALL') == 'y' {
+  include 'openstacklib::iscsid'
+}
+
+if lookup('CONFIG_CINDER_INSTALL') == 'y' and
+   lookup('CONFIG_VMWARE_BACKEND') != 'y' {
+   if 'nfs' in lookup('CONFIG_CINDER_BACKEND', { merge => 'unique' }) {
+    include 'packstack::nova::nfs'
+   }
+}
+
+include 'packstack::nova::neutron'
+include 'packstack::neutron::rabbitmq'
+case lookup('CONFIG_NEUTRON_L2_AGENT') {
+  'openvswitch': { include 'packstack::neutron::ovs_agent' }
+  'ovn':         { include 'packstack::neutron::ovn_agent'
+                   include 'packstack::neutron::ovn_metadata'
+                 }
+  default:       { include 'packstack::neutron::ovs_agent' }
+}
+include 'packstack::neutron::bridge'
+
+if 'sriovnicswitch' in lookup('CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS', { merge => 'unique' }) and
+   lookup('CONFIG_NEUTRON_L2_AGENT') == 'openvswitch' {
+  include 'packstack::neutron::sriov'
+}
diff --git a/packstack/puppet/templates/controller.pp b/packstack/puppet/templates/controller.pp
new file mode 100644
index 000000000..79c731216
--- /dev/null
+++ b/packstack/puppet/templates/controller.pp
@@ -0,0 +1,188 @@
+stage { "init": before  => Stage["main"] }
+
+Exec { timeout => lookup('DEFAULT_EXEC_TIMEOUT') }
+Package { allow_virtual => true }
+
+class { 'packstack::prereqs':
+  stage => init,
+}
+
+include firewall
+
+if lookup('CONFIG_NTP_SERVERS', undef, undef, '') != '' {
+  include 'packstack::chrony'
+}
+
+include 'packstack::amqp'
+include 'packstack::mariadb'
+
+if lookup('CONFIG_MARIADB_INSTALL') == 'y' {
+  include 'packstack::mariadb::services'
+} else {
+  include 'packstack::mariadb::services_remote'
+}
+
+include 'packstack::apache'
+include 'packstack::keystone'
+
+if lookup('CONFIG_GLANCE_INSTALL') == 'y' {
+  include 'packstack::keystone::glance'
+  include 'packstack::glance'
+  if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+    include 'packstack::glance::ceilometer'
+  }
+  if lookup('CONFIG_GLANCE_BACKEND') == 'swift' {
+    include 'packstack::glance::backend::swift'
+  } else {
+    include 'packstack::glance::backend::file'
+  }
+}
+
+if lookup('CONFIG_CINDER_INSTALL') == 'y' {
+  include 'openstacklib::iscsid'
+  include 'packstack::keystone::cinder'
+  include 'packstack::cinder::rabbitmq'
+  include 'packstack::cinder'
+  if lookup('CONFIG_SWIFT_INSTALL') == 'y' {
+    include 'packstack::cinder::backup'
+  }
+
+  $cinder_backends = lookup('CONFIG_CINDER_BACKEND', { merge => 'unique' })
+
+  case $cinder_backends[0] {
+    'lvm':       { include 'packstack::cinder::backend::lvm' }
+    'nfs':       { include 'packstack::cinder::backend::nfs' }
+    'netapp':    { include 'packstack::cinder::backend::netapp' }
+    'solidfire': { include 'packstack::cinder::backend::solidfire' }
+    default:     { include 'packstack::cinder::backend::lvm' }
+  }
+}
+
+if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
+  include 'packstack::keystone::ironic'
+  include 'packstack::ironic'
+  include 'packstack::ironic::rabbitmq'
+}
+
+if lookup('CONFIG_NOVA_INSTALL') == 'y' {
+  include 'packstack::keystone::nova'
+  include 'packstack::nova'
+  include 'packstack::nova::common'
+  include 'packstack::nova::api'
+  include 'packstack::nova::conductor'
+  if lookup('CONFIG_IRONIC_INSTALL') == 'y' {
+    include 'packstack::nova::sched::ironic'
+  } else {
+    include 'packstack::nova::sched'
+  }
+  include 'packstack::nova::vncproxy'
+  include 'packstack::nova::neutron'
+  include 'packstack::placement'
+}
+
+if lookup('CONFIG_NEUTRON_INSTALL') == 'y' {
+  include 'packstack::keystone::neutron'
+  include 'packstack::neutron::rabbitmq'
+  include 'packstack::neutron::api'
+  if lookup('CONFIG_NOVA_INSTALL') == 'y' {
+    include 'packstack::neutron::notifications'
+  }
+  include 'packstack::neutron::ml2'
+  if lookup('CONFIG_NEUTRON_L2_AGENT') == 'ovn' {
+    include 'packstack::neutron::ovn_northd'
+  }
+}
+
+if lookup('CONFIG_MANILA_INSTALL') == 'y' {
+  include 'packstack::keystone::manila'
+  include 'packstack::manila'
+  include 'packstack::manila::rabbitmq'
+  if 'generic' in lookup('CONFIG_MANILA_BACKEND', { merge => 'unique' }) {
+    include 'packstack::manila::backend::generic'
+  }
+  if 'netapp' in lookup('CONFIG_MANILA_BACKEND', { merge => 'unique' }) {
+    include 'packstack::manila::backend::netapp'
+  }
+  if 'glusternative' in lookup('CONFIG_MANILA_BACKEND', { merge => 'unique' }) {
+    include 'packstack::manila::backend::glusternative'
+  }
+  if 'glusternfs' in lookup('CONFIG_MANILA_BACKEND', { merge => 'unique' }) {
+    include 'packstack::manila::backend::glusternfs'
+  }
+}
+
+include 'packstack::openstackclient'
+
+if lookup('CONFIG_HORIZON_INSTALL') == 'y' {
+  include 'packstack::horizon'
+}
+
+if lookup('CONFIG_SWIFT_INSTALL') == 'y' {
+  include 'packstack::keystone::swift'
+  include 'packstack::swift'
+  include 'packstack::swift::ringbuilder'
+  include 'packstack::swift::proxy'
+  include 'packstack::swift::storage'
+  if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' and
+     lookup('CONFIG_ENABLE_CEILOMETER_MIDDLEWARE') == 'y' {
+    include 'packstack::swift::ceilometer'
+  }
+}
+
+if lookup('CONFIG_HEAT_INSTALL') == 'y' {
+  include 'packstack::keystone::heat'
+  include 'packstack::heat::rabbitmq'
+  include 'packstack::heat'
+  if lookup('CONFIG_HEAT_CFN_INSTALL') == 'y' {
+    include 'packstack::heat::cfn'
+  }
+}
+
+if lookup('CONFIG_MAGNUM_INSTALL') == 'y' {
+  include 'packstack::keystone::magnum'
+  include 'packstack::magnum'
+  include 'packstack::magnum::rabbitmq'
+}
+
+if lookup('CONFIG_PROVISION_DEMO') == 'y' or lookup('CONFIG_PROVISION_TEMPEST') == 'y' {
+  include 'packstack::provision'
+  if lookup('CONFIG_GLANCE_INSTALL') == 'y' {
+    include 'packstack::provision::glance'
+  }
+}
+
+if lookup('CONFIG_PROVISION_TEMPEST') == 'y' {
+  include 'packstack::provision::tempest'
+}
+
+
+if lookup('CONFIG_PROVISION_TEMPEST') == 'y' {
+  include 'packstack::provision::tempest'
+}
+
+
+if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' {
+  # setup gnocchi
+  include 'packstack::keystone::gnocchi'
+  include 'packstack::gnocchi'
+  # setup ceilometer
+  include 'packstack::keystone::ceilometer'
+  include 'packstack::ceilometer::rabbitmq'
+  include 'packstack::ceilometer'
+  if lookup('CONFIG_NOVA_INSTALL') == 'n' {
+    include 'packstack::ceilometer::nova_disabled'
+  }
+  include 'packstack::redis'
+}
+
+if lookup('CONFIG_CEILOMETER_INSTALL') == 'y' and lookup('CONFIG_AODH_INSTALL') == 'y' {
+  include 'packstack::keystone::aodh'
+  include 'packstack::aodh::rabbitmq'
+  include 'packstack::aodh'
+}
+
+if lookup('CONFIG_TROVE_INSTALL') == 'y' {
+  include 'packstack::keystone::trove'
+  include 'packstack::trove::rabbitmq'
+  include 'packstack::trove'
+}
diff --git a/packstack/puppet/templates/controller_post.pp b/packstack/puppet/templates/controller_post.pp
new file mode 100644
index 000000000..9e5710177
--- /dev/null
+++ b/packstack/puppet/templates/controller_post.pp
@@ -0,0 +1,14 @@
+stage { "init": before  => Stage["main"] }
+
+Exec { timeout => lookup('DEFAULT_EXEC_TIMEOUT') }
+Package { allow_virtual => true }
+
+class { 'packstack::prereqs':
+  stage => init,
+}
+
+include nova::cell_v2::discover_hosts
+
+notify {'Discovering compute nodes': } ~> Class['nova::cell_v2::discover_hosts']
+
+
diff --git a/packstack/puppet/templates/firewall.pp b/packstack/puppet/templates/firewall.pp
deleted file mode 100644
index 2b2c13419..000000000
--- a/packstack/puppet/templates/firewall.pp
+++ /dev/null
@@ -1,11 +0,0 @@
-# Create firewall rules to allow only the FIREWALL_ALLOWED
-# hosts that need to connect via FIREWALL_PORTS
-# using FIREWALL_CHAIN
-
-packstack::firewall {'%(FIREWALL_SERVICE_ID)s':
-  host => %(FIREWALL_ALLOWED)s,
-  service_name => '%(FIREWALL_SERVICE_NAME)s',
-  chain => '%(FIREWALL_CHAIN)s',
-  ports => [%(FIREWALL_PORTS)s],
-}
-
diff --git a/packstack/puppet/templates/glance.pp b/packstack/puppet/templates/glance.pp
deleted file mode 100644
index 220409e5c..000000000
--- a/packstack/puppet/templates/glance.pp
+++ /dev/null
@@ -1,23 +0,0 @@
-
-class {"glance::api":
-    auth_host => "%(CONFIG_KEYSTONE_HOST)s",
-    keystone_tenant => "services",
-    keystone_user => "glance",
-    keystone_password => "%(CONFIG_GLANCE_KS_PW)s",
-    pipeline => 'keystone',
-    sql_connection => "mysql://glance:%(CONFIG_GLANCE_DB_PW)s@%(CONFIG_MYSQL_HOST)s/glance",
-    verbose => true,
-    debug => %(CONFIG_DEBUG_MODE)s,
-}
-
-class { 'glance::backend::file': }
-
-class {"glance::registry":
-    auth_host => "%(CONFIG_KEYSTONE_HOST)s",
-    keystone_tenant => "services",
-    keystone_user => "glance",
-    keystone_password => "%(CONFIG_GLANCE_KS_PW)s",
-    sql_connection => "mysql://glance:%(CONFIG_GLANCE_DB_PW)s@%(CONFIG_MYSQL_HOST)s/glance",
-    verbose => true,
-    debug => %(CONFIG_DEBUG_MODE)s,
-}
diff --git a/packstack/puppet/templates/glance_ceilometer_qpid.pp b/packstack/puppet/templates/glance_ceilometer_qpid.pp
deleted file mode 100644
index ab5d0fa3e..000000000
--- a/packstack/puppet/templates/glance_ceilometer_qpid.pp
+++ /dev/null
@@ -1,8 +0,0 @@
-
-class { 'glance::notify::qpid':
-    qpid_password => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-    qpid_username => '%(CONFIG_AMQP_AUTH_USER)s',
-    qpid_hostname => '%(CONFIG_AMQP_HOST)s',
-    qpid_port     => '%(CONFIG_AMQP_CLIENTS_PORT)s',
-    qpid_protocol => '%(CONFIG_AMQP_PROTOCOL)s'
-}
diff --git a/packstack/puppet/templates/glance_ceilometer_rabbitmq.pp b/packstack/puppet/templates/glance_ceilometer_rabbitmq.pp
deleted file mode 100644
index a549229ab..000000000
--- a/packstack/puppet/templates/glance_ceilometer_rabbitmq.pp
+++ /dev/null
@@ -1,9 +0,0 @@
-
-class { 'glance::notify::rabbitmq':
-    rabbit_host      => '%(CONFIG_AMQP_HOST)s',
-    rabbit_port      => '%(CONFIG_AMQP_CLIENTS_PORT)s',
-    rabbit_use_ssl   => '%(CONFIG_AMQP_ENABLE_SSL)s',
-    rabbit_userid    => '%(CONFIG_AMQP_AUTH_USER)s',
-    rabbit_password  => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-}
-
diff --git a/packstack/puppet/templates/global.pp b/packstack/puppet/templates/global.pp
deleted file mode 100644
index c2aaad10c..000000000
--- a/packstack/puppet/templates/global.pp
+++ /dev/null
@@ -1 +0,0 @@
-Exec { timeout => %(DEFAULT_EXEC_TIMEOUT)s }
diff --git a/packstack/puppet/templates/heat.pp b/packstack/puppet/templates/heat.pp
deleted file mode 100644
index fa85871aa..000000000
--- a/packstack/puppet/templates/heat.pp
+++ /dev/null
@@ -1,9 +0,0 @@
-class { 'heat::api':
-}
-
-class { 'heat::engine':
-    heat_metadata_server_url      => 'http://%(CONFIG_HEAT_METADATA_HOST)s:8000',
-    heat_waitcondition_server_url => 'http://%(CONFIG_HEAT_METADATA_HOST)s:8000/v1/waitcondition',
-    heat_watch_server_url         => 'http://%(CONFIG_HEAT_WATCH_HOST)s:8003',
-    auth_encryption_key           => '%(CONFIG_HEAT_AUTH_ENC_KEY)s',
-}
diff --git a/packstack/puppet/templates/heat_cfn.pp b/packstack/puppet/templates/heat_cfn.pp
deleted file mode 100644
index e82640271..000000000
--- a/packstack/puppet/templates/heat_cfn.pp
+++ /dev/null
@@ -1,2 +0,0 @@
-class { 'heat::api_cfn':
-}
diff --git a/packstack/puppet/templates/heat_cloudwatch.pp b/packstack/puppet/templates/heat_cloudwatch.pp
deleted file mode 100644
index 00ddcdffe..000000000
--- a/packstack/puppet/templates/heat_cloudwatch.pp
+++ /dev/null
@@ -1,2 +0,0 @@
-class { 'heat::api_cloudwatch':
-}
diff --git a/packstack/puppet/templates/heat_qpid.pp b/packstack/puppet/templates/heat_qpid.pp
deleted file mode 100644
index c1161184b..000000000
--- a/packstack/puppet/templates/heat_qpid.pp
+++ /dev/null
@@ -1,12 +0,0 @@
-class { 'heat':
-    keystone_host     => '%(CONFIG_KEYSTONE_HOST)s',
-    keystone_password => '%(CONFIG_HEAT_KS_PW)s',
-    auth_uri          => 'http://%(CONFIG_KEYSTONE_HOST)s:35357/v2.0',
-    rpc_backend       => 'heat.openstack.common.rpc.impl_qpid',
-    qpid_hostname     => '%(CONFIG_AMQP_HOST)s',
-    qpid_username     => '%(CONFIG_AMQP_AUTH_USER)s',
-    qpid_password     => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-    verbose           => true,
-    debug             => %(CONFIG_DEBUG_MODE)s,
-    sql_connection    => "mysql://heat:%(CONFIG_HEAT_DB_PW)s@%(CONFIG_MYSQL_HOST)s/heat",
-}
diff --git a/packstack/puppet/templates/heat_rabbitmq.pp b/packstack/puppet/templates/heat_rabbitmq.pp
deleted file mode 100644
index 20290e66b..000000000
--- a/packstack/puppet/templates/heat_rabbitmq.pp
+++ /dev/null
@@ -1,12 +0,0 @@
-class { 'heat':
-    keystone_host     => '%(CONFIG_KEYSTONE_HOST)s',
-    keystone_password => '%(CONFIG_HEAT_KS_PW)s',
-    auth_uri          => 'http://%(CONFIG_KEYSTONE_HOST)s:35357/v2.0',
-    rpc_backend       => 'heat.openstack.common.rpc.impl_kombu',
-    rabbit_host       => '%(CONFIG_AMQP_HOST)s',
-    rabbit_userid     => '%(CONFIG_AMQP_AUTH_USER)s',
-    rabbit_password   => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-    verbose           => true,
-    debug             => %(CONFIG_DEBUG_MODE)s,
-    sql_connection    => "mysql://heat:%(CONFIG_HEAT_DB_PW)s@%(CONFIG_MYSQL_HOST)s/heat",
-}
diff --git a/packstack/puppet/templates/horizon.pp b/packstack/puppet/templates/horizon.pp
deleted file mode 100644
index da9d8b415..000000000
--- a/packstack/puppet/templates/horizon.pp
+++ /dev/null
@@ -1,48 +0,0 @@
-$horizon_packages = ["python-memcached", "python-netaddr"]
-
-include concat::setup
-
-package {$horizon_packages:
-    notify => Class["horizon"],
-    ensure => present,
-}
-
-class {'horizon':
-   secret_key => '%(CONFIG_HORIZON_SECRET_KEY)s',
-   keystone_host => '%(CONFIG_KEYSTONE_HOST)s',
-   keystone_default_role => '_member_',
-   fqdn => ['%(CONFIG_HORIZON_HOST)s', "$::fqdn", 'localhost'],
-   can_set_mount_point => 'False',
-   help_url =>'http://docs.openstack.org',
-   django_debug => %(CONFIG_DEBUG_MODE)s ? {true => 'True', false => 'False'},
-}
-
-class {'memcached':}
-
-$firewall_port = %(CONFIG_HORIZON_PORT)s
-
-firewall { "001 horizon ${firewall_port}  incoming":
-    proto    => 'tcp',
-    dport    => [%(CONFIG_HORIZON_PORT)s],
-    action   => 'accept',
-}
-
-if ($::selinux != "false"){
-    selboolean{'httpd_can_network_connect':
-        value => on,
-        persistent => true,
-    }
-}
-
-#FIXME
-# Ugly hack to avoid duplicate Listen directives on
-# port 80
-file_line { 'undo_httpd_listen_on_bind_address_80':
-    path    => $::horizon::params::httpd_listen_config_file,
-    match   => '^.*Listen 0.0.0.0:?80$',
-    line    => "#Listen 0.0.0.0:80",
-    require => Package['horizon'],
-    notify  => Service[$::horizon::params::http_service],
-}
-
-File_line['httpd_listen_on_bind_address_80'] -> File_line['undo_httpd_listen_on_bind_address_80']
diff --git a/packstack/puppet/templates/https.pp b/packstack/puppet/templates/https.pp
deleted file mode 100644
index 728f98eb9..000000000
--- a/packstack/puppet/templates/https.pp
+++ /dev/null
@@ -1,97 +0,0 @@
-
-class {'apache::mod::ssl': }
-
-file {'/etc/pki/tls/certs/ps_generate_ssl_certs.ssh':
-    content => template('packstack/ssl/generate_ssl_certs.sh.erb'),
-    ensure => present,
-    mode => '755',
-}
-
-exec {'/etc/pki/tls/certs/ps_generate_ssl_certs.ssh':
-    require => File['/etc/pki/tls/certs/ps_generate_ssl_certs.ssh'],
-    notify  => Service['httpd'],
-}
-
-# close port 80
-file_line{'nohttp':
-    path => '/etc/httpd/conf/httpd.conf',
-    match => '^.*Listen 80',
-    line => '#Listen 80',
-    require =>  Class['apache::mod::ssl']
-}
-
-# close port 80 on 0.0.0.0
-# this line is added by the horizon class
-file_line{'nohttp_ip':
-    path => '/etc/httpd/conf/httpd.conf',
-    match => '^.*Listen 0.0.0.0:80',
-    line => '#Listen 0.0.0.0:80',
-    require =>  Class['horizon']
-}
-
-$https_port = %(CONFIG_HORIZON_PORT)s
-
-
-if ($::fqdn != "" and $::fqdn !~ /localhost/) {
-    $vhostname = $::fqdn
-}
-else {
-    $vhostname = '%(CONFIG_HORIZON_HOST)s'
-}
-
-
-file{'/etc/httpd/conf.d/openstack-dashboard-vhost-port-80.conf':
-    ensure  => present,
-    content => "\n<VirtualHost *:80>\n\tServerName ${vhostname}\n\tRewriteEngine On\n\tRewriteCond %%{HTTPS} !=on\n\tRewriteRule ^/?(.*) https://%%{SERVER_NAME}/$1 [R,L]\n</VirtualHost>\n",
-}
-
-file_line{'redirect':
-    path    => '/etc/httpd/conf.d/openstack-dashboard.conf',
-    match   => '^RedirectMatch .*',
-    line    => "RedirectMatch permanent ^/$ https://%(CONFIG_HORIZON_HOST)s:${https_port}/dashboard",
-    require =>  Class['horizon']
-}
-
-
-# if the mod_ssl apache puppet module does not install
-# this file, we ensure it haves the minimum
-# requirements for SSL to work
-$ssl_lines = {
-    'ssl_port' => {
-        path  => '/etc/httpd/conf.d/ssl.conf',
-        match => 'Listen .+',
-        line  => 'Listen 443',
-        require =>  Class['apache::mod::ssl']
-    },
-    'start_vhost_ssl' => {
-        path => '/etc/httpd/conf.d/ssl.conf',
-        line => '<VirtualHost *:443>',
-        require => File_line['ssl_port'],
-     },
-    'ssl_engine' => {
-        path => '/etc/httpd/conf.d/ssl.conf',
-        match => 'SSLEngine .+',
-        line => 'SSLEngine on',
-        require =>   File_line['start_vhost_ssl'],
-     },
-    # set the name of the ssl cert and key file
-    'sslcert' => {
-        path => '/etc/httpd/conf.d/ssl.conf',
-        match => '^SSLCertificateFile ',
-        line => 'SSLCertificateFile /etc/pki/tls/certs/ssl_ps_server.crt',
-        require => File_line['ssl_engine'],
-    },
-    'sslkey' => {
-        path => '/etc/httpd/conf.d/ssl.conf',
-        match => '^SSLCertificateKeyFile ',
-        line => 'SSLCertificateKeyFile /etc/pki/tls/private/ssl_ps_server.key',
-        require =>  File_line['sslcert'],
-    },
-    'end_vhost_ssl' => {
-        path => '/etc/httpd/conf.d/ssl.conf',
-        line => '</VirtualHost>',
-        require => File_line['sslkey'],
-     },
-}
-
-create_resources(file_line, $ssl_lines)
diff --git a/packstack/puppet/templates/keystone.pp b/packstack/puppet/templates/keystone.pp
deleted file mode 100644
index 946e9a24a..000000000
--- a/packstack/puppet/templates/keystone.pp
+++ /dev/null
@@ -1,32 +0,0 @@
-
-class {"keystone":
-    admin_token => "%(CONFIG_KEYSTONE_ADMIN_TOKEN)s",
-    sql_connection => "mysql://keystone_admin:%(CONFIG_KEYSTONE_DB_PW)s@%(CONFIG_MYSQL_HOST)s/keystone",
-    token_format => "%(CONFIG_KEYSTONE_TOKEN_FORMAT)s",
-    verbose => true,
-    debug => %(CONFIG_DEBUG_MODE)s,
-}
-
-class {"keystone::roles::admin":
-    email => "test@test.com",
-    password => "%(CONFIG_KEYSTONE_ADMIN_PW)s",
-    admin_tenant => "admin"
-}
-
-class {"keystone::endpoint":
-    public_address  => "%(CONFIG_KEYSTONE_HOST)s",
-    admin_address  => "%(CONFIG_KEYSTONE_HOST)s",
-    internal_address  => "%(CONFIG_KEYSTONE_HOST)s",
-}
-
-# Run token flush every minute (without output so we won't spam admins)
-cron { 'token-flush':
-    ensure => 'present',
-    command => '/usr/bin/keystone-manage token_flush >/dev/null 2>&1',
-    minute => '*/1',
-    user => 'keystone',
-    require => [User['keystone'], Group['keystone']],
-} -> service { 'crond':
-    ensure => 'running',
-    enable => true,
-}
diff --git a/packstack/puppet/templates/keystone_ceilometer.pp b/packstack/puppet/templates/keystone_ceilometer.pp
deleted file mode 100644
index 87baa828e..000000000
--- a/packstack/puppet/templates/keystone_ceilometer.pp
+++ /dev/null
@@ -1,7 +0,0 @@
-
-class { 'ceilometer::keystone::auth':
-    password => '%(CONFIG_CEILOMETER_KS_PW)s',
-    public_address => "%(CONFIG_CEILOMETER_HOST)s",
-    admin_address => "%(CONFIG_CEILOMETER_HOST)s",
-    internal_address => "%(CONFIG_CEILOMETER_HOST)s",
-}
diff --git a/packstack/puppet/templates/keystone_cinder.pp b/packstack/puppet/templates/keystone_cinder.pp
deleted file mode 100644
index 63439e9a2..000000000
--- a/packstack/puppet/templates/keystone_cinder.pp
+++ /dev/null
@@ -1,20 +0,0 @@
-
-class {"cinder::keystone::auth":
-    password => "%(CONFIG_CINDER_KS_PW)s",
-    public_address => "%(CONFIG_CINDER_HOST)s",
-    admin_address => "%(CONFIG_CINDER_HOST)s",
-    internal_address => "%(CONFIG_CINDER_HOST)s",
-}
-
-keystone_service { "${cinder::keystone::auth::auth_name}_v2":
-    ensure      => present,
-    type        => "${cinder::keystone::auth::service_type}v2",
-    description => "Cinder Service v2",
-}
-
-keystone_endpoint { "${cinder::keystone::auth::region}/${cinder::keystone::auth::auth_name}_v2":
-    ensure       => present,
-    public_url   => "${cinder::keystone::auth::public_protocol}://${cinder::keystone::auth::public_address}:${cinder::keystone::auth::port}/v2/%%(tenant_id)s",
-    admin_url    => "http://${cinder::keystone::auth::admin_address}:${cinder::keystone::auth::port}/v2/%%(tenant_id)s",
-    internal_url => "http://${cinder::keystone::auth::internal_address}:${cinder::keystone::auth::port}/v2/%%(tenant_id)s",
-}
diff --git a/packstack/puppet/templates/keystone_glance.pp b/packstack/puppet/templates/keystone_glance.pp
deleted file mode 100644
index 4823cd60e..000000000
--- a/packstack/puppet/templates/keystone_glance.pp
+++ /dev/null
@@ -1,7 +0,0 @@
-
-class {"glance::keystone::auth":
-    password => "%(CONFIG_GLANCE_KS_PW)s",
-    public_address => "%(CONFIG_GLANCE_HOST)s",
-    admin_address => "%(CONFIG_GLANCE_HOST)s",
-    internal_address => "%(CONFIG_GLANCE_HOST)s",
-}
diff --git a/packstack/puppet/templates/keystone_heat.pp b/packstack/puppet/templates/keystone_heat.pp
deleted file mode 100644
index 4860bda7c..000000000
--- a/packstack/puppet/templates/keystone_heat.pp
+++ /dev/null
@@ -1,17 +0,0 @@
-# heat::keystone::auth
-class {"heat::keystone::auth":
-    password => "%(CONFIG_HEAT_KS_PW)s",
-    public_address => "%(CONFIG_HEAT_HOST)s",
-    admin_address => "%(CONFIG_HEAT_HOST)s",
-    internal_address => "%(CONFIG_HEAT_HOST)s",
-}
-
-if '%(CONFIG_HEAT_CFN_INSTALL)s' == 'y' {
-    # heat::keystone::cfn
-    class {"heat::keystone::auth_cfn":
-        password => "%(CONFIG_HEAT_KS_PW)s",
-        public_address => "%(CONFIG_HEAT_HOST)s",
-        admin_address => "%(CONFIG_HEAT_HOST)s",
-        internal_address => "%(CONFIG_HEAT_HOST)s",
-    }
-}
diff --git a/packstack/puppet/templates/keystone_neutron.pp b/packstack/puppet/templates/keystone_neutron.pp
deleted file mode 100644
index 062514e0c..000000000
--- a/packstack/puppet/templates/keystone_neutron.pp
+++ /dev/null
@@ -1,7 +0,0 @@
-
-class {"neutron::keystone::auth":
-    password    => "%(CONFIG_NEUTRON_KS_PW)s",
-    public_address => "%(CONFIG_NEUTRON_SERVER_HOST)s",
-    admin_address => "%(CONFIG_NEUTRON_SERVER_HOST)s",
-    internal_address => "%(CONFIG_NEUTRON_SERVER_HOST)s",
-}
diff --git a/packstack/puppet/templates/keystone_nova.pp b/packstack/puppet/templates/keystone_nova.pp
deleted file mode 100644
index f336fa5c7..000000000
--- a/packstack/puppet/templates/keystone_nova.pp
+++ /dev/null
@@ -1,8 +0,0 @@
-
-class {"nova::keystone::auth":
-    password    => "%(CONFIG_NOVA_KS_PW)s",
-    public_address => "%(CONFIG_NOVA_API_HOST)s",
-    admin_address => "%(CONFIG_NOVA_API_HOST)s",
-    internal_address => "%(CONFIG_NOVA_API_HOST)s",
-    cinder => true,
-}
diff --git a/packstack/puppet/templates/keystone_swift.pp b/packstack/puppet/templates/keystone_swift.pp
deleted file mode 100644
index 8ba3c7c0c..000000000
--- a/packstack/puppet/templates/keystone_swift.pp
+++ /dev/null
@@ -1,4 +0,0 @@
-class { 'swift::keystone::auth':
-  public_address  => '%(CONFIG_SWIFT_PROXY)s',
-  password => '%(CONFIG_SWIFT_KS_PW)s',
-}
diff --git a/packstack/puppet/templates/mongodb.pp b/packstack/puppet/templates/mongodb.pp
deleted file mode 100644
index 490ce4ba1..000000000
--- a/packstack/puppet/templates/mongodb.pp
+++ /dev/null
@@ -1,4 +0,0 @@
-class { 'mongodb::server':
-    smallfiles   => true,
-    bind_ip      => ['%(CONFIG_MONGODB_HOST)s'],
-}
diff --git a/packstack/puppet/templates/mysql_cinder_install.pp b/packstack/puppet/templates/mysql_cinder_install.pp
deleted file mode 100644
index 699777a92..000000000
--- a/packstack/puppet/templates/mysql_cinder_install.pp
+++ /dev/null
@@ -1,5 +0,0 @@
-class {"cinder::db::mysql":
-    password      => "%(CONFIG_CINDER_DB_PW)s",
-    allowed_hosts => "%%",
-    charset       => "utf8",
-}
diff --git a/packstack/puppet/templates/mysql_cinder_noinstall.pp b/packstack/puppet/templates/mysql_cinder_noinstall.pp
deleted file mode 100644
index c41ad44a6..000000000
--- a/packstack/puppet/templates/mysql_cinder_noinstall.pp
+++ /dev/null
@@ -1,27 +0,0 @@
-
-remote_database { 'cinder':
-    ensure      => 'present',
-    charset     => 'utf8',
-    db_host     => '%(CONFIG_MYSQL_HOST)s',
-    db_user     => '%(CONFIG_MYSQL_USER)s',
-    db_password => '%(CONFIG_MYSQL_PW)s',
-    provider    => 'mysql',
-}
-
-remote_database_user { 'cinder@%%':
-    password_hash => mysql_password('%(CONFIG_CINDER_DB_PW)s'),
-    db_host       => '%(CONFIG_MYSQL_HOST)s',
-    db_user       => '%(CONFIG_MYSQL_USER)s',
-    db_password   => '%(CONFIG_MYSQL_PW)s',
-    provider      => 'mysql',
-    require       => Remote_database['cinder'],
-}
-
-remote_database_grant { 'cinder@%%/cinder':
-    privileges  => "all",
-    db_host     => '%(CONFIG_MYSQL_HOST)s',
-    db_user     => '%(CONFIG_MYSQL_USER)s',
-    db_password => '%(CONFIG_MYSQL_PW)s',
-    provider    => 'mysql',
-    require     => Remote_database_user['cinder@%%'],
-}
diff --git a/packstack/puppet/templates/mysql_glance_install.pp b/packstack/puppet/templates/mysql_glance_install.pp
deleted file mode 100644
index 0a1159869..000000000
--- a/packstack/puppet/templates/mysql_glance_install.pp
+++ /dev/null
@@ -1,5 +0,0 @@
-class {"glance::db::mysql":
-    password      => "%(CONFIG_GLANCE_DB_PW)s",
-    allowed_hosts => "%%",
-    charset       => "utf8",
-}
diff --git a/packstack/puppet/templates/mysql_glance_noinstall.pp b/packstack/puppet/templates/mysql_glance_noinstall.pp
deleted file mode 100644
index 1578aec71..000000000
--- a/packstack/puppet/templates/mysql_glance_noinstall.pp
+++ /dev/null
@@ -1,27 +0,0 @@
-
-remote_database { 'glance':
-    ensure      => 'present',
-    charset     => 'utf8',
-    db_host     => '%(CONFIG_MYSQL_HOST)s',
-    db_user     => '%(CONFIG_MYSQL_USER)s',
-    db_password => '%(CONFIG_MYSQL_PW)s',
-    provider    => 'mysql',
-}
-
-remote_database_user { 'glance@%%':
-    password_hash => mysql_password('%(CONFIG_GLANCE_DB_PW)s' ),
-    db_host       => '%(CONFIG_MYSQL_HOST)s',
-    db_user       => '%(CONFIG_MYSQL_USER)s',
-    db_password   => '%(CONFIG_MYSQL_PW)s',
-    provider      => 'mysql',
-    require       => Remote_database['glance'],
-}
-
-remote_database_grant { 'glance@%%/glance':
-    privileges  => "all",
-    db_host     => '%(CONFIG_MYSQL_HOST)s',
-    db_user     => '%(CONFIG_MYSQL_USER)s',
-    db_password => '%(CONFIG_MYSQL_PW)s',
-    provider    => 'mysql',
-    require     => Remote_database_user['glance@%%'],
-}
diff --git a/packstack/puppet/templates/mysql_heat_install.pp b/packstack/puppet/templates/mysql_heat_install.pp
deleted file mode 100644
index a593e97e9..000000000
--- a/packstack/puppet/templates/mysql_heat_install.pp
+++ /dev/null
@@ -1,5 +0,0 @@
-class {"heat::db::mysql":
-    password      => "%(CONFIG_HEAT_DB_PW)s",
-    allowed_hosts => "%%",
-    charset       => "utf8",
-}
diff --git a/packstack/puppet/templates/mysql_heat_noinstall.pp b/packstack/puppet/templates/mysql_heat_noinstall.pp
deleted file mode 100644
index 7bc36eb88..000000000
--- a/packstack/puppet/templates/mysql_heat_noinstall.pp
+++ /dev/null
@@ -1,27 +0,0 @@
-
-remote_database { 'heat':
-    ensure      => 'present',
-    charset     => 'utf8',
-    db_host     => '%(CONFIG_MYSQL_HOST)s',
-    db_user     => '%(CONFIG_MYSQL_USER)s',
-    db_password => '%(CONFIG_MYSQL_PW)s',
-    provider    => 'mysql',
-}
-
-remote_database_user { 'heat@%%':
-    password_hash => mysql_password('%(CONFIG_HEAT_DB_PW)s'),
-    db_host       => '%(CONFIG_MYSQL_HOST)s',
-    db_user       => '%(CONFIG_MYSQL_USER)s',
-    db_password   => '%(CONFIG_MYSQL_PW)s',
-    provider      => 'mysql',
-    require       => Remote_database['heat'],
-}
-
-remote_database_grant { 'heat@%%/heat':
-    privileges  => "all",
-    db_host     => '%(CONFIG_MYSQL_HOST)s',
-    db_user     => '%(CONFIG_MYSQL_USER)s',
-    db_password => '%(CONFIG_MYSQL_PW)s',
-    provider    => 'mysql',
-    require     => Remote_database_user['heat@%%'],
-}
diff --git a/packstack/puppet/templates/mysql_install.pp b/packstack/puppet/templates/mysql_install.pp
deleted file mode 100644
index fab2d93b2..000000000
--- a/packstack/puppet/templates/mysql_install.pp
+++ /dev/null
@@ -1,25 +0,0 @@
-
-class {"mysql::server":
-    package_name => "mariadb-galera-server",
-    config_hash => {bind_address => "0.0.0.0",
-                    default_engine => "InnoDB",
-                    root_password => "%(CONFIG_MYSQL_PW)s",}
-}
-
-# deleting database users for security
-# this is done in mysql::server::account_security but has problems
-# when there is no fqdn, so we're defining a slightly different one here
-database_user { [ 'root@127.0.0.1', 'root@::1', '@localhost', '@%%' ]:
-    ensure  => 'absent', require => Class['mysql::config'],
-}
-if ($::fqdn != "" and $::fqdn != "localhost") {
-    database_user { [ "root@${::fqdn}", "@${::fqdn}"]:
-        ensure  => 'absent', require => Class['mysql::config'],
-    }
-}
-if ($::fqdn != $::hostname and $::hostname != "localhost") {
-    database_user { ["root@${::hostname}", "@${::hostname}"]:
-        ensure  => 'absent', require => Class['mysql::config'],
-    }
-}
-
diff --git a/packstack/puppet/templates/mysql_keystone_install.pp b/packstack/puppet/templates/mysql_keystone_install.pp
deleted file mode 100644
index 9adf46b5f..000000000
--- a/packstack/puppet/templates/mysql_keystone_install.pp
+++ /dev/null
@@ -1,6 +0,0 @@
-class {"keystone::db::mysql":
-    user          => 'keystone_admin',
-    password      => "%(CONFIG_KEYSTONE_DB_PW)s",
-    allowed_hosts => "%%",
-    charset       => "utf8",
-}
diff --git a/packstack/puppet/templates/mysql_keystone_noinstall.pp b/packstack/puppet/templates/mysql_keystone_noinstall.pp
deleted file mode 100644
index 7d71dc49a..000000000
--- a/packstack/puppet/templates/mysql_keystone_noinstall.pp
+++ /dev/null
@@ -1,27 +0,0 @@
-
-remote_database { 'keystone':
-    ensure      => 'present',
-    charset     => 'utf8',
-    db_host     => '%(CONFIG_MYSQL_HOST)s',
-    db_user     => '%(CONFIG_MYSQL_USER)s',
-    db_password => '%(CONFIG_MYSQL_PW)s',
-    provider    => 'mysql',
-}
-
-remote_database_user { 'keystone_admin@%%':
-    password_hash => mysql_password('%(CONFIG_KEYSTONE_DB_PW)s' ),
-    db_host       => '%(CONFIG_MYSQL_HOST)s',
-    db_user       => '%(CONFIG_MYSQL_USER)s',
-    db_password   => '%(CONFIG_MYSQL_PW)s',
-    provider      => 'mysql',
-    require       => Remote_database['keystone'],
-}
-
-remote_database_grant { 'keystone_admin@%%/keystone':
-    privileges  => "all",
-    db_host     => '%(CONFIG_MYSQL_HOST)s',
-    db_user     => '%(CONFIG_MYSQL_USER)s',
-    db_password => '%(CONFIG_MYSQL_PW)s',
-    provider    => 'mysql',
-    require     => Remote_database_user['keystone_admin@%%'],
-}
diff --git a/packstack/puppet/templates/mysql_neutron_install.pp b/packstack/puppet/templates/mysql_neutron_install.pp
deleted file mode 100644
index cba7eb479..000000000
--- a/packstack/puppet/templates/mysql_neutron_install.pp
+++ /dev/null
@@ -1,6 +0,0 @@
-class {"neutron::db::mysql":
-    password      => "%(CONFIG_NEUTRON_DB_PW)s",
-    allowed_hosts => "%%",
-    dbname        => '%(CONFIG_NEUTRON_L2_DBNAME)s',
-    charset       => "utf8",
-}
diff --git a/packstack/puppet/templates/mysql_neutron_noinstall.pp b/packstack/puppet/templates/mysql_neutron_noinstall.pp
deleted file mode 100644
index 913b38886..000000000
--- a/packstack/puppet/templates/mysql_neutron_noinstall.pp
+++ /dev/null
@@ -1,27 +0,0 @@
-
-remote_database { '%(CONFIG_NEUTRON_L2_DBNAME)s':
-    ensure      => 'present',
-    charset     => 'utf8',
-    db_host     => '%(CONFIG_MYSQL_HOST)s',
-    db_user     => '%(CONFIG_MYSQL_USER)s',
-    db_password => '%(CONFIG_MYSQL_PW)s',
-    provider    => 'mysql',
-}
-
-remote_database_user { 'neutron@%%':
-    password_hash => mysql_password('%(CONFIG_NEUTRON_DB_PW)s' ),
-    db_host       => '%(CONFIG_MYSQL_HOST)s',
-    db_user       => '%(CONFIG_MYSQL_USER)s',
-    db_password   => '%(CONFIG_MYSQL_PW)s',
-    provider      => 'mysql',
-    require       => Remote_database['%(CONFIG_NEUTRON_L2_DBNAME)s'],
-}
-
-remote_database_grant { 'neutron@%%/%(CONFIG_NEUTRON_L2_DBNAME)s':
-    privileges  => "all",
-    db_host     => '%(CONFIG_MYSQL_HOST)s',
-    db_user     => '%(CONFIG_MYSQL_USER)s',
-    db_password => '%(CONFIG_MYSQL_PW)s',
-    provider    => 'mysql',
-    require     => Remote_database_user['neutron@%%'],
-}
diff --git a/packstack/puppet/templates/mysql_noinstall.pp b/packstack/puppet/templates/mysql_noinstall.pp
deleted file mode 100644
index 69356c573..000000000
--- a/packstack/puppet/templates/mysql_noinstall.pp
+++ /dev/null
@@ -1,8 +0,0 @@
-
-package { 'mysql':
-    ensure => 'present',
-}
-
-Package ['mysql'] -> Remote_database<||>
-Package ['mysql'] -> Remote_database_user<||>
-Package ['mysql'] -> Remote_database_grant<||>
diff --git a/packstack/puppet/templates/mysql_nova_install.pp b/packstack/puppet/templates/mysql_nova_install.pp
deleted file mode 100644
index cd9fa113f..000000000
--- a/packstack/puppet/templates/mysql_nova_install.pp
+++ /dev/null
@@ -1,5 +0,0 @@
-class {"nova::db::mysql":
-    password      => "%(CONFIG_NOVA_DB_PW)s",
-    allowed_hosts => "%%",
-    charset       => "utf8",
-}
diff --git a/packstack/puppet/templates/mysql_nova_noinstall.pp b/packstack/puppet/templates/mysql_nova_noinstall.pp
deleted file mode 100644
index 4a0c627ef..000000000
--- a/packstack/puppet/templates/mysql_nova_noinstall.pp
+++ /dev/null
@@ -1,27 +0,0 @@
-
-remote_database { 'nova':
-    ensure      => 'present',
-    charset     => 'utf8',
-    db_host     => '%(CONFIG_MYSQL_HOST)s',
-    db_user     => '%(CONFIG_MYSQL_USER)s',
-    db_password => '%(CONFIG_MYSQL_PW)s',
-    provider    => 'mysql',
-}
-
-remote_database_user { 'nova@%%':
-    password_hash => mysql_password('%(CONFIG_NOVA_DB_PW)s' ),
-    db_host       => '%(CONFIG_MYSQL_HOST)s',
-    db_user       => '%(CONFIG_MYSQL_USER)s',
-    db_password   => '%(CONFIG_MYSQL_PW)s',
-    provider      => 'mysql',
-    require       => Remote_database['nova'],
-}
-
-remote_database_grant { 'nova@%%/nova':
-    privileges  => "all",
-    db_host     => '%(CONFIG_MYSQL_HOST)s',
-    db_user     => '%(CONFIG_MYSQL_USER)s',
-    db_password => '%(CONFIG_MYSQL_PW)s',
-    provider    => 'mysql',
-    require     => Remote_database_user['nova@%%'],
-}
diff --git a/packstack/puppet/templates/nagios_nrpe.pp b/packstack/puppet/templates/nagios_nrpe.pp
deleted file mode 100644
index e4b6ddac5..000000000
--- a/packstack/puppet/templates/nagios_nrpe.pp
+++ /dev/null
@@ -1,45 +0,0 @@
-package{'nrpe':
-    ensure => present,
-    before => Class['nagios_configs']
-}
-
-file{'/etc/nagios/nrpe.cfg':
-    ensure => 'present',
-    mode => '0644',
-    owner => 'nagios',
-    group => 'nagios',
-    require => Package['nrpe'],
-}
-
-class nagios_configs(){
-    file_line{'allowed_hosts':
-        path => '/etc/nagios/nrpe.cfg',
-        match => 'allowed_hosts=',
-        line => 'allowed_hosts=%(CONFIG_NAGIOS_HOST)s',
-    }
-
-    # 5 minute load average
-    file_line{'load5':
-        path => '/etc/nagios/nrpe.cfg',
-        match => 'command\[load5\]=',
-        line => 'command[load5]=cut /proc/loadavg -f 1 -d " "',
-    }
-
-    # disk used on /var
-    file_line{'df_var':
-        path => '/etc/nagios/nrpe.cfg',
-        match => "command\[df_var\]=",
-        line => "command[df_var]=df /var/ | sed -re 's/.* ([0-9]+)%%.*/\\1/' | grep -E '^[0-9]'",
-    }
-}
-class{'nagios_configs':
-    notify => Service['nrpe'],
-}
-
-service{'nrpe':
-    ensure => running,
-    enable => true,
-    hasstatus => true,
-}
-
-
diff --git a/packstack/puppet/templates/nagios_server.pp b/packstack/puppet/templates/nagios_server.pp
deleted file mode 100644
index 24c7376db..000000000
--- a/packstack/puppet/templates/nagios_server.pp
+++ /dev/null
@@ -1,75 +0,0 @@
-package{['nagios', 'nagios-plugins-nrpe', 'nagios-plugins-ping']:
-    ensure => present,
-    before => Class['nagios_configs']
-}
-
-class nagios_configs(){
-    file{['/etc/nagios/nagios_command.cfg', '/etc/nagios/nagios_host.cfg']:
-        ensure => 'present',
-        mode => '0644',
-        owner => 'nagios',
-        group => 'nagios',
-    }
-
-    # Remove the entry for localhost, it contains services we're not
-    # monitoring
-    file{['/etc/nagios/objects/localhost.cfg']:
-        ensure => 'present',
-        content => '',
-    }
-
-    file_line{'nagios_host':
-        path => '/etc/nagios/nagios.cfg',
-        line => 'cfg_file=/etc/nagios/nagios_host.cfg',
-    }
-
-    file_line{'nagios_command':
-        path => '/etc/nagios/nagios.cfg',
-        line => 'cfg_file=/etc/nagios/nagios_command.cfg',
-    }
-
-    file_line{'nagios_service':
-        path => '/etc/nagios/nagios.cfg',
-        line => 'cfg_file=/etc/nagios/nagios_service.cfg',
-    }
-
-    nagios_command{'check_nrpe':
-        command_line => '/usr/lib64/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -c $ARG1$',
-    }
-
-    exec{'nagiospasswd':
-        command => '/usr/bin/htpasswd -b /etc/nagios/passwd nagiosadmin %(CONFIG_NAGIOS_PW)s',
-    }
-
-    file {"/etc/nagios/keystonerc_admin":
-        ensure  => "present", owner  => "nagios", mode => '0600',
-        content => "export OS_USERNAME=admin
-export OS_TENANT_NAME=admin
-export OS_PASSWORD=%(CONFIG_KEYSTONE_ADMIN_PW)s
-export OS_AUTH_URL=http://%(CONFIG_KEYSTONE_HOST)s:35357/v2.0/ ",}
-
-    %(CONFIG_NAGIOS_MANIFEST_CONFIG)s
-}
-
-class{'nagios_configs':
-    notify => [Service['nagios'], Service['httpd']],
-}
-
-include concat::setup
-
-class {'apache':
-    purge_configs => false,
-}
-class {'apache::mod::php': }
-
-service{['nagios']:
-    ensure => running,
-    enable => true,
-    hasstatus => true,
-}
-
-firewall { '001 nagios incoming':
-    proto    => 'tcp',
-    dport    => ['80'],
-    action   => 'accept',
-}
diff --git a/packstack/puppet/templates/network.pp b/packstack/puppet/templates/network.pp
new file mode 100644
index 000000000..6270de0e0
--- /dev/null
+++ b/packstack/puppet/templates/network.pp
@@ -0,0 +1,45 @@
+stage { "init": before  => Stage["main"] }
+
+Exec { timeout => lookup('DEFAULT_EXEC_TIMEOUT') }
+Package { allow_virtual => true }
+
+class { 'packstack::prereqs':
+  stage => init,
+}
+
+include firewall
+
+if lookup('CONFIG_NTP_SERVERS', undef, undef, '') != '' {
+  include 'packstack::chrony'
+}
+
+if lookup('CONFIG_NEUTRON_INSTALL') == 'y' {
+  include 'packstack::neutron::rabbitmq'
+
+  if lookup('CONFIG_NEUTRON_VPNAAS') == 'y' {
+    include 'packstack::neutron::vpnaas'
+  }
+  if lookup('CONFIG_NEUTRON_L2_AGENT') != 'ovn' {
+    include 'packstack::neutron::l3'
+  }
+  if lookup('CONFIG_NEUTRON_OVS_BRIDGE_CREATE') == 'y' {
+    include 'packstack::neutron::ovs_bridge'
+  }
+
+  case lookup('CONFIG_NEUTRON_L2_AGENT') {
+    'openvswitch': { include 'packstack::neutron::ovs_agent' }
+    'ovn':         { include 'packstack::neutron::ovn_agent' }
+    default:       { include 'packstack::neutron::ovs_agent' }
+  }
+  include 'packstack::neutron::bridge'
+  if lookup('CONFIG_NEUTRON_L2_AGENT') != 'ovn' {
+    include 'packstack::neutron::dhcp'
+    include 'packstack::neutron::metadata'
+  }
+  if lookup('CONFIG_NEUTRON_METERING_AGENT_INSTALL') == 'y' {
+    include 'packstack::neutron::metering'
+  }
+  if lookup('CONFIG_PROVISION_DEMO') == 'y' or lookup('CONFIG_PROVISION_TEMPEST') == 'y' {
+    include 'packstack::provision::bridge'
+  }
+}
diff --git a/packstack/puppet/templates/neutron.pp b/packstack/puppet/templates/neutron.pp
deleted file mode 100644
index 5afbcfe0b..000000000
--- a/packstack/puppet/templates/neutron.pp
+++ /dev/null
@@ -1,9 +0,0 @@
-$neutron_db_host = '%(CONFIG_MYSQL_HOST)s'
-$neutron_db_name = '%(CONFIG_NEUTRON_L2_DBNAME)s'
-$neutron_db_user = 'neutron'
-$neutron_db_password = '%(CONFIG_NEUTRON_DB_PW)s'
-$neutron_sql_connection = "mysql://${neutron_db_user}:${neutron_db_password}@${neutron_db_host}/${neutron_db_name}"
-
-$neutron_user_password = '%(CONFIG_NEUTRON_KS_PW)s'
-
-
diff --git a/packstack/puppet/templates/neutron_api.pp b/packstack/puppet/templates/neutron_api.pp
deleted file mode 100644
index aa0140a32..000000000
--- a/packstack/puppet/templates/neutron_api.pp
+++ /dev/null
@@ -1,16 +0,0 @@
-class { 'neutron::server':
-  sql_connection => $neutron_sql_connection,
-  connection => $neutron_sql_connection,
-  auth_password => $neutron_user_password,
-  auth_host => '%(CONFIG_KEYSTONE_HOST)s',
-  enabled => true,
-}
-
-exec { 'neutron-db-manage upgrade':
-  command     => 'neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini upgrade head',
-  path        => '/usr/bin',
-  user        => 'neutron',
-  logoutput   => 'on_failure',
-  before      => Service['neutron-server'],
-  require     => [Neutron_config['database/connection'], Neutron_config['DEFAULT/core_plugin']],
-}
diff --git a/packstack/puppet/templates/neutron_bridge_module.pp b/packstack/puppet/templates/neutron_bridge_module.pp
deleted file mode 100644
index 919037d05..000000000
--- a/packstack/puppet/templates/neutron_bridge_module.pp
+++ /dev/null
@@ -1,2 +0,0 @@
-
-class { 'packstack::neutron::bridge': }
diff --git a/packstack/puppet/templates/neutron_dhcp.pp b/packstack/puppet/templates/neutron_dhcp.pp
deleted file mode 100644
index d674c8b84..000000000
--- a/packstack/puppet/templates/neutron_dhcp.pp
+++ /dev/null
@@ -1,3 +0,0 @@
-class { 'neutron::agents::dhcp':
-  interface_driver => '%(CONFIG_NEUTRON_DHCP_INTERFACE_DRIVER)s',
-}
diff --git a/packstack/puppet/templates/neutron_l3.pp b/packstack/puppet/templates/neutron_l3.pp
deleted file mode 100644
index e512143dd..000000000
--- a/packstack/puppet/templates/neutron_l3.pp
+++ /dev/null
@@ -1,8 +0,0 @@
-class { 'neutron::agents::l3':
-  interface_driver        => '%(CONFIG_NEUTRON_L3_INTERFACE_DRIVER)s',
-  external_network_bridge => '%(CONFIG_NEUTRON_L3_EXT_BRIDGE)s',
-}
-
-sysctl::value { 'net.ipv4.ip_forward':
-  value => '1'
-}
diff --git a/packstack/puppet/templates/neutron_lb_agent.pp b/packstack/puppet/templates/neutron_lb_agent.pp
deleted file mode 100644
index a22c22fd6..000000000
--- a/packstack/puppet/templates/neutron_lb_agent.pp
+++ /dev/null
@@ -1,3 +0,0 @@
-class {'neutron::agents::linuxbridge':
-  physical_interface_mappings => '%(CONFIG_NEUTRON_LB_INTERFACE_MAPPINGS)s',
-}
diff --git a/packstack/puppet/templates/neutron_lb_plugin.pp b/packstack/puppet/templates/neutron_lb_plugin.pp
deleted file mode 100644
index 90ecfc4bd..000000000
--- a/packstack/puppet/templates/neutron_lb_plugin.pp
+++ /dev/null
@@ -1,4 +0,0 @@
-class { 'neutron::plugins::linuxbridge':
-  tenant_network_type => '%(CONFIG_NEUTRON_LB_TENANT_NETWORK_TYPE)s',
-  network_vlan_ranges => '%(CONFIG_NEUTRON_LB_VLAN_RANGES)s',
-}
diff --git a/packstack/puppet/templates/neutron_lbaas.pp b/packstack/puppet/templates/neutron_lbaas.pp
deleted file mode 100644
index 5d06be7ae..000000000
--- a/packstack/puppet/templates/neutron_lbaas.pp
+++ /dev/null
@@ -1,5 +0,0 @@
-class { 'neutron::agents::lbaas':
-  interface_driver => '%(CONFIG_NEUTRON_LBAAS_INTERFACE_DRIVER)s',
-  device_driver => 'neutron.services.loadbalancer.drivers.haproxy.namespace_driver.HaproxyNSDriver',
-  user_group => 'haproxy',
-}
diff --git a/packstack/puppet/templates/neutron_metadata.pp b/packstack/puppet/templates/neutron_metadata.pp
deleted file mode 100644
index cb628b4b8..000000000
--- a/packstack/puppet/templates/neutron_metadata.pp
+++ /dev/null
@@ -1,6 +0,0 @@
-class {'neutron::agents::metadata':
-  auth_password => '%(CONFIG_NEUTRON_KS_PW)s',
-  auth_url      => 'http://%(CONFIG_KEYSTONE_HOST)s:35357/v2.0',
-  shared_secret => '%(CONFIG_NEUTRON_METADATA_PW)s',
-  metadata_ip   => '%(CONFIG_NOVA_API_HOST)s',
-}
diff --git a/packstack/puppet/templates/neutron_ml2_plugin.pp b/packstack/puppet/templates/neutron_ml2_plugin.pp
deleted file mode 100644
index 80b630bf0..000000000
--- a/packstack/puppet/templates/neutron_ml2_plugin.pp
+++ /dev/null
@@ -1,34 +0,0 @@
-
-# We need this before https://review.openstack.org/#/c/67004/ will be merged
-if 'openvswitch' in %(CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS)s and !defined(Package['neutron-plugin-ovs']) {
-  package {'neutron-plugin-ovs':
-    name   => 'openstack-neutron-openvswitch',
-    ensure => 'installed',
-    before => Class['neutron::plugins::ml2']
-  }
-}
-
-if 'linuxbridge' in %(CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS)s and !defined(Package['neutron-plugin-linuxbridge']) {
-  package {'neutron-plugin-linuxbridge':
-    name   => 'openstack-neutron-linuxbridge',
-    ensure => 'installed',
-    before => Class['neutron::plugins::ml2']
-  }
-}
-
-class { 'neutron::plugins::ml2':
-  type_drivers          => %(CONFIG_NEUTRON_ML2_TYPE_DRIVERS)s,
-  tenant_network_types  => %(CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES)s,
-  mechanism_drivers     => %(CONFIG_NEUTRON_ML2_MECHANISM_DRIVERS)s,
-  flat_networks         => %(CONFIG_NEUTRON_ML2_FLAT_NETWORKS)s,
-  network_vlan_ranges   => %(CONFIG_NEUTRON_ML2_VLAN_RANGES)s,
-  tunnel_id_ranges      => %(CONFIG_NEUTRON_ML2_TUNNEL_ID_RANGES)s,
-  vxlan_group           => %(CONFIG_NEUTRON_ML2_VXLAN_GROUP)s,
-  vni_ranges            => %(CONFIG_NEUTRON_ML2_VNI_RANGES)s,
-  enable_security_group => 'dummy',
-}
-
-# For cases where "neutron-db-manage upgrade" command is called we need to fill config file first
-if defined(Exec['neutron-db-manage upgrade']) {
-  Neutron_plugin_ml2<||> -> File['/etc/neutron/plugin.ini'] -> Exec['neutron-db-manage upgrade']
-}
diff --git a/packstack/puppet/templates/neutron_notifications.pp b/packstack/puppet/templates/neutron_notifications.pp
deleted file mode 100644
index ebca9b432..000000000
--- a/packstack/puppet/templates/neutron_notifications.pp
+++ /dev/null
@@ -1,9 +0,0 @@
-# Configure nova notifications system
-class { 'neutron::server::notifications':
-    nova_admin_username    => 'nova',
-    nova_admin_password    => '%(CONFIG_NOVA_KS_PW)s',
-    nova_admin_tenant_name => 'services',
-    nova_url               => 'http://%(CONFIG_NOVA_API_HOST)s:8774/v2',
-    nova_admin_auth_url    => 'http://%(CONFIG_KEYSTONE_HOST)s:35357/v2.0',
-}
-
diff --git a/packstack/puppet/templates/neutron_ovs_agent_gre.pp b/packstack/puppet/templates/neutron_ovs_agent_gre.pp
deleted file mode 100644
index 0f635b031..000000000
--- a/packstack/puppet/templates/neutron_ovs_agent_gre.pp
+++ /dev/null
@@ -1,20 +0,0 @@
-if "%(CONFIG_NEUTRON_OVS_TUNNEL_IF)s" {
-  $localip = $ipaddress_%(CONFIG_NEUTRON_OVS_TUNNEL_IF)s
-} else {
-  $localip = '%(CONFIG_NEUTRON_OVS_HOST)s'
-}
-
-class { 'neutron::agents::ovs':
-  bridge_mappings => %(CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS)s,
-  enable_tunneling => true,
-  tunnel_types => ['gre'],
-  local_ip => $localip,
-}
-
-file { 'ovs_neutron_plugin.ini':
-    path  => '/etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini',
-    owner => 'root',
-    group => 'neutron',
-    before => Service['ovs-cleanup-service'],
-    require => Package['neutron-plugin-ovs'],
-}
diff --git a/packstack/puppet/templates/neutron_ovs_agent_local.pp b/packstack/puppet/templates/neutron_ovs_agent_local.pp
deleted file mode 100644
index 3516b8330..000000000
--- a/packstack/puppet/templates/neutron_ovs_agent_local.pp
+++ /dev/null
@@ -1,11 +0,0 @@
-class { 'neutron::agents::ovs':
-  bridge_mappings => %(CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS)s,
-}
-
-file { 'ovs_neutron_plugin.ini':
-    path  => '/etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini',
-    owner => 'root',
-    group => 'neutron',
-    before => Service['ovs-cleanup-service'],
-    require => Package['neutron-plugin-ovs'],
-}
diff --git a/packstack/puppet/templates/neutron_ovs_agent_vlan.pp b/packstack/puppet/templates/neutron_ovs_agent_vlan.pp
deleted file mode 100644
index 3516b8330..000000000
--- a/packstack/puppet/templates/neutron_ovs_agent_vlan.pp
+++ /dev/null
@@ -1,11 +0,0 @@
-class { 'neutron::agents::ovs':
-  bridge_mappings => %(CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS)s,
-}
-
-file { 'ovs_neutron_plugin.ini':
-    path  => '/etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini',
-    owner => 'root',
-    group => 'neutron',
-    before => Service['ovs-cleanup-service'],
-    require => Package['neutron-plugin-ovs'],
-}
diff --git a/packstack/puppet/templates/neutron_ovs_agent_vxlan.pp b/packstack/puppet/templates/neutron_ovs_agent_vxlan.pp
deleted file mode 100644
index 078a0eea8..000000000
--- a/packstack/puppet/templates/neutron_ovs_agent_vxlan.pp
+++ /dev/null
@@ -1,22 +0,0 @@
-
-if "%(CONFIG_NEUTRON_OVS_TUNNEL_IF)s" {
-  $localip = $ipaddress_%(CONFIG_NEUTRON_OVS_TUNNEL_IF)s
-} else {
-  $localip = '%(CONFIG_NEUTRON_OVS_HOST)s'
-}
-
-class { 'neutron::agents::ovs':
-  bridge_mappings => %(CONFIG_NEUTRON_OVS_BRIDGE_MAPPINGS)s,
-  enable_tunneling => true,
-  tunnel_types => ['vxlan'],
-  local_ip => $localip,
-  vxlan_udp_port => %(CONFIG_NEUTRON_OVS_VXLAN_UDP_PORT)s,
-}
-
-file { 'ovs_neutron_plugin.ini':
-    path  => '/etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini',
-    owner => 'root',
-    group => 'neutron',
-    before => Service['ovs-cleanup-service'],
-    require => Package['neutron-plugin-ovs'],
-}
diff --git a/packstack/puppet/templates/neutron_ovs_bridge.pp b/packstack/puppet/templates/neutron_ovs_bridge.pp
deleted file mode 100644
index 223900e9e..000000000
--- a/packstack/puppet/templates/neutron_ovs_bridge.pp
+++ /dev/null
@@ -1,4 +0,0 @@
-vs_bridge { '%(CONFIG_NEUTRON_OVS_BRIDGE)s':
-  ensure => present,
-  require => Service['neutron-plugin-ovs-service']
-}
diff --git a/packstack/puppet/templates/neutron_ovs_plugin_gre.pp b/packstack/puppet/templates/neutron_ovs_plugin_gre.pp
deleted file mode 100644
index 90e0e7fef..000000000
--- a/packstack/puppet/templates/neutron_ovs_plugin_gre.pp
+++ /dev/null
@@ -1,5 +0,0 @@
-class { 'neutron::plugins::ovs':
-  tenant_network_type => '%(CONFIG_NEUTRON_OVS_TENANT_NETWORK_TYPE)s',
-  network_vlan_ranges => '%(CONFIG_NEUTRON_OVS_VLAN_RANGES)s',
-  tunnel_id_ranges => '%(CONFIG_NEUTRON_OVS_TUNNEL_RANGES)s',
-}
diff --git a/packstack/puppet/templates/neutron_ovs_plugin_local.pp b/packstack/puppet/templates/neutron_ovs_plugin_local.pp
deleted file mode 100644
index 08b293093..000000000
--- a/packstack/puppet/templates/neutron_ovs_plugin_local.pp
+++ /dev/null
@@ -1,4 +0,0 @@
-class { 'neutron::plugins::ovs':
-  tenant_network_type => '%(CONFIG_NEUTRON_OVS_TENANT_NETWORK_TYPE)s',
-  network_vlan_ranges => '%(CONFIG_NEUTRON_OVS_VLAN_RANGES)s',
-}
diff --git a/packstack/puppet/templates/neutron_ovs_plugin_vlan.pp b/packstack/puppet/templates/neutron_ovs_plugin_vlan.pp
deleted file mode 100644
index 08b293093..000000000
--- a/packstack/puppet/templates/neutron_ovs_plugin_vlan.pp
+++ /dev/null
@@ -1,4 +0,0 @@
-class { 'neutron::plugins::ovs':
-  tenant_network_type => '%(CONFIG_NEUTRON_OVS_TENANT_NETWORK_TYPE)s',
-  network_vlan_ranges => '%(CONFIG_NEUTRON_OVS_VLAN_RANGES)s',
-}
diff --git a/packstack/puppet/templates/neutron_ovs_plugin_vxlan.pp b/packstack/puppet/templates/neutron_ovs_plugin_vxlan.pp
deleted file mode 100644
index 5504cb0a3..000000000
--- a/packstack/puppet/templates/neutron_ovs_plugin_vxlan.pp
+++ /dev/null
@@ -1,7 +0,0 @@
-
-class { 'neutron::plugins::ovs':
-  tenant_network_type => '%(CONFIG_NEUTRON_OVS_TENANT_NETWORK_TYPE)s',
-  network_vlan_ranges => '%(CONFIG_NEUTRON_OVS_VLAN_RANGES)s',
-  tunnel_id_ranges => '%(CONFIG_NEUTRON_OVS_TUNNEL_RANGES)s',
-  vxlan_udp_port => %(CONFIG_NEUTRON_OVS_VXLAN_UDP_PORT)s,
-}
diff --git a/packstack/puppet/templates/neutron_ovs_port.pp b/packstack/puppet/templates/neutron_ovs_port.pp
deleted file mode 100644
index 787c0510a..000000000
--- a/packstack/puppet/templates/neutron_ovs_port.pp
+++ /dev/null
@@ -1,5 +0,0 @@
-vs_port { '%(CONFIG_NEUTRON_OVS_IFACE)s':
-  bridge => '%(CONFIG_NEUTRON_OVS_BRIDGE)s',
-  ensure => present
-}
-
diff --git a/packstack/puppet/templates/neutron_qpid.pp b/packstack/puppet/templates/neutron_qpid.pp
deleted file mode 100644
index 9c107c86e..000000000
--- a/packstack/puppet/templates/neutron_qpid.pp
+++ /dev/null
@@ -1,14 +0,0 @@
-
-class { 'neutron':
-  rpc_backend           => 'neutron.openstack.common.rpc.impl_qpid',
-  qpid_hostname         => '%(CONFIG_AMQP_HOST)s',
-  qpid_username         => '%(CONFIG_AMQP_AUTH_USER)s',
-  qpid_password         => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-  qpid_port             => '%(CONFIG_AMQP_CLIENTS_PORT)s',
-  qpid_protocol         => '%(CONFIG_AMQP_PROTOCOL)s',
-  core_plugin           => '%(CONFIG_NEUTRON_CORE_PLUGIN)s',
-  allow_overlapping_ips => true,
-  service_plugins       => %(SERVICE_PLUGINS)s,
-  verbose               => true,
-  debug                 => %(CONFIG_DEBUG_MODE)s,
-}
diff --git a/packstack/puppet/templates/neutron_rabbitmq.pp b/packstack/puppet/templates/neutron_rabbitmq.pp
deleted file mode 100644
index e84c23408..000000000
--- a/packstack/puppet/templates/neutron_rabbitmq.pp
+++ /dev/null
@@ -1,12 +0,0 @@
-
-class { 'neutron':
-  rabbit_host           => '%(CONFIG_AMQP_HOST)s',
-  rabbit_port           => '%(CONFIG_AMQP_CLIENTS_PORT)s',
-  rabbit_user           => '%(CONFIG_AMQP_AUTH_USER)s',
-  rabbit_password       => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-  core_plugin           => '%(CONFIG_NEUTRON_CORE_PLUGIN)s',
-  allow_overlapping_ips => true,
-  service_plugins       => %(SERVICE_PLUGINS)s,
-  verbose               => true,
-  debug                 => %(CONFIG_DEBUG_MODE)s,
-}
diff --git a/packstack/puppet/templates/nova_api.pp b/packstack/puppet/templates/nova_api.pp
deleted file mode 100644
index 8540dee9f..000000000
--- a/packstack/puppet/templates/nova_api.pp
+++ /dev/null
@@ -1,16 +0,0 @@
-
-require 'keystone::python'
-class {"nova::api":
-    enabled => true,
-    auth_host => "%(CONFIG_KEYSTONE_HOST)s",
-    admin_password => "%(CONFIG_NOVA_KS_PW)s",
-    neutron_metadata_proxy_shared_secret => %(CONFIG_NEUTRON_METADATA_PW_UNQUOTED)s
-}
-
-Package<| title == 'nova-common' |> -> Class['nova::api']
-
-firewall { '001 novaapi incoming':
-    proto    => 'tcp',
-    dport    => ['8773', '8774', '8775'],
-    action   => 'accept',
-}
diff --git a/packstack/puppet/templates/nova_ceilometer.pp b/packstack/puppet/templates/nova_ceilometer.pp
deleted file mode 100644
index c3676bcdc..000000000
--- a/packstack/puppet/templates/nova_ceilometer.pp
+++ /dev/null
@@ -1,8 +0,0 @@
-
-class { 'ceilometer::agent::auth':
-    auth_url      => 'http://%(CONFIG_KEYSTONE_HOST)s:35357/v2.0',
-    auth_password => '%(CONFIG_CEILOMETER_KS_PW)s',
-}
-
-class { 'ceilometer::agent::compute':
-}
diff --git a/packstack/puppet/templates/nova_ceilometer_qpid.pp b/packstack/puppet/templates/nova_ceilometer_qpid.pp
deleted file mode 100644
index 77a405dc8..000000000
--- a/packstack/puppet/templates/nova_ceilometer_qpid.pp
+++ /dev/null
@@ -1,11 +0,0 @@
-
-class { 'ceilometer':
-    metering_secret => '%(CONFIG_CEILOMETER_SECRET)s',
-    qpid_hostname   => '%(CONFIG_AMQP_HOST)s',
-    qpid_username  => '%(CONFIG_AMQP_AUTH_USER)s',
-    qpid_password  => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-    rpc_backend     => 'ceilometer.openstack.common.rpc.impl_qpid',
-    verbose         => true,
-    debug           => %(CONFIG_DEBUG_MODE)s
-}
-
diff --git a/packstack/puppet/templates/nova_ceilometer_rabbitmq.pp b/packstack/puppet/templates/nova_ceilometer_rabbitmq.pp
deleted file mode 100644
index 2303a0136..000000000
--- a/packstack/puppet/templates/nova_ceilometer_rabbitmq.pp
+++ /dev/null
@@ -1,10 +0,0 @@
-
-class { 'ceilometer':
-    metering_secret  => '%(CONFIG_CEILOMETER_SECRET)s',
-    rabbit_host      => '%(CONFIG_AMQP_HOST)s',
-    rabbit_userid    => '%(CONFIG_AMQP_AUTH_USER)s',
-    rabbit_password  => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-    verbose          => true,
-    debug            => %(CONFIG_DEBUG_MODE)s
-}
-
diff --git a/packstack/puppet/templates/nova_cert.pp b/packstack/puppet/templates/nova_cert.pp
deleted file mode 100644
index 165c73431..000000000
--- a/packstack/puppet/templates/nova_cert.pp
+++ /dev/null
@@ -1,4 +0,0 @@
-
-class {"nova::cert":
-    enabled => true,
-}
diff --git a/packstack/puppet/templates/nova_common.pp b/packstack/puppet/templates/nova_common.pp
deleted file mode 100644
index 16b6a537a..000000000
--- a/packstack/puppet/templates/nova_common.pp
+++ /dev/null
@@ -1,11 +0,0 @@
-
-# Ensure Firewall changes happen before nova services start
-# preventing a clash with rules being set by nova-compute and nova-network
-Firewall <| |> -> Class['nova']
-
-nova_config{
-    "DEFAULT/sql_connection": value => "%(CONFIG_NOVA_SQL_CONN)s";
-    "DEFAULT/metadata_host": value => "%(CONFIG_NOVA_METADATA_HOST)s";
-}
-
-
diff --git a/packstack/puppet/templates/nova_common_qpid.pp b/packstack/puppet/templates/nova_common_qpid.pp
deleted file mode 100644
index 148ab04f3..000000000
--- a/packstack/puppet/templates/nova_common_qpid.pp
+++ /dev/null
@@ -1,21 +0,0 @@
-
-class { "nova":
-    glance_api_servers => "%(CONFIG_GLANCE_HOST)s:9292",
-    qpid_hostname      => "%(CONFIG_AMQP_HOST)s",
-    qpid_username      => '%(CONFIG_AMQP_AUTH_USER)s',
-    qpid_password      => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-    rpc_backend        => 'nova.openstack.common.rpc.impl_qpid',
-    qpid_port          => '%(CONFIG_AMQP_CLIENTS_PORT)s',
-    qpid_protocol      => '%(CONFIG_AMQP_PROTOCOL)s',
-    verbose            => true,
-    debug              => %(CONFIG_DEBUG_MODE)s,
-    nova_public_key    => {
-      type             => '%(NOVA_MIGRATION_KEY_TYPE)s',
-      key              => '%(NOVA_MIGRATION_KEY_PUBLIC)s',
-    },
-    nova_private_key   => {
-      type             => '%(NOVA_MIGRATION_KEY_TYPE)s',
-      key              => '%(NOVA_MIGRATION_KEY_SECRET)s',
-    },
-    nova_shell => '/bin/bash',
-}
diff --git a/packstack/puppet/templates/nova_common_rabbitmq.pp b/packstack/puppet/templates/nova_common_rabbitmq.pp
deleted file mode 100644
index a3511a273..000000000
--- a/packstack/puppet/templates/nova_common_rabbitmq.pp
+++ /dev/null
@@ -1,19 +0,0 @@
-
-class { "nova":
-    glance_api_servers => "%(CONFIG_GLANCE_HOST)s:9292",
-    rabbit_host        => "%(CONFIG_AMQP_HOST)s",
-    rabbit_port        => '%(CONFIG_AMQP_CLIENTS_PORT)s',
-    rabbit_userid      => '%(CONFIG_AMQP_AUTH_USER)s',
-    rabbit_password    => '%(CONFIG_AMQP_AUTH_PASSWORD)s',
-    verbose            => true,
-    debug              => %(CONFIG_DEBUG_MODE)s,
-    nova_public_key    => {
-      type             => '%(NOVA_MIGRATION_KEY_TYPE)s',
-      key              => '%(NOVA_MIGRATION_KEY_PUBLIC)s',
-    },
-    nova_private_key   => {
-      type             => '%(NOVA_MIGRATION_KEY_TYPE)s',
-      key              => '%(NOVA_MIGRATION_KEY_SECRET)s',
-    },
-    nova_shell => '/bin/bash',
-}
diff --git a/packstack/puppet/templates/nova_compute.pp b/packstack/puppet/templates/nova_compute.pp
deleted file mode 100644
index f36cfcd15..000000000
--- a/packstack/puppet/templates/nova_compute.pp
+++ /dev/null
@@ -1,77 +0,0 @@
-package{'python-cinderclient':
-    before => Class["nova"]
-}
-
-# Install the private key to be used for live migration.  This needs to be configured
-# into libvirt/live_migration_uri in nova.conf.
-file { '/etc/nova/ssh':
-  ensure => directory,
-  owner  => root,
-  group  => root,
-  mode   => 0700,
-}
-
-file { '/etc/nova/ssh/nova_migration_key':
-  content => '%(NOVA_MIGRATION_KEY_SECRET)s',
-  mode    => 0600,
-  owner   => root,
-  group   => root,
-  require => File['/etc/nova/ssh'],
-}
-
-nova_config{
-    "DEFAULT/volume_api_class": value   => "nova.volume.cinder.API";
-    "libvirt/live_migration_uri": value => "qemu+ssh://nova@%%s/system?keyfile=/etc/nova/ssh/nova_migration_key";
-}
-
-class {"nova::compute":
-    enabled => true,
-    vncproxy_host => "%(CONFIG_NOVA_VNCPROXY_HOST)s",
-    vncserver_proxyclient_address => "%(CONFIG_NOVA_COMPUTE_HOST)s",
-}
-
-
-# Note : remove this once we're installing a version of openstack that isn't
-#        supported on RHEL 6.3
-if $::is_virtual_packstack == "true" and $::osfamily == "RedHat" and
-    $::operatingsystemrelease == "6.3"{
-    file { "/usr/bin/qemu-system-x86_64":
-        ensure => link,
-        target => "/usr/libexec/qemu-kvm",
-        notify => Service["nova-compute"],
-    }
-}
-
-# Tune the host with a virtual hosts profile
-package {'tuned':
-    ensure => present,
-}
-
-service {'tuned':
-    ensure => running,
-    require => Package['tuned'],
-}
-
-if $::operatingsystem == 'Fedora' and $::operatingsystemrelease == 19 {
-    # older tuned service is sometimes stucked on Fedora 19
-    exec {'tuned-update':
-       path => ['/sbin', '/usr/sbin', '/bin', '/usr/bin'],
-       command => 'yum update -y tuned',
-       logoutput => 'on_failure',
-    }
-
-    exec {'tuned-restart':
-       path => ['/sbin', '/usr/sbin', '/bin', '/usr/bin'],
-       command => 'systemctl restart tuned.service',
-       logoutput => 'on_failure',
-    }
-
-    Service['tuned'] -> Exec['tuned-update'] -> Exec['tuned-restart'] -> Exec['tuned-virtual-host']
-}
-
-exec {'tuned-virtual-host':
-    unless => '/usr/sbin/tuned-adm active | /bin/grep virtual-host',
-    command => '/usr/sbin/tuned-adm profile virtual-host',
-    require => Service['tuned'],
-}
-
diff --git a/packstack/puppet/templates/nova_compute_libvirt.pp b/packstack/puppet/templates/nova_compute_libvirt.pp
deleted file mode 100644
index 97ad5f591..000000000
--- a/packstack/puppet/templates/nova_compute_libvirt.pp
+++ /dev/null
@@ -1,56 +0,0 @@
-Firewall <| |> -> Class['nova::compute::libvirt']
-
-# Ensure Firewall changes happen before libvirt service start
-# preventing a clash with rules being set by libvirt
-
-if $::is_virtual_packstack == "true" {
-    $libvirt_type = "qemu"
-    nova_config{
-        "DEFAULT/libvirt_cpu_mode": value => "none";
-    }
-}else{
-    $libvirt_type = "kvm"
-}
-
-nova_config{
-  "DEFAULT/libvirt_inject_partition": value => "-1";
-}
-
-exec { 'qemu-kvm':
-    path => '/usr/bin',
-    command => 'yum install -y qemu-kvm',
-    before => Class['nova::compute::libvirt']
-}
-
-class { 'nova::compute::libvirt':
-  libvirt_type                => "$libvirt_type",
-  vncserver_listen            => "0.0.0.0",
-}
-
-exec {'load_kvm':
-    user => 'root',
-    command => '/bin/sh /etc/sysconfig/modules/kvm.modules',
-    onlyif => '/usr/bin/test -e /etc/sysconfig/modules/kvm.modules',
-}
-
-Class['nova::compute']-> Exec["load_kvm"]
-
-file_line { 'libvirt-guests':
-    path  => '/etc/sysconfig/libvirt-guests',
-    line  => 'ON_BOOT=ignore',
-    match => '^[\s#]*ON_BOOT=.*',
-    require => Class['nova::compute::libvirt']
-}
-
-# Remove libvirt's default network (usually virbr0) as it's unnecessary and can be confusing
-exec {'virsh-net-destroy-default':
-    onlyif  => '/usr/bin/virsh net-list | grep default',
-    command => '/usr/bin/virsh net-destroy default',
-    require => Package['libvirt'],
-}
-
-exec {'virsh-net-undefine-default':
-    onlyif  => '/usr/bin/virsh net-list --inactive | grep default',
-    command => '/usr/bin/virsh net-undefine default',
-    require => Exec['virsh-net-destroy-default'],
-}
diff --git a/packstack/puppet/templates/nova_compute_vmware.pp b/packstack/puppet/templates/nova_compute_vmware.pp
deleted file mode 100644
index a1a1d08e1..000000000
--- a/packstack/puppet/templates/nova_compute_vmware.pp
+++ /dev/null
@@ -1,6 +0,0 @@
-class { 'nova::compute::vmware':
-  host_ip       => "%(CONFIG_VCENTER_HOST)s",
-  host_username => "%(CONFIG_VCENTER_USER)s",
-  host_password => "%(CONFIG_VCENTER_PASSWORD)s",
-  cluster_name  => "%(CONFIG_VCENTER_CLUSTER_NAME)s",
-}
diff --git a/packstack/puppet/templates/nova_conductor.pp b/packstack/puppet/templates/nova_conductor.pp
deleted file mode 100644
index ed8750eaf..000000000
--- a/packstack/puppet/templates/nova_conductor.pp
+++ /dev/null
@@ -1,4 +0,0 @@
-
-class {"nova::conductor":
-    enabled => true,
-}
diff --git a/packstack/puppet/templates/nova_gluster.pp b/packstack/puppet/templates/nova_gluster.pp
deleted file mode 100644
index 1974d4564..000000000
--- a/packstack/puppet/templates/nova_gluster.pp
+++ /dev/null
@@ -1 +0,0 @@
-package { 'glusterfs-fuse': ensure => present }
\ No newline at end of file
diff --git a/packstack/puppet/templates/nova_metadata.pp b/packstack/puppet/templates/nova_metadata.pp
deleted file mode 100644
index 68926c0a6..000000000
--- a/packstack/puppet/templates/nova_metadata.pp
+++ /dev/null
@@ -1,7 +0,0 @@
-
-nova::generic_service { 'metadata-api':
-    enabled        => true,
-    ensure_package => 'present',
-    package_name   => 'openstack-nova-api',
-    service_name   => 'openstack-nova-metadata-api',
-}
diff --git a/packstack/puppet/templates/nova_network.pp b/packstack/puppet/templates/nova_network.pp
deleted file mode 100644
index b3f9eba62..000000000
--- a/packstack/puppet/templates/nova_network.pp
+++ /dev/null
@@ -1,40 +0,0 @@
-
-nova_config {
-    "DEFAULT/default_floating_pool": value => '%(CONFIG_NOVA_NETWORK_DEFAULTFLOATINGPOOL)s';
-    "DEFAULT/auto_assign_floating_ip": value => '%(CONFIG_NOVA_NETWORK_AUTOASSIGNFLOATINGIP)s';
-}
-
-$multihost = %(CONFIG_NOVA_NETWORK_MULTIHOST)s
-if $multihost {
-    nova_config {
-        "DEFAULT/multi_host": value => true;
-        "DEFAULT/send_arp_for_ha": value => true;
-    }
-}
-
-$manager = '%(CONFIG_NOVA_NETWORK_MANAGER)s'
-$overrides = {}
-if $manager in ['nova.network.manager.VlanManager', 'nova.network.manager.FlatDHCPManager'] {
-    $overrides['force_dhcp_release'] = false
-}
-if $manager == 'nova.network.manager.VlanManager' {
-    $overrides['vlan_start'] = '%(CONFIG_NOVA_NETWORK_VLAN_START)s'
-    $net_size = '%(CONFIG_NOVA_NETWORK_SIZE)s'
-    $net_num = '%(CONFIG_NOVA_NETWORK_NUMBER)s'
-} else {
-    $net_size = '%(CONFIG_NOVA_NETWORK_FIXEDSIZE)s'
-    $net_num = 1
-}
-class { "nova::network":
-    enabled => true,
-    network_manager => $manager,
-    num_networks => $net_num ,
-    network_size => $net_size,
-    private_interface => '%(CONFIG_NOVA_NETWORK_PRIVIF)s',
-    public_interface => '%(CONFIG_NOVA_NETWORK_PUBIF)s',
-    fixed_range => '%(CONFIG_NOVA_NETWORK_FIXEDRANGE)s',
-    floating_range => '%(CONFIG_NOVA_NETWORK_FLOATRANGE)s',
-    config_overrides => $overrides,
-}
-
-package { 'dnsmasq': ensure => present }
diff --git a/packstack/puppet/templates/nova_neutron.pp b/packstack/puppet/templates/nova_neutron.pp
deleted file mode 100644
index 03a576dcb..000000000
--- a/packstack/puppet/templates/nova_neutron.pp
+++ /dev/null
@@ -1,12 +0,0 @@
-
-class {"nova::network::neutron":
-  neutron_admin_password => "%(CONFIG_NEUTRON_KS_PW)s",
-  neutron_auth_strategy => "keystone",
-  neutron_url => "http://%(CONFIG_NEUTRON_SERVER_HOST)s:9696",
-  neutron_admin_tenant_name => "services",
-  neutron_admin_auth_url => "http://%(CONFIG_KEYSTONE_HOST)s:35357/v2.0",
-}
-
-class {"nova::compute::neutron":
-  libvirt_vif_driver => "%(CONFIG_NOVA_LIBVIRT_VIF_DRIVER)s",
-}
diff --git a/packstack/puppet/templates/nova_nfs.pp b/packstack/puppet/templates/nova_nfs.pp
deleted file mode 100644
index 25e4c3c84..000000000
--- a/packstack/puppet/templates/nova_nfs.pp
+++ /dev/null
@@ -1 +0,0 @@
-package { 'nfs-utils': ensure => present }
\ No newline at end of file
diff --git a/packstack/puppet/templates/nova_sched.pp b/packstack/puppet/templates/nova_sched.pp
deleted file mode 100644
index 1278568c7..000000000
--- a/packstack/puppet/templates/nova_sched.pp
+++ /dev/null
@@ -1,13 +0,0 @@
-nova_config{
-    # OpenStack doesn't include the CoreFilter (= CPU Filter) by default
-    "DEFAULT/scheduler_default_filters":
-        value => "RetryFilter,AvailabilityZoneFilter,RamFilter,ComputeFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,CoreFilter";
-    "DEFAULT/cpu_allocation_ratio":
-        value => "%(CONFIG_NOVA_SCHED_CPU_ALLOC_RATIO)s";
-    "DEFAULT/ram_allocation_ratio":
-        value => "%(CONFIG_NOVA_SCHED_RAM_ALLOC_RATIO)s";
-}
-
-class {"nova::scheduler":
-    enabled => true,
-}
diff --git a/packstack/puppet/templates/nova_vncproxy.pp b/packstack/puppet/templates/nova_vncproxy.pp
deleted file mode 100644
index e2333fe10..000000000
--- a/packstack/puppet/templates/nova_vncproxy.pp
+++ /dev/null
@@ -1,14 +0,0 @@
-class {"nova::vncproxy":
-    enabled => true,
-}
-
-class {"nova::consoleauth":
-    enabled => true,
-}
-
-firewall { '001 novncproxy incoming':
-    proto    => 'tcp',
-    dport    => ['6080'],
-    action   => 'accept',
-}
-
diff --git a/packstack/puppet/templates/ntpd.pp b/packstack/puppet/templates/ntpd.pp
deleted file mode 100644
index 72dd6ef0a..000000000
--- a/packstack/puppet/templates/ntpd.pp
+++ /dev/null
@@ -1,94 +0,0 @@
-$config_content = "
-driftfile /var/lib/ntp/drift
-
-# Permit time synchronization with our time source, but do not
-# permit the source to query or modify the service on this system.
-restrict default kod nomodify notrap nopeer noquery
-restrict -6 default kod nomodify notrap nopeer noquery
-
-# Permit all access over the loopback interface.  This could
-# be tightened as well, but to do so would effect some of
-# the administrative functions.
-restrict 127.0.0.1
-restrict -6 ::1
-
-# Hosts on local network are less restricted.
-#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
-
-# Use public servers from the pool.ntp.org project.
-# Please consider joining the pool (http://www.pool.ntp.org/join.html).
-%(CONFIG_NTP_SERVER_DEF)s
-
-#broadcast 192.168.1.255 autokey    # broadcast server
-#broadcastclient            # broadcast client
-#broadcast 224.0.1.1 autokey        # multicast server
-#multicastclient 224.0.1.1      # multicast client
-#manycastserver 239.255.254.254     # manycast server
-#manycastclient 239.255.254.254 autokey # manycast client
-
-# Undisciplined Local Clock. This is a fake driver intended for backup
-# and when no outside source of synchronized time is available.
-#server 127.127.1.0 # local clock
-#fudge  127.127.1.0 stratum 10
-
-# Enable public key cryptography.
-#crypto
-
-includefile /etc/ntp/crypto/pw
-
-# Key file containing the keys and key identifiers used when operating
-# with symmetric key cryptography.
-keys /etc/ntp/keys
-
-# Specify the key identifiers which are trusted.
-#trustedkey 4 8 42
-
-# Specify the key identifier to use with the ntpdc utility.
-#requestkey 8
-
-# Specify the key identifier to use with the ntpq utility.
-#controlkey 8
-
-# Enable writing of statistics records.
-#statistics clockstats cryptostats loopstats peerstats
-"
-
-
-package {'ntp':
-    ensure => 'installed',
-    name => 'ntp',
-}
-
-file {'ntp_config':
-    path => '/etc/ntp.conf',
-    ensure => file,
-    mode => '0644',
-    content => $config_content,
-}
-
-exec {'stop-ntpd':
-  command     => $osfamily ? {
-    # Unfortunately, the RedHat osfamily doesn't only include RHEL and
-    # derivatives thereof but also Fedora so further differentiation by
-    # operatingsystem is necessary.
-    'RedHat' => $operatingsystem ? {
-      'Fedora' => '/usr/bin/systemctl stop ntpd.service',
-      default  => '/sbin/service ntpd stop',
-    },
-  },
-}
-
-exec {'ntpdate':
-    command => '/usr/sbin/ntpdate %(CONFIG_NTP_SERVERS)s',
-    tries   => 3,
-}
-
-service {'ntpd':
-    ensure => 'running',
-    enable => true,
-    name => 'ntpd',
-    hasstatus => true,
-    hasrestart => true,
-}
-
-Package['ntp'] -> File['ntp_config'] -> Exec['stop-ntpd'] -> Exec['ntpdate'] -> Service['ntpd']
diff --git a/packstack/puppet/templates/openstack_client.pp b/packstack/puppet/templates/openstack_client.pp
deleted file mode 100644
index 4c84ca3e7..000000000
--- a/packstack/puppet/templates/openstack_client.pp
+++ /dev/null
@@ -1,42 +0,0 @@
-
-$clientdeps = ["python-iso8601"]
-package { $clientdeps: }
-
-$clientlibs = ["python-novaclient", "python-keystoneclient", "python-glanceclient", "python-swiftclient", "python-cinderclient"]
-package { $clientlibs: }
-
-$rcadmin_content = "export OS_USERNAME=admin
-export OS_TENANT_NAME=admin
-export OS_PASSWORD=%(CONFIG_KEYSTONE_ADMIN_PW)s
-export OS_AUTH_URL=http://%(CONFIG_KEYSTONE_HOST)s:5000/v2.0/
-export PS1='[\\u@\\h \\W(keystone_admin)]\\$ '
-"
-
-file {"${::home_dir}/keystonerc_admin":
-   ensure  => "present",
-   mode => '0600',
-   content => $rcadmin_content,
-}
-
-if '%(CONFIG_PROVISION_DEMO)s' == 'y' {
-   file {"${::home_dir}/keystonerc_demo":
-      ensure  => "present",
-      mode => '0600',
-      content => "export OS_USERNAME=demo
-export OS_TENANT_NAME=demo
-export OS_PASSWORD=%(CONFIG_KEYSTONE_DEMO_PW)s
-export OS_AUTH_URL=http://%(CONFIG_KEYSTONE_HOST)s:5000/v2.0/
-export PS1='[\\u@\\h \\W(keystone_demo)]\\$ '
-",
-   }
-}
-
-if %(NO_ROOT_USER_ALLINONE)s {
-    file {"%(HOME_DIR)s/keystonerc_admin":
-       ensure => present,
-       owner => '%(NO_ROOT_USER)s',
-       group => '%(NO_ROOT_GROUP)s',
-       mode => '0600',
-       content => $rcadmin_content,
-    }
-}
diff --git a/packstack/puppet/templates/persist_ovs_bridge.pp b/packstack/puppet/templates/persist_ovs_bridge.pp
deleted file mode 100644
index 861479d2f..000000000
--- a/packstack/puppet/templates/persist_ovs_bridge.pp
+++ /dev/null
@@ -1,11 +0,0 @@
-$net_script = "DEVICE=%(CONFIG_NEUTRON_L3_EXT_BRIDGE)s
-DEVICETYPE=ovs
-TYPE=OVSBridge
-BOOTPROTO=static
-IPADDR=$ipaddress_%(EXT_BRIDGE_VAR)s
-NETMASK=$netmask_%(EXT_BRIDGE_VAR)s
-ONBOOT=yes"
-
-file { "/etc/sysconfig/network-scripts/ifcfg-%(CONFIG_NEUTRON_L3_EXT_BRIDGE)s":
-  content => $net_script
-}
diff --git a/packstack/puppet/templates/postscript.pp b/packstack/puppet/templates/postscript.pp
deleted file mode 100644
index 32a68286e..000000000
--- a/packstack/puppet/templates/postscript.pp
+++ /dev/null
@@ -1,4 +0,0 @@
-exec { 'update-selinux-policy':
-    path => "/usr/bin/",
-    command => "yum update -y selinux-policy-targeted"
-}
diff --git a/packstack/puppet/templates/prescript.pp b/packstack/puppet/templates/prescript.pp
deleted file mode 100644
index 8a1defa93..000000000
--- a/packstack/puppet/templates/prescript.pp
+++ /dev/null
@@ -1,18 +0,0 @@
-include firewall
-
-if $::operatingsystem != "Fedora" {
-    package{ 'openstack-selinux':
-        ensure => present,
-    }
-}
-
-$info = "The RDO kernel that includes network namespace (netns) support has been installed on host $::ipaddress."
-if $::operatingsystem == 'RedHat' {
-    $warning = " This is a community supplied kernel and is not officially supported by Red Hat. Installing this kernel on RHEL systems may impact your ability to get support from Red Hat."
-} else {
-    $warning = ""
-}
-
-class { 'packstack::netns':
-    warning => "${info}${warning}"
-}
diff --git a/packstack/puppet/templates/provision.pp b/packstack/puppet/templates/provision.pp
deleted file mode 100644
index 3aedbef28..000000000
--- a/packstack/puppet/templates/provision.pp
+++ /dev/null
@@ -1,36 +0,0 @@
-class { 'openstack::provision':
-  admin_password        => '%(CONFIG_KEYSTONE_ADMIN_PW)s',
-  password              => '%(CONFIG_KEYSTONE_DEMO_PW)s',
-  configure_tempest     => %(CONFIG_PROVISION_TEMPEST)s,
-  tempest_repo_uri      => '%(CONFIG_PROVISION_TEMPEST_REPO_URI)s',
-  tempest_repo_revision => '%(CONFIG_PROVISION_TEMPEST_REPO_REVISION)s',
-  neutron_available     => %(PROVISION_NEUTRON_AVAILABLE)s,
-  setup_ovs_bridge      => %(CONFIG_PROVISION_ALL_IN_ONE_OVS_BRIDGE)s,
-  public_bridge_name    => '%(CONFIG_NEUTRON_L3_EXT_BRIDGE)s',
-  floating_range        => '%(CONFIG_PROVISION_DEMO_FLOATRANGE)s',
-}
-
-if %(CONFIG_PROVISION_ALL_IN_ONE_OVS_BRIDGE)s {
-  firewall { '000 nat':
-    chain  => 'POSTROUTING',
-    jump   => 'MASQUERADE',
-    source => $::openstack::provision::floating_range,
-    outiface => $::gateway_device,
-    table => 'nat',
-    proto => 'all',
-  }
-
-  firewall { '000 forward out':
-    chain => 'FORWARD',
-    action  => 'accept',
-    outiface => '%(CONFIG_NEUTRON_L3_EXT_BRIDGE)s',
-    proto => 'all',
-  }
-
-  firewall { '000 forward in':
-    chain => 'FORWARD',
-    action  => 'accept',
-    iniface => '%(CONFIG_NEUTRON_L3_EXT_BRIDGE)s',
-    proto => 'all',
-  }
-}
diff --git a/packstack/puppet/templates/sshkey.pp b/packstack/puppet/templates/sshkey.pp
deleted file mode 100644
index f1fd66e0b..000000000
--- a/packstack/puppet/templates/sshkey.pp
+++ /dev/null
@@ -1,7 +0,0 @@
-sshkey { '%(SSH_HOST_NAME)s':
-  ensure       => present,
-  host_aliases => [%(SSH_HOST_ALIASES)s],
-  key          => '%(SSH_HOST_KEY)s',
-  type         => '%(SSH_HOST_KEY_TYPE)s',
-}
-
diff --git a/packstack/puppet/templates/swift_builder.pp b/packstack/puppet/templates/swift_builder.pp
deleted file mode 100644
index 32387b293..000000000
--- a/packstack/puppet/templates/swift_builder.pp
+++ /dev/null
@@ -1,23 +0,0 @@
-
-class { 'swift::ringbuilder':
-  part_power     => '18',
-  replicas       => '%(CONFIG_SWIFT_STORAGE_REPLICAS)s',
-  min_part_hours => 1,
-  require        => Class['swift'],
-}
-
-# sets up an rsync db that can be used to sync the ring DB
-class { 'swift::ringserver':
-  local_net_ip => "%(CONFIG_SWIFT_BUILDER_HOST)s",
-}
-
-@@swift::ringsync { ['account', 'object', 'container']:
- ring_server => $swift_local_net_ip
-}
-
-if ($::selinux != "false"){
-    selboolean{'rsync_export_all_ro':
-        value => on,
-        persistent => true,
-    }
-}
diff --git a/packstack/puppet/templates/swift_common.pp b/packstack/puppet/templates/swift_common.pp
deleted file mode 100644
index c4d79c6a7..000000000
--- a/packstack/puppet/templates/swift_common.pp
+++ /dev/null
@@ -1,9 +0,0 @@
-
-class { 'ssh::server::install': }
-
-Class['swift'] -> Service <| |>
-class { 'swift':
-    # not sure how I want to deal with this shared secret
-    swift_hash_suffix => '%(CONFIG_SWIFT_HASH)s',
-    package_ensure    => latest,
-}
diff --git a/packstack/puppet/templates/swift_loopback.pp b/packstack/puppet/templates/swift_loopback.pp
deleted file mode 100644
index e0dd899ce..000000000
--- a/packstack/puppet/templates/swift_loopback.pp
+++ /dev/null
@@ -1,10 +0,0 @@
-
-swift::storage::loopback { [%(SWIFT_STORAGE_DEVICES)s]:
-  base_dir     => '/srv/loopback-device',
-  mnt_base_dir => '/srv/node',
-  require      => Class['swift'],
-  fstype       => '%(CONFIG_SWIFT_STORAGE_FSTYPE)s',
-  seek         => '%(SWIFT_STORAGE_SEEK)s',
-}
-
-
diff --git a/packstack/puppet/templates/swift_proxy.pp b/packstack/puppet/templates/swift_proxy.pp
deleted file mode 100644
index 2c9adbe82..000000000
--- a/packstack/puppet/templates/swift_proxy.pp
+++ /dev/null
@@ -1,60 +0,0 @@
-
-package { 'curl': ensure => present }
-
-class { 'memcached':
-}
-
-class { 'swift::proxy':
-  proxy_local_net_ip => '%(CONFIG_SWIFT_PROXY)s',
-  pipeline           => [
-    #'catch_errors',
-    'healthcheck',
-    'cache',
-    #'ratelimit',
-    'authtoken',
-    'keystone',
-    'staticweb',
-    'tempurl',
-    #'account_quotas',
-    #'container_quotas',
-    'proxy-server'
-  ],
-  account_autocreate => true,
-}
-
-# configure all of the middlewares
-class { [
-    'swift::proxy::catch_errors',
-    'swift::proxy::healthcheck',
-    'swift::proxy::cache',
-    'swift::proxy::staticweb',
-    'swift::proxy::tempurl',
-    'swift::proxy::account_quotas',
-    'swift::proxy::container_quotas'
-]: }
-
-class { 'swift::proxy::ratelimit':
-    clock_accuracy         => 1000,
-    max_sleep_time_seconds => 60,
-    log_sleep_time_seconds => 0,
-    rate_buffer_seconds    => 5,
-    account_ratelimit      => 0
-}
-
-class { 'swift::proxy::keystone':
-    operator_roles => ['admin', 'SwiftOperator'],
-}
-
-class { 'swift::proxy::authtoken':
-    admin_user        => 'swift',
-    admin_tenant_name => 'services',
-    admin_password    => '%(CONFIG_SWIFT_KS_PW)s',
-    # assume that the controller host is the swift api server
-    auth_host         => '%(CONFIG_KEYSTONE_HOST)s',
-}
-
-firewall { '001 swift proxy incoming':
-    proto    => 'tcp',
-    dport    => ['8080'],
-    action   => 'accept',
-}
diff --git a/packstack/puppet/templates/swift_storage.pp b/packstack/puppet/templates/swift_storage.pp
deleted file mode 100644
index 8a4955759..000000000
--- a/packstack/puppet/templates/swift_storage.pp
+++ /dev/null
@@ -1,24 +0,0 @@
-
-# install all swift storage servers together
-class { 'swift::storage::all':
-  storage_local_net_ip => '%(CONFIG_SWIFT_STORAGE_CURRENT)s',
-  allow_versions => true,
-  require => Class['swift'],
-}
-
-if(!defined(File['/srv/node'])) {
-  file { '/srv/node':
-    owner  => 'swift',
-    group  => 'swift',
-    ensure => directory,
-    require => Package['openstack-swift'],
-  }
-}
-
-swift::ringsync{["account","container","object"]:
-    ring_server => '%(CONFIG_SWIFT_BUILDER_HOST)s',
-    before => Class['swift::storage::all'],
-    require => Class['swift'],
-}
-
-
diff --git a/packstack/version.py b/packstack/version.py
index d1a0130ca..5f4378191 100644
--- a/packstack/version.py
+++ b/packstack/version.py
@@ -1,14 +1,16 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
-VERSION = ['2014', '1', '1']
-FINAL=False
-RELEASE="Icehouse"
-SNAPTAG=None
+import pbr.version
 
-def release_string():
-    return RELEASE
-
-def version_string():
-    if FINAL:
-        return '.'.join(filter(None, VERSION))
-    else:
-        return '.'.join(filter(None, VERSION))+"dev{0}".format(SNAPTAG)
+version_info = pbr.version.VersionInfo('packstack')
diff --git a/playbooks/packstack-centos9-pre.yaml b/playbooks/packstack-centos9-pre.yaml
new file mode 100644
index 000000000..9a9b12798
--- /dev/null
+++ b/playbooks/packstack-centos9-pre.yaml
@@ -0,0 +1,36 @@
+- hosts: all
+  name: packstack-centos9-pre
+  tasks:
+    - name: Ensure legacy workspace directory
+      file:
+        path: '{{ ansible_user_dir }}/workspace'
+        state: directory
+
+    - shell:
+        cmd: |
+          cp -pr {{ ansible_user_dir }}/src/opendev.org/x/packstack {{ ansible_user_dir }}/workspace
+
+    - shell:
+        cmd: |
+          set -e
+          set -x
+          rm -rf /etc/yum.repos.d/delorean*
+          # Remove epel repos
+          rm -rf /etc/yum.repos.d/epel*
+          dnf clean all
+          sudo sed -i '/^exclude.*/d' /etc/dnf/dnf.conf
+          dnf -y install dnf-plugins-core
+          dnf config-manager --set-enabled crb
+          dnf -y install libxml2-devel libxslt-devel ruby-devel zlib-devel
+          dnf -y install gcc gettext diffstat doxygen patch patchutils subversion systemtap git python3-setuptools wget python3-libselinux virt-what yum
+        executable: /bin/bash
+        chdir: '{{ ansible_user_dir }}/workspace'
+      become: true
+      environment: '{{ zuul }}'
+
+    # mariadb-10.11 is broken https://issues.redhat.com/browse/RDO-241
+    - name: Temporary disable mariadb module
+      shell: "sudo dnf module disable -y mariadb"
+      when: ansible_distribution == "CentOS" and ansible_distribution_major_version == "9"
+      become: true
+      changed_when: False
diff --git a/playbooks/packstack-integration-tempest.yaml b/playbooks/packstack-integration-tempest.yaml
new file mode 100644
index 000000000..9101719d0
--- /dev/null
+++ b/playbooks/packstack-integration-tempest.yaml
@@ -0,0 +1,3 @@
+- hosts: all
+  roles:
+    - packstack-integration-tempest
diff --git a/playbooks/packstack-multinode.yaml b/playbooks/packstack-multinode.yaml
new file mode 100644
index 000000000..e7d6166a6
--- /dev/null
+++ b/playbooks/packstack-multinode.yaml
@@ -0,0 +1,85 @@
+- hosts: compute
+  name: setup RDO Trunk repositories
+  vars:
+    delorean_default: "https://trunk.rdoproject.org/centos7-master/current-passed-ci/delorean.repo"
+    delorean_deps_default: "https://trunk.rdoproject.org/centos7-master/delorean-deps.repo"
+  tasks:
+    - name: Fetch DLRN repo
+      get_url:
+       url: "{{ delorean | default(delorean_default) }}"
+       dest: /etc/yum.repos.d/delorean.repo
+       mode: 0640
+      become: true
+
+    - name: Fetch DLRN dependency repo
+      get_url:
+       url: "{{ delorean_deps | default(delorean_deps_default) }}"
+       dest: /etc/yum.repos.d/delorean-deps.repo
+       mode: 0640
+      become: true
+
+    - name: Update installed packages from RDO repos
+      package:
+        name: '*'
+        state: latest
+      become: true
+
+    - name: Disable selinux in Compute node
+      shell:
+        cmd: |
+          setenforce 0
+      become: true
+      when: not selinux_enforcing|default("true")|bool
+
+- hosts: controller
+  name: packstack-ssh-preparation-1
+  tasks:
+    - name: Generate SSH key on controller
+      shell: ssh-keygen -t rsa -f /root/.ssh/id_rsa -P ""
+      args:
+        creates: /root/.ssh/id_rsa
+      become: true
+
+    - name: Fetch SSH key
+      shell: cat /root/.ssh/id_rsa.pub
+      become: true
+      register: ssh_key
+
+    - name: Deploy SSH key on controller
+      authorized_key:
+        user: root
+        state: present
+        key: "{{ ssh_key.stdout }}"
+      become: true
+
+    - name: Set SSH key fact to be used by the compute node
+      set_fact:
+        sshkey: "{{ ssh_key.stdout }}"
+
+- hosts: compute
+  name: packstack-ssh-preparation-2
+  tasks:
+    - name: Deploy SSH key on compute node
+      authorized_key:
+        user: root
+        state: present
+        key: "{{ hostvars['controller'].sshkey }}"
+      become: true
+
+- hosts: controller
+  name: packstack-multinode
+  tasks:
+    - name: Run Packstack
+      shell:
+        cmd: |
+          set -e
+          set -x
+          export SCENARIO='{{ scenario }}'
+          export DELOREAN='{{ delorean | default('') }}'
+          export DELOREAN_DEPS='{{ delorean_deps | default('') }}'
+          export CONTROLLER_NODE="{{ hostvars['controller'].nodepool.public_ipv4 }}"
+          export COMPUTE_NODE="{{ hostvars['compute'].nodepool.public_ipv4 }}"
+          export SELINUX_ENFORCING='{{ selinux_enforcing | default('true') }}'
+          ./run_tests.sh
+        executable: /bin/bash
+        chdir: '{{ ansible_user_dir }}/workspace/packstack'
diff --git a/playbooks/packstack-post-compute.yaml b/playbooks/packstack-post-compute.yaml
new file mode 100644
index 000000000..a52c33371
--- /dev/null
+++ b/playbooks/packstack-post-compute.yaml
@@ -0,0 +1,20 @@
+- hosts: compute
+  name: store compute node logs
+  tasks:
+    - file:
+        path: /tmp/logs
+        state: directory
+        mode: 0755
+
+    - file:
+        path: /tmp/compute
+        state: directory
+        mode: 0755
+
+    - shell:
+        cmd: |
+          source {{ ansible_user_dir }}/src/opendev.org/x/packstack/tools/copy-logs.sh
+          recover_default_logs
+          mv /tmp/logs/* /tmp/compute
+          mv /tmp/compute /tmp/logs
+      become: true
diff --git a/playbooks/upload-logs.yaml b/playbooks/upload-logs.yaml
new file mode 100644
index 000000000..a946b2e86
--- /dev/null
+++ b/playbooks/upload-logs.yaml
@@ -0,0 +1,15 @@
+- hosts: all
+  tasks:
+    - name: Upload logs
+      synchronize:
+        src: '/tmp/logs'
+        dest: '{{ zuul.executor.log_root }}'
+        mode: pull
+        copy_links: true
+        verify_host: true
+        rsync_opts:
+          - --include=/logs/**
+          - --include=*/
+          - --exclude=*
+          - --prune-empty-dirs
+
diff --git a/releasenotes/notes/Add-Panko-service-63a8a966013abeaa.yaml b/releasenotes/notes/Add-Panko-service-63a8a966013abeaa.yaml
new file mode 100644
index 000000000..fe2fdf7a6
--- /dev/null
+++ b/releasenotes/notes/Add-Panko-service-63a8a966013abeaa.yaml
@@ -0,0 +1,3 @@
+---
+features:
+  - Add panko service to packstack deployment.
diff --git a/releasenotes/notes/Panko-has-been-removed-fb234a047231d84f.yaml b/releasenotes/notes/Panko-has-been-removed-fb234a047231d84f.yaml
new file mode 100644
index 000000000..117c74b1e
--- /dev/null
+++ b/releasenotes/notes/Panko-has-been-removed-fb234a047231d84f.yaml
@@ -0,0 +1,10 @@
+---
+other:
+  - |
+    Service panko has been removed in OpenStack project
+    in Xena. Packstack has removed support to deploying
+    this service, what implies some changes:
+
+      * CONFIG_PANKO_INSTALL option has been removed.
+      * CONFIG_PANKO_DB_PW option has been removed.
+      * CONFIG_PANKO_KS_PW option has been removed.
diff --git a/releasenotes/notes/Remove-CONFIG_NEUTRON_ML2_SUPPORTED_PCI_VENDOR_DEVS-param-926649e4eef08b44.yaml b/releasenotes/notes/Remove-CONFIG_NEUTRON_ML2_SUPPORTED_PCI_VENDOR_DEVS-param-926649e4eef08b44.yaml
new file mode 100644
index 000000000..e84a5bba6
--- /dev/null
+++ b/releasenotes/notes/Remove-CONFIG_NEUTRON_ML2_SUPPORTED_PCI_VENDOR_DEVS-param-926649e4eef08b44.yaml
@@ -0,0 +1,6 @@
+---
+deprecations:
+  - |
+    The CONFIG_NEUTRON_ML2_SUPPORTED_PCI_VENDOR_DEVS is no longer needed in
+    the answers file. The upstream parameter was already removed, and all
+    PCI device ids are supported by Nova and Neutron.
diff --git a/releasenotes/notes/Remove-FWaaS-deployment-41cfa0b709cd9a3f.yaml b/releasenotes/notes/Remove-FWaaS-deployment-41cfa0b709cd9a3f.yaml
new file mode 100644
index 000000000..4cbc53edc
--- /dev/null
+++ b/releasenotes/notes/Remove-FWaaS-deployment-41cfa0b709cd9a3f.yaml
@@ -0,0 +1,7 @@
+---
+prelude: >
+    Neutron FWaaS has been removed in Victoria release.
+other:
+  - |
+    Packstack does not longer support deployment of Neutron FWaaS extension as it
+    has been removed upstream. Option CONFIG_NEUTRON_FWAAS has been removed.
diff --git a/releasenotes/notes/Remove-Heat-Cloudwatch-07e55f1c35a16ee4.yaml b/releasenotes/notes/Remove-Heat-Cloudwatch-07e55f1c35a16ee4.yaml
new file mode 100644
index 000000000..15befeefd
--- /dev/null
+++ b/releasenotes/notes/Remove-Heat-Cloudwatch-07e55f1c35a16ee4.yaml
@@ -0,0 +1,6 @@
+---
+deprecations:
+  - |
+    The Heat CloudWatch API was removed from the project in
+    https://review.openstack.org/534660. Packstack has also removed all
+    references to the API.
diff --git a/releasenotes/notes/Remove-PKI-and-UUID-Keystone-token-formats-618f4b0dc4cf782f.yaml b/releasenotes/notes/Remove-PKI-and-UUID-Keystone-token-formats-618f4b0dc4cf782f.yaml
new file mode 100644
index 000000000..f564c1fd9
--- /dev/null
+++ b/releasenotes/notes/Remove-PKI-and-UUID-Keystone-token-formats-618f4b0dc4cf782f.yaml
@@ -0,0 +1,6 @@
+---
+deprecations:
+  - |
+    Keystone has removed support for token formats other than Fernet in
+    https://review.openstack.org/543060. Thus, support for those token
+    formats has been removed from Packstack.
diff --git a/releasenotes/notes/Remove-deprecated-keystone-ldap-params-848d0eaf7a24273e.yaml b/releasenotes/notes/Remove-deprecated-keystone-ldap-params-848d0eaf7a24273e.yaml
new file mode 100644
index 000000000..d4d7f5ac3
--- /dev/null
+++ b/releasenotes/notes/Remove-deprecated-keystone-ldap-params-848d0eaf7a24273e.yaml
@@ -0,0 +1,8 @@
+---
+deprecations:
+  - |
+    The CONFIG_KEYSTONE_LDAP_USER_ALLOW_* and
+    CONFIG_KEYSTONE_LDAP_GROUP_ALLOW_* parameters have been removed from the
+    answer file. Their corresponding options were removed from Keystone long
+    ago, and they are no longer valid in puppet-keystone since the Rocky
+    release.
diff --git a/releasenotes/notes/Replace-keystone-token-flush-cron-job-with-fernet-rotation-5b1fccf2bc6add91.yaml b/releasenotes/notes/Replace-keystone-token-flush-cron-job-with-fernet-rotation-5b1fccf2bc6add91.yaml
new file mode 100644
index 000000000..724a3bc58
--- /dev/null
+++ b/releasenotes/notes/Replace-keystone-token-flush-cron-job-with-fernet-rotation-5b1fccf2bc6add91.yaml
@@ -0,0 +1,12 @@
+---
+upgrade:
+  - |
+    A new CONFIG_KEYSTONE_FERNET_TOKEN_ROTATE_ENABLE option has been added to
+    the answer file. When enabled (default), it will create a cron job to
+    rotate Fernet keys.
+deprecations:
+  - |
+    Since Keystone has deprecated token formats requiring storage in the DB,
+    the CONFIG_KEYSTONE_DB_PURGE_ENABLE option has been removed. Instead, we
+    are implementing a cron job to rotate Fernet keys.
+
diff --git a/releasenotes/notes/Support-for-extracted-placement-service-8ae75efbb1ad25b5.yaml b/releasenotes/notes/Support-for-extracted-placement-service-8ae75efbb1ad25b5.yaml
new file mode 100644
index 000000000..c9c7ff5a2
--- /dev/null
+++ b/releasenotes/notes/Support-for-extracted-placement-service-8ae75efbb1ad25b5.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    Packstack has added support for the extracted Placement service in the
+    Train cycle, following its upstream support and deprecation in Nova.
diff --git a/releasenotes/notes/add-parameter-messages-47d9cf6996f58230.yaml b/releasenotes/notes/add-parameter-messages-47d9cf6996f58230.yaml
new file mode 100644
index 000000000..577c37e7c
--- /dev/null
+++ b/releasenotes/notes/add-parameter-messages-47d9cf6996f58230.yaml
@@ -0,0 +1,24 @@
+---
+features:
+  - |
+    Packstack can display parameter specific messages when a MESSAGE option
+    is added to the parameter. If MESSAGE_VALUES exist for the parameter, the
+    message will only be shown if the value provided by the user is included
+    in MESSAGE_VALUES. Example:
+
+        {"CMD_OPTION": "example-service-install",
+         "OPTION_LIST": ["y", "n"],
+         "VALIDATORS": [validators.validate_options],
+         "DEFAULT_VALUE": 'n',
+         "MASK_INPUT": False,
+         "LOOSE_VALIDATION": False,
+         "CONF_NAME": "CONFIG_EXAMPLE_SERVICE_INSTALL",
+         "USE_DEFAULT": False,
+         "NEED_CONFIRM": False,
+         "CONDITION": False,
+         "MESSAGE_VALUES": ["y"],
+         "MESSAGE": "Example service installation will be removed from packstack in Pike"}
+
+    In this case, if the user enable installation of example service, a message
+    will be displayed at the end of packstack execution with content "Example
+    service installation will be removed from packstack in Pike"
diff --git a/releasenotes/notes/add-skip-tempest-tests-option-86cf59ec5a61d349.yaml b/releasenotes/notes/add-skip-tempest-tests-option-86cf59ec5a61d349.yaml
new file mode 100644
index 000000000..0bf75aaaa
--- /dev/null
+++ b/releasenotes/notes/add-skip-tempest-tests-option-86cf59ec5a61d349.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - |
+    Add new config option "CONFIG_SKIP_TEMPEST_TESTS" to allow
+    skipping of some of tempest tests which are running as part
+    of "CONFIG_RUN_TEMPEST_TESTS".
diff --git a/releasenotes/notes/add-support-to-ovn-networking-ae6e0176270265c6.yaml b/releasenotes/notes/add-support-to-ovn-networking-ae6e0176270265c6.yaml
new file mode 100644
index 000000000..fe9964ebb
--- /dev/null
+++ b/releasenotes/notes/add-support-to-ovn-networking-ae6e0176270265c6.yaml
@@ -0,0 +1,20 @@
+---
+features:
+  - |
+    Now packstack support using Open Virtual Network (ovn) as neutron
+    plugin. To enable it you need to set CONFIG_NEUTRON_L2_AGENT to ovn.
+    Additionally some options have been added to configure different options
+    and topologies:
+
+        * CONFIG_NEUTRON_OVN_BRIDGE_MAPPINGS
+        * CONFIG_NEUTRON_OVN_BRIDGE_IFACES
+        * CONFIG_NEUTRON_OVN_BRIDGES_COMPUTE
+        * CONFIG_NEUTRON_OVN_EXTERNAL_PHYSNET
+        * CONFIG_NEUTRON_OVN_TUNNEL_IF
+        * CONFIG_NEUTRON_OVN_TUNNEL_SUBNETS
+
+    Additionally, geneve has been included as an option to existing parameters
+    CONFIG_NEUTRON_ML2_TYPE_DRIVERS and CONFIG_NEUTRON_ML2_TENANT_NETWORK_TYPES.
+    Note that OVN networking has still some limitations, as lack of support of
+    for LBaaS, FWaaS and VPNaaS. Consult networking-ovn documentation for
+    further details.
diff --git a/releasenotes/notes/add_cinder_solidfire-9b62f78b86a52a09.yaml b/releasenotes/notes/add_cinder_solidfire-9b62f78b86a52a09.yaml
new file mode 100644
index 000000000..f14d95e1b
--- /dev/null
+++ b/releasenotes/notes/add_cinder_solidfire-9b62f78b86a52a09.yaml
@@ -0,0 +1,9 @@
+---
+features:
+  - |
+    Added basic support for SolidFire storage as a backend to Cinder.
+    The following 3 config options have been added:
+
+    * CONFIG_CINDER_SOLIDFIRE_LOGIN - SolidFire cluster admin name.
+    * CONFIG_CINDER_SOLIDFIRE_PASSWORD - SolidFire cluster admin password.
+    * CONFIG_CINDER_SOLIDFIRE_HOSTNAME - SolidFire MVIP hostname or IP.
diff --git a/releasenotes/notes/admin-token-removed-64ae39c4ecd28f15.yaml b/releasenotes/notes/admin-token-removed-64ae39c4ecd28f15.yaml
new file mode 100644
index 000000000..e95e4cb00
--- /dev/null
+++ b/releasenotes/notes/admin-token-removed-64ae39c4ecd28f15.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    The config option CONFIG_KEYSTONE_ADMIN_TOKEN to configure the admin token
+    is removed. You must specify a admin password with CONFIG_KEYSTONE_ADMIN_PW.
diff --git a/releasenotes/notes/aodh-move-to-mariadb-9e36b7cfdbbd2aa5.yaml b/releasenotes/notes/aodh-move-to-mariadb-9e36b7cfdbbd2aa5.yaml
new file mode 100644
index 000000000..533031caa
--- /dev/null
+++ b/releasenotes/notes/aodh-move-to-mariadb-9e36b7cfdbbd2aa5.yaml
@@ -0,0 +1,8 @@
+---
+features:
+  - Aodh project has removed support for non-SQL drivers
+    in https://review.openstack.org/#/c/373043/.
+    Packstack has switched aodh storage backend from
+    MongoDB to mysqld. A new parameter CONFIG_AODH_DB_PW
+    has been added to configure the password of the
+    aodh user in the database.
diff --git a/releasenotes/notes/bp-add-magnum-support-74d88638fe4b2c6c.yaml b/releasenotes/notes/bp-add-magnum-support-74d88638fe4b2c6c.yaml
new file mode 100644
index 000000000..58e0a47e1
--- /dev/null
+++ b/releasenotes/notes/bp-add-magnum-support-74d88638fe4b2c6c.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - |
+    Packstack supports the deployment of magnum, the
+    container Infrastructure Management Service
+    for OpenStack.
diff --git a/releasenotes/notes/ceilometer-with-wsgi-a46d2ff0ceabaaf8.yaml b/releasenotes/notes/ceilometer-with-wsgi-a46d2ff0ceabaaf8.yaml
new file mode 100644
index 000000000..ee6eafe78
--- /dev/null
+++ b/releasenotes/notes/ceilometer-with-wsgi-a46d2ff0ceabaaf8.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - |
+    Add support for deploying Ceilometer behind Apache with WSGI.
diff --git a/releasenotes/notes/change-default-nagios-b190de0737165bf9.yaml b/releasenotes/notes/change-default-nagios-b190de0737165bf9.yaml
new file mode 100644
index 000000000..fd2d27336
--- /dev/null
+++ b/releasenotes/notes/change-default-nagios-b190de0737165bf9.yaml
@@ -0,0 +1,7 @@
+---
+upgrade:
+  - |
+    Default value for configuration option CONFIG_NAGIOS_INSTALL has been
+    changed to 'n' in Ocata. Users that require nagios installation in their
+    packstack deployent will need to explicitely modify it to 'y' using
+    answers file or command line option '--nagios-install'.
diff --git a/releasenotes/notes/check-unexpected-options-2f2d26ebe54da6c9.yaml b/releasenotes/notes/check-unexpected-options-2f2d26ebe54da6c9.yaml
new file mode 100644
index 000000000..5bc2887e3
--- /dev/null
+++ b/releasenotes/notes/check-unexpected-options-2f2d26ebe54da6c9.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    Added new --validate-answer-file switch to check if answerfile contains
+    any unexpected options.
diff --git a/releasenotes/notes/create-uec-image-70073744430d1538.yaml b/releasenotes/notes/create-uec-image-70073744430d1538.yaml
new file mode 100644
index 000000000..f65faa5bc
--- /dev/null
+++ b/releasenotes/notes/create-uec-image-70073744430d1538.yaml
@@ -0,0 +1,13 @@
+---
+features:
+  - |
+    When tempest provisioning is enabled, three glance images
+    following uec schema (AKI,ARI,AMI) are created. These
+    images are used for tempest tests. This is done for issue
+    in https://bugs.launchpad.net/cirros/+bug/1312199
+    Image name and URLs to download images can be modified
+    with parameters:
+    * CONFIG_PROVISION_UEC_IMAGE_NAME
+    * CONFIG_PROVISION_UEC_IMAGE_KERNEL_URL
+    * CONFIG_PROVISION_UEC_IMAGE_RAMDISK_URL
+    * CONFIG_PROVISION_UEC_IMAGE_DISK_URL
diff --git a/releasenotes/notes/custom-tempest-flavors-baa5cf02235f78dd.yaml b/releasenotes/notes/custom-tempest-flavors-baa5cf02235f78dd.yaml
new file mode 100644
index 000000000..ce9b92bb9
--- /dev/null
+++ b/releasenotes/notes/custom-tempest-flavors-baa5cf02235f78dd.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    Added new set of variables CONFIG_PROVISION_TEMPEST_FLAVOR_*,
+    enabling the customization of created flavors.
diff --git a/releasenotes/notes/demo-allocation-pools-c535e4235c7edcb2.yaml b/releasenotes/notes/demo-allocation-pools-c535e4235c7edcb2.yaml
new file mode 100644
index 000000000..5c14af7bf
--- /dev/null
+++ b/releasenotes/notes/demo-allocation-pools-c535e4235c7edcb2.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - Introduced CONFIG_PROVISION_DEMO_ALLOCATION_POOLS
+    to restrict public subnet IP address allocations.
diff --git a/releasenotes/notes/demo-image-properties-9994f2981a8c00a1.yaml b/releasenotes/notes/demo-image-properties-9994f2981a8c00a1.yaml
new file mode 100644
index 000000000..68a9768fc
--- /dev/null
+++ b/releasenotes/notes/demo-image-properties-9994f2981a8c00a1.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - New config parameter CONFIG_PROVISION_IMAGE_PROPERTIES
+    introduced, useful when provided image needs custom parameters
diff --git a/releasenotes/notes/disable-rabbitmq-repositories-d5cb9dc8f1246a39.yaml b/releasenotes/notes/disable-rabbitmq-repositories-d5cb9dc8f1246a39.yaml
new file mode 100644
index 000000000..10b30ba58
--- /dev/null
+++ b/releasenotes/notes/disable-rabbitmq-repositories-d5cb9dc8f1246a39.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Do not enable RabbitMQ repo during installation, Packstack does not retrieve
+    it from there in any case.
diff --git a/releasenotes/notes/drop-mongodb-a9771fb4f0430a4c.yaml b/releasenotes/notes/drop-mongodb-a9771fb4f0430a4c.yaml
new file mode 100644
index 000000000..f7925f18e
--- /dev/null
+++ b/releasenotes/notes/drop-mongodb-a9771fb4f0430a4c.yaml
@@ -0,0 +1,9 @@
+---
+fixes:
+  - |
+    Drop mongodb support from packstack. Telemetry does not support this
+    anymore and there is no reason to keep deploying and maintaining this
+    going forward. We will use gnocchi for metrics, panko for events instead.
+    Also dropping command options CONFIG_CEILOMETER_METERING_BACKEND and
+    CONFIG_CEILOMETER_EVENTS_BACKEND as we directly set the publishers
+    in the pipeline.
diff --git a/releasenotes/notes/gnocchi-and-aodh-00da52a4c45588fd.yaml b/releasenotes/notes/gnocchi-and-aodh-00da52a4c45588fd.yaml
new file mode 100644
index 000000000..5ed25ae1a
--- /dev/null
+++ b/releasenotes/notes/gnocchi-and-aodh-00da52a4c45588fd.yaml
@@ -0,0 +1,11 @@
+---
+prelude: >
+    Packstack now provides support for installing and configuring both the
+    Gnocchi and the Aodh telemetry projects.
+features:
+  - |
+    Add support for installing and configuring the Telemetry Alarming Service
+    (Aodh)
+  - |
+    Add support for installing and configuring the Telemetry Time Series
+    Database as a Service (Gnocchi)
diff --git a/releasenotes/notes/install-tempest-from-rpm-fd59c072011f372b.yaml b/releasenotes/notes/install-tempest-from-rpm-fd59c072011f372b.yaml
new file mode 100644
index 000000000..07fce054e
--- /dev/null
+++ b/releasenotes/notes/install-tempest-from-rpm-fd59c072011f372b.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - Install tempest from rpm.
+deprecations:
+  - CONFIG_PROVISION_TEMPEST_REPO_URI and CONFIG_PROVISION_TEMPEST_REPO_REVISION options are removed.
diff --git a/releasenotes/notes/integration-tests-d5f86a29cc037329.yaml b/releasenotes/notes/integration-tests-d5f86a29cc037329.yaml
new file mode 100644
index 000000000..a832ca517
--- /dev/null
+++ b/releasenotes/notes/integration-tests-d5f86a29cc037329.yaml
@@ -0,0 +1,16 @@
+---
+prelude: >
+    The Tempest implementation in Packstack has been refactored and improved in
+    order to be able to install, configure and run Tempest against itself.
+    We have leveraged these new features to have Packstack gate patch reviews
+    against integration jobs where the patch is tested automatically against a
+    wide range of configuration scenarios.
+features:
+  - |
+    Implemented test scenarios and tools to troubleshoot failed installations
+
+  - |
+    Implemented gate jobs which install Packstack and run tempest against itself
+
+  - |
+    Tempest installation and configuration has been vastly improved
diff --git a/releasenotes/notes/keystone-evenlet-dropped-6f85670db62f7b91.yaml b/releasenotes/notes/keystone-evenlet-dropped-6f85670db62f7b91.yaml
new file mode 100644
index 000000000..79dd87185
--- /dev/null
+++ b/releasenotes/notes/keystone-evenlet-dropped-6f85670db62f7b91.yaml
@@ -0,0 +1,7 @@
+---
+deprecations:
+  - |
+    Keystone eventlet support has been removed as of
+    https://review.openstack.org/249486. Packstack support has also been
+    removed, so parameter CONFIG_KEYSTONE_SERVICE_NAME in the config file
+    will be ignored.
diff --git a/releasenotes/notes/keystone-v3-note-065b6302b49285f3.yaml b/releasenotes/notes/keystone-v3-note-065b6302b49285f3.yaml
new file mode 100644
index 000000000..3f7b5e905
--- /dev/null
+++ b/releasenotes/notes/keystone-v3-note-065b6302b49285f3.yaml
@@ -0,0 +1,5 @@
+---
+issues:
+  - Keystone v3 API is not fully functional in Packstack. Cinder does not
+    work properly if CONFIG_KEYSTONE_API_VERSION is set to v3.
+
diff --git a/releasenotes/notes/l3-agent-multiple-networks-9d1837c4187055be.yaml b/releasenotes/notes/l3-agent-multiple-networks-9d1837c4187055be.yaml
new file mode 100644
index 000000000..cb1483e47
--- /dev/null
+++ b/releasenotes/notes/l3-agent-multiple-networks-9d1837c4187055be.yaml
@@ -0,0 +1,12 @@
+---
+features:
+  - In previous releases neutron L3 agent was configured
+    statically to manage only br-ex as provider network.
+    This way of configuring neutron is being deprecated in neutron
+    and it's recomended to move to a new mode where a
+    single L3 agent is able to manage multiple provider
+    networks. To implement it, a new parameter
+    CONFIG_NEUTRON_OVS_EXTERNAL_PHYSNET has been introduced.
+    Default configuration has been modified to preserve the
+    same behavior, creating a public network attached to
+    br-ex bridge.
diff --git a/releasenotes/notes/manifest-execution-refactor-418c27bbc03df064.yaml b/releasenotes/notes/manifest-execution-refactor-418c27bbc03df064.yaml
new file mode 100644
index 000000000..825c843a6
--- /dev/null
+++ b/releasenotes/notes/manifest-execution-refactor-418c27bbc03df064.yaml
@@ -0,0 +1,25 @@
+---
+features:
+  - Previously, Packstack created many individual manifest files from
+    smaller snippets (templates), and executed them following a certain
+    order. This is sub-optimal, since it forces code duplication and goes
+    against the Puppet design of running a single manifest.
+
+    This patch refactors the manifest execution, with the following changes
+
+    - Only 4 templates used, so max 4 Puppet executions on a host. Controller
+      manifest, network node manifest, compute node manifest, and a firewall
+      manifest, which is still generated on the fly for simplicity.
+
+    - The previous snippets are now part of the Packstack Puppet module, and
+      included as needed by the controller/network/compute manifests. This
+      concept is similar to the one used by the puppet-openstack-integration
+      project.
+
+    - The remaining Python code is left untouched, so we can keep complete
+      compatibility with previous answer files.
+
+deprecations:
+  - |
+    Redis HA support has been removed from Packstack.
+
diff --git a/releasenotes/notes/move-to-pymysql-b5f1a40ededa8fb2.yaml b/releasenotes/notes/move-to-pymysql-b5f1a40ededa8fb2.yaml
new file mode 100644
index 000000000..bfd11f0db
--- /dev/null
+++ b/releasenotes/notes/move-to-pymysql-b5f1a40ededa8fb2.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - |
+    Transition to the new PyMySQL driver for database access.
diff --git a/releasenotes/notes/neutron-ovs-bridges-compute-0aec0e39c1b1b84b.yaml b/releasenotes/notes/neutron-ovs-bridges-compute-0aec0e39c1b1b84b.yaml
new file mode 100644
index 000000000..cdfe0c0b2
--- /dev/null
+++ b/releasenotes/notes/neutron-ovs-bridges-compute-0aec0e39c1b1b84b.yaml
@@ -0,0 +1,12 @@
+---
+features:
+  - |
+    New parameter ``--os-neutron-ovs-bridges-compute`` has been introduced to
+    set the OVS bridges created and configured in compute nodes when vlan or
+    flat type drivers are enabled.
+
+fixes:
+  - |
+    Before this patch, all defined OVS bridges were created in both network
+    and compute hosts. However, in certain topologies some bridges are only
+    required in network hosts.
diff --git a/releasenotes/notes/nova-cert-86fb2f0ddc53b032.yaml b/releasenotes/notes/nova-cert-86fb2f0ddc53b032.yaml
new file mode 100644
index 000000000..e452f8b14
--- /dev/null
+++ b/releasenotes/notes/nova-cert-86fb2f0ddc53b032.yaml
@@ -0,0 +1,4 @@
+---
+other:
+  - Removing Nova cert service, which has been removed in Nova
+    during Pike cycle.
diff --git a/releasenotes/notes/nova-cpu-manager-8440f026c4a0165e.yaml b/releasenotes/notes/nova-cpu-manager-8440f026c4a0165e.yaml
new file mode 100644
index 000000000..bf68a77d1
--- /dev/null
+++ b/releasenotes/notes/nova-cpu-manager-8440f026c4a0165e.yaml
@@ -0,0 +1,4 @@
+---
+other:
+  - Remove nova compute manager option, removed in Nova
+    and puppet-nova.
diff --git a/releasenotes/notes/nova-migration-improvements-85b208c2b45a3fbe.yaml b/releasenotes/notes/nova-migration-improvements-85b208c2b45a3fbe.yaml
new file mode 100644
index 000000000..f3c034a22
--- /dev/null
+++ b/releasenotes/notes/nova-migration-improvements-85b208c2b45a3fbe.yaml
@@ -0,0 +1,5 @@
+---
+security:
+  - Improving security of the Nova migration configuration.
+    Now, ssh is the default option for Nova migration, and
+    a specific migration user is used.
diff --git a/releasenotes/notes/nova-placement-api-acf32977978da6fb.yaml b/releasenotes/notes/nova-placement-api-acf32977978da6fb.yaml
new file mode 100644
index 000000000..7cf1b4ffa
--- /dev/null
+++ b/releasenotes/notes/nova-placement-api-acf32977978da6fb.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - Packstack now installs and configures the Nova Placement API which is
+    required from Ocata onwards.
\ No newline at end of file
diff --git a/releasenotes/notes/ovs-bridges-on-network-nodes-890c51cbbddf8f1c.yaml b/releasenotes/notes/ovs-bridges-on-network-nodes-890c51cbbddf8f1c.yaml
new file mode 100644
index 000000000..59f640252
--- /dev/null
+++ b/releasenotes/notes/ovs-bridges-on-network-nodes-890c51cbbddf8f1c.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    OVS bridges are no longer created on compute nodes, they should only be
+    created on network nodes.
diff --git a/releasenotes/notes/ovs-tunnel-subnets-8955593d3004852e.yaml b/releasenotes/notes/ovs-tunnel-subnets-8955593d3004852e.yaml
new file mode 100644
index 000000000..58643a89c
--- /dev/null
+++ b/releasenotes/notes/ovs-tunnel-subnets-8955593d3004852e.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - |
+    Add neutron plugin option ``CONFIG_NEUTRON_OVS_TUNNEL_SUBNETS`` to configure
+    IP filtering to accept tunneling packets from these subnets instead of
+    specific IP addresses of peer nodes.
diff --git a/releasenotes/notes/packstack-moved-from-stackforge-766c35141b5480c3.yaml b/releasenotes/notes/packstack-moved-from-stackforge-766c35141b5480c3.yaml
new file mode 100644
index 000000000..41d98e377
--- /dev/null
+++ b/releasenotes/notes/packstack-moved-from-stackforge-766c35141b5480c3.yaml
@@ -0,0 +1,5 @@
+---
+other:
+  - |
+    The Packstack project repository was moved from https://github.com/stackforge/packstack to
+    https://github.com/openstack/packstack
diff --git a/releasenotes/notes/qpid-removal-f754f589e335ae0c.yaml b/releasenotes/notes/qpid-removal-f754f589e335ae0c.yaml
new file mode 100644
index 000000000..2255df57b
--- /dev/null
+++ b/releasenotes/notes/qpid-removal-f754f589e335ae0c.yaml
@@ -0,0 +1,5 @@
+---
+deprecations:
+  - |
+    qpid support has been dropped from oslo.messaging and as such, support for
+    it has been removed from Packstack.
diff --git a/releasenotes/notes/register-satellite6-server-796a5f89b39386a4.yaml b/releasenotes/notes/register-satellite6-server-796a5f89b39386a4.yaml
new file mode 100644
index 000000000..67d07908c
--- /dev/null
+++ b/releasenotes/notes/register-satellite6-server-796a5f89b39386a4.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - |
+    Allow registering to a Satellite 6 server
diff --git a/releasenotes/notes/releasenotes/notes/add-custom-lvm-name-090af5002950706d.yaml b/releasenotes/notes/releasenotes/notes/add-custom-lvm-name-090af5002950706d.yaml
new file mode 100644
index 000000000..01cc2552b
--- /dev/null
+++ b/releasenotes/notes/releasenotes/notes/add-custom-lvm-name-090af5002950706d.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - Users would like the ability to use custom lvm
+    names during deployment. This is now possible using
+    the cinder-volume-name parameter. 
diff --git a/releasenotes/notes/remove-cinder-gluster-6c54d9f440424259.yaml b/releasenotes/notes/remove-cinder-gluster-6c54d9f440424259.yaml
new file mode 100644
index 000000000..c811e1b59
--- /dev/null
+++ b/releasenotes/notes/remove-cinder-gluster-6c54d9f440424259.yaml
@@ -0,0 +1,7 @@
+---
+upgrade:
+  - |
+    The GlusterFS volume driver was removed from Cinder in Ocata release. The options to
+    enable it in Packstack have been removed:
+    - `gluster` is not longer accepted in CONFIG_CINDER_BACKEND parameter.
+    - Parameter `CONFIG_CINDER_GLUSTER_MOUNTS` has been removed.
diff --git a/releasenotes/notes/remove-collector-api-5b494f09593197f0.yaml b/releasenotes/notes/remove-collector-api-5b494f09593197f0.yaml
new file mode 100644
index 000000000..b36ea6d4d
--- /dev/null
+++ b/releasenotes/notes/remove-collector-api-5b494f09593197f0.yaml
@@ -0,0 +1,3 @@
+---
+fixes:
+  - Remove confguring ceilometer collector and api in packstack.
diff --git a/releasenotes/notes/remove-config-gnocchi-install-ecfe10ce59f1d0da.yaml b/releasenotes/notes/remove-config-gnocchi-install-ecfe10ce59f1d0da.yaml
new file mode 100644
index 000000000..c2b2ca0f9
--- /dev/null
+++ b/releasenotes/notes/remove-config-gnocchi-install-ecfe10ce59f1d0da.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Remove CONFIG_GNOCCHI_INSTALL command line option and make gnocchi install
+    part of ceilometer install. We will always need gnocchi for ceilometer, so
+    this makes sense and one less option for user to worry about.
diff --git a/releasenotes/notes/remove-epel-support-3732f53a2e45d64c.yaml b/releasenotes/notes/remove-epel-support-3732f53a2e45d64c.yaml
new file mode 100644
index 000000000..16da66bcb
--- /dev/null
+++ b/releasenotes/notes/remove-epel-support-3732f53a2e45d64c.yaml
@@ -0,0 +1,5 @@
+---
+deprecations:
+  - Support to enable the EPEL repository has been removed.
+    It is known to cause conflicts with packages provided
+    with RDO, and it is no longer needed.
diff --git a/releasenotes/notes/remove-glance-registry-6076539ab6ce1a8b.yaml b/releasenotes/notes/remove-glance-registry-6076539ab6ce1a8b.yaml
new file mode 100644
index 000000000..c96ae43e3
--- /dev/null
+++ b/releasenotes/notes/remove-glance-registry-6076539ab6ce1a8b.yaml
@@ -0,0 +1,5 @@
+---
+other:
+  - |
+    Glance Registry service was deprecated in the Queens release and has been removed in Victoria.
+    Accordingly, packstack is not longer deploying glance-registry.
diff --git a/releasenotes/notes/remove-keystone-v2-f257cdb7e7e3a4df.yaml b/releasenotes/notes/remove-keystone-v2-f257cdb7e7e3a4df.yaml
new file mode 100644
index 000000000..5c3311ad2
--- /dev/null
+++ b/releasenotes/notes/remove-keystone-v2-f257cdb7e7e3a4df.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    The ``CONFIG_KEYSTONE_API_VERSION`` parameter no longer accepts ``v2.0``.
+    Identity v2 API was alreday removed from Keystone.
diff --git a/releasenotes/notes/remove-lbaas-0054d83972c5afcf.yaml b/releasenotes/notes/remove-lbaas-0054d83972c5afcf.yaml
new file mode 100644
index 000000000..525eddbef
--- /dev/null
+++ b/releasenotes/notes/remove-lbaas-0054d83972c5afcf.yaml
@@ -0,0 +1,4 @@
+---
+upgrade:
+  - |
+    Neutron LBaaS has been removed from upstream and is now removed from Packstack.
diff --git a/releasenotes/notes/remove-legacy-nova-filters-d6e21a5e8f5c31a7.yaml b/releasenotes/notes/remove-legacy-nova-filters-d6e21a5e8f5c31a7.yaml
new file mode 100644
index 000000000..e7817927d
--- /dev/null
+++ b/releasenotes/notes/remove-legacy-nova-filters-d6e21a5e8f5c31a7.yaml
@@ -0,0 +1,6 @@
+---
+deprecations:
+  - |
+    Ram/Disk/Core Filter Scheduler were deprecated since
+    stein and are recently removed in nova, hence removing
+    it from Packstack.
diff --git a/releasenotes/notes/remove-nagios-deployment-21362a84a3ac446f.yaml b/releasenotes/notes/remove-nagios-deployment-21362a84a3ac446f.yaml
new file mode 100644
index 000000000..63a7d2f9d
--- /dev/null
+++ b/releasenotes/notes/remove-nagios-deployment-21362a84a3ac446f.yaml
@@ -0,0 +1,13 @@
+---
+deprecations:
+  - |
+    The option to deploy nagios from packstack was
+    deprecated in Ocata release and it has been removed
+    in Pike. Following options have been retired:
+
+      * CONFIG_NAGIOS_INSTALL
+      * CONFIG_NAGIOS_PW
+
+    Note that CentOS OpsTools Special Interest Group provides
+    packages and automation tooling to deploy monitoring tools
+    and integrate them with RDO.
diff --git a/releasenotes/notes/remove-nova-network-8fe352ac6eb22ecb.yaml b/releasenotes/notes/remove-nova-network-8fe352ac6eb22ecb.yaml
new file mode 100644
index 000000000..d91e12295
--- /dev/null
+++ b/releasenotes/notes/remove-nova-network-8fe352ac6eb22ecb.yaml
@@ -0,0 +1,18 @@
+---
+deprecations:
+  - |
+    Service nova-network has been removed in nova project
+    in Ocata. Packstack has removed support to deploying
+    this service, what implies some changes:
+
+      * CONFIG_NEUTRON_INSTALL must allways be set to y
+      * CONFIG_NOVA_COMPUTE_PRIVIF option has been removed.
+      * CONFIG_NOVA_NETWORK_MANAGER option has been removed.
+      * CONFIG_NOVA_NETWORK_PUBIF option has been removed.
+      * CONFIG_NOVA_NETWORK_PRIVIF option has been removed.
+      * CONFIG_NOVA_NETWORK_FIXEDRANGE option has been removed.
+      * CONFIG_NOVA_NETWORK_FLOATRANGE option has been removed.
+      * CONFIG_NOVA_NETWORK_AUTOASSIGNFLOATINGIP option has been removed.
+      * CONFIG_NOVA_NETWORK_VLAN_START  option has been removed.
+      * CONFIG_NOVA_NETWORK_NUMBER option has been removed.
+      * CONFIG_NOVA_NETWORK_SIZE option has been removed.
diff --git a/releasenotes/notes/remove-retry-filter-nova-05e84f3fd020d8ed.yaml b/releasenotes/notes/remove-retry-filter-nova-05e84f3fd020d8ed.yaml
new file mode 100644
index 000000000..e0d2e2034
--- /dev/null
+++ b/releasenotes/notes/remove-retry-filter-nova-05e84f3fd020d8ed.yaml
@@ -0,0 +1,6 @@
+---
+deprecations:
+  - |
+    Retry Filter Scheduler was deprecated since Train
+    and is recently removed in nova, hence removing
+    it from Packstack.
diff --git a/releasenotes/notes/remove-sahara-79e02a209c7128e9.yaml b/releasenotes/notes/remove-sahara-79e02a209c7128e9.yaml
new file mode 100644
index 000000000..c01db5cec
--- /dev/null
+++ b/releasenotes/notes/remove-sahara-79e02a209c7128e9.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    Sahara support has been removed because the sahara project is no longer
+    maintained.
diff --git a/releasenotes/notes/remove-uec-images-d876bd8c805d9633.yaml b/releasenotes/notes/remove-uec-images-d876bd8c805d9633.yaml
new file mode 100644
index 000000000..baae33478
--- /dev/null
+++ b/releasenotes/notes/remove-uec-images-d876bd8c805d9633.yaml
@@ -0,0 +1,10 @@
+---
+upgrade:
+  - |
+    Default cirros image for demo project has been updated to 0.5.1. With this change
+    using UEC image is not longer needed so following options have been removed from
+    packstack parameters:
+    * CONFIG_PROVISION_UEC_IMAGE_NAME
+    * CONFIG_PROVISION_UEC_IMAGE_KERNEL_URL
+    * CONFIG_PROVISION_UEC_IMAGE_RAMDISK_URL
+    * CONFIG_PROVISION_UEC_IMAGE_DISK_URL
diff --git a/releasenotes/notes/renamed-ssl-subject-parameters-c2a52d17c349a59f.yaml b/releasenotes/notes/renamed-ssl-subject-parameters-c2a52d17c349a59f.yaml
new file mode 100644
index 000000000..876a1055d
--- /dev/null
+++ b/releasenotes/notes/renamed-ssl-subject-parameters-c2a52d17c349a59f.yaml
@@ -0,0 +1,36 @@
+---
+upgrade:
+  - |
+    Parameters names for SSL certificates subjects have
+    been changed. While old parameters names still works
+    when using answers files, they will not work when
+    passed with packstack cli. For users using them, they
+    are required to move to new CLI parameters, see ``packstack -h``
+    for details of new names.
+
+deprecations:
+  - |
+    SSL certificates subject parameters can be used now
+    both to create a new selfsigned CA certificate or
+    to generate new server certificates using an existing
+    CA certificate. In order to provide a more accurate
+    usage description for SSL certificates subject parameters,
+    they have been renamed as follows:
+
+      * CONFIG_SELFSIGN_CACERT_SUBJECT_C is renamed to
+        CONFIG_SSL_CERT_SUBJECT_C
+      * CONFIG_SELFSIGN_CACERT_SUBJECT_ST is renamed to
+        CONFIG_SSL_CERT_SUBJECT_ST
+      * CONFIG_SELFSIGN_CACERT_SUBJECT_L is renamed to
+        CONFIG_SSL_CERT_SUBJECT_L
+      * CONFIG_SELFSIGN_CACERT_SUBJECT_O is renamed to
+        CONFIG_SSL_CERT_SUBJECT_O
+      * CONFIG_SELFSIGN_CACERT_SUBJECT_OU is renamed to
+        CONFIG_SSL_CERT_SUBJECT_OU
+      * CONFIG_SELFSIGN_CACERT_SUBJECT_CN is renamed to
+        CONFIG_SSL_CERT_SUBJECT_CN
+      * CONFIG_SELFSIGN_CACERT_SUBJECT_MAIL is renamed to
+        CONFIG_SSL_CERT_SUBJECT_MAIL
+
+    Old parameters names in answer files will still work
+    but it's recomended to move to new ones.
diff --git a/releasenotes/notes/reno-for-release-notes-66c17b84c946591f.yaml b/releasenotes/notes/reno-for-release-notes-66c17b84c946591f.yaml
new file mode 100644
index 000000000..ed2b37a26
--- /dev/null
+++ b/releasenotes/notes/reno-for-release-notes-66c17b84c946591f.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    Release notes are no longer maintained by hand, we now use the Reno tool to
+    manage them.
diff --git a/releasenotes/notes/service-workers-and-mariadb-c2a6ba903f36b57e.yaml b/releasenotes/notes/service-workers-and-mariadb-c2a6ba903f36b57e.yaml
new file mode 100644
index 000000000..f6ac25212
--- /dev/null
+++ b/releasenotes/notes/service-workers-and-mariadb-c2a6ba903f36b57e.yaml
@@ -0,0 +1,12 @@
+---
+features:
+  - |
+    Add ``--service-workers`` parameter to configure the amount of
+    workers/threads per process to scale up or down as necessary. Defaults to
+    the amount of cores on the system.
+
+fixes:
+  - |
+    MariaDB max_connections is no longer hardcoded to 1024 and now scales
+    automatically according to the --service-workers parameter.
+    ( Service Workers * 128 ).
diff --git a/releasenotes/notes/swift-s3-removal-ee3ddc2ee21a56cf.yaml b/releasenotes/notes/swift-s3-removal-ee3ddc2ee21a56cf.yaml
new file mode 100644
index 000000000..35d69fdeb
--- /dev/null
+++ b/releasenotes/notes/swift-s3-removal-ee3ddc2ee21a56cf.yaml
@@ -0,0 +1,5 @@
+---
+deprecations:
+  - |
+    Removed the configuration of the Swift S3 endpoint. Swift S3 is not yet
+    supported in Packstack.
diff --git a/releasenotes/notes/switch-default-neutron-driver-to-ovn-0eb7053b81c7794d.yaml b/releasenotes/notes/switch-default-neutron-driver-to-ovn-0eb7053b81c7794d.yaml
new file mode 100644
index 000000000..e6f7be733
--- /dev/null
+++ b/releasenotes/notes/switch-default-neutron-driver-to-ovn-0eb7053b81c7794d.yaml
@@ -0,0 +1,11 @@
+---
+prelude: >
+    The default ML2 driver is replaced from ``openvswitch``to ``ovn``. This
+    means that, when deploying packstack with the default settings, OVN will
+    be used as the networking backend for Neutron.
+features:
+  - |
+    OVN is now used as the default networking backend for Neutron when
+    deploying packstack. Neutron agents such as L2, L3 or DHCP agents are no
+    longer used and get replaced by OVN services.
+    The encapsulation used will be ``geneve`` instead of ``vxlan``.
diff --git a/releasenotes/notes/update-puppet-module-usage-4ed869e87e67caaf.yaml b/releasenotes/notes/update-puppet-module-usage-4ed869e87e67caaf.yaml
new file mode 100644
index 000000000..7775fac03
--- /dev/null
+++ b/releasenotes/notes/update-puppet-module-usage-4ed869e87e67caaf.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Several updates to Packstack to keep up with supported upstream projects
+    new features, deprecations or removals throughout the cycle.
diff --git a/tools/pip-requires b/releasenotes/source/_static/.placeholder
similarity index 100%
rename from tools/pip-requires
rename to releasenotes/source/_static/.placeholder
diff --git a/releasenotes/source/_templates/.placeholder b/releasenotes/source/_templates/.placeholder
new file mode 100644
index 000000000..e69de29bb
diff --git a/releasenotes/source/conf.py b/releasenotes/source/conf.py
new file mode 100644
index 000000000..e176b13d2
--- /dev/null
+++ b/releasenotes/source/conf.py
@@ -0,0 +1,268 @@
+# -*- coding: utf-8 -*-
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# If extensions (or modules to document with autodoc) are in another directory,
+# add these directories to sys.path here. If the directory is relative to the
+# documentation root, use os.path.abspath to make it absolute, like shown here.
+# sys.path.insert(0, os.path.abspath('.'))
+
+# -- General configuration ------------------------------------------------
+
+# If your documentation needs a minimal Sphinx version, state it here.
+# needs_sphinx = '1.0'
+
+# Add any Sphinx extension module names here, as strings. They can be
+# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
+# ones.
+extensions = [
+    'openstackdocstheme',
+    'reno.sphinxext',
+]
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ['_templates']
+
+# The suffix of source filenames.
+source_suffix = '.rst'
+
+# The encoding of source files.
+# source_encoding = 'utf-8-sig'
+
+# The master toctree document.
+master_doc = 'index'
+
+# General information about the project.
+project = u'Packstack Release Notes'
+copyright = u'2016, Packstack Developers'
+
+# Release notes do not need a version number in the title, they
+# cover multiple releases.
+# The short X.Y version.
+version = ''
+# The full version, including alpha/beta/rc tags.
+release = ''
+
+# openstackdocstheme options
+repository_name = 'openstack/packstack'
+bug_project = 'packstack'
+bug_tag = ''
+
+# The language for content autogenerated by Sphinx. Refer to documentation
+# for a list of supported languages.
+# language = None
+
+# There are two options for replacing |today|: either, you set today to some
+# non-false value, then it is used:
+# today = ''
+# Else, today_fmt is used as the format for a strftime call.
+# today_fmt = '%B %d, %Y'
+
+# List of patterns, relative to source directory, that match files and
+# directories to ignore when looking for source files.
+exclude_patterns = []
+
+# The reST default role (used for this markup: `text`) to use for all
+# documents.
+# default_role = None
+
+# If true, '()' will be appended to :func: etc. cross-reference text.
+# add_function_parentheses = True
+
+# If true, the current module name will be prepended to all description
+# unit titles (such as .. function::).
+# add_module_names = True
+
+# If true, sectionauthor and moduleauthor directives will be shown in the
+# output. They are ignored by default.
+# show_authors = False
+
+# The name of the Pygments (syntax highlighting) style to use.
+pygments_style = 'sphinx'
+
+# A list of ignored prefixes for module index sorting.
+# modindex_common_prefix = []
+
+# If true, keep warnings as "system message" paragraphs in the built documents.
+# keep_warnings = False
+
+
+# -- Options for HTML output ----------------------------------------------
+
+# The theme to use for HTML and HTML Help pages.  See the documentation for
+# a list of builtin themes.
+html_theme = 'openstackdocs'
+
+# Theme options are theme-specific and customize the look and feel of a theme
+# further.  For a list of options available for each theme, see the
+# documentation.
+# html_theme_options = {}
+
+# Add any paths that contain custom themes here, relative to this directory.
+# html_theme_path = []
+
+# The name for this set of Sphinx documents.  If None, it defaults to
+# "<project> v<release> documentation".
+# html_title = None
+
+# A shorter title for the navigation bar.  Default is the same as html_title.
+# html_short_title = None
+
+# The name of an image file (relative to this directory) to place at the top
+# of the sidebar.
+# html_logo = None
+
+# The name of an image file (within the static path) to use as favicon of the
+# docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
+# pixels large.
+# html_favicon = None
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+html_static_path = ['_static']
+
+# Add any extra paths that contain custom files (such as robots.txt or
+# .htaccess) here, relative to this directory. These files are copied
+# directly to the root of the documentation.
+# html_extra_path = []
+
+# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
+# using the given strftime format.
+# html_last_updated_fmt = '%b %d, %Y'
+# Must set this variable to include year, month, day, hours, and minutes.
+html_last_updated_fmt = '%Y-%m-%d %H:%M'
+
+# If true, SmartyPants will be used to convert quotes and dashes to
+# typographically correct entities.
+# html_use_smartypants = True
+
+# Custom sidebar templates, maps document names to template names.
+# html_sidebars = {}
+
+# Additional templates that should be rendered to pages, maps page names to
+# template names.
+# html_additional_pages = {}
+
+# If false, no module index is generated.
+# html_domain_indices = True
+
+# If false, no index is generated.
+# html_use_index = True
+
+# If true, the index is split into individual pages for each letter.
+# html_split_index = False
+
+# If true, links to the reST sources are added to the pages.
+# html_show_sourcelink = True
+
+# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
+# html_show_sphinx = True
+
+# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
+# html_show_copyright = True
+
+# If true, an OpenSearch description file will be output, and all pages will
+# contain a <link> tag referring to it.  The value of this option must be the
+# base URL from which the finished HTML is served.
+# html_use_opensearch = ''
+
+# This is the file name suffix for HTML files (e.g. ".xhtml").
+# html_file_suffix = None
+
+# Output file base name for HTML help builder.
+htmlhelp_basename = 'PackstackReleaseNotesdoc'
+
+
+# -- Options for LaTeX output ---------------------------------------------
+
+latex_elements = {
+    # The paper size ('letterpaper' or 'a4paper').
+    # 'papersize': 'letterpaper',
+
+    # The font size ('10pt', '11pt' or '12pt').
+    # 'pointsize': '10pt',
+
+    # Additional stuff for the LaTeX preamble.
+    # 'preamble': '',
+}
+
+# Grouping the document tree into LaTeX files. List of tuples
+# (source start file, target name, title,
+#  author, documentclass [howto, manual, or own class]).
+latex_documents = [
+    ('index', 'PackstackReleaseNotes.tex', u'Packstack Release Notes Documentation',
+     u'2016, Packstack Developers', 'manual'),
+]
+
+# The name of an image file (relative to this directory) to place at the top of
+# the title page.
+# latex_logo = None
+
+# For "manual" documents, if this is true, then toplevel headings are parts,
+# not chapters.
+# latex_use_parts = False
+
+# If true, show page references after internal links.
+# latex_show_pagerefs = False
+
+# If true, show URL addresses after external links.
+# latex_show_urls = False
+
+# Documents to append as an appendix to all manuals.
+# latex_appendices = []
+
+# If false, no module index is generated.
+# latex_domain_indices = True
+
+
+# -- Options for manual page output ---------------------------------------
+
+# One entry per manual page. List of tuples
+# (source start file, name, description, authors, manual section).
+man_pages = [
+    ('index', 'packstackreleasenotes', u'Packstack Release Notes Documentation',
+     [u'2016, Packstack Developers'], 1)
+]
+
+# If true, show URL addresses after external links.
+# man_show_urls = False
+
+
+# -- Options for Texinfo output -------------------------------------------
+
+# Grouping the document tree into Texinfo files. List of tuples
+# (source start file, target name, title, author,
+#  dir menu entry, description, category)
+texinfo_documents = [
+    ('index', 'PackstackReleaseNotes', u'Packstack Release Notes Documentation',
+     u'2016, Packstack Developers', 'PackstackReleaseNotes', 'OpenStack installer',
+     'Miscellaneous'),
+]
+
+# Documents to append as an appendix to all manuals.
+# texinfo_appendices = []
+
+# If false, no module index is generated.
+# texinfo_domain_indices = True
+
+# How to display URL addresses: 'footnote', 'no', or 'inline'.
+# texinfo_show_urls = 'footnote'
+
+# If true, do not generate a @detailmenu in the "Top" node's menu.
+# texinfo_no_detailmenu = False
+
+# -- Options for Internationalization output ------------------------------
+locale_dirs = ['locale/']
diff --git a/releasenotes/source/index.rst b/releasenotes/source/index.rst
new file mode 100644
index 000000000..004786436
--- /dev/null
+++ b/releasenotes/source/index.rst
@@ -0,0 +1,16 @@
+Welcome to Packstack Release Notes!
+===================================
+
+Contents
+========
+
+.. toctree::
+   :maxdepth: 2
+
+   unreleased
+
+Indices and tables
+==================
+
+* :ref:`genindex`
+* :ref:`search`
\ No newline at end of file
diff --git a/releasenotes/source/unreleased.rst b/releasenotes/source/unreleased.rst
new file mode 100644
index 000000000..16c701c3e
--- /dev/null
+++ b/releasenotes/source/unreleased.rst
@@ -0,0 +1,4 @@
+Current Series Release Notes
+============================
+
+.. release-notes::
\ No newline at end of file
diff --git a/requirements.txt b/requirements.txt
index 3721f7851..f99e8383c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1,7 @@
+pbr>=1.6 # Apache-2.0
 netaddr>=0.7.6
+PyYAML>=3.10
+docutils>=0.11
+netifaces
+distro
+cryptography>=2.1 # BSD/Apache-2.0
diff --git a/roles/packstack-integration-tempest/tasks/main.yaml b/roles/packstack-integration-tempest/tasks/main.yaml
new file mode 100644
index 000000000..bd0d6a3ec
--- /dev/null
+++ b/roles/packstack-integration-tempest/tasks/main.yaml
@@ -0,0 +1,13 @@
+- name: packstack-integration-tempest
+  shell:
+      cmd: |
+        set -e
+        set -x
+        export SCENARIO='{{ scenario }}'
+        export DELOREAN='{{ delorean | default('') }}'
+        export DELOREAN_DEPS='{{ delorean_deps | default('') }}'
+        export SELINUX_ENFORCING='{{ selinux_enforcing | default('true') }}'
+        ./run_tests.sh
+      executable: /bin/bash
+      chdir: '{{ ansible_user_dir }}/workspace/packstack'
+  environment: '{{ zuul }}'
diff --git a/run_tests.sh b/run_tests.sh
index 1c836eb0c..9e464bdfc 100755
--- a/run_tests.sh
+++ b/run_tests.sh
@@ -1,2 +1,317 @@
-#!/usr/bin/env bash
-tox -epy26,py27,pep8
+#!/bin/bash -ex
+# Copyright 2015 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+export PATH=$PATH:/usr/local/sbin:/usr/sbin
+
+SCENARIO=${SCENARIO:-scenario001}
+
+BRANCH=master
+
+# Find OS version and release
+source /etc/os-release
+OS_NAME_VERS=${ID}${VERSION_ID}
+
+# We could want to override the default repositories or install behavior
+INSTALL_FROM_SOURCE=${INSTALL_FROM_SOURCE:-true}
+MANAGE_REPOS=${MANAGE_REPOS:-true}
+DELOREAN=${DELOREAN:-https://trunk.rdoproject.org/${OS_NAME_VERS}-master/current-passed-ci/delorean.repo}
+DELOREAN_DEPS=${DELOREAN_DEPS:-https://trunk.rdoproject.org/${OS_NAME_VERS}-master/delorean-deps.repo}
+GIT_BASE_URL=${GIT_BASE_URL:-https://git.openstack.org}
+ADDITIONAL_ARGS=${ADDITIONAL_ARGS:-}
+SELINUX_ENFORCING=${SELINUX_ENFORCING:-true}
+# If logs should be retrieved automatically
+COPY_LOGS=${COPY_LOGS:-true}
+
+# Let's add an option for a secondary node, to act as a compute
+CONTROLLER_NODE=${CONTROLLER_NODE:-}
+COMPUTE_NODE=${COMPUTE_NODE:-}
+
+# Use dnf as package manager if it exist
+type -p dnf && export PKG_MGR=dnf || export PKG_MGR=yum
+
+# Install external Puppet modules with r10k
+# Uses the following variables:
+#
+# - ``GEM_BIN_DIR`` must be set to Gem bin directory
+# - ``PUPPETFILE_DIR`` must be set to Puppet modules directory
+install_external() {
+  $SUDO ${GEM_BIN_DIR}r10k puppetfile install -v --moduledir ${PUPPETFILE_DIR} --puppetfile Puppetfile1
+}
+
+# Install Puppet OpenStack modules with zuul-cloner
+# Uses the following variables:
+#
+# - ``PUPPETFILE_DIR`` must be set to Puppet modules directory
+# - ``ZUUL_REF`` must be set to Zuul ref. Fallback to 'None'.
+# - ``ZUUL_BRANCH`` must be set to Zuul branch. Fallback to 'master'.
+install_openstack() {
+  cat > clonemap.yaml <<EOF
+clonemap:
+  - name: '(.*?)/puppet-(.*)'
+    dest: '$PUPPETFILE_DIR/\2'
+EOF
+
+  # Periodic jobs run without ref on master
+  ZUUL_REF=${ZUUL_REF:-None}
+  ZUUL_BRANCH=${ZUUL_BRANCH:-master}
+  GIT_BASE_URL=${GIT_BASE_URL:-https://git.openstack.org}
+
+  local project_names=$(awk '{ if ($1 == ":git") print $3 }' \
+    Puppetfile0 | tr -d "'," | cut -d '/' -f 4- | xargs
+  )
+  $SUDO /usr/zuul-env/bin/zuul-cloner -m clonemap.yaml \
+    --cache-dir /opt/git \
+    --zuul-ref $ZUUL_REF \
+    --zuul-branch $ZUUL_BRANCH \
+    https://git.openstack.org $project_names
+}
+
+# Install all Puppet modules with r10k
+# Uses the following variables:
+#
+# - ``GEM_BIN_DIR`` must be set to Gem bin directory
+install_all() {
+  $SUDO ${GEM_BIN_DIR}r10k puppetfile install -v --puppetfile Puppetfile
+}
+
+# Install Puppet OpenStack modules and dependencies by using
+# zuul-cloner or r10k.
+# Uses the following variables:
+#
+# - ``PUPPETFILE_DIR`` must be set to Puppet modules directory
+# - ``ZUUL_REF`` must be set to Zuul ref
+# - ``ZUUL_BRANCH`` must be set to Zuul branch
+install_modules() {
+  # If zuul-cloner is there, have it install modules using zuul refs
+  if [ -e /usr/zuul-env/bin/zuul-cloner ] ; then
+    csplit Puppetfile /'Non-OpenStack modules'/ \
+      --prefix Puppetfile \
+      --suffix '%d'
+    install_external
+    install_openstack
+  else
+    install_all
+  fi
+  # Copy the Packstack Puppet module
+  $SUDO cp -r packstack/puppet/modules/packstack ${PUPPETFILE_DIR}
+}
+
+if [ $(id -u) != 0 ]; then
+    SUDO='sudo -E'
+
+    # Packstack will connect as root to localhost, set-up the keypair and sshd
+    if [ ! -f ~/.ssh/id_rsa ]; then
+      ssh-keygen -t rsa -C "packstack-integration-test" -N "" -f ~/.ssh/id_rsa
+    fi
+
+    $SUDO mkdir -p /root/.ssh
+    cat ~/.ssh/id_rsa.pub | $SUDO tee -a /root/.ssh/authorized_keys
+    $SUDO chmod 0600 /root/.ssh/authorized_keys
+    $SUDO sed -i 's/^PermitRootLogin no/PermitRootLogin without-password/g' /etc/ssh/sshd_config
+    $SUDO service sshd restart
+fi
+
+# Make swap configuration consistent
+# TODO: REMOVE ME
+# https://review.openstack.org/#/c/300122/
+source ./tools/fix_disk_layout.sh
+
+# Bump ulimit to avoid too many open file errors
+echo "${USER} soft nofile 65536" | $SUDO tee -a /etc/security/limits.conf
+echo "${USER} hard nofile 65536" | $SUDO tee -a /etc/security/limits.conf
+echo "root soft nofile 65536" | $SUDO tee -a /etc/security/limits.conf
+echo "root hard nofile 65536" | $SUDO tee -a /etc/security/limits.conf
+
+# Set SELinux to enforcing/permissive as needed
+if [ "${SELINUX_ENFORCING}" = true ]; then
+    $SUDO setenforce 1
+else
+    $SUDO setenforce 0
+fi
+
+# Setup repositories
+if [ "${MANAGE_REPOS}" = true ]; then
+    $SUDO curl -L ${DELOREAN} -o /etc/yum.repos.d/delorean.repo
+    $SUDO curl -L ${DELOREAN_DEPS} -o /etc/yum.repos.d/delorean-deps.repo
+    $SUDO $PKG_MGR update -y
+fi
+
+# Install dependencies
+$SUDO $PKG_MGR -y install puppet \
+                     iproute \
+                     iptables \
+                     iptables-services \
+                     dstat \
+                     openssl-devel \
+                     libffi-devel \
+                     libxml2-devel \
+                     libxslt-devel \
+                     libyaml-devel \
+                     ruby-devel \
+                     openstack-selinux \
+                     policycoreutils \
+                     rubygems \
+                     curl \
+                     gettext \
+                     diffstat \
+                     doxygen \
+                     patch \
+                     patchutils \
+                     subversion \
+                     systemtap
+
+# Some dependencies are not installed on RHEL/CentOS 8, or are renamed
+OS_NAME=$(facter operatingsystem)
+OS_VERSION=$(facter operatingsystemmajrelease)
+
+$SUDO $PKG_MGR -y install python3-setuptools \
+                          python3-devel \
+                          python3-wheel \
+                          python3-pyyaml
+
+# Don't assume pip is installed
+which pip3 && PIP=pip3
+if [ -z $PIP ]; then
+    $SUDO $PKG_MGR -y install python3-pip python3-wheel
+    PIP=pip3
+fi
+
+# Try to use pre-cached cirros images, if available, otherwise download them
+rm -rf /tmp/cirros
+mkdir /tmp/cirros
+
+export CIRROS_ARCH="$(uname -p)"
+export CIRROS_VERSION=${CIRROS_VERSION:-"0.6.3"}
+
+if [ -f ~/cache/files/cirros-$CIRROS_VERSION-$CIRROS_ARCH-uec.tar.gz ]; then
+    tar -xzvf ~/cache/files/cirros-$CIRROS_VERSION-$CIRROS_ARCH-uec.tar.gz -C /tmp/cirros/
+else
+    echo "No pre-cached uec archive found, downloading..."
+    curl -Lo /tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-uec.tar.gz --retry 10 https://download.cirros-cloud.net/$CIRROS_VERSION/cirros-$CIRROS_VERSION-$CIRROS_ARCH-uec.tar.gz
+    tar -xzvf /tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-uec.tar.gz -C /tmp/cirros/
+fi
+if [ -f ~/cache/files/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img ]; then
+    cp -p ~/cache/files/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img /tmp/cirros/
+else
+    echo "No pre-cached disk image found, downloading..."
+    curl -Lo /tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img --retry 10 https://download.cirros-cloud.net/$CIRROS_VERSION/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img
+fi
+echo "Using pre-cached images:"
+find /tmp/cirros -type f -printf "%m %n %u %g %s  %t" -exec md5sum \{\} \;
+
+# TO-DO: Packstack should handle Hiera and Puppet configuration, so that it works
+# no matter the environment
+$SUDO su -c 'cat > /etc/puppet/puppet.conf <<EOF
+[main]
+    logdir = /var/log/puppet
+    rundir = /var/run/puppet
+    ssldir = $vardir/ssl
+    hiera_config = /etc/puppet/hiera.yaml
+
+[agent]
+    classfile = $vardir/classes.txt
+    localconfig = $vardir/localconfig
+EOF'
+$SUDO su -c 'cat > /etc/puppet/hiera.yaml <<EOF
+---
+:backends:
+  - yaml
+:yaml:
+  :datadir: /placeholder
+:hierarchy:
+  - common
+  - defaults
+  - "%{clientcert}"
+  - "%{environment}"
+  - global
+EOF'
+
+# To make sure wrong config files are not used
+if [ -d /home/jenkins/.puppet ]; then
+  $SUDO rm -f /home/jenkins/.puppet
+fi
+$SUDO puppet config set hiera_config /etc/puppet/hiera.yaml
+
+# Setup dstat for resource usage tracing
+if type "dstat" 2>/dev/null; then
+    DSTAT_OPTS=""
+    set -e
+    if dstat --help 2>&1 | grep -q "top-io-adv"; then
+        DSTAT_OPTS="${DSTAT_OPTS} --top-io-adv"
+    fi
+
+    if dstat --help 2>&1 | grep -q "top-cpu-adv"; then
+        DSTAT_OPTS="${DSTAT_OPTS} --top-cpu-adv"
+    fi
+    set +e
+    $SUDO dstat -tcmndrylpg $DSTAT_OPTS --nocolor | $SUDO tee --append /var/log/dstat.log > /dev/null &
+fi
+
+# Setup packstack
+if [ "${INSTALL_FROM_SOURCE}" = true ]; then
+  $SUDO $PIP install -U pip
+  $SUDO $PIP install --ignore-installed -c https://opendev.org/openstack/requirements/raw/branch/$BRANCH/upper-constraints.txt --prefix=/usr .
+  # In Fedora when running with sudo gems are installed at /usr/local/bin/ even when GEM_HOME/GEM_BIN_DIR are set
+  if [ "${PKG_MGR}" = "dnf" ]; then
+      export GEM_BIN_DIR=/usr/local/bin/
+  else
+      export GEM_BIN_DIR=/tmp/packstackgems/bin/
+  fi
+  export PUPPETFILE_DIR=/usr/share/openstack-puppet/modules
+  export GEM_HOME=/tmp/packstackgems
+  $SUDO gem install r10k
+  # make sure there is no puppet module pre-installed
+  $SUDO rm -rf "${PUPPETFILE_DIR:?}/"*
+  install_modules
+else
+  $SUDO $PKG_MGR -y install openstack-packstack
+fi
+
+# Make sure there are no other puppet modules in the system (happens in gate)
+$SUDO rm -rf /etc/puppet/modules/*
+
+# Make sure the fqdn is associated to the IP in /etc/hosts
+# Needed for Horizon SSL tests in Tempest
+echo -e "\n127.0.0.1 $(facter fqdn)" | $SUDO tee -a /etc/hosts
+
+# Generate configuration from selected scenario and run it
+source ./tests/${SCENARIO}.sh
+result=$?
+
+# Print output and generate subunit if results exist
+if [ -d /var/lib/tempest ]; then
+    # FIXME(jpena): Work around Fedora image issues with umask
+    $SUDO chown -R $USER /var/lib/tempest
+    pushd /var/lib/tempest
+    if [ -d .testrepository ]; then
+        $SUDO /usr/bin/testr last || true
+        $SUDO bash -c "/usr/bin/testr last --subunit > /var/tmp/packstack/latest/testrepository.subunit" || true
+    elif [ -d .stestr ]; then
+        $SUDO /usr/bin/stestr last || true
+        $SUDO bash -c "/usr/bin/stestr last --subunit > /var/tmp/packstack/latest/testrepository.subunit" || true
+    fi
+    popd
+fi
+
+if [ "${COPY_LOGS}" = true ]; then
+    source ./tools/copy-logs.sh
+    recover_default_logs
+fi
+
+if [ "${FAILURE}" = true ]; then
+    exit 1
+fi
+
+exit $result
diff --git a/setup.cfg b/setup.cfg
new file mode 100644
index 000000000..520f3d443
--- /dev/null
+++ b/setup.cfg
@@ -0,0 +1,44 @@
+[metadata]
+name = packstack
+summary = A utility to install OpenStack
+description_file = README.rst
+long_description_content_type = text/x-rst
+author = RDO
+author_email = rdo-list@redhat.com
+home_page = http://www.rdoproject.org/
+python_requires = >=3.6
+classifier =
+    Environment :: OpenStack
+    Intended Audience :: Developers
+    Intended Audience :: Information Technology
+    Intended Audience :: System Administrators
+    License :: OSI Approved :: Apache Software License
+    Operating System :: POSIX :: Linux
+    Programming Language :: Python
+    Programming Language :: Python :: 3.6
+    Programming Language :: Python :: 3.9
+
+[files]
+packages =
+    packstack
+
+data_files =
+    share/packstack = docs/source/packstack.rst
+
+[global]
+setup-hooks =
+    pbr.hooks.setup_hook
+
+[egg_info]
+tag_build =
+tag_date = 0
+tag_svn_revision = 0
+
+[pbr]
+warnerrors = True
+autodoc_tree_index_modules = True
+
+[entry_points]
+console_scripts =
+    packstack = packstack.installer.run_setup:main
+
diff --git a/setup.py b/setup.py
index af7ca3058..2e8329785 100644
--- a/setup.py
+++ b/setup.py
@@ -1,97 +1,5 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
+import setuptools
 
-import os
-import shutil
-import subprocess
-import sys
-
-from setuptools import setup, find_packages, Command
-
-from packstack import version
-
-
-MODULES_DIR = os.environ.get('PACKSTACK_PUPPETDIR',
-                             '/usr/share/openstack-puppet/modules')
-MODULES_REPO = ('https://github.com/redhat-openstack/'
-                'openstack-puppet-modules.git')
-MODULES_BRANCH = 'master'
-
-
-class InstallModulesCommand(Command):
-    description = 'install Puppet modules required to run Packstack'
-    user_options = [
-        ('destination=', None, 'Directory where to install modules'),
-        ('branch=', None, 'Branch which should be used'),
-    ]
-
-    def initialize_options(self):
-        self.destination = None
-        self.branch = None
-        self.repo = MODULES_REPO
-
-    def finalize_options(self):
-        self.destination = self.destination or MODULES_DIR
-        self.branch = self.branch or MODULES_BRANCH
-
-    def run(self):
-        destination = self.destination
-        basedir = os.path.dirname(self.destination.rstrip(' /'))
-        repodir = os.path.basename(self.destination.rstrip(' /'))
-        repo = self.repo
-        branch = self.branch
-        # install third-party modules from openstack-puppet-modules repo
-        if not os.path.exists(self.destination):
-            try:
-                os.makedirs(basedir, 0755)
-            except OSError:
-                # base directory exists
-                pass
-            print 'Cloning %(repo)s to %(destination)s' % locals()
-            cmd = ('cd %(basedir)s; git clone %(repo)s %(repodir)s; '
-                   'cd %(repodir)s; git checkout %(branch)s; '
-                   'git submodule update --init' % locals())
-            proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE,
-                                    stderr=subprocess.PIPE)
-            out, err = proc.communicate()
-            if proc.returncode:
-                raise RuntimeError('Failed:\n%s' % err)
-        # install Packstack module
-        packstack_path = os.path.join(self.destination, 'packstack')
-        print 'Copying Packstack module to %(packstack_path)s' % locals()
-        source = os.path.join(os.path.dirname(__file__),
-                              'packstack/puppet/modules/packstack')
-        shutil.rmtree(packstack_path, ignore_errors=True)
-        shutil.copytree(source, packstack_path)
-
-
-# Utility function to read the README file.
-# Used for the long_description.  It's nice, because now 1) we have a top level
-# README file and 2) it's easier to type in the README file than to put a raw
-# string in below ...
-def read(fname):
-    return open(os.path.join(os.path.dirname(__file__), fname)).read()
-
-
-setup(
-    name="packstack",
-    version=version.version_string(),
-    author="Derek Higgins",
-    author_email="derekh@redhat.com",
-    description=("A utility to install openstack"),
-    license="ASL 2.0",
-    keywords="openstack",
-    url="https://github.com/stackforge/packstack",
-    packages=find_packages('.'),
-    include_package_data=True,
-    long_description=read('README'),
-    zip_safe=False,
-    install_requires=['netaddr'],
-    classifiers=[
-        "Development Status :: 3 - Alpha",
-        "Topic :: Utilities",
-        "License :: OSI Approved :: Apache Software License",
-    ],
-    scripts=["bin/packstack"],
-    cmdclass={'install_puppet_modules': InstallModulesCommand}
-)
+setuptools.setup(
+    setup_requires=['pbr>=1.8'],
+    pbr=True)
diff --git a/spec/openstack-packstack.spec b/spec/openstack-packstack.spec
deleted file mode 100644
index c01897c73..000000000
--- a/spec/openstack-packstack.spec
+++ /dev/null
@@ -1,81 +0,0 @@
-
-%global git_revno %GIT_REVNO%
-
-Name:           openstack-packstack
-Version:        2012.2.2
-#Release:       1%{?dist}
-Release:        0.1.dev%{git_revno}%{?dist}
-Summary:        Openstack Install Utility
-
-Group:          Applications/System
-License:        ASL 2.0
-URL:            https://github.com/fedora-openstack/packstack
-#Source0:        https://github.com/downloads/fedora-openstack/packstack/packstack-%{version}.tar.gz
-Source0:        https://github.com/downloads/fedora-openstack/packstack/packstack-%{version}dev%{git_revno}.tar.gz
-
-BuildArch:      noarch
-
-BuildRequires:  python2-devel
-BuildRequires:  python-setuptools
-%if 0%{?rhel}
-BuildRequires:  python-sphinx10
-%else
-BuildRequires:  python-sphinx
-%endif
-
-Requires:       openssh-clients
-
-%description
-Packstack is a utility that uses puppet modules to install openstack
-packstack can be used to deploy various parts of openstack on multiple
-pre installed servers over ssh. It does this be using puppet manifests to
-apply puppet labs modules (https://github.com/puppetlabs/)
-
-%prep
-#%setup -n packstack-%{version}
-%setup -n packstack-%{version}dev%{git_revno}
-
-# Sanitizing a lot of the files in the puppet modules, they come from seperate upstream projects
-find packstack/puppet/modules \( -name .fixtures.yml -o -name .gemfile -o -name ".travis.yml" -o -name .rspec \) -exec rm {} \;
-find packstack/puppet/modules \( -name "*.py" -o -name "*.rb" -o -name "*.pl" \) -exec sed -i '/^#!/{d;q}' {} \; -exec chmod -x {} \;
-find packstack/puppet/modules \( -name "*.sh" \) -exec sed -i 's/^#!.*/#!\/bin\/bash/g' {} \; -exec chmod +x {} \;
-find packstack/puppet/modules -name site.pp -size 0 -exec rm {} \;
-
-# Moving this data directory out temporarily as it causes setup.py to throw errors
-rm -rf %{_builddir}/puppet
-mv packstack/puppet %{_builddir}/puppet
-
-%build
-# puppet on fedora already has this module, using this one causes problems
-%if 0%{?fedora}
-    rm -rf %{_builddir}/puppet/modules/create_resources
-%endif
-
-%{__python} setup.py build
-
-cd docs
-%if 0%{?rhel}
-make man SPHINXBUILD=sphinx-1.0-build
-%else
-make man
-%endif
-
-%install
-%{__python} setup.py install --skip-build --root %{buildroot}
-mv %{_builddir}/puppet %{buildroot}/%{python_sitelib}/packstack/puppet
-
-mkdir -p %{buildroot}%{_mandir}/man1
-install -p -D -m 644 docs/_build/man/*.1 %{buildroot}%{_mandir}/man1/
-
-%files
-%doc LICENSE
-%{_bindir}/packstack
-%{python_sitelib}/packstack
-%{python_sitelib}/packstack-%{version}*.egg-info
-%{_mandir}/man1/packstack.1.gz
-
-%changelog
-
-* Thu Dec 06 2012 Derek Higgins <derekh@redhat.com>
-- Not keeping change log here, see downstream distributions for actual packaging
-
diff --git a/test-requirements.txt b/test-requirements.txt
new file mode 100644
index 000000000..fa9310cdb
--- /dev/null
+++ b/test-requirements.txt
@@ -0,0 +1,6 @@
+sphinx>=1.6.2  # BSD
+openstackdocstheme>=1.17.0  # Apache-2.0
+reno>=0.1.1 # Apache2
+stestr>=1.0.0 # Apache-2.0
+coverage
+hacking>=7.0.0,<7.1.0 # Apache-2.0
diff --git a/tests/installer/test_arch.py b/tests/installer/test_arch.py
new file mode 100644
index 000000000..67d179806
--- /dev/null
+++ b/tests/installer/test_arch.py
@@ -0,0 +1,45 @@
+# -*- coding: utf-8 -*-
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2017, Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+"""
+Test cases for packstack.installer.core.arch module.
+"""
+
+from unittest import mock
+from unittest import TestCase
+
+from packstack.installer.core import arch
+
+
+class ArchTestCase(TestCase):
+    def test_kernel_arch(self):
+        for (expected, _arch) in [('x86_64', 'x86_64'),
+                                  ('ppc64le', 'ppc64le')]:
+            with mock.patch('os.uname', return_value=('', '', '', '', _arch)):
+                self.assertEqual(expected, arch.kernel_arch())
+
+    def test_dib_arch(self):
+        for (expected, _arch) in [('amd64', 'x86_64'),
+                                  ('ppc64le', 'ppc64le')]:
+            with mock.patch('os.uname', return_value=('', '', '', '', _arch)):
+                self.assertEqual(expected, arch.dib_arch())
+
+    def test_cirros_arch(self):
+        for (expected, _arch) in [('x86_64', 'x86_64'),
+                                  ('powerpc', 'ppc64le')]:
+            with mock.patch('os.uname', return_value=('', '', '', '', _arch)):
+                self.assertEqual(expected, arch.cirros_arch())
diff --git a/tests/installer/test_drones.py b/tests/installer/test_drones.py
index 0b3b64f6b..0214f65ed 100644
--- a/tests/installer/test_drones.py
+++ b/tests/installer/test_drones.py
@@ -17,27 +17,18 @@
 
 import os
 import shutil
+import tarfile
 import tempfile
-import subprocess
 from unittest import TestCase
 
 from ..test_base import PackstackTestCaseMixin
-from packstack.installer.core.drones import *
-from packstack.installer import utils
+from packstack.installer.core import drones
 
 
 class SshTarballTransferMixinTestCase(PackstackTestCaseMixin, TestCase):
     def setUp(self):
         # Creating a temp directory that can be used by tests
         self.tempdir = tempfile.mkdtemp()
-
-    def tearDown(self):
-        # remove the temp directory
-        #shutil.rmtree(self.tempdir)
-        pass
-
-    def setUp(self):
-        self.tempdir = tempfile.mkdtemp()
         # prepare resource files
         res1path = os.path.join(self.tempdir, 'res1.txt')
         with open(res1path, 'w') as f:
@@ -57,7 +48,7 @@ def setUp(self):
         with open(rec2path, 'w') as f:
             f.write('recipe two')
         # prepare class
-        self.mixin = SshTarballTransferMixin()
+        self.mixin = drones.SshTarballTransferMixin()
         self.mixin.node = '127.0.0.1'
         self.mixin.resource_dir = os.path.join(self.tempdir, 'remote')
         self.mixin.recipe_dir = os.path.join(self.tempdir, 'remote',
@@ -72,6 +63,11 @@ def setUp(self):
                   self.mixin.local_tmpdir, self.mixin.remote_tmpdir):
             os.mkdir(i)
 
+    def tearDown(self):
+        # remove the temp directory
+        # shutil.rmtree(self.tempdir)
+        pass
+
     def test_tarball_packing(self):
         """
         Tests packing of resources and recipes
@@ -84,11 +80,10 @@ def test_tarball_packing(self):
             tarball = tarfile.open(pack_path)
             tarball.extractall(path=self.tempdir)
         # check content of files
-        for path, content in \
-                [('resources/res1.txt', 'resource one'),
-                 ('resources/resdir/res2.txt', 'resource two'),
-                 ('recipes/rec1.pp', 'recipe one'),
-                 ('recipes/rec2.pp', 'recipe two')]:
+        for path, content in [('resources/res1.txt', 'resource one'),
+                              ('resources/resdir/res2.txt', 'resource two'),
+                              ('recipes/rec1.pp', 'recipe one'),
+                              ('recipes/rec2.pp', 'recipe two')]:
             with open(os.path.join(self.tempdir, path)) as f:
                 fcont = f.read()
                 self.assertEqual(fcont, content)
@@ -128,7 +123,7 @@ def test_transfer(self):
     '''
 
 
-class FakeDroneObserver(DroneObserver):
+class FakeDroneObserver(drones.DroneObserver):
     def __init__(self, *args, **kwargs):
         super(FakeDroneObserver, self).__init__(*args, **kwargs)
         self.log = []
@@ -155,7 +150,7 @@ def finished(self, drone, recipe):
         self.log.append('finished:%s' % recipe)
 
 
-class FakeDrone(Drone):
+class FakeDrone(drones.Drone):
     def __init__(self, *args, **kwargs):
         super(FakeDrone, self).__init__(*args, **kwargs)
         self.log = []
diff --git a/tests/installer/test_processors.py b/tests/installer/test_processors.py
index 91c66a29f..6e68d9e36 100644
--- a/tests/installer/test_processors.py
+++ b/tests/installer/test_processors.py
@@ -16,27 +16,26 @@
 # under the License.
 
 import os
-import shutil
-import tempfile
 from unittest import TestCase
-from packstack.installer.processors import *
+
+from packstack.installer import processors
 
 from ..test_base import PackstackTestCaseMixin
 
 
 class ProcessorsTestCase(PackstackTestCaseMixin, TestCase):
     def test_process_host(self):
-        """Test packstack.installer.processors.process_host"""
-        proc_local = process_host('localhost',
-                                  process_args={'allow_localhost': True})
+        """Test packstack.installer.processors.process_host."""
+        proc_local = processors.process_host('localhost', 'HOSTNAME')
         self.assertIn(proc_local, ['127.0.0.1', '::1'])
 
     def test_process_ssh_key(self):
-        """Test packstack.installer.processors.process_ssh_key"""
-        path = process_ssh_key(os.path.join(self.tempdir, 'id_rsa'))
+        """Test packstack.installer.processors.process_ssh_key."""
+        path = processors.process_ssh_key(
+            os.path.join(self.tempdir, 'id_rsa'), 'SSH_KEY')
         # test if key was created
-        self.assertEquals(True, bool(path))
+        self.assertTrue(bool(path))
         # test if key exists
         # XXX: process_ssh_key does not create ssh key during test run
         #      ... not sure why, nevertheless it works in normal run
-        #self.assertEquals(True, os.path.isfile(path))
+        # self.assertEquals(True, os.path.isfile(path))
diff --git a/tests/installer/test_run_setup.py b/tests/installer/test_run_setup.py
index d104b1854..9e475f071 100644
--- a/tests/installer/test_run_setup.py
+++ b/tests/installer/test_run_setup.py
@@ -15,16 +15,21 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+import distro
 import os
 import shutil
 import subprocess
 import sys
 from unittest import TestCase
 
-from packstack.modules import ospluginutils, puppet
-from packstack.installer import run_setup, basedefs
+from packstack.modules import ospluginutils
+from packstack.modules import puppet
+from packstack.installer import basedefs
+from packstack.installer import run_setup
+from packstack.installer import validators
 
-from ..test_base import PackstackTestCaseMixin, FakePopen
+from ..test_base import FakePopen
+from ..test_base import PackstackTestCaseMixin
 
 
 def makefile(path, content):
@@ -34,13 +39,22 @@ def makefile(path, content):
 
 
 class CommandLineTestCase(PackstackTestCaseMixin, TestCase):
+
+    def setUp(self):
+        super(CommandLineTestCase, self).setUp()
+        self._old_validate_ssh = validators.validate_ssh
+        validators.validate_ssh = lambda param, options=None: None
+
+    def tearDown(self):
+        super(CommandLineTestCase, self).tearDown()
+        validators.validate_ssh = self._old_validate_ssh
+
     def test_running_install_hosts(self):
         """
         Test packstack.installer.run_setup.main
 
         This test effectivly runs all of the python code ran by
-        packstack --install-hosts=127.0.0.1 --os-swift-install=y \
-        --nagios-install=y
+        packstack --install-hosts=127.0.0.1 --os-swift-install=y
 
         It is a fairly wide net but boost code coverage of the packstack
         python code to about 85%, more finer grained tests should also be
@@ -62,6 +76,11 @@ def test_running_install_hosts(self):
                                      'openstack-icehouse',
                                      stdout='[openstack-icehouse]\nenabled=1')
 
+        FakePopen.register_as_script(
+            'facter -p',
+            stdout='operatingsystem => Fedora\noperatingsystemmajrelease => 21'
+        )
+
         # required by packstack.plugins.nova_300.gather_host_keys
         FakePopen.register('ssh-keyscan 127.0.0.1',
                            stdout='127.0.0.1 ssh-rsa hostkey-data')
@@ -83,7 +102,8 @@ def test_running_install_hosts(self):
         sys.argv = ['packstack', '--debug',
                     '--ssh-public-key=%s' % dummy_public_key,
                     '--install-hosts=127.0.0.1', '--os-swift-install=y',
-                    '--nagios-install=y', '--use-epel=y']
+                    '--ssl-cacert-selfsign=y', '--ssl-cert-dir=%s' %
+                    os.path.expanduser('~/')]
 
         # There is no puppet logfile to validate, so replace
         # ospluginutils.validate_puppet_logfile with a mock function
@@ -91,6 +111,10 @@ def test_running_install_hosts(self):
         puppet.validate_logfile = lambda a: None
         puppet.scan_logfile = lambda a: []
 
+        # mock distro.linux_distribution, it's does subprocess.check_output
+        # lsb_release -a
+        distro.linux_distribution = lambda: "CentOS"
+
         # If there is a error in a plugin sys.exit() gets called, this masks
         # the actual error that should be reported, so we replace it to
         # raise Exception, packstack logging gives a more infomrative error
@@ -107,5 +131,5 @@ def raise_(ex):
             sys.exit = orig_sys_exit
             try:
                 shutil.rmtree(basedefs.VAR_DIR)
-            except:
+            except Exception:
                 pass
diff --git a/tests/installer/test_sequences.py b/tests/installer/test_sequences.py
index 55c8b126c..fdc07c2c2 100644
--- a/tests/installer/test_sequences.py
+++ b/tests/installer/test_sequences.py
@@ -15,12 +15,12 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+import io
 import sys
-import StringIO
 from unittest import TestCase
 
 from packstack.installer import utils
-from packstack.installer.core.sequences import *
+from packstack.installer.core import sequences
 
 from ..test_base import PackstackTestCaseMixin
 
@@ -29,7 +29,7 @@ class StepTestCase(PackstackTestCaseMixin, TestCase):
     def setUp(self):
         super(StepTestCase, self).setUp()
         self._stdout = sys.stdout
-        sys.stdout = StringIO.StringIO()
+        sys.stdout = io.StringIO()
 
     def tearDown(self):
         super(StepTestCase, self).tearDown()
@@ -39,17 +39,17 @@ def test_run(self):
         """
         Test packstack.instaler.core.sequences.Step run.
         """
-        def func(config):
+        def func(config, messages):
             if 'test' not in config:
                 raise AssertionError('Missing config value.')
 
-        step = Step('test', func, title='Running test')
+        step = sequences.Step('test', func, title='Running test')
         step.run(config={'test': 'test'})
         contents = sys.stdout.getvalue()
 
         state = '[ %s ]\n' % utils.color_text('DONE', 'green')
-        if not contents.startswith('Running test') or \
-           not contents.endswith(state):
+        if (not contents.startswith('Running test') or
+                not contents.endswith(state)):
             raise AssertionError('Step run test failed: %s' % contents)
 
 
@@ -57,17 +57,17 @@ class SequenceTestCase(PackstackTestCaseMixin, TestCase):
     def setUp(self):
         super(SequenceTestCase, self).setUp()
         self._stdout = sys.stdout
-        sys.stdout = StringIO.StringIO()
+        sys.stdout = io.StringIO()
 
-        self.steps = [{'name': '1', 'function': lambda x: True,
+        self.steps = [{'name': '1', 'function': lambda x, y: True,
                        'title': 'Step 1'},
-                      {'name': '2', 'function': lambda x: True,
+                      {'name': '2', 'function': lambda x, y: True,
                        'title': 'Step 2'},
-                      {'name': '3', 'function': lambda x: True,
+                      {'name': '3', 'function': lambda x, y: True,
                        'title': 'Step 3'}]
 
-        self.seq = Sequence('test', self.steps, condition='test',
-                                                cond_match='test')
+        self.seq = sequences.Sequence('test', self.steps, condition='test',
+                                      cond_match='test')
 
     def tearDown(self):
         super(SequenceTestCase, self).tearDown()
diff --git a/tests/installer/test_setup_params.py b/tests/installer/test_setup_params.py
index f8ffaf139..032fdf95e 100644
--- a/tests/installer/test_setup_params.py
+++ b/tests/installer/test_setup_params.py
@@ -22,23 +22,23 @@
 from unittest import TestCase
 
 from ..test_base import PackstackTestCaseMixin
-from packstack.installer.core.parameters import *
+from packstack.installer.core import parameters
 
 
 class ParameterTestCase(PackstackTestCaseMixin, TestCase):
     def setUp(self):
         super(ParameterTestCase, self).setUp()
         self.data = {
-            "CMD_OPTION": "mysql-host",
+            "CMD_OPTION": "mariadb-host",
             "USAGE": ("The IP address of the server on which to "
-                      "install MySQL"),
-            "PROMPT": "Enter the IP address of the MySQL server",
+                      "install MariaDB"),
+            "PROMPT": "Enter the IP address of the MariaDB server",
             "OPTION_LIST": [],
             "VALIDATORS": [],
             "DEFAULT_VALUE": "127.0.0.1",
             "MASK_INPUT": False,
             "LOOSE_VALIDATION": True,
-            "CONF_NAME": "CONFIG_MYSQL_HOST",
+            "CONF_NAME": "CONFIG_MARIADB_HOST",
             "USE_DEFAULT": False,
             "NEED_CONFIRM": False,
             "CONDITION": False}
@@ -48,15 +48,15 @@ def test_parameter_init(self):
         Test packstack.installer.core.parameters.Parameter
         initialization
         """
-        param = Parameter(self.data)
-        for key, value in self.data.iteritems():
+        param = parameters.Parameter(self.data)
+        for key, value in self.data.items():
             self.assertEqual(getattr(param, key), value)
 
     def test_default_attribute(self):
         """
         Test packstack.installer.core.parameters.Parameter default value
         """
-        param = Parameter()
+        param = parameters.Parameter()
         self.assertIsNone(param.PROCESSORS)
 
 
@@ -64,23 +64,23 @@ class GroupTestCase(PackstackTestCaseMixin, TestCase):
     def setUp(self):
         super(GroupTestCase, self).setUp()
         self.attrs = {
-            "GROUP_NAME": "MYSQL",
-            "DESCRIPTION": "MySQL Config parameters",
+            "GROUP_NAME": "MARIADB",
+            "DESCRIPTION": "MariaDB Config parameters",
             "PRE_CONDITION": "y",
             "PRE_CONDITION_MATCH": "y",
             "POST_CONDITION": False,
             "POST_CONDITION_MATCH": False}
         self.params = [
-            {"CONF_NAME": "CONFIG_MYSQL_HOST", "PROMPT": "find_me"},
-            {"CONF_NAME": "CONFIG_MYSQL_USER"},
-            {"CONF_NAME": "CONFIG_MYSQL_PW"}]
+            {"CONF_NAME": "CONFIG_MARIADB_HOST", "PROMPT": "find_me"},
+            {"CONF_NAME": "CONFIG_MARIADB_USER"},
+            {"CONF_NAME": "CONFIG_MARIADB_PW"}]
 
     def test_group_init(self):
         """
         Test packstack.installer.core.parameters.Group initialization
         """
-        group = Group(attributes=self.attrs, parameters=self.params)
-        for key, value in self.attrs.iteritems():
+        group = parameters.Group(attributes=self.attrs, parameters=self.params)
+        for key, value in self.attrs.items():
             self.assertEqual(getattr(group, key), value)
         for param in self.params:
             self.assertIn(param['CONF_NAME'], group.parameters)
@@ -89,8 +89,8 @@ def test_search(self):
         """
         Test packstack.installer.core.parameters.Group search method
         """
-        group = Group(attributes=self.attrs, parameters=self.params)
+        group = parameters.Group(attributes=self.attrs, parameters=self.params)
         param_list = group.search('PROMPT', 'find_me')
         self.assertEqual(len(param_list), 1)
-        self.assertIsInstance(param_list[0], Parameter)
-        self.assertEqual(param_list[0].CONF_NAME, 'CONFIG_MYSQL_HOST')
+        self.assertIsInstance(param_list[0], parameters.Parameter)
+        self.assertEqual(param_list[0].CONF_NAME, 'CONFIG_MARIADB_HOST')
diff --git a/tests/installer/test_utils.py b/tests/installer/test_utils.py
index 9508018dd..e311fea94 100644
--- a/tests/installer/test_utils.py
+++ b/tests/installer/test_utils.py
@@ -23,8 +23,9 @@
 import tempfile
 from unittest import TestCase
 
-from ..test_base import PackstackTestCaseMixin, FakePopen
-from packstack.installer.utils import *
+from ..test_base import FakePopen
+from ..test_base import PackstackTestCaseMixin
+from packstack.installer import utils
 from packstack.installer.utils.strings import STR_MASK
 from packstack.installer.exceptions import ExecuteRuntimeError
 
@@ -44,18 +45,18 @@ def tearDown(self):
         shutil.rmtree(self.tempdir)
 
     def test_sorteddict(self):
-        """Test packstack.installer.utils.datastructures.SortedDict"""
-        sdict = SortedDict()
+        """Test packstack.installer.utils.datastructures.SortedDict."""
+        sdict = utils.SortedDict()
         sdict['1'] = 1
         sdict['2'] = 2
-        sdict.update(SortedDict([('3', 3), ('4', 4), ('5', 5)]))
+        sdict.update(utils.SortedDict([('3', 3), ('4', 4), ('5', 5)]))
         self.assertListEqual(sdict.keys(), ['1', '2', '3', '4', '5'])
         self.assertListEqual(sdict.values(), [1, 2, 3, 4, 5])
 
     def test_retry(self):
-        """Test packstack.installer.utils.decorators.retry"""
+        """Test packstack.installer.utils.decorators.retry."""
 
-        @retry(count=3, delay=0, retry_on=ValueError)
+        @utils.retry(count=3, delay=0, retry_on=ValueError)
         def test_sum():
             global cnt
             cnt += 1
@@ -72,45 +73,45 @@ def test_sum():
         self.assertRaises(ValueError, test_sum)
 
     def test_network(self):
-        """Test packstack.installer.utils.network functions"""
-        self.assertIn(host2ip('localhost', allow_localhost=True),
+        """Test packstack.installer.utils.network functions."""
+        self.assertIn(utils.host2ip('localhost', allow_localhost=True),
                       ['127.0.0.1', '::1'])
 
     def test_shell(self):
-        """Test packstack.installer.utils.shell functions"""
-        rc, out = execute(['echo', 'this is test'])
+        """Test packstack.installer.utils.shell functions."""
+        rc, out = utils.execute(['echo', 'this is test'])
         self.assertEqual(out.strip(), 'this is test')
-        rc, out = execute('echo "this is test"', use_shell=True)
+        rc, out = utils.execute('echo "this is test"', use_shell=True)
         self.assertEqual(out.strip(), 'this is test')
         try:
-            execute('echo "mask the password" && exit 1',
-                    use_shell=True, mask_list=['password'])
+            utils.execute('echo "mask the password" && exit 1',
+                          use_shell=True, mask_list=['password'])
             raise AssertionError('Masked execution failed.')
-        except ExecuteRuntimeError, ex:
+        except ExecuteRuntimeError as ex:
             should_be = ('Failed to execute command, stdout: mask the %s\n\n'
                          'stderr: ' % STR_MASK)
             self.assertEqual(str(ex), should_be)
 
-        script = ScriptRunner()
+        script = utils.ScriptRunner()
         script.append('echo "this is test"')
         rc, out = script.execute()
         self.assertEqual(out.strip(), 'this is test')
 
     def test_strings(self):
-        """Test packstack.installer.utils.strings functions"""
-        self.assertEqual(color_text('test text', 'red'),
-                        '\033[0;31mtest text\033[0m')
-        self.assertEqual(mask_string('test text', mask_list=['text']),
+        """Test packstack.installer.utils.strings functions."""
+        self.assertEqual(utils.color_text('test text', 'red'),
+                         '\033[0;31mtest text\033[0m')
+        self.assertEqual(utils.mask_string('test text', mask_list=['text']),
                          'test %s' % STR_MASK)
-        masked = mask_string("test '\\''text'\\''",
-                             mask_list=["'text'"],
-                             replace_list=[("'", "'\\''")])
+        masked = utils.mask_string("test '\\''text'\\''",
+                                   mask_list=["'text'"],
+                                   replace_list=[("'", "'\\''")])
         self.assertEqual(masked, 'test %s' % STR_MASK)
 
     def test_shortcuts(self):
-        """Test packstack.installer.utils.shortcuts functions"""
+        """Test packstack.installer.utils.shortcuts functions."""
         conf = {"A_HOST": "1.1.1.1", "B_HOSTS": "2.2.2.2,1.1.1.1",
                 "C_HOSTS": "3.3.3.3/vdc"}
-        hostlist = list(hosts(conf))
+        hostlist = list(utils.hosts(conf))
         hostlist.sort()
-        self.assertEquals(['1.1.1.1', '2.2.2.2', '3.3.3.3'], hostlist)
+        self.assertEqual(['1.1.1.1', '2.2.2.2', '3.3.3.3'], hostlist)
diff --git a/tests/installer/test_validators.py b/tests/installer/test_validators.py
index e81e59fa7..ca8d0007a 100644
--- a/tests/installer/test_validators.py
+++ b/tests/installer/test_validators.py
@@ -19,7 +19,8 @@
 import shutil
 import tempfile
 from unittest import TestCase
-from packstack.installer.validators import *
+from packstack.installer import exceptions
+from packstack.installer import validators
 
 from ..test_base import PackstackTestCaseMixin
 
@@ -34,65 +35,87 @@ def tearDown(self):
         shutil.rmtree(self.tempdir)
 
     def test_validate_integer(self):
-        """Test packstack.installer.validators.validate_integer"""
-        validate_integer('1')
-        self.assertRaises(ParamValidationError, validate_integer, 'test')
+        """Test validate_integer."""
+        validators.validate_integer('1')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_integer, 'test')
 
     def test_validate_regexp(self):
-        """Test packstack.installer.validators.validate_regexp"""
-        validate_regexp('Test_123', options=['\w'])
-        self.assertRaises(ParamValidationError, validate_regexp,
-                          '!#$%', options=['\w'])
+        """Test validate_regexp."""
+        validators.validate_regexp('Test_123', options=[r'\w'])
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_regexp, '!#$%', options=[r'\w'])
 
     def test_validate_port(self):
-        """Test packstack.installer.validators.validate_port"""
-        validate_port('666')
-        self.assertRaises(ParamValidationError, validate_port, 'test')
-        self.assertRaises(ParamValidationError, validate_port, '-3')
+        """Test validate_port."""
+        validators.validate_port('666')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_port, 'test')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_port, '-3')
 
     def test_validate_not_empty(self):
-        """Test packstack.installer.validators.validate_not_empty"""
-        validate_not_empty('test')
-        validate_not_empty(False)
-        self.assertRaises(ParamValidationError, validate_not_empty, '')
-        self.assertRaises(ParamValidationError, validate_not_empty, [])
-        self.assertRaises(ParamValidationError, validate_not_empty, {})
+        """Test validate_not_empty."""
+        validators.validate_not_empty('test')
+        validators.validate_not_empty(False)
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_not_empty, '')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_not_empty, [])
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_not_empty, {})
 
     def test_validate_options(self):
-        """Test packstack.installer.validators.validate_options"""
-        validate_options('a', options=['a', 'b'])
-        validate_options('b', options=['a', 'b'])
-        self.assertRaises(ParamValidationError, validate_options,
-                          'c', options=['a', 'b'])
+        """Test validate_options."""
+        validators.validate_options('a', options=['a', 'b'])
+        validators.validate_options('b', options=['a', 'b'])
+        self.assertRaises(
+            exceptions.ParamValidationError,
+            validators.validate_options, 'c', options=['a', 'b'])
 
     def test_validate_ip(self):
-        """Test packstack.installer.validators.validate_ip"""
-        validate_ip('127.0.0.1')
-        validate_ip('::1')
-        self.assertRaises(ParamValidationError, validate_ip, 'test')
+        """Test validate_ip."""
+        validators.validate_ip('127.0.0.1')
+        validators.validate_ip('::1')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_ip, 'test')
 
     def test_validate_file(self):
-        """Test packstack.installer.validators.validate_file"""
-        fname = os.path.join(self.tempdir, '.test_validate_file')
+        """Test validate_file."""
+        dname = os.path.join(self.tempdir, '.test_validate_file')
+        bad_name = os.path.join(self.tempdir, '.me_no/exists')
+        os.mkdir(dname)
+        validators.validate_writeable_directory(dname)
+        self.assertRaises(
+            exceptions.ParamValidationError,
+            validators.validate_writeable_directory, bad_name)
+
+    def test_validate_writeable_directory(self):
+        """Test validate_writeable_directory."""
+        fname = os.path.join(
+            self.tempdir, '.test_validate_writeable_directory')
         bad_name = os.path.join(self.tempdir, '.me_no_exists')
         with open(fname, 'w') as f:
             f.write('test')
-        validate_file(fname)
-        self.assertRaises(ParamValidationError, validate_file, bad_name)
+        validators.validate_file(fname)
+        self.assertRaises(
+            exceptions.ParamValidationError,
+            validators.validate_file, bad_name)
 
     def test_validate_ping(self):
-        """Test packstack.installer.validators.validate_ping"""
+        """Test validate_ping."""
         # ping to broadcast fails
-        self.assertRaises(ParamValidationError, validate_ping,
-                          '255.255.255.255')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_ping, '255.255.255.255')
 
     def test_validate_ssh(self):
-        """Test packstack.installer.validators.validate_ssh"""
+        """Test validate_ssh."""
         # ssh to broadcast fails
-        self.assertRaises(ParamValidationError, validate_ssh,
-                          '255.255.255.255')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_ssh, '255.255.255.255')
 
     def test_validate_float(self):
-        """Test packstack.installer.validators.validate_float"""
-        validate_float('5.3')
-        self.assertRaises(ParamValidationError, validate_float, 'test')
+        """Test validate_float."""
+        validators.validate_float('5.3')
+        self.assertRaises(exceptions.ParamValidationError,
+                          validators.validate_float, 'test')
diff --git a/tests/modules/test_ospluginutils.py b/tests/modules/test_ospluginutils.py
index 0b802ebc4..1691503e1 100644
--- a/tests/modules/test_ospluginutils.py
+++ b/tests/modules/test_ospluginutils.py
@@ -15,7 +15,6 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import os
 from unittest import TestCase
 
 from ..test_base import PackstackTestCaseMixin
@@ -28,4 +27,4 @@ def test_gethostlist(self):
                 "C_HOSTS": "3.3.3.3/vdc"}
         hosts = gethostlist(conf)
         hosts.sort()
-        self.assertEquals(['1.1.1.1', '2.2.2.2', '3.3.3.3'], hosts)
+        self.assertEqual(['1.1.1.1', '2.2.2.2', '3.3.3.3'], hosts)
diff --git a/tests/modules/test_puppet.py b/tests/modules/test_puppet.py
index c3ea9a0bc..825aa8f65 100644
--- a/tests/modules/test_puppet.py
+++ b/tests/modules/test_puppet.py
@@ -21,13 +21,13 @@
 from ..test_base import PackstackTestCaseMixin
 
 from packstack.installer.exceptions import PuppetError
-from packstack.modules.puppet import validate_logfile, scan_logfile
+from packstack.modules.puppet import validate_logfile
 
 
 class PuppetTestCase(PackstackTestCaseMixin, TestCase):
 
     def test_validate_logfile(self):
-        """Test packstack.modules.validate_logfile"""
+        """Test packstack.modules.validate_logfile."""
         filename = os.path.join(self.tempdir, "puppet.log")
         # test valid run
         with open(filename, "w") as fp:
diff --git a/tests/scenario-py3.sh b/tests/scenario-py3.sh
new file mode 100755
index 000000000..a7a594fa1
--- /dev/null
+++ b/tests/scenario-py3.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+CONTROLLER_NODE=${CONTROLLER_NODE:-}
+COMPUTE_NODE=${COMPUTE_NODE:-}
+
+if [ $(id -u) != 0 ]; then
+    SUDO='sudo'
+fi
+
+echo -e "Generating packstack config for:
+- keystone
+- glance (file backend)
+- nova
+- neutron (ovs+vxlan)
+- cinder (lvm+iscsi)
+- tempest (regex: 'smoke')"
+echo "tempest will run if packstack's installation completes successfully."
+echo
+
+if [ -z $COMPUTE_NODE ]; then
+  NODE_FLAGS="--allinone"
+else
+  NODE_FLAGS="--allinone --os-controller-host=$CONTROLLER_NODE --os-network-hosts=$CONTROLLER_NODE --os-compute-hosts=$COMPUTE_NODE"
+fi
+
+$SUDO packstack ${ADDITIONAL_ARGS} \
+          ${NODE_FLAGS} \
+          --cinder-volume-name="aVolume" \
+          --debug \
+          --service-workers=2 \
+          --default-password="packstack" \
+          --os-aodh-install=n \
+          --os-ceilometer-install=n \
+          --os-swift-install=n \
+          --os-manila-install=n \
+          --os-horizon-ssl=n \
+          --amqp-enable-ssl=n \
+          --glance-backend=file \
+          --nova-libvirt-virt-type=qemu \
+          --provision-image-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img" \
+          --provision-demo=y \
+          --provision-tempest=y \
+          --run-tempest=y \
+          --run-tempest-tests="smoke dashboard" || export FAILURE=true
diff --git a/tests/scenario000.sh b/tests/scenario000.sh
new file mode 100755
index 000000000..b19f71afc
--- /dev/null
+++ b/tests/scenario000.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+if [ $(id -u) != 0 ]; then
+    SUDO='sudo'
+fi
+
+$SUDO packstack ${ADDITIONAL_ARGS} \
+          --allinone \
+          --debug \
+          --os-debug-mode=y \
+          --service-workers=2 \
+          --default-password="packstack" || export FAILURE=true
diff --git a/tests/scenario001.sh b/tests/scenario001.sh
new file mode 100755
index 000000000..92b73a56a
--- /dev/null
+++ b/tests/scenario001.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+CONTROLLER_NODE=${CONTROLLER_NODE:-}
+COMPUTE_NODE=${COMPUTE_NODE:-}
+
+if [ $(id -u) != 0 ]; then
+    SUDO='sudo'
+fi
+
+echo -e "Generating packstack config for:
+- keystone
+- glance (file backend)
+- nova
+- neutron (ovs+vxlan)
+- cinder (lvm+iscsi)
+- manila
+- tempest (regex: 'smoke')"
+echo "tempest will run if packstack's installation completes successfully."
+echo
+
+if [ -z $COMPUTE_NODE ]; then
+  NODE_FLAGS="--allinone"
+else
+  NODE_FLAGS="--allinone --os-controller-host=$CONTROLLER_NODE --os-network-hosts=$CONTROLLER_NODE --os-compute-hosts=$COMPUTE_NODE"
+fi
+
+$SUDO packstack ${ADDITIONAL_ARGS} \
+          ${NODE_FLAGS} \
+          --cinder-volume-name="aVolume" \
+          --debug \
+          --os-debug-mode=y \
+          --service-workers=2 \
+          --default-password="packstack" \
+          --os-aodh-install=n \
+          --os-ceilometer-install=n \
+          --os-swift-install=n \
+          --os-manila-install=y \
+          --os-horizon-ssl=y \
+          --amqp-enable-ssl=y \
+          --glance-backend=file \
+          --nova-libvirt-virt-type=qemu \
+          --provision-image-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img" \
+          --provision-demo=y \
+          --provision-tempest=y \
+          --run-tempest=y \
+          --run-tempest-tests="smoke dashboard" \
+          --skip-tempest-tests="test_dashboard_basic_ops" || export FAILURE=true
diff --git a/tests/scenario002.sh b/tests/scenario002.sh
new file mode 100755
index 000000000..89d97c08a
--- /dev/null
+++ b/tests/scenario002.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+CONTROLLER_NODE=${CONTROLLER_NODE:-}
+COMPUTE_NODE=${COMPUTE_NODE:-}
+
+if [ $(id -u) != 0 ]; then
+    SUDO='sudo'
+fi
+
+echo -e "Generating packstack config for:
+- keystone
+- glance (swift backend)
+- nova
+- neutron (ovs+vxlan)
+- swift
+- trove
+- tempest (regex: 'smoke dashboard')"
+echo "tempest will run if packstack's installation completes successfully."
+echo
+
+if [ -z $COMPUTE_NODE ]; then
+  NODE_FLAGS="--allinone"
+else
+  NODE_FLAGS="--allinone --os-controller-host=$CONTROLLER_NODE --os-network-hosts=$CONTROLLER_NODE --os-compute-hosts=$COMPUTE_NODE"
+fi
+
+$SUDO packstack ${ADDITIONAL_ARGS} \
+          ${NODE_FLAGS} \
+          --debug \
+          --os-debug-mode=y \
+          --service-workers=2 \
+          --default-password="packstack" \
+          --os-aodh-install=n \
+          --os-ceilometer-install=n \
+          --os-cinder-install=n \
+          --os-horizon-install=n \
+          --glance-backend=swift \
+          --os-neutron-l2-agent=openvswitch \
+          --os-neutron-ml2-type-drivers="vxlan,flat" \
+          --os-neutron-ml2-tenant-network-types="vxlan" \
+          --os-neutron-vpnaas-install=n \
+          --os-trove-install=y \
+          --nova-libvirt-virt-type=qemu \
+          --provision-image-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img" \
+          --provision-demo=y \
+          --provision-tempest=y \
+          --run-tempest=y \
+          --run-tempest-tests="smoke" || export FAILURE=true
diff --git a/tests/scenario003.sh b/tests/scenario003.sh
new file mode 100755
index 000000000..fd6f61ca4
--- /dev/null
+++ b/tests/scenario003.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+CONTROLLER_NODE=${CONTROLLER_NODE:-}
+COMPUTE_NODE=${COMPUTE_NODE:-}
+
+if [ $(id -u) != 0 ]; then
+    SUDO='sudo'
+fi
+
+echo -e "Generating packstack config for:
+- keystone
+- glance (file backend)
+- nova
+- neutron (ovs+vxlan)
+- ceilometer
+- aodh
+- gnocchi
+- heat
+- magnum
+- tempest (regex: 'smoke TelemetryAlarming')"
+echo "tempest will run if packstack's installation completes successfully."
+echo
+
+if [ -z $COMPUTE_NODE ]; then
+  NODE_FLAGS="--allinone"
+else
+  NODE_FLAGS="--allinone --os-controller-host=$CONTROLLER_NODE --os-network-hosts=$CONTROLLER_NODE --os-compute-hosts=$COMPUTE_NODE"
+fi
+
+$SUDO packstack ${ADDITIONAL_ARGS} \
+          ${NODE_FLAGS} \
+          --debug \
+          --os-debug-mode=y \
+          --service-workers=2 \
+          --default-password="packstack" \
+          --os-swift-install=n \
+          --os-horizon-install=n \
+          --glance-backend=file \
+          --os-heat-install=y \
+          --os-magnum-install=y \
+          --nova-libvirt-virt-type=qemu \
+          --provision-image-url="/tmp/cirros/cirros-$CIRROS_VERSION-$CIRROS_ARCH-disk.img" \
+          --provision-demo=y \
+          --provision-tempest=y \
+          --run-tempest=y \
+          --run-tempest-tests="smoke TelemetryAlarming" || export FAILURE=true
diff --git a/tests/test_base.py b/tests/test_base.py
index 1045699eb..42cf5ea67 100644
--- a/tests/test_base.py
+++ b/tests/test_base.py
@@ -15,16 +15,11 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+import logging
 import shutil
-import tempfile
 import subprocess
-import logging
-import re
+import tempfile
 
-from packstack.installer.utils.shell import block_fmt
-from packstack.installer.exceptions import (ScriptRuntimeError,
-                                            NetworkError)
-from packstack.installer.utils.strings import mask_string
 
 LOG = logging.getLogger(__name__)
 
@@ -54,7 +49,8 @@ def register_as_script(cls, args, stdout='', stderr='', returncode=0):
         '''Register a fake script.'''
         if isinstance(args, list):
             args = '\n'.join(args)
-        prefix = "function t(){ exit $? ; } \n trap t ERR \n"
+
+        prefix = "function t(){ exit $? ; } \n trap t ERR \n "
         args = prefix + args
         cls.script_registry[args] = {'stdout': stdout,
                                      'stderr': stderr,
@@ -79,7 +75,7 @@ def _init_as_cmd(self, args, **kwargs):
         if args in self.cmd_registry:
             this = self.cmd_registry[args]
         else:
-            LOG.warn('call to unregistered command: %s', cmd)
+            LOG.warning('call to unregistered command: %s', cmd)
             this = {'stdout': '', 'stderr': '', 'returncode': 0}
 
         self.stdout = this['stdout']
@@ -91,10 +87,10 @@ def _init_as_script(self, args, **kwargs):
 
     def communicate(self, input=None):
         if self._is_script:
-            if input in self.script_registry:
-                this = self.script_registry[input]
+            if input.decode('utf-8') in self.script_registry:
+                this = self.script_registry[input.decode('utf-8')]
             else:
-                LOG.warn('call to unregistered script: %s', input)
+                LOG.warning('call to unregistered script: %s', input)
                 this = {'stdout': '', 'stderr': '', 'returncode': 0}
             self.stdout = this['stdout']
             self.stderr = this['stderr']
@@ -126,20 +122,18 @@ def assertItemsEqual(self, list1, list2, msg=None):
                        'Second has %s' % (f, s))
         self.assertEqual(f, s, msg=_msg)
 
-        _msg = msg or ('Given lists differ:\n%(list1)s'
-                       '\n%(list2)s' % locals())
+        _msg = msg or f'Given lists differ:\n{list1}\n{list2}'
         for i in list1:
             if i not in list2:
                 raise AssertionError(_msg)
 
     def assertListEqual(self, list1, list2, msg=None):
-        f, s = len(list1), len(list2)
+        f, s = len(list(list1)), len(list(list2))
         _msg = msg or ('Element counts were not equal. First has %s, '
                        'Second has %s' % (f, s))
         self.assertEqual(f, s, msg=_msg)
 
-        _msg = msg or ('Given lists differ:\n%(list1)s'
-                       '\n%(list2)s' % locals())
+        _msg = msg or f'Given lists differ:\n{list1}\n{list2}'
         for index, item in enumerate(list1):
             if item != list2[index]:
                 raise AssertionError(_msg)
diff --git a/tests/test_plugin_serverprep.py b/tests/test_plugin_serverprep.py
deleted file mode 100644
index 92c93e4b6..000000000
--- a/tests/test_plugin_serverprep.py
+++ /dev/null
@@ -1,60 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2013, Red Hat, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-import os
-from unittest import TestCase
-
-from test_base import PackstackTestCaseMixin
-from packstack.plugins import serverprep_949
-from packstack.installer.setup_controller import Controller
-
-serverprep_949.controller = Controller()
-
-
-class OSPluginUtilsTestCase(PackstackTestCaseMixin, TestCase):
-    def test_rhn_creds_quoted(self):
-        """Make sure RHN password is quoted"""
-
-        # On non-RHEL, the CONFIG_{RH,SATELLITE} options are never set,
-        # i.e. this test would always fail. Therefore, only run it on RHEL.
-        if not serverprep_949.is_rhel():
-            return
-
-        password = "dasd|'asda%><?"
-
-        serverprep_949.controller.CONF["CONFIG_KEYSTONE_HOST"] = "1.2.3.4"
-        serverprep_949.controller.CONF["CONFIG_USE_EPEL"] = "n"
-        serverprep_949.controller.CONF["CONFIG_REPO"] = ""
-        serverprep_949.controller.CONF["CONFIG_RH_USER"] = "testuser"
-        serverprep_949.controller.CONF["CONFIG_RH_PW"] = password
-        serverprep_949.controller.CONF["CONFIG_RH_BETA_REPO"] = "n"
-
-        serverprep_949.controller.CONF["CONFIG_SATELLITE_FLAGS"] = ""
-        serverprep_949.controller.CONF["CONFIG_SATELLITE_URL"] = ""
-        serverprep_949.controller.CONF["CONFIG_SATELLITE_USER"] = ""
-        serverprep_949.controller.CONF["CONFIG_SATELLITE_PW"] = ""
-        serverprep_949.controller.CONF["CONFIG_SATELLITE_CACERT"] = ""
-        serverprep_949.controller.CONF["CONFIG_SATELLITE_AKEY"] = ""
-        serverprep_949.controller.CONF["CONFIG_SATELLITE_PROFILE"] = ""
-        serverprep_949.controller.CONF["CONFIG_SATELLITE_PROXY"] = ""
-        serverprep_949.controller.CONF["CONFIG_SATELLITE_PROXY_USER"] = ""
-        serverprep_949.controller.CONF["CONFIG_SATELLITE_PROXY_PW"] = ""
-
-        serverprep_949.serverprep(serverprep_949.controller.CONF)
-
-        self.assertNotEqual(
-            self.fake_popen.data.find('--password="%s"' % password), -1
-        )
diff --git a/tools/copy-logs.sh b/tools/copy-logs.sh
new file mode 100755
index 000000000..2e362013b
--- /dev/null
+++ b/tools/copy-logs.sh
@@ -0,0 +1,163 @@
+#!/bin/bash
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+#
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+export PATH=$PATH:/usr/local/sbin:/usr/sbin
+
+# This script attempts to recover as much generic diagnostic logs as it can
+LOGROOT=${WORKSPACE:-/tmp}
+LOGDIR="${LOGROOT}/logs"
+DIAG_LOGDIR="${LOGDIR}/diag"
+CONF_LOGDIR="${LOGDIR}/etc"
+GIT_URL="https://opendev.org"
+PROJECTS_URL="${GIT_URL}/openstack/governance/raw/branch/master/reference/projects.yaml"
+
+if [ $(id -u) != 0 ]; then
+    SUDO='sudo'
+fi
+
+type -p dnf && export PKG_MGR=dnf || export PKG_MGR=yum
+
+$SUDO mkdir -p "${DIAG_LOGDIR}"
+$SUDO mkdir -p "${CONF_LOGDIR}"
+
+function get_diag_commands {
+    echo "Setting up list of diagnostic commands to run..."
+    commands=(
+        'df -h'
+        'dmesg -T'
+        'fdisk -l'
+        'lsmod'
+        'iptables -vnL'
+        'iptables -vnL -t nat'
+        'iptables -vnL -t mangle'
+        'ifconfig -a'
+        'ip addr show'
+        'ip netns'
+        'lsmod'
+        'timeout 15 lsof' # High potential of getting stuck
+        'lsof -Pni'
+        'netstat -ntlp'
+        'pstree -p'
+        'sysctl -a'
+        "$PKG_MGR repolist -v"
+        'rpm -qa'
+        'journalctl --no-pager'
+        'ulimit -n'
+        'dmidecode'
+    )
+
+    echo "Installing required RPM packages..."
+    $SUDO $PKG_MGR -y install coreutils curl file lsof net-tools psmisc
+
+    echo "Running diagnostic commands..."
+    for ((i = 0; i < ${#commands[@]}; i++)); do
+        # filenames have underscores instead of spaces or slashes
+        filename="$(echo "${commands[$i]}" |sed -e "s%[ \/]%_%g").txt"
+        # Run diagnostic commands but don't fail the whole thing if one command fails
+        $SUDO bash -c "${commands[$i]} 2>&1 > ${DIAG_LOGDIR}/${filename}" || true
+    done
+}
+
+function get_config_and_logs {
+    echo "Setting up and discovering directories and files to recover..."
+    # Paths we're interested in
+    paths=(
+        '/proc/cpuinfo'
+        '/proc/meminfo'
+        '/proc/mounts'
+        '/etc/os-release'
+        '/etc/sudoers'
+        '/etc/sudoers.d'
+        '/etc/hosts'
+        '/etc/pip.conf'
+        '/etc/libvirt'
+        '/var/log/libvirt'
+        '/etc/qemu'
+        '/etc/qemu-kvm'
+        '/etc/openvswitch'
+        '/var/log/openvswitch'
+        '/etc/openstack-dashboard'
+        '/etc/aodh' # aodh is nested under telemetry in governance
+        '/var/log/aodh'
+        '/etc/ceilometer' # ceilometer is nested under telemetry in governance
+        '/var/log/ceilometer'
+        '/etc/gnocchi' # gnocchi is nested under telemetry in governance
+        '/var/log/gnocchi'
+        '/etc/rabbitmq/'
+        '/var/log/rabbitmq'
+        '/etc/redis'
+        '/var/log/redis'
+        '/etc/my.cnf.d'
+        '/var/log/mariadb'
+        '/etc/httpd/conf.d/'
+        '/etc/yum.repos.d/'
+        '/var/log/httpd'
+        '/var/tmp/packstack/latest'
+        '/var/tmp/packstack/latest/testrepository.subunit' # So we're copying it
+        '/var/log/audit'                                   # to the root of
+        '/var/log/secure'                                  # /logs
+        '/var/log/messages'
+        '/var/log/dstat.log'
+        '/var/log/dnf.log'
+        '/var/log/dnf.rpm.log'
+        '/var/log/dnf.librepo.log'
+        '/etc/puppet/puppet.conf'
+        '/etc/puppet/hiera.yaml'
+    )
+
+    # Add discovered project directories from official governance
+    # Optimistic parsing.. find a better way
+    project_list=$(curl $PROJECTS_URL 2>&1 | egrep "^\S+:$" |cut -f1 -d :)
+    for project in $project_list; do
+        paths+=("/etc/${project}")
+        paths+=("/var/log/${project}")
+    done
+
+    echo "Recovering files and directories..."
+    # Send things to appropriate log directories if they exist
+    for ((i = 0; i < ${#paths[@]}; i++)); do
+        if [ -e ${paths[$i]} ]; then
+            if [[ "${paths[$i]}" =~ /proc/ ]]; then
+                $SUDO cp "${paths[$i]}" ${DIAG_LOGDIR}/
+            elif [[ "${paths[$i]}" =~ /var/ ]]; then
+                $SUDO cp -Lr "${paths[$i]}" ${LOGDIR}/
+            elif [[ "${paths[$i]}" =~ /etc/ ]]; then
+                $SUDO cp -Lr "${paths[$i]}" ${CONF_LOGDIR}/
+            fi
+        fi
+    done
+}
+
+function ensure_log_properties {
+    echo "Making sure directories and files have the right properties..."
+    FIND="${SUDO} find ${LOGDIR} ! -path '*.git/*'"
+    # Ensure files are readable by everyone
+    $FIND -type d -execdir $SUDO chmod 755 '{}' \;
+    $FIND -type f -execdir $SUDO chmod 644 '{}' \;
+
+    # Ensure files are in .txt when possible (web mime type)
+    for file in $($FIND -type f ! -name "*.txt"); do
+        if [[ "$(file --mime-type ${file} |cut -f2 -d :)" =~ text ]]; then
+            $SUDO mv ${file} ${file}.txt
+        fi
+    done
+}
+
+function recover_default_logs {
+    get_diag_commands
+    get_config_and_logs
+    ensure_log_properties
+}
diff --git a/tools/fix_disk_layout.sh b/tools/fix_disk_layout.sh
new file mode 100644
index 000000000..44f5a35df
--- /dev/null
+++ b/tools/fix_disk_layout.sh
@@ -0,0 +1,97 @@
+#!/bin/bash
+# Copyright (C) 2016 OpenStack Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+#
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Don't attempt to fix disk layout more than once
+[[ -e /etc/fixed_disk_layout ]] && return 0 || sudo touch /etc/fixed_disk_layout
+
+# Ensure virtual machines from different providers all have at least 8GB of
+# swap.
+# Use an ephemeral disk if there is one or create and use a swapfile.
+# Rackspace also doesn't have enough space on / for two devstack installs,
+# so we partition the disk and mount it on /opt, syncing the previous
+# contents of /opt over.
+SWAPSIZE=8192
+swapcurrent=$(( $(grep SwapTotal /proc/meminfo | awk '{ print $2; }') / 1024 ))
+
+if [[ $swapcurrent -lt $SWAPSIZE ]]; then
+    if [ -b /dev/xvde ]; then
+        DEV='/dev/xvde'
+    else
+        EPHEMERAL_DEV=$(blkid -L ephemeral0 || true)
+        if [ -n "$EPHEMERAL_DEV" -a -b "$EPHEMERAL_DEV" ]; then
+            DEV=$EPHEMERAL_DEV
+        fi
+    fi
+    if [ -n "$DEV" ]; then
+        # If an ephemeral device is available, use it
+        swap=${DEV}1
+        lvmvol=${DEV}2
+        optdev=${DEV}3
+        if mount | grep ${DEV} > /dev/null; then
+            echo "*** ${DEV} appears to already be mounted"
+            echo "*** ${DEV} unmounting and reformating"
+            sudo umount ${DEV}
+        fi
+        sudo parted ${DEV} --script -- mklabel msdos
+        sudo parted ${DEV} --script -- mkpart primary linux-swap 1 ${SWAPSIZE}
+        sudo parted ${DEV} --script -- mkpart primary ext2 8192 -1
+        sudo mkswap ${DEV}1
+        sudo mkfs.ext4 ${DEV}2
+        sudo swapon ${DEV}1
+        sudo mount ${DEV}2 /mnt
+        sudo find /opt/ -mindepth 1 -maxdepth 1 -exec mv {} /mnt/ \;
+        sudo umount /mnt
+        sudo mount ${DEV}2 /opt
+
+        # Sanity check
+        grep -q ${DEV}1 /proc/swaps || exit 1
+        grep -q ${DEV}2 /proc/mounts || exit 1
+    else
+        # If no ephemeral devices are available, use root filesystem
+        # Don't use sparse device to avoid wedging when disk space and
+        # memory are both unavailable.
+        swapfile='/root/swapfile'
+        swapdiff=$(( $SWAPSIZE - $swapcurrent ))
+
+        sudo dd if=/dev/zero of=${swapfile} bs=1M count=${swapdiff}
+        sudo chmod 600 ${swapfile}
+        sudo mkswap ${swapfile}
+        sudo swapon ${swapfile}
+
+        # Sanity check
+        grep -q ${swapfile} /proc/swaps || exit 1
+    fi
+fi
+
+# dump vm settings for reference (Ubuntu 12 era procps can get
+# confused with certain proc trigger nodes that are write-only and
+# return a EPERM; ignore this)
+sudo sysctl vm || true
+
+# ensure a standard level of swappiness.  Some platforms
+# (rax+centos7) come with swappiness of 0 (presumably because the
+# vm doesn't come with swap setup ... but we just did that above),
+# which depending on the kernel version can lead to the OOM killer
+# kicking in on some processes despite swap being available;
+# particularly things like mysql which have very high ratio of
+# anonymous-memory to file-backed mappings.
+
+# make sure reload of sysctl doesn't reset this
+sudo sed -i '/vm.swappiness/d' /etc/sysctl.conf
+# This sets swappiness low; we really don't want to be relying on
+# cloud I/O based swap during our runs
+sudo sysctl -w vm.swappiness=10
diff --git a/tools/test-requires b/tools/test-requires
deleted file mode 100644
index a6c88f59d..000000000
--- a/tools/test-requires
+++ /dev/null
@@ -1,2 +0,0 @@
-nose
-coverage
diff --git a/tox.ini b/tox.ini
index 2b2916823..188ad6379 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,29 +1,47 @@
 [tox]
-envlist = py26,py27,pep8
+minversion = 3.18.0
+envlist = py39,py312,pep8,releasenotes,docs
+skipsdist = False
 
 [testenv]
+usedevelop = True
 setenv = VIRTUAL_ENV={envdir}
          LANG=en_US.UTF-8
          LANGUAGE=en_US:en
          LC_ALL=C
+deps =
+  -c{env:UPPER_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+  -r{toxinidir}/test-requirements.txt
+  -r{toxinidir}/requirements.txt
 
-deps = -r{toxinidir}/tools/pip-requires
-       -r{toxinidir}/tools/test-requires
-commands = nosetests {posargs}
+allowlist_externals = /usr/bin/find
+commands = /usr/bin/find . -type f -name "*.pyc" -delete
+           stestr run {posargs}
 
 [tox:jenkins]
 sitepackages = True
-downloadcache = ~/cache/pip
 
 [testenv:pep8]
-deps=pep8==1.2
-commands = pep8 --exclude=*.pyc --repeat --show-source \
-           packstack/modules tests setup.py packstack/installer/utils \
-           packstack/installer/processors.py
-
+commands = flake8
 
 [testenv:cover]
 setenv = NOSE_WITH_COVERAGE=1
 
 [testenv:venv]
 commands = {posargs}
+
+[testenv:docs]
+commands = sphinx-build -a -E -W -d docs/build/doctrees -b html docs/source docs/build/html
+
+[testenv:releasenotes]
+deps = -r{toxinidir}/test-requirements.txt
+commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
+
+[flake8]
+# H803 skipped on purpose per list discussion.
+# E123, E125 skipped as they are invalid PEP-8.
+#
+# All other checks should be enabled in the future.
+ignore = E123,E125,E501,H404,H405,H305,H306,H307,W504
+show-source = True
+exclude=.venv,.git,.tox,.eggs