diff --git a/Puppetfile b/Puppetfile
index 1b6a7987b..7c4d747c6 100644
--- a/Puppetfile
+++ b/Puppetfile
@@ -7,11 +7,11 @@ mod 'aviator',
   :git => 'https://github.com/aimonb/puppet_aviator.git'
 
 mod 'ceilometer',
-  :commit => 'f17b3442402529281bdca9b2f70697e04bcfe216',
+  :commit => '05926aaaba5f733f7be1f3e57b59db3ee1385db3',
   :git => 'https://github.com/openstack/puppet-ceilometer.git'
 
 mod 'ceph',
-  :commit => 'b6ab15b47c81d7694fdcfd75d8f2e0a0481ca40c',
+  :commit => '71fccdf944a2b0721a972a8a86f97703cabd586e',
   :git => 'https://github.com/stackforge/puppet-ceph.git'
 
 mod 'certmonger',
@@ -19,7 +19,7 @@ mod 'certmonger',
   :git => 'https://github.com/rcritten/puppet-certmonger.git'
 
 mod 'cinder',
-  :commit => '15fd1a81b047342e71bfe939cf059eb4fd143e4d',
+  :commit => '330dda3c4106ffef318d330f4de303b631196581',
   :git => 'https://github.com/openstack/puppet-cinder.git'
 
 mod 'common',
@@ -43,7 +43,7 @@ mod 'galera',
   :git => 'https://github.com/redhat-openstack/puppet-galera.git'
 
 mod 'glance',
-  :commit => '0bb7577f7e4189495a148ca91f4f92c118e499e7',
+  :commit => 'c2d8e72f594b0caab0ace8c17d59717a3dd13385',
   :git => 'https://github.com/openstack/puppet-glance.git'
 
 mod 'gluster',
@@ -51,7 +51,7 @@ mod 'gluster',
   :git => 'https://github.com/purpleidea/puppet-gluster.git'
 
 mod 'gnocchi',
-  :commit => '388ace2495661ff909b45c00471a121b5f2d18e3',
+  :commit => '02692807d218210a27a4043e27b3aa0ac38e8b28',
   :git => 'https://github.com/openstack/puppet-gnocchi.git'
 
 mod 'haproxy',
@@ -59,11 +59,11 @@ mod 'haproxy',
   :git => 'https://github.com/puppetlabs/puppetlabs-haproxy.git'
 
 mod 'heat',
-  :commit => '8e742b8d09e3bded06e9529ccd5e7f38e527ab5d',
+  :commit => '3ced80f2eb6fc8a0694e8586c212d1a3ec5a3bdc',
   :git => 'https://github.com/openstack/puppet-heat.git'
 
 mod 'horizon',
-  :commit => '6e11fbf346560dab461964e53bcb1c817707abc5',
+  :commit => '79e373bebc010c25410a684437ae41b60e8eefc8',
   :git => 'https://github.com/openstack/puppet-horizon.git'
 
 mod 'inifile',
@@ -75,7 +75,7 @@ mod 'ipa',
   :git => 'https://github.com/xbezdick/puppet-ipa-1.git'
 
 mod 'ironic',
-  :commit => '886a9c0aa2c8ac6167e2d95a60c55bbd6977f82b',
+  :commit => '88c228cca9d74072a5e944acf0063418b9bdfe4e',
   :git => 'https://github.com/openstack/puppet-ironic.git'
 
 mod 'keepalived',
@@ -83,11 +83,15 @@ mod 'keepalived',
   :git => 'https://github.com/Unyonsys/puppet-module-keepalived.git'
 
 mod 'keystone',
-  :commit => 'e0e87604b8199c0ac0d443999153f88fb7797a9c',
+  :commit => '6dbef6298478b5a8799c9dadd8d0b4b7edbcdd74',
   :git => 'https://github.com/openstack/puppet-keystone.git'
 
+mod 'kmod',
+  :commit => 'ea03df0eff7b7e5faccb9c4e386d451301468f04',
+  :git => 'https://github.com/camptocamp/puppet-kmod.git'
+
 mod 'manila',
-  :commit => 'ff018bdef812bacfe512663c1cc0b92c7d1f26b2',
+  :commit => 'b94391158dc7c392986db9b0eb63562dde411ea1',
   :git => 'https://github.com/openstack/puppet-manila.git'
 
 mod 'memcached',
@@ -111,7 +115,7 @@ mod 'mysql',
   :git => 'https://github.com/puppetlabs/puppetlabs-mysql.git'
 
 mod 'n1k_vsm',
-  :commit => 'ed391d3d9bdcccef3e2de3b0da98e654237d99a5',
+  :commit => '8266fb6dd504bc6ab310644728b076a6de996cbd',
   :git => 'https://github.com/stackforge/puppet-n1k-vsm.git'
 
 mod 'nagios',
@@ -119,11 +123,11 @@ mod 'nagios',
   :git => 'https://github.com/gildub/puppet-nagios-openstack.git'
 
 mod 'neutron',
-  :commit => '36b463c003f94fe23c3d9eff207bbf5005ee470c',
+  :commit => 'c683ca5fc31111b7b0569cc71e9b959e62d21c4b',
   :git => 'https://github.com/openstack/puppet-neutron.git'
 
 mod 'nova',
-  :commit => 'cb2d487fb9baf2c1902182973e29982b5389e769',
+  :commit => 'ea1eddfaa04a3c44d9b6863bb4a87c89b91f3305',
   :git => 'https://github.com/openstack/puppet-nova.git'
 
 mod 'nssdb',
@@ -135,15 +139,15 @@ mod 'ntp',
   :git => 'https://github.com/puppetlabs/puppetlabs-ntp'
 
 mod 'openstack_extras',
-  :commit => 'ab8ddaff93e06d7fdbfb2c61ffe9113562dd82ad',
+  :commit => '2d08ba975b65c613fbdc08812cbf30e7d6c9d6e4',
   :git => 'https://github.com/openstack/puppet-openstack_extras.git'
 
 mod 'openstacklib',
-  :commit => '78ef674e0e6bc73b3a0af7833025dc9786eaeaeb',
+  :commit => 'fcfffcf47069119805e44cc712739ba0c1e4603d',
   :git => 'https://github.com/openstack/puppet-openstacklib.git'
 
 mod 'pacemaker',
-  :commit => '1fa8e5591ab606a7be3bae32df088f6cec26d3c0',
+  :commit => 'e9a8f0d048c1bbc86a4bb1ee81417da3afe6673e',
   :git => 'https://github.com/redhat-openstack/puppet-pacemaker.git'
 
 mod 'puppet',
@@ -155,7 +159,7 @@ mod 'qpid',
   :git => 'https://github.com/dprince/puppet-qpid'
 
 mod 'rabbitmq',
-  :commit => '1cdf6568473a0a45fb0b06b21b0c9a82c398bf08',
+  :commit => 'aa3ec5e061f619f4340a9c6ef1465f2f6a673cb4',
   :git => 'https://github.com/puppetlabs/puppetlabs-rabbitmq.git'
 
 mod 'redis',
@@ -171,7 +175,7 @@ mod 'rsync',
   :git => 'https://github.com/puppetlabs/puppetlabs-rsync.git'
 
 mod 'sahara',
-  :commit => '56d9a841bff7389d1128d40dad4a319988d547f1',
+  :commit => '6e79d710a97d7c43aea766bbfa8c4d782a7c2049',
   :git => 'https://github.com/openstack/puppet-sahara.git'
 
 mod 'snmp',
@@ -191,7 +195,7 @@ mod 'stdlib',
   :git => 'https://github.com/puppetlabs/puppetlabs-stdlib.git'
 
 mod 'swift',
-  :commit => '275fb9b111bbb30148e762afc0798aa891091cf2',
+  :commit => 'd736e6a00e8ff1e4f05c8fbc9535908fc2112587',
   :git => 'https://github.com/openstack/puppet-swift.git'
 
 mod 'sysctl',
@@ -199,7 +203,7 @@ mod 'sysctl',
   :git => 'https://github.com/puppetlabs/puppetlabs-sysctl.git'
 
 mod 'tempest',
-  :commit => 'ab9601ff339f6acb40901291133c03cf1b45d5ee',
+  :commit => '4cc2ad2e827e1117d79dbab1bc91283428ffdc78',
   :git => 'https://github.com/openstack/puppet-tempest.git'
 
 mod 'timezone',
@@ -207,15 +211,15 @@ mod 'timezone',
   :git => 'https://github.com/saz/puppet-timezone.git'
 
 mod 'tripleo',
-  :commit => '717eb39ca7295e128ab99694ea3a7ae658b9528f',
+  :commit => 'a003b3d97ebe8bd470717c419434851d60669bf7',
   :git => 'https://github.com/openstack/puppet-tripleo.git'
 
 mod 'trove',
-  :commit => '2636a384f67c2ac1513ac709f3ae4525668ccb62',
+  :commit => '1c5d6895c86fdb99501c72ef999864268bb7a389',
   :git => 'https://github.com/openstack/puppet-trove'
 
 mod 'tuskar',
-  :commit => '85a3991330f36903cd66a6e12512b54ab758ec41',
+  :commit => '09e2ced9be2cdf5d94dd6310e9df3a3155ab549b',
   :git => 'https://github.com/openstack/puppet-tuskar.git'
 
 mod 'vcsrepo',
@@ -227,7 +231,7 @@ mod 'vlan',
   :git => 'https://github.com/derekhiggins/puppet-vlan.git'
 
 mod 'vswitch',
-  :commit => 'e73073a120d833958d22925a1badbc1ccdc0f15a',
+  :commit => '5992d41a238c93bcf6bd6989c23d3c7577c48b69',
   :git => 'https://github.com/openstack/puppet-vswitch.git'
 
 mod 'xinetd',
diff --git a/ceilometer/CHANGELOG.md b/ceilometer/CHANGELOG.md
index d5913be17..e29904bed 100644
--- a/ceilometer/CHANGELOG.md
+++ b/ceilometer/CHANGELOG.md
@@ -1,3 +1,32 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+This is a backwards-incompatible major release for OpenStack Kilo.
+
+####Backwards-incompatible changes
+- Move rabbit/kombu settings to oslo_messaging_rabbit section
+
+####Features
+- Puppet 4.x support
+- make crontab for expirer optional
+- Refactorise Keystone resources management
+- db: Added postgresql backend using openstacklib helper
+- Implement Ceilometer-API as a WSGI process support
+- Add support for ceilometer-polling agent
+- Add support for identity_uri
+- Tag all Ceilometer packages
+- Add udp_address/udp_port parameters for collector.
+- Deprecate old public, internal and admin parameters
+
+####Bugfixes
+- Ensure python-mysqldb is installed before MySQL db_sync
+- Fix dependency on nova-common package
+
+####Maintenance
+- Acceptance tests with Beaker
+- Fix spec tests for RSpec 3.x and Puppet 4.x
+
+
 ##2015-06-17 - 5.1.0
 ###Summary
 
diff --git a/ceilometer/README.md b/ceilometer/README.md
index 7bd699a77..56155b2f9 100644
--- a/ceilometer/README.md
+++ b/ceilometer/README.md
@@ -1,7 +1,7 @@
 Ceilometer
 ==========
 
-5.1.0 - 2014.2 - Juno
+6.0.0 - 2015.1 - Kilo
 
 #### Table of Contents
 
diff --git a/ceilometer/manifests/agent/auth.pp b/ceilometer/manifests/agent/auth.pp
index 2b6f536e2..47f04026a 100644
--- a/ceilometer/manifests/agent/auth.pp
+++ b/ceilometer/manifests/agent/auth.pp
@@ -29,14 +29,20 @@
 #  [*auth_cacert*]
 #    Certificate chain for SSL validation. Optional; Defaults to 'None'
 #
+#  [*auth_endpoint_type*]
+#    Type of endpoint in Identity service catalog to use for
+#    communication with OpenStack services.
+#    Optional. Defaults to undef.
+#
 class ceilometer::agent::auth (
   $auth_password,
-  $auth_url         = 'http://localhost:5000/v2.0',
-  $auth_region      = 'RegionOne',
-  $auth_user        = 'ceilometer',
-  $auth_tenant_name = 'services',
-  $auth_tenant_id   = '',
-  $auth_cacert      = undef,
+  $auth_url           = 'http://localhost:5000/v2.0',
+  $auth_region        = 'RegionOne',
+  $auth_user          = 'ceilometer',
+  $auth_tenant_name   = 'services',
+  $auth_tenant_id     = '',
+  $auth_cacert        = undef,
+  $auth_endpoint_type = undef,
 ) {
 
   if ! $auth_cacert {
@@ -59,4 +65,10 @@
     }
   }
 
+  if $auth_endpoint_type {
+    ceilometer_config {
+      'service_credentials/os_endpoint_type' : value => $auth_endpoint_type;
+    }
+  }
+
 }
diff --git a/ceilometer/manifests/api.pp b/ceilometer/manifests/api.pp
index 66d71d38b..9bcb67937 100644
--- a/ceilometer/manifests/api.pp
+++ b/ceilometer/manifests/api.pp
@@ -64,6 +64,15 @@
 #    (optional) ensure state for package.
 #    Defaults to 'present'
 #
+# [*service_name*]
+#   (optional) Name of the service that will be providing the
+#   server functionality of ceilometer-api.
+#   If the value is 'httpd', this means ceilometer-api will be a web
+#   service, and you must use another class to configure that
+#   web service. For example, use class { 'ceilometer::wsgi::apache'...}
+#   to make keystone be a web app using apache mod_wsgi.
+#   Defaults to '$::ceilometer::params::api_service_name'
+#
 class ceilometer::api (
   $manage_service             = true,
   $enabled                    = true,
@@ -75,23 +84,24 @@
   $keystone_identity_uri      = false,
   $host                       = '0.0.0.0',
   $port                       = '8777',
+  $service_name               = $::ceilometer::params::api_service_name,
   # DEPRECATED PARAMETERS
   $keystone_host              = '127.0.0.1',
   $keystone_port              = '35357',
   $keystone_auth_admin_prefix = false,
   $keystone_protocol          = 'http',
-) {
+) inherits ceilometer::params {
 
   include ::ceilometer::params
   include ::ceilometer::policy
 
   validate_string($keystone_password)
 
-  Ceilometer_config<||> ~> Service['ceilometer-api']
-  Class['ceilometer::policy'] ~> Service['ceilometer-api']
+  Ceilometer_config<||> ~> Service[$service_name]
+  Class['ceilometer::policy'] ~> Service[$service_name]
 
   Package['ceilometer-api'] -> Ceilometer_config<||>
-  Package['ceilometer-api'] -> Service['ceilometer-api']
+  Package['ceilometer-api'] -> Service[$service_name]
   Package['ceilometer-api'] -> Class['ceilometer::policy']
   package { 'ceilometer-api':
     ensure => $package_ensure,
@@ -106,16 +116,30 @@
       $service_ensure = 'stopped'
     }
   }
-
-  Package['ceilometer-common'] -> Service['ceilometer-api']
-  service { 'ceilometer-api':
-    ensure     => $service_ensure,
-    name       => $::ceilometer::params::api_service_name,
-    enable     => $enabled,
-    hasstatus  => true,
-    hasrestart => true,
-    require    => Class['ceilometer::db'],
-    subscribe  => Exec['ceilometer-dbsync']
+  Package['ceilometer-common'] -> Service[$service_name]
+
+  if $service_name == $::ceilometer::params::api_service_name {
+    service { 'ceilometer-api':
+      ensure     => $service_ensure,
+      name       => $::ceilometer::params::api_service_name,
+      enable     => $enabled,
+      hasstatus  => true,
+      hasrestart => true,
+      require    => Class['ceilometer::db'],
+      subscribe  => Exec['ceilometer-dbsync'],
+      tag        => 'ceilometer-service',
+    }
+  } elsif $service_name == 'httpd' {
+    include ::apache::params
+    service { 'ceilometer-api':
+      ensure => 'stopped',
+      name   => $::ceilometer::params::api_service_name,
+      enable => false,
+      tag    => 'ceilometer-service',
+    }
+    Class['ceilometer::db'] -> Service[$service_name]
+  } else {
+    fail('Invalid service_name. Either keystone/openstack-ceilometer-api for running as a standalone service, or httpd for being run by a httpd server')
   }
 
   ceilometer_config {
diff --git a/ceilometer/manifests/init.pp b/ceilometer/manifests/init.pp
index 577e3533f..3769f3ce9 100644
--- a/ceilometer/manifests/init.pp
+++ b/ceilometer/manifests/init.pp
@@ -41,6 +41,22 @@
 #    password to connect to the rabbit_server. Optional. Defaults to empty.
 #  [*rabbit_virtual_host*]
 #    virtualhost to use. Optional. Defaults to '/'
+#
+# [*rabbit_heartbeat_timeout_threshold*]
+#   (optional) Number of seconds after which the RabbitMQ broker is considered
+#   down if the heartbeat keepalive fails.  Any value >0 enables heartbeats.
+#   Heartbeating helps to ensure the TCP connection to RabbitMQ isn't silently
+#   closed, resulting in missed or lost messages from the queue.
+#   (Requires kombu >= 3.0.7 and amqp >= 1.4.0)
+#   Defaults to 0
+#
+# [*rabbit_heartbeat_rate*]
+#   (optional) How often during the rabbit_heartbeat_timeout_threshold period to
+#   check the heartbeat on RabbitMQ connection.  (i.e. rabbit_heartbeat_rate=2
+#   when rabbit_heartbeat_timeout_threshold=60, the heartbeat will be checked
+#   every 30 seconds.
+#   Defaults to 2
+#
 #  [*rabbit_use_ssl*]
 #    (optional) Connect over SSL for RabbitMQ
 #    Defaults to false
@@ -75,39 +91,41 @@
 # (optional) various QPID options
 #
 class ceilometer(
-  $metering_secret     = false,
-  $notification_topics = ['notifications'],
-  $package_ensure      = 'present',
-  $debug               = false,
-  $log_dir             = '/var/log/ceilometer',
-  $verbose             = false,
-  $use_syslog          = false,
-  $log_facility        = 'LOG_USER',
-  $rpc_backend         = 'ceilometer.openstack.common.rpc.impl_kombu',
-  $rabbit_host         = '127.0.0.1',
-  $rabbit_port         = 5672,
-  $rabbit_hosts        = undef,
-  $rabbit_userid       = 'guest',
-  $rabbit_password     = '',
-  $rabbit_virtual_host = '/',
-  $rabbit_use_ssl      = false,
-  $kombu_ssl_ca_certs  = undef,
-  $kombu_ssl_certfile  = undef,
-  $kombu_ssl_keyfile   = undef,
-  $kombu_ssl_version   = 'TLSv1',
-  $qpid_hostname = 'localhost',
-  $qpid_port = 5672,
-  $qpid_username = 'guest',
-  $qpid_password = 'guest',
-  $qpid_heartbeat = 60,
-  $qpid_protocol = 'tcp',
-  $qpid_tcp_nodelay = true,
-  $qpid_reconnect = true,
-  $qpid_reconnect_timeout = 0,
-  $qpid_reconnect_limit = 0,
-  $qpid_reconnect_interval_min = 0,
-  $qpid_reconnect_interval_max = 0,
-  $qpid_reconnect_interval = 0
+  $metering_secret                    = false,
+  $notification_topics                = ['notifications'],
+  $package_ensure                     = 'present',
+  $debug                              = false,
+  $log_dir                            = '/var/log/ceilometer',
+  $verbose                            = false,
+  $use_syslog                         = false,
+  $log_facility                       = 'LOG_USER',
+  $rpc_backend                        = 'ceilometer.openstack.common.rpc.impl_kombu',
+  $rabbit_host                        = '127.0.0.1',
+  $rabbit_port                        = 5672,
+  $rabbit_hosts                       = undef,
+  $rabbit_userid                      = 'guest',
+  $rabbit_password                    = '',
+  $rabbit_virtual_host                = '/',
+  $rabbit_heartbeat_timeout_threshold = 0,
+  $rabbit_heartbeat_rate              = 2,
+  $rabbit_use_ssl                     = false,
+  $kombu_ssl_ca_certs                 = undef,
+  $kombu_ssl_certfile                 = undef,
+  $kombu_ssl_keyfile                  = undef,
+  $kombu_ssl_version                  = 'TLSv1',
+  $qpid_hostname                      = 'localhost',
+  $qpid_port                          = 5672,
+  $qpid_username                      = 'guest',
+  $qpid_password                      = 'guest',
+  $qpid_heartbeat                     = 60,
+  $qpid_protocol                      = 'tcp',
+  $qpid_tcp_nodelay                   = true,
+  $qpid_reconnect                     = true,
+  $qpid_reconnect_timeout             = 0,
+  $qpid_reconnect_limit               = 0,
+  $qpid_reconnect_interval_min        = 0,
+  $qpid_reconnect_interval_max        = 0,
+  $qpid_reconnect_interval            = 0,
 ) {
 
   validate_string($metering_secret)
@@ -187,10 +205,12 @@
       }
 
       ceilometer_config {
-        'oslo_messaging_rabbit/rabbit_userid'          : value => $rabbit_userid;
-        'oslo_messaging_rabbit/rabbit_password'        : value => $rabbit_password, secret => true;
-        'oslo_messaging_rabbit/rabbit_virtual_host'    : value => $rabbit_virtual_host;
-        'oslo_messaging_rabbit/rabbit_use_ssl'         : value => $rabbit_use_ssl;
+        'oslo_messaging_rabbit/rabbit_userid':                value => $rabbit_userid;
+        'oslo_messaging_rabbit/rabbit_password':              value => $rabbit_password, secret => true;
+        'oslo_messaging_rabbit/rabbit_virtual_host':          value => $rabbit_virtual_host;
+        'oslo_messaging_rabbit/rabbit_use_ssl':               value => $rabbit_use_ssl;
+        'oslo_messaging_rabbit/heartbeat_timeout_threshold':  value => $rabbit_heartbeat_timeout_threshold;
+        'oslo_messaging_rabbit/heartbeat_rate':               value => $rabbit_heartbeat_rate;
       }
 
       if $rabbit_use_ssl {
diff --git a/ceilometer/manifests/params.pp b/ceilometer/manifests/params.pp
index 524c2f902..a1923230b 100644
--- a/ceilometer/manifests/params.pp
+++ b/ceilometer/manifests/params.pp
@@ -68,7 +68,7 @@
         }
       }
       $ceilometer_wsgi_script_path    = '/usr/lib/cgi-bin/ceilometer'
-      $ceilometer_wsgi_script_source  = '/usr/share/ceilometer/app.wsgi'
+      $ceilometer_wsgi_script_source  = '/usr/lib/python2.7/dist-packages/ceilometer/api/app.wsgi'
     }
     default: {
       fail("Unsupported osfamily: ${::osfamily} operatingsystem: \
diff --git a/ceilometer/metadata.json b/ceilometer/metadata.json
index 0b32dd6bb..c7d82fc99 100644
--- a/ceilometer/metadata.json
+++ b/ceilometer/metadata.json
@@ -1,6 +1,6 @@
 {
-  "name": "stackforge-ceilometer",
-  "version": "5.1.0",
+  "name": "openstack-ceilometer",
+  "version": "6.0.0",
   "author": "eNovance and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Ceilometer",
   "license": "Apache-2.0",
@@ -33,8 +33,8 @@
   "dependencies": [
     { "name": "puppetlabs/apache", "version_requirement": ">=1.0.0 <2.0.0" },
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
-    { "name": "stackforge/keystone", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/keystone", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
-    { "name": "stackforge/openstacklib", "version_requirement": ">=5.0.0 <6.0.0" }
+    { "name": "openstack/openstacklib", "version_requirement": ">=6.0.0 <7.0.0" }
   ]
 }
diff --git a/ceilometer/spec/acceptance/ceilometer_wsgi_apache_spec.rb b/ceilometer/spec/acceptance/ceilometer_wsgi_apache_spec.rb
new file mode 100644
index 000000000..d731de218
--- /dev/null
+++ b/ceilometer/spec/acceptance/ceilometer_wsgi_apache_spec.rb
@@ -0,0 +1,133 @@
+require 'spec_helper_acceptance'
+
+describe 'ceilometer with mysql' do
+
+  context 'default parameters' do
+
+    it 'should work with no errors' do
+      pp= <<-EOS
+      Exec { logoutput => 'on_failure' }
+
+      # Common resources
+      case $::osfamily {
+        'Debian': {
+          include ::apt
+          class { '::openstack_extras::repo::debian::ubuntu':
+            release         => 'kilo',
+            package_require => true,
+          }
+          $package_provider = 'apt'
+        }
+        'RedHat': {
+          class { '::openstack_extras::repo::redhat::redhat':
+            release => 'kilo',
+          }
+          package { 'openstack-selinux': ensure => 'latest' }
+          $package_provider = 'yum'
+        }
+        default: {
+          fail("Unsupported osfamily (${::osfamily})")
+        }
+      }
+
+      class { '::mysql::server': }
+
+      class { '::rabbitmq':
+        delete_guest_user => true,
+        package_provider  => $package_provider,
+      }
+
+      rabbitmq_vhost { '/':
+        provider => 'rabbitmqctl',
+        require  => Class['rabbitmq'],
+      }
+
+      rabbitmq_user { 'ceilometer':
+        admin    => true,
+        password => 'an_even_bigger_secret',
+        provider => 'rabbitmqctl',
+        require  => Class['rabbitmq'],
+      }
+
+      rabbitmq_user_permissions { 'ceilometer@/':
+        configure_permission => '.*',
+        write_permission     => '.*',
+        read_permission      => '.*',
+        provider             => 'rabbitmqctl',
+        require              => Class['rabbitmq'],
+      }
+
+
+      # Keystone resources, needed by Ceilometer to run
+      class { '::keystone::db::mysql':
+        password => 'keystone',
+      }
+      class { '::keystone':
+        verbose             => true,
+        debug               => true,
+        database_connection => 'mysql://keystone:keystone@127.0.0.1/keystone',
+        admin_token         => 'admin_token',
+        enabled             => true,
+      }
+      class { '::keystone::roles::admin':
+        email    => 'test@example.tld',
+        password => 'a_big_secret',
+      }
+      class { '::keystone::endpoint':
+        public_url => "https://${::fqdn}:5000/",
+        admin_url  => "https://${::fqdn}:35357/",
+      }
+
+      # Ceilometer resources
+      class { '::ceilometer':
+        metering_secret     => 'secrete',
+        rabbit_userid       => 'ceilometer',
+        rabbit_password     => 'an_even_bigger_secret',
+        rabbit_host         => '127.0.0.1',
+      }
+      # Until https://review.openstack.org/177593 is merged:
+      Package<| title == 'python-mysqldb' |> -> Class['ceilometer::db']
+      class { '::ceilometer::db::mysql':
+        password => 'a_big_secret',
+      }
+      class { '::ceilometer::db':
+        database_connection => 'mysql://ceilometer:a_big_secret@127.0.0.1/ceilometer?charset=utf8',
+      }
+      class { '::ceilometer::keystone::auth':
+        password => 'a_big_secret',
+      }
+      class { '::ceilometer::client': }
+      class { '::ceilometer::collector': }
+      class { '::ceilometer::expirer': }
+      class { '::ceilometer::alarm::evaluator': }
+      class { '::ceilometer::alarm::notifier': }
+      class { '::ceilometer::agent::central': }
+      class { '::ceilometer::agent::notification': }
+      class { '::ceilometer::api':
+        enabled               => true,
+        keystone_password     => 'a_big_secret',
+        keystone_identity_uri => 'http://127.0.0.1:35357/',
+        service_name          => 'httpd',
+      }
+      include ::apache
+      class { '::ceilometer::wsgi::apache':
+        ssl => false,
+      }
+      EOS
+
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe port(8777) do
+      it { is_expected.to be_listening }
+    end
+
+    describe cron do
+      it { is_expected.to have_entry('1 0 * * * ceilometer-expirer').with_user('ceilometer') }
+    end
+
+  end
+end
diff --git a/ceilometer/spec/classes/ceilometer_agent_auth_spec.rb b/ceilometer/spec/classes/ceilometer_agent_auth_spec.rb
index f72459315..fd1908cd7 100644
--- a/ceilometer/spec/classes/ceilometer_agent_auth_spec.rb
+++ b/ceilometer/spec/classes/ceilometer_agent_auth_spec.rb
@@ -30,9 +30,13 @@
 
     context 'when overriding parameters' do
       before do
-        params.merge!(:auth_cacert => '/tmp/dummy.pem')
+        params.merge!(
+          :auth_cacert        => '/tmp/dummy.pem',
+          :auth_endpoint_type => 'internalURL',
+        )
       end
       it { is_expected.to contain_ceilometer_config('service_credentials/os_cacert').with_value(params[:auth_cacert]) }
+      it { is_expected.to contain_ceilometer_config('service_credentials/os_endpoint_type').with_value(params[:auth_endpoint_type]) }
     end
 
   end
diff --git a/ceilometer/spec/classes/ceilometer_api_spec.rb b/ceilometer/spec/classes/ceilometer_api_spec.rb
index e54eea1a9..6ada5b8be 100644
--- a/ceilometer/spec/classes/ceilometer_api_spec.rb
+++ b/ceilometer/spec/classes/ceilometer_api_spec.rb
@@ -3,7 +3,8 @@
 describe 'ceilometer::api' do
 
   let :pre_condition do
-    "class { 'ceilometer': metering_secret => 's3cr3t' }"
+    "class { 'ceilometer': metering_secret => 's3cr3t' }
+     include ::ceilometer::db"
   end
 
   let :params do
@@ -113,11 +114,51 @@
         )
       end
     end
+
+    context 'when running ceilometer-api in wsgi' do
+      before do
+        params.merge!({ :service_name   => 'httpd' })
+      end
+
+      let :pre_condition do
+        "include ::apache
+         include ::ceilometer::db
+         class { 'ceilometer': metering_secret => 's3cr3t' }"
+      end
+
+      it 'configures ceilometer-api service with Apache' do
+        is_expected.to contain_service('ceilometer-api').with(
+          :ensure     => 'stopped',
+          :name       => platform_params[:api_service_name],
+          :enable     => false,
+          :tag        => 'ceilometer-service',
+        )
+      end
+    end
+
+    context 'when service_name is not valid' do
+      before do
+        params.merge!({ :service_name   => 'foobar' })
+      end
+
+      let :pre_condition do
+        "include ::apache
+         include ::ceilometer::db
+         class { 'ceilometer': metering_secret => 's3cr3t' }"
+      end
+
+      it_raises 'a Puppet::Error', /Invalid service_name/
+    end
   end
 
   context 'on Debian platforms' do
     let :facts do
-      { :osfamily => 'Debian' }
+      { :osfamily               => 'Debian',
+        :operatingsystem        => 'Debian',
+        :operatingsystemrelease => '8.0',
+        :concat_basedir         => '/var/lib/puppet/concat',
+        :fqdn                   => 'some.host.tld',
+        :processorcount         => 2 }
     end
 
     let :platform_params do
@@ -130,7 +171,12 @@
 
   context 'on RedHat platforms' do
     let :facts do
-      { :osfamily => 'RedHat' }
+      { :osfamily               => 'RedHat',
+        :operatingsystem        => 'RedHat',
+        :operatingsystemrelease => '7.1',
+        :fqdn                   => 'some.host.tld',
+        :concat_basedir         => '/var/lib/puppet/concat',
+        :processorcount         => 2 }
     end
 
     let :platform_params do
diff --git a/ceilometer/spec/classes/ceilometer_init_spec.rb b/ceilometer/spec/classes/ceilometer_init_spec.rb
index 536a30614..594fbb09e 100644
--- a/ceilometer/spec/classes/ceilometer_init_spec.rb
+++ b/ceilometer/spec/classes/ceilometer_init_spec.rb
@@ -39,6 +39,7 @@
       it_configures 'a ceilometer base installation'
       it_configures 'rabbit with SSL support'
       it_configures 'rabbit without HA support (with backward compatibility)'
+      it_configures 'rabbit with connection heartbeats'
     end
 
     context 'with rabbit_hosts parameter' do
@@ -178,6 +179,8 @@
       is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_password').with_value( params[:rabbit_password] )
       is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_password').with_value( params[:rabbit_password] ).with_secret(true)
       is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_virtual_host').with_value( params[:rabbit_virtual_host] )
+      is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('0')
+      is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/heartbeat_rate').with_value('2')
     end
 
     it { is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_host').with_value( params[:rabbit_host] ) }
@@ -194,6 +197,8 @@
       is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_password').with_value( params[:rabbit_password] )
       is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_password').with_value( params[:rabbit_password] ).with_secret(true)
       is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_virtual_host').with_value( params[:rabbit_virtual_host] )
+      is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('0')
+      is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/heartbeat_rate').with_value('2')
     end
 
     it { is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_host').with_ensure('absent') }
@@ -210,6 +215,8 @@
       is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_password').with_value( params[:rabbit_password] )
       is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_password').with_value( params[:rabbit_password] ).with_secret(true)
       is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_virtual_host').with_value( params[:rabbit_virtual_host] )
+      is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('0')
+      is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/heartbeat_rate').with_value('2')
     end
 
     it { is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_host').with_ensure('absent') }
@@ -219,6 +226,18 @@
 
   end
 
+  shared_examples_for 'rabbit with connection heartbeats' do
+    context "with heartbeat configuration" do
+      before { params.merge!(
+        :rabbit_heartbeat_timeout_threshold => '60',
+        :rabbit_heartbeat_rate              => '10'
+      ) }
+
+      it { is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('60') }
+      it { is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/heartbeat_rate').with_value('10') }
+    end
+  end
+
   shared_examples_for 'rabbit with SSL support' do
     context "with default parameters" do
       it { is_expected.to contain_ceilometer_config('oslo_messaging_rabbit/rabbit_use_ssl').with_value('false') }
diff --git a/ceilometer/spec/classes/ceilometer_wsgi_apache_spec.rb b/ceilometer/spec/classes/ceilometer_wsgi_apache_spec.rb
index b7c689900..ad4c07654 100644
--- a/ceilometer/spec/classes/ceilometer_wsgi_apache_spec.rb
+++ b/ceilometer/spec/classes/ceilometer_wsgi_apache_spec.rb
@@ -119,7 +119,7 @@
         :httpd_service_name => 'apache2',
         :httpd_ports_file   => '/etc/apache2/ports.conf',
         :wsgi_script_path   => '/usr/lib/cgi-bin/ceilometer',
-        :wsgi_script_source => '/usr/share/ceilometer/app.wsgi'
+        :wsgi_script_source => '/usr/lib/python2.7/dist-packages/ceilometer/api/app.wsgi'
       }
     end
 
diff --git a/ceilometer/spec/spec_helper_acceptance.rb b/ceilometer/spec/spec_helper_acceptance.rb
index 429e807c4..6031cb8d4 100644
--- a/ceilometer/spec/spec_helper_acceptance.rb
+++ b/ceilometer/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git -b stable/kilo clone https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/ceph/.fixtures.yml b/ceph/.fixtures.yml
index 9428e1cf0..0448cc0ae 100644
--- a/ceph/.fixtures.yml
+++ b/ceph/.fixtures.yml
@@ -7,10 +7,10 @@ fixtures:
     'inifile': 'git://github.com/puppetlabs/puppetlabs-inifile'
     'apache':
       repo: 'git://github.com/puppetlabs/puppetlabs-apache'
-      ref: '1.0.1'
+      ref: '1.4.1'
     'concat':
       repo: 'git://github.com/puppetlabs/puppetlabs-concat'
-      ref: '1.1.0'
+      ref: '1.2.1'
 
   symlinks:
     'ceph': "#{source_dir}"
diff --git a/ceph/Gemfile b/ceph/Gemfile
index 0511f9d06..e3e4a8158 100644
--- a/ceph/Gemfile
+++ b/ceph/Gemfile
@@ -2,8 +2,8 @@ source 'https://rubygems.org'
 
 group :development, :test do
   gem 'puppetlabs_spec_helper', :require => false
-  gem 'rspec-puppet', '~> 2.0.0', :require => false
-  gem 'beaker-rspec', '~> 2.2.4', :require => false
+  gem 'rspec-puppet', '~> 2.1.0', :require => false
+  gem 'beaker-rspec', :require => false
   gem 'puppet-lint-param-docs'
   gem 'metadata-json-lint'
   gem 'puppet-lint-absolute_classname-check'
diff --git a/ceph/Gemfile-rspec-system b/ceph/Gemfile-rspec-system
index cce2000a1..1927be5de 100644
--- a/ceph/Gemfile-rspec-system
+++ b/ceph/Gemfile-rspec-system
@@ -3,7 +3,7 @@ source 'https://rubygems.org'
 
 group :development, :test do
   gem 'puppetlabs_spec_helper', :require => false
-  gem 'rspec-puppet', '~> 2.0.0', :require => false
+  gem 'rspec-puppet', '~> 2.1.0', :require => false
   gem 'metadata-json-lint'
   gem 'puppet-lint-param-docs'
   gem 'puppet-lint-absolute_classname-check'
diff --git a/ceph/Puppetfile b/ceph/Puppetfile
index 65400b5f6..f84861ad4 100644
--- a/ceph/Puppetfile
+++ b/ceph/Puppetfile
@@ -17,8 +17,8 @@ mod 'bodepd/scenario_node_terminus',
 
 mod 'puppetlabs/apache',
   :git => 'git://github.com/puppetlabs/puppetlabs-apache',
-  :ref => '1.0.1'
+  :ref => '1.4.1'
 
 mod 'puppetlabs/concat',
   :git => 'git://github.com/puppetlabs/puppetlabs-concat',
-  :ref => '1.1.x'
+  :ref => '1.2.1'
diff --git a/ceph/README.md b/ceph/README.md
index f3ae2179c..bdd0b03b2 100644
--- a/ceph/README.md
+++ b/ceph/README.md
@@ -128,10 +128,12 @@ The RS_SET environment variable contains the resource set of linux
 distribution configurations for which integration tests are going
 to be run. Available values are
 
-* two-ubuntu-server-1204-x64
-* ubuntu-server-1204-x64
-* two-centos-66-x64
-* centos-66-x64
+* two-ubuntu-server-12042-x64
+* one-ubuntu-server-12042-x64
+* two-centos-65-x64
+* one-centos-65-x64
+* two-centos-70-x64
+* one-centos-70-x64
 
 The default is
 
diff --git a/ceph/manifests/init.pp b/ceph/manifests/init.pp
index 170d53e76..ffd5a7d12 100644
--- a/ceph/manifests/init.pp
+++ b/ceph/manifests/init.pp
@@ -68,6 +68,9 @@
 #   individually through ceph::mon.
 #   Optional. String like e.g. 'a, b, c'.
 #
+# [*ms_bind_ipv6*] Enables Ceph daemons to bind to IPv6 addresses.
+#   Optional. Boolean. Default provided by Ceph.
+#
 # [*require_signatures*] If Ceph requires signatures on all
 #   message traffic (client<->cluster and between cluster daemons).
 #   Optional. Boolean. Default provided by Ceph.
@@ -103,6 +106,7 @@
   $mon_osd_nearfull_ratio     = undef,
   $mon_initial_members        = undef,
   $mon_host                   = undef,
+  $ms_bind_ipv6               = undef,
   $require_signatures         = undef,
   $cluster_require_signatures = undef,
   $service_require_signatures = undef,
@@ -133,6 +137,7 @@
       'global/mon_osd_nearfull_ratio':      value => $mon_osd_nearfull_ratio;
       'global/mon_initial_members':         value => $mon_initial_members;
       'global/mon_host':                    value => $mon_host;
+      'global/ms_bind_ipv6':                value => $ms_bind_ipv6;
       'global/require_signatures':          value => $require_signatures;
       'global/cluster_require_signatures':  value => $cluster_require_signatures;
       'global/service_require_signatures':  value => $service_require_signatures;
diff --git a/ceph/manifests/profile/base.pp b/ceph/manifests/profile/base.pp
index 12d60f07f..8f9d5cf49 100644
--- a/ceph/manifests/profile/base.pp
+++ b/ceph/manifests/profile/base.pp
@@ -39,6 +39,7 @@
     osd_pool_default_min_size => $ceph::profile::params::osd_pool_default_min_size,
     mon_initial_members       => $ceph::profile::params::mon_initial_members,
     mon_host                  => $ceph::profile::params::mon_host,
+    ms_bind_ipv6              => $ceph::profile::params::ms_bind_ipv6,
     cluster_network           => $ceph::profile::params::cluster_network,
     public_network            => $ceph::profile::params::public_network,
   }
diff --git a/ceph/manifests/profile/params.pp b/ceph/manifests/profile/params.pp
index 6a11b494d..c79efe234 100644
--- a/ceph/manifests/profile/params.pp
+++ b/ceph/manifests/profile/params.pp
@@ -38,6 +38,9 @@
 #   individually through ceph::mon.
 #   Optional. String like e.g. 'a, b, c'.
 #
+# [*ms_bind_ipv6*] Enables Ceph daemons to bind to IPv6 addresses.
+#   Optional. Boolean. Default provided by Ceph.
+#
 # [*osd_pool_default_pg_num*] The default number of PGs per pool.
 #   Optional. Integer. Default provided by Ceph.
 #
@@ -95,6 +98,7 @@
   $authentication_type = undef,
   $mon_initial_members = undef,
   $mon_host = undef,
+  $ms_bind_ipv6 = undef,
   $osd_pool_default_pg_num = undef,
   $osd_pool_default_pgp_num = undef,
   $osd_pool_default_size = undef,
diff --git a/ceph/manifests/repo.pp b/ceph/manifests/repo.pp
index 45662b0d7..c01c2ebb7 100644
--- a/ceph/manifests/repo.pp
+++ b/ceph/manifests/repo.pp
@@ -2,6 +2,7 @@
 #   Copyright (C) 2013 Cloudwatt <libre.licensing@cloudwatt.com>
 #   Copyright (C) 2014 Nine Internet Solutions AG
 #   Copyright (C) 2014 Catalyst IT Limited
+#   Copyright (C) 2015 Red Hat
 #
 #   Licensed under the Apache License, Version 2.0 (the "License");
 #   you may not use this file except in compliance with the License.
@@ -21,6 +22,7 @@
 # Author: Andrew Woodward <awoodward@mirantis.com>
 # Author: David Gurtner <aldavud@crimson.ch>
 # Author: Ricardo Rocha <ricardo@catalyst.net.nz>
+# Author: Emilien Macchi <emilien@redhat.com>
 #
 # == Class: ceph::repo
 #
@@ -53,7 +55,7 @@
       apt::key { 'ceph':
         ensure     => $ensure,
         key        => '17ED316D',
-        key_source => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
+        key_source => 'http://git.ceph.com/?p=ceph.git;a=blob_plain;f=keys/release.asc',
       }
 
       apt::source { 'ceph':
@@ -98,17 +100,34 @@
 
     'RedHat': {
       $enabled = $ensure ? { 'present' => '1', 'absent' => '0', default => absent, }
-      yumrepo { 'ext-epel-6.8':
+
+      if ((($::operatingsystem == 'RedHat' or $::operatingsystem == 'CentOS') and (versioncmp($::operatingsystemmajrelease, '7') < 0)) or ($::operatingsystem == 'Fedora' and (versioncmp($::operatingsystemmajrelease, '19') < 0))) {
+        $el = '6'
+      } else {
+        $el = '7'
+      }
+
+      if ($::operatingsystem == 'CentOS') {
+        file_line { 'exclude base':
+          ensure => $ensure,
+          path   => '/etc/yum.repos.d/CentOS-Base.repo',
+          after  => '^\[base\]$',
+          line   => 'exclude=python-ceph-compat python-rbd python-rados python-cephfs',
+        } -> Package<| tag == 'ceph' |>
+      }
+
+      yumrepo { "ext-epel-${el}":
         # puppet versions prior to 3.5 do not support ensure, use enabled instead
         enabled    => $enabled,
-        descr      => 'External EPEL 6.8',
-        name       => 'ext-epel-6.8',
+        descr      => "External EPEL ${el}",
+        name       => "ext-epel-${el}",
         baseurl    => absent,
         gpgcheck   => '0',
         gpgkey     => absent,
-        mirrorlist => 'http://mirrors.fedoraproject.org/metalink?repo=epel-6&arch=$basearch',
+        mirrorlist => "http://mirrors.fedoraproject.org/metalink?repo=epel-${el}&arch=\$basearch",
         priority   => '20', # prefer ceph repos over EPEL
         tag        => 'ceph',
+        exclude    => 'python-ceph-compat python-rbd python-rados python-cephfs',
       }
 
       yumrepo { 'ext-ceph':
@@ -116,7 +135,7 @@
         enabled    => $enabled,
         descr      => "External Ceph ${release}",
         name       => "ext-ceph-${release}",
-        baseurl    => "http://ceph.com/rpm-${release}/el6/\$basearch",
+        baseurl    => "http://ceph.com/rpm-${release}/el${el}/\$basearch",
         gpgcheck   => '1',
         gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
         mirrorlist => absent,
@@ -129,7 +148,7 @@
         enabled    => $enabled,
         descr      => 'External Ceph noarch',
         name       => "ext-ceph-${release}-noarch",
-        baseurl    => "http://ceph.com/rpm-${release}/el6/noarch",
+        baseurl    => "http://ceph.com/rpm-${release}/el${el}/noarch",
         gpgcheck   => '1',
         gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
         mirrorlist => absent,
@@ -137,7 +156,7 @@
         tag        => 'ceph',
       }
 
-      if $extras {
+      if $extras and $el == '6' {
 
         yumrepo { 'ext-ceph-extras':
           enabled    => $enabled,
@@ -159,7 +178,7 @@
           enabled    => $enabled,
           descr      => 'FastCGI basearch packages for Ceph',
           name       => 'ext-ceph-fastcgi',
-          baseurl    => 'http://gitbuilder.ceph.com/mod_fastcgi-rpm-rhel6-x86_64-basic/ref/master',
+          baseurl    => "http://gitbuilder.ceph.com/mod_fastcgi-rpm-rhel${el}-x86_64-basic/ref/master",
           gpgcheck   => '1',
           gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/autobuild.asc',
           mirrorlist => absent,
diff --git a/ceph/manifests/rgw.pp b/ceph/manifests/rgw.pp
index 727b93972..7fad377ab 100644
--- a/ceph/manifests/rgw.pp
+++ b/ceph/manifests/rgw.pp
@@ -24,7 +24,7 @@
 #
 # === Parameters:
 #
-# [*pgk_cephrgw*] Package name for the ceph radosgw.
+# [*pkg_radosgw*] Package name for the ceph radosgw.
 #   Optional. Default is osfamily dependent (check ceph::params).
 #
 # [*rgw_data*] The path where the radosgw data should be stored.
diff --git a/ceph/metadata.json b/ceph/metadata.json
index 989784120..8fee7ef4b 100644
--- a/ceph/metadata.json
+++ b/ceph/metadata.json
@@ -32,8 +32,8 @@
   "description": "Installs and configures Ceph.",
   "dependencies": [
     { "name": "puppetlabs/apt", "version_requirement": ">=1.4.0 <2.0.0" },
-    { "name": "puppetlabs/apache", "version_requirement": ">=1.0.1 <2.0.0" },
-    { "name": "puppetlabs/concat", "version_requirement": ">=1.1.0 <2.0.0" },
+    { "name": "puppetlabs/apache", "version_requirement": ">=1.4.1 <2.0.0" },
+    { "name": "puppetlabs/concat", "version_requirement": ">=1.2.1 <2.0.0" },
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" }
   ]
diff --git a/ceph/spec/acceptance/ceph_usecases_spec.rb b/ceph/spec/acceptance/ceph_usecases_spec.rb
index 12ca10683..523ce2905 100644
--- a/ceph/spec/acceptance/ceph_usecases_spec.rb
+++ b/ceph/spec/acceptance/ceph_usecases_spec.rb
@@ -51,13 +51,13 @@ class { 'ceph':
       shell 'sleep 10' # we need to wait a bit until the OSD is up
 
       shell 'ceph -s', { :acceptable_exit_codes => [0] } do |r|
-        r.stdout.should =~ /1 mons at/
-        r.stderr.should be_empty
+        expect(r.stdout).to match(/1 mons at/)
+        expect(r.stderr).to be_empty
       end
 
       shell 'ceph osd tree', { :acceptable_exit_codes => [0] } do |r|
-        r.stdout.should =~ /osd.0/
-        r.stderr.should be_empty
+        expect(r.stdout).to match(/osd.0/)
+        expect(r.stderr).to be_empty
       end
     end
 
@@ -93,14 +93,14 @@ class { 'ceph':
 
       if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
         shell 'status ceph-mon id=a', { :acceptable_exit_codes => [1] } do |r|
-          r.stdout.should be_empty
-          r.stderr.should =~ /Unknown instance: ceph.a/
+          expect(r.stdout).to be_empty
+          expect(r.stderr).to match(/Unknown instance: ceph.a/)
         end
       end
       if osfamily == 'RedHat'
         shell 'service ceph status mon.a', { :acceptable_exit_codes => [1] } do |r|
-          r.stdout.should =~ /mon.a not found/
-          r.stderr.should be_empty
+          expect(r.stdout).to match(/mon.a not found/)
+          expect(r.stderr).to be_empty
         end
       end
     end
@@ -116,7 +116,9 @@ class { 'ceph::repo':
       EOS
 
       apply_manifest(pp, :catch_failures => true)
-      apply_manifest(pp, :catch_changes => true)
+      # can't check for idempotency because of https://tickets.puppetlabs.com/browse/PUP-1198
+      #apply_manifest(pp, :catch_changes => true)
+      apply_manifest(pp, :catch_failures => true)
     end
   end
 end
diff --git a/ceph/spec/acceptance/nodesets/centos70-x64.yml b/ceph/spec/acceptance/nodesets/centos70-x64.yml
new file mode 100644
index 000000000..b75c1f17d
--- /dev/null
+++ b/ceph/spec/acceptance/nodesets/centos70-x64.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  first:
+    roles:
+      - master
+      - mon
+      - osd
+      - client
+    platform: el-7-x86_64
+    box: puppetlabs/centos-7.0-64-nocm
+    box_url: https://atlas.hashicorp.com/puppetlabs/boxes/centos-7.0-64-nocm
+    hypervisor: vagrant
+    ip: 10.11.12.2
+CONFIG:
+  type: foss
+  set_env: false
diff --git a/ceph/spec/acceptance/nodesets/nodepool.yml b/ceph/spec/acceptance/nodesets/nodepool-centos7.yml
similarity index 76%
rename from ceph/spec/acceptance/nodesets/nodepool.yml
rename to ceph/spec/acceptance/nodesets/nodepool-centos7.yml
index 0765232d5..d52883df5 100644
--- a/ceph/spec/acceptance/nodesets/nodepool.yml
+++ b/ceph/spec/acceptance/nodesets/nodepool-centos7.yml
@@ -5,8 +5,9 @@ HOSTS:
       - mon
       - osd
       - client
-    platform: ubuntu-1404-amd64
+    platform: el-7-x86_64
     hypervisor: none
     ip: 127.0.0.1
 CONFIG:
   type: foss
+  set_env: false
diff --git a/ceph/spec/acceptance/nodesets/nodepool-trusty.yml b/ceph/spec/acceptance/nodesets/nodepool-trusty.yml
new file mode 100644
index 000000000..dc22d561a
--- /dev/null
+++ b/ceph/spec/acceptance/nodesets/nodepool-trusty.yml
@@ -0,0 +1,13 @@
+HOSTS:
+  first:
+    roles:
+      - master
+      - mon
+      - osd
+      - client
+    platform: ubuntu-14.04-amd64
+    hypervisor: none
+    ip: 127.0.0.1
+CONFIG:
+  type: foss
+  set_env: false
diff --git a/ceph/spec/classes/ceph_init_spec.rb b/ceph/spec/classes/ceph_init_spec.rb
index 82559368d..49f309cfe 100644
--- a/ceph/spec/classes/ceph_init_spec.rb
+++ b/ceph/spec/classes/ceph_init_spec.rb
@@ -41,6 +41,7 @@
       it { is_expected.to_not contain_ceph_config('global/mon_osd_nearfull_ratio').with_value('85') }
       it { is_expected.to_not contain_ceph_config('global/mon_initial_members').with_value('mon.01') }
       it { is_expected.to_not contain_ceph_config('global/mon_host').with_value('mon01.ceph, mon02.ceph') }
+      it { is_expected.to_not contain_ceph_config('global/ms_bind_ipv6').with_value('false') }
       it { is_expected.to_not contain_ceph_config('global/require_signatures').with_value('false') }
       it { is_expected.to_not contain_ceph_config('global/cluster_require_signatures').with_value('false') }
       it { is_expected.to_not contain_ceph_config('global/service_require_signatures').with_value('false') }
@@ -72,6 +73,7 @@
           :mon_osd_nearfull_ratio     => '90',
           :mon_initial_members        => 'mon.01',
           :mon_host                   => 'mon01.ceph, mon02.ceph',
+          :ms_bind_ipv6               => 'true',
           :require_signatures         => 'true',
           :cluster_require_signatures => 'true',
           :service_require_signatures => 'true',
@@ -96,6 +98,7 @@
       it { is_expected.to contain_ceph_config('global/mon_osd_nearfull_ratio').with_value('90') }
       it { is_expected.to contain_ceph_config('global/mon_initial_members').with_value('mon.01') }
       it { is_expected.to contain_ceph_config('global/mon_host').with_value('mon01.ceph, mon02.ceph') }
+      it { is_expected.to contain_ceph_config('global/ms_bind_ipv6').with_value('true') }
       it { is_expected.to contain_ceph_config('global/require_signatures').with_value('true') }
       it { is_expected.to contain_ceph_config('global/cluster_require_signatures').with_value('true') }
       it { is_expected.to contain_ceph_config('global/service_require_signatures').with_value('true') }
diff --git a/ceph/spec/classes/ceph_mons_spec.rb b/ceph/spec/classes/ceph_mons_spec.rb
index a46b6dbad..a21e5b46b 100644
--- a/ceph/spec/classes/ceph_mons_spec.rb
+++ b/ceph/spec/classes/ceph_mons_spec.rb
@@ -68,11 +68,22 @@
     it_configures 'ceph mons'
   end
 
-  describe 'RedHat' do
+  describe 'RHEL6' do
     let :facts do
       {
-        :osfamily => 'RedHat',
-        :operatingsystem => 'RedHat',
+        :osfamily                  => 'RedHat',
+        :operatingsystemmajrelease => '6',
+      }
+    end
+
+    it_configures 'ceph mons'
+  end
+
+  describe 'RHEL7' do
+    let :facts do
+      {
+        :osfamily                  => 'RedHat',
+        :operatingsystemmajrelease => '7',
       }
     end
 
diff --git a/ceph/spec/classes/ceph_profile_base_spec.rb b/ceph/spec/classes/ceph_profile_base_spec.rb
index f1c1d9b9e..cdf4bf414 100644
--- a/ceph/spec/classes/ceph_profile_base_spec.rb
+++ b/ceph/spec/classes/ceph_profile_base_spec.rb
@@ -63,7 +63,18 @@
   context 'on RHEL6' do
 
     let :facts do
-      { :osfamily => 'RedHat', }
+      { :osfamily                  => 'RedHat',
+        :operatingsystemmajrelease => '6' }
+    end
+
+    it_configures 'ceph profile base'
+  end
+
+  context 'on RHEL7' do
+
+    let :facts do
+      { :osfamily                  => 'RedHat',
+        :operatingsystemmajrelease => '7' }
     end
 
     it_configures 'ceph profile base'
diff --git a/ceph/spec/classes/ceph_profile_client_spec.rb b/ceph/spec/classes/ceph_profile_client_spec.rb
index f5483ec3a..c830b4868 100644
--- a/ceph/spec/classes/ceph_profile_client_spec.rb
+++ b/ceph/spec/classes/ceph_profile_client_spec.rb
@@ -118,12 +118,22 @@
   context 'on RHEL6' do
 
     let :facts do
-      {
-        :osfamily         => 'RedHat',
-        :operatingsystem  => 'RHEL6',
-      }
+      { :osfamily                  => 'RedHat',
+        :operatingsystemmajrelease => '6' }
     end
 
+
+    it_configures 'ceph profile client'
+  end
+
+  context 'on RHEL7' do
+
+    let :facts do
+      { :osfamily                  => 'RedHat',
+        :operatingsystemmajrelease => '7' }
+    end
+
+
     it_configures 'ceph profile client'
   end
 end
diff --git a/ceph/spec/classes/ceph_profile_mon_spec.rb b/ceph/spec/classes/ceph_profile_mon_spec.rb
index b7de0bbd3..33bea69d3 100644
--- a/ceph/spec/classes/ceph_profile_mon_spec.rb
+++ b/ceph/spec/classes/ceph_profile_mon_spec.rb
@@ -92,11 +92,20 @@
   context 'on RHEL6' do
 
     let :facts do
-      {
-        :osfamily         => 'RedHat',
-        :operatingsystem  => 'RHEL6',
-        :hostname         => 'first',
-      }
+      { :osfamily                  => 'RedHat',
+        :hostname                  => 'first',
+        :operatingsystemmajrelease => '6' }
+    end
+
+    it_configures 'ceph profile mon'
+  end
+
+  context 'on RHEL7' do
+
+    let :facts do
+      { :osfamily                  => 'RedHat',
+        :hostname                  => 'first',
+        :operatingsystemmajrelease => '7' }
     end
 
     it_configures 'ceph profile mon'
diff --git a/ceph/spec/classes/ceph_profile_osd_spec.rb b/ceph/spec/classes/ceph_profile_osd_spec.rb
index c4979d4b6..0b309bdd3 100644
--- a/ceph/spec/classes/ceph_profile_osd_spec.rb
+++ b/ceph/spec/classes/ceph_profile_osd_spec.rb
@@ -68,13 +68,21 @@
     it_configures 'ceph profile osd'
   end
 
-  describe 'on RedHat' do
+  describe 'on RHEL6' do
 
     let :facts do
-      {
-        :osfamily         => 'RedHat',
-        :operatingsystem  => 'RHEL6',
-      }
+      { :osfamily                  => 'RedHat',
+        :operatingsystemmajrelease => '6' }
+    end
+
+    it_configures 'ceph profile osd'
+  end
+
+  describe 'on RHEL7' do
+
+    let :facts do
+      { :osfamily                  => 'RedHat',
+        :operatingsystemmajrelease => '7' }
     end
 
     it_configures 'ceph profile osd'
diff --git a/ceph/spec/classes/ceph_repo_spec.rb b/ceph/spec/classes/ceph_repo_spec.rb
index 5181e8e67..c10e4442c 100644
--- a/ceph/spec/classes/ceph_repo_spec.rb
+++ b/ceph/spec/classes/ceph_repo_spec.rb
@@ -34,7 +34,7 @@
 
       it { is_expected.to contain_apt__key('ceph').with(
         :key        => '17ED316D',
-        :key_source => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc'
+        :key_source => 'http://git.ceph.com/?p=ceph.git;a=blob_plain;f=keys/release.asc'
       ) }
 
       it { is_expected.to contain_apt__source('ceph').with(
@@ -75,7 +75,7 @@
 
       it { is_expected.to contain_apt__key('ceph').with(
         :key        => '17ED316D',
-        :key_source => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc'
+        :key_source => 'http://git.ceph.com/?p=ceph.git;a=blob_plain;f=keys/release.asc'
       ) }
 
       it { is_expected.to contain_apt__source('ceph').with(
@@ -187,21 +187,24 @@
 
     let :facts do
     {
-      :osfamily         => 'RedHat',
+      :osfamily                  => 'RedHat',
+      :operatingsystem           => 'RedHat',
+      :operatingsystemmajrelease => '6',
     }
     end
 
     describe "with default params" do
 
-      it { is_expected.to contain_yumrepo('ext-epel-6.8').with(
+      it { is_expected.to contain_yumrepo('ext-epel-6').with(
         :enabled    => '1',
-        :descr      => 'External EPEL 6.8',
-        :name       => 'ext-epel-6.8',
+        :descr      => 'External EPEL 6',
+        :name       => 'ext-epel-6',
         :baseurl    => 'absent',
         :gpgcheck   => '0',
         :gpgkey     => 'absent',
         :mirrorlist => 'http://mirrors.fedoraproject.org/metalink?repo=epel-6&arch=$basearch',
-        :priority   => '20'
+        :priority   => '20',
+        :exclude    => 'python-ceph-compat python-rbd python-rados python-cephfs',
       ) }
 
       it { is_expected.to contain_yumrepo('ext-ceph').with(
@@ -234,15 +237,16 @@
         }
       end
 
-      it { is_expected.to contain_yumrepo('ext-epel-6.8').with(
+      it { is_expected.to contain_yumrepo('ext-epel-6').with(
         :enabled    => '1',
-        :descr      => 'External EPEL 6.8',
-        :name       => 'ext-epel-6.8',
+        :descr      => 'External EPEL 6',
+        :name       => 'ext-epel-6',
         :baseurl    => 'absent',
         :gpgcheck   => '0',
         :gpgkey     => 'absent',
         :mirrorlist => 'http://mirrors.fedoraproject.org/metalink?repo=epel-6&arch=$basearch',
-        :priority   => '20'
+        :priority   => '20',
+        :exclude    => 'python-ceph-compat python-rbd python-rados python-cephfs',
       ) }
 
       it { is_expected.to contain_yumrepo('ext-ceph').with(
@@ -277,15 +281,16 @@
         }
       end
 
-      it { is_expected.to contain_yumrepo('ext-epel-6.8').with(
+      it { is_expected.to contain_yumrepo('ext-epel-6').with(
         :enabled    => '0',
-        :descr      => 'External EPEL 6.8',
-        :name       => 'ext-epel-6.8',
+        :descr      => 'External EPEL 6',
+        :name       => 'ext-epel-6',
         :baseurl    => 'absent',
         :gpgcheck   => '0',
         :gpgkey     => 'absent',
         :mirrorlist => 'http://mirrors.fedoraproject.org/metalink?repo=epel-6&arch=$basearch',
-        :priority   => '20'
+        :priority   => '20',
+        :exclude    => 'python-ceph-compat python-rbd python-rados python-cephfs',
       ) }
 
       it { is_expected.to contain_yumrepo('ext-ceph').with(
@@ -341,15 +346,16 @@
         }
       end
 
-      it { is_expected.to contain_yumrepo('ext-epel-6.8').with(
+      it { is_expected.to contain_yumrepo('ext-epel-6').with(
         :enabled    => '1',
-        :descr      => 'External EPEL 6.8',
-        :name       => 'ext-epel-6.8',
+        :descr      => 'External EPEL 6',
+        :name       => 'ext-epel-6',
         :baseurl    => 'absent',
         :gpgcheck   => '0',
         :gpgkey     => 'absent',
         :mirrorlist => 'http://mirrors.fedoraproject.org/metalink?repo=epel-6&arch=$basearch',
-        :priority   => '20'
+        :priority   => '20',
+        :exclude    => 'python-ceph-compat python-rbd python-rados python-cephfs',
       ) }
 
       it { is_expected.to contain_yumrepo('ext-ceph').with(
@@ -394,15 +400,16 @@
         }
       end
 
-      it { is_expected.to contain_yumrepo('ext-epel-6.8').with(
+      it { is_expected.to contain_yumrepo('ext-epel-6').with(
         :enabled    => '1',
-        :descr      => 'External EPEL 6.8',
-        :name       => 'ext-epel-6.8',
+        :descr      => 'External EPEL 6',
+        :name       => 'ext-epel-6',
         :baseurl    => 'absent',
         :gpgcheck   => '0',
         :gpgkey     => 'absent',
         :mirrorlist => 'http://mirrors.fedoraproject.org/metalink?repo=epel-6&arch=$basearch',
-        :priority   => '20'
+        :priority   => '20',
+        :exclude    => 'python-ceph-compat python-rbd python-rados python-cephfs',
       ) }
 
       it { is_expected.to contain_yumrepo('ext-ceph').with(
@@ -441,4 +448,250 @@
     end
   end
 
+  describe 'RHEL7' do
+
+    let :facts do
+    {
+      :osfamily                  => 'RedHat',
+      :operatingsystem           => 'RedHat',
+      :operatingsystemmajrelease => '7',
+    }
+    end
+
+    describe "with default params" do
+
+      it { should contain_yumrepo('ext-epel-7').with(
+        :enabled    => '1',
+        :descr      => 'External EPEL 7',
+        :name       => 'ext-epel-7',
+        :baseurl    => 'absent',
+        :gpgcheck   => '0',
+        :gpgkey     => 'absent',
+        :mirrorlist => 'http://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch',
+        :priority   => '20',
+        :exclude    => 'python-ceph-compat python-rbd python-rados python-cephfs',
+      ) }
+
+      it { should contain_yumrepo('ext-ceph').with(
+        :enabled    => '1',
+        :descr      => 'External Ceph giant',
+        :name       => 'ext-ceph-giant',
+        :baseurl    => 'http://ceph.com/rpm-giant/el7/$basearch',
+        :gpgcheck   => '1',
+        :gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
+        :mirrorlist => 'absent',
+        :priority   => '10'
+     ) }
+
+      it { should contain_yumrepo('ext-ceph-noarch').with(
+        :enabled    => '1',
+        :descr      => 'External Ceph noarch',
+        :name       => 'ext-ceph-giant-noarch',
+        :baseurl    => 'http://ceph.com/rpm-giant/el7/noarch',
+        :gpgcheck   => '1',
+        :gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
+        :mirrorlist => 'absent',
+        :priority   => '10'
+      ) }
+    end
+
+    describe "when overriding ceph release" do
+      let :params do
+        {
+         :release => 'firefly'
+        }
+      end
+
+      it { should contain_yumrepo('ext-epel-7').with(
+        :enabled    => '1',
+        :descr      => 'External EPEL 7',
+        :name       => 'ext-epel-7',
+        :baseurl    => 'absent',
+        :gpgcheck   => '0',
+        :gpgkey     => 'absent',
+        :mirrorlist => 'http://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch',
+        :priority   => '20',
+        :exclude    => 'python-ceph-compat python-rbd python-rados python-cephfs',
+      ) }
+
+      it { should contain_yumrepo('ext-ceph').with(
+        :enabled    => '1',
+        :descr      => 'External Ceph firefly',
+        :name       => 'ext-ceph-firefly',
+        :baseurl    => 'http://ceph.com/rpm-firefly/el7/$basearch',
+        :gpgcheck   => '1',
+        :gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
+        :mirrorlist => 'absent',
+        :priority   => '10'
+     ) }
+
+      it { should contain_yumrepo('ext-ceph-noarch').with(
+        :enabled    => '1',
+        :descr      => 'External Ceph noarch',
+        :name       => 'ext-ceph-firefly-noarch',
+        :baseurl    => 'http://ceph.com/rpm-firefly/el7/noarch',
+        :gpgcheck   => '1',
+        :gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
+        :mirrorlist => 'absent',
+        :priority   => '10'
+      ) }
+    end
+
+    describe "with ensure => absent to disable" do
+      let :params do
+        {
+          :ensure  => 'absent',
+          :extras  => true,
+          :fastcgi => true
+        }
+      end
+
+      it { should contain_yumrepo('ext-epel-7').with(
+        :enabled    => '0',
+        :descr      => 'External EPEL 7',
+        :name       => 'ext-epel-7',
+        :baseurl    => 'absent',
+        :gpgcheck   => '0',
+        :gpgkey     => 'absent',
+        :mirrorlist => 'http://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch',
+        :priority   => '20',
+        :exclude    => 'python-ceph-compat python-rbd python-rados python-cephfs',
+      ) }
+
+      it { should contain_yumrepo('ext-ceph').with(
+        :enabled    => '0',
+        :descr      => 'External Ceph giant',
+        :name       => 'ext-ceph-giant',
+        :baseurl    => 'http://ceph.com/rpm-giant/el7/$basearch',
+        :gpgcheck   => '1',
+        :gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
+        :mirrorlist => 'absent',
+        :priority   => '10'
+     ) }
+
+      it { should contain_yumrepo('ext-ceph-noarch').with(
+        :enabled    => '0',
+        :descr      => 'External Ceph noarch',
+        :name       => 'ext-ceph-giant-noarch',
+        :baseurl    => 'http://ceph.com/rpm-giant/el7/noarch',
+        :gpgcheck   => '1',
+        :gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
+        :mirrorlist => 'absent',
+        :priority   => '10'
+      ) }
+
+      it { should_not contain_yumrepo('ext-ceph-extras') }
+
+      it { should contain_yumrepo('ext-ceph-fastcgi').with(
+        :enabled    => '0',
+        :descr      => 'FastCGI basearch packages for Ceph',
+        :name       => 'ext-ceph-fastcgi',
+        :baseurl    => 'http://gitbuilder.ceph.com/mod_fastcgi-rpm-rhel7-x86_64-basic/ref/master',
+        :gpgcheck   => '1',
+        :gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/autobuild.asc',
+        :mirrorlist => 'absent',
+        :priority   => '20'
+      ) }
+
+    end
+
+    describe "with ceph extras" do
+      let :params do
+        {
+          :extras => true
+        }
+      end
+
+      it { should contain_yumrepo('ext-epel-7').with(
+        :enabled    => '1',
+        :descr      => 'External EPEL 7',
+        :name       => 'ext-epel-7',
+        :baseurl    => 'absent',
+        :gpgcheck   => '0',
+        :gpgkey     => 'absent',
+        :mirrorlist => 'http://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch',
+        :priority   => '20',
+        :exclude    => 'python-ceph-compat python-rbd python-rados python-cephfs',
+      ) }
+
+      it { should contain_yumrepo('ext-ceph').with(
+        :enabled    => '1',
+        :descr      => 'External Ceph giant',
+        :name       => 'ext-ceph-giant',
+        :baseurl    => 'http://ceph.com/rpm-giant/el7/$basearch',
+        :gpgcheck   => '1',
+        :gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
+        :mirrorlist => 'absent',
+        :priority   => '10'
+     ) }
+
+      it { should contain_yumrepo('ext-ceph-noarch').with(
+        :enabled    => '1',
+        :descr      => 'External Ceph noarch',
+        :name       => 'ext-ceph-giant-noarch',
+        :baseurl    => 'http://ceph.com/rpm-giant/el7/noarch',
+        :gpgcheck   => '1',
+        :gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
+        :mirrorlist => 'absent',
+        :priority   => '10'
+      ) }
+
+      it { should_not contain_yumrepo('ext-ceph-extras') }
+    end
+
+    describe "with ceph fast-cgi" do
+      let :params do
+        {
+          :fastcgi => true
+        }
+      end
+
+      it { should contain_yumrepo('ext-epel-7').with(
+        :enabled    => '1',
+        :descr      => 'External EPEL 7',
+        :name       => 'ext-epel-7',
+        :baseurl    => 'absent',
+        :gpgcheck   => '0',
+        :gpgkey     => 'absent',
+        :mirrorlist => 'http://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch',
+        :priority   => '20',
+        :exclude    => 'python-ceph-compat python-rbd python-rados python-cephfs',
+      ) }
+
+      it { should contain_yumrepo('ext-ceph').with(
+        :enabled    => '1',
+        :descr      => 'External Ceph giant',
+        :name       => 'ext-ceph-giant',
+        :baseurl    => 'http://ceph.com/rpm-giant/el7/$basearch',
+        :gpgcheck   => '1',
+        :gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
+        :mirrorlist => 'absent',
+        :priority   => '10'
+     ) }
+
+      it { should contain_yumrepo('ext-ceph-noarch').with(
+        :enabled    => '1',
+        :descr      => 'External Ceph noarch',
+        :name       => 'ext-ceph-giant-noarch',
+        :baseurl    => 'http://ceph.com/rpm-giant/el7/noarch',
+        :gpgcheck   => '1',
+        :gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc',
+        :mirrorlist => 'absent',
+        :priority   => '10'
+      ) }
+
+      it { should contain_yumrepo('ext-ceph-fastcgi').with(
+        :enabled    => '1',
+        :descr      => 'FastCGI basearch packages for Ceph',
+        :name       => 'ext-ceph-fastcgi',
+        :baseurl    => 'http://gitbuilder.ceph.com/mod_fastcgi-rpm-rhel7-x86_64-basic/ref/master',
+        :gpgcheck   => '1',
+        :gpgkey     => 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/autobuild.asc',
+        :mirrorlist => 'absent',
+        :priority   => '20'
+      ) }
+
+    end
+  end
+
 end
diff --git a/ceph/spec/defines/ceph_key_spec.rb b/ceph/spec/defines/ceph_key_spec.rb
index e614ecd49..38be3d543 100644
--- a/ceph/spec/defines/ceph_key_spec.rb
+++ b/ceph/spec/defines/ceph_key_spec.rb
@@ -40,15 +40,15 @@
       end
 
       it {
-        should contain_exec('ceph-key-client.admin').with(
+        is_expected.to contain_exec('ceph-key-client.admin').with(
           'command' => "/bin/true # comment to satisfy puppet syntax requirements\nset -ex\nceph-authtool /etc/ceph/ceph.client.admin.keyring --name 'client.admin' --add-key 'supersecret' --cap mon 'allow *' --cap osd 'allow rw' "
         )
-        should contain_file('/etc/ceph/ceph.client.admin.keyring').with(
+        is_expected.to contain_file('/etc/ceph/ceph.client.admin.keyring').with(
           'owner' => 'nobody',
           'group' => 'nogroup',
           'mode'  => '0600'
         )
-        should contain_exec('ceph-injectkey-client.admin').with(
+        is_expected.to contain_exec('ceph-injectkey-client.admin').with(
            'command' => "/bin/true # comment to satisfy puppet syntax requirements\nset -ex\nceph    auth add client.admin --in-file=/etc/ceph/ceph.client.admin.keyring"
         )
       }
diff --git a/ceph/spec/defines/ceph_mon_spec.rb b/ceph/spec/defines/ceph_mon_spec.rb
index c74ef50fc..5c4656f32 100644
--- a/ceph/spec/defines/ceph_mon_spec.rb
+++ b/ceph/spec/defines/ceph_mon_spec.rb
@@ -39,7 +39,7 @@
 
       it {
         expect {
-          should contain_service('ceph-mon-A').with('ensure' => 'running')
+          is_expected.to contain_service('ceph-mon-A').with('ensure' => 'running')
         }.to raise_error(Puppet::Error, /authentication_type cephx requires either key or keyring to be set but both are undef/)
       }
     end
@@ -56,13 +56,13 @@
         }
       end
 
-      it { should contain_service('ceph-mon-A').with('ensure' => 'running') }
-      it { should contain_exec('ceph-mon-ceph.client.admin.keyring-A').with(
+      it { is_expected.to contain_service('ceph-mon-A').with('ensure' => 'running') }
+      it { is_expected.to contain_exec('ceph-mon-ceph.client.admin.keyring-A').with(
         'command' => '/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 touch /etc/ceph/ceph.client.admin.keyring'
        ) }
-      it { should contain_exec('ceph-mon-mkfs-A').with(
+      it { is_expected.to contain_exec('ceph-mon-mkfs-A').with(
         'command' => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 mon_data=\$(ceph-mon  --id A --show-config-value mon_data)
@@ -80,10 +80,10 @@
 fi
 ",
         'logoutput' => true) }
-      it { should contain_file('/tmp/ceph-mon-keyring-A').with(
+      it { is_expected.to contain_file('/tmp/ceph-mon-keyring-A').with(
         'mode' => '0444',
         'content' => "[mon.]\n\tkey = AQATGHJTUCBqIBAA7M2yafV1xctn1pgr3GcKPg==\n\tcaps mon = \"allow *\"\n") }
-      it { should contain_exec('rm-keyring-A').with('command' => '/bin/rm /tmp/ceph-mon-keyring-A') }
+      it { is_expected.to contain_exec('rm-keyring-A').with('command' => '/bin/rm /tmp/ceph-mon-keyring-A') }
     end
 
     describe 'with keyring' do
@@ -98,13 +98,13 @@
         }
       end
 
-      it { should contain_service('ceph-mon-A').with('ensure' => 'running') }
-      it { should contain_exec('ceph-mon-ceph.client.admin.keyring-A').with(
+      it { is_expected.to contain_service('ceph-mon-A').with('ensure' => 'running') }
+      it { is_expected.to contain_exec('ceph-mon-ceph.client.admin.keyring-A').with(
         'command' => '/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 touch /etc/ceph/ceph.client.admin.keyring'
        ) }
-      it { should contain_exec('ceph-mon-mkfs-A').with(
+      it { is_expected.to contain_exec('ceph-mon-mkfs-A').with(
         'command' => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 mon_data=\$(ceph-mon  --id A --show-config-value mon_data)
@@ -138,13 +138,13 @@
         }
       end
 
-      it { should contain_service('ceph-mon-A').with('ensure' => 'running') }
-      it { should contain_exec('ceph-mon-testcluster.client.admin.keyring-A').with(
+      it { is_expected.to contain_service('ceph-mon-A').with('ensure' => 'running') }
+      it { is_expected.to contain_exec('ceph-mon-testcluster.client.admin.keyring-A').with(
         'command' => '/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 touch /etc/ceph/testcluster.client.admin.keyring'
        ) }
-      it { should contain_exec('ceph-mon-mkfs-A').with(
+      it { is_expected.to contain_exec('ceph-mon-mkfs-A').with(
         'command' => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 mon_data=\$(ceph-mon --cluster testcluster --id A --show-config-value mon_data)
@@ -179,8 +179,8 @@
         }
       end
 
-      it { should contain_service('ceph-mon-A').with('ensure' => 'stopped') }
-      it { should contain_exec('remove-mon-A').with(
+      it { is_expected.to contain_service('ceph-mon-A').with('ensure' => 'stopped') }
+      it { is_expected.to contain_exec('remove-mon-A').with(
         'command' => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 mon_data=\$(ceph-mon --cluster testcluster --id A --show-config-value mon_data)
@@ -196,12 +196,12 @@
     end
   end
 
-  context 'RHEL6' do
+  context 'RHEL7' do
 
     let :facts do
       {
         :osfamily        => 'RedHat',
-        :operatingsystem => 'RHEL6',
+        :operatingsystem => 'RHEL7',
       }
     end
 
@@ -213,7 +213,7 @@
 
       it {
         expect {
-          should contain_service('ceph-mon-A').with('ensure' => 'running')
+          is_expected.to contain_service('ceph-mon-A').with('ensure' => 'running')
         }.to raise_error(Puppet::Error, /authentication_type cephx requires either key or keyring to be set but both are undef/)
       }
     end
@@ -230,13 +230,13 @@
         }
       end
 
-      it { should contain_service('ceph-mon-A').with('ensure' => 'running') }
-      it { should contain_exec('ceph-mon-ceph.client.admin.keyring-A').with(
+      it { is_expected.to contain_service('ceph-mon-A').with('ensure' => 'running') }
+      it { is_expected.to contain_exec('ceph-mon-ceph.client.admin.keyring-A').with(
         'command' => '/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 touch /etc/ceph/ceph.client.admin.keyring'
        ) }
-      it { should contain_exec('ceph-mon-mkfs-A').with(
+      it { is_expected.to contain_exec('ceph-mon-mkfs-A').with(
         'command' => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 mon_data=\$(ceph-mon  --id A --show-config-value mon_data)
@@ -254,10 +254,10 @@
 fi
 ",
         'logoutput' => true) }
-      it { should contain_file('/tmp/ceph-mon-keyring-A').with(
+      it { is_expected.to contain_file('/tmp/ceph-mon-keyring-A').with(
         'mode' => '0444',
         'content' => "[mon.]\n\tkey = AQATGHJTUCBqIBAA7M2yafV1xctn1pgr3GcKPg==\n\tcaps mon = \"allow *\"\n") }
-      it { should contain_exec('rm-keyring-A').with('command' => '/bin/rm /tmp/ceph-mon-keyring-A') }
+      it { is_expected.to contain_exec('rm-keyring-A').with('command' => '/bin/rm /tmp/ceph-mon-keyring-A') }
     end
 
     describe 'with keyring' do
@@ -272,13 +272,13 @@
         }
       end
 
-      it { should contain_service('ceph-mon-A').with('ensure' => 'running') }
-      it { should contain_exec('ceph-mon-ceph.client.admin.keyring-A').with(
+      it { is_expected.to contain_service('ceph-mon-A').with('ensure' => 'running') }
+      it { is_expected.to contain_exec('ceph-mon-ceph.client.admin.keyring-A').with(
         'command' => '/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 touch /etc/ceph/ceph.client.admin.keyring'
        ) }
-      it { should contain_exec('ceph-mon-mkfs-A').with(
+      it { is_expected.to contain_exec('ceph-mon-mkfs-A').with(
         'command' => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 mon_data=\$(ceph-mon  --id A --show-config-value mon_data)
@@ -312,13 +312,13 @@
         }
       end
 
-      it { should contain_service('ceph-mon-A').with('ensure' => 'running') }
-      it { should contain_exec('ceph-mon-testcluster.client.admin.keyring-A').with(
+      it { is_expected.to contain_service('ceph-mon-A').with('ensure' => 'running') }
+      it { is_expected.to contain_exec('ceph-mon-testcluster.client.admin.keyring-A').with(
         'command' => '/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 touch /etc/ceph/testcluster.client.admin.keyring'
        ) }
-      it { should contain_exec('ceph-mon-mkfs-A').with(
+      it { is_expected.to contain_exec('ceph-mon-mkfs-A').with(
         'command' => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 mon_data=\$(ceph-mon --cluster testcluster --id A --show-config-value mon_data)
@@ -353,8 +353,8 @@
         }
       end
 
-      it { should contain_service('ceph-mon-A').with('ensure' => 'stopped') }
-      it { should contain_exec('remove-mon-A').with(
+      it { is_expected.to contain_service('ceph-mon-A').with('ensure' => 'stopped') }
+      it { is_expected.to contain_exec('remove-mon-A').with(
         'command' => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 mon_data=\$(ceph-mon --cluster testcluster --id A --show-config-value mon_data)
diff --git a/ceph/spec/defines/ceph_osd_spec.rb b/ceph/spec/defines/ceph_osd_spec.rb
index 2a4895e36..c66fcfbb8 100644
--- a/ceph/spec/defines/ceph_osd_spec.rb
+++ b/ceph/spec/defines/ceph_osd_spec.rb
@@ -29,7 +29,7 @@
         '/tmp'
       end
 
-      it { should contain_exec('ceph-osd-prepare-/tmp').with(
+      it { is_expected.to contain_exec('ceph-osd-prepare-/tmp').with(
         'command'   => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 if ! test -b /tmp ; then
@@ -45,7 +45,7 @@
 ",
         'logoutput' => true
       ) }
-      it { should contain_exec('ceph-osd-activate-/tmp').with(
+      it { is_expected.to contain_exec('ceph-osd-activate-/tmp').with(
         'command'   => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 if ! test -b /tmp ; then
@@ -78,7 +78,7 @@
         }
       end
 
-      it { should contain_exec('ceph-osd-prepare-/tmp/data').with(
+      it { is_expected.to contain_exec('ceph-osd-prepare-/tmp/data').with(
         'command'   => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 if ! test -b /tmp/data ; then
@@ -94,7 +94,7 @@
 ",
         'logoutput' => true
       ) }
-      it { should contain_exec('ceph-osd-activate-/tmp/data').with(
+      it { is_expected.to contain_exec('ceph-osd-activate-/tmp/data').with(
         'command'   => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 if ! test -b /tmp/data ; then
@@ -126,7 +126,7 @@
         }
       end
 
-      it { should contain_exec('remove-osd-/tmp').with(
+      it { is_expected.to contain_exec('remove-osd-/tmp').with(
         'command'   => "/bin/true # comment to satisfy puppet syntax requirements
 set -ex
 if [ -z \"\$id\" ] ; then
diff --git a/ceph/spec/defines/ceph_pool_spec.rb b/ceph/spec/defines/ceph_pool_spec.rb
index ff85173b4..97e171588 100644
--- a/ceph/spec/defines/ceph_pool_spec.rb
+++ b/ceph/spec/defines/ceph_pool_spec.rb
@@ -37,19 +37,19 @@
       end
 
       it {
-        should contain_exec('create-volumes').with(
+        is_expected.to contain_exec('create-volumes').with(
           'command' => "/bin/true # comment to satisfy puppet syntax requirements\nset -ex\nceph osd pool create volumes 3"
         )
-        should contain_exec('set-volumes-pg_num').with(
+        is_expected.to contain_exec('set-volumes-pg_num').with(
           'command' => "/bin/true # comment to satisfy puppet syntax requirements\nset -ex\nceph osd pool set volumes pg_num 3"
         )
-        should contain_exec('set-volumes-pgp_num').with(
+        is_expected.to contain_exec('set-volumes-pgp_num').with(
           'command' => "/bin/true # comment to satisfy puppet syntax requirements\nset -ex\nceph osd pool set volumes pgp_num 4"
         )
-        should contain_exec('set-volumes-size').with(
+        is_expected.to contain_exec('set-volumes-size').with(
           'command' => "/bin/true # comment to satisfy puppet syntax requirements\nset -ex\nceph osd pool set volumes size 2"
         )
-        should_not contain_exec('delete-volumes')
+        is_expected.not_to contain_exec('delete-volumes')
       }
 
     end
@@ -67,8 +67,8 @@
       end
 
       it {
-        should_not contain_exec('create-volumes')
-        should contain_exec('delete-volumes').with(
+        is_expected.not_to contain_exec('create-volumes')
+        is_expected.to contain_exec('delete-volumes').with(
           'command' => "/bin/true # comment to satisfy puppet syntax requirements\nset -ex\nceph osd pool delete volumes volumes --yes-i-really-really-mean-it"
         )
       }
diff --git a/ceph/spec/defines/ceph_rgw_apache_spec.rb b/ceph/spec/defines/ceph_rgw_apache_spec.rb
index e1450074c..1d65e9332 100644
--- a/ceph/spec/defines/ceph_rgw_apache_spec.rb
+++ b/ceph/spec/defines/ceph_rgw_apache_spec.rb
@@ -49,7 +49,7 @@ class { 'ceph::repo':
         'radosgw.gateway'
       end
 
-      it { should contain_apache__vhost('myhost.domain-radosgw').with( {
+      it { is_expected.to contain_apache__vhost('myhost.domain-radosgw').with( {
         'servername'        => 'myhost.domain',
         'serveradmin'       => 'root@localhost',
         'port'              => 80,
@@ -63,14 +63,14 @@ class { 'ceph::repo':
   ServerSignature Off",
       })}
 
-      it { should contain_class('apache') }
-      it { should contain_class('apache::mod::alias') }
-      it { should contain_class('apache::mod::auth_basic') }
-      it { should contain_apache__mod('fastcgi').with ( { 'package' => 'libapache2-mod-fastcgi' } ) }
-      it { should contain_class('apache::mod::mime') }
-      it { should contain_class('apache::mod::rewrite') }
+      it { is_expected.to contain_class('apache') }
+      it { is_expected.to contain_class('apache::mod::alias') }
+      it { is_expected.to contain_class('apache::mod::auth_basic') }
+      it { is_expected.to contain_apache__mod('fastcgi').with ( { 'package' => 'libapache2-mod-fastcgi' } ) }
+      it { is_expected.to contain_class('apache::mod::mime') }
+      it { is_expected.to contain_class('apache::mod::rewrite') }
 
-      it { should contain_file('/var/www/s3gw.fcgi').with({
+      it { is_expected.to contain_file('/var/www/s3gw.fcgi').with({
         'ensure'  => 'file',
         'owner'   => 'root',
         'group'   => 'root',
@@ -98,7 +98,7 @@ class { 'ceph::repo':
         }
       end
 
-      it { should contain_apache__vhost('mydns.hostname-radosgw').with( {
+      it { is_expected.to contain_apache__vhost('mydns.hostname-radosgw').with( {
         'servername'        => 'mydns.hostname',
         'serveradmin'       => 'admin@hostname',
         'port'              => 1111,
@@ -112,14 +112,14 @@ class { 'ceph::repo':
   ServerSignature Off",
       } ) }
 
-      it { should contain_class('apache') }
-      it { should contain_class('apache::mod::alias') }
-      it { should contain_class('apache::mod::auth_basic') }
-      it { should contain_apache__mod('fastcgi').with ( { 'package' => 'libapache2-mod-fastcgi' } ) }
-      it { should contain_class('apache::mod::mime') }
-      it { should contain_class('apache::mod::rewrite') }
+      it { is_expected.to contain_class('apache') }
+      it { is_expected.to contain_class('apache::mod::alias') }
+      it { is_expected.to contain_class('apache::mod::auth_basic') }
+      it { is_expected.to contain_apache__mod('fastcgi').with ( { 'package' => 'libapache2-mod-fastcgi' } ) }
+      it { is_expected.to contain_class('apache::mod::mime') }
+      it { is_expected.to contain_class('apache::mod::rewrite') }
 
-      it { should contain_file('/some/fcgi/filepath') }
+      it { is_expected.to contain_file('/some/fcgi/filepath') }
 
     end
   end
@@ -144,7 +144,7 @@ class { 'ceph::repo':
         'radosgw.gateway'
       end
 
-      it { should contain_apache__vhost('myhost.domain-radosgw').with( {
+      it { is_expected.to contain_apache__vhost('myhost.domain-radosgw').with( {
         'servername'        => 'myhost.domain',
         'serveradmin'       => 'root@localhost',
         'port'              => 80,
@@ -158,14 +158,14 @@ class { 'ceph::repo':
   ServerSignature Off",
       })}
 
-      it { should contain_class('apache') }
-      it { should contain_class('apache::mod::alias') }
-      it { should contain_class('apache::mod::auth_basic') }
-      it { should contain_apache__mod('fastcgi').with ( { 'package' => 'mod_fastcgi' } ) }
-      it { should contain_class('apache::mod::mime') }
-      it { should contain_class('apache::mod::rewrite') }
+      it { is_expected.to contain_class('apache') }
+      it { is_expected.to contain_class('apache::mod::alias') }
+      it { is_expected.to contain_class('apache::mod::auth_basic') }
+      it { is_expected.to contain_apache__mod('fastcgi').with ( { 'package' => 'mod_fastcgi' } ) }
+      it { is_expected.to contain_class('apache::mod::mime') }
+      it { is_expected.to contain_class('apache::mod::rewrite') }
 
-      it { should contain_file('/var/www/s3gw.fcgi').with({
+      it { is_expected.to contain_file('/var/www/s3gw.fcgi').with({
         'ensure'  => 'file',
         'owner'   => 'root',
         'group'   => 'root',
@@ -193,7 +193,7 @@ class { 'ceph::repo':
         }
       end
 
-      it { should contain_apache__vhost('mydns.hostname-radosgw').with( {
+      it { is_expected.to contain_apache__vhost('mydns.hostname-radosgw').with( {
         'servername'        => 'mydns.hostname',
         'serveradmin'       => 'admin@hostname',
         'port'              => 1111,
@@ -207,14 +207,14 @@ class { 'ceph::repo':
   ServerSignature Off",
       } ) }
 
-      it { should contain_class('apache') }
-      it { should contain_class('apache::mod::alias') }
-      it { should contain_class('apache::mod::auth_basic') }
-      it { should contain_apache__mod('fastcgi').with ( { 'package' => 'mod_fastcgi' } ) }
-      it { should contain_class('apache::mod::mime') }
-      it { should contain_class('apache::mod::rewrite') }
+      it { is_expected.to contain_class('apache') }
+      it { is_expected.to contain_class('apache::mod::alias') }
+      it { is_expected.to contain_class('apache::mod::auth_basic') }
+      it { is_expected.to contain_apache__mod('fastcgi').with ( { 'package' => 'mod_fastcgi' } ) }
+      it { is_expected.to contain_class('apache::mod::mime') }
+      it { is_expected.to contain_class('apache::mod::rewrite') }
 
-      it { should contain_file('/some/fcgi/filepath') }
+      it { is_expected.to contain_file('/some/fcgi/filepath') }
 
     end
   end
diff --git a/ceph/spec/defines/ceph_rgw_spec.rb b/ceph/spec/defines/ceph_rgw_spec.rb
index a3e3617ff..0fc1c8622 100644
--- a/ceph/spec/defines/ceph_rgw_spec.rb
+++ b/ceph/spec/defines/ceph_rgw_spec.rb
@@ -31,29 +31,29 @@
         'radosgw.gateway'
       end
 
-      it { should contain_package("#{default_params[:pkg_radosgw]}").with('ensure' => 'installed') }
-      it { should contain_ceph_config('client.radosgw.gateway/user').with_value("#{default_params[:user]}") }
-      it { should contain_ceph_config('client.radosgw.gateway/host').with_value('myhost') }
-      it { should contain_ceph_config('client.radosgw.gateway/keyring').with_value('/etc/ceph/ceph.client.radosgw.gateway.keyring') }
-      it { should contain_ceph_config('client.radosgw.gateway/log_file').with_value('/var/log/ceph/radosgw.log') }
-      it { should contain_ceph_config('client.radosgw.gateway/rgw_dns_name').with_value('myhost.domain') }
-      it { should contain_ceph_config('client.radosgw.gateway/rgw_print_continue').with_value(true) }
-      it { should contain_ceph_config('client.radosgw.gateway/rgw_socket_path').with_value('/tmp/radosgw.sock') }
-      it { should contain_ceph_config('client.radosgw.gateway/rgw_port').with_value(80) }
-
-      it { should contain_file('/var/lib/ceph/radosgw').with({
+      it { is_expected.to contain_package("#{default_params[:pkg_radosgw]}").with('ensure' => 'installed') }
+      it { is_expected.to contain_ceph_config('client.radosgw.gateway/user').with_value("#{default_params[:user]}") }
+      it { is_expected.to contain_ceph_config('client.radosgw.gateway/host').with_value('myhost') }
+      it { is_expected.to contain_ceph_config('client.radosgw.gateway/keyring').with_value('/etc/ceph/ceph.client.radosgw.gateway.keyring') }
+      it { is_expected.to contain_ceph_config('client.radosgw.gateway/log_file').with_value('/var/log/ceph/radosgw.log') }
+      it { is_expected.to contain_ceph_config('client.radosgw.gateway/rgw_dns_name').with_value('myhost.domain') }
+      it { is_expected.to contain_ceph_config('client.radosgw.gateway/rgw_print_continue').with_value(true) }
+      it { is_expected.to contain_ceph_config('client.radosgw.gateway/rgw_socket_path').with_value('/tmp/radosgw.sock') }
+      it { is_expected.to contain_ceph_config('client.radosgw.gateway/rgw_port').with_value(80) }
+
+      it { is_expected.to contain_file('/var/lib/ceph/radosgw').with({
         'ensure' => 'directory',
         'mode'   => '0755',
       })}
 
-      it { should contain_file('/var/lib/ceph/radosgw/ceph-radosgw.gateway').with({
+      it { is_expected.to contain_file('/var/lib/ceph/radosgw/ceph-radosgw.gateway').with({
         'ensure' => 'directory',
         'owner'  => 'root',
         'group'  => 'root',
         'mode'   => '0750',
       })}
 
-      it { should contain_service('radosgw-radosgw.gateway') }
+      it { is_expected.to contain_service('radosgw-radosgw.gateway') }
 
     end
 
@@ -78,25 +78,25 @@
         }
       end
 
-      it { should contain_package('pkgradosgw').with('ensure' => 'installed') }
+      it { is_expected.to contain_package('pkgradosgw').with('ensure' => 'installed') }
 
-      it { should contain_ceph_config('client.myid/host').with_value('myhost') }
-      it { should contain_ceph_config('client.myid/keyring').with_value('/etc/ceph/ceph.myid.keyring') }
-      it { should contain_ceph_config('client.myid/log_file').with_value('/var/log/ceph/mylogfile.log') }
-      it { should contain_ceph_config('client.myid/rgw_dns_name').with_value('mydns.hostname') }
-      it { should contain_ceph_config('client.myid/rgw_print_continue').with_value(false) }
-      it { should contain_ceph_config('client.myid/rgw_socket_path').with_value('/some/location/radosgw.sock') }
-      it { should contain_ceph_config('client.myid/rgw_port').with_value(1111) }
-      it { should contain_ceph_config('client.myid/user').with_value('wwwuser') }
+      it { is_expected.to contain_ceph_config('client.myid/host').with_value('myhost') }
+      it { is_expected.to contain_ceph_config('client.myid/keyring').with_value('/etc/ceph/ceph.myid.keyring') }
+      it { is_expected.to contain_ceph_config('client.myid/log_file').with_value('/var/log/ceph/mylogfile.log') }
+      it { is_expected.to contain_ceph_config('client.myid/rgw_dns_name').with_value('mydns.hostname') }
+      it { is_expected.to contain_ceph_config('client.myid/rgw_print_continue').with_value(false) }
+      it { is_expected.to contain_ceph_config('client.myid/rgw_socket_path').with_value('/some/location/radosgw.sock') }
+      it { is_expected.to contain_ceph_config('client.myid/rgw_port').with_value(1111) }
+      it { is_expected.to contain_ceph_config('client.myid/user').with_value('wwwuser') }
 
-      it { should contain_file('/var/lib/ceph/radosgw/ceph-myid').with( {
+      it { is_expected.to contain_file('/var/lib/ceph/radosgw/ceph-myid').with( {
         'ensure' => 'directory',
         'owner'  => 'root',
         'group'  => 'root',
         'mode'   => '0750',
       } ) }
 
-      it { should contain_service('radosgw-myid') }
+      it { is_expected.to contain_service('radosgw-myid') }
 
     end
 
diff --git a/ceph/spec/spec_helper_acceptance.rb b/ceph/spec/spec_helper_acceptance.rb
index f301c819e..e6803f79e 100644
--- a/ceph/spec/spec_helper_acceptance.rb
+++ b/ceph/spec/spec_helper_acceptance.rb
@@ -24,13 +24,18 @@
 
   hosts.each do |host|
     install_puppet
+    # clean out any module cruft
+    shell('rm -fr /etc/puppet/modules/*')
     on host, "mkdir -p #{host['distmoduledir']}"
+    # we will provide our own epel with some excludes later
+    shell('test -f /etc/debian_version || yum-config-manager --disable epel')
   end
 
+  c.formatter = :documentation
+
   c.before :suite do
-    puppet_module_install(:source => proj_root, :module_name => 'ceph')
-    scp_to hosts, File.join(proj_root, 'spec/fixtures/hieradata/hiera.yaml'), '/etc/puppet/hiera.yaml'
     hosts.each do |host|
+      scp_to hosts, File.join(proj_root, 'spec/fixtures/hieradata/hiera.yaml'), '/etc/puppet/hiera.yaml'
       # https://tickets.puppetlabs.com/browse/PUP-2566
       on host, 'sed -i "/templatedir/d" /etc/puppet/puppet.conf'
       install_package host, 'git'
@@ -38,8 +43,9 @@
       on host, puppet('module install puppetlabs/stdlib --version ">=4.0.0 <5.0.0"'), { :acceptable_exit_codes => [0,1] }
       on host, puppet('module install puppetlabs/inifile --version ">=1.0.0 <2.0.0"'), { :acceptable_exit_codes => [0,1] }
       on host, puppet('module install puppetlabs/apt --version ">=1.4.0 <2.0.0"'), { :acceptable_exit_codes => [0,1] }
-      on host, puppet('module install puppetlabs/concat --version ">=1.1.0 <2.0.0"'), { :acceptable_exit_codes => [0,1] }
-      on host, puppet('module install puppetlabs/apache --version ">=1.0.1 <2.0.0"'), { :acceptable_exit_codes => [0,1] }
+      on host, puppet('module install puppetlabs/concat --version ">=1.2.1 <2.0.0"'), { :acceptable_exit_codes => [0,1] }
+      on host, puppet('module install puppetlabs/apache --version ">=1.4.1 <2.0.0"'), { :acceptable_exit_codes => [0,1] }
+      puppet_module_install(:source => proj_root, :module_name => 'ceph')
       # Flush the firewall
       flushfw = <<-EOS
         iptables -F
diff --git a/ceph/spec/spec_helper_system.rb b/ceph/spec/spec_helper_system.rb
index ab82e0cb7..3f725cbf9 100644
--- a/ceph/spec/spec_helper_system.rb
+++ b/ceph/spec/spec_helper_system.rb
@@ -44,15 +44,15 @@
       puppet_module_install(:source => File.join(proj_root, '../scenario_node_terminus'),
                             :module_name => 'scenario_node_terminus',
                             :node => vm)
-      shell(:command => 'puppet module install --version 4.x puppetlabs/stdlib',
+      shell(:command => 'puppet module install --version ">=4.0.0 <5.0.0" puppetlabs/stdlib',
             :node => vm)
-      shell(:command => 'puppet module install --version 1.0.0 puppetlabs/inifile',
+      shell(:command => 'puppet module install --version ">=1.0.0 <2.0.0" puppetlabs/inifile',
             :node => vm)
-      shell(:command => 'puppet module install --version 1.4.0 puppetlabs/apt',
+      shell(:command => 'puppet module install --version ">=1.4.0 <2.0.0" puppetlabs/apt',
             :node => vm)
-      shell(:command => 'puppet module install --version 1.1.x puppetlabs/concat',
+      shell(:command => 'puppet module install --version ">=1.2.1 <2.0.0" puppetlabs/concat',
             :node => vm)
-      shell(:command => 'puppet module install --version 1.0.1 puppetlabs/apache',
+      shell(:command => 'puppet module install --version ">=1.4.1 <2.0.0" puppetlabs/apache',
             :node => vm)
       rcp(:sp => File.join(proj_root, 'spec/fixtures/hieradata/hiera.yaml'),
           :dp => '/etc/puppet/hiera.yaml',
diff --git a/ceph/spec/system/ceph_key_spec.rb b/ceph/spec/system/ceph_key_spec.rb
index 8e3fa645a..c18389c8d 100644
--- a/ceph/spec/system/ceph_key_spec.rb
+++ b/ceph/spec/system/ceph_key_spec.rb
@@ -67,7 +67,7 @@ class { 'ceph::repo':
 
         machines.each do |mon|
           puppet_apply(:node => mon, :code => pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
@@ -85,7 +85,7 @@ class { 'ceph::repo':
 
         machines.each do |mon|
           puppet_apply(:node => mon, :code => pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
@@ -117,33 +117,33 @@ class { 'ceph':
         EOS
 
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
 
         shell 'ceph auth list' do |r|
-          r.stdout.should_not =~ /client.admin/
-          r.exit_code.should be_zero
+          expect(r.stdout).not_to match(/client.admin/)
+          expect(r.exit_code).to be_zero
         end
 
         shell 'ls -l /etc/ceph/ceph.client.admin.keyring' do |r|
-          r.stdout.should =~ /.*-rw-------.*root\sroot.*/m
-          r.stderr.should be_empty
-          r.exit_code.should be_zero
+          expect(r.stdout).to match(/.*-rw-------.*root\sroot.*/m)
+          expect(r.stderr).to be_empty
+          expect(r.exit_code).to be_zero
         end
 
         shell 'cat /etc/ceph/ceph.client.admin.keyring' do |r|
-          r.stdout.should =~ /.*\[client.admin\].*key = #{admin_key}.*caps mds = "allow \*".*caps mon = "allow \*".*caps osd = "allow \*".*/m
-          r.stderr.should be_empty
-          r.exit_code.should be_zero
+          expect(r.stdout).to match(/.*\[client.admin\].*key = #{admin_key}.*caps mds = "allow \*".*caps mon = "allow \*".*caps osd = "allow \*".*/m)
+          expect(r.stderr).to be_empty
+          expect(r.exit_code).to be_zero
         end
 
       end
 
       it 'should uninstall one monitor and all packages' do
         puppet_apply(purge) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
       end
 
@@ -192,34 +192,34 @@ class { 'ceph':
         EOS
 
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should_not == 1
-          r.stdout.should_not =~ /Exec\[ceph-key-client\.admin\]/ # client.admin key needs to contain a / character!
+          expect(r.exit_code).not_to eq(1)
+          expect(r.stdout).not_to match(/Exec\[ceph-key-client\.admin\]/) # client.admin key needs to contain a / character!
         end
 
         shell 'ceph auth list' do |r|
-          r.stdout.should =~ /.*client\.volumes.*key:\s#{volume_key}.*/m
+          expect(r.stdout).to match(/.*client\.volumes.*key:\s#{volume_key}.*/m)
           # r.stderr.should be_empty # ceph auth writes to stderr!
-          r.exit_code.should be_zero
+          expect(r.exit_code).to be_zero
         end
 
         shell 'ls -l /etc/ceph/ceph.client.volumes.keyring' do |r|
-          r.stdout.should =~ /.*-rw-------.*nobody\s#{nogroup}.*/m
-          r.stderr.should be_empty
-          r.exit_code.should be_zero
+          expect(r.stdout).to match(/.*-rw-------.*nobody\s#{nogroup}.*/m)
+          expect(r.stderr).to be_empty
+          expect(r.exit_code).to be_zero
         end
 
         shell 'cat /etc/ceph/ceph.client.volumes.keyring' do |r|
-          r.stdout.should =~ /.*\[client.volumes\].*key = #{volume_key}.*caps mon = "allow \*".*caps osd = "allow rw".*/m
-          r.stderr.should be_empty
-          r.exit_code.should be_zero
+          expect(r.stdout).to match(/.*\[client.volumes\].*key = #{volume_key}.*caps mon = "allow \*".*caps osd = "allow rw".*/m)
+          expect(r.stderr).to be_empty
+          expect(r.exit_code).to be_zero
         end
       end
 
       it 'should uninstall one monitor and all packages' do
         puppet_apply(purge) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
       end
     end
diff --git a/ceph/spec/system/ceph_mon_spec.rb b/ceph/spec/system/ceph_mon_spec.rb
index 8d9939ba5..d0a4c93fd 100644
--- a/ceph/spec/system/ceph_mon_spec.rb
+++ b/ceph/spec/system/ceph_mon_spec.rb
@@ -40,7 +40,7 @@ class { 'ceph::repo':
 
         machines.each do |mon|
           puppet_apply(:node => mon, :code => pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
@@ -58,7 +58,7 @@ class { 'ceph::repo':
 
         machines.each do |mon|
           puppet_apply(:node => mon, :code => pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
@@ -78,15 +78,15 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph -s' do |r|
-            r.stdout.should =~ /1 mons at/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/1 mons at/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
@@ -98,9 +98,9 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should == 0
+            expect(r.exit_code).to eq(0)
           end
 
           osfamily = facter.facts['osfamily']
@@ -108,16 +108,16 @@ class { 'ceph':
 
           if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
             shell 'status ceph-mon id=a' do |r|
-              r.stdout.should be_empty
-              r.stderr.should =~ /Unknown instance: ceph.a/
-              r.exit_code.should_not be_zero
+              expect(r.stdout).to be_empty
+              expect(r.stderr).to match(/Unknown instance: ceph.a/)
+              expect(r.exit_code).not_to be_zero
             end
           end
           if osfamily == 'RedHat'
             shell 'service ceph status mon.a' do |r|
-              r.stdout.should =~ /mon.a not found/
-              r.stderr.should be_empty
-              r.exit_code.should_not be_zero
+              expect(r.stdout).to match(/mon.a not found/)
+              expect(r.stderr).to be_empty
+              expect(r.exit_code).not_to be_zero
             end
           end
         end
@@ -137,13 +137,13 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'test -z "$(cat /etc/ceph/ceph.client.admin.keyring)"' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
         end
 
@@ -155,9 +155,9 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should == 0
+            expect(r.exit_code).to eq(0)
           end
 
           osfamily = facter.facts['osfamily']
@@ -165,16 +165,16 @@ class { 'ceph':
 
           if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
             shell 'status ceph-mon id=a' do |r|
-              r.stdout.should be_empty
-              r.stderr.should =~ /Unknown instance: ceph.a/
-              r.exit_code.should_not be_zero
+              expect(r.stdout).to be_empty
+              expect(r.stderr).to match(/Unknown instance: ceph.a/)
+              expect(r.exit_code).not_to be_zero
             end
           end
           if osfamily == 'RedHat'
             shell 'service ceph status mon.a' do |r|
-              r.stdout.should =~ /mon.a not found/
-              r.stderr.should be_empty
-              r.exit_code.should_not be_zero
+              expect(r.stdout).to match(/mon.a not found/)
+              expect(r.stderr).to be_empty
+              expect(r.exit_code).not_to be_zero
             end
           end
         end
@@ -198,13 +198,13 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'test -f /etc/ceph/ceph.client.admin.keyring' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
         end
 
@@ -216,9 +216,9 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should == 0
+            expect(r.exit_code).to eq(0)
           end
 
           osfamily = facter.facts['osfamily']
@@ -226,16 +226,16 @@ class { 'ceph':
 
           if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
             shell 'status ceph-mon id=a' do |r|
-              r.stdout.should be_empty
-              r.stderr.should =~ /Unknown instance: ceph.a/
-              r.exit_code.should_not be_zero
+              expect(r.stdout).to be_empty
+              expect(r.stderr).to match(/Unknown instance: ceph.a/)
+              expect(r.exit_code).not_to be_zero
             end
           end
           if osfamily == 'RedHat'
             shell 'service ceph status mon.a' do |r|
-              r.stdout.should =~ /mon.a not found/
-              r.stderr.should be_empty
-              r.exit_code.should_not be_zero
+              expect(r.stdout).to match(/mon.a not found/)
+              expect(r.stderr).to be_empty
+              expect(r.exit_code).not_to be_zero
             end
           end
         end
@@ -243,7 +243,7 @@ class { 'ceph':
 
       describe 'on two hosts' do
         it 'should be two hosts' do
-          machines.size.should == 2
+          expect(machines.size).to eq(2)
         end
 
         it 'should install two monitors' do
@@ -262,16 +262,16 @@ class { 'ceph':
             EOS
 
             puppet_apply(:node => mon, :code => pp) do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
               r.refresh
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
           end
 
           shell 'ceph -s' do |r|
-            r.stdout.should =~ /2 mons .* quorum 0,1/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/2 mons .* quorum 0,1/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
@@ -284,9 +284,9 @@ class { 'ceph':
             EOS
 
             puppet_apply(:node => mon, :code => pp) do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
               r.refresh
-              r.exit_code.should == 0
+              expect(r.exit_code).to eq(0)
             end
 
             osfamily = facter.facts['osfamily']
@@ -294,16 +294,16 @@ class { 'ceph':
 
             if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
               shell "status ceph-mon id=#{mon}" do |r|
-                r.stdout.should be_empty
-                r.stderr.should =~ /Unknown instance: ceph.#{mon}/
-                r.exit_code.should_not be_zero
+                expect(r.stdout).to be_empty
+                expect(r.stderr).to match(/Unknown instance: ceph.#{mon}/)
+                expect(r.exit_code).not_to be_zero
               end
             end
             if osfamily == 'RedHat'
               shell "service ceph status mon.#{mon}" do |r|
-                r.stdout.should =~ /mon.#{mon} not found/
-                r.stderr.should be_empty
-                r.exit_code.should_not be_zero
+                expect(r.stdout).to match(/mon.#{mon} not found/)
+                expect(r.stderr).to be_empty
+                expect(r.exit_code).not_to be_zero
               end
             end
           end
diff --git a/ceph/spec/system/ceph_mons_spec.rb b/ceph/spec/system/ceph_mons_spec.rb
index 745e05815..6894edf99 100644
--- a/ceph/spec/system/ceph_mons_spec.rb
+++ b/ceph/spec/system/ceph_mons_spec.rb
@@ -117,15 +117,15 @@
             end
 
             puppet_apply(data_site_pp) do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
               r.refresh
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
 
             shell 'ceph -s' do |r|
-              r.stdout.should =~ /1 mons at/
-              r.stderr.should be_empty
-              r.exit_code.should be_zero
+              expect(r.stdout).to match(/1 mons at/)
+              expect(r.stderr).to be_empty
+              expect(r.exit_code).to be_zero
             end
           end
 
@@ -146,7 +146,7 @@
             end
 
             puppet_apply(data_site_pp) do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
 
             osfamily = facter.facts['osfamily']
@@ -154,16 +154,16 @@
 
             if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
               shell 'status ceph-mon id=first' do |r|
-                r.stdout.should be_empty
-                r.stderr.should =~ /status: Unknown job: ceph-mon/
-                r.exit_code.should_not be_zero
+                expect(r.stdout).to be_empty
+                expect(r.stderr).to match(/status: Unknown job: ceph-mon/)
+                expect(r.exit_code).not_to be_zero
               end
             end
             if osfamily == 'RedHat'
               shell 'service ceph status mon.first' do |r|
-                r.stdout.should be_empty
-                r.stderr.should =~ /ceph: unrecognized service/
-                r.exit_code.should_not be_zero
+                expect(r.stdout).to be_empty
+                expect(r.stderr).to match(/ceph: unrecognized service/)
+                expect(r.exit_code).not_to be_zero
               end
             end
           end
@@ -201,26 +201,26 @@
             end
 
             puppet_apply(data_site_pp) do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
               r.refresh
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
 
             shell 'cat /etc/ceph/ceph.client.admin.keyring' do |r|
-              r.stdout.should =~ /#{admin_key}/
-              r.stderr.should be_empty
-              r.exit_code.should be_zero
+              expect(r.stdout).to match(/#{admin_key}/)
+              expect(r.stderr).to be_empty
+              expect(r.exit_code).to be_zero
             end
 
             shell 'ceph -s' do |r|
-              r.stdout.should =~ /1 mons at/
-              r.stderr.should be_empty
-              r.exit_code.should be_zero
+              expect(r.stdout).to match(/1 mons at/)
+              expect(r.stderr).to be_empty
+              expect(r.exit_code).to be_zero
             end
 
             shell 'ceph auth list' do |r|
-              r.stdout.should =~ /#{admin_key}/
-              r.exit_code.should be_zero
+              expect(r.stdout).to match(/#{admin_key}/)
+              expect(r.exit_code).to be_zero
             end
           end
 
@@ -242,7 +242,7 @@
             end
 
             puppet_apply(data_site_pp) do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
 
             osfamily = facter.facts['osfamily']
@@ -250,16 +250,16 @@
 
             if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
               shell 'status ceph-mon id=first' do |r|
-                r.stdout.should be_empty
-                r.stderr.should =~ /status: Unknown job: ceph-mon/
-                r.exit_code.should_not be_zero
+                expect(r.stdout).to be_empty
+                expect(r.stderr).to match(/status: Unknown job: ceph-mon/)
+                expect(r.exit_code).not_to be_zero
               end
             end
             if osfamily == 'RedHat'
               shell 'service ceph status mon.first' do |r|
-                r.stdout.should be_empty
-                r.stderr.should =~ /ceph: unrecognized service/
-                r.exit_code.should_not be_zero
+                expect(r.stdout).to be_empty
+                expect(r.stderr).to match(/ceph: unrecognized service/)
+                expect(r.exit_code).not_to be_zero
               end
             end
           end
@@ -282,7 +282,7 @@
 
       machines.each do |vm|
         puppet_apply(:node => vm, :code => pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
 
         rcp(:sp => snt_data, :dp => data_path, :d => node(:name => vm))
@@ -334,15 +334,15 @@
             end
 
             puppet_apply('') do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
               r.refresh
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
 
             shell 'ceph -s' do |r|
-              r.stdout.should =~ /1 mons at/
-                r.stderr.should be_empty
-              r.exit_code.should be_zero
+              expect(r.stdout).to match(/1 mons at/)
+                expect(r.stderr).to be_empty
+              expect(r.exit_code).to be_zero
             end
           end
 
@@ -359,7 +359,7 @@
             end
 
             puppet_apply('') do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
 
             osfamily = facter.facts['osfamily']
@@ -367,16 +367,16 @@
 
             if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
               shell 'status ceph-mon id=first' do |r|
-                r.stdout.should be_empty
-                r.stderr.should =~ /status: Unknown job: ceph-mon/
-                  r.exit_code.should_not be_zero
+                expect(r.stdout).to be_empty
+                expect(r.stderr).to match(/status: Unknown job: ceph-mon/)
+                  expect(r.exit_code).not_to be_zero
               end
             end
             if osfamily == 'RedHat'
               shell 'service ceph status mon.first' do |r|
-                r.stdout.should be_empty
-                r.stderr.should =~ /ceph: unrecognized service/
-                  r.exit_code.should_not be_zero
+                expect(r.stdout).to be_empty
+                expect(r.stderr).to match(/ceph: unrecognized service/)
+                  expect(r.exit_code).not_to be_zero
               end
             end
           end
@@ -416,26 +416,26 @@
             end
 
             puppet_apply('') do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
               r.refresh
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
 
             shell 'cat /etc/ceph/ceph.client.admin.keyring' do |r|
-              r.stdout.should =~ /#{admin_key}/
-                r.stderr.should be_empty
-              r.exit_code.should be_zero
+              expect(r.stdout).to match(/#{admin_key}/)
+                expect(r.stderr).to be_empty
+              expect(r.exit_code).to be_zero
             end
 
             shell 'ceph -s' do |r|
-              r.stdout.should =~ /1 mons at/
-                r.stderr.should be_empty
-              r.exit_code.should be_zero
+              expect(r.stdout).to match(/1 mons at/)
+                expect(r.stderr).to be_empty
+              expect(r.exit_code).to be_zero
             end
 
             shell 'ceph auth list' do |r|
-              r.stdout.should =~ /#{admin_key}/
-                r.exit_code.should be_zero
+              expect(r.stdout).to match(/#{admin_key}/)
+                expect(r.exit_code).to be_zero
             end
           end
 
@@ -452,7 +452,7 @@
             end
 
             puppet_apply('') do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
 
             osfamily = facter.facts['osfamily']
@@ -460,16 +460,16 @@
 
             if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
               shell 'status ceph-mon id=first' do |r|
-                r.stdout.should be_empty
-                r.stderr.should =~ /status: Unknown job: ceph-mon/
-                  r.exit_code.should_not be_zero
+                expect(r.stdout).to be_empty
+                expect(r.stderr).to match(/status: Unknown job: ceph-mon/)
+                  expect(r.exit_code).not_to be_zero
               end
             end
             if osfamily == 'RedHat'
               shell 'service ceph status mon.first' do |r|
-                r.stdout.should be_empty
-                r.stderr.should =~ /ceph: unrecognized service/
-                  r.exit_code.should_not be_zero
+                expect(r.stdout).to be_empty
+                expect(r.stderr).to match(/ceph: unrecognized service/)
+                  expect(r.exit_code).not_to be_zero
               end
             end
           end
diff --git a/ceph/spec/system/ceph_osd_spec.rb b/ceph/spec/system/ceph_osd_spec.rb
index d5e3ebf38..5f67f1eea 100644
--- a/ceph/spec/system/ceph_osd_spec.rb
+++ b/ceph/spec/system/ceph_osd_spec.rb
@@ -56,7 +56,7 @@ class { 'ceph::repo':
 
         machines.each do |mon|
           puppet_apply(:node => mon, :code => pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
@@ -74,7 +74,7 @@ class { 'ceph::repo':
 
         machines.each do |mon|
           puppet_apply(:node => mon, :code => pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
@@ -98,22 +98,22 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
 
         end
 
         it 'should uninstall one osd' do
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should_not be_zero
+            expect(r.exit_code).not_to be_zero
           end
 
           pp = <<-EOS
@@ -123,20 +123,20 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should == 0
+            expect(r.exit_code).to eq(0)
           end
 
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
           shell "test -b #{data} && ceph-disk zap #{data}"
         end
 
         it 'should uninstall one monitor and all packages' do
           puppet_apply(purge) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
 
@@ -172,21 +172,21 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
         it 'should uninstall one osd' do
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should_not be_zero
+            expect(r.exit_code).not_to be_zero
           end
 
           pp = <<-EOS
@@ -194,13 +194,13 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should == 0
+            expect(r.exit_code).to eq(0)
           end
 
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
 
           shell "test -b #{data} && ceph-disk zap #{data}"
@@ -208,7 +208,7 @@ class { 'ceph':
 
         it 'should uninstall one monitor and all packages' do
           puppet_apply(purge) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
 
@@ -233,21 +233,21 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
         it 'should uninstall one osd and external journal' do
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should_not be_zero
+            expect(r.exit_code).not_to be_zero
           end
 
           pp = <<-EOS
@@ -255,26 +255,26 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should == 0
+            expect(r.exit_code).to eq(0)
           end
 
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
           shell "test -b #{data} && ceph-disk zap #{data}"
         end
 
         it 'should uninstall one monitor and all packages' do
           puppet_apply(purge) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
 
         it 'should install one OSD no cephx on a partition' do
           shell 'sgdisk --largest-new=1 --change-name="1:ceph data" --partition-guid=1:7aebb13f-d4a5-4b94-8622-355d2b5401f1 --typecode=1:4fbd7e29-9d25-41b8-afd0-062c0ceff05d -- /dev/sdb' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
 
           pp = <<-EOS
@@ -294,21 +294,21 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
         it 'should uninstall one osd' do
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should_not be_zero
+            expect(r.exit_code).not_to be_zero
           end
 
           pp = <<-EOS
@@ -318,20 +318,20 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should == 0
+            expect(r.exit_code).to eq(0)
           end
 
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
           shell 'ceph-disk zap /dev/sdb'
         end
 
         it 'should install one OSD no cephx on partition and activate after umount' do
           shell 'sgdisk --delete=1 /dev/sdb || true; sgdisk --largest-new=1 --change-name="1:ceph data" --partition-guid=1:7aebb13f-d4a5-4b94-8622-355d2b5401f1 --typecode=1:4fbd7e29-9d25-41b8-afd0-062c0ceff05d -- /dev/sdb' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
 
           pp = <<-EOS
@@ -351,41 +351,41 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
 
           # stop and umount (but leave it prepared)
           shell 'stop ceph-osd id=0 || /etc/init.d/ceph stop osd.0; umount /dev/sdb1' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
 
           # rerun puppet (should activate but not prepare)
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           # check osd up and same osd.id
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0\s*up/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0\s*up/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
 
         end
 
         it 'should uninstall one osd' do
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should_not be_zero
+            expect(r.exit_code).not_to be_zero
           end
 
           pp = <<-EOS
@@ -395,20 +395,20 @@ class { 'ceph':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should == 0
+            expect(r.exit_code).to eq(0)
           end
 
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
           shell 'ceph-disk zap /dev/sdb'
         end
 
         it 'should uninstall one monitor and all packages' do
           puppet_apply(purge) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
diff --git a/ceph/spec/system/ceph_osds_spec.rb b/ceph/spec/system/ceph_osds_spec.rb
index 9df41a206..d398d4553 100644
--- a/ceph/spec/system/ceph_osds_spec.rb
+++ b/ceph/spec/system/ceph_osds_spec.rb
@@ -52,7 +52,7 @@
 
     machines.each do |vm|
       puppet_apply(:node => vm, :code => pp) do |r|
-        r.exit_code.should_not == 1
+        expect(r.exit_code).not_to eq(1)
       end
 
       rcp(:sp => data, :dp => data_path, :d => node(:name => vm))
@@ -114,7 +114,7 @@
 
         machines.each do |vm|
           puppet_apply('') do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell(:node => vm, :command => 'test -b /dev/sdb && sgdisk --zap-all --clear --mbrtogpt -- /dev/sdb')
@@ -148,15 +148,15 @@
           end
 
           puppet_apply('') do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
       end
@@ -199,15 +199,15 @@
           end
 
           puppet_apply('') do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
       end
diff --git a/ceph/spec/system/ceph_pool_spec.rb b/ceph/spec/system/ceph_pool_spec.rb
index a1ca42778..93c8eabbf 100644
--- a/ceph/spec/system/ceph_pool_spec.rb
+++ b/ceph/spec/system/ceph_pool_spec.rb
@@ -46,7 +46,7 @@ class { 'ceph':
         EOS
 
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
       end
 
@@ -66,7 +66,7 @@ class { 'ceph::repo':
         EOS
 
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
       end
 
@@ -80,27 +80,27 @@ class { 'ceph::repo':
         EOS
 
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should == 0
+          expect(r.exit_code).to eq(0)
         end
 
         shell 'ceph osd pool get volumes pg_num' do |r|
-          r.stdout.should =~ /pg_num: 64/
-          r.stderr.should be_empty
-          r.exit_code.should be_zero
+          expect(r.stdout).to match(/pg_num: 64/)
+          expect(r.stderr).to be_empty
+          expect(r.exit_code).to be_zero
         end
 
         shell 'ceph osd pool get volumes pgp_num' do |r|
-          r.stdout.should =~ /pgp_num: 64/
-          r.stderr.should be_empty
-          r.exit_code.should be_zero
+          expect(r.stdout).to match(/pgp_num: 64/)
+          expect(r.stderr).to be_empty
+          expect(r.exit_code).to be_zero
         end
 
         shell 'ceph osd pool get volumes size' do |r|
-          r.stdout.should =~ /size: 3/
-          r.stderr.should be_empty
-          r.exit_code.should be_zero
+          expect(r.stdout).to match(/size: 3/)
+          expect(r.stderr).to be_empty
+          expect(r.exit_code).to be_zero
         end
 
       end
@@ -115,9 +115,9 @@ class { 'ceph::repo':
         EOS
 
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should == 0
+          expect(r.exit_code).to eq(0)
         end
 
         pp2 = <<-EOS
@@ -127,15 +127,15 @@ class { 'ceph::repo':
         EOS
 
         puppet_apply(pp2) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should == 0
+          expect(r.exit_code).to eq(0)
         end
 
         shell 'ceph osd lspools | grep volumes' do |r|
-          r.stdout.should be_empty
-          r.stderr.should be_empty
-          r.exit_code.should_not be_zero
+          expect(r.stdout).to be_empty
+          expect(r.stderr).to be_empty
+          expect(r.exit_code).not_to be_zero
         end
 
       end
diff --git a/ceph/spec/system/ceph_profile_base_spec.rb b/ceph/spec/system/ceph_profile_base_spec.rb
index 13a7d9608..4f27becd3 100644
--- a/ceph/spec/system/ceph_profile_base_spec.rb
+++ b/ceph/spec/system/ceph_profile_base_spec.rb
@@ -54,7 +54,7 @@ class { 'ceph::repo':
 
         machines.each do |vm|
           puppet_apply(:node => vm, :code => pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
@@ -93,21 +93,21 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'cat /etc/ceph/ceph.conf' do |r|
-            r.stdout.should =~ /#{fsid}/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/#{fsid}/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
 
           shell querycommand do |r|
-            r.stdout.should =~ /#{queryresult}/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/#{queryresult}/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
       end
diff --git a/ceph/spec/system/ceph_profile_client_spec.rb b/ceph/spec/system/ceph_profile_client_spec.rb
index 435484c31..ce7d47d71 100644
--- a/ceph/spec/system/ceph_profile_client_spec.rb
+++ b/ceph/spec/system/ceph_profile_client_spec.rb
@@ -62,7 +62,7 @@ class { 'ceph::repo':
 
         machines.each do |vm|
           puppet_apply(:node => vm, :code => pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
@@ -104,37 +104,37 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph -s' do |r|
-            r.stdout.should =~ /1 mons .* quorum 0 first/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/1 mons .* quorum 0 first/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
 
           shell 'ceph -n client.volumes -s' do |r|
-            r.stdout.should =~ /1 mons .* quorum 0 first/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/1 mons .* quorum 0 first/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
 
           shell 'ceph auth list' do |r|
-            r.stdout.should =~ /#{admin_key}/
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/#{admin_key}/)
+            expect(r.exit_code).to be_zero
           end
 
           shell 'ceph auth list' do |r|
-            r.stdout.should =~ /#{volumes_key}/
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/#{volumes_key}/)
+            expect(r.exit_code).to be_zero
           end
         end
 
         it 'should uninstall one monitor' do
           puppet_apply(purge) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
@@ -201,31 +201,31 @@ class { 'ceph::repo':
             end
 
             puppet_apply(:node => vm, :code => pp) do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
               r.refresh
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
           end
 
           ['first', 'second'].each do |vm|
             if vm == "first"
               shell 'ceph -s' do |r|
-                r.stdout.should =~ /1 mons .* quorum 0 first/
-                r.stderr.should be_empty
-                r.exit_code.should be_zero
+                expect(r.stdout).to match(/1 mons .* quorum 0 first/)
+                expect(r.stderr).to be_empty
+                expect(r.exit_code).to be_zero
               end
 
               shell 'ceph auth list' do |r|
-                r.stdout.should =~ /#{admin_key}/
-                r.exit_code.should be_zero
+                expect(r.stdout).to match(/#{admin_key}/)
+                expect(r.exit_code).to be_zero
               end
             end
 
             if vm == "second"
               shell 'ceph -n client.volumes -s' do |r|
-                r.stdout.should =~ /1 mons .* quorum 0 first/
-                r.stderr.should be_empty
-                r.exit_code.should be_zero
+                expect(r.stdout).to match(/1 mons .* quorum 0 first/)
+                expect(r.stderr).to be_empty
+                expect(r.exit_code).to be_zero
               end
             end
           end
@@ -234,7 +234,7 @@ class { 'ceph::repo':
         it 'should uninstall one monitor' do
           [ 'second', 'first' ].each do |vm|
             puppet_apply(:node => vm, :code => purge) do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
           end
         end
diff --git a/ceph/spec/system/ceph_profile_mon_spec.rb b/ceph/spec/system/ceph_profile_mon_spec.rb
index 69fc2658a..68541fb3b 100644
--- a/ceph/spec/system/ceph_profile_mon_spec.rb
+++ b/ceph/spec/system/ceph_profile_mon_spec.rb
@@ -48,7 +48,7 @@ class { 'ceph::repo':
 
         machines.each do |vm|
           puppet_apply(:node => vm, :code => pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
@@ -76,15 +76,15 @@ class { 'ceph::repo':
            EOS
 
            puppet_apply(pp) do |r|
-             r.exit_code.should_not == 1
+             expect(r.exit_code).not_to eq(1)
              r.refresh
-             r.exit_code.should_not == 1
+             expect(r.exit_code).not_to eq(1)
            end
 
            shell 'ceph -s' do |r|
-             r.stdout.should =~ /1 mons .* quorum 0 first/
-             r.stderr.should be_empty
-             r.exit_code.should be_zero
+             expect(r.stdout).to match(/1 mons .* quorum 0 first/)
+             expect(r.stderr).to be_empty
+             expect(r.exit_code).to be_zero
            end
         end
 
@@ -96,7 +96,7 @@ class { 'ceph::repo':
          EOS
 
          puppet_apply(pp) do |r|
-           r.exit_code.should_not == 1
+           expect(r.exit_code).not_to eq(1)
          end
 
           osfamily = facter.facts['osfamily']
@@ -104,16 +104,16 @@ class { 'ceph::repo':
 
           if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
             shell 'status ceph-mon id=first' do |r|
-              r.stdout.should be_empty
-              r.stderr.should =~ /Unknown instance: ceph.first/
-              r.exit_code.should_not be_zero
+              expect(r.stdout).to be_empty
+              expect(r.stderr).to match(/Unknown instance: ceph.first/)
+              expect(r.exit_code).not_to be_zero
             end
           end
           if osfamily == 'RedHat'
             shell 'service ceph status mon.first' do |r|
-              r.stdout.should =~ /mon.first not found/
-              r.stderr.should be_empty
-              r.exit_code.should_not be_zero
+              expect(r.stdout).to match(/mon.first not found/)
+              expect(r.stderr).to be_empty
+              expect(r.exit_code).not_to be_zero
             end
           end
         end
@@ -150,20 +150,20 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph -s' do |r|
-            r.stdout.should =~ /1 mons .* quorum 0 first/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/1 mons .* quorum 0 first/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
 
           shell 'ceph auth list' do |r|
-            r.stdout.should =~ /#{admin_key}/
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/#{admin_key}/)
+            expect(r.exit_code).to be_zero
           end
         end
 
@@ -175,7 +175,7 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           osfamily = facter.facts['osfamily']
@@ -183,16 +183,16 @@ class { 'ceph::repo':
 
           if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
             shell 'status ceph-mon id=first' do |r|
-              r.stdout.should be_empty
-              r.stderr.should =~ /Unknown instance: ceph.first/
-              r.exit_code.should_not be_zero
+              expect(r.stdout).to be_empty
+              expect(r.stderr).to match(/Unknown instance: ceph.first/)
+              expect(r.exit_code).not_to be_zero
             end
           end
           if osfamily == 'RedHat'
             shell 'service ceph status mon.first' do |r|
-              r.stdout.should =~ /mon.first not found/
-              r.stderr.should be_empty
-              r.exit_code.should_not be_zero
+              expect(r.stdout).to match(/mon.first not found/)
+              expect(r.stderr).to be_empty
+              expect(r.exit_code).not_to be_zero
             end
           end
         end
@@ -232,20 +232,20 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
           shell 'ceph -s' do |r|
-            r.stdout.should =~ /1 mons .* quorum 0 first/
+            expect(r.stdout).to match(/1 mons .* quorum 0 first/)
 
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
 
           shell 'ceph auth list' do |r|
-            r.stdout.should =~ /#{admin_key}/
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/#{admin_key}/)
+            expect(r.exit_code).to be_zero
           end
         end
 
@@ -257,7 +257,7 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           osfamily = facter.facts['osfamily']
@@ -265,16 +265,16 @@ class { 'ceph::repo':
 
           if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
             shell 'status ceph-mon id=first' do |r|
-              r.stdout.should be_empty
-              r.stderr.should =~ /Unknown instance: ceph.first/
-              r.exit_code.should_not be_zero
+              expect(r.stdout).to be_empty
+              expect(r.stderr).to match(/Unknown instance: ceph.first/)
+              expect(r.exit_code).not_to be_zero
             end
           end
           if osfamily == 'RedHat'
             shell 'service ceph status mon.first' do |r|
-              r.stdout.should =~ /mon.first not found/
-              r.stderr.should be_empty
-              r.exit_code.should_not be_zero
+              expect(r.stdout).to match(/mon.first not found/)
+              expect(r.stderr).to be_empty
+              expect(r.exit_code).not_to be_zero
             end
           end
         end
@@ -282,7 +282,7 @@ class { 'ceph::repo':
 
       describe 'on two hosts' do
         it 'should be two hosts' do
-          machines.size.should == 2
+          expect(machines.size).to eq(2)
         end
 
         it 'should install two monitors' do
@@ -309,16 +309,16 @@ class { 'ceph::repo':
             EOS
 
             puppet_apply(:node => mon, :code => pp) do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
               r.refresh
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
           end
 
           shell 'ceph -s' do |r|
-            r.stdout.should =~ /2 mons .* quorum 0,1 first,second/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/2 mons .* quorum 0,1 first,second/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
@@ -331,7 +331,7 @@ class { 'ceph::repo':
             EOS
 
             puppet_apply(:node => mon, :code => pp) do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
 
             osfamily = facter.facts['osfamily']
@@ -339,16 +339,16 @@ class { 'ceph::repo':
 
             if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
               shell "status ceph-mon id=#{mon}" do |r|
-                r.stdout.should be_empty
-                r.stderr.should =~ /Unknown instance: ceph.#{mon}/
-                r.exit_code.should_not be_zero
+                expect(r.stdout).to be_empty
+                expect(r.stderr).to match(/Unknown instance: ceph.#{mon}/)
+                expect(r.exit_code).not_to be_zero
               end
             end
             if osfamily == 'RedHat'
               shell "service ceph status mon.#{mon}" do |r|
-                r.stdout.should =~ /mon.#{mon} not found/
-                r.stderr.should be_empty
-                r.exit_code.should_not be_zero
+                expect(r.stdout).to match(/mon.#{mon} not found/)
+                expect(r.stderr).to be_empty
+                expect(r.exit_code).not_to be_zero
               end
             end
           end
diff --git a/ceph/spec/system/ceph_profile_osd_spec.rb b/ceph/spec/system/ceph_profile_osd_spec.rb
index a2de9c54f..dd1da3715 100644
--- a/ceph/spec/system/ceph_profile_osd_spec.rb
+++ b/ceph/spec/system/ceph_profile_osd_spec.rb
@@ -61,7 +61,7 @@ class { 'ceph::repo':
 
         machines.each do |vm|
           puppet_apply(:node => vm, :code => pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
@@ -90,21 +90,21 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0/
-              r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0/)
+              expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
         it 'should uninstall one osd' do
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should_not be_zero
+            expect(r.exit_code).not_to be_zero
           end
 
           pp = <<-EOS
@@ -114,18 +114,18 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
           shell 'ceph-disk zap /dev/sdb'
         end
 
         it 'should uninstall one monitor' do
           puppet_apply(purge) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
 
@@ -153,21 +153,21 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0/
-              r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0/)
+              expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
         it 'should uninstall one osd' do
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should_not be_zero
+            expect(r.exit_code).not_to be_zero
           end
 
           pp = <<-EOS
@@ -175,18 +175,18 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
           shell 'ceph-disk zap /dev/sdb'
         end
 
         it 'should uninstall one monitor' do
           puppet_apply(purge) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
 
@@ -225,21 +225,21 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
             r.refresh
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0/
-              r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0/)
+              expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
         it 'should uninstall one osd' do
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should_not be_zero
+            expect(r.exit_code).not_to be_zero
           end
 
           pp = <<-EOS
@@ -247,11 +247,11 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
 
           shell 'ceph-disk zap /dev/sdb'
@@ -259,7 +259,7 @@ class { 'ceph::repo':
 
         it 'should uninstall one monitor and all packages' do
           puppet_apply(purge) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
@@ -296,28 +296,28 @@ class { 'ceph::repo':
             end
 
             puppet_apply(:node => vm, :code => pp) do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
               r.refresh
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
           end
 
           shell 'ceph -s' do |r|
-            r.stdout.should =~ /1 mons .* quorum 0 first/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/1 mons .* quorum 0 first/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
 
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
         it 'should uninstall one osd on second host' do
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should_not be_zero
+            expect(r.exit_code).not_to be_zero
           end
 
           pp = <<-EOS
@@ -325,23 +325,23 @@ class { 'ceph::repo':
           EOS
 
           puppet_apply(:node => 'second', :code => pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
 
           shell(:node => 'second', :command => 'ceph-disk zap /dev/sdb')
 
           puppet_apply(:node => 'second', :code => purge) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
 
         it 'should uninstall one monitor on first host' do
           puppet_apply(purge) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
 
@@ -388,28 +388,28 @@ class { 'ceph::repo':
             end
 
             puppet_apply(:node => vm, :code => pp) do |r|
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
               r.refresh
-              r.exit_code.should_not == 1
+              expect(r.exit_code).not_to eq(1)
             end
           end
 
           shell 'ceph -s' do |r|
-            r.stdout.should =~ /1 mons .* quorum 0 first/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/1 mons .* quorum 0 first/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
 
           shell 'ceph osd tree' do |r|
-            r.stdout.should =~ /osd.0/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/osd.0/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
         it 'should uninstall one osd on second host' do
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should_not be_zero
+            expect(r.exit_code).not_to be_zero
           end
 
           pp = <<-EOS
@@ -420,23 +420,23 @@ class { '::ceph::profile::client': } ->
           EOS
 
           puppet_apply(:node => 'second', :code => pp) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
 
           shell 'ceph osd tree | grep DNE' do |r|
-            r.exit_code.should be_zero
+            expect(r.exit_code).to be_zero
           end
 
           shell(:node => 'second', :command => 'ceph-disk zap /dev/sdb')
 
           puppet_apply(:node => 'second', :code => purge) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
 
         it 'should uninstall one monitor' do
           puppet_apply(purge) do |r|
-            r.exit_code.should_not == 1
+            expect(r.exit_code).not_to eq(1)
           end
         end
       end
diff --git a/ceph/spec/system/ceph_repo_spec.rb b/ceph/spec/system/ceph_repo_spec.rb
index c20dfcb03..2d43f08f9 100644
--- a/ceph/spec/system/ceph_repo_spec.rb
+++ b/ceph/spec/system/ceph_repo_spec.rb
@@ -46,7 +46,7 @@ class { 'ceph::repo':
       EOS
 
       puppet_apply(pp) do |r|
-        r.exit_code.should_not == 1
+        expect(r.exit_code).not_to eq(1)
       end
     end
 
@@ -54,33 +54,33 @@ class { 'ceph::repo':
 
     if osfamily == 'Debian'
       shell 'apt-cache policy ceph' do |r|
-        r.stdout.should_not =~ /ceph.com/
-        r.stderr.should be_empty
-        r.exit_code.should be_zero
+        expect(r.stdout).not_to match(/ceph.com/)
+        expect(r.stderr).to be_empty
+        expect(r.exit_code).to be_zero
       end
       shell 'apt-cache policy curl' do |r|
-        r.stdout.should_not =~ /ceph.com/
-        r.exit_code.should be_zero
+        expect(r.stdout).not_to match(/ceph.com/)
+        expect(r.exit_code).to be_zero
       end
       shell 'apt-cache policy libapache2-mod-fastcgi' do |r|
-        r.stdout.should_not =~ /ceph.com/
-        r.exit_code.should be_zero
+        expect(r.stdout).not_to match(/ceph.com/)
+        expect(r.exit_code).to be_zero
       end
     end
     if osfamily == 'RedHat'
       shell 'yum info ceph' do |r|
-        r.stdout.should_not =~ /ceph.com/
-        r.stderr.should =~ /Error: No matching Packages to list/
-        r.exit_code.should_not be_zero
+        expect(r.stdout).not_to match(/ceph.com/)
+        expect(r.stderr).to match(/Error: No matching Packages to list/)
+        expect(r.exit_code).not_to be_zero
       end
       shell 'yum info qemu-kvm' do |r|
-        r.stdout.should_not =~ /Repo.*ext-ceph-extras/
-        r.exit_code.should be_zero
+        expect(r.stdout).not_to match(/Repo.*ext-ceph-extras/)
+        expect(r.exit_code).to be_zero
       end
       shell 'yum info mod_fastcgi' do |r|
-        r.stdout.should_not =~ /Repo.*ext-ceph-fastcgi/
-        r.stderr.should =~ /Error: No matching Packages to list/
-        r.exit_code.should_not be_zero
+        expect(r.stdout).not_to match(/Repo.*ext-ceph-fastcgi/)
+        expect(r.stderr).to match(/Error: No matching Packages to list/)
+        expect(r.exit_code).not_to be_zero
       end
     end
   end
@@ -116,28 +116,28 @@ class { 'ceph::repo':
 
         # Run it twice and test for idempotency
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
 
         shell querycommand do |r|
-          r.stdout.should =~ /#{queryresult}/
-          r.stderr.should be_empty
-          r.exit_code.should be_zero
+          expect(r.stdout).to match(/#{queryresult}/)
+          expect(r.stderr).to be_empty
+          expect(r.exit_code).to be_zero
         end
 
         # Test extras is not enabled
         if osfamily == 'Debian'
           shell 'apt-cache policy curl' do |r|
-            r.stdout.should_not =~ /ceph\.com.*ceph-extras/
-            r.exit_code.should be_zero
+            expect(r.stdout).not_to match(/ceph\.com.*ceph-extras/)
+            expect(r.exit_code).to be_zero
           end
         end
         if osfamily == 'RedHat'
           shell 'yum info qemu-kvm' do |r|
-            r.stdout.should_not =~ /Repo.*ext-ceph-extras/
-            r.exit_code.should be_zero
+            expect(r.stdout).not_to match(/Repo.*ext-ceph-extras/)
+            expect(r.exit_code).to be_zero
           end
         end
 
@@ -151,23 +151,23 @@ class { 'ceph::repo':
 
         # Run it twice and test for idempotency
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
 
         if osfamily == 'Debian'
           shell querycommand do |r|
-            r.stdout.should_not =~ /ceph.com/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).not_to match(/ceph.com/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
         if osfamily == 'RedHat'
           shell querycommand do |r|
-            r.stdout.should_not =~ /ceph.com/
-            r.stderr.should =~ /Error: No matching Packages to list/
-            r.exit_code.should_not be_zero
+            expect(r.stdout).not_to match(/ceph.com/)
+            expect(r.stderr).to match(/Error: No matching Packages to list/)
+            expect(r.exit_code).not_to be_zero
           end
         end
       end
@@ -184,24 +184,24 @@ class { 'ceph::repo':
 
         # Run it twice and test for idempotency
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
 
         # Test for a package in ceph-extras (curl/qemu-kvm)
         if osfamily == 'Debian'
           shell 'apt-cache policy curl' do |r|
-            r.stdout.should =~ /ceph\.com.*ceph-extras/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/ceph\.com.*ceph-extras/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
         if osfamily == 'RedHat'
           shell 'yum info qemu-kvm' do |r|
-            r.stdout.should =~ /Repo.*ext-ceph-extras/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/Repo.*ext-ceph-extras/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
@@ -216,21 +216,21 @@ class { 'ceph::repo':
 
         # Run it twice and test for idempotency
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
 
         if osfamily == 'Debian'
           shell 'apt-cache policy curl' do |r|
-            r.stdout.should_not =~ /ceph.com/
-            r.exit_code.should be_zero
+            expect(r.stdout).not_to match(/ceph.com/)
+            expect(r.exit_code).to be_zero
           end
         end
         if osfamily == 'RedHat'
           shell 'yum info qemu-kvm' do |r|
-            r.stdout.should_not =~ /Repo.*ext-ceph-extras/
-            r.exit_code.should be_zero
+            expect(r.stdout).not_to match(/Repo.*ext-ceph-extras/)
+            expect(r.exit_code).to be_zero
           end
         end
       end
@@ -247,24 +247,24 @@ class { 'ceph::repo':
 
         # Run it twice and test for idempotency
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
 
         # Test fastcgi in ceph-fastcgi
         if osfamily == 'Debian'
           shell 'apt-cache policy libapache2-mod-fastcgi' do |r|
-            r.stdout.should =~ /ceph.com/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/ceph.com/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
         if osfamily == 'RedHat'
           shell 'yum info mod_fastcgi' do |r|
-            r.stdout.should =~ /Repo.*ext-ceph-fastcgi/
-            r.stderr.should be_empty
-            r.exit_code.should be_zero
+            expect(r.stdout).to match(/Repo.*ext-ceph-fastcgi/)
+            expect(r.stderr).to be_empty
+            expect(r.exit_code).to be_zero
           end
         end
 
@@ -279,22 +279,22 @@ class { 'ceph::repo':
 
         # Run it twice and test for idempotency
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
 
         if osfamily == 'Debian'
           shell 'apt-cache policy libapache2-mod-fastcgi' do |r|
-            r.stdout.should_not =~ /ceph.com/
-            r.exit_code.should be_zero
+            expect(r.stdout).not_to match(/ceph.com/)
+            expect(r.exit_code).to be_zero
           end
         end
         if osfamily == 'RedHat'
           shell 'yum info mod_fastcgi' do |r|
-            r.stdout.should_not =~ /Repo.*ext-ceph-fastcgi/
-            r.stderr.should =~ /Error: No matching Packages to list/
-            r.exit_code.should_not be_zero
+            expect(r.stdout).not_to match(/Repo.*ext-ceph-fastcgi/)
+            expect(r.stderr).to match(/Error: No matching Packages to list/)
+            expect(r.exit_code).not_to be_zero
           end
         end
       end
diff --git a/ceph/spec/system/ceph_rgw_apache_spec.rb b/ceph/spec/system/ceph_rgw_apache_spec.rb
index dcdbad0fe..fde061786 100644
--- a/ceph/spec/system/ceph_rgw_apache_spec.rb
+++ b/ceph/spec/system/ceph_rgw_apache_spec.rb
@@ -20,7 +20,7 @@
 
 describe 'ceph::rgw::apache' do
 
-  releases = ENV['RELEASES'] ? ENV['RELEASES'].split : [ 'dumpling', 'firefly', 'giant' ]
+  releases = ENV['RELEASES'] ? ENV['RELEASES'].split : [ 'dumpling', 'giant' ]
   fsid = 'a4807c9a-e76f-4666-a297-6d6cbc922e3a'
   mon_key ='AQCztJdSyNb0NBAASA2yPZPuwXeIQnDJ9O8gVw=='
   admin_key = 'AQA0TVRTsP/aHxAAFBvntu1dSEJHxtJeFFrRsg=='
@@ -109,36 +109,36 @@ class { 'ceph':
         }
 
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
 
         shell servicequery[osfamily] do |r|
-          r.exit_code.should be_zero
+          expect(r.exit_code).to be_zero
         end
 
         shell 'radosgw-admin user create --uid=puppet --display-name=puppet-user' do |r|
-          r.exit_code.should be_zero
+          expect(r.exit_code).to be_zero
         end
 
         shell 'radosgw-admin subuser create --uid=puppet --subuser=puppet:swift --access=full' do |r|
-          r.exit_code.should be_zero
+          expect(r.exit_code).to be_zero
         end
 
         # need to create subuser key twice, due to http://tracker.ceph.com/issues/9155
         shell "radosgw-admin key create --subuser=puppet:swift --key-type=swift --secret='123456'" do |r|
-          r.exit_code.should be_zero
+          expect(r.exit_code).to be_zero
         end
 
         shell "radosgw-admin key create --subuser=puppet:swift --key-type=swift --secret='123456'" do |r|
-          r.exit_code.should be_zero
+          expect(r.exit_code).to be_zero
         end
 
         shell 'curl -i -H "X-Auth-User: puppet:swift" -H "X-Auth-Key: 123456" http://first/auth/v1.0/' do |r|
-          r.exit_code.should be_zero
-          r.stdout.should =~ /HTTP\/1\.1 204 No Content/
-          r.stdout.should_not =~ /401 Unauthorized/
+          expect(r.exit_code).to be_zero
+          expect(r.stdout).to match(/HTTP\/1\.1 204 No Content/)
+          expect(r.stdout).not_to match(/401 Unauthorized/)
         end
 
       end
@@ -151,7 +151,7 @@ class { 'ceph':
         EOS
 
         puppet_apply(pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
 
         shell 'ceph-disk zap /dev/sdb'
@@ -196,7 +196,7 @@ class { 'apache':
         EOS
 
         puppet_apply(purge) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
       end
     end
diff --git a/ceph/spec/system/ceph_usecases_spec.rb b/ceph/spec/system/ceph_usecases_spec.rb
index 511e28825..0eef0ec52 100644
--- a/ceph/spec/system/ceph_usecases_spec.rb
+++ b/ceph/spec/system/ceph_usecases_spec.rb
@@ -49,27 +49,27 @@ class { 'ceph':
       puppet_apply(pp) do |r|
         # due to the generate() the above is not idempotent
         # so we don't run twice as usual
-        r.exit_code.should_not == 1
+        expect(r.exit_code).not_to eq(1)
       end
 
       shell 'sleep 30' # we need to wait a bit until the OSD is up
 
       shell 'ceph -s' do |r|
-        r.stdout.should =~ /1 mons at/
-        r.stderr.should be_empty
-        r.exit_code.should be_zero
+        expect(r.stdout).to match(/1 mons at/)
+        expect(r.stderr).to be_empty
+        expect(r.exit_code).to be_zero
       end
 
       shell 'ceph osd tree' do |r|
-        r.stdout.should =~ /osd.0/
-        r.stderr.should be_empty
-        r.exit_code.should be_zero
+        expect(r.stdout).to match(/osd.0/)
+        expect(r.stderr).to be_empty
+        expect(r.exit_code).to be_zero
       end
     end
 
     it 'should uninstall one osd' do
       shell 'ceph osd tree | grep DNE' do |r|
-        r.exit_code.should_not be_zero
+        expect(r.exit_code).not_to be_zero
       end
 
       pp = <<-EOS
@@ -79,12 +79,12 @@ class { 'ceph':
       EOS
 
       puppet_apply(pp) do |r|
-        r.exit_code.should_not == 1
+        expect(r.exit_code).not_to eq(1)
       end
 
       shell 'ceph osd tree | grep DNE' do |r|
-        r.stderr.should be_empty
-        r.exit_code.should be_zero
+        expect(r.stderr).to be_empty
+        expect(r.exit_code).to be_zero
       end
     end
 
@@ -96,7 +96,7 @@ class { 'ceph':
       EOS
 
       puppet_apply(pp) do |r|
-        r.exit_code.should_not == 1
+        expect(r.exit_code).not_to eq(1)
       end
 
       osfamily = facter.facts['osfamily']
@@ -104,16 +104,16 @@ class { 'ceph':
 
       if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
         shell 'status ceph-mon id=a' do |r|
-          r.stdout.should be_empty
-          r.stderr.should =~ /Unknown instance: ceph.a/
-          r.exit_code.should_not be_zero
+          expect(r.stdout).to be_empty
+          expect(r.stderr).to match(/Unknown instance: ceph.a/)
+          expect(r.exit_code).not_to be_zero
         end
       end
       if osfamily == 'RedHat'
         shell 'service ceph status mon.a' do |r|
-          r.stdout.should =~ /mon.a not found/
-          r.stderr.should be_empty
-          r.exit_code.should_not be_zero
+          expect(r.stdout).to match(/mon.a not found/)
+          expect(r.stderr).to be_empty
+          expect(r.exit_code).not_to be_zero
         end
       end
     end
@@ -130,7 +130,7 @@ class { 'ceph::repo':
 
       machines.each do |vm|
         puppet_apply(:node => vm, :code => pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
       end
     end
@@ -193,28 +193,28 @@ class { 'ceph':
 
       machines.each do |vm|
         puppet_apply(:node => vm, :code => pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
       end
 
       shell 'ceph -s' do |r|
-        r.stdout.should =~ /1 mons at/
-        r.stderr.should be_empty
-        r.exit_code.should be_zero
+        expect(r.stdout).to match(/1 mons at/)
+        expect(r.stderr).to be_empty
+        expect(r.exit_code).to be_zero
       end
 
       shell 'ceph osd tree' do |r|
-        r.stdout.should =~ /osd.0/
-        r.stderr.should be_empty
-        r.exit_code.should be_zero
+        expect(r.stdout).to match(/osd.0/)
+        expect(r.stderr).to be_empty
+        expect(r.exit_code).to be_zero
       end
     end
 
     it 'should uninstall one osd' do
       shell 'ceph osd tree | grep DNE' do |r|
-        r.exit_code.should_not be_zero
+        expect(r.exit_code).not_to be_zero
       end
 
       pp = <<-EOS
@@ -224,13 +224,13 @@ class { 'ceph':
       EOS
 
       puppet_apply(:node => 'second', :code => pp) do |r|
-        r.exit_code.should_not == 1
+        expect(r.exit_code).not_to eq(1)
       end
 
       shell(:node => 'second', :command => "test -b /dev/sdb && ceph-disk zap /dev/sdb")
 
       shell 'ceph osd tree | grep DNE' do |r|
-        r.exit_code.should be_zero
+        expect(r.exit_code).to be_zero
       end
     end
 
@@ -242,7 +242,7 @@ class { 'ceph':
       EOS
 
       puppet_apply(:node => 'first', :code => pp) do |r|
-        r.exit_code.should_not == 1
+        expect(r.exit_code).not_to eq(1)
       end
 
       osfamily = facter.facts['osfamily']
@@ -250,16 +250,16 @@ class { 'ceph':
 
       if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
         shell 'status ceph-mon id=first' do |r|
-          r.stdout.should be_empty
-          r.stderr.should =~ /Unknown instance: ceph.first/
-          r.exit_code.should_not be_zero
+          expect(r.stdout).to be_empty
+          expect(r.stderr).to match(/Unknown instance: ceph.first/)
+          expect(r.exit_code).not_to be_zero
         end
       end
       if osfamily == 'RedHat'
         shell 'service ceph status mon.first' do |r|
-          r.stdout.should =~ /mon.first not found/
-          r.stderr.should be_empty
-          r.exit_code.should_not be_zero
+          expect(r.stdout).to match(/mon.first not found/)
+          expect(r.stderr).to be_empty
+          expect(r.exit_code).not_to be_zero
         end
       end
     end
@@ -276,7 +276,7 @@ class { 'ceph::repo':
 
       machines.each do |vm|
         puppet_apply(:node => vm, :code => pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
       end
     end
@@ -316,29 +316,29 @@ class { 'ceph':
 
       machines.each do |vm|
         puppet_apply(:node => vm, :code => pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
           r.refresh
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
       end
 
       shell 'ceph -s' do |r|
-        r.stdout.should =~ /1 mons at/
-        r.stderr.should be_empty
-        r.exit_code.should be_zero
+        expect(r.stdout).to match(/1 mons at/)
+        expect(r.stderr).to be_empty
+        expect(r.exit_code).to be_zero
       end
 
       shell 'ceph osd tree' do |r|
-        r.stdout.should =~ /osd.0/
-        r.stdout.should =~ /osd.1/
-        r.stderr.should be_empty
-        r.exit_code.should be_zero
+        expect(r.stdout).to match(/osd.0/)
+        expect(r.stdout).to match(/osd.1/)
+        expect(r.stderr).to be_empty
+        expect(r.exit_code).to be_zero
       end
     end
 
     it 'should uninstall two OSDs' do
       shell 'ceph osd tree | grep DNE' do |r|
-        r.exit_code.should_not be_zero
+        expect(r.exit_code).not_to be_zero
       end
 
       pp = <<-EOS
@@ -349,14 +349,14 @@ class { 'ceph':
 
       machines.each do |vm|
         puppet_apply(:node => vm, :code => pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
 
         shell(:node => vm, :command => "test -b /dev/sdb && ceph-disk zap /dev/sdb")
       end
 
       shell 'ceph osd tree | grep DNE' do |r|
-        r.exit_code.should be_zero
+        expect(r.exit_code).to be_zero
       end
     end
 
@@ -368,7 +368,7 @@ class { 'ceph':
       EOS
 
       puppet_apply(:node => 'first', :code => pp) do |r|
-        r.exit_code.should_not == 1
+        expect(r.exit_code).not_to eq(1)
       end
 
       osfamily = facter.facts['osfamily']
@@ -376,16 +376,16 @@ class { 'ceph':
 
       if osfamily == 'Debian' && operatingsystem == 'Ubuntu'
         shell 'status ceph-mon id=first' do |r|
-          r.stdout.should be_empty
-          r.stderr.should =~ /Unknown instance: ceph.first/
-          r.exit_code.should_not be_zero
+          expect(r.stdout).to be_empty
+          expect(r.stderr).to match(/Unknown instance: ceph.first/)
+          expect(r.exit_code).not_to be_zero
         end
       end
       if osfamily == 'RedHat'
         shell 'service ceph status mon.first' do |r|
-          r.stdout.should =~ /mon.first not found/
-          r.stderr.should be_empty
-          r.exit_code.should_not be_zero
+          expect(r.stdout).to match(/mon.first not found/)
+          expect(r.stderr).to be_empty
+          expect(r.exit_code).not_to be_zero
         end
       end
     end
@@ -402,7 +402,7 @@ class { 'ceph::repo':
 
       machines.each do |vm|
         puppet_apply(:node => vm, :code => pp) do |r|
-          r.exit_code.should_not == 1
+          expect(r.exit_code).not_to eq(1)
         end
       end
     end
diff --git a/ceph/spec/unit/provider/ceph_config/ini_setting_spec.rb b/ceph/spec/unit/provider/ceph_config/ini_setting_spec.rb
index f034d8857..8a944c691 100644
--- a/ceph/spec/unit/provider/ceph_config/ini_setting_spec.rb
+++ b/ceph/spec/unit/provider/ceph_config/ini_setting_spec.rb
@@ -43,16 +43,16 @@
   } }
 
   def validate(expected, tmpfile = tmpfile)
-    File.read(tmpfile).should == expected
+    expect(File.read(tmpfile)).to eq(expected)
   end
 
   it 'should create keys = value and ensure space around equals' do
     resource = Puppet::Type::Ceph_config.new(params.merge(
       :name => 'global/ceph_is_foo', :value => 'bar'))
     provider = provider_class.new(resource)
-    provider.exists?.should be_falsey
+    expect(provider.exists?).to be_falsey
     provider.create
-    provider.exists?.should be_truthy
+    expect(provider.exists?).to be_truthy
     validate(<<-EOS
 
 [global]
@@ -65,7 +65,7 @@ def validate(expected, tmpfile = tmpfile)
     resource = Puppet::Type::Ceph_config.new(
       :name => 'global/ceph_is_foo', :value => 'bar')
     provider = provider_class.new(resource)
-    provider.file_path.should == '/etc/ceph/ceph.conf'
+    expect(provider.file_path).to eq('/etc/ceph/ceph.conf')
   end
 
 end
diff --git a/ceph/spec/unit/type/ceph_config_spec.rb b/ceph/spec/unit/type/ceph_config_spec.rb
index 01e4af85b..c78dfb684 100644
--- a/ceph/spec/unit/type/ceph_config_spec.rb
+++ b/ceph/spec/unit/type/ceph_config_spec.rb
@@ -26,16 +26,16 @@
 
   it 'should work bascily' do
     @ceph_config[:value] = 'max'
-    @ceph_config[:value].should == 'max'
+    expect(@ceph_config[:value]).to eq('max')
   end
 
   it 'should convert true to True' do
     @ceph_config[:value] = 'tRuE'
-    @ceph_config[:value].should == 'True'
+    expect(@ceph_config[:value]).to eq('True')
   end
 
   it 'should convert false to False' do
     @ceph_config[:value] = 'fAlSe'
-    @ceph_config[:value].should == 'False'
+    expect(@ceph_config[:value]).to eq('False')
   end
 end
\ No newline at end of file
diff --git a/cinder/CHANGELOG.md b/cinder/CHANGELOG.md
index d087182b2..34e0ab23d 100644
--- a/cinder/CHANGELOG.md
+++ b/cinder/CHANGELOG.md
@@ -1,3 +1,52 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+This is a backwards-incompatible major release for OpenStack Kilo.
+
+####Backwards-incompatible changes
+- Iscsi: Change default $volume_driver
+- Switch to TLSv1 as SSLv3 is considered insecure and is disabled by default
+- Remove POSIX users, groups, and file modes
+- Move rabbit/kombu settings to oslo_messaging_rabbit section
+- Also removed deprecated parameters
+
+####Features
+- Puppet 4.x support
+- Refactorise Keystone resources management
+- Add an option to not configure RabbitMQ service
+- Run db_sync when upgrading packages
+- Makes kombu_ssl_* parameters optional when rabbit_use_ssl => true
+- Adds ability to override service name for service catalog
+- Support the enable_v*_api settings
+- Support iSER driver within the ISCSITarget flow
+- ISCSI: Allow one to specify volumes_dir path
+- Backends: Add an extra_options door
+- Support identity_uri and auth_uri properly
+- Make scheduler_driver option can be cleaned up
+- Tag all Cinder packages
+- Adds OracleLinux support
+- Create a sync_db boolean for Cinder
+- Update NetApp params for Kilo
+- Add nfs_mount_options variable when backend is NetApp
+- Add support for NFS Backup
+- Decouple $sync_db from $enabled
+- Add backup compression parameter
+- Introduce public_url, internal_url and admin_url
+- Added support for DellStorageCenter ISCSI cinder driver
+- Add cinder::scheduler::filter for managing scheduler.filter
+- NetApp: use $name for configuration group name (allows to run multiple NetApp
+  backends)
+- Lint documentation parameters
+- HP 3par iscsi backend module
+- MySQL: change default MySQL collate to utf8_general_ci
+
+####Bugfixes
+- Fix db_sync dependencies
+
+####Maintenance
+- Acceptance tests with Beaker
+- Fix spec tests for RSpec 3.x and Puppet 4.x
+
 ##2015-06-17 - 5.1.0
 ###Summary
 
diff --git a/cinder/README.md b/cinder/README.md
index 538178c12..937488a3a 100644
--- a/cinder/README.md
+++ b/cinder/README.md
@@ -1,7 +1,7 @@
 cinder
 =======
 
-5.1.0 - 2014.2 - Juno
+6.0.0 - 2015.1 - Kilo
 
 #### Table of Contents
 
diff --git a/cinder/manifests/api.pp b/cinder/manifests/api.pp
index 828902ed2..ec861c9ea 100644
--- a/cinder/manifests/api.pp
+++ b/cinder/manifests/api.pp
@@ -40,6 +40,15 @@
 #   requests. For example, boot-from-volume.
 #   Defaults to undef.
 #
+# [*nova_catalog_info*]
+#   (optional) Match this value when searching for nova in the service
+#   catalog.
+#   Defaults to 'compute:Compute Service:publicURL'
+#
+# [*nova_catalog_admin_info*]
+#   (optional) Same as nova_catalog_info, but for admin endpoint.
+#   Defaults to 'compute:Compute Service:adminURL'
+#
 # [*keystone_auth_admin_prefix*]
 #   (optional) DEPRECATED The admin_prefix used to admin endpoint of the auth
 #   host. This allow admin auth URIs like http://auth_host:35357/keystone.
@@ -131,6 +140,8 @@
   $auth_uri                   = false,
   $identity_uri               = false,
   $os_region_name             = undef,
+  $nova_catalog_info          = 'compute:Compute Service:publicURL',
+  $nova_catalog_admin_info    = 'compute:Compute Service:adminURL',
   $service_workers            = $::processorcount,
   $package_ensure             = 'present',
   $bind_host                  = '0.0.0.0',
@@ -215,6 +226,11 @@
     }
   }
 
+  cinder_config {
+    'DEFAULT/nova_catalog_info':       value => $nova_catalog_info;
+    'DEFAULT/nova_catalog_admin_info': value => $nova_catalog_admin_info;
+  }
+
   if $keystone_auth_uri and $auth_uri {
     fail('both keystone_auth_uri and auth_uri are set and they have the same meaning')
   }
diff --git a/cinder/manifests/ceilometer.pp b/cinder/manifests/ceilometer.pp
index 813ea687d..c13374b35 100644
--- a/cinder/manifests/ceilometer.pp
+++ b/cinder/manifests/ceilometer.pp
@@ -7,16 +7,17 @@
 #
 # [*notification_driver*]
 #   (option) Driver or drivers to handle sending notifications.
-#    Notice: rabbit_notifier has been deprecated in Grizzly, use rpc_notifier instead.
+#   The default value of 'messagingv2' is for enabling notifications via
+#   oslo.messaging.  'cinder.openstack.common.notifier.rpc_notifier' is the
+#   backwards compatible option that will be deprecated. Prior to Grizzly,
+#   'cinder.openstack.common.notifier.rabbit_notifier' was used. oslo.messaging
+#   was adopted in icehouse/juno. See LP#1425713.
 #
-
-
 class cinder::ceilometer (
-  $notification_driver = 'cinder.openstack.common.notifier.rpc_notifier'
+  $notification_driver = 'messagingv2',
 ) {
 
   cinder_config {
-    'DEFAULT/notification_driver':     value => $notification_driver;
+    'DEFAULT/notification_driver': value => $notification_driver;
   }
 }
-
diff --git a/cinder/manifests/cron/db_purge.pp b/cinder/manifests/cron/db_purge.pp
new file mode 100644
index 000000000..559f7848e
--- /dev/null
+++ b/cinder/manifests/cron/db_purge.pp
@@ -0,0 +1,76 @@
+#
+# Copyright (C) 2015 Red Hat Inc.
+#
+# Author: Martin Magr <mmagr@redhat.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: cinder::cron::db_purge
+#
+# Move deleted instances to another table that you don't have to backup
+# unless you have data retention policies.
+#
+# === Parameters
+#
+#  [*minute*]
+#    (optional) Defaults to '1'.
+#
+#  [*hour*]
+#    (optional) Defaults to '0'.
+#
+#  [*monthday*]
+#    (optional) Defaults to '*'.
+#
+#  [*month*]
+#    (optional) Defaults to '*'.
+#
+#  [*weekday*]
+#    (optional) Defaults to '*'.
+#
+#  [*user*]
+#    (optional) User with access to cinder files.
+#    Defaults to 'cinder'.
+#
+#  [*age*]
+#    (optional) Number of days prior to today for deletion,
+#    e.g. value 60 means to purge deleted rows that have the "deleted_at"
+#    column greater than 60 days ago.
+#    Defaults to 30
+#
+#  [*destination*]
+#    (optional) Path to file to which rows should be archived
+#    Defaults to '/var/log/cinder/cinder-rowsflush.log'.
+#
+class cinder::cron::db_purge (
+  $minute      = 1,
+  $hour        = 0,
+  $monthday    = '*',
+  $month       = '*',
+  $weekday     = '*',
+  $user        = 'cinder',
+  $age         = 30,
+  $destination = '/var/log/cinder/cinder-rowsflush.log'
+) {
+
+  cron { 'cinder-manage db purge':
+    command     => "cinder-manage db purge ${age} >>${destination} 2>&1",
+    environment => 'PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh',
+    user        => $user,
+    minute      => $minute,
+    hour        => $hour,
+    monthday    => $monthday,
+    month       => $month,
+    weekday     => $weekday,
+    require     => Package['cinder'],
+  }
+}
diff --git a/cinder/manifests/init.pp b/cinder/manifests/init.pp
index 7e11e3394..c7e9d833c 100644
--- a/cinder/manifests/init.pp
+++ b/cinder/manifests/init.pp
@@ -84,6 +84,21 @@
 #   (Optional) Virtual_host to use.
 #   Defaults to '/'
 #
+# [*rabbit_heartbeat_timeout_threshold*]
+#   (optional) Number of seconds after which the RabbitMQ broker is considered
+#   down if the heartbeat keepalive fails.  Any value >0 enables heartbeats.
+#   Heartbeating helps to ensure the TCP connection to RabbitMQ isn't silently
+#   closed, resulting in missed or lost messages from the queue.
+#   (Requires kombu >= 3.0.7 and amqp >= 1.4.0)
+#   Defaults to 0
+#
+# [*rabbit_heartbeat_rate*]
+#   (optional) How often during the rabbit_heartbeat_timeout_threshold period to
+#   check the heartbeat on RabbitMQ connection.  (i.e. rabbit_heartbeat_rate=2
+#   when rabbit_heartbeat_timeout_threshold=60, the heartbeat will be checked
+#   every 30 seconds.
+#   Defaults to 2
+#
 # [*rabbit_use_ssl*]
 #   (optional) Connect over SSL for RabbitMQ
 #   Defaults to false
@@ -212,58 +227,60 @@
 #   DEPRECATED. Does nothing.
 #
 class cinder (
-  $database_connection         = 'sqlite:////var/lib/cinder/cinder.sqlite',
-  $database_idle_timeout       = '3600',
-  $database_min_pool_size      = '1',
-  $database_max_pool_size      = undef,
-  $database_max_retries        = '10',
-  $database_retry_interval     = '10',
-  $database_max_overflow       = undef,
-  $rpc_backend                 = 'cinder.openstack.common.rpc.impl_kombu',
-  $control_exchange            = 'openstack',
-  $rabbit_host                 = '127.0.0.1',
-  $rabbit_port                 = 5672,
-  $rabbit_hosts                = false,
-  $rabbit_virtual_host         = '/',
-  $rabbit_userid               = 'guest',
-  $rabbit_password             = false,
-  $rabbit_use_ssl              = false,
-  $kombu_ssl_ca_certs          = undef,
-  $kombu_ssl_certfile          = undef,
-  $kombu_ssl_keyfile           = undef,
-  $kombu_ssl_version           = 'TLSv1',
-  $amqp_durable_queues         = false,
-  $qpid_hostname               = 'localhost',
-  $qpid_port                   = '5672',
-  $qpid_username               = 'guest',
-  $qpid_password               = false,
-  $qpid_sasl_mechanisms        = false,
-  $qpid_reconnect              = true,
-  $qpid_reconnect_timeout      = 0,
-  $qpid_reconnect_limit        = 0,
-  $qpid_reconnect_interval_min = 0,
-  $qpid_reconnect_interval_max = 0,
-  $qpid_reconnect_interval     = 0,
-  $qpid_heartbeat              = 60,
-  $qpid_protocol               = 'tcp',
-  $qpid_tcp_nodelay            = true,
-  $package_ensure              = 'present',
-  $use_ssl                     = false,
-  $ca_file                     = false,
-  $cert_file                   = false,
-  $key_file                    = false,
-  $api_paste_config            = '/etc/cinder/api-paste.ini',
-  $use_syslog                  = false,
-  $log_facility                = 'LOG_USER',
-  $log_dir                     = '/var/log/cinder',
-  $verbose                     = false,
-  $debug                       = false,
-  $storage_availability_zone   = 'nova',
-  $default_availability_zone   = false,
-  $enable_v1_api               = true,
-  $enable_v2_api               = true,
+  $database_connection                = 'sqlite:////var/lib/cinder/cinder.sqlite',
+  $database_idle_timeout              = '3600',
+  $database_min_pool_size             = '1',
+  $database_max_pool_size             = undef,
+  $database_max_retries               = '10',
+  $database_retry_interval            = '10',
+  $database_max_overflow              = undef,
+  $rpc_backend                        = 'cinder.openstack.common.rpc.impl_kombu',
+  $control_exchange                   = 'openstack',
+  $rabbit_host                        = '127.0.0.1',
+  $rabbit_port                        = 5672,
+  $rabbit_hosts                       = false,
+  $rabbit_virtual_host                = '/',
+  $rabbit_heartbeat_timeout_threshold = 0,
+  $rabbit_heartbeat_rate              = 2,
+  $rabbit_userid                      = 'guest',
+  $rabbit_password                    = false,
+  $rabbit_use_ssl                     = false,
+  $kombu_ssl_ca_certs                 = undef,
+  $kombu_ssl_certfile                 = undef,
+  $kombu_ssl_keyfile                  = undef,
+  $kombu_ssl_version                  = 'TLSv1',
+  $amqp_durable_queues                = false,
+  $qpid_hostname                      = 'localhost',
+  $qpid_port                          = '5672',
+  $qpid_username                      = 'guest',
+  $qpid_password                      = false,
+  $qpid_sasl_mechanisms               = false,
+  $qpid_reconnect                     = true,
+  $qpid_reconnect_timeout             = 0,
+  $qpid_reconnect_limit               = 0,
+  $qpid_reconnect_interval_min        = 0,
+  $qpid_reconnect_interval_max        = 0,
+  $qpid_reconnect_interval            = 0,
+  $qpid_heartbeat                     = 60,
+  $qpid_protocol                      = 'tcp',
+  $qpid_tcp_nodelay                   = true,
+  $package_ensure                     = 'present',
+  $use_ssl                            = false,
+  $ca_file                            = false,
+  $cert_file                          = false,
+  $key_file                           = false,
+  $api_paste_config                   = '/etc/cinder/api-paste.ini',
+  $use_syslog                         = false,
+  $log_facility                       = 'LOG_USER',
+  $log_dir                            = '/var/log/cinder',
+  $verbose                            = false,
+  $debug                              = false,
+  $storage_availability_zone          = 'nova',
+  $default_availability_zone          = false,
+  $enable_v1_api                      = true,
+  $enable_v2_api                      = true,
   # DEPRECATED PARAMETERS
-  $mysql_module                = undef,
+  $mysql_module                       = undef,
 ) {
 
   include ::cinder::params
@@ -302,12 +319,14 @@
     }
 
     cinder_config {
-      'oslo_messaging_rabbit/rabbit_password':     value => $rabbit_password, secret => true;
-      'oslo_messaging_rabbit/rabbit_userid':       value => $rabbit_userid;
-      'oslo_messaging_rabbit/rabbit_virtual_host': value => $rabbit_virtual_host;
-      'oslo_messaging_rabbit/rabbit_use_ssl':      value => $rabbit_use_ssl;
-      'DEFAULT/control_exchange':    value => $control_exchange;
-      'DEFAULT/amqp_durable_queues': value => $amqp_durable_queues;
+      'oslo_messaging_rabbit/rabbit_password':              value => $rabbit_password, secret => true;
+      'oslo_messaging_rabbit/rabbit_userid':                value => $rabbit_userid;
+      'oslo_messaging_rabbit/rabbit_virtual_host':          value => $rabbit_virtual_host;
+      'oslo_messaging_rabbit/rabbit_use_ssl':               value => $rabbit_use_ssl;
+      'oslo_messaging_rabbit/heartbeat_timeout_threshold':  value => $rabbit_heartbeat_timeout_threshold;
+      'oslo_messaging_rabbit/heartbeat_rate':               value => $rabbit_heartbeat_rate;
+      'DEFAULT/control_exchange':                           value => $control_exchange;
+      'DEFAULT/amqp_durable_queues':                        value => $amqp_durable_queues;
     }
 
     if $rabbit_hosts {
diff --git a/cinder/metadata.json b/cinder/metadata.json
index 3b718d866..438e83f27 100644
--- a/cinder/metadata.json
+++ b/cinder/metadata.json
@@ -1,6 +1,6 @@
 {
-  "name": "stackforge-cinder",
-  "version": "5.1.0",
+  "name": "openstack-cinder",
+  "version": "6.0.0",
   "author": "Puppet Labs and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Cinder",
   "license": "Apache-2.0",
@@ -33,9 +33,9 @@
   "dependencies": [
     { "name": "dprince/qpid", "version_requirement": ">=1.0.0 <2.0.0" },
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
-    { "name": "stackforge/keystone", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/keystone", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/rabbitmq", "version_requirement": ">=2.0.2 <6.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
-    { "name": "stackforge/openstacklib", "version_requirement": ">=5.0.0 <6.0.0" }
+    { "name": "openstack/openstacklib", "version_requirement": ">=6.0.0 <7.0.0" }
   ]
 }
diff --git a/cinder/spec/acceptance/basic_cinder_spec.rb b/cinder/spec/acceptance/basic_cinder_spec.rb
index f12c9e03d..9b5595b79 100644
--- a/cinder/spec/acceptance/basic_cinder_spec.rb
+++ b/cinder/spec/acceptance/basic_cinder_spec.rb
@@ -102,6 +102,7 @@ class { '::cinder::quota': }
       class { '::cinder::scheduler': }
       class { '::cinder::scheduler::filter': }
       class { '::cinder::volume': }
+      class { '::cinder::cron::db_purge': }
       # TODO: create a backend and spawn a volume
       EOS
 
@@ -115,5 +116,10 @@ class { '::cinder::volume': }
       it { is_expected.to be_listening.with('tcp') }
     end
 
+    describe cron do
+      it { is_expected.to have_entry('1 0 * * * cinder-manage db purge 30 >>/var/log/cinder/cinder-rowsflush.log 2>&1').with_user('cinder') }
+    end
+
+
   end
 end
diff --git a/cinder/spec/classes/cinder_api_spec.rb b/cinder/spec/classes/cinder_api_spec.rb
index e901ec9a0..7be1b6552 100644
--- a/cinder/spec/classes/cinder_api_spec.rb
+++ b/cinder/spec/classes/cinder_api_spec.rb
@@ -30,6 +30,12 @@
       is_expected.to contain_cinder_config('DEFAULT/osapi_volume_workers').with(
        :value => '8'
       )
+      is_expected.to contain_cinder_config('DEFAULT/nova_catalog_info').with(
+       :value => 'compute:Compute Service:publicURL'
+      )
+      is_expected.to contain_cinder_config('DEFAULT/nova_catalog_admin_info').with(
+       :value => 'compute:Compute Service:adminURL'
+      )
       is_expected.to contain_cinder_config('DEFAULT/default_volume_type').with(
        :ensure => 'absent'
       )
@@ -73,6 +79,17 @@
     end
   end
 
+  describe 'with a custom nova_catalog params' do
+    let :params do
+      req_params.merge({
+        'nova_catalog_admin_info' => 'compute:nova:adminURL',
+        'nova_catalog_info' => 'compute:nova:publicURL',
+      })
+    end
+    it { is_expected.to contain_cinder_config('DEFAULT/nova_catalog_admin_info').with_value('compute:nova:adminURL') }
+    it { is_expected.to contain_cinder_config('DEFAULT/nova_catalog_info').with_value('compute:nova:publicURL') }
+  end
+
   describe 'with a custom region for nova' do
     let :params do
       req_params.merge({'os_region_name' => 'MyRegion'})
diff --git a/cinder/spec/classes/cinder_ceilometer_spec.rb b/cinder/spec/classes/cinder_ceilometer_spec.rb
index fdb9b49ee..1d268c1a7 100644
--- a/cinder/spec/classes/cinder_ceilometer_spec.rb
+++ b/cinder/spec/classes/cinder_ceilometer_spec.rb
@@ -5,7 +5,7 @@
   describe 'with default parameters' do
     it 'contains default values' do
       is_expected.to contain_cinder_config('DEFAULT/notification_driver').with(
-        :value => 'cinder.openstack.common.notifier.rpc_notifier')
+        :value => 'messagingv2')
     end
   end
 end
diff --git a/cinder/spec/classes/cinder_cron_db_purge_spec.rb b/cinder/spec/classes/cinder_cron_db_purge_spec.rb
new file mode 100644
index 000000000..f78e9a7bc
--- /dev/null
+++ b/cinder/spec/classes/cinder_cron_db_purge_spec.rb
@@ -0,0 +1,33 @@
+require 'spec_helper'
+
+describe 'cinder::cron::db_purge' do
+
+  let :facts do
+    { :osfamily => 'RedHat' }
+  end
+
+  let :params do
+    { :minute      => 1,
+      :hour        => 0,
+      :monthday    => '*',
+      :month       => '*',
+      :weekday     => '*',
+      :user        => 'cinder',
+      :age         => '30',
+      :destination => '/var/log/cinder/cinder-rowsflush.log' }
+  end
+
+  it 'configures a cron' do
+    is_expected.to contain_cron('cinder-manage db purge').with(
+      :command     => "cinder-manage db purge #{params[:age]} >>#{params[:destination]} 2>&1",
+      :environment => 'PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh',
+      :user        => params[:user],
+      :minute      => params[:minute],
+      :hour        => params[:hour],
+      :monthday    => params[:monthday],
+      :month       => params[:month],
+      :weekday     => params[:weekday],
+      :require     => 'Package[cinder]',
+    )
+  end
+end
diff --git a/cinder/spec/classes/cinder_spec.rb b/cinder/spec/classes/cinder_spec.rb
index 8bfc280f9..3f5d62f47 100644
--- a/cinder/spec/classes/cinder_spec.rb
+++ b/cinder/spec/classes/cinder_spec.rb
@@ -25,6 +25,8 @@
       is_expected.to contain_cinder_config('oslo_messaging_rabbit/rabbit_hosts').with(:value => '127.0.0.1:5672')
       is_expected.to contain_cinder_config('oslo_messaging_rabbit/rabbit_ha_queues').with(:value => false)
       is_expected.to contain_cinder_config('oslo_messaging_rabbit/rabbit_virtual_host').with(:value => '/')
+      is_expected.to contain_cinder_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('0')
+      is_expected.to contain_cinder_config('oslo_messaging_rabbit/heartbeat_rate').with_value('2')
       is_expected.to contain_cinder_config('oslo_messaging_rabbit/rabbit_userid').with(:value => 'guest')
       is_expected.to contain_cinder_config('database/connection').with(:value  => 'mysql://user:password@host/database', :secret => true)
       is_expected.to contain_cinder_config('database/idle_timeout').with(:value => '3600')
@@ -68,6 +70,17 @@
     end
   end
 
+  describe 'with rabbitmq heartbeats' do
+    let :params do
+      req_params.merge({'rabbit_heartbeat_timeout_threshold' => '60', 'rabbit_heartbeat_rate' => '10'})
+    end
+
+    it 'should contain heartbeat config' do
+      is_expected.to contain_cinder_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('60')
+      is_expected.to contain_cinder_config('oslo_messaging_rabbit/heartbeat_rate').with_value('10')
+    end
+  end
+
   describe 'with qpid rpc supplied' do
 
     let :params do
diff --git a/cinder/spec/spec_helper_acceptance.rb b/cinder/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/cinder/spec/spec_helper_acceptance.rb
+++ b/cinder/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/galera/manifests/server.pp b/galera/manifests/server.pp
index f4f630efe..5496ea2a2 100644
--- a/galera/manifests/server.pp
+++ b/galera/manifests/server.pp
@@ -121,11 +121,17 @@
     warning("DEPRECATED: wsrep_bind_address is deprecated, you should use bind_address of mysql module")
   }
 
-  $wsrep_provider_options = wsrep_options({
-    'socket.ssl'      => $wsrep_ssl,
-    'socket.ssl_key'  => $wsrep_ssl_key,
-    'socket.ssl_cert' => $wsrep_ssl_cert,
-  })
+  if $wsrep_ssl {
+    $wsrep_provider_options = wsrep_options({
+      'socket.ssl'      => $wsrep_ssl,
+      'socket.ssl_key'  => $wsrep_ssl_key,
+      'socket.ssl_cert' => $wsrep_ssl_cert,
+    })
+  } else {
+    $wsrep_provider_options = wsrep_options({
+      'socket.ssl'      => $wsrep_ssl,
+    })
+  }
 
   $wsrep_debug = bool2num($debug)
 
@@ -136,6 +142,7 @@
     group   => 'root',
     content => template('galera/wsrep.cnf.erb'),
     notify  => Service['mysqld'],
+    require => Class['mysql::server::install'],
   }
 
   if $manage_service {
diff --git a/glance/CHANGELOG.md b/glance/CHANGELOG.md
index 1e69f7f3f..c3a1b33fc 100644
--- a/glance/CHANGELOG.md
+++ b/glance/CHANGELOG.md
@@ -1,3 +1,31 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+This is a backwards-incompatible major release for OpenStack Kilo.
+
+####Backwards-incompatible changes
+- Move rabbit/kombu settings to oslo_messaging_rabbit section
+- Remove sql_connection and sql_idle_timeout deprecated parameters
+- api: change default pipeline
+- Separate api and registry packages for Red Hat
+- python-ceph no longer exists in el7, use python-rbd
+
+####Features
+- Puppet 4.x support
+- Refactorise Keystone resources management
+- Migrate postgresql backend to use openstacklib::db::postgresql
+- Add support for identity_uri
+- Service Validation for Glance-API
+- Create a sync_db boolean for Glance
+- make service description configurable
+
+####Bugfixes
+- Fix API/Registry ensure for Ubuntu
+
+####Maintenance
+- Acceptance tests with Beaker
+- Fix spec tests for RSpec 3.x and Puppet 4.x
+
 ##2015-06-17 - 5.1.0
 ###Summary
 
diff --git a/glance/README.md b/glance/README.md
index a980477ae..7d471435c 100644
--- a/glance/README.md
+++ b/glance/README.md
@@ -1,7 +1,7 @@
 glance
 =======
 
-5.1.0 - 2014.2 - Juno
+6.0.0 - 2015.1 - Kilo
 
 #### Table of Contents
 
diff --git a/glance/manifests/backend/swift.pp b/glance/manifests/backend/swift.pp
index 6065acff0..ea3a34b57 100644
--- a/glance/manifests/backend/swift.pp
+++ b/glance/manifests/backend/swift.pp
@@ -29,6 +29,9 @@ # == class: glance::backend::swift
 #  [*swift_store_endpoint_type*]
 #    Optional. Default: 'internalURL'
 #
+#  [*swift_store_region*]
+#    Optional. Default: undef
+#
 class glance::backend::swift(
   $swift_store_user,
   $swift_store_key,
@@ -37,7 +40,8 @@ # == class: glance::backend::swift
   $swift_store_auth_version = '2',
   $swift_store_large_object_size = '5120',
   $swift_store_create_container_on_put = false,
-  $swift_store_endpoint_type = 'internalURL'
+  $swift_store_endpoint_type = 'internalURL',
+  $swift_store_region = undef,
 ) {
 
   glance_api_config {
@@ -45,6 +49,7 @@ # == class: glance::backend::swift
     'glance_store/swift_store_user':         value => $swift_store_user;
     'glance_store/swift_store_key':          value => $swift_store_key;
     'glance_store/swift_store_auth_address': value => $swift_store_auth_address;
+    'glance_store/swift_store_region':       value => $swift_store_region;
     'glance_store/swift_store_container':    value => $swift_store_container;
     'glance_store/swift_store_auth_version': value => $swift_store_auth_version;
     'glance_store/swift_store_create_container_on_put':
@@ -59,6 +64,7 @@ # == class: glance::backend::swift
     'glance_store/swift_store_user':         value => $swift_store_user;
     'glance_store/swift_store_key':          value => $swift_store_key;
     'glance_store/swift_store_auth_address': value => $swift_store_auth_address;
+    'glance_store/swift_store_region':       value => $swift_store_region;
     'glance_store/swift_store_container':    value => $swift_store_container;
     'glance_store/swift_store_auth_version': value => $swift_store_auth_version;
     'glance_store/swift_store_create_container_on_put':
diff --git a/glance/manifests/notify/rabbitmq.pp b/glance/manifests/notify/rabbitmq.pp
index a55434926..87110e837 100644
--- a/glance/manifests/notify/rabbitmq.pp
+++ b/glance/manifests/notify/rabbitmq.pp
@@ -21,6 +21,21 @@
 #  [*rabbit_virtual_host*]
 #    virtual_host to use. Optional. Defaults to '/'
 #
+# [*rabbit_heartbeat_timeout_threshold*]
+#   (optional) Number of seconds after which the RabbitMQ broker is considered
+#   down if the heartbeat keepalive fails.  Any value >0 enables heartbeats.
+#   Heartbeating helps to ensure the TCP connection to RabbitMQ isn't silently
+#   closed, resulting in missed or lost messages from the queue.
+#   (Requires kombu >= 3.0.7 and amqp >= 1.4.0)
+#   Defaults to 0
+#
+# [*rabbit_heartbeat_rate*]
+#   (optional) How often during the rabbit_heartbeat_timeout_threshold period to
+#   check the heartbeat on RabbitMQ connection.  (i.e. rabbit_heartbeat_rate=2
+#   when rabbit_heartbeat_timeout_threshold=60, the heartbeat will be checked
+#   every 30 seconds.
+#   Defaults to 2
+#
 #  [*rabbit_use_ssl*]
 #    (optional) Connect over SSL for RabbitMQ
 #    Defaults to false
@@ -61,21 +76,23 @@
 
 class glance::notify::rabbitmq(
   $rabbit_password,
-  $rabbit_userid                = 'guest',
-  $rabbit_host                  = 'localhost',
-  $rabbit_port                  = '5672',
-  $rabbit_hosts                 = false,
-  $rabbit_virtual_host          = '/',
-  $rabbit_use_ssl               = false,
-  $kombu_ssl_ca_certs           = undef,
-  $kombu_ssl_certfile           = undef,
-  $kombu_ssl_keyfile            = undef,
-  $kombu_ssl_version            = 'TLSv1',
-  $rabbit_notification_exchange = 'glance',
-  $rabbit_notification_topic    = 'notifications',
-  $rabbit_durable_queues        = false,
-  $amqp_durable_queues          = false,
-  $notification_driver          = 'messaging',
+  $rabbit_userid                      = 'guest',
+  $rabbit_host                        = 'localhost',
+  $rabbit_port                        = '5672',
+  $rabbit_hosts                       = false,
+  $rabbit_virtual_host                = '/',
+  $rabbit_heartbeat_timeout_threshold = 0,
+  $rabbit_heartbeat_rate              = 2,
+  $rabbit_use_ssl                     = false,
+  $kombu_ssl_ca_certs                 = undef,
+  $kombu_ssl_certfile                 = undef,
+  $kombu_ssl_keyfile                  = undef,
+  $kombu_ssl_version                  = 'TLSv1',
+  $rabbit_notification_exchange       = 'glance',
+  $rabbit_notification_topic          = 'notifications',
+  $rabbit_durable_queues              = false,
+  $amqp_durable_queues                = false,
+  $notification_driver                = 'messaging',
 ) {
 
   if $rabbit_durable_queues {
@@ -106,6 +123,8 @@
     'oslo_messaging_rabbit/rabbit_userid':                value => $rabbit_userid;
     'oslo_messaging_rabbit/rabbit_notification_exchange': value => $rabbit_notification_exchange;
     'oslo_messaging_rabbit/rabbit_notification_topic':    value => $rabbit_notification_topic;
+    'oslo_messaging_rabbit/heartbeat_timeout_threshold':  value => $rabbit_heartbeat_timeout_threshold;
+    'oslo_messaging_rabbit/heartbeat_rate':               value => $rabbit_heartbeat_rate;
     'oslo_messaging_rabbit/rabbit_use_ssl':               value => $rabbit_use_ssl;
     'DEFAULT/amqp_durable_queues':          value => $amqp_durable_queues_real;
   }
diff --git a/glance/metadata.json b/glance/metadata.json
index 33e155644..c9c386242 100644
--- a/glance/metadata.json
+++ b/glance/metadata.json
@@ -1,6 +1,6 @@
 {
-  "name": "stackforge-glance",
-  "version": "5.1.0",
+  "name": "openstack-glance",
+  "version": "6.0.0",
   "author": "Puppet Labs and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Glance",
   "license": "Apache-2.0",
@@ -32,8 +32,8 @@
   "description": "Installs and configures OpenStack Glance (Image Service).",
   "dependencies": [
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
-    { "name": "stackforge/keystone", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/keystone", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
-    { "name": "stackforge/openstacklib", "version_requirement": ">=5.0.0 <6.0.0" }
+    { "name": "openstack/openstacklib", "version_requirement": ">=6.0.0 <7.0.0" }
   ]
 }
diff --git a/glance/spec/classes/glance_backend_swift_spec.rb b/glance/spec/classes/glance_backend_swift_spec.rb
index 65d09ddd7..0993b5a4e 100644
--- a/glance/spec/classes/glance_backend_swift_spec.rb
+++ b/glance/spec/classes/glance_backend_swift_spec.rb
@@ -30,6 +30,7 @@
       is_expected.to contain_glance_api_config('glance_store/swift_store_container').with_value('glance')
       is_expected.to contain_glance_api_config('glance_store/swift_store_create_container_on_put').with_value(false)
       is_expected.to contain_glance_api_config('glance_store/swift_store_endpoint_type').with_value('internalURL')
+      is_expected.to contain_glance_api_config('glance_store/swift_store_region').with_value(nil)
     end
 
     it 'configures glance-cache.conf' do
@@ -40,6 +41,7 @@
       is_expected.to contain_glance_cache_config('glance_store/swift_store_auth_address').with_value('127.0.0.1:5000/v2.0/')
       is_expected.to contain_glance_cache_config('glance_store/swift_store_container').with_value('glance')
       is_expected.to contain_glance_cache_config('glance_store/swift_store_create_container_on_put').with_value(false)
+      is_expected.to contain_glance_cache_config('glance_store/swift_store_region').with_value(nil)
     end
   end
 
@@ -53,7 +55,8 @@
         :swift_store_auth_address            => '127.0.0.2:8080/v1.0/',
         :swift_store_container               => 'swift',
         :swift_store_create_container_on_put => true,
-        :swift_store_endpoint_type           => 'publicURL'
+        :swift_store_endpoint_type           => 'publicURL',
+        :swift_store_region                  => 'RegionTwo'
       }
     end
 
@@ -64,6 +67,7 @@
       is_expected.to contain_glance_api_config('glance_store/swift_store_large_object_size').with_value('100')
       is_expected.to contain_glance_api_config('glance_store/swift_store_auth_address').with_value('127.0.0.2:8080/v1.0/')
       is_expected.to contain_glance_api_config('glance_store/swift_store_endpoint_type').with_value('publicURL')
+      is_expected.to contain_glance_api_config('glance_store/swift_store_region').with_value('RegionTwo')
     end
 
     it 'configures glance-cache.conf' do
@@ -72,6 +76,7 @@
       is_expected.to contain_glance_cache_config('glance_store/swift_store_auth_version').with_value('1')
       is_expected.to contain_glance_cache_config('glance_store/swift_store_large_object_size').with_value('100')
       is_expected.to contain_glance_cache_config('glance_store/swift_store_auth_address').with_value('127.0.0.2:8080/v1.0/')
+      is_expected.to contain_glance_cache_config('glance_store/swift_store_region').with_value('RegionTwo')
     end
   end
 end
diff --git a/glance/spec/classes/glance_notify_rabbitmq_spec.rb b/glance/spec/classes/glance_notify_rabbitmq_spec.rb
index 7f5f76fa0..ad84e284c 100644
--- a/glance/spec/classes/glance_notify_rabbitmq_spec.rb
+++ b/glance/spec/classes/glance_notify_rabbitmq_spec.rb
@@ -26,6 +26,8 @@
     it { is_expected.to contain_glance_api_config('oslo_messaging_rabbit/rabbit_virtual_host').with_value('/') }
     it { is_expected.to contain_glance_api_config('oslo_messaging_rabbit/rabbit_notification_exchange').with_value('glance') }
     it { is_expected.to contain_glance_api_config('oslo_messaging_rabbit/rabbit_notification_topic').with_value('notifications') }
+    it { is_expected.to contain_glance_api_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('0') }
+    it { is_expected.to contain_glance_api_config('oslo_messaging_rabbit/heartbeat_rate').with_value('2') }
   end
 
   describe 'when passing params and use ssl' do
@@ -122,6 +124,18 @@
     it { is_expected.to_not contain_glance_api_config('oslo_messaging_rabbit/rabbit_host') }
   end
 
+  describe 'when passing params for rabbitmq heartbeat' do
+    let :params do
+      {
+        :rabbit_password                    => 'pass',
+        :rabbit_heartbeat_timeout_threshold => '60',
+        :rabbit_heartbeat_rate              => '10',
+      }
+    end
+    it { is_expected.to contain_glance_api_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('60') }
+    it { is_expected.to contain_glance_api_config('oslo_messaging_rabbit/heartbeat_rate').with_value('10') }
+  end
+
   describe 'when using deprecated params' do
     let :params do
       {
diff --git a/glance/spec/spec_helper_acceptance.rb b/glance/spec/spec_helper_acceptance.rb
index e29c01cd3..b25e26b7e 100644
--- a/glance/spec/spec_helper_acceptance.rb
+++ b/glance/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/gnocchi/.fixtures.yml b/gnocchi/.fixtures.yml
deleted file mode 100644
index 2561c2fce..000000000
--- a/gnocchi/.fixtures.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-fixtures:
-  repositories:
-    'inifile':  'git://github.com/puppetlabs/puppetlabs-inifile'
-    'concat':
-      'repo': 'git://github.com/puppetlabs/puppetlabs-concat.git'
-      'ref': '1.2.1'
-    'keystone': 'git://github.com/stackforge/puppet-keystone.git'
-    'mysql': 'git://github.com/puppetlabs/puppetlabs-mysql.git'
-    'openstacklib': 'git://github.com/stackforge/puppet-openstacklib.git'
-    'postgresql': 'git://github.com/puppetlabs/puppet-postgresql.git'
-    'stdlib': 'git://github.com/puppetlabs/puppetlabs-stdlib.git'
-  symlinks:
-    'gnocchi': "#{source_dir}"
diff --git a/gnocchi/.gitignore b/gnocchi/.gitignore
index da4238187..15c55efd0 100644
--- a/gnocchi/.gitignore
+++ b/gnocchi/.gitignore
@@ -1,7 +1,11 @@
-*.swp
-spec/fixtures/modules/*
-spec/fixtures/manifests/site.pp
+pkg/
 Gemfile.lock
-.vendor
-.bundle/
 vendor/
+spec/fixtures/
+.vagrant/
+.bundle/
+coverage/
+.idea/
+*.swp
+*.iml
+openstack/
diff --git a/gnocchi/Gemfile b/gnocchi/Gemfile
index 9ea211333..fc2214398 100644
--- a/gnocchi/Gemfile
+++ b/gnocchi/Gemfile
@@ -1,25 +1,31 @@
-source 'https://rubygems.org'
+source ENV['GEM_SOURCE'] || "https://rubygems.org"
 
 group :development, :test do
-  gem 'puppetlabs_spec_helper', :require => false
-  gem 'rspec-puppet', '~> 2.1.0', :require => false
-
-  gem 'metadata-json-lint'
-  gem 'puppet-lint-param-docs'
-  gem 'puppet-lint-absolute_classname-check'
-  gem 'puppet-lint-absolute_template_path'
-  gem 'puppet-lint-trailing_newline-check'
+  gem 'puppetlabs_spec_helper',               :require => 'false'
+  gem 'rspec-puppet', '~> 2.2.0',             :require => 'false'
+  gem 'metadata-json-lint',                   :require => 'false'
+  gem 'puppet-lint-param-docs',               :require => 'false'
+  gem 'puppet-lint-absolute_classname-check', :require => 'false'
+  gem 'puppet-lint-absolute_template_path',   :require => 'false'
+  gem 'puppet-lint-trailing_newline-check',   :require => 'false'
+  gem 'puppet-lint-unquoted_string-check',    :require => 'false'
+  gem 'puppet-lint-leading_zero-check',       :require => 'false'
+  gem 'puppet-lint-variable_contains_upcase', :require => 'false'
+  gem 'puppet-lint-numericvariable',          :require => 'false'
+  gem 'json',                                 :require => 'false'
+  gem 'webmock',                              :require => 'false'
+end
 
-  # Puppet 4.x related lint checks
-  gem 'puppet-lint-unquoted_string-check'
-  gem 'puppet-lint-leading_zero-check'
-  gem 'puppet-lint-variable_contains_upcase'
-  gem 'puppet-lint-numericvariable'
+group :system_tests do
+  gem 'beaker-rspec',                 :require => 'false'
+  gem 'beaker-puppet_install_helper', :require => 'false'
+  gem 'r10k',                         :require => 'false'
+end
 
-  gem 'beaker-rspec', :require => false
-  gem 'beaker-puppet_install_helper', :require => false
-  gem 'json'
-  gem 'webmock'
+if facterversion = ENV['FACTER_GEM_VERSION']
+  gem 'facter', facterversion, :require => false
+else
+  gem 'facter', :require => false
 end
 
 if puppetversion = ENV['PUPPET_GEM_VERSION']
diff --git a/gnocchi/README.md b/gnocchi/README.md
index 5a00b70be..00ac0ed86 100644
--- a/gnocchi/README.md
+++ b/gnocchi/README.md
@@ -34,6 +34,36 @@ Implementation
 
 gnocchi is a combination of Puppet manifest and ruby code to delivery configuration and extra functionality through types and providers.
 
+### Types
+
+#### gnocchi_config
+
+The `gnocchi_config` provider is a children of the ini_setting provider. It allows one to write an entry in the `/etc/gnocchi/gnocchi.conf` file.
+
+```puppet
+gnocchi_config { 'DEFAULT/verbose' :
+  value => true,
+}
+```
+
+This will write `verbose=true` in the `[DEFAULT]` section.
+
+##### name
+
+Section/setting name to manage from `gnocchi.conf`
+
+##### value
+
+The value of the setting to be defined.
+
+##### secret
+
+Whether to hide the value from Puppet logs. Defaults to `false`.
+
+##### ensure_absent_val
+
+If value is equal to ensure_absent_val then the resource will behave as if `ensure => absent` was specified. Defaults to `<SERVICE DEFAULT>`
+
 Limitations
 -----------
 
diff --git a/gnocchi/Rakefile b/gnocchi/Rakefile
index 84c9a7046..3c3603e3c 100644
--- a/gnocchi/Rakefile
+++ b/gnocchi/Rakefile
@@ -1,9 +1,85 @@
 require 'puppetlabs_spec_helper/rake_tasks'
 require 'puppet-lint/tasks/puppet-lint'
+require 'puppet-syntax/tasks/puppet-syntax'
+require 'json'
 
-PuppetLint.configuration.fail_on_warnings = true
-PuppetLint.configuration.send('disable_80chars')
-PuppetLint.configuration.send('disable_class_parameter_defaults')
+modname = JSON.parse(open('metadata.json').read)['name'].split('-')[1]
 
-task(:default).clear
-task :default => [:spec, :lint]
+PuppetSyntax.exclude_paths ||= []
+PuppetSyntax.exclude_paths << "spec/fixtures/**/*"
+PuppetSyntax.exclude_paths << "pkg/**/*"
+PuppetSyntax.exclude_paths << "vendor/**/*"
+
+Rake::Task[:lint].clear
+PuppetLint::RakeTask.new :lint do |config|
+  config.ignore_paths = ["spec/**/*.pp", "vendor/**/*.pp"]
+  config.fail_on_warnings = true
+  config.log_format = '%{path}:%{linenumber}:%{KIND}: %{message}'
+  config.disable_checks = ["80chars", "class_inherits_from_params_class", "class_parameter_defaults", "only_variable_string"]
+end
+
+desc "Run acceptance tests"
+RSpec::Core::RakeTask.new(:acceptance) do |t|
+  t.pattern = 'spec/acceptance'
+end
+
+Rake::Task[:spec_prep].clear
+desc 'Create the fixtures directory'
+task :spec_prep do
+  # Allow to test the module with custom dependencies
+  # like you could do with .fixtures file
+  if ENV['PUPPETFILE']
+    puppetfile = ENV['PUPPETFILE']
+    if ENV['GEM_HOME']
+      gem_home    = ENV['GEM_HOME']
+      gem_bin_dir = "#{gem_home}" + '/bin/'
+    else
+      gem_bin_dir = ''
+    end
+    r10k = ['env']
+    r10k += ["PUPPETFILE=#{puppetfile}"]
+    r10k += ["PUPPETFILE_DIR=#{Dir.pwd}/spec/fixtures/modules"]
+    r10k += ["#{gem_bin_dir}r10k"]
+    r10k += ['puppetfile', 'install', '-v']
+    sh(*r10k)
+  else
+  # otherwise, use official OpenStack Puppetfile
+    zuul_ref = ENV['ZUUL_REF']
+    zuul_branch = ENV['ZUUL_BRANCH']
+    zuul_url = ENV['ZUUL_URL']
+    repo = 'openstack/puppet-openstack-integration'
+    rm_rf(repo)
+    if File.exists?('/usr/zuul-env/bin/zuul-cloner')
+      zuul_clone_cmd = ['/usr/zuul-env/bin/zuul-cloner']
+      zuul_clone_cmd += ['--cache-dir', '/opt/git']
+      zuul_clone_cmd += ['--zuul-ref', "#{zuul_ref}"]
+      zuul_clone_cmd += ['--zuul-branch', "#{zuul_branch}"]
+      zuul_clone_cmd += ['--zuul-url', "#{zuul_url}"]
+      zuul_clone_cmd += ['git://git.openstack.org', "#{repo}"]
+      sh(*zuul_clone_cmd)
+    else
+      sh("git clone https://git.openstack.org/#{repo} #{repo}")
+    end
+    script = ['env']
+    script += ["PUPPETFILE_DIR=#{Dir.pwd}/spec/fixtures/modules"]
+    script += ["ZUUL_REF=#{zuul_ref}"]
+    script += ["ZUUL_BRANCH=#{zuul_branch}"]
+    script += ["ZUUL_URL=#{zuul_url}"]
+    script += ['bash', "#{repo}/install_modules_unit.sh"]
+    sh(*script)
+  end
+  rm_rf("spec/fixtures/modules/#{modname}")
+  ln_s(Dir.pwd, "spec/fixtures/modules/#{modname}")
+  mkdir_p('spec/fixtures/manifests')
+  touch('spec/fixtures/manifests/site.pp')
+end
+
+Rake::Task[:spec_clean].clear
+desc 'Clean up the fixtures directory'
+task :spec_clean do
+  rm_rf('spec/fixtures/modules')
+  rm_rf('openstack')
+  if File.zero?('spec/fixtures/manifests/site.pp')
+    rm_f('spec/fixtures/manifests/site.pp')
+  end
+end
diff --git a/gnocchi/lib/puppet/provider/gnocchi_config/ini_setting.rb b/gnocchi/lib/puppet/provider/gnocchi_config/ini_setting.rb
index 0fee4b125..e4f5888aa 100644
--- a/gnocchi/lib/puppet/provider/gnocchi_config/ini_setting.rb
+++ b/gnocchi/lib/puppet/provider/gnocchi_config/ini_setting.rb
@@ -1,27 +1,10 @@
 Puppet::Type.type(:gnocchi_config).provide(
   :ini_setting,
-  :parent => Puppet::Type.type(:ini_setting).provider(:ruby)
+  :parent => Puppet::Type.type(:openstack_config).provider(:ini_setting)
 ) do
 
-  def section
-    resource[:name].split('/', 2).first
-  end
-
-  def setting
-    resource[:name].split('/', 2).last
-  end
-
-  def separator
-    '='
-  end
-
   def self.file_path
     '/etc/gnocchi/gnocchi.conf'
   end
 
-  # added for backwards compatibility with older versions of inifile
-  def file_path
-    self.class.file_path
-  end
-
 end
diff --git a/gnocchi/lib/puppet/type/gnocchi_config.rb b/gnocchi/lib/puppet/type/gnocchi_config.rb
index 9fbf10c0f..7c32cf25c 100644
--- a/gnocchi/lib/puppet/type/gnocchi_config.rb
+++ b/gnocchi/lib/puppet/type/gnocchi_config.rb
@@ -14,6 +14,7 @@
       value.capitalize! if value =~ /^(true|false)$/i
       value
     end
+    newvalues(/^[\S ]*$/)
 
     def is_to_s( currentvalue )
       if resource.secret?
@@ -39,4 +40,14 @@ def should_to_s( newvalue )
 
     defaultto false
   end
+
+  newparam(:ensure_absent_val) do
+    desc 'A value that is specified as the value property will behave as if ensure => absent was specified'
+    defaultto('<SERVICE DEFAULT>')
+  end
+
+  autorequire(:package) do
+    'gnocchi-api'
+  end
+
 end
diff --git a/gnocchi/manifests/api.pp b/gnocchi/manifests/api.pp
index 86be53de3..bbb12a3f9 100644
--- a/gnocchi/manifests/api.pp
+++ b/gnocchi/manifests/api.pp
@@ -34,21 +34,33 @@
 #
 # [*verbose*]
 #   (optional) Rather to log the gnocchi api service at verbose level.
-#   Default: false
+#   Defaults to undef
 #
 # [*debug*]
 #   (optional) Rather to log the gnocchi api service at debug level.
-#   Default: false
+#   Defaults to undef
 #
 # [*log_file*]
 #   (optional) The path of file used for logging
 #   If set to boolean false, it will not log to any file.
-#   Default: /var/log/gnocchi/gnocchi-api.log
+#   Defaults to undef
 #
-#  [*log_dir*]
+# [*use_syslog*]
+#   (Optional) Use syslog for logging.
+#   Defaults to undef
+#
+# [*use_stderr*]
+#   (optional) Use stderr for logging
+#   Defaults to undef
+#
+# [*log_facility*]
+#   (Optional) Syslog facility to receive log lines.
+#   Defaults to undef
+#
+# [*log_dir*]
 #   (optional) directory to which gnocchi logs are sent.
 #   If set to boolean false, it will not log to any directory.
-#   Defaults to '/var/log/gnocchi'
+#   Defaults to undef
 #
 # [*keystone_tenant*]
 #   (optional) Tenant to authenticate to.
@@ -81,10 +93,13 @@
 #
 class gnocchi::api(
   $keystone_password,
-  $verbose                      = false,
-  $debug                        = false,
-  $log_file                     = '/var/log/gnocchi/gnocchi-api.log',
-  $log_dir                      = '/var/log/gnocchi',
+  $verbose                      = undef,
+  $debug                        = undef,
+  $use_syslog                   = undef,
+  $use_stderr                   = undef,
+  $log_facility                 = undef,
+  $log_dir                      = undef,
+  $log_file                     = undef,
   $keystone_tenant              = 'services',
   $keystone_user                = 'gnocchi',
   $identity_uri                 = 'http://127.0.0.1:35357',
@@ -97,11 +112,11 @@
 ) inherits gnocchi {
 
   require ::keystone::python
+  include ::gnocchi::logging
   include ::gnocchi::params
 
   Gnocchi_config<||> ~> Exec['post-gnocchi_config']
   Gnocchi_config<||> ~> Service['gnocchi-api']
-  Package['gnocchi-api'] -> Gnocchi_config<||>
 
   if $::gnocchi::database_connection {
     if($::gnocchi::database_connection =~ /mysql:\/\/\S+:\S+@\S+\/\S+/) {
@@ -122,47 +137,12 @@
 
   # basic service config
   gnocchi_config {
-    'DEFAULT/verbose':                      value => $verbose;
-    'DEFAULT/debug':                        value => $debug;
     'keystone_authtoken/identity_uri':      value => $identity_uri;
     'keystone_authtoken/admin_user':        value => $keystone_user;
     'keystone_authtoken/admin_password':    value => $keystone_password, secret => true;
     'keystone_authtoken/admin_tenant_name': value => $keystone_tenant;
   }
 
-  # Logging
-  if $log_file {
-    gnocchi_config {
-      'DEFAULT/log_file': value  => $log_file;
-    }
-  } else {
-    gnocchi_config {
-      'DEFAULT/log_file': ensure => absent;
-    }
-  }
-
-  if $log_dir {
-    gnocchi_config {
-      'DEFAULT/log_dir': value  => $log_dir;
-    }
-  } else {
-    gnocchi_config {
-      'DEFAULT/log_dir': ensure => absent;
-    }
-  }
-
-  # Syslog
-  if $use_syslog {
-    gnocchi_config {
-      'DEFAULT/use_syslog'          : value => true;
-      'DEFAULT/syslog_log_facility' : value => $log_facility;
-    }
-  } else {
-    gnocchi_config {
-      'DEFAULT/use_syslog': value => false;
-    }
-  }
-
   resources { 'gnocchi_config':
     purge => $purge_config,
   }
diff --git a/gnocchi/manifests/config.pp b/gnocchi/manifests/config.pp
new file mode 100644
index 000000000..7e473ec9b
--- /dev/null
+++ b/gnocchi/manifests/config.pp
@@ -0,0 +1,30 @@
+# == Class: gnocchi::config
+#
+# This class is used to manage arbitrary Gnocchi configurations.
+#
+# === Parameters
+#
+# [*gnocchi_config*]
+#   (optional) Allow configuration of arbitrary Gnocchi configurations.
+#   The value is an hash of gnocchi_config resources. Example:
+#   { 'DEFAULT/foo' => { value => 'fooValue'},
+#     'DEFAULT/bar' => { value => 'barValue'}
+#   }
+#   In yaml format, Example:
+#   gnocchi_config:
+#     DEFAULT/foo:
+#       value: fooValue
+#     DEFAULT/bar:
+#       value: barValue
+#
+#   NOTE: The configuration MUST NOT be already handled by this module
+#   or Puppet catalog compilation will fail with duplicate resources.
+#
+class gnocchi::config (
+  $gnocchi_config        = {},
+) {
+
+  validate_hash($gnocchi_config)
+
+  create_resources('gnocchi_config', $gnocchi_config)
+}
diff --git a/gnocchi/manifests/generic_service.pp b/gnocchi/manifests/generic_service.pp
index 9530cc151..9e0e898a0 100644
--- a/gnocchi/manifests/generic_service.pp
+++ b/gnocchi/manifests/generic_service.pp
@@ -68,6 +68,7 @@
         ensure => $ensure_package,
         name   => $package_name,
         notify => Service[$gnocchi_title],
+        tag    => ['openstack', 'gnocchi-package'],
       }
     }
   }
@@ -86,6 +87,7 @@
       name      => $service_name,
       enable    => $enabled,
       hasstatus => true,
+      tag       => 'gnocchi-service',
     }
   }
 }
diff --git a/gnocchi/manifests/keystone/auth.pp b/gnocchi/manifests/keystone/auth.pp
index cb010d9d6..129b0e253 100644
--- a/gnocchi/manifests/keystone/auth.pp
+++ b/gnocchi/manifests/keystone/auth.pp
@@ -45,6 +45,9 @@
 # [*service_type*]
 #   Type of service. Defaults to 'gnocchi'.
 #
+# [*service_description*]
+#   Description for keystone service. Optional. Defaults to 'OpenStack Datapoint Service'.
+#
 # [*public_protocol*]
 #   Protocol for public endpoint. Defaults to 'http'.
 #
@@ -88,6 +91,7 @@
   $configure_user      = true,
   $configure_user_role = true,
   $service_type        = 'gnocchi',
+  $service_description = 'OpenStack Datapoint Service',
   $public_protocol     = 'http',
   $public_address      = '127.0.0.1',
   $public_port         = '8041',
@@ -108,7 +112,7 @@
     configure_user_role => true,
     configure_endpoint  => $configure_endpoint,
     service_type        => $service_type,
-    service_description => 'OpenStack Datapoint Service',
+    service_description => $service_description,
     region              => $region,
     password            => $password,
     email               => $email,
diff --git a/gnocchi/manifests/logging.pp b/gnocchi/manifests/logging.pp
new file mode 100644
index 000000000..38586ab2e
--- /dev/null
+++ b/gnocchi/manifests/logging.pp
@@ -0,0 +1,265 @@
+# Class gnocchi::logging
+#
+#  gnocchi logging configuration
+#
+# == parameters
+#
+#  [*verbose*]
+#    (Optional) Should the daemons log verbose messages
+#    Defaults to 'false'
+#
+#  [*debug*]
+#    (Optional) Should the daemons log debug messages
+#    Defaults to 'false'
+#
+#  [*use_syslog*]
+#    (Optional) Use syslog for logging.
+#    Defaults to 'false'
+#
+#  [*use_stderr*]
+#    (optional) Use stderr for logging
+#    Defaults to 'true'
+#
+#  [*log_facility*]
+#    (Optional) Syslog facility to receive log lines.
+#    Defaults to 'LOG_USER'
+#
+#  [*log_dir*]
+#    (optional) Directory where logs should be stored.
+#    If set to boolean false, it will not log to any directory.
+#    Defaults to '/var/log/gnocchi'
+#
+#  [*log_file*]
+#    (optional) The path of file used for logging
+#    If set to boolean false, it will not log to any file.
+#    Default to '/var/log/gnocchi-api.log'
+#
+#  [*logging_context_format_string*]
+#    (optional) Format string to use for log messages with context.
+#    Defaults to undef.
+#    Example: '%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s\
+#              [%(request_id)s %(user_identity)s] %(instance)s%(message)s'
+#
+#  [*logging_default_format_string*]
+#    (optional) Format string to use for log messages without context.
+#    Defaults to undef.
+#    Example: '%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s\
+#              [-] %(instance)s%(message)s'
+#
+#  [*logging_debug_format_suffix*]
+#    (optional) Formatted data to append to log format when level is DEBUG.
+#    Defaults to undef.
+#    Example: '%(funcName)s %(pathname)s:%(lineno)d'
+#
+#  [*logging_exception_prefix*]
+#    (optional) Prefix each line of exception output with this format.
+#    Defaults to undef.
+#    Example: '%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s'
+#
+#  [*log_config_append*]
+#    The name of an additional logging configuration file.
+#    Defaults to undef.
+#    See https://docs.python.org/2/howto/logging.html
+#
+#  [*default_log_levels*]
+#    (optional) Hash of logger (keys) and level (values) pairs.
+#    Defaults to undef.
+#    Example:
+#      { 'amqp' => 'WARN', 'amqplib' => 'WARN', 'boto' => 'WARN',
+#        'qpid' => 'WARN', 'sqlalchemy' => 'WARN', 'suds' => 'INFO',
+#        'iso8601' => 'WARN',
+#        'requests.packages.urllib3.connectionpool' => 'WARN' }
+#
+#  [*publish_errors*]
+#    (optional) Publish error events (boolean value).
+#    Defaults to undef (false if unconfigured).
+#
+#  [*fatal_deprecations*]
+#    (optional) Make deprecations fatal (boolean value)
+#    Defaults to undef (false if unconfigured).
+#
+#  [*instance_format*]
+#    (optional) If an instance is passed with the log message, format it
+#               like this (string value).
+#    Defaults to undef.
+#    Example: '[instance: %(uuid)s] '
+#
+#  [*instance_uuid_format*]
+#    (optional) If an instance UUID is passed with the log message, format
+#               it like this (string value).
+#    Defaults to undef.
+#    Example: instance_uuid_format='[instance: %(uuid)s] '
+
+#  [*log_date_format*]
+#    (optional) Format string for %%(asctime)s in log records.
+#    Defaults to undef.
+#    Example: 'Y-%m-%d %H:%M:%S'
+
+class gnocchi::logging(
+  $use_syslog                    = false,
+  $use_stderr                    = true,
+  $log_facility                  = 'LOG_USER',
+  $log_dir                       = '/var/log/gnocchi',
+  $log_file                      = '/var/log/gnocchi/gnocchi-api.log',
+  $verbose                       = false,
+  $debug                         = false,
+  $logging_context_format_string = undef,
+  $logging_default_format_string = undef,
+  $logging_debug_format_suffix   = undef,
+  $logging_exception_prefix      = undef,
+  $log_config_append             = undef,
+  $default_log_levels            = undef,
+  $publish_errors                = undef,
+  $fatal_deprecations            = undef,
+  $instance_format               = undef,
+  $instance_uuid_format          = undef,
+  $log_date_format               = undef,
+) {
+
+  # NOTE(spredzy): In order to keep backward compatibility we rely on the pick function
+  # to use gnocchi::<myparam> first then gnocchi::logging::<myparam>.
+  $use_syslog_real = pick($::gnocchi::api::use_syslog,$use_syslog)
+  $use_stderr_real = pick($::gnocchi::api::use_stderr,$use_stderr)
+  $log_facility_real = pick($::gnocchi::api::log_facility,$log_facility)
+  $log_dir_real = pick($::gnocchi::api::log_dir,$log_dir)
+  $log_file_real = pick($::gnocchi::api::log_file,$log_file)
+  $verbose_real  = pick($::gnocchi::api::verbose,$verbose)
+  $debug_real = pick($::gnocchi::api::debug,$debug)
+
+  gnocchi_config {
+    'DEFAULT/debug'              : value => $debug_real;
+    'DEFAULT/verbose'            : value => $verbose_real;
+    'DEFAULT/use_stderr'         : value => $use_stderr_real;
+    'DEFAULT/use_syslog'         : value => $use_syslog_real;
+    'DEFAULT/log_dir'            : value => $log_dir_real;
+    'DEFAULT/log_file'           : value => $log_file_real;
+    'DEFAULT/syslog_log_facility': value => $log_facility_real;
+  }
+
+  if $logging_context_format_string {
+    gnocchi_config {
+      'DEFAULT/logging_context_format_string' :
+        value => $logging_context_format_string;
+      }
+    }
+  else {
+    gnocchi_config {
+      'DEFAULT/logging_context_format_string' : ensure => absent;
+      }
+    }
+
+  if $logging_default_format_string {
+    gnocchi_config {
+      'DEFAULT/logging_default_format_string' :
+        value => $logging_default_format_string;
+      }
+    }
+  else {
+    gnocchi_config {
+      'DEFAULT/logging_default_format_string' : ensure => absent;
+      }
+    }
+
+  if $logging_debug_format_suffix {
+    gnocchi_config {
+      'DEFAULT/logging_debug_format_suffix' :
+        value => $logging_debug_format_suffix;
+      }
+    }
+  else {
+    gnocchi_config {
+      'DEFAULT/logging_debug_format_suffix' : ensure => absent;
+      }
+    }
+
+  if $logging_exception_prefix {
+    gnocchi_config {
+      'DEFAULT/logging_exception_prefix' : value => $logging_exception_prefix;
+      }
+    }
+  else {
+    gnocchi_config {
+      'DEFAULT/logging_exception_prefix' : ensure => absent;
+      }
+    }
+
+  if $log_config_append {
+    gnocchi_config {
+      'DEFAULT/log_config_append' : value => $log_config_append;
+      }
+    }
+  else {
+    gnocchi_config {
+      'DEFAULT/log_config_append' : ensure => absent;
+      }
+    }
+
+  if $default_log_levels {
+    gnocchi_config {
+      'DEFAULT/default_log_levels' :
+        value => join(sort(join_keys_to_values($default_log_levels, '=')), ',');
+      }
+    }
+  else {
+    gnocchi_config {
+      'DEFAULT/default_log_levels' : ensure => absent;
+      }
+    }
+
+  if $publish_errors {
+    gnocchi_config {
+      'DEFAULT/publish_errors' : value => $publish_errors;
+      }
+    }
+  else {
+    gnocchi_config {
+      'DEFAULT/publish_errors' : ensure => absent;
+      }
+    }
+
+  if $fatal_deprecations {
+    gnocchi_config {
+      'DEFAULT/fatal_deprecations' : value => $fatal_deprecations;
+      }
+    }
+  else {
+    gnocchi_config {
+      'DEFAULT/fatal_deprecations' : ensure => absent;
+      }
+    }
+
+  if $instance_format {
+    gnocchi_config {
+      'DEFAULT/instance_format' : value => $instance_format;
+      }
+    }
+  else {
+    gnocchi_config {
+      'DEFAULT/instance_format' : ensure => absent;
+      }
+    }
+
+  if $instance_uuid_format {
+    gnocchi_config {
+      'DEFAULT/instance_uuid_format' : value => $instance_uuid_format;
+      }
+    }
+  else {
+    gnocchi_config {
+      'DEFAULT/instance_uuid_format' : ensure => absent;
+      }
+    }
+
+  if $log_date_format {
+    gnocchi_config {
+      'DEFAULT/log_date_format' : value => $log_date_format;
+      }
+    }
+  else {
+    gnocchi_config {
+      'DEFAULT/log_date_format' : ensure => absent;
+      }
+    }
+
+
+}
diff --git a/gnocchi/spec/acceptance/nodesets/centos-70-x64.yml b/gnocchi/spec/acceptance/nodesets/centos-70-x64.yml
new file mode 100644
index 000000000..5f097e9fe
--- /dev/null
+++ b/gnocchi/spec/acceptance/nodesets/centos-70-x64.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  centos-server-70-x64:
+    roles:
+      - master
+    platform: el-7-x86_64
+    box: puppetlabs/centos-7.0-64-nocm
+    box_url: https://vagrantcloud.com/puppetlabs/centos-7.0-64-nocm
+    hypervisor: vagrant
+CONFIG:
+  log_level: debug
+  type: foss
diff --git a/gnocchi/spec/acceptance/nodesets/default.yml b/gnocchi/spec/acceptance/nodesets/default.yml
index cba1cd04c..486b6a34e 100644
--- a/gnocchi/spec/acceptance/nodesets/default.yml
+++ b/gnocchi/spec/acceptance/nodesets/default.yml
@@ -1,11 +1,10 @@
 HOSTS:
-  ubuntu-server-1404-x64:
+  ubuntu-server-14.04-amd64:
     roles:
       - master
     platform: ubuntu-14.04-amd64
-    box : puppetlabs/ubuntu-14.04-64-nocm
-    box_url : https://vagrantcloud.com/puppetlabs/ubuntu-14.04-64-nocm
-    hypervisor : vagrant
+    box: puppetlabs/ubuntu-14.04-64-nocm
+    box_url: https://vagrantcloud.com/puppetlabs/ubuntu-14.04-64-nocm
+    hypervisor: vagrant
 CONFIG:
-  log_level   : debug
-  type: git
+  type: foss
diff --git a/gnocchi/spec/acceptance/nodesets/nodepool-centos7.yml b/gnocchi/spec/acceptance/nodesets/nodepool-centos7.yml
index 575ae6732..c55287420 100644
--- a/gnocchi/spec/acceptance/nodesets/nodepool-centos7.yml
+++ b/gnocchi/spec/acceptance/nodesets/nodepool-centos7.yml
@@ -3,7 +3,7 @@ HOSTS:
     roles:
       - master
     platform: el-7-x86_64
-    hypervisor : none
+    hypervisor: none
     ip: 127.0.0.1
 CONFIG:
   type: foss
diff --git a/gnocchi/spec/acceptance/nodesets/nodepool-trusty.yml b/gnocchi/spec/acceptance/nodesets/nodepool-trusty.yml
index a95d9f38d..9fc624e24 100644
--- a/gnocchi/spec/acceptance/nodesets/nodepool-trusty.yml
+++ b/gnocchi/spec/acceptance/nodesets/nodepool-trusty.yml
@@ -3,7 +3,7 @@ HOSTS:
     roles:
       - master
     platform: ubuntu-14.04-amd64
-    hypervisor : none
+    hypervisor: none
     ip: 127.0.0.1
 CONFIG:
   type: foss
diff --git a/gnocchi/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml b/gnocchi/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
index cba1cd04c..8001929b2 100644
--- a/gnocchi/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
+++ b/gnocchi/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
@@ -1,11 +1,11 @@
 HOSTS:
-  ubuntu-server-1404-x64:
+  ubuntu-server-14.04-amd64:
     roles:
       - master
     platform: ubuntu-14.04-amd64
-    box : puppetlabs/ubuntu-14.04-64-nocm
-    box_url : https://vagrantcloud.com/puppetlabs/ubuntu-14.04-64-nocm
-    hypervisor : vagrant
+    box: puppetlabs/ubuntu-14.04-64-nocm
+    box_url: https://vagrantcloud.com/puppetlabs/ubuntu-14.04-64-nocm
+    hypervisor: vagrant
 CONFIG:
-  log_level   : debug
-  type: git
+  log_level: debug
+  type: foss
diff --git a/gnocchi/spec/classes/gnocchi_api_spec.rb b/gnocchi/spec/classes/gnocchi_api_spec.rb
index 244c875e3..fd1e04022 100644
--- a/gnocchi/spec/classes/gnocchi_api_spec.rb
+++ b/gnocchi/spec/classes/gnocchi_api_spec.rb
@@ -17,6 +17,10 @@
 
     context 'with default parameters' do
 
+      it 'contains the logging class' do
+        is_expected.to contain_class('gnocchi::logging')
+      end
+
       it 'installs gnocchi-api package and service' do
         is_expected.to contain_service('gnocchi-api').with(
           :name      => platform_params[:api_service_name],
@@ -32,8 +36,6 @@
       end
 
       it 'configures gnocchi-api with default parameters' do
-        is_expected.to contain_gnocchi_config('DEFAULT/verbose').with_value(false)
-        is_expected.to contain_gnocchi_config('DEFAULT/debug').with_value(false)
         is_expected.to contain_gnocchi_config('keystone_authtoken/identity_uri').with_value(params[:identity_uri])
         is_expected.to contain_gnocchi_config('keystone_authtoken/admin_tenant_name').with_value(params[:keystone_tenant])
         is_expected.to contain_gnocchi_config('keystone_authtoken/admin_user').with_value(params[:keystone_user])
diff --git a/gnocchi/spec/classes/gnocchi_config_spec.rb b/gnocchi/spec/classes/gnocchi_config_spec.rb
new file mode 100644
index 000000000..edf53aeb8
--- /dev/null
+++ b/gnocchi/spec/classes/gnocchi_config_spec.rb
@@ -0,0 +1,20 @@
+require 'spec_helper'
+
+describe 'gnocchi::config' do
+
+  let :params do
+    { :gnocchi_config => {
+        'DEFAULT/foo' => { 'value'  => 'fooValue' },
+        'DEFAULT/bar' => { 'value'  => 'barValue' },
+        'DEFAULT/baz' => { 'ensure' => 'absent' }
+      }
+    }
+  end
+
+  it 'configures arbitrary gnocchi configurations' do
+    is_expected.to contain_gnocchi_config('DEFAULT/foo').with_value('fooValue')
+    is_expected.to contain_gnocchi_config('DEFAULT/bar').with_value('barValue')
+    is_expected.to contain_gnocchi_config('DEFAULT/baz').with_ensure('absent')
+  end
+
+end
diff --git a/gnocchi/spec/classes/gnocchi_logging_spec.rb b/gnocchi/spec/classes/gnocchi_logging_spec.rb
new file mode 100644
index 000000000..6a4c3e4a5
--- /dev/null
+++ b/gnocchi/spec/classes/gnocchi_logging_spec.rb
@@ -0,0 +1,146 @@
+require 'spec_helper'
+
+describe 'gnocchi::logging' do
+
+  let :params do
+    {
+    }
+  end
+
+  let :log_params do
+    {
+      :logging_context_format_string => '%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s',
+      :logging_default_format_string => '%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s',
+      :logging_debug_format_suffix => '%(funcName)s %(pathname)s:%(lineno)d',
+      :logging_exception_prefix => '%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s',
+      :log_config_append => '/etc/gnocchi/logging.conf',
+      :publish_errors => true,
+      :default_log_levels => { 
+        'amqp' => 'WARN', 'amqplib' => 'WARN', 'boto' => 'WARN',
+        'qpid' => 'WARN', 'sqlalchemy' => 'WARN', 'suds' => 'INFO',
+        'iso8601' => 'WARN',
+        'requests.packages.urllib3.connectionpool' => 'WARN' },
+     :fatal_deprecations => true,
+     :instance_format => '[instance: %(uuid)s] ',
+     :instance_uuid_format => '[instance: %(uuid)s] ',
+     :log_date_format => '%Y-%m-%d %H:%M:%S',
+     :use_syslog => true,
+     :use_stderr => false,
+     :log_facility => 'LOG_FOO',
+     :log_dir => '/var/log',
+     :log_file => '/var/log/foo.log',
+     :verbose => true,
+     :debug => true,
+    }
+  end
+
+  shared_examples_for 'gnocchi-logging' do
+
+    context 'with basic logging options and default settings' do
+      it_configures  'basic default logging settings'
+    end
+
+    context 'with basic logging options and non-default settings' do
+      before { params.merge!( log_params ) }
+      it_configures 'basic non-default logging settings'
+    end
+
+    context 'with extended logging options' do
+      before { params.merge!( log_params ) }
+      it_configures 'logging params set'
+    end
+
+    context 'without extended logging options' do
+      it_configures 'logging params unset'
+    end
+
+  end
+
+  shared_examples 'basic default logging settings' do
+    it 'configures gnocchi logging settins with default values' do
+      is_expected.to contain_gnocchi_config('DEFAULT/use_syslog').with(:value => 'false')
+      is_expected.to contain_gnocchi_config('DEFAULT/use_stderr').with(:value => 'true')
+      is_expected.to contain_gnocchi_config('DEFAULT/log_dir').with(:value => '/var/log/gnocchi')
+      is_expected.to contain_gnocchi_config('DEFAULT/log_file').with(:value => '/var/log/gnocchi/gnocchi-api.log')
+      is_expected.to contain_gnocchi_config('DEFAULT/verbose').with(:value => 'false')
+      is_expected.to contain_gnocchi_config('DEFAULT/debug').with(:value => 'false')
+    end
+  end
+
+  shared_examples 'basic non-default logging settings' do
+    it 'configures gnocchi logging settins with non-default values' do
+      is_expected.to contain_gnocchi_config('DEFAULT/use_syslog').with(:value => 'true')
+      is_expected.to contain_gnocchi_config('DEFAULT/use_stderr').with(:value => 'false')
+      is_expected.to contain_gnocchi_config('DEFAULT/syslog_log_facility').with(:value => 'LOG_FOO')
+      is_expected.to contain_gnocchi_config('DEFAULT/log_dir').with(:value => '/var/log')
+      is_expected.to contain_gnocchi_config('DEFAULT/log_file').with(:value => '/var/log/foo.log')
+      is_expected.to contain_gnocchi_config('DEFAULT/verbose').with(:value => 'true')
+      is_expected.to contain_gnocchi_config('DEFAULT/debug').with(:value => 'true')
+    end
+  end
+
+  shared_examples_for 'logging params set' do
+    it 'enables logging params' do
+      is_expected.to contain_gnocchi_config('DEFAULT/logging_context_format_string').with_value(
+        '%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s')
+
+      is_expected.to contain_gnocchi_config('DEFAULT/logging_default_format_string').with_value(
+        '%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s')
+
+      is_expected.to contain_gnocchi_config('DEFAULT/logging_debug_format_suffix').with_value(
+        '%(funcName)s %(pathname)s:%(lineno)d')
+
+      is_expected.to contain_gnocchi_config('DEFAULT/logging_exception_prefix').with_value(
+       '%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s')
+
+      is_expected.to contain_gnocchi_config('DEFAULT/log_config_append').with_value(
+        '/etc/gnocchi/logging.conf')
+      is_expected.to contain_gnocchi_config('DEFAULT/publish_errors').with_value(
+        true)
+
+      is_expected.to contain_gnocchi_config('DEFAULT/default_log_levels').with_value(
+        'amqp=WARN,amqplib=WARN,boto=WARN,iso8601=WARN,qpid=WARN,requests.packages.urllib3.connectionpool=WARN,sqlalchemy=WARN,suds=INFO')
+
+      is_expected.to contain_gnocchi_config('DEFAULT/fatal_deprecations').with_value(
+        true)
+
+      is_expected.to contain_gnocchi_config('DEFAULT/instance_format').with_value(
+        '[instance: %(uuid)s] ')
+
+      is_expected.to contain_gnocchi_config('DEFAULT/instance_uuid_format').with_value(
+        '[instance: %(uuid)s] ')
+
+      is_expected.to contain_gnocchi_config('DEFAULT/log_date_format').with_value(
+        '%Y-%m-%d %H:%M:%S')
+    end
+  end
+
+
+  shared_examples_for 'logging params unset' do
+   [ :logging_context_format_string, :logging_default_format_string,
+     :logging_debug_format_suffix, :logging_exception_prefix,
+     :log_config_append, :publish_errors,
+     :default_log_levels, :fatal_deprecations,
+     :instance_format, :instance_uuid_format,
+     :log_date_format, ].each { |param|
+        it { is_expected.to contain_gnocchi_config("DEFAULT/#{param}").with_ensure('absent') }
+      }
+  end
+
+  context 'on Debian platforms' do
+    let :facts do
+      { :osfamily => 'Debian' }
+    end
+
+    it_configures 'gnocchi-logging'
+  end
+
+  context 'on RedHat platforms' do
+    let :facts do
+      { :osfamily => 'RedHat' }
+    end
+
+    it_configures 'gnocchi-logging'
+  end
+
+end
diff --git a/gnocchi/spec/shared_examples.rb b/gnocchi/spec/shared_examples.rb
index 4bc52a928..a888e4622 100644
--- a/gnocchi/spec/shared_examples.rb
+++ b/gnocchi/spec/shared_examples.rb
@@ -11,13 +11,15 @@
       is_expected.to contain_package(service[:name]).with({
         :name   => service[:package_name],
         :ensure => 'present',
-        :notify => "Service[#{service[:name]}]"
+        :notify => "Service[#{service[:name]}]",
+        :tag    => ['openstack', 'gnocchi-package'],
       })
       is_expected.to contain_service(service[:name]).with({
         :name      => service[:service_name],
         :ensure    => 'stopped',
         :hasstatus => true,
-        :enable    => false
+        :enable    => false,
+        :tag       => 'gnocchi-service',
       })
     end
   end
@@ -32,13 +34,15 @@
       is_expected.to contain_package(service[:name]).with({
         :name   => service[:package_name],
         :ensure => '2014.1-1',
-        :notify => "Service[#{service[:name]}]"
+        :notify => "Service[#{service[:name]}]",
+        :tag    => ['openstack', 'gnocchi-package'],
       })
       is_expected.to contain_service(service[:name]).with({
         :name      => service[:service_name],
         :ensure    => 'running',
         :hasstatus => true,
-        :enable    => true
+        :enable    => true,
+        :tag       => 'gnocchi-service',
       })
     end
   end
diff --git a/gnocchi/spec/spec_helper.rb b/gnocchi/spec/spec_helper.rb
index 53d4dd02d..3df4cede1 100644
--- a/gnocchi/spec/spec_helper.rb
+++ b/gnocchi/spec/spec_helper.rb
@@ -1,7 +1,10 @@
 require 'puppetlabs_spec_helper/module_spec_helper'
 require 'shared_examples'
+require 'webmock/rspec'
 
 RSpec.configure do |c|
   c.alias_it_should_behave_like_to :it_configures, 'configures'
   c.alias_it_should_behave_like_to :it_raises, 'raises'
 end
+
+at_exit { RSpec::Puppet::Coverage.report! }
diff --git a/gnocchi/spec/unit/provider/gnocchi_config/ini_setting_spec.rb b/gnocchi/spec/unit/provider/gnocchi_config/ini_setting_spec.rb
index 059a5a2f5..a3fbe1cbb 100644
--- a/gnocchi/spec/unit/provider/gnocchi_config/ini_setting_spec.rb
+++ b/gnocchi/spec/unit/provider/gnocchi_config/ini_setting_spec.rb
@@ -13,6 +13,17 @@
     'inifile',
     'lib')
 )
+$LOAD_PATH.push(
+  File.join(
+    File.dirname(__FILE__),
+    '..',
+    '..',
+    '..',
+    'fixtures',
+    'modules',
+    'openstacklib',
+    'lib')
+)
 require 'spec_helper'
 provider_class = Puppet::Type.type(:gnocchi_config).provider(:ini_setting)
 describe provider_class do
@@ -34,4 +45,22 @@
     expect(provider.section).to eq('dude')
     expect(provider.setting).to eq('foo')
   end
+
+  it 'should ensure absent when <SERVICE DEFAULT> is specified as a value' do
+    resource = Puppet::Type::Gnocchi_config.new(
+      {:name => 'dude/foo', :value => '<SERVICE DEFAULT>'}
+    )
+    provider = provider_class.new(resource)
+    provider.exists?
+    expect(resource[:ensure]).to eq :absent
+  end
+
+  it 'should ensure absent when value matches ensure_absent_val' do
+    resource = Puppet::Type::Gnocchi_config.new(
+      {:name => 'dude/foo', :value => 'foo', :ensure_absent_val => 'foo' }
+    )
+    provider = provider_class.new(resource)
+    provider.exists?
+    expect(resource[:ensure]).to eq :absent
+  end
 end
diff --git a/gnocchi/spec/unit/type/gnocchi_config_spec.rb b/gnocchi/spec/unit/type/gnocchi_config_spec.rb
index d711b0345..64580fe4c 100644
--- a/gnocchi/spec/unit/type/gnocchi_config_spec.rb
+++ b/gnocchi/spec/unit/type/gnocchi_config_spec.rb
@@ -49,4 +49,15 @@
       @gnocchi_config[:ensure] = :latest
     }.to raise_error(Puppet::Error, /Invalid value/)
   end
+
+  it 'should autorequire the package that install the file' do
+    catalog = Puppet::Resource::Catalog.new
+    package = Puppet::Type.type(:package).new(:name => 'gnocchi-api')
+    catalog.add_resource package, @gnocchi_config
+    dependency = @gnocchi_config.autorequire
+    expect(dependency.size).to eq(1)
+    expect(dependency[0].target).to eq(@gnocchi_config)
+    expect(dependency[0].source).to eq(package)
+  end
+
 end
diff --git a/heat/CHANGELOG.md b/heat/CHANGELOG.md
index fd37e6d33..131c7b961 100644
--- a/heat/CHANGELOG.md
+++ b/heat/CHANGELOG.md
@@ -1,3 +1,36 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+This is a backwards-incompatible major release for OpenStack Kilo.
+
+####Backwards-incompatible changes
+- Move rabbit/kombu settings to oslo_messaging_rabbit section
+
+####Features
+- Puppet 4.x support
+- Implement Keystone domain creation
+- Log output of heat-keystone-setup-domain
+- Refactorise Keystone resources management
+- Move keystone role creation to keystone area
+- Support region_name for Heat
+- Mark heat's keystone password as secret
+- Add support for identity_uri
+- Make configuring the service optional
+- Set instance_user in heat
+- Added missing enable_stack_abandon configuration option
+- Tag all Heat packages
+- Create a sync_db boolean for Heat
+- Engine: validate auth_encryption_key
+- Allow setting default config/signal transport
+- Run db_sync when heat-common is upgraded
+- Introduce public_url, internal_url and admin_url
+
+####Maintenance
+- Acceptance tests with Beaker
+- Fix spec tests for RSpec 3.x and Puppet 4.x
+- Rename keystone_v2_authenticate method
+- Make package_ensure consistent across classes
+
 ##2015-06-17 - 5.1.0
 ###Summary
 
diff --git a/heat/README.md b/heat/README.md
index b75cd196f..246c4b6d7 100644
--- a/heat/README.md
+++ b/heat/README.md
@@ -1,7 +1,7 @@
 puppet-heat
 =============
 
-5.1.0 - 2014.2 - Juno
+6.0.0 - 2015.1 - Kilo
 
 #### Table of Contents
 
diff --git a/heat/lib/puppet/provider/heat_domain_id_setter/ruby.rb b/heat/lib/puppet/provider/heat_domain_id_setter/ruby.rb
deleted file mode 100644
index 12ce71acf..000000000
--- a/heat/lib/puppet/provider/heat_domain_id_setter/ruby.rb
+++ /dev/null
@@ -1,189 +0,0 @@
-## NB: This must work with Ruby 1.8!
-
-# This provider permits the stack_user_domain parameter in heat.conf
-# to be set by providing a domain_name to the Puppet module and
-# using the Keystone REST API to translate the name into the corresponding
-# UUID.
-#
-# This requires that tenant names be unique.  If there are multiple matches
-# for a given tenant name, this provider will raise an exception.
-
-require 'rubygems'
-require 'net/http'
-require 'json'
-
-class KeystoneError < Puppet::Error
-end
-
-class KeystoneConnectionError < KeystoneError
-end
-
-class KeystoneAPIError < KeystoneError
-end
-
-# Provides common request handling semantics to the other methods in
-# this module.
-#
-# +req+::
-#   An HTTPRequest object
-# +url+::
-#   A parsed URL (returned from URI.parse)
-def handle_request(req, url)
-    begin
-        # There is issue with ipv6 where address has to be in brackets, this causes the
-        # underlying ruby TCPSocket to fail. Net::HTTP.new will fail without brackets on
-        # joining the ipv6 address with :port or passing brackets to TCPSocket. It was
-        # found that if we use Net::HTTP.start with url.hostname the incriminated code
-        # won't be hit.
-        use_ssl = url.scheme == "https" ? true : false
-        res = Net::HTTP.start(url.hostname, url.port, {:use_ssl => use_ssl}) {|http|
-            http.request(req)
-        }
-
-        if res.code != '200'
-            raise KeystoneAPIError, "Received error response from Keystone server at #{url}: #{res.message}"
-        end
-    rescue Errno::ECONNREFUSED => detail
-        raise KeystoneConnectionError, "Failed to connect to Keystone server at #{url}: #{detail}"
-    rescue SocketError => detail
-        raise KeystoneConnectionError, "Failed to connect to Keystone server at #{url}: #{detail}"
-    end
-
-    res
-end
-
-# Authenticates to a Keystone server and obtains an authentication token.
-# It returns a 2-element +[token, authinfo]+, where +token+ is a token
-# suitable for passing to openstack apis in the +X-Auth-Token+ header, and
-# +authinfo+ is the complete response from Keystone, including the service
-# catalog (if available).
-#
-# +auth_url+::
-#   Keystone endpoint URL.  This function assumes API version
-#   2.0 and an administrative endpoint, so this will typically look like
-#   +http://somehost:35357/v2.0+.
-#
-# +username+::
-#   Username for authentication.
-#
-# +password+::
-#   Password for authentication
-#
-# +tenantID+::
-#   Tenant UUID
-#
-# +tenantName+::
-#   Tenant name
-#
-def heat_handle_requests(auth_url,
-                             username,
-                             password,
-                             tenantId=nil,
-                             tenantName=nil)
-
-    post_args = {
-        'auth' => {
-            'passwordCredentials' => {
-                'username' => username,
-                'password' => password
-            },
-        }}
-
-    if tenantId
-        post_args['auth']['tenantId'] = tenantId
-    end
-
-    if tenantName
-        post_args['auth']['tenantName'] = tenantName
-    end
-
-    url = URI.parse("#{auth_url}/tokens")
-    req = Net::HTTP::Post.new url.path
-    req['content-type'] = 'application/json'
-    req.body = post_args.to_json
-
-    res = handle_request(req, url)
-    data = JSON.parse res.body
-    return data['access']['token']['id'], data
-end
-
-# Queries a Keystone server to a list of all tenants.
-#
-# +auth_url+::
-#   Keystone endpoint.  See the notes for +auth_url+ in
-#   +heat_handle_requests+.
-#
-# +token+::
-#   A Keystone token that will be passed in requests as the value of the
-#   +X-Auth-Token+ header.
-#
-def keystone_v3_domains(auth_url,
-                        token)
-
-    auth_url.sub!('v2.0', 'v3')
-    url = URI.parse("#{auth_url}/domains")
-    req = Net::HTTP::Get.new url.path
-    req['content-type'] = 'application/json'
-    req['x-auth-token'] = token
-
-    res = handle_request(req, url)
-    data = JSON.parse res.body
-    data['domains']
-end
-
-Puppet::Type.type(:heat_domain_id_setter).provide(:ruby) do
-    def authenticate
-        token, authinfo = heat_handle_requests(
-            @resource[:auth_url],
-            @resource[:auth_username],
-            @resource[:auth_password],
-            nil,
-            @resource[:auth_tenant_name])
-
-        return token
-    end
-
-    def find_domain_by_name(token)
-        domains = keystone_v3_domains(
-            @resource[:auth_url],
-            token)
-        domains.select{|domain| domain['name'] == @resource[:domain_name]}
-    end
-
-    def exists?
-        false
-    end
-
-    def create
-        config
-    end
-
-    # This looks for the domain specified by the 'domain_name' parameter to
-    # the resource and returns the corresponding UUID if there is a single
-    # match.
-    #
-    # Raises a KeystoneAPIError if:
-    #
-    # - There are multiple matches, or
-    # - There are zero matches
-    def get_domain_id
-        token = authenticate
-        domains = find_domain_by_name(token)
-
-        if domains.length == 1
-            return domains[0]['id']
-        elsif domains.length > 1
-            name = domains[0]['name']
-            raise KeystoneAPIError, 'Found multiple matches for domain name "#{name}"'
-        else
-            raise KeystoneAPIError, 'Unable to find matching domain'
-        end
-    end
-
-    def config
-        Puppet::Type.type(:heat_config).new(
-            {:name => 'DEFAULT/stack_user_domain', :value => "#{get_domain_id}"}
-        ).create
-    end
-
-end
diff --git a/heat/lib/puppet/type/heat_domain_id_setter.rb b/heat/lib/puppet/type/heat_domain_id_setter.rb
deleted file mode 100644
index d6e1eeef0..000000000
--- a/heat/lib/puppet/type/heat_domain_id_setter.rb
+++ /dev/null
@@ -1,31 +0,0 @@
-Puppet::Type.newtype(:heat_domain_id_setter) do
-
-    ensurable
-
-    newparam(:name, :namevar => true) do
-        desc 'The name of the setting to update'
-    end
-
-    newparam(:domain_name) do
-        desc 'The heat domain name'
-    end
-
-    newparam(:auth_url) do
-        desc 'The Keystone endpoint URL'
-        defaultto 'http://localhost:35357/v2.0'
-    end
-
-    newparam(:auth_username) do
-        desc 'Username with which to authenticate'
-        defaultto 'admin'
-    end
-
-    newparam(:auth_password) do
-        desc 'Password with which to authenticate'
-    end
-
-    newparam(:auth_tenant_name) do
-        desc 'Tenant name with which to authenticate'
-        defaultto 'admin'
-    end
-end
diff --git a/heat/manifests/init.pp b/heat/manifests/init.pp
index b6a7327df..76c002ead 100644
--- a/heat/manifests/init.pp
+++ b/heat/manifests/init.pp
@@ -25,6 +25,10 @@
 #   (Optional) Use these options to configure the RabbitMQ message system.
 #   Defaults to 'heat.openstack.common.rpc.impl_kombu'
 #
+# [*rpc_response_timeout*]
+#   (Optional) Configure the timeout (in seconds) for rpc responses
+#   Defaults to 60 seconds
+#
 # [*rabbit_host*]
 #   (Optional) IP or hostname of the rabbit server.
 #   Defaults to '127.0.0.1'
@@ -50,6 +54,21 @@
 #   (Optional) Virtual_host to use.
 #   Defaults to '/'
 #
+# [*rabbit_heartbeat_timeout_threshold*]
+#   (optional) Number of seconds after which the RabbitMQ broker is considered
+#   down if the heartbeat keepalive fails.  Any value >0 enables heartbeats.
+#   Heartbeating helps to ensure the TCP connection to RabbitMQ isn't silently
+#   closed, resulting in missed or lost messages from the queue.
+#   (Requires kombu >= 3.0.7 and amqp >= 1.4.0)
+#   Defaults to 0
+#
+# [*rabbit_heartbeat_rate*]
+#   (optional) How often during the rabbit_heartbeat_timeout_threshold period to
+#   check the heartbeat on RabbitMQ connection.  (i.e. rabbit_heartbeat_rate=2
+#   when rabbit_heartbeat_timeout_threshold=60, the heartbeat will be checked
+#   every 30 seconds.
+#   Defaults to 2
+#
 # [*rabbit_use_ssl*]
 #   (Optional) Connect over SSL for RabbitMQ.
 #   Defaults to false
@@ -154,7 +173,9 @@
 # [*instance_user*]
 #   (Optional) The default user for new instances. Although heat claims that
 #   this feature is deprecated, it still sets the users to ec2-user if
-#   you leave this unset. This will likely be deprecated in K or L.
+#   you leave this unset. If you want heat to not set instance_user to
+#   ec2-user, you need to set this to an empty string. This feature has been
+#   deprecated for some time and will likely be removed in L or M.
 #
 # [*enable_stack_adopt*]
 #   (Optional) Enable the stack-adopt feature.
@@ -189,58 +210,60 @@
 #   Defaults to http.
 #
 class heat(
-  $auth_uri                    = false,
-  $identity_uri                = false,
-  $package_ensure              = 'present',
-  $verbose                     = false,
-  $debug                       = false,
-  $log_dir                     = '/var/log/heat',
-  $keystone_user               = 'heat',
-  $keystone_tenant             = 'services',
-  $keystone_password           = false,
-  $keystone_ec2_uri            = 'http://127.0.0.1:5000/v2.0/ec2tokens',
-  $rpc_backend                 = 'heat.openstack.common.rpc.impl_kombu',
-  $rabbit_host                 = '127.0.0.1',
-  $rabbit_port                 = 5672,
-  $rabbit_hosts                = undef,
-  $rabbit_userid               = 'guest',
-  $rabbit_password             = '',
-  $rabbit_virtual_host         = '/',
-  $rabbit_use_ssl              = false,
-  $kombu_ssl_ca_certs          = undef,
-  $kombu_ssl_certfile          = undef,
-  $kombu_ssl_keyfile           = undef,
-  $kombu_ssl_version           = 'TLSv1',
-  $amqp_durable_queues         = false,
-  $qpid_hostname               = 'localhost',
-  $qpid_port                   = 5672,
-  $qpid_username               = 'guest',
-  $qpid_password               = 'guest',
-  $qpid_heartbeat              = 60,
-  $qpid_protocol               = 'tcp',
-  $qpid_tcp_nodelay            = true,
-  $qpid_reconnect              = true,
-  $qpid_reconnect_timeout      = 0,
-  $qpid_reconnect_limit        = 0,
-  $qpid_reconnect_interval_min = 0,
-  $qpid_reconnect_interval_max = 0,
-  $qpid_reconnect_interval     = 0,
-  $database_connection         = 'sqlite:////var/lib/heat/heat.sqlite',
-  $database_idle_timeout       = 3600,
-  $use_syslog                  = false,
-  $log_facility                = 'LOG_USER',
-  $flavor                      = undef,
-  $region_name                 = undef,
-  $enable_stack_adopt          = undef,
-  $enable_stack_abandon        = undef,
-  $sync_db                     = true,
+  $auth_uri                           = false,
+  $identity_uri                       = false,
+  $package_ensure                     = 'present',
+  $verbose                            = false,
+  $debug                              = false,
+  $log_dir                            = '/var/log/heat',
+  $keystone_user                      = 'heat',
+  $keystone_tenant                    = 'services',
+  $keystone_password                  = false,
+  $keystone_ec2_uri                   = 'http://127.0.0.1:5000/v2.0/ec2tokens',
+  $rpc_backend                        = 'heat.openstack.common.rpc.impl_kombu',
+  $rabbit_host                        = '127.0.0.1',
+  $rabbit_port                        = 5672,
+  $rabbit_hosts                       = undef,
+  $rabbit_userid                      = 'guest',
+  $rabbit_password                    = '',
+  $rabbit_virtual_host                = '/',
+  $rabbit_heartbeat_timeout_threshold = 0,
+  $rabbit_heartbeat_rate              = 2,
+  $rabbit_use_ssl                     = false,
+  $kombu_ssl_ca_certs                 = undef,
+  $kombu_ssl_certfile                 = undef,
+  $kombu_ssl_keyfile                  = undef,
+  $kombu_ssl_version                  = 'TLSv1',
+  $amqp_durable_queues                = false,
+  $qpid_hostname                      = 'localhost',
+  $qpid_port                          = 5672,
+  $qpid_username                      = 'guest',
+  $qpid_password                      = 'guest',
+  $qpid_heartbeat                     = 60,
+  $qpid_protocol                      = 'tcp',
+  $qpid_tcp_nodelay                   = true,
+  $qpid_reconnect                     = true,
+  $qpid_reconnect_timeout             = 0,
+  $qpid_reconnect_limit               = 0,
+  $qpid_reconnect_interval_min        = 0,
+  $qpid_reconnect_interval_max        = 0,
+  $qpid_reconnect_interval            = 0,
+  $database_connection                = 'sqlite:////var/lib/heat/heat.sqlite',
+  $database_idle_timeout              = 3600,
+  $use_syslog                         = false,
+  $log_facility                       = 'LOG_USER',
+  $flavor                             = undef,
+  $region_name                        = undef,
+  $enable_stack_adopt                 = undef,
+  $enable_stack_abandon               = undef,
+  $sync_db                            = true,
   # Deprecated parameters
-  $mysql_module                = undef,
-  $sql_connection              = undef,
-  $keystone_host               = '127.0.0.1',
-  $keystone_port               = '35357',
-  $keystone_protocol           = 'http',
-  $instance_user               = undef,
+  $mysql_module                       = undef,
+  $sql_connection                     = undef,
+  $keystone_host                      = '127.0.0.1',
+  $keystone_port                      = '35357',
+  $keystone_protocol                  = 'http',
+  $instance_user                      = undef,
 ) {
 
   include ::heat::params
@@ -322,11 +345,13 @@
     }
 
     heat_config {
-      'oslo_messaging_rabbit/rabbit_userid'          : value => $rabbit_userid;
-      'oslo_messaging_rabbit/rabbit_password'        : value => $rabbit_password, secret => true;
-      'oslo_messaging_rabbit/rabbit_virtual_host'    : value => $rabbit_virtual_host;
-      'oslo_messaging_rabbit/rabbit_use_ssl'         : value => $rabbit_use_ssl;
-      'DEFAULT/amqp_durable_queues'    : value => $amqp_durable_queues;
+      'oslo_messaging_rabbit/rabbit_userid':                value => $rabbit_userid;
+      'oslo_messaging_rabbit/rabbit_password':              value => $rabbit_password, secret => true;
+      'oslo_messaging_rabbit/rabbit_virtual_host':          value => $rabbit_virtual_host;
+      'oslo_messaging_rabbit/heartbeat_timeout_threshold':  value => $rabbit_heartbeat_timeout_threshold;
+      'oslo_messaging_rabbit/heartbeat_rate':               value => $rabbit_heartbeat_rate;
+      'oslo_messaging_rabbit/rabbit_use_ssl':               value => $rabbit_use_ssl;
+      'DEFAULT/amqp_durable_queues':                        value => $amqp_durable_queues;
     }
 
     if $rabbit_use_ssl {
@@ -448,6 +473,7 @@
 
   heat_config {
     'DEFAULT/rpc_backend'                  : value => $rpc_backend;
+    'DEFAULT/rpc_response_timeout'         : value => $rpc_response_timeout;
     'DEFAULT/debug'                        : value => $debug;
     'DEFAULT/verbose'                      : value => $verbose;
     'ec2authtoken/auth_uri'                : value => $keystone_ec2_uri;
@@ -552,7 +578,10 @@
   }
 
   # instance_user
-  if $instance_user {
+  # special case for empty string since it's a valid value
+  if $instance_user == '' {
+    heat_config { 'DEFAULT/instance_user': value => ''; }
+  } elsif $instance_user {
     heat_config { 'DEFAULT/instance_user': value => $instance_user; }
   } else {
     heat_config { 'DEFAULT/instance_user': ensure => absent; }
diff --git a/heat/manifests/keystone/domain.pp b/heat/manifests/keystone/domain.pp
index 35f675ff8..19b26703c 100644
--- a/heat/manifests/keystone/domain.pp
+++ b/heat/manifests/keystone/domain.pp
@@ -1,12 +1,23 @@
 # == Class: heat::keystone::domain
 #
-# Configures heat domain in Keystone.
-#
-# Note: Implementation is done by heat-keystone-setup-domain script temporarily
-#       because currently puppet-keystone does not support v3 API
+# Configures Heat domain in Keystone.
 #
 # === Parameters
 #
+# [*domain_name*]
+#   Heat domain name. Defaults to 'heat'.
+#
+# [*domain_admin*]
+#   Keystone domain admin user which will be created. Defaults to 'heat_admin'.
+#
+# [*domain_admin_email*]
+#   Keystone domain admin user email address. Defaults to 'heat_admin@localhost'.
+
+# [*domain_password*]
+#   Keystone domain admin user password. Defaults to 'changeme'.
+#
+# === Deprecated Parameters
+#
 # [*auth_url*]
 #   Keystone auth url
 #
@@ -19,57 +30,54 @@
 # [*keystone_tenant*]
 #   Keystone admin tenant name
 #
-# [*domain_name*]
-#   Heat domain name. Defaults to 'heat'.
-#
-# [*domain_admin*]
-#   Keystone domain admin user which will be created. Defaults to 'heat_admin'.
-#
-# [*domain_password*]
-#   Keystone domain admin user password. Defaults to 'changeme'.
-#
 class heat::keystone::domain (
-  $auth_url          = undef,
-  $keystone_admin    = undef,
-  $keystone_password = undef,
-  $keystone_tenant   = undef,
-  $domain_name       = 'heat',
-  $domain_admin      = 'heat_admin',
-  $domain_password   = 'changeme',
+  $domain_name        = 'heat',
+  $domain_admin       = 'heat_admin',
+  $domain_admin_email = 'heat_admin@localhost',
+  $domain_password    = 'changeme',
+
+  # DEPRECATED PARAMETERS
+  $auth_url           = undef,
+  $keystone_admin     = undef,
+  $keystone_password  = undef,
+  $keystone_tenant    = undef,
 ) {
 
   include ::heat::params
 
-  $cmd_evn = [
-    "OS_TENANT_NAME=${keystone_tenant}",
-    "OS_USERNAME=${keystone_admin}",
-    "OS_PASSWORD=${keystone_password}",
-    "OS_AUTH_URL=${auth_url}",
-    "HEAT_DOMAIN=${domain_name}",
-    "HEAT_DOMAIN_ADMIN=${domain_admin}",
-    "HEAT_DOMAIN_PASSWORD=${domain_password}"
-  ]
-  exec { 'heat_domain_create':
-    path        => '/usr/bin',
-    command     => 'heat-keystone-setup-domain',
-    environment => $cmd_evn,
-    require     => Package['heat-common'],
-    logoutput   => 'on_failure'
+  if $auth_url {
+    warning('The auth_url parameter is deprecated and will be removed in future releases')
   }
-
-  heat_domain_id_setter { 'heat_domain_id':
-    ensure           => present,
-    domain_name      => $domain_name,
-    auth_url         => $auth_url,
-    auth_username    => $keystone_admin,
-    auth_password    => $keystone_password,
-    auth_tenant_name => $keystone_tenant,
-    require          => Exec['heat_domain_create'],
+  if $keystone_admin {
+    warning('The keystone_admin parameter is deprecated and will be removed in future releases')
+  }
+  if $keystone_password {
+    warning('The keystone_password parameter is deprecated and will be removed in future releases')
   }
+  if $keystone_tenant {
+    warning('The keystone_tenant parameter is deprecated and will be removed in future releases')
+  }
+
+  ensure_resource('keystone_domain', 'heat_domain', {
+    'ensure'  => 'present',
+    'enabled' => true,
+    'name'    => $domain_name
+  })
+  ensure_resource('keystone_user', 'heat_domain_admin', {
+    'ensure'   => 'present',
+    'enabled'  => true,
+    'name'     => $domain_admin,
+    'email'    => $domain_admin_email,
+    'password' => $domain_password,
+    'domain'   => $domain_name,
+  })
+  ensure_resource('keystone_user_role', "${domain_admin}@::${domain_name}", {
+    'roles' => ['admin'],
+  })
 
   heat_config {
-    'DEFAULT/stack_domain_admin': value => $domain_admin;
+    'DEFAULT/stack_domain_admin':          value => $domain_admin;
     'DEFAULT/stack_domain_admin_password': value => $domain_password, secret => true;
+    'DEFAULT/stack_user_domain_name':      value => $domain_name;
   }
-
 }
diff --git a/heat/metadata.json b/heat/metadata.json
index 7ad7a6cbb..9834175f6 100644
--- a/heat/metadata.json
+++ b/heat/metadata.json
@@ -1,6 +1,6 @@
 {
-  "name": "stackforge-heat",
-  "version": "5.1.0",
+  "name": "openstack-heat",
+  "version": "6.0.0",
   "author": "eNovance and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Heat",
   "license": "Apache-2.0",
@@ -32,8 +32,8 @@
   "description": "Installs and configures OpenStack Heat (Orchestration).",
   "dependencies": [
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
-    { "name": "stackforge/keystone", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/keystone", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
-    { "name": "stackforge/openstacklib", "version_requirement": ">=5.0.0 <6.0.0" }
+    { "name": "openstack/openstacklib", "version_requirement": ">=6.0.0 <7.0.0" }
   ]
 }
diff --git a/heat/spec/acceptance/basic_heat_spec.rb b/heat/spec/acceptance/basic_heat_spec.rb
index 1f78e4833..785af33fe 100644
--- a/heat/spec/acceptance/basic_heat_spec.rb
+++ b/heat/spec/acceptance/basic_heat_spec.rb
@@ -70,8 +70,9 @@ class { '::keystone':
         enabled             => true,
       }
       class { '::keystone::roles::admin':
-        email    => 'test@example.tld',
-        password => 'a_big_secret',
+        email       => 'test@example.tld',
+        password    => 'a_big_secret',
+        admin_roles => ['admin', '_member_', 'heat_stack_owner']
       }
       class { '::keystone::endpoint':
         public_url => "https://${::fqdn}:5000/",
@@ -93,6 +94,9 @@ class { '::heat::db::mysql':
       class { '::heat::keystone::auth':
         password => 'a_big_secret',
       }
+      class { '::heat::keystone::domain':
+        domain_password => 'oh_my_no_secret',
+      }
       class { '::heat::client': }
       class { '::heat::api': }
       class { '::heat::engine':
diff --git a/heat/spec/classes/heat_init_spec.rb b/heat/spec/classes/heat_init_spec.rb
index 83f330783..c1edc2904 100644
--- a/heat/spec/classes/heat_init_spec.rb
+++ b/heat/spec/classes/heat_init_spec.rb
@@ -55,6 +55,14 @@
       end
     end
 
+    context 'with rabbit heartbeat configured' do
+      before { params.merge!(
+        :rabbit_heartbeat_timeout_threshold => '60',
+        :rabbit_heartbeat_rate => '10' ) }
+      it_configures 'a heat base installation'
+      it_configures 'rabbit with heartbeat configured'
+    end
+
     context 'with qpid instance' do
       before {params.merge!(qpid_params) }
 
@@ -189,11 +197,14 @@
       is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_certfile').with_ensure('absent')
       is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_keyfile').with_ensure('absent')
       is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_version').with_ensure('absent')
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('0')
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/heartbeat_rate').with_value('2')
     end
     it { is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_host').with_value( params[:rabbit_host] ) }
     it { is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_port').with_value( params[:rabbit_port] ) }
     it { is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_hosts').with_value( "#{params[:rabbit_host]}:#{params[:rabbit_port]}" ) }
     it { is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_ha_queues').with_value('false') }
+    it { is_expected.to contain_heat_config('DEFAULT/rpc_response_timeout').with_value('60') }
     it { is_expected.to contain_heat_config('DEFAULT/amqp_durable_queues').with_value(false) }
   end
 
@@ -208,6 +219,8 @@
       is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_certfile').with_ensure('absent')
       is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_keyfile').with_ensure('absent')
       is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_version').with_ensure('absent')
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('0')
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/heartbeat_rate').with_value('2')
     end
     it { is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_host').with_ensure('absent') }
     it { is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_port').with_ensure('absent') }
@@ -227,6 +240,8 @@
       is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_certfile').with_ensure('absent')
       is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_keyfile').with_ensure('absent')
       is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_version').with_ensure('absent')
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('0')
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/heartbeat_rate').with_value('2')
     end
     it { is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_host').with_ensure('absent') }
     it { is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_port').with_ensure('absent') }
@@ -235,6 +250,21 @@
     it { is_expected.to contain_heat_config('DEFAULT/amqp_durable_queues').with_value(true) }
   end
 
+  shared_examples_for 'rabbit with heartbeat configured' do
+    it 'configures rabbit' do
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_userid').with_value( params[:rabbit_userid] )
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_password').with_value( params[:rabbit_password] )
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_password').with_secret( true )
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_virtual_host').with_value( params[:rabbit_virtual_host] )
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/rabbit_use_ssl').with_value(false)
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_ca_certs').with_ensure('absent')
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_certfile').with_ensure('absent')
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_keyfile').with_ensure('absent')
+      is_expected.to contain_heat_config('oslo_messaging_rabbit/kombu_ssl_version').with_ensure('absent')
+    end
+    it { is_expected.to contain_heat_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('60') }
+    it { is_expected.to contain_heat_config('oslo_messaging_rabbit/heartbeat_rate').with_value('10') }
+  end
 
   shared_examples_for 'qpid as rpc backend' do
     context("with default parameters") do
@@ -247,6 +277,7 @@
       it { is_expected.to contain_heat_config('DEFAULT/qpid_heartbeat').with_value('60') }
       it { is_expected.to contain_heat_config('DEFAULT/qpid_protocol').with_value('tcp') }
       it { is_expected.to contain_heat_config('DEFAULT/qpid_tcp_nodelay').with_value(true) }
+      it { is_expected.to contain_heat_config('DEFAULT/rpc_response_timeout').with_value('60') }
       it { is_expected.to contain_heat_config('DEFAULT/amqp_durable_queues').with_value(false) }
     end
 
@@ -457,7 +488,7 @@
     end
   end
 
-  shared_examples_for 'with instance_user set' do
+  shared_examples_for 'with instance_user set to a string' do
     before do
       params.merge!(
         :instance_user => "fred",
@@ -469,6 +500,18 @@
     end
   end
 
+  shared_examples_for 'with instance_user set to an empty string' do
+    before do
+      params.merge!(
+        :instance_user => "",
+      )
+    end
+
+    it 'has instance_user set to an empty string when specified' do
+      is_expected.to contain_heat_config('DEFAULT/instance_user').with_value('')
+    end
+  end
+
   shared_examples_for 'without instance_user set' do
     it 'doesnt have instance_user set by default' do
       is_expected.to contain_heat_config('DEFAULT/instance_user').with_enure('absent')
diff --git a/heat/spec/classes/heat_keystone_domain_spec.rb b/heat/spec/classes/heat_keystone_domain_spec.rb
index 0eba85d82..c8d77911d 100644
--- a/heat/spec/classes/heat_keystone_domain_spec.rb
+++ b/heat/spec/classes/heat_keystone_domain_spec.rb
@@ -3,13 +3,10 @@
 describe 'heat::keystone::domain' do
 
   let :params do {
-    :auth_url          => 'http://127.0.0.1:35357/v2.0',
-    :keystone_admin    => 'admin',
-    :keystone_password => 'admin_passwd',
-    :keystone_tenant   => 'admin',
-    :domain_name       => 'heat',
-    :domain_admin      => 'heat_admin',
-    :domain_password   => 'domain_passwd'
+    :domain_name        => 'heat',
+    :domain_admin       => 'heat_admin',
+    :domain_admin_email => 'heat_admin@localhost',
+    :domain_password    => 'domain_passwd'
     }
   end
 
@@ -18,34 +15,26 @@
       is_expected.to contain_heat_config('DEFAULT/stack_domain_admin').with_value(params[:domain_admin])
       is_expected.to contain_heat_config('DEFAULT/stack_domain_admin_password').with_value(params[:domain_password])
       is_expected.to contain_heat_config('DEFAULT/stack_domain_admin_password').with_secret(true)
+      is_expected.to contain_heat_config('DEFAULT/stack_user_domain_name').with_value(params[:domain_name])
     end
 
-    it 'should configure heat domain id' do
-      is_expected.to contain_heat_domain_id_setter('heat_domain_id').with(
-        :ensure           => 'present',
-        :domain_name      => params[:domain_name],
-        :auth_url         => params[:auth_url],
-        :auth_username    => params[:keystone_admin],
-        :auth_password    => params[:keystone_password],
-        :auth_tenant_name => params[:keystone_tenant]
+    it 'should create keystone domain' do
+      is_expected.to contain_keystone_domain('heat_domain').with(
+        :ensure  => 'present',
+        :enabled => 'true',
+        :name    => params[:domain_name]
       )
-    end
 
-    it 'should exec helper script' do
-      is_expected.to contain_exec('heat_domain_create').with(
-        :command     => 'heat-keystone-setup-domain',
-        :path        => '/usr/bin',
-        :require     => 'Package[heat-common]',
-        :logoutput   => 'on_failure',
-        :environment => [
-            "OS_TENANT_NAME=#{params[:keystone_tenant]}",
-            "OS_USERNAME=#{params[:keystone_admin]}",
-            "OS_PASSWORD=#{params[:keystone_password]}",
-            "OS_AUTH_URL=#{params[:auth_url]}",
-            "HEAT_DOMAIN=#{params[:domain_name]}",
-            "HEAT_DOMAIN_ADMIN=#{params[:domain_admin]}",
-            "HEAT_DOMAIN_PASSWORD=#{params[:domain_password]}"
-        ]
+      is_expected.to contain_keystone_user('heat_domain_admin').with(
+        :ensure   => 'present',
+        :enabled  => 'true',
+        :name     => params[:domain_admin],
+        :email    => params[:domain_admin_email],
+        :password => params[:domain_password],
+        :domain   => params[:domain_name],
+      )
+      is_expected.to contain_keystone_user_role('heat_admin@::heat').with(
+        :roles => ['admin'],
       )
     end
   end
diff --git a/heat/spec/spec_helper_acceptance.rb b/heat/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/heat/spec/spec_helper_acceptance.rb
+++ b/heat/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/heat/spec/unit/provider/heat_domain_id_setter/heat_spec.rb b/heat/spec/unit/provider/heat_domain_id_setter/heat_spec.rb
deleted file mode 100644
index a6bc4d9c0..000000000
--- a/heat/spec/unit/provider/heat_domain_id_setter/heat_spec.rb
+++ /dev/null
@@ -1,177 +0,0 @@
-require 'spec_helper'
-require 'puppet'
-require 'puppet/type/heat_domain_id_setter'
-
-provider_class = Puppet::Type.type(:heat_domain_id_setter).provider(:ruby)
-
-# used to simulate an authentication response from Keystone
-# (POST v2.0/tokens)
-auth_response = {
-    'access' => {
-        'token' => {
-            'id' => 'TOKEN',
-        }
-    }
-}
-
-# used to simulate a response to GET v3/domains
-domains_response = {
-    'domains' => [
-        {
-            'name' => 'heat',
-            'id'   => 'UUID_HEAT'
-        },
-        {
-            'name' => 'multiple_matches_domain',
-            'id'   => 'UUID1'
-        },
-        {
-            'name' => 'multiple_matches_domain',
-            'id'   => 'UUID2'
-        },
-    ]
-}
-
-# Stub for ini_setting resource
-Puppet::Type.newtype(:ini_setting) do
-end
-
-# Stub for ini_setting provider
-Puppet::Type.newtype(:ini_setting).provide(:ruby) do
-    def create
-    end
-end
-
-describe 'Puppet::Type.type(:heat_keystone_domain_id_setter)' do
-    let :params do
-        {
-            :name             => 'heat_domain_id',
-            :ensure           => 'present',
-            :domain_name      => 'heat',
-            :auth_url         => 'http://127.0.0.1:35357/v2.0',
-            :auth_username    => 'admin',
-            :auth_password    => 'admin_passwd',
-            :auth_tenant_name => 'admin',
-        }
-    end
-
-    it 'should have a non-nil provider' do
-        expect(provider_class).not_to be_nil
-    end
-
-    context 'when url is correct' do
-        before :each do
-            stub_request(:post, "http://127.0.0.1:35357/v2.0/tokens").
-                to_return(:status => 200,
-                          :body => auth_response.to_json,
-                          :headers => {})
-            stub_request(:get, "http://127.0.0.1:35357/v3/domains").
-                with(:headers => {'X-Auth-Token'=>'TOKEN'}).
-                to_return(:status => 200,
-                          :body => domains_response.to_json,
-                          :headers => {})
-        end
-
-        it 'should create a resource' do
-            resource = Puppet::Type::Heat_domain_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect(provider.create).to be_nil
-        end
-    end
-
-    # What happens if we ask for a domain that does not exist?
-    context 'when domain cannot be found' do
-        before :each do
-            stub_request(:post, "http://127.0.0.1:35357/v2.0/tokens").
-                to_return(:status => 200,
-                          :body => auth_response.to_json,
-                          :headers => {})
-            stub_request(:get, "http://127.0.0.1:35357/v3/domains").
-                with(:headers => {'X-Auth-Token'=>'TOKEN'}).
-                to_return(:status => 200,
-                          :body => domains_response.to_json,
-                          :headers => {})
-
-            params.merge!(:domain_name => 'bad_domain_name')
-        end
-
-        it 'should receive an api error' do
-            resource = Puppet::Type::Heat_domain_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect { provider.create }.to raise_error KeystoneAPIError, /Unable to find matching domain/
-        end
-    end
-
-    # What happens if we ask for a domain name that results in multiple
-    # matches?
-    context 'when there are multiple matching domains' do
-        before :each do
-            stub_request(:post, "http://127.0.0.1:35357/v2.0/tokens").
-                to_return(:status => 200,
-                          :body => auth_response.to_json,
-                          :headers => {})
-            stub_request(:get, "http://127.0.0.1:35357/v3/domains").
-                with(:headers => {'X-Auth-Token'=>'TOKEN'}).
-                to_return(:status => 200,
-                          :body => domains_response.to_json,
-                          :headers => {})
-
-            params.merge!(:domain_name => 'multiple_matches_domain')
-        end
-
-        it 'should receive an api error' do
-            resource = Puppet::Type::Heat_domain_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect { provider.create }.to raise_error KeystoneAPIError, /Found multiple matches for domain name/
-        end
-    end
-
-    # What happens if we pass a bad password?
-    context 'when password is incorrect' do
-        before :each do
-            stub_request(:post, "http://127.0.0.1:35357/v2.0/tokens").
-                to_return(:status => 401,
-                          :body => auth_response.to_json,
-                          :headers => {})
-        end
-
-        it 'should receive an authentication error' do
-            resource = Puppet::Type::Heat_domain_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect { provider.create }.to raise_error KeystoneAPIError
-        end
-    end
-
-    # What happens if the server is not listening?
-    context 'when keystone server is unavailable' do
-        before :each do
-            stub_request(:post, "http://127.0.0.1:35357/v2.0/tokens").to_raise Errno::ECONNREFUSED
-        end
-
-        it 'should receive a connection error' do
-            resource = Puppet::Type::Heat_domain_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect { provider.create }.to raise_error KeystoneConnectionError
-        end
-    end
-
-    # What happens if we mistype the hostname?
-    context 'when keystone server is unknown' do
-        before :each do
-            stub_request(:post, "http://127.0.0.1:35357/v2.0/tokens").to_raise SocketError, 'getaddrinfo: Name or service not known'
-        end
-
-        it 'should receive a connection error' do
-            resource = Puppet::Type::Heat_domain_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect { provider.create }.to raise_error KeystoneConnectionError
-        end
-    end
-
-end
diff --git a/horizon/CHANGELOG.md b/horizon/CHANGELOG.md
index df1c6c51b..196a2328a 100644
--- a/horizon/CHANGELOG.md
+++ b/horizon/CHANGELOG.md
@@ -1,3 +1,24 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+This is a backwards-incompatible major release for OpenStack Kilo.
+
+####Backwards-incompatible changes
+- Remove some old deprecated parameters
+
+####Features
+- Puppet 4.x support
+- Sort policy files in local_settings.py
+- Add support for Neutron DVR and L3 HA options
+- Collect static files before compressing them
+- Add support to add Tuskar-ui config to local_settings
+- Add support for WEBROOT in local_settings
+- Add 'log_handler' parameter
+
+####Maintenance
+- Acceptance tests with Beaker
+- Fix spec tests for RSpec 3.x and Puppet 4.x
+
 ##2015-06-17 - 5.1.0
 ###Summary
 
diff --git a/horizon/README.md b/horizon/README.md
index 0f775e353..caefbcbfa 100644
--- a/horizon/README.md
+++ b/horizon/README.md
@@ -1,7 +1,7 @@
 horizon
 =======
 
-5.1.0 - 2014.2 - Juno
+6.0.0 - 2015.1 - Kilo
 
 #### Table of Contents
 
diff --git a/horizon/manifests/init.pp b/horizon/manifests/init.pp
index d64b507ba..3e6f5aa25 100644
--- a/horizon/manifests/init.pp
+++ b/horizon/manifests/init.pp
@@ -228,7 +228,7 @@
   $api_result_limit                    = 1000,
   $log_handler                         = 'file',
   $log_level                           = 'INFO',
-  $help_url                            = 'http://docs.openstack.org',
+  $help_url                            = 'https://www.rdoproject.org/Docs',
   $local_settings_template             = 'horizon/local_settings.py.erb',
   $configure_apache                    = true,
   $bind_address                        = undef,
diff --git a/horizon/metadata.json b/horizon/metadata.json
index 1c580c18a..5dddaea48 100644
--- a/horizon/metadata.json
+++ b/horizon/metadata.json
@@ -1,6 +1,6 @@
 {
-  "name": "stackforge-horizon",
-  "version": "5.1.0",
+  "name": "openstack-horizon",
+  "version": "6.0.0",
   "author": "Puppet Labs and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Horizon",
   "license": "Apache-2.0",
diff --git a/horizon/spec/spec_helper_acceptance.rb b/horizon/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/horizon/spec/spec_helper_acceptance.rb
+++ b/horizon/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/ironic/CHANGELOG.md b/ironic/CHANGELOG.md
new file mode 100644
index 000000000..6a0701c08
--- /dev/null
+++ b/ironic/CHANGELOG.md
@@ -0,0 +1,4 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+- Initial release of the puppet-ironic module
diff --git a/ironic/README.md b/ironic/README.md
index 289f0154c..15198183d 100644
--- a/ironic/README.md
+++ b/ironic/README.md
@@ -1,6 +1,8 @@
 puppet-ironic
 =============
 
+6.0.0 - 2015.1 - Kilo
+
 #### Table of Contents
 
 1. [Overview - What is the ironic module?](#overview)
diff --git a/ironic/manifests/conductor.pp b/ironic/manifests/conductor.pp
index 76bacbefe..c52c480e3 100644
--- a/ironic/manifests/conductor.pp
+++ b/ironic/manifests/conductor.pp
@@ -32,10 +32,17 @@
 #   Should be an interger value
 #   Defaults to '120'.
 #
+# [*force_power_state_during_sync*]
+#   (optional) Should the hardware power state be set to the state recorded in
+#   the database (True) or should the database be updated based on the hardware
+#   state (False).
+#   Defaults to true.
+#
 class ironic::conductor (
-  $package_ensure    = 'present',
-  $enabled           = true,
-  $max_time_interval = '120'
+  $package_ensure                = 'present',
+  $enabled                       = true,
+  $max_time_interval             = '120',
+  $force_power_state_during_sync = true,
 ) {
 
   include ::ironic::params
@@ -45,6 +52,7 @@
   # Configure ironic.conf
   ironic_config {
     'conductor/max_time_interval': value => $max_time_interval;
+    'conductor/force_power_state_during_sync': value => $force_power_state_during_sync;
   }
 
   # Install package
diff --git a/ironic/metadata.json b/ironic/metadata.json
index d86bbfd56..61dc596dd 100644
--- a/ironic/metadata.json
+++ b/ironic/metadata.json
@@ -1,10 +1,10 @@
 {
-  "name": "stackforge-ironic",
-  "version": "5.0.0",
-  "author": "eNovance and StackForge Contributors",
+  "name": "openstack-ironic",
+  "version": "6.0.0",
+  "author": "eNovance and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Ironic",
   "license": "Apache-2.0",
-  "source": "git://github.com/stackforge/puppet-ironic.git",
+  "source": "git://github.com/openstack/puppet-ironic.git",
   "project_page": "https://launchpad.net/puppet-ironic",
   "issues_url": "https://bugs.launchpad.net/puppet-ironic",
   "requirements": [
@@ -32,8 +32,8 @@
   "description": "Installs and configures OpenStack Ironic (Bare metal).",
   "dependencies": [
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
-    { "name": "stackforge/keystone", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/keystone", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
-    { "name": "stackforge/openstacklib", "version_requirement": ">=5.0.0 <6.0.0" }
+    { "name": "openstack/openstacklib", "version_requirement": ">=6.0.0 <7.0.0" }
   ]
 }
diff --git a/ironic/spec/classes/ironic_conductor_spec.rb b/ironic/spec/classes/ironic_conductor_spec.rb
index 105a4c885..8d0d1df08 100644
--- a/ironic/spec/classes/ironic_conductor_spec.rb
+++ b/ironic/spec/classes/ironic_conductor_spec.rb
@@ -23,9 +23,10 @@
 describe 'ironic::conductor' do
 
   let :default_params do
-    { :package_ensure    => 'present',
-      :enabled           => true,
-      :max_time_interval => '120' }
+    { :package_ensure                => 'present',
+      :enabled                       => true,
+      :max_time_interval             => '120',
+      :force_power_state_during_sync => true }
   end
 
   let :params do
@@ -57,14 +58,19 @@
 
     it 'configures ironic.conf' do
       is_expected.to contain_ironic_config('conductor/max_time_interval').with_value(p[:max_time_interval])
+      is_expected.to contain_ironic_config('conductor/force_power_state_during_sync').with_value(p[:force_power_state_during_sync])
     end
 
     context 'when overriding parameters' do
       before :each do
-        params.merge!(:max_time_interval => '50')
+        params.merge!(
+          :max_time_interval             => '50',
+          :force_power_state_during_sync => false
+        )
       end
       it 'should replace default parameter with new value' do
         is_expected.to contain_ironic_config('conductor/max_time_interval').with_value(p[:max_time_interval])
+        is_expected.to contain_ironic_config('conductor/force_power_state_during_sync').with_value(p[:force_power_state_during_sync])
       end
     end
 
diff --git a/ironic/spec/spec_helper_acceptance.rb b/ironic/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/ironic/spec/spec_helper_acceptance.rb
+++ b/ironic/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/keystone/CHANGELOG.md b/keystone/CHANGELOG.md
index 973da8fb1..33c0f5e06 100644
--- a/keystone/CHANGELOG.md
+++ b/keystone/CHANGELOG.md
@@ -1,3 +1,43 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+This is a backwards-incompatible major release for OpenStack Kilo.
+
+####Backwards-incompatible changes
+- Remove deprecated parameters
+- MySQL: change default MySQL collate to utf8_general_ci
+- Move openstackclient to openstacklib
+
+####Features
+- Puppet 4.x support
+- Support Keystone v3 API
+- Allow disabling or delaying the token_flush cron
+- Migrate postgresql backend to use openstacklib::db::postgresql
+- Add max_token_size optional parameter
+- Add admin_workers and public_workers configuration options
+- Add support for LDAP connection pools
+- Add a package ensure for openstackclient
+- Enable setting the revoke/token driver
+- Add manage_service feature
+- Makes distinct use of url vs auth_url
+- Create a sync_db boolean for Keystone
+- LDAP: add support to configure credential driver
+- Support notification_format
+- Allow custom file source for wsgi scripts
+- Decouple sync_db from enabled
+- Add support for Fernet Tokens
+
+####Bugfixes
+- Crontab: ensure the script is run with bash shell
+- Copy latest keystone.py from Keystone upstream
+- Fix deprecated LDAP config options
+- Fix service keystone conflict when running in apache
+
+####Maintenance
+- Acceptance tests with Beaker
+- Fix spec tests for RSpec 3.x and Puppet 4.x
+- Restructures authentication for resource providers
+
 ##2015-06-17 - 5.1.0
 ###Summary
 
diff --git a/keystone/README.md b/keystone/README.md
index df6023740..e35380cc9 100644
--- a/keystone/README.md
+++ b/keystone/README.md
@@ -1,7 +1,7 @@
 keystone
 =======
 
-5.1.0 - 2014.2 - Juno
+6.0.0 - 2015.1 - Kilo
 
 #### Table of Contents
 
diff --git a/keystone/examples/v3_basic.pp b/keystone/examples/v3_basic.pp
new file mode 100644
index 000000000..5777d2b5b
--- /dev/null
+++ b/keystone/examples/v3_basic.pp
@@ -0,0 +1,47 @@
+# Example using v3 domains.  The admin user is created in the domain
+# named 'admin_domain', and assigned the role 'admin' in the 'admin'
+# project in the domain 'admin_domain'.  The keystone service account is
+# created in default domain, and assigned the
+# role 'admin' in the project 'services' in the default domain.
+# NOTE: Until all of the other services support using Keystone v3
+# with keystone_authtoken middleware that supports v3, they cannot
+# specify a domain for authentication, and so have to be in the
+# default domain.
+#
+# To be sure everything is working, run:
+#   $ export OS_IDENTITY_API_VERSION=3
+#   $ export OS_USERNAME=admin
+#   $ export OS_USER_DOMAIN_NAME=admin_domain
+#   $ export OS_PASSWORD=ChangeMe
+#   $ export OS_PROJECT_NAME=admin
+#   $ export OS_PROJECT_DOMAIN_NAME=admin_domain
+#   $ export OS_AUTH_URL=http://keystone.local:35357/v3
+#   $ openstack user list
+#
+
+Exec { logoutput => 'on_failure' }
+
+
+class { '::mysql::server': }
+class { '::keystone::db::mysql':
+  password => 'keystone',
+}
+class { '::keystone':
+  verbose             => true,
+  debug               => true,
+  database_connection => 'mysql://keystone:keystone@127.0.0.1/keystone',
+  admin_token         => 'admin_token',
+  enabled             => true,
+}
+class { '::keystone::roles::admin':
+  email               => 'test@example.tld',
+  password            => 'a_big_secret',
+  admin               => 'admin', # username
+  admin_tenant        => 'admin', # project name
+  admin_user_domain   => 'admin', # domain for user
+  admin_tenant_domain => 'admin', # domain for project
+}
+class { '::keystone::endpoint':
+  public_url => 'http://127.0.0.1:5000/',
+  admin_url  => 'http://127.0.0.1:35357/',
+}
diff --git a/keystone/ext/keystone_test_v3.rb b/keystone/ext/keystone_test_v3.rb
new file mode 100644
index 000000000..0d7550e32
--- /dev/null
+++ b/keystone/ext/keystone_test_v3.rb
@@ -0,0 +1,64 @@
+#!/usr/bin/env ruby
+# this script verifies that keystone has
+# been successfully installed using the instructions
+# found here: http://keystone.openstack.org/configuration.html
+# and can use the v3 api http://developer.openstack.org/api-ref-identity-v3.html
+
+begin
+  require 'rubygems'
+rescue
+  puts 'Could not require rubygems. This assumes puppet is not installed as a gem'
+end
+require 'open3'
+require 'fileutils'
+require 'puppet'
+require 'pp'
+
+username='admin'
+password='a_big_secret'
+# required to get a real services catalog
+project='openstack'
+user_domain='admin'
+project_domain='admin'
+
+# shared secret
+service_token='admin_token'
+
+def run_command(cmd)
+  Open3.popen3(cmd) do |stdin, stdout, stderr|
+    begin
+      stdout = stdout.read
+      puts "Response from token request:#{stdout}"
+      return stdout
+    rescue Exception => e
+      puts "Request failed, this sh*t is borked :( : details: #{e}"
+      exit 1
+    end
+  end
+end
+
+puts `puppet apply -e "package {curl: ensure => present }"`
+get_token = %(curl -D - -d '{"auth":{"identity":{"methods":["password"],"password":{"user":{"domain":{"name":"#{user_domain}"},"name":"#{username}","password": "#{password}"}}},"scope":{"project":{"domain":{"name":"#{project_domain}"},"name": "#{project}"}}}}' -H "Content-type: application/json" http://localhost:35357/v3/auth/tokens)
+token = nil
+
+puts "Running auth command: #{get_token}"
+rawoutput = run_command(get_token)
+if rawoutput =~ /X-Subject-Token: ([\w]+)/
+  token = $1
+else
+  puts "No token in output! #{rawoutput}"
+  exit 1
+end
+
+if token
+  puts "We were able to retrieve a token"
+  puts token
+  verify_token = "curl -H 'X-Auth-Token: #{service_token}' 'X-Subject-Token: #{token}' http://localhost:35357/v3/auth/tokens"
+  puts 'verifying token'
+  run_command(verify_token)
+  ['endpoints', 'projects', 'users'].each do |x|
+    puts "getting #{x}"
+    get_keystone_data = "curl -H 'X-Auth-Token: #{token}' http://localhost:35357/v3/#{x}"
+    pp PSON.load(run_command(get_keystone_data))
+  end
+end
diff --git a/keystone/lib/puppet/provider/keystone.rb b/keystone/lib/puppet/provider/keystone.rb
index 849868bcb..64f46de50 100644
--- a/keystone/lib/puppet/provider/keystone.rb
+++ b/keystone/lib/puppet/provider/keystone.rb
@@ -10,25 +10,120 @@ class Puppet::Provider::Keystone < Puppet::Provider::Openstack
 
   INI_FILENAME = '/etc/keystone/keystone.conf'
 
-  def self.get_endpoint
+  @@default_domain_id = nil
+
+  def self.admin_endpoint
+    @admin_endpoint ||= get_admin_endpoint
+  end
+
+  def self.admin_token
+    @admin_token ||= get_admin_token
+  end
+
+  def self.clean_host(host)
+    host ||= '127.0.0.1'
+    case host
+    when '0.0.0.0'
+      return '127.0.0.1'
+    when '::0'
+      return '[::1]'
+    else
+      return host
+    end
+  end
+
+  def self.default_domain
+    domain_name_from_id(default_domain_id)
+  end
+
+  def self.default_domain_id
+    if @@default_domain_id
+      @@default_domain_id
+    elsif keystone_file and keystone_file['identity'] and keystone_file['identity']['default_domain_id']
+      keystone_file['identity']['default_domain_id'].strip
+    else
+      'default'
+    end
+  end
+
+  def self.default_domain_id=(id)
+    @@default_domain_id = id
+  end
+
+  def self.domain_name_from_id(id)
+    unless @domain_hash
+      list = request('domain', 'list')
+      @domain_hash = Hash[list.collect{|domain| [domain[:id], domain[:name]]}]
+    end
+    unless @domain_hash.include?(id)
+      name = request('domain', 'show', id)[:name]
+      @domain_hash[id] = name if name
+    end
+    unless @domain_hash.include?(id)
+      err("Could not find domain with id [#{id}]")
+    end
+    @domain_hash[id]
+  end
+
+  def self.get_admin_endpoint
     endpoint = nil
+    if keystone_file
+      if url = get_section('DEFAULT', 'admin_endpoint')
+        endpoint = url.chomp('/')
+      else
+        admin_port = get_section('DEFAULT', 'admin_port') || '35357'
+        host = clean_host(get_section('DEFAULT', 'admin_bind_host'))
+        protocol = ssl? ? 'https' : 'http'
+        endpoint = "#{protocol}://#{host}:#{admin_port}"
+      end
+    end
+    return endpoint
+  end
+
+  def self.get_admin_token
+    get_section('DEFAULT', 'admin_token')
+  end
+
+  def self.get_auth_url
+    auth_url = nil
     if ENV['OS_AUTH_URL']
-      endpoint = ENV['OS_AUTH_URL']
+      auth_url = ENV['OS_AUTH_URL'].dup
+    elsif auth_url = get_os_vars_from_rcfile(rc_filename)['OS_AUTH_URL']
     else
-      endpoint = get_os_vars_from_rcfile(rc_filename)['OS_AUTH_URL']
-      unless endpoint
-        # This is from legacy but seems wrong, we want auth_url not url!
-        endpoint = get_admin_endpoint
-      end
+      auth_url = admin_endpoint
     end
-    unless endpoint
-      raise(Puppet::Error::OpenstackAuthInputError, 'Could not find auth url to check user password.')
+    return auth_url
+  end
+
+  def self.get_section(group, name)
+    if keystone_file && keystone_file[group] && keystone_file[group][name]
+      return keystone_file[group][name].strip
     end
-    endpoint
+    return nil
   end
 
-  def self.admin_endpoint
-    @admin_endpoint ||= get_admin_endpoint
+  def self.get_service_url
+    service_url = nil
+    if ENV['OS_URL']
+      service_url = ENV['OS_URL'].dup
+    elsif admin_endpoint
+      service_url = admin_endpoint
+      service_url << "/v#{@credentials.version}"
+    end
+    return service_url
+  end
+
+  def self.ini_filename
+    INI_FILENAME
+  end
+
+  def self.keystone_file
+    return @keystone_file if @keystone_file
+    if File.exists?(ini_filename)
+      @keystone_file = Puppet::Util::IniConfig::File.new
+      @keystone_file.read(ini_filename)
+      @keystone_file
+    end
   end
 
   # use the domain in this order:
@@ -56,54 +151,6 @@ def self.name_and_domain(namedomstr, domain_from_resource=nil, default_domain_na
     ret
   end
 
-  def self.admin_token
-    @admin_token ||= get_admin_token
-  end
-
-  def self.get_admin_token
-    if keystone_file and keystone_file['DEFAULT'] and keystone_file['DEFAULT']['admin_token']
-      return "#{keystone_file['DEFAULT']['admin_token'].strip}"
-    else
-      return nil
-    end
-  end
-
-  def self.get_admin_endpoint
-    if keystone_file
-      if keystone_file['DEFAULT']
-        if keystone_file['DEFAULT']['admin_endpoint']
-          auth_url = keystone_file['DEFAULT']['admin_endpoint'].strip.chomp('/')
-          return "#{auth_url}/v#{@credentials.version}/"
-        end
-
-        if keystone_file['DEFAULT']['admin_port']
-          admin_port = keystone_file['DEFAULT']['admin_port'].strip
-        else
-          admin_port = '35357'
-        end
-
-        if keystone_file['DEFAULT']['admin_bind_host']
-          host = keystone_file['DEFAULT']['admin_bind_host'].strip
-          if host == "0.0.0.0"
-            host = "127.0.0.1"
-          elsif host == '::0'
-            host = '[::1]'
-          end
-        else
-          host = "127.0.0.1"
-        end
-      end
-
-      if keystone_file['ssl'] && keystone_file['ssl']['enable'] && keystone_file['ssl']['enable'].strip.downcase == 'true'
-        protocol = 'https'
-      else
-        protocol = 'http'
-      end
-    end
-
-    "#{protocol}://#{host}:#{admin_port}/v#{@credentials.version}/"
-  end
-
   def self.request(service, action, properties=nil)
     super
   rescue Puppet::Error::OpenstackAuthInputError => error
@@ -112,48 +159,21 @@ def self.request(service, action, properties=nil)
 
   def self.request_by_service_token(service, action, error, properties=nil)
     properties ||= []
-    @credentials.token = get_admin_token
-    @credentials.url   = get_admin_endpoint
+    @credentials.token = admin_token
+    @credentials.url   = service_url
     raise error unless @credentials.service_token_set?
     Puppet::Provider::Openstack.request(service, action, properties, @credentials)
   end
 
-  def self.ini_filename
-    INI_FILENAME
-  end
-
-  def self.default_domain
-    domain_hash[default_domain_id]
-  end
-
-  def self.domain_hash
-    return @domain_hash if @domain_hash
-    list = request('domain', 'list')
-    @domain_hash = Hash[list.collect{|domain| [domain[:id], domain[:name]]}]
-    @domain_hash
-  end
-
-  def self.domain_name_from_id(id)
-    domain_hash[id]
-  end
-
-  def self.default_domain_id
-    return @default_domain_id if @default_domain_id
-    if keystone_file and keystone_file['identity'] and keystone_file['identity']['default_domain_id']
-      @default_domain_id = "#{keystone_file['identity']['default_domain_id'].strip}"
-    else
-      @default_domain_id = 'default'
-    end
-    @default_domain_id
+  def self.service_url
+    @service_url ||= get_service_url
   end
 
-  def self.keystone_file
-    return @keystone_file if @keystone_file
-    if File.exists?(ini_filename)
-      @keystone_file = Puppet::Util::IniConfig::File.new
-      @keystone_file.read(ini_filename)
-      @keystone_file
+  def self.ssl?
+    if keystone_file && keystone_file['ssl'] && keystone_file['ssl']['enable'] && keystone_file['ssl']['enable'].strip.downcase == 'true'
+      return true
     end
+    return false
   end
 
   # Helper functions to use on the pre-validated enabled field
diff --git a/keystone/lib/puppet/provider/keystone_domain/openstack.rb b/keystone/lib/puppet/provider/keystone_domain/openstack.rb
index 14a8f6982..134b46d08 100644
--- a/keystone/lib/puppet/provider/keystone_domain/openstack.rb
+++ b/keystone/lib/puppet/provider/keystone_domain/openstack.rb
@@ -99,6 +99,7 @@ def ensure_default_domain(create, destroy=false, value=nil)
     end
     if changed
       self.class.keystone_file.store
+      self.class.default_domain_id = newid
       debug("The default_domain_id was changed from #{curid} to #{newid}")
     end
   end
diff --git a/keystone/lib/puppet/provider/keystone_tenant/openstack.rb b/keystone/lib/puppet/provider/keystone_tenant/openstack.rb
index 57a299fd6..ac1dfb107 100644
--- a/keystone/lib/puppet/provider/keystone_tenant/openstack.rb
+++ b/keystone/lib/puppet/provider/keystone_tenant/openstack.rb
@@ -32,6 +32,7 @@ def create
       properties << project_domain
     end
     @property_hash = self.class.request('project', 'create', properties)
+    @property_hash[:name] = resource[:name]
     @property_hash[:ensure] = :present
   end
 
diff --git a/keystone/lib/puppet/provider/keystone_user/openstack.rb b/keystone/lib/puppet/provider/keystone_user/openstack.rb
index 98a34cd3c..e6f2486dc 100644
--- a/keystone/lib/puppet/provider/keystone_user/openstack.rb
+++ b/keystone/lib/puppet/provider/keystone_user/openstack.rb
@@ -7,7 +7,7 @@
 
   desc "Provider to manage keystone users."
 
-  @credentials = Puppet::Provider::Openstack::CredentialsV2_0.new
+  @credentials = Puppet::Provider::Openstack::CredentialsV3.new
 
   def initialize(value={})
     super(value)
@@ -15,7 +15,9 @@ def initialize(value={})
   end
 
   def create
-    properties = [resource[:name]]
+    # see if resource[:domain], or user specified as user::domain
+    user_name, user_domain = self.class.name_and_domain(resource[:name], resource[:domain])
+    properties = [user_name]
     if resource[:enabled] == :true
       properties << '--enable'
     elsif resource[:enabled] == :false
@@ -24,18 +26,28 @@ def create
     if resource[:password]
       properties << '--password' << resource[:password]
     end
-    if resource[:tenant]
-      properties << '--project' << resource[:tenant]
-    end
     if resource[:email]
       properties << '--email' << resource[:email]
     end
-    self.class.request('user', 'create', properties)
+    if user_domain
+      properties << '--domain'
+      properties << user_domain
+    end
+    @property_hash = self.class.request('user', 'create', properties)
+    @property_hash[:name] = resource[:name]
+    @property_hash[:domain] = user_domain
+    if resource[:tenant]
+      # DEPRECATED - To be removed in next release (Liberty)
+      # https://bugs.launchpad.net/puppet-keystone/+bug/1472437
+      project_id = Puppet::Resource.indirection.find("Keystone_tenant/#{resource[:tenant]}")[:id]
+      set_project(resource[:tenant], project_id)
+      @property_hash[:tenant] = resource[:tenant]
+    end
     @property_hash[:ensure] = :present
   end
 
   def destroy
-    self.class.request('user', 'delete', @property_hash[:id])
+    self.class.request('user', 'delete', id)
     @property_hash.clear
   end
 
@@ -82,27 +94,44 @@ def id
   end
 
   def password
-    res = nil
-    return res if resource[:password] == nil
+    passwd = nil
+    return passwd if resource[:password] == nil
     if resource[:enabled] == :false || resource[:replace_password] == :false
       # Unchanged password
-      res = resource[:password]
+      passwd = resource[:password]
     else
       # Password validation
-      credentials = Puppet::Provider::Openstack::CredentialsV2_0.new
-      credentials.auth_url     = self.class.get_endpoint
-      credentials.password     = resource[:password]
-      credentials.project_name = resource[:tenant]
-      credentials.username     = resource[:name]
+      credentials = Puppet::Provider::Openstack::CredentialsV3.new
+      unless auth_url = self.class.get_auth_url
+        raise(Puppet::Error::OpenstackAuthInputError, "Could not find authentication url to validate user's password.")
+      end
+      auth_url << "/v#{credentials.version}" unless auth_url =~ /\/v\d(\.\d)?$/
+      credentials.auth_url = auth_url
+      credentials.password = resource[:password]
+      credentials.user_id = id
+
+      # NOTE: The only reason we use username is so that the openstack provider
+      # will know we are doing v3password auth - otherwise, it is not used.  The
+      # user_id uniquely identifies the user including domain.
+      credentials.username, unused = self.class.name_and_domain(resource[:name], domain)
+      # Need to specify a project id to get a project scoped token.  List
+      # all of the projects for the user, and use the id from the first one.
+      projects = self.class.request('project', 'list', ['--user', id, '--long'])
+      if projects && projects[0] && projects[0][:id]
+        credentials.project_id = projects[0][:id]
+      else
+        # last chance - try a domain scoped token
+        credentials.domain_name = domain
+      end
       begin
         token = Puppet::Provider::Openstack.request('token', 'issue', ['--format', 'value'], credentials)
       rescue Puppet::Error::OpenstackUnauthorizedError
         # password is invalid
       else
-        res = resource[:password] unless token.empty?
+        passwd = resource[:password] unless token.empty?
       end
     end
-    return res
+    return passwd
   end
 
   def password=(value)
@@ -117,6 +146,51 @@ def replace_password=(value)
     @property_flush[:replace_password] = value
   end
 
+  def find_project_for_user(projname, project_id = nil)
+    # DEPRECATED - To be removed in next release (Liberty)
+    # https://bugs.launchpad.net/puppet-keystone/+bug/1472437
+    user_name, user_domain = self.class.name_and_domain(resource[:name], resource[:domain])
+    project_name, project_domain = self.class.name_and_domain(projname, nil, user_domain)
+    self.class.request('project', 'list', ['--user', id, '--long']).each do |project|
+      if (project_id == project[:id]) ||
+         ((projname == project_name) && (project_domain == self.class.domain_name_from_id(project[:domain_id])))
+        return projname
+      end
+    end
+    return nil
+  end
+
+  def set_project(newproject, project_id = nil)
+    # DEPRECATED - To be removed in next release (Liberty)
+    # https://bugs.launchpad.net/puppet-keystone/+bug/1472437
+    unless project_id
+      project_id = Puppet::Resource.indirection.find("Keystone_tenant/#{newproject}")[:id]
+    end
+    # Currently the only way to assign a user to a tenant not using user-create
+    # is to use role-add - this means we also need a role - there is usual
+    # a default role called _member_ which can be used for this purpose.  What
+    # usually happens in a puppet module is that immediately after calling
+    # keystone_user, the module will then assign a role to that user.  It is
+    # ok for a user to have the _member_ role and another role.
+    default_role = "_member_"
+    begin
+      self.class.request('role', 'show', default_role)
+    rescue
+      self.class.request('role', 'create', default_role)
+    end
+    # finally, assign the user to the project with the role
+    self.class.request('role', 'add', [default_role, '--project', project_id, '--user', id])
+    newproject
+  end
+
+  # DEPRECATED - To be removed in next release (Liberty)
+  # https://bugs.launchpad.net/puppet-keystone/+bug/1472437
+  def tenant=(value)
+    @property_hash[:tenant] = set_project(value)
+  end
+
+  # DEPRECATED - To be removed in next release (Liberty)
+  # https://bugs.launchpad.net/puppet-keystone/+bug/1472437
   def tenant
     return resource[:tenant] if sym_to_bool(resource[:ignore_default_tenant])
     # use the one returned from instances
@@ -130,40 +204,52 @@ def tenant
     if tenant_name.nil? or tenant_name.empty?
       return nil # nothing found, nothing given
     end
-    # If the user list command doesn't report the project, it might still be there
-    # We don't need to know exactly what it is, we just need to know whether it's
-    # the one we're trying to set.
-    roles = self.class.request('user role', 'list', [resource[:name], '--project', tenant_name])
-    if roles.empty?
-      return nil
-    else
-      return tenant_name
-    end
+    project_id = Puppet::Resource.indirection.find("Keystone_tenant/#{tenant_name}")[:id]
+    find_project_for_user(tenant_name, project_id)
   end
 
-  def tenant=(value)
-    self.class.request('user', 'set', [resource[:name], '--project', value])
-    rescue Puppet::ExecutionFailure => e
-      if e.message =~ /You are not authorized to perform the requested action: LDAP user update/
-        # read-only LDAP identity backend - just fall through
-      else
-        raise e
-      end
-      # note: read-write ldap will silently fail, not raise an exception
-    else
-    @property_hash[:tenant] = self.class.set_project(value, resource[:name])
+  def domain
+    @property_hash[:domain]
+  end
+
+  def domain_id
+    @property_hash[:domain_id]
   end
 
   def self.instances
-    list = request('user', 'list', '--long')
-    list.collect do |user|
+    instance_hash = {}
+    request('user', 'list', ['--long']).each do |user|
+      # The field says "domain" but it is really the domain_id
+      domname = domain_name_from_id(user[:domain])
+      if instance_hash.include?(user[:name]) # not unique
+        curdomid = instance_hash[user[:name]][:domain]
+        if curdomid != default_domain_id
+          # Move the user from the short name slot to the long name slot
+          # because it is not in the default domain.
+          curdomname = domain_name_from_id(curdomid)
+          instance_hash["#{user[:name]}::#{curdomname}"] = instance_hash[user[:name]]
+          # Use the short name slot for the new user
+          instance_hash[user[:name]] = user
+        else
+          # Use the long name for the new user
+          instance_hash["#{user[:name]}::#{domname}"] = user
+        end
+      else
+        # Unique (for now) - store in short name slot
+        instance_hash[user[:name]] = user
+      end
+    end
+    instance_hash.keys.collect do |user_name|
+      user = instance_hash[user_name]
       new(
-        :name        => user[:name],
+        :name        => user_name,
         :ensure      => :present,
         :enabled     => user[:enabled].downcase.chomp == 'true' ? true : false,
         :password    => user[:password],
-        :project     => user[:project],
         :email       => user[:email],
+        :description => user[:description],
+        :domain      => domain_name_from_id(user[:domain]),
+        :domain_id   => user[:domain],
         :id          => user[:id]
       )
     end
@@ -171,34 +257,19 @@ def self.instances
 
   def self.prefetch(resources)
     users = instances
-    resources.keys.each do |name|
-       if provider = users.find{ |user| user.name == name }
-        resources[name].provider = provider
+    resources.each do |resname, resource|
+      # resname may be specified as just "name" or "name::domain"
+      name, resdomain = name_and_domain(resname, resource[:domain])
+      provider = users.find do |user|
+        # have a match if the full instance name matches the full resource name, OR
+        # the base resource name matches the base instance name, and the
+        # resource domain matches the instance domain
+        username, user_domain = name_and_domain(user.name, user.domain)
+        (user.name == resname) ||
+          ((username == name) && (user_domain == resdomain))
       end
+      resource.provider = provider if provider
     end
   end
 
-  def self.set_project(newproject, name)
-    # some backends do not store the project/tenant in the user object, so we have to
-    # to modify the project/tenant instead
-    # First, see if the project actually needs to change
-    roles = request('user role', 'list', [name, '--project', newproject])
-    unless roles.empty?
-      return # if already set, just skip
-    end
-    # Currently the only way to assign a user to a tenant not using user-create
-    # is to use user-role-add - this means we also need a role - there is usual
-    # a default role called _member_ which can be used for this purpose.  What
-    # usually happens in a puppet module is that immediately after calling
-    # keystone_user, the module will then assign a role to that user.  It is
-    # ok for a user to have the _member_ role and another role.
-    default_role = "_member_"
-    begin
-      request('role', 'show', [default_role])
-    rescue
-      debug("Keystone role #{default_role} does not exist - creating")
-      request('role', 'create', [default_role])
-    end
-    request('role', 'add', [default_role, '--project', newproject, '--user', name])
-  end
 end
diff --git a/keystone/lib/puppet/provider/keystone_user_role/openstack.rb b/keystone/lib/puppet/provider/keystone_user_role/openstack.rb
index da2b87044..e670a6750 100644
--- a/keystone/lib/puppet/provider/keystone_user_role/openstack.rb
+++ b/keystone/lib/puppet/provider/keystone_user_role/openstack.rb
@@ -1,4 +1,5 @@
 require 'puppet/provider/keystone'
+require 'puppet/provider/keystone/util'
 
 Puppet::Type.type(:keystone_user_role).provide(
   :openstack,
@@ -7,7 +8,7 @@
 
   desc "Provider to manage keystone role assignments to users."
 
-  @credentials = Puppet::Provider::Openstack::CredentialsV2_0.new
+  @credentials = Puppet::Provider::Openstack::CredentialsV3.new
 
   def initialize(value={})
     super(value)
@@ -15,9 +16,6 @@ def initialize(value={})
   end
 
   def create
-    properties = []
-    properties << '--project' << get_project
-    properties << '--user' << get_user
     if resource[:roles]
       resource[:roles].each do |role|
         self.class.request('role', 'add', [role] + properties)
@@ -26,9 +24,6 @@ def create
   end
 
   def destroy
-    properties = []
-    properties << '--project' << get_project
-    properties << '--user' << get_user
     if @property_hash[:roles]
       @property_hash[:roles].each do |role|
         self.class.request('role', 'remove', [role] + properties)
@@ -38,10 +33,8 @@ def destroy
   end
 
   def exists?
-    if @user_role_hash
-      return ! @property_hash[:name].empty?
-    else
-      roles = self.class.request('user role', 'list', [get_user, '--project', get_project])
+    if self.class.user_role_hash.nil? || self.class.user_role_hash.empty?
+      roles = self.class.request('role', 'list', properties)
       # Since requesting every combination of users, roles, and
       # projects is so expensive, construct the property hash here
       # instead of in self.instances so it can be used in the role
@@ -55,8 +48,8 @@ def exists?
           role[:name]
         end
       end
-      return @property_hash[:ensure] == :present
     end
+    return @property_hash[:ensure] == :present
   end
 
   def roles
@@ -68,13 +61,11 @@ def roles=(value)
     # determine the roles to be added and removed
     remove = current_roles - Array(value)
     add    = Array(value) - current_roles
-    user = get_user
-    project = get_project
     add.each do |role_name|
-      self.class.request('role', 'add', [role_name, '--project', project, '--user', user])
+      self.class.request('role', 'add', [role_name] + properties)
     end
     remove.each do |role_name|
-      self.class.request('role', 'remove', [role_name, '--project', project, '--user', user])
+      self.class.request('role', 'remove', [role_name] + properties)
     end
   end
 
@@ -91,6 +82,19 @@ def self.instances
 
   private
 
+  def properties
+    properties = []
+    if get_project_id
+      properties << '--project' << get_project_id
+    elsif get_domain
+      properties << '--domain' << get_domain
+    else
+      error("No project or domain specified for role")
+    end
+    properties << '--user' << get_user_id
+    properties
+  end
+
   def get_user
     resource[:name].rpartition('@').first
   end
@@ -99,12 +103,67 @@ def get_project
     resource[:name].rpartition('@').last
   end
 
+  # if the role is for a domain, it will be specified as
+  # user@::domain - the "project" part will be empty
+  def get_domain
+    # use defined because @domain may be nil
+    return @domain if defined?(@domain)
+    projname, domname = Util.split_domain(get_project)
+    if projname.nil?
+      @domain = domname # no project specified, so must be a domain
+    else
+      @domain = nil # not a domain specific role
+    end
+    @domain
+  end
+
+  def get_user_id
+    @user_id ||= Puppet::Resource.indirection.find("Keystone_user/#{get_user}")[:id]
+  end
+
+  def get_project_id
+    # use defined because @project_id may be nil
+    return @project_id if defined?(@project_id)
+    projname, domname = Util.split_domain(get_project)
+    if projname.nil?
+      @project_id = nil
+    else
+      @project_id ||= Puppet::Resource.indirection.find("Keystone_tenant/#{get_project}")[:id]
+    end
+    @project_id
+  end
+
   def self.get_projects
-    request('project', 'list').collect { |project| project[:name] }
+    request('project', 'list', '--long').collect do |project|
+      {
+        :id        => project[:id],
+        :name      => project[:name],
+        :domain_id => project[:domain_id],
+        :domain    => domain_name_from_id(project[:domain_id])
+      }
+    end
   end
 
-  def self.get_users(project)
-    request('user', 'list', ['--project', project]).collect { |user| user[:name] }
+  def self.get_users(project_id=nil, domain_id=nil)
+    properties = ['--long']
+    if project_id
+      properties << '--project' << project_id
+    elsif domain_id
+      properties << '--domain' << domain_id
+    end
+    request('user', 'list', properties).collect do |user|
+      {
+        :id        => user[:id],
+        :name      => user[:name],
+        # note - column is "Domain" but it is really the domain id
+        :domain_id => user[:domain],
+        :domain    => domain_name_from_id(user[:domain])
+      }
+    end
+  end
+
+  def self.user_role_hash
+    @user_role_hash
   end
 
   def self.set_user_role_hash(user_role_hash)
@@ -112,16 +171,32 @@ def self.set_user_role_hash(user_role_hash)
   end
 
   def self.build_user_role_hash
-    hash = @user_role_hash || {}
+    # The new hash will have the property that if the
+    # given key does not exist, create it with an empty
+    # array as the value for the hash key
+    hash = @user_role_hash || Hash.new{|h,k| h[k] = []}
     return hash unless hash.empty?
-    projects = get_projects
-    projects.each do |project|
-      users = get_users(project)
-      users.each do |user|
-        user_roles = request('user role', 'list', [user, '--project', project])
-        hash["#{user}@#{project}"] = []
-        user_roles.each do |role|
-          hash["#{user}@#{project}"] << role[:name]
+    # Need a mapping of project id to names.
+    project_hash = {}
+    Puppet::Type.type(:keystone_tenant).provider(:openstack).instances.each do |project|
+      project_hash[project.id] = project.name
+    end
+    # Need a mapping of user id to names.
+    user_hash = {}
+    Puppet::Type.type(:keystone_user).provider(:openstack).instances.each do |user|
+      user_hash[user.id] = user.name
+    end
+    # need a mapping of role id to name
+    role_hash = {}
+    request('role', 'list').each {|role| role_hash[role[:id]] = role[:name]}
+    # now, get all role assignments
+    request('role assignment', 'list').each do |assignment|
+      if assignment[:user]
+        if assignment[:project]
+          hash["#{user_hash[assignment[:user]]}@#{project_hash[assignment[:project]]}"] << role_hash[assignment[:role]]
+        else
+          domainname = domain_id_to_name(assignment[:domain])
+          hash["#{user_hash[assignment[:user]]}@::#{domainname}"] << role_hash[assignment[:role]]
         end
       end
     end
diff --git a/keystone/lib/puppet/type/keystone_domain.rb b/keystone/lib/puppet/type/keystone_domain.rb
index 4a2d77736..687da2826 100644
--- a/keystone/lib/puppet/type/keystone_domain.rb
+++ b/keystone/lib/puppet/type/keystone_domain.rb
@@ -46,8 +46,8 @@
   end
 
   # we should not do anything until the keystone service is started
-  autorequire(:service) do
-    'keystone'
+  autorequire(:anchor) do
+    ['keystone_started']
   end
 
 
diff --git a/keystone/lib/puppet/type/keystone_endpoint.rb b/keystone/lib/puppet/type/keystone_endpoint.rb
index 43c5eb2ea..55d69f427 100644
--- a/keystone/lib/puppet/type/keystone_endpoint.rb
+++ b/keystone/lib/puppet/type/keystone_endpoint.rb
@@ -31,8 +31,8 @@
   end
 
   # we should not do anything until the keystone service is started
-  autorequire(:service) do
-    ['keystone']
+  autorequire(:anchor) do
+    ['keystone_started']
   end
 
   autorequire(:keystone_service) do
diff --git a/keystone/lib/puppet/type/keystone_role.rb b/keystone/lib/puppet/type/keystone_role.rb
index 3636afb27..15ec26a5c 100644
--- a/keystone/lib/puppet/type/keystone_role.rb
+++ b/keystone/lib/puppet/type/keystone_role.rb
@@ -22,7 +22,7 @@
   end
 
   # we should not do anything until the keystone service is started
-  autorequire(:service) do
-    ['keystone']
+  autorequire(:anchor) do
+    ['keystone_started']
   end
 end
diff --git a/keystone/lib/puppet/type/keystone_service.rb b/keystone/lib/puppet/type/keystone_service.rb
index a4be4edae..5fb2933c3 100644
--- a/keystone/lib/puppet/type/keystone_service.rb
+++ b/keystone/lib/puppet/type/keystone_service.rb
@@ -35,7 +35,7 @@
   # config is configured IF we need them for authentication.
   # If there is no keystone config, authentication credentials
   # need to come from another source.
-  autorequire(:service) do
-    ['keystone']
+  autorequire(:anchor) do
+    ['keystone_started']
   end
 end
diff --git a/keystone/lib/puppet/type/keystone_tenant.rb b/keystone/lib/puppet/type/keystone_tenant.rb
index 449ccd04e..4bddd8185 100644
--- a/keystone/lib/puppet/type/keystone_tenant.rb
+++ b/keystone/lib/puppet/type/keystone_tenant.rb
@@ -53,7 +53,7 @@ def insync?(is)
   # config is configured IF we need them for authentication.
   # If there is no keystone config, authentication credentials
   # need to come from another source.
-  autorequire(:service) do
-    ['keystone']
+  autorequire(:anchor) do
+    ['keystone_started','default_domain_created']
   end
 end
diff --git a/keystone/lib/puppet/type/keystone_user.rb b/keystone/lib/puppet/type/keystone_user.rb
index b484e7c5f..5c13d762c 100644
--- a/keystone/lib/puppet/type/keystone_user.rb
+++ b/keystone/lib/puppet/type/keystone_user.rb
@@ -2,6 +2,8 @@
 File.expand_path('../..', File.dirname(__FILE__)).tap { |dir| $LOAD_PATH.unshift(dir) unless $LOAD_PATH.include?(dir) }
 File.expand_path('../../../../openstacklib/lib', File.dirname(__FILE__)).tap { |dir| $LOAD_PATH.unshift(dir) unless $LOAD_PATH.include?(dir) }
 
+require 'puppet/provider/keystone/util'
+
 Puppet::Type.newtype(:keystone_user) do
 
   desc 'Type for managing keystone users.'
@@ -13,6 +15,11 @@
   end
 
   newparam(:ignore_default_tenant) do
+    # DEPRECATED - To be removed in next release (Liberty)
+    # https://bugs.launchpad.net/puppet-keystone/+bug/1472437
+    validate do |v|
+      Puppet.warning('The ignore_default_tenant parameter is deprecated and will be removed in the future.')
+    end
     newvalues(/(t|T)rue/, /(f|F)alse/, true, false)
     defaultto(false)
     munge do |value|
@@ -48,6 +55,11 @@ def should_to_s( newvalue )
   end
 
   newproperty(:tenant) do
+    # DEPRECATED - To be removed in next release (Liberty)
+    # https://bugs.launchpad.net/puppet-keystone/+bug/1472437
+    validate do |v|
+      Puppet.warning('The tenant parameter is deprecated and will be removed in the future. Please use keystone_user_role to assign a user to a project.')
+    end
     newvalues(/\S+/)
   end
 
@@ -69,12 +81,27 @@ def should_to_s( newvalue )
     end
   end
 
+  newproperty(:domain) do
+    newvalues(nil, /\S+/)
+    def insync?(is)
+      raise(Puppet::Error, "The domain cannot be changed from #{self.should} to #{is}") unless self.should == is
+      true
+    end
+  end
+
   autorequire(:keystone_tenant) do
+    # DEPRECATED - To be removed in next release (Liberty)
+    # https://bugs.launchpad.net/puppet-keystone/+bug/1472437
     self[:tenant]
   end
 
+  autorequire(:keystone_domain) do
+    # use the domain parameter if given, or the one from name if any
+    self[:domain] or Util.split_domain(self[:name])[1]
+  end
+
   # we should not do anything until the keystone service is started
-  autorequire(:service) do
-    ['keystone']
+  autorequire(:anchor) do
+    ['keystone_started','default_domain_created']
   end
 end
diff --git a/keystone/lib/puppet/type/keystone_user_role.rb b/keystone/lib/puppet/type/keystone_user_role.rb
index 502dc3976..28be7fdf2 100644
--- a/keystone/lib/puppet/type/keystone_user_role.rb
+++ b/keystone/lib/puppet/type/keystone_user_role.rb
@@ -2,6 +2,8 @@
 File.expand_path('../..', File.dirname(__FILE__)).tap { |dir| $LOAD_PATH.unshift(dir) unless $LOAD_PATH.include?(dir) }
 File.expand_path('../../../../openstacklib/lib', File.dirname(__FILE__)).tap { |dir| $LOAD_PATH.unshift(dir) unless $LOAD_PATH.include?(dir) }
 
+require 'puppet/provider/keystone/util'
+
 Puppet::Type.newtype(:keystone_user_role) do
 
   desc <<-EOT
@@ -31,15 +33,33 @@ def insync?(is)
   end
 
   autorequire(:keystone_tenant) do
-    self[:name].rpartition('@').last
+    proj, dom = Util.split_domain(self[:name].rpartition('@').last)
+    rv = nil
+    if proj # i.e. not ::domain
+      rv = self[:name].rpartition('@').last
+    end
+    rv
   end
 
   autorequire(:keystone_role) do
     self[:roles]
   end
 
+  autorequire(:keystone_domain) do
+    rv = []
+    userdom = Util.split_domain(self[:name].rpartition('@').first)[1]
+    if userdom
+      rv << userdom
+    end
+    projectdom = Util.split_domain(self[:name].rpartition('@').last)[1]
+    if projectdom
+      rv << projectdom
+    end
+    rv
+  end
+
   # we should not do anything until the keystone service is started
-  autorequire(:service) do
-    ['keystone']
+  autorequire(:anchor) do
+    ['keystone_started']
   end
 end
diff --git a/keystone/manifests/cron/token_flush.pp b/keystone/manifests/cron/token_flush.pp
index 331eeba56..6dba32b47 100644
--- a/keystone/manifests/cron/token_flush.pp
+++ b/keystone/manifests/cron/token_flush.pp
@@ -45,14 +45,19 @@
 #    Induces a random delay before running the cronjob to avoid running all
 #    cron jobs at the same time on all hosts this job is configured.
 #
+#  [*destination*]
+#    (optional) Path to file to which rows should be archived
+#    Defaults to '/var/log/keystone/keystone-tokenflush.log'.
+#
 class keystone::cron::token_flush (
-  $ensure   = present,
-  $minute   = 1,
-  $hour     = 0,
-  $monthday = '*',
-  $month    = '*',
-  $weekday  = '*',
-  $maxdelay = 0,
+  $ensure      = present,
+  $minute      = 1,
+  $hour        = 0,
+  $monthday    = '*',
+  $month       = '*',
+  $weekday     = '*',
+  $maxdelay    = 0,
+  $destination = '/var/log/keystone/keystone-tokenflush.log'
 ) {
 
   if $maxdelay == 0 {
@@ -63,7 +68,7 @@
 
   cron { 'keystone-manage token_flush':
     ensure      => $ensure,
-    command     => "${sleep}keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1",
+    command     => "${sleep}keystone-manage token_flush >>${destination} 2>&1",
     environment => 'PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh',
     user        => 'keystone',
     minute      => $minute,
diff --git a/keystone/manifests/endpoint.pp b/keystone/manifests/endpoint.pp
index 6c821f475..ddf5c1368 100644
--- a/keystone/manifests/endpoint.pp
+++ b/keystone/manifests/endpoint.pp
@@ -22,6 +22,20 @@
 # [*version*]
 #   (optional) API version for endpoint. Appended to all endpoint urls. (Defaults to 'v2.0')
 #
+# [*user_domain*]
+#   (Optional) Domain for $auth_name
+#   Defaults to undef (use the keystone server default domain)
+#
+# [*project_domain*]
+#   (Optional) Domain for $tenant (project)
+#   Defaults to undef (use the keystone server default domain)
+#
+# [*default_domain*]
+#   (Optional) Domain for $auth_name and $tenant (project)
+#   If keystone_user_domain is not specified, use $keystone_default_domain
+#   If keystone_project_domain is not specified, use $keystone_default_domain
+#   Defaults to undef
+#
 # === Examples
 #
 #  class { 'keystone::endpoint':
@@ -36,6 +50,9 @@
   $admin_url         = 'http://127.0.0.1:35357',
   $version           = 'v2.0',
   $region            = 'RegionOne',
+  $user_domain       = undef,
+  $project_domain    = undef,
+  $default_domain    = undef,
 ) {
 
   $public_url_real = "${public_url}/${version}"
@@ -56,6 +73,9 @@
     admin_url           => $admin_url_real,
     internal_url        => $internal_url_real,
     region              => $region,
+    user_domain         => $user_domain,
+    project_domain      => $project_domain,
+    default_domain      => $default_domain,
   }
 
 }
diff --git a/keystone/manifests/init.pp b/keystone/manifests/init.pp
index 20c2011e3..fa1c391c3 100644
--- a/keystone/manifests/init.pp
+++ b/keystone/manifests/init.pp
@@ -182,6 +182,21 @@
 #   (optional) The RabbitMQ virtual host.
 #   Defaults to /.
 #
+# [*rabbit_heartbeat_timeout_threshold*]
+#   (optional) Number of seconds after which the RabbitMQ broker is considered
+#   down if the heartbeat keepalive fails.  Any value >0 enables heartbeats.
+#   Heartbeating helps to ensure the TCP connection to RabbitMQ isn't silently
+#   closed, resulting in missed or lost messages from the queue.
+#   (Requires kombu >= 3.0.7 and amqp >= 1.4.0)
+#   Defaults to 0
+#
+# [*rabbit_heartbeat_rate*]
+#   (optional) How often during the rabbit_heartbeat_timeout_threshold period to
+#   check the heartbeat on RabbitMQ connection.  (i.e. rabbit_heartbeat_rate=2
+#   when rabbit_heartbeat_timeout_threshold=60, the heartbeat will be checked
+#   every 30 seconds.
+#   Defaults to 2
+#
 # [*rabbit_use_ssl*]
 #   (optional) Connect over SSL for RabbitMQ
 #   Defaults to false
@@ -363,6 +378,14 @@
 #   (Optional) Number of maximum active Fernet keys. Integer > 0.
 #   Defaults to undef
 #
+# [*default_domain*]
+#   (optional) When Keystone v3 support is enabled, v2 clients will need
+#   to have a domain assigned for certain operations.  For example,
+#   doing a user create operation must have a domain associated with it.
+#   This is the domain which will be used if a domain is needed and not
+#   explicitly set in the request.
+#   Defaults to undef (will use built-in Keystone default)
+#
 # == Dependencies
 #  None
 #
@@ -394,82 +417,85 @@
 #
 class keystone(
   $admin_token,
-  $package_ensure         = 'present',
-  $client_package_ensure  = 'present',
-  $public_bind_host       = '0.0.0.0',
-  $admin_bind_host        = '0.0.0.0',
-  $public_port            = '5000',
-  $admin_port             = '35357',
-  $verbose                = false,
-  $debug                  = false,
-  $log_dir                = '/var/log/keystone',
-  $log_file               = false,
-  $use_syslog             = false,
-  $log_facility           = 'LOG_USER',
-  $catalog_type           = 'sql',
-  $catalog_driver         = false,
-  $catalog_template_file  = '/etc/keystone/default_catalog.templates',
-  $token_provider         = 'keystone.token.providers.uuid.Provider',
-  $token_driver           = 'keystone.token.persistence.backends.sql.Token',
-  $token_expiration       = 3600,
-  $revoke_driver          = 'keystone.contrib.revoke.backends.sql.Revoke',
-  $public_endpoint        = false,
-  $admin_endpoint         = false,
-  $enable_ssl             = false,
-  $ssl_certfile           = '/etc/keystone/ssl/certs/keystone.pem',
-  $ssl_keyfile            = '/etc/keystone/ssl/private/keystonekey.pem',
-  $ssl_ca_certs           = '/etc/keystone/ssl/certs/ca.pem',
-  $ssl_ca_key             = '/etc/keystone/ssl/private/cakey.pem',
-  $ssl_cert_subject       = '/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost',
-  $cache_dir              = '/var/cache/keystone',
-  $memcache_servers       = false,
-  $manage_service         = true,
-  $cache_backend          = 'keystone.common.cache.noop',
-  $cache_backend_argument = undef,
-  $debug_cache_backend    = false,
-  $token_caching          = true,
-  $enabled                = true,
-  $database_connection    = 'sqlite:////var/lib/keystone/keystone.db',
-  $database_idle_timeout  = '200',
-  $enable_pki_setup       = true,
-  $signing_certfile       = '/etc/keystone/ssl/certs/signing_cert.pem',
-  $signing_keyfile        = '/etc/keystone/ssl/private/signing_key.pem',
-  $signing_ca_certs       = '/etc/keystone/ssl/certs/ca.pem',
-  $signing_ca_key         = '/etc/keystone/ssl/private/cakey.pem',
-  $signing_cert_subject   = '/C=US/ST=Unset/L=Unset/O=Unset/CN=www.example.com',
-  $signing_key_size       = 2048,
-  $rabbit_host            = 'localhost',
-  $rabbit_hosts           = false,
-  $rabbit_password        = 'guest',
-  $rabbit_port            = '5672',
-  $rabbit_userid          = 'guest',
-  $rabbit_virtual_host    = '/',
-  $rabbit_use_ssl         = false,
-  $kombu_ssl_ca_certs     = undef,
-  $kombu_ssl_certfile     = undef,
-  $kombu_ssl_keyfile      = undef,
-  $kombu_ssl_version      = 'TLSv1',
-  $notification_driver    = false,
-  $notification_topics    = false,
-  $notification_format    = undef,
-  $control_exchange       = false,
-  $validate_service       = false,
-  $validate_insecure      = false,
-  $validate_auth_url      = false,
-  $validate_cacert        = undef,
-  $paste_config           = $::keystone::params::paste_config,
-  $service_provider       = $::keystone::params::service_provider,
-  $service_name           = $::keystone::params::service_name,
-  $max_token_size         = undef,
-  $admin_workers          = max($::processorcount, 2),
-  $public_workers         = max($::processorcount, 2),
-  $sync_db                = true,
-  $enable_fernet_setup    = false,
-  $fernet_key_repository  = '/etc/keystone/fernet-keys',
-  $fernet_max_active_keys = undef,
+  $package_ensure                     = 'present',
+  $client_package_ensure              = 'present',
+  $public_bind_host                   = '0.0.0.0',
+  $admin_bind_host                    = '0.0.0.0',
+  $public_port                        = '5000',
+  $admin_port                         = '35357',
+  $verbose                            = false,
+  $debug                              = false,
+  $log_dir                            = '/var/log/keystone',
+  $log_file                           = false,
+  $use_syslog                         = false,
+  $log_facility                       = 'LOG_USER',
+  $catalog_type                       = 'sql',
+  $catalog_driver                     = false,
+  $catalog_template_file              = '/etc/keystone/default_catalog.templates',
+  $token_provider                     = 'keystone.token.providers.uuid.Provider',
+  $token_driver                       = 'keystone.token.persistence.backends.sql.Token',
+  $token_expiration                   = 3600,
+  $revoke_driver                      = 'keystone.contrib.revoke.backends.sql.Revoke',
+  $public_endpoint                    = false,
+  $admin_endpoint                     = false,
+  $enable_ssl                         = false,
+  $ssl_certfile                       = '/etc/keystone/ssl/certs/keystone.pem',
+  $ssl_keyfile                        = '/etc/keystone/ssl/private/keystonekey.pem',
+  $ssl_ca_certs                       = '/etc/keystone/ssl/certs/ca.pem',
+  $ssl_ca_key                         = '/etc/keystone/ssl/private/cakey.pem',
+  $ssl_cert_subject                   = '/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost',
+  $cache_dir                          = '/var/cache/keystone',
+  $memcache_servers                   = false,
+  $manage_service                     = true,
+  $cache_backend                      = 'keystone.common.cache.noop',
+  $cache_backend_argument             = undef,
+  $debug_cache_backend                = false,
+  $token_caching                      = true,
+  $enabled                            = true,
+  $database_connection                = 'sqlite:////var/lib/keystone/keystone.db',
+  $database_idle_timeout              = '200',
+  $enable_pki_setup                   = true,
+  $signing_certfile                   = '/etc/keystone/ssl/certs/signing_cert.pem',
+  $signing_keyfile                    = '/etc/keystone/ssl/private/signing_key.pem',
+  $signing_ca_certs                   = '/etc/keystone/ssl/certs/ca.pem',
+  $signing_ca_key                     = '/etc/keystone/ssl/private/cakey.pem',
+  $signing_cert_subject               = '/C=US/ST=Unset/L=Unset/O=Unset/CN=www.example.com',
+  $signing_key_size                   = 2048,
+  $rabbit_host                        = 'localhost',
+  $rabbit_hosts                       = false,
+  $rabbit_password                    = 'guest',
+  $rabbit_port                        = '5672',
+  $rabbit_userid                      = 'guest',
+  $rabbit_virtual_host                = '/',
+  $rabbit_heartbeat_timeout_threshold = 0,
+  $rabbit_heartbeat_rate              = 2,
+  $rabbit_use_ssl                     = false,
+  $kombu_ssl_ca_certs                 = undef,
+  $kombu_ssl_certfile                 = undef,
+  $kombu_ssl_keyfile                  = undef,
+  $kombu_ssl_version                  = 'TLSv1',
+  $notification_driver                = false,
+  $notification_topics                = false,
+  $notification_format                = undef,
+  $control_exchange                   = false,
+  $validate_service                   = false,
+  $validate_insecure                  = false,
+  $validate_auth_url                  = false,
+  $validate_cacert                    = undef,
+  $paste_config                       = $::keystone::params::paste_config,
+  $service_provider                   = $::keystone::params::service_provider,
+  $service_name                       = $::keystone::params::service_name,
+  $max_token_size                     = undef,
+  $admin_workers                      = max($::processorcount, 2),
+  $public_workers                     = max($::processorcount, 2),
+  $sync_db                            = true,
+  $enable_fernet_setup                = false,
+  $fernet_key_repository              = '/etc/keystone/fernet-keys',
+  $fernet_max_active_keys             = undef,
+  $default_domain                     = undef,
   # DEPRECATED PARAMETERS
-  $mysql_module           = undef,
-  $compute_port           = undef,
+  $mysql_module                       = undef,
+  $compute_port                       = undef,
 ) inherits keystone::params {
 
   if ! $catalog_driver {
@@ -756,35 +782,37 @@
   }
 
   keystone_config {
-    'DEFAULT/rabbit_password':     value => $rabbit_password, secret => true;
-    'DEFAULT/rabbit_userid':       value => $rabbit_userid;
-    'DEFAULT/rabbit_virtual_host': value => $rabbit_virtual_host;
+    'oslo_messaging_rabbit/rabbit_password':              value => $rabbit_password, secret => true;
+    'oslo_messaging_rabbit/rabbit_userid':                value => $rabbit_userid;
+    'oslo_messaging_rabbit/rabbit_virtual_host':          value => $rabbit_virtual_host;
+    'oslo_messaging_rabbit/heartbeat_timeout_threshold':  value => $rabbit_heartbeat_timeout_threshold;
+    'oslo_messaging_rabbit/heartbeat_rate':               value => $rabbit_heartbeat_rate;
   }
 
   if $rabbit_hosts {
-    keystone_config { 'DEFAULT/rabbit_hosts':     value => join($rabbit_hosts, ',') }
-    keystone_config { 'DEFAULT/rabbit_ha_queues': value => true }
+    keystone_config { 'oslo_messaging_rabbit/rabbit_hosts':     value => join($rabbit_hosts, ',') }
+    keystone_config { 'oslo_messaging_rabbit/rabbit_ha_queues': value => true }
   } else {
-    keystone_config { 'DEFAULT/rabbit_host':      value => $rabbit_host }
-    keystone_config { 'DEFAULT/rabbit_port':      value => $rabbit_port }
-    keystone_config { 'DEFAULT/rabbit_hosts':     value => "${rabbit_host}:${rabbit_port}" }
-    keystone_config { 'DEFAULT/rabbit_ha_queues': value => false }
+    keystone_config { 'oslo_messaging_rabbit/rabbit_host':      value => $rabbit_host }
+    keystone_config { 'oslo_messaging_rabbit/rabbit_port':      value => $rabbit_port }
+    keystone_config { 'oslo_messaging_rabbit/rabbit_hosts':     value => "${rabbit_host}:${rabbit_port}" }
+    keystone_config { 'oslo_messaging_rabbit/rabbit_ha_queues': value => false }
   }
 
-  keystone_config { 'DEFAULT/rabbit_use_ssl': value => $rabbit_use_ssl }
+  keystone_config { 'oslo_messaging_rabbit/rabbit_use_ssl': value => $rabbit_use_ssl }
   if $rabbit_use_ssl {
     keystone_config {
-      'DEFAULT/kombu_ssl_ca_certs': value => $kombu_ssl_ca_certs;
-      'DEFAULT/kombu_ssl_certfile': value => $kombu_ssl_certfile;
-      'DEFAULT/kombu_ssl_keyfile':  value => $kombu_ssl_keyfile;
-      'DEFAULT/kombu_ssl_version':  value => $kombu_ssl_version;
+      'oslo_messaging_rabbit/kombu_ssl_ca_certs': value => $kombu_ssl_ca_certs;
+      'oslo_messaging_rabbit/kombu_ssl_certfile': value => $kombu_ssl_certfile;
+      'oslo_messaging_rabbit/kombu_ssl_keyfile':  value => $kombu_ssl_keyfile;
+      'oslo_messaging_rabbit/kombu_ssl_version':  value => $kombu_ssl_version;
     }
   } else {
     keystone_config {
-      'DEFAULT/kombu_ssl_ca_certs': ensure => absent;
-      'DEFAULT/kombu_ssl_certfile': ensure => absent;
-      'DEFAULT/kombu_ssl_keyfile':  ensure => absent;
-      'DEFAULT/kombu_ssl_version':  ensure => absent;
+      'oslo_messaging_rabbit/kombu_ssl_ca_certs': ensure => absent;
+      'oslo_messaging_rabbit/kombu_ssl_certfile': ensure => absent;
+      'oslo_messaging_rabbit/kombu_ssl_keyfile':  ensure => absent;
+      'oslo_messaging_rabbit/kombu_ssl_version':  ensure => absent;
     }
   }
 
@@ -804,6 +832,7 @@
   }
 
   if $service_name == $::keystone::params::service_name {
+    $service_name_real = $::keystone::params::service_name
     if $validate_service {
       if $validate_auth_url {
         $v_auth_url = $validate_auth_url
@@ -836,6 +865,7 @@
       }
     }
   } elsif $service_name == 'httpd' {
+    include ::apache::params
     class { '::keystone::service':
       ensure       => 'stopped',
       service_name => $::keystone::params::service_name,
@@ -843,6 +873,7 @@
       provider     => $service_provider,
       validate     => false,
     }
+    $service_name_real = $::apache::params::service_name
   } else {
     fail('Invalid service_name. Either keystone/openstack-keystone for running as a standalone service, or httpd for being run by a httpd server')
   }
@@ -927,4 +958,33 @@
     }
   }
 
+  if $default_domain {
+    keystone_domain { $default_domain:
+      ensure     => present,
+      enabled    => true,
+      is_default => true,
+      require    => File['/etc/keystone/keystone.conf'],
+      notify     => Exec['restart_keystone'],
+    }
+    anchor { 'default_domain_created':
+      require => Keystone_domain[$default_domain],
+    }
+    # Update this code when https://bugs.launchpad.net/keystone/+bug/1472285 is addressed.
+    # 1/ Keystone needs to be started before creating the default domain
+    # 2/ Once the default domain is created, we can query Keystone to get the default domain ID
+    # 3/ The Keystone_domain provider has in charge of doing the query and configure keystone.conf
+    # 4/ After such a change, we need to restart Keystone service.
+    # restart_keystone exec is doing 4/, it restart Keystone if we have a new default domain setted
+    # and if we manage the service to be enabled.
+    if $manage_service and $enabled {
+      exec { 'restart_keystone':
+        path        => ['/usr/sbin', '/usr/bin', '/sbin', '/bin/'],
+        command     => "service ${service_name_real} restart",
+        refreshonly => true,
+      }
+    }
+  }
+  anchor { 'keystone_started':
+    require => Service[$service_name]
+  }
 }
diff --git a/keystone/manifests/resource/authtoken.pp b/keystone/manifests/resource/authtoken.pp
new file mode 100644
index 000000000..5165abb3a
--- /dev/null
+++ b/keystone/manifests/resource/authtoken.pp
@@ -0,0 +1,253 @@
+# == Definition: keystone::resource::authtoken
+#
+# This resource configures Keystone authentication resources for an OpenStack
+# service.  It will manage the [keystone_authtoken] section in the given
+# config resource.  It supports all of the authentication parameters specified
+# at http://www.jamielennox.net/blog/2015/02/17/loading-authentication-plugins/
+# with the addition of the default domain for user and project.
+#
+# The username and project_name parameters may be given in the form
+# "name::domainname".  The authtoken resource will use the domains in
+# the following order:
+# 1) The given domain parameter (user_domain_name or project_domain_name)
+# 2) The domain given as the "::domainname" part of username or project_name
+# 3) The default_domain_name
+#
+# For example, instead of doing this::
+#
+#     glance_api_config {
+#       'keystone_authtoken/admin_tenant_name': value => $keystone_tenant;
+#       'keystone_authtoken/admin_user'       : value => $keystone_user;
+#       'keystone_authtoken/admin_password'   : value => $keystone_password;
+#       secret => true;
+#       ...
+#     }
+#
+# manifests should do this instead::
+#
+#     keystone::resource::authtoken { 'glance_api_config':
+#       username            => $keystone_user,
+#       password            => $keystone_password,
+#       auth_url            => $real_identity_uri,
+#       project_name        => $keystone_tenant,
+#       user_domain_name    => $keystone_user_domain,
+#       project_domain_name => $keystone_project_domain,
+#       default_domain_name => $keystone_default_domain,
+#       cacert              => $ca_file,
+#       ...
+#     }
+#
+# The use of `keystone::resource::authtoken` makes it easy to avoid mistakes,
+# and makes it easier to support some of the newer authentication types coming
+# with Keystone Kilo and later, such as Kerberos, Federation, etc.
+#
+# == Parameters:
+#
+# [*name*]
+#   The name of the resource corresponding to the config file.  For example,
+#   keystone::resource::authtoken { 'glance_api_config': ... }
+#   Where 'glance_api_config' is the name of the resource used to manage
+#   the glance api configuration.
+#   string; required
+#
+# [*username*]
+#   The name of the service user;
+#   string; required
+#
+# [*password*]
+#   Password to create for the service user;
+#   string; required
+#
+# [*auth_url*]
+#   The URL to use for authentication.
+#   string; required
+#
+# [*auth_plugin*]
+#   The plugin to use for authentication.
+#   string; optional: default to 'password'
+#
+# [*user_id*]
+#   The ID of the service user;
+#   string; optional: default to undef
+#
+# [*user_domain_name*]
+#   (Optional) Name of domain for $username
+#   Defaults to undef
+#
+# [*user_domain_id*]
+#   (Optional) ID of domain for $username
+#   Defaults to undef
+#
+# [*project_name*]
+#   Service project name;
+#   string; optional: default to undef
+#
+# [*project_id*]
+#   Service project ID;
+#   string; optional: default to undef
+#
+# [*project_domain_name*]
+#   (Optional) Name of domain for $project_name
+#   Defaults to undef
+#
+# [*project_domain_id*]
+#   (Optional) ID of domain for $project_name
+#   Defaults to undef
+#
+# [*domain_name*]
+#   (Optional) Use this for auth to obtain a domain-scoped token.
+#   If using this option, do not specify $project_name or $project_id.
+#   Defaults to undef
+#
+# [*domain_id*]
+#   (Optional) Use this for auth to obtain a domain-scoped token.
+#   If using this option, do not specify $project_name or $project_id.
+#   Defaults to undef
+#
+# [*default_domain_name*]
+#   (Optional) Name of domain for $username and $project_name
+#   If user_domain_name is not specified, use $default_domain_name
+#   If project_domain_name is not specified, use $default_domain_name
+#   Defaults to undef
+#
+# [*default_domain_id*]
+#   (Optional) ID of domain for $user_id and $project_id
+#   If user_domain_id is not specified, use $default_domain_id
+#   If project_domain_id is not specified, use $default_domain_id
+#   Defaults to undef
+#
+# [*trust_id*]
+#   (Optional) Trust ID
+#   Defaults to undef
+#
+# [*cacert*]
+#   (Optional) CA certificate file for TLS (https)
+#   Defaults to undef
+#
+# [*cert*]
+#   (Optional) Certificate file for TLS (https)
+#   Defaults to undef
+#
+# [*key*]
+#   (Optional) Key file for TLS (https)
+#   Defaults to undef
+#
+# [*insecure*]
+#   If true, explicitly allow TLS without checking server cert against any
+#   certificate authorities.  WARNING: not recommended.  Use with caution.
+#   boolean; Defaults to false (which means be secure)
+#
+define keystone::resource::authtoken(
+  $username,
+  $password,
+  $auth_url,
+  $auth_plugin         = 'password',
+  $user_id             = undef,
+  $user_domain_name    = undef,
+  $user_domain_id      = undef,
+  $project_name        = undef,
+  $project_id          = undef,
+  $project_domain_name = undef,
+  $project_domain_id   = undef,
+  $domain_name         = undef,
+  $domain_id           = undef,
+  $default_domain_name = undef,
+  $default_domain_id   = undef,
+  $trust_id            = undef,
+  $cacert              = undef,
+  $cert                = undef,
+  $key                 = undef,
+  $insecure            = false,
+) {
+
+  if !$project_name and !$project_id and !$domain_name and !$domain_id {
+    fail('Must specify either a project (project_name or project_id, for a project scoped token) or a domain (domain_name or domain_id, for a domain scoped token)')
+  }
+
+  if ($project_name or $project_id) and ($domain_name or $domain_id) {
+    fail('Cannot specify both a project (project_name or project_id) and a domain (domain_name or domain_id)')
+  }
+
+  $user_and_domain_array = split($username, '::')
+  $real_username = $user_and_domain_array[0]
+  $real_user_domain_name = pick($user_domain_name, $user_and_domain_array[1], $default_domain_name, '__nodomain__')
+
+  $project_and_domain_array = split($project_name, '::')
+  $real_project_name = $project_and_domain_array[0]
+  $real_project_domain_name = pick($project_domain_name, $project_and_domain_array[1], $default_domain_name, '__nodomain__')
+
+  create_resources($name, {'keystone_authtoken/auth_plugin' => {'value' => $auth_plugin}})
+  create_resources($name, {'keystone_authtoken/auth_url' => {'value' => $auth_url}})
+  create_resources($name, {'keystone_authtoken/username' => {'value' => $real_username}})
+  create_resources($name, {'keystone_authtoken/password' => {'value' => $password, 'secret' => true}})
+  if $user_id {
+    create_resources($name, {'keystone_authtoken/user_id' => {'value' => $user_id}})
+  } else {
+    create_resources($name, {'keystone_authtoken/user_id' => {'ensure' => 'absent'}})
+  }
+  if $real_user_domain_name == '__nodomain__' {
+    create_resources($name, {'keystone_authtoken/user_domain_name' => {'ensure' => 'absent'}})
+  } else {
+    create_resources($name, {'keystone_authtoken/user_domain_name' => {'value' => $real_user_domain_name}})
+  }
+  if $user_domain_id {
+    create_resources($name, {'keystone_authtoken/user_domain_id' => {'value' => $user_domain_id}})
+  } elsif $default_domain_id {
+    create_resources($name, {'keystone_authtoken/user_domain_id' => {'value' => $default_domain_id}})
+  } else {
+    create_resources($name, {'keystone_authtoken/user_domain_id' => {'ensure' => 'absent'}})
+  }
+  if $project_name {
+    create_resources($name, {'keystone_authtoken/project_name' => {'value' => $real_project_name}})
+  } else {
+    create_resources($name, {'keystone_authtoken/project_name' => {'ensure' => 'absent'}})
+  }
+  if $project_id {
+    create_resources($name, {'keystone_authtoken/project_id' => {'value' => $project_id}})
+  } else {
+    create_resources($name, {'keystone_authtoken/project_id' => {'ensure' => 'absent'}})
+  }
+  if $real_project_domain_name == '__nodomain__' {
+    create_resources($name, {'keystone_authtoken/project_domain_name' => {'ensure' => 'absent'}})
+  } else {
+    create_resources($name, {'keystone_authtoken/project_domain_name' => {'value' => $real_project_domain_name}})
+  }
+  if $project_domain_id {
+    create_resources($name, {'keystone_authtoken/project_domain_id' => {'value' => $project_domain_id}})
+  } elsif $default_domain_id {
+    create_resources($name, {'keystone_authtoken/project_domain_id' => {'value' => $default_domain_id}})
+  } else {
+    create_resources($name, {'keystone_authtoken/project_domain_id' => {'ensure' => 'absent'}})
+  }
+  if $domain_name {
+    create_resources($name, {'keystone_authtoken/domain_name' => {'value' => $domain_name}})
+  } else {
+    create_resources($name, {'keystone_authtoken/domain_name' => {'ensure' => 'absent'}})
+  }
+  if $domain_id {
+    create_resources($name, {'keystone_authtoken/domain_id' => {'value' => $domain_id}})
+  } else {
+    create_resources($name, {'keystone_authtoken/domain_id' => {'ensure' => 'absent'}})
+  }
+  if $trust_id {
+    create_resources($name, {'keystone_authtoken/trust_id' => {'value' => $trust_id}})
+  } else {
+    create_resources($name, {'keystone_authtoken/trust_id' => {'ensure' => 'absent'}})
+  }
+  if $cacert {
+    create_resources($name, {'keystone_authtoken/cacert' => {'value' => $cacert}})
+  } else {
+    create_resources($name, {'keystone_authtoken/cacert' => {'ensure' => 'absent'}})
+  }
+  if $cert {
+    create_resources($name, {'keystone_authtoken/cert' => {'value' => $cert}})
+  } else {
+    create_resources($name, {'keystone_authtoken/cert' => {'ensure' => 'absent'}})
+  }
+  if $key {
+    create_resources($name, {'keystone_authtoken/key' => {'value' => $key}})
+  } else {
+    create_resources($name, {'keystone_authtoken/key' => {'ensure' => 'absent'}})
+  }
+  create_resources($name, {'keystone_authtoken/insecure' => {'value' => $insecure}})
+}
diff --git a/keystone/manifests/resource/service_identity.pp b/keystone/manifests/resource/service_identity.pp
index 9bbd1b13a..4ac132205 100644
--- a/keystone/manifests/resource/service_identity.pp
+++ b/keystone/manifests/resource/service_identity.pp
@@ -69,10 +69,6 @@
 #   List of roles;
 #   string; optional: default to ['admin']
 #
-# [*domain*]
-#   User domain (keystone v3), not implemented yet.
-#   string; optional: default to undef
-#
 # [*email*]
 #   Service email;
 #   string; optional: default to '$auth_name@localhost'
@@ -93,6 +89,20 @@
 #   Whether to create the service.
 #   string; optional: default to True
 #
+# [*user_domain*]
+#   (Optional) Domain for $auth_name
+#   Defaults to undef (use the keystone server default domain)
+#
+# [*project_domain*]
+#   (Optional) Domain for $tenant (project)
+#   Defaults to undef (use the keystone server default domain)
+#
+# [*default_domain*]
+#   (Optional) Domain for $auth_name and $tenant (project)
+#   If keystone_user_domain is not specified, use $keystone_default_domain
+#   If keystone_project_domain is not specified, use $keystone_default_domain
+#   Defaults to undef
+#
 define keystone::resource::service_identity(
   $admin_url             = false,
   $internal_url          = false,
@@ -104,7 +114,6 @@
   $configure_user        = true,
   $configure_user_role   = true,
   $configure_service     = true,
-  $domain                = undef,
   $email                 = "${name}@localhost",
   $region                = 'RegionOne',
   $service_name          = undef,
@@ -112,19 +121,32 @@
   $tenant                = 'services',
   $ignore_default_tenant = false,
   $roles                 = ['admin'],
+  $user_domain           = undef,
+  $project_domain        = undef,
+  $default_domain        = undef,
 ) {
-
-  if $domain {
-    warning('Keystone domains are not yet managed by puppet-keystone.')
-  }
-
   if $service_name == undef {
     $service_name_real = $auth_name
   } else {
     $service_name_real = $service_name
   }
 
+  if $user_domain == undef {
+    $user_domain_real = $default_domain
+  } else {
+    $user_domain_real = $user_domain
+  }
+
   if $configure_user {
+    if $user_domain_real {
+      # We have to use ensure_resource here and hope for the best, because we have
+      # no way to know if the $user_domain is the same domain passed as the
+      # $default_domain parameter to class keystone.
+      ensure_resource('keystone_domain', $user_domain_real, {
+        'ensure'  => 'present',
+        'enabled' => true,
+      })
+    }
     ensure_resource('keystone_user', $auth_name, {
       'ensure'                => 'present',
       'enabled'               => true,
@@ -132,6 +154,7 @@
       'email'                 => $email,
       'tenant'                => $tenant,
       'ignore_default_tenant' => $ignore_default_tenant,
+      'domain'                => $user_domain_real,
     })
   }
 
@@ -140,9 +163,6 @@
       'ensure' => 'present',
       'roles'  => $roles,
     })
-    if $configure_user {
-      Keystone_user[$auth_name] -> Keystone_user_role["${auth_name}@${tenant}"]
-    }
   }
 
   if $configure_service {
diff --git a/keystone/manifests/roles/admin.pp b/keystone/manifests/roles/admin.pp
index aa5abd72f..37758c812 100644
--- a/keystone/manifests/roles/admin.pp
+++ b/keystone/manifests/roles/admin.pp
@@ -51,7 +51,19 @@
 #
 # [*configure_user_role*]
 #   Optional. Should the admin role be configured for the admin user?
-#   Defaulst to 'true'.
+#   Defaults to 'true'.
+#
+# [*admin_user_domain*]
+#   Optional.  Domain of the admin user
+#   Defaults to undef (undef will resolve to class keystone $default_domain)
+#
+# [*admin_project_domain*]
+#   Optional.  Domain of the admin tenant
+#   Defaults to undef (undef will resolve to class keystone $default_domain)
+#
+# [*service_project_domain*]
+#   Optional.  Domain for $service_tenant
+#   Defaults to undef (undef will resolve to class keystone $default_domain)
 #
 # == Dependencies
 # == Examples
@@ -75,17 +87,28 @@
   $service_tenant_desc    = 'Tenant for the openstack services',
   $configure_user         = true,
   $configure_user_role    = true,
+  $admin_user_domain      = undef,
+  $admin_project_domain   = undef,
+  $service_project_domain = undef,
 ) {
 
+  $domains = unique(delete_undef_values([ $admin_user_domain, $admin_project_domain, $service_project_domain]))
+  keystone_domain { $domains:
+    ensure  => present,
+    enabled => true,
+  }
+
   keystone_tenant { $service_tenant:
     ensure      => present,
     enabled     => true,
     description => $service_tenant_desc,
+    domain      => $service_project_domain,
   }
   keystone_tenant { $admin_tenant:
     ensure      => present,
     enabled     => true,
     description => $admin_tenant_desc,
+    domain      => $admin_project_domain,
   }
   keystone_role { 'admin':
     ensure => present,
@@ -98,6 +121,7 @@
       tenant                => $admin_tenant,
       email                 => $email,
       password              => $password,
+      domain                => $admin_user_domain,
       ignore_default_tenant => $ignore_default_tenant,
     }
   }
diff --git a/keystone/metadata.json b/keystone/metadata.json
index 77e23afd4..5a2e3ff61 100644
--- a/keystone/metadata.json
+++ b/keystone/metadata.json
@@ -1,6 +1,6 @@
 {
-  "name": "stackforge-keystone",
-  "version": "5.1.0",
+  "name": "openstack-keystone",
+  "version": "6.0.0",
   "author": "Puppet Labs and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Keystone",
   "license": "Apache-2.0",
@@ -34,6 +34,6 @@
     { "name": "puppetlabs/apache", "version_requirement": ">=1.0.0 <2.0.0" },
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
-    { "name": "stackforge/openstacklib", "version_requirement": ">=5.0.0 <6.0.0" }
+    { "name": "openstack/openstacklib", "version_requirement": ">=6.0.0 <7.0.0" }
   ]
 }
diff --git a/keystone/spec/acceptance/basic_keystone_spec.rb b/keystone/spec/acceptance/basic_keystone_spec.rb
index b0fd8d398..f8aa5023f 100644
--- a/keystone/spec/acceptance/basic_keystone_spec.rb
+++ b/keystone/spec/acceptance/basic_keystone_spec.rb
@@ -42,14 +42,17 @@ class { '::keystone':
         database_connection => 'mysql://keystone:keystone@127.0.0.1/keystone',
         admin_token         => 'admin_token',
         enabled             => true,
+        default_domain      => 'default_domain',
       }
+      # "v2" admin and service
       class { '::keystone::roles::admin':
-        email    => 'test@example.tld',
-        password => 'a_big_secret',
+        email                  => 'test@example.tld',
+        password               => 'a_big_secret',
       }
       class { '::keystone::endpoint':
-        public_url => "http://127.0.0.1:5000/",
-        admin_url  => "http://127.0.0.1:35357/",
+        public_url     => "http://127.0.0.1:5000/",
+        admin_url      => "http://127.0.0.1:35357/",
+        default_domain => 'admin',
       }
       ::keystone::resource::service_identity { 'beaker-ci':
         service_type        => 'beaker',
@@ -60,6 +63,56 @@ class { '::keystone::endpoint':
         admin_url           => 'http://127.0.0.1:1234',
         internal_url        => 'http://127.0.0.1:1234',
       }
+      # v3 admin
+      # we don't use ::keystone::roles::admin but still create resources manually:
+      keystone_domain { 'admin_domain':
+        ensure      => present,
+        enabled     => true,
+        description => 'Domain for admin v3 users',
+      }
+      keystone_domain { 'service_domain':
+        ensure      => present,
+        enabled     => true,
+        description => 'Domain for admin v3 users',
+      }
+      keystone_tenant { 'servicesv3':
+        ensure      => present,
+        enabled     => true,
+        description => 'Tenant for the openstack services',
+        domain      => 'service_domain',
+      }
+      keystone_tenant { 'openstackv3':
+        ensure      => present,
+        enabled     => true,
+        description => 'admin tenant',
+        domain      => 'admin_domain',
+      }
+      keystone_user { 'adminv3':
+        ensure      => present,
+        enabled     => true,
+        tenant      => 'openstackv3', # note: don't have to use 'openstackv3::admin_domain' here since the tenant name 'openstackv3' is unique among all domains
+        email       => 'test@example.tld',
+        password    => 'a_big_secret',
+        domain      => 'admin_domain',
+      }
+      keystone_user_role { 'adminv3@openstackv3':
+        ensure => present,
+        roles  => ['admin'],
+      }
+      # service user exists only in the service_domain - must
+      # use v3 api
+      ::keystone::resource::service_identity { 'beaker-civ3':
+        service_type        => 'beakerv3',
+        service_description => 'beakerv3 service',
+        service_name        => 'beakerv3',
+        password            => 'secret',
+        tenant              => 'servicesv3',
+        public_url          => 'http://127.0.0.1:1234/v3',
+        admin_url           => 'http://127.0.0.1:1234/v3',
+        internal_url        => 'http://127.0.0.1:1234/v3',
+        user_domain         => 'service_domain',
+        project_domain      => 'service_domain',
+      }
       EOS
 
 
@@ -77,40 +130,97 @@ class { '::keystone::endpoint':
     end
 
     describe cron do
-      it { should have_entry('1 0 * * * keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1').with_user('keystone') }
+      it { is_expected.to have_entry('1 0 * * * keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1').with_user('keystone') }
     end
 
-    describe 'test keystone user/tenant/service/role/endpoint resources' do
+    shared_examples_for 'keystone user/tenant/service/role/endpoint resources using v2 API' do |auth_creds|
+      it 'should find users in the default domain' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v2.0 --os-identity-api-version 2 user list") do |r|
+          expect(r.stdout).to match(/admin/)
+          expect(r.stderr).to be_empty
+        end
+      end
+      it 'should find tenants in the default domain' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v2.0 --os-identity-api-version 2 project list") do |r|
+          expect(r.stdout).to match(/openstack/)
+          expect(r.stderr).to be_empty
+        end
+      end
+      it 'should find beaker service' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v2.0 --os-identity-api-version 2 service list") do |r|
+          expect(r.stdout).to match(/beaker/)
+          expect(r.stderr).to be_empty
+        end
+      end
+      it 'should find admin role' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v2.0 --os-identity-api-version 2 role list") do |r|
+          expect(r.stdout).to match(/admin/)
+          expect(r.stderr).to be_empty
+        end
+      end
+      it 'should find beaker endpoints' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v2.0 --os-identity-api-version 2 endpoint list --long") do |r|
+          expect(r.stdout).to match(/1234/)
+          expect(r.stderr).to be_empty
+        end
+      end
+    end
+    shared_examples_for 'keystone user/tenant/service/role/endpoint resources using v3 API' do |auth_creds|
       it 'should find beaker user' do
-        shell('openstack --os-username admin --os-password a_big_secret --os-tenant-name openstack --os-auth-url http://127.0.0.1:5000/v2.0 user list') do |r|
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 user list") do |r|
           expect(r.stdout).to match(/beaker/)
           expect(r.stderr).to be_empty
         end
       end
       it 'should find services tenant' do
-        shell('openstack --os-username admin --os-password a_big_secret --os-tenant-name openstack --os-auth-url http://127.0.0.1:5000/v2.0 project list') do |r|
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 project list") do |r|
           expect(r.stdout).to match(/services/)
           expect(r.stderr).to be_empty
         end
       end
       it 'should find beaker service' do
-        shell('openstack --os-username admin --os-password a_big_secret --os-tenant-name openstack --os-auth-url http://127.0.0.1:5000/v2.0 service list') do |r|
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 service list") do |r|
           expect(r.stdout).to match(/beaker/)
           expect(r.stderr).to be_empty
         end
       end
       it 'should find admin role' do
-        shell('openstack --os-username admin --os-password a_big_secret --os-tenant-name openstack --os-auth-url http://127.0.0.1:5000/v2.0 role list') do |r|
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 role list") do |r|
           expect(r.stdout).to match(/admin/)
           expect(r.stderr).to be_empty
         end
       end
       it 'should find beaker endpoints' do
-        shell('openstack --os-username admin --os-password a_big_secret --os-tenant-name openstack --os-auth-url http://127.0.0.1:5000/v2.0 endpoint list --long') do |r|
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 endpoint list") do |r|
           expect(r.stdout).to match(/1234/)
           expect(r.stderr).to be_empty
         end
       end
     end
+    describe 'with v2 admin with v2 credentials' do
+      include_examples 'keystone user/tenant/service/role/endpoint resources using v2 API',
+                       '--os-username admin --os-password a_big_secret --os-project-name openstack'
+    end
+    describe 'with v2 service with v2 credentials' do
+      include_examples 'keystone user/tenant/service/role/endpoint resources using v2 API',
+                       '--os-username beaker-ci --os-password secret --os-project-name services'
+    end
+    describe 'with v2 admin with v3 credentials' do
+      include_examples 'keystone user/tenant/service/role/endpoint resources using v3 API',
+                       '--os-username admin --os-password a_big_secret --os-project-name openstack --os-user-domain-name default_domain --os-project-domain-name default_domain'
+    end
+    describe "with v2 service with v3 credentials" do
+      include_examples 'keystone user/tenant/service/role/endpoint resources using v3 API',
+                       '--os-username beaker-ci --os-password secret --os-project-name services --os-user-domain-name default_domain --os-project-domain-name default_domain'
+    end
+    describe 'with v3 admin with v3 credentials' do
+      include_examples 'keystone user/tenant/service/role/endpoint resources using v3 API',
+                       '--os-username adminv3 --os-password a_big_secret --os-project-name openstackv3 --os-user-domain-name admin_domain --os-project-domain-name admin_domain'
+    end
+    describe "with v3 service with v3 credentials" do
+      include_examples 'keystone user/tenant/service/role/endpoint resources using v3 API',
+                       '--os-username beaker-civ3 --os-password secret --os-project-name servicesv3 --os-user-domain-name service_domain --os-project-domain-name service_domain'
+    end
+
   end
 end
diff --git a/keystone/spec/acceptance/keystone_wsgi_apache_spec.rb b/keystone/spec/acceptance/keystone_wsgi_apache_spec.rb
new file mode 100644
index 000000000..b7c8d9dc2
--- /dev/null
+++ b/keystone/spec/acceptance/keystone_wsgi_apache_spec.rb
@@ -0,0 +1,232 @@
+require 'spec_helper_acceptance'
+
+describe 'keystone server running with Apache/WSGI with resources' do
+
+  context 'default parameters' do
+
+    it 'should work with no errors' do
+      pp= <<-EOS
+      Exec { logoutput => 'on_failure' }
+
+      # Common resources
+      case $::osfamily {
+        'Debian': {
+          include ::apt
+          class { '::openstack_extras::repo::debian::ubuntu':
+            release => 'kilo',
+            package_require => true,
+          }
+        }
+        'RedHat': {
+          class { '::openstack_extras::repo::redhat::redhat':
+            release => 'kilo',
+          }
+          package { 'openstack-selinux': ensure => 'latest' }
+        }
+        default: {
+          fail("Unsupported osfamily (${::osfamily})")
+        }
+      }
+
+      class { '::mysql::server': }
+
+      # Keystone resources
+      class { '::keystone::client': }
+      class { '::keystone::cron::token_flush': }
+      class { '::keystone::db::mysql':
+        password => 'keystone',
+      }
+      class { '::keystone':
+        verbose             => true,
+        debug               => true,
+        database_connection => 'mysql://keystone:keystone@127.0.0.1/keystone',
+        admin_token         => 'admin_token',
+        enabled             => true,
+        service_name        => 'httpd',
+        default_domain      => 'default_domain',
+      }
+      include ::apache
+      class { '::keystone::wsgi::apache':
+        ssl => false,
+      }
+
+      # "v2" admin and service
+      class { '::keystone::roles::admin':
+        email                  => 'test@example.tld',
+        password               => 'a_big_secret',
+      }
+      class { '::keystone::endpoint':
+        public_url     => "http://127.0.0.1:5000/",
+        admin_url      => "http://127.0.0.1:35357/",
+        default_domain => 'admin',
+      }
+      ::keystone::resource::service_identity { 'beaker-ci':
+        service_type        => 'beaker',
+        service_description => 'beaker service',
+        service_name        => 'beaker',
+        password            => 'secret',
+        public_url          => 'http://127.0.0.1:1234',
+        admin_url           => 'http://127.0.0.1:1234',
+        internal_url        => 'http://127.0.0.1:1234',
+      }
+      # v3 admin
+      # we don't use ::keystone::roles::admin but still create resources manually:
+      keystone_domain { 'admin_domain':
+        ensure      => present,
+        enabled     => true,
+        description => 'Domain for admin v3 users',
+      }
+      keystone_domain { 'service_domain':
+        ensure      => present,
+        enabled     => true,
+        description => 'Domain for admin v3 users',
+      }
+      keystone_tenant { 'servicesv3':
+        ensure      => present,
+        enabled     => true,
+        description => 'Tenant for the openstack services',
+        domain      => 'service_domain',
+      }
+      keystone_tenant { 'openstackv3':
+        ensure      => present,
+        enabled     => true,
+        description => 'admin tenant',
+        domain      => 'admin_domain',
+      }
+      keystone_user { 'adminv3':
+        ensure      => present,
+        enabled     => true,
+        tenant      => 'openstackv3', # note: don't have to use 'openstackv3::admin_domain' here since the tenant name 'openstackv3' is unique among all domains
+        email       => 'test@example.tld',
+        password    => 'a_big_secret',
+        domain      => 'admin_domain',
+      }
+      keystone_user_role { 'adminv3@openstackv3':
+        ensure => present,
+        roles  => ['admin'],
+      }
+      # service user exists only in the service_domain - must
+      # use v3 api
+      ::keystone::resource::service_identity { 'beaker-civ3':
+        service_type        => 'beakerv3',
+        service_description => 'beakerv3 service',
+        service_name        => 'beakerv3',
+        password            => 'secret',
+        tenant              => 'servicesv3',
+        public_url          => 'http://127.0.0.1:1234/v3',
+        admin_url           => 'http://127.0.0.1:1234/v3',
+        internal_url        => 'http://127.0.0.1:1234/v3',
+        user_domain         => 'service_domain',
+        project_domain      => 'service_domain',
+      }
+      EOS
+
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe port(5000) do
+      it { is_expected.to be_listening }
+    end
+
+    describe port(35357) do
+      it { is_expected.to be_listening }
+    end
+
+    describe cron do
+      it { is_expected.to have_entry('1 0 * * * keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1').with_user('keystone') }
+    end
+
+    shared_examples_for 'keystone user/tenant/service/role/endpoint resources using v2 API' do |auth_creds|
+      it 'should find users in the default domain' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v2.0 --os-identity-api-version 2 user list") do |r|
+          expect(r.stdout).to match(/admin/)
+          expect(r.stderr).to be_empty
+        end
+      end
+      it 'should find tenants in the default domain' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v2.0 --os-identity-api-version 2 project list") do |r|
+          expect(r.stdout).to match(/openstack/)
+          expect(r.stderr).to be_empty
+        end
+      end
+      it 'should find beaker service' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v2.0 --os-identity-api-version 2 service list") do |r|
+          expect(r.stdout).to match(/beaker/)
+          expect(r.stderr).to be_empty
+        end
+      end
+      it 'should find admin role' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v2.0 --os-identity-api-version 2 role list") do |r|
+          expect(r.stdout).to match(/admin/)
+          expect(r.stderr).to be_empty
+        end
+      end
+      it 'should find beaker endpoints' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v2.0 --os-identity-api-version 2 endpoint list --long") do |r|
+          expect(r.stdout).to match(/1234/)
+          expect(r.stderr).to be_empty
+        end
+      end
+    end
+    shared_examples_for 'keystone user/tenant/service/role/endpoint resources using v3 API' do |auth_creds|
+      it 'should find beaker user' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 user list") do |r|
+          expect(r.stdout).to match(/beaker/)
+          expect(r.stderr).to be_empty
+        end
+      end
+      it 'should find services tenant' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 project list") do |r|
+          expect(r.stdout).to match(/services/)
+          expect(r.stderr).to be_empty
+        end
+      end
+      it 'should find beaker service' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 service list") do |r|
+          expect(r.stdout).to match(/beaker/)
+          expect(r.stderr).to be_empty
+        end
+      end
+      it 'should find admin role' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 role list") do |r|
+          expect(r.stdout).to match(/admin/)
+          expect(r.stderr).to be_empty
+        end
+      end
+      it 'should find beaker endpoints' do
+        shell("openstack #{auth_creds} --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 endpoint list") do |r|
+          expect(r.stdout).to match(/1234/)
+          expect(r.stderr).to be_empty
+        end
+      end
+    end
+    describe 'with v2 admin with v2 credentials' do
+      include_examples 'keystone user/tenant/service/role/endpoint resources using v2 API',
+                       '--os-username admin --os-password a_big_secret --os-project-name openstack'
+    end
+    describe 'with v2 service with v2 credentials' do
+      include_examples 'keystone user/tenant/service/role/endpoint resources using v2 API',
+                       '--os-username beaker-ci --os-password secret --os-project-name services'
+    end
+    describe 'with v2 admin with v3 credentials' do
+      include_examples 'keystone user/tenant/service/role/endpoint resources using v3 API',
+                       '--os-username admin --os-password a_big_secret --os-project-name openstack --os-user-domain-name default_domain --os-project-domain-name default_domain'
+    end
+    describe "with v2 service with v3 credentials" do
+      include_examples 'keystone user/tenant/service/role/endpoint resources using v3 API',
+                       '--os-username beaker-ci --os-password secret --os-project-name services --os-user-domain-name default_domain --os-project-domain-name default_domain'
+    end
+    describe 'with v3 admin with v3 credentials' do
+      include_examples 'keystone user/tenant/service/role/endpoint resources using v3 API',
+                       '--os-username adminv3 --os-password a_big_secret --os-project-name openstackv3 --os-user-domain-name admin_domain --os-project-domain-name admin_domain'
+    end
+    describe "with v3 service with v3 credentials" do
+      include_examples 'keystone user/tenant/service/role/endpoint resources using v3 API',
+                       '--os-username beaker-civ3 --os-password secret --os-project-name servicesv3 --os-user-domain-name service_domain --os-project-domain-name service_domain'
+    end
+
+  end
+end
diff --git a/keystone/spec/classes/keystone_cron_token_flush_spec.rb b/keystone/spec/classes/keystone_cron_token_flush_spec.rb
index 88e1fd519..24ebcd8aa 100644
--- a/keystone/spec/classes/keystone_cron_token_flush_spec.rb
+++ b/keystone/spec/classes/keystone_cron_token_flush_spec.rb
@@ -6,62 +6,73 @@
     { :osfamily => 'Debian' }
   end
 
+  let :params do
+    { :ensure      => 'present',
+      :minute      => 1,
+      :hour        => 0,
+      :monthday    => '*',
+      :month       => '*',
+      :weekday     => '*',
+      :maxdelay    => 0,
+      :destination => '/var/log/keystone/keystone-tokenflush.log' }
+  end
+
   describe 'with default parameters' do
     it 'configures a cron' do
       is_expected.to contain_cron('keystone-manage token_flush').with(
-        :ensure      => 'present',
-        :command     => 'keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1',
+        :ensure      => params[:ensure],
+        :command     => "keystone-manage token_flush >>#{params[:destination]} 2>&1",
         :environment => 'PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh',
         :user        => 'keystone',
-        :minute      => 1,
-        :hour        => 0,
-        :monthday    => '*',
-        :month       => '*',
-        :weekday     => '*'
+        :minute      => params[:minute],
+        :hour        => params[:hour],
+        :monthday    => params[:monthday],
+        :month       => params[:month],
+        :weekday     => params[:weekday]
       )
     end
   end
 
   describe 'when specifying a maxdelay param' do
-    let :params do
-      {
+    before :each do
+      params.merge!(
         :maxdelay => 600
-      }
+      )
     end
 
     it 'configures a cron with delay' do
       is_expected.to contain_cron('keystone-manage token_flush').with(
-        :ensure      => 'present',
-        :command     => 'sleep `expr ${RANDOM} \\% 600`; keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1',
+        :ensure      => params[:ensure],
+        :command     => "sleep `expr ${RANDOM} \\% #{params[:maxdelay]}`; keystone-manage token_flush >>#{params[:destination]} 2>&1",
         :environment => 'PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh',
         :user        => 'keystone',
-        :minute      => 1,
-        :hour        => 0,
-        :monthday    => '*',
-        :month       => '*',
-        :weekday     => '*'
+        :minute      => params[:minute],
+        :hour        => params[:hour],
+        :monthday    => params[:monthday],
+        :month       => params[:month],
+        :weekday     => params[:weekday]
       )
     end
   end
 
-  describe 'when specifying a maxdelay param' do
-    let :params do
-      {
+  describe 'when disabling cron job' do
+    before :each do
+      params.merge!(
         :ensure => 'absent'
-      }
+      )
     end
 
     it 'configures a cron with delay' do
       is_expected.to contain_cron('keystone-manage token_flush').with(
-        :ensure      => 'absent',
-        :command     => 'keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1',
+        :ensure      => params[:ensure],
+        :command     => "keystone-manage token_flush >>#{params[:destination]} 2>&1",
         :environment => 'PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh',
         :user        => 'keystone',
-        :minute      => 1,
-        :hour        => 0,
-        :monthday    => '*',
-        :month       => '*',
-        :weekday     => '*'
+        :minute      => params[:minute],
+        :hour        => params[:hour],
+        :monthday    => params[:monthday],
+        :month       => params[:month],
+        :weekday     => params[:weekday]
       )
     end
   end
diff --git a/keystone/spec/classes/keystone_endpoint_spec.rb b/keystone/spec/classes/keystone_endpoint_spec.rb
index 217d791f9..59390ec98 100644
--- a/keystone/spec/classes/keystone_endpoint_spec.rb
+++ b/keystone/spec/classes/keystone_endpoint_spec.rb
@@ -48,4 +48,19 @@
       )
     end
   end
+
+  describe 'with domain parameters' do
+
+    let :params do
+      { :user_domain    => 'userdomain',
+        :project_domain => 'projectdomain',
+        :default_domain => 'defaultdomain' }
+    end
+
+    it { is_expected.to contain_keystone__resource__service_identity('keystone').with(
+      :user_domain    => 'userdomain',
+      :project_domain => 'projectdomain',
+      :default_domain => 'defaultdomain'
+    )}
+  end
 end
diff --git a/keystone/spec/classes/keystone_roles_admin_spec.rb b/keystone/spec/classes/keystone_roles_admin_spec.rb
index bbd6d953b..10f2a3850 100644
--- a/keystone/spec/classes/keystone_roles_admin_spec.rb
+++ b/keystone/spec/classes/keystone_roles_admin_spec.rb
@@ -54,8 +54,8 @@
     end
 
     it { is_expected.to contain_keystone_tenant('foobar').with(
-      :ensure  => 'present',
-      :enabled => true,
+      :ensure      => 'present',
+      :enabled     => true,
       :description => 'foobar description'
     )}
     it { is_expected.to contain_keystone_tenant('admin').with(
@@ -95,8 +95,8 @@
     before do
       let :params do
         {
-          :configure_user       => false,
-          :configure_user_role  => false
+          :configure_user      => false,
+          :configure_user_role => false
         }
       end
 
@@ -105,4 +105,83 @@
     end
   end
 
+  describe 'when specifying admin_user_domain and admin_project_domain' do
+    let :params do
+      {
+        :email                => 'foo@bar',
+        :password             => 'ChangeMe',
+        :admin_tenant         => 'admin_tenant',
+        :admin_user_domain    => 'admin_user_domain',
+        :admin_project_domain => 'admin_project_domain',
+      }
+    end
+    it { is_expected.to contain_keystone_user('admin').with(
+      :domain => 'admin_user_domain',
+      :tenant => 'admin_tenant'
+    )}
+    it { is_expected.to contain_keystone_tenant('admin_tenant').with(:domain => 'admin_project_domain') }
+    it { is_expected.to contain_keystone_domain('admin_user_domain') }
+    it { is_expected.to contain_keystone_domain('admin_project_domain') }
+
+  end
+
+  describe 'when specifying admin_user_domain and admin_project_domain' do
+    let :params do
+      {
+        :email                => 'foo@bar',
+        :password             => 'ChangeMe',
+        :admin_tenant         => 'admin_tenant::admin_project_domain',
+        :admin_user_domain    => 'admin_user_domain',
+        :admin_project_domain => 'admin_project_domain',
+      }
+    end
+    it { is_expected.to contain_keystone_user('admin').with(
+      :domain => 'admin_user_domain',
+      :tenant => 'admin_tenant::admin_project_domain'
+    )}
+    it { is_expected.to contain_keystone_tenant('admin_tenant::admin_project_domain').with(:domain => 'admin_project_domain') }
+    it { is_expected.to contain_keystone_domain('admin_user_domain') }
+    it { is_expected.to contain_keystone_domain('admin_project_domain') }
+
+  end
+
+  describe 'when specifying a service domain' do
+    let :params do
+      {
+        :email                  => 'foo@bar',
+        :password               => 'ChangeMe',
+        :service_tenant         => 'service_project',
+        :service_project_domain => 'service_domain'
+      }
+    end
+    it { is_expected.to contain_keystone_tenant('service_project').with(:domain => 'service_domain') }
+    it { is_expected.to contain_keystone_domain('service_domain') }
+
+  end
+
+  describe 'when specifying a service domain and service tenant domain' do
+    let :params do
+      {
+        :email                  => 'foo@bar',
+        :password               => 'ChangeMe',
+        :service_tenant         => 'service_project::service_domain',
+        :service_project_domain => 'service_domain'
+      }
+    end
+    it { is_expected.to contain_keystone_tenant('service_project::service_domain').with(:domain => 'service_domain') }
+    it { is_expected.to contain_keystone_domain('service_domain') }
+
+  end
+
+  describe 'when admin_user_domain and admin_project_domain are equal' do
+    let :params do
+      {
+        :email                => 'foo@bar',
+        :password             => 'ChangeMe',
+        :admin_user_domain    => 'admin_domain',
+        :admin_project_domain => 'admin_domain',
+      }
+    end
+   it { is_expected.to contain_keystone_domain('admin_domain') }
+   end
 end
diff --git a/keystone/spec/classes/keystone_spec.rb b/keystone/spec/classes/keystone_spec.rb
index 89c4fc55e..418f9d81f 100644
--- a/keystone/spec/classes/keystone_spec.rb
+++ b/keystone/spec/classes/keystone_spec.rb
@@ -20,79 +20,84 @@
   end
 
   default_params = {
-      'admin_token'           => 'service_token',
-      'package_ensure'        => 'present',
-      'client_package_ensure' => 'present',
-      'public_bind_host'      => '0.0.0.0',
-      'admin_bind_host'       => '0.0.0.0',
-      'public_port'           => '5000',
-      'admin_port'            => '35357',
-      'admin_token'           => 'service_token',
-      'verbose'               => false,
-      'debug'                 => false,
-      'catalog_type'          => 'sql',
-      'catalog_driver'        => false,
-      'token_provider'        => 'keystone.token.providers.uuid.Provider',
-      'token_driver'          => 'keystone.token.persistence.backends.sql.Token',
-      'revoke_driver'         => 'keystone.contrib.revoke.backends.sql.Revoke',
-      'cache_dir'             => '/var/cache/keystone',
-      'enable_ssl'            => false,
-      'ssl_certfile'          => '/etc/keystone/ssl/certs/keystone.pem',
-      'ssl_keyfile'           => '/etc/keystone/ssl/private/keystonekey.pem',
-      'ssl_ca_certs'          => '/etc/keystone/ssl/certs/ca.pem',
-      'ssl_ca_key'            => '/etc/keystone/ssl/private/cakey.pem',
-      'ssl_cert_subject'      => '/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost',
-      'enabled'               => true,
-      'manage_service'        => true,
-      'database_connection'   => 'sqlite:////var/lib/keystone/keystone.db',
-      'database_idle_timeout' => '200',
-      'enable_pki_setup'      => true,
-      'signing_certfile'      => '/etc/keystone/ssl/certs/signing_cert.pem',
-      'signing_keyfile'       => '/etc/keystone/ssl/private/signing_key.pem',
-      'signing_ca_certs'      => '/etc/keystone/ssl/certs/ca.pem',
-      'signing_ca_key'        => '/etc/keystone/ssl/private/cakey.pem',
-      'rabbit_host'           => 'localhost',
-      'rabbit_password'       => 'guest',
-      'rabbit_userid'         => 'guest',
-      'admin_workers'         => 20,
-      'public_workers'        => 20,
-      'sync_db'               => true,
+      'admin_token'                         => 'service_token',
+      'package_ensure'                      => 'present',
+      'client_package_ensure'               => 'present',
+      'public_bind_host'                    => '0.0.0.0',
+      'admin_bind_host'                     => '0.0.0.0',
+      'public_port'                         => '5000',
+      'admin_port'                          => '35357',
+      'admin_token'                         => 'service_token',
+      'verbose'                             => false,
+      'debug'                               => false,
+      'catalog_type'                        => 'sql',
+      'catalog_driver'                      => false,
+      'token_provider'                      => 'keystone.token.providers.uuid.Provider',
+      'token_driver'                        => 'keystone.token.persistence.backends.sql.Token',
+      'revoke_driver'                       => 'keystone.contrib.revoke.backends.sql.Revoke',
+      'cache_dir'                           => '/var/cache/keystone',
+      'enable_ssl'                          => false,
+      'ssl_certfile'                        => '/etc/keystone/ssl/certs/keystone.pem',
+      'ssl_keyfile'                         => '/etc/keystone/ssl/private/keystonekey.pem',
+      'ssl_ca_certs'                        => '/etc/keystone/ssl/certs/ca.pem',
+      'ssl_ca_key'                          => '/etc/keystone/ssl/private/cakey.pem',
+      'ssl_cert_subject'                    => '/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost',
+      'enabled'                             => true,
+      'manage_service'                      => true,
+      'database_connection'                 => 'sqlite:////var/lib/keystone/keystone.db',
+      'database_idle_timeout'               => '200',
+      'enable_pki_setup'                    => true,
+      'signing_certfile'                    => '/etc/keystone/ssl/certs/signing_cert.pem',
+      'signing_keyfile'                     => '/etc/keystone/ssl/private/signing_key.pem',
+      'signing_ca_certs'                    => '/etc/keystone/ssl/certs/ca.pem',
+      'signing_ca_key'                      => '/etc/keystone/ssl/private/cakey.pem',
+      'rabbit_host'                         => 'localhost',
+      'rabbit_password'                     => 'guest',
+      'rabbit_userid'                       => 'guest',
+      'rabbit_heartbeat_timeout_threshold'  => 0,
+      'rabbit_heartbeat_rate'               => 2,
+      'admin_workers'                       => 20,
+      'public_workers'                      => 20,
+      'sync_db'                             => true,
     }
 
   override_params = {
-      'package_ensure'        => 'latest',
-      'client_package_ensure' => 'latest',
-      'public_bind_host'      => '0.0.0.0',
-      'admin_bind_host'       => '0.0.0.0',
-      'public_port'           => '5001',
-      'admin_port'            => '35358',
-      'admin_token'           => 'service_token_override',
-      'verbose'               => true,
-      'debug'                 => true,
-      'catalog_type'          => 'template',
-      'token_provider'        => 'keystone.token.providers.uuid.Provider',
-      'token_driver'          => 'keystone.token.backends.kvs.Token',
-      'revoke_driver'         => 'keystone.contrib.revoke.backends.kvs.Revoke',
-      'public_endpoint'       => 'https://localhost:5000/v2.0/',
-      'admin_endpoint'        => 'https://localhost:35357/v2.0/',
-      'enable_ssl'            => true,
-      'ssl_certfile'          => '/etc/keystone/ssl/certs/keystone.pem',
-      'ssl_keyfile'           => '/etc/keystone/ssl/private/keystonekey.pem',
-      'ssl_ca_certs'          => '/etc/keystone/ssl/certs/ca.pem',
-      'ssl_ca_key'            => '/etc/keystone/ssl/private/cakey.pem',
-      'ssl_cert_subject'      => '/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost',
-      'enabled'               => false,
-      'manage_service'        => true,
-      'database_connection'   => 'mysql://a:b@c/d',
-      'database_idle_timeout' => '300',
-      'enable_pki_setup'      => true,
-      'signing_certfile'      => '/etc/keystone/ssl/certs/signing_cert.pem',
-      'signing_keyfile'       => '/etc/keystone/ssl/private/signing_key.pem',
-      'signing_ca_certs'      => '/etc/keystone/ssl/certs/ca.pem',
-      'signing_ca_key'        => '/etc/keystone/ssl/private/cakey.pem',
-      'rabbit_host'           => '127.0.0.1',
-      'rabbit_password'       => 'openstack',
-      'rabbit_userid'         => 'admin',
+      'package_ensure'                      => 'latest',
+      'client_package_ensure'               => 'latest',
+      'public_bind_host'                    => '0.0.0.0',
+      'admin_bind_host'                     => '0.0.0.0',
+      'public_port'                         => '5001',
+      'admin_port'                          => '35358',
+      'admin_token'                         => 'service_token_override',
+      'verbose'                             => true,
+      'debug'                               => true,
+      'catalog_type'                        => 'template',
+      'token_provider'                      => 'keystone.token.providers.uuid.Provider',
+      'token_driver'                        => 'keystone.token.backends.kvs.Token',
+      'revoke_driver'                       => 'keystone.contrib.revoke.backends.kvs.Revoke',
+      'public_endpoint'                     => 'https://localhost:5000/v2.0/',
+      'admin_endpoint'                      => 'https://localhost:35357/v2.0/',
+      'enable_ssl'                          => true,
+      'ssl_certfile'                        => '/etc/keystone/ssl/certs/keystone.pem',
+      'ssl_keyfile'                         => '/etc/keystone/ssl/private/keystonekey.pem',
+      'ssl_ca_certs'                        => '/etc/keystone/ssl/certs/ca.pem',
+      'ssl_ca_key'                          => '/etc/keystone/ssl/private/cakey.pem',
+      'ssl_cert_subject'                    => '/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost',
+      'enabled'                             => false,
+      'manage_service'                      => true,
+      'database_connection'                 => 'mysql://a:b@c/d',
+      'database_idle_timeout'               => '300',
+      'enable_pki_setup'                    => true,
+      'signing_certfile'                    => '/etc/keystone/ssl/certs/signing_cert.pem',
+      'signing_keyfile'                     => '/etc/keystone/ssl/private/signing_key.pem',
+      'signing_ca_certs'                    => '/etc/keystone/ssl/certs/ca.pem',
+      'signing_ca_key'                      => '/etc/keystone/ssl/private/cakey.pem',
+      'rabbit_host'                         => '127.0.0.1',
+      'rabbit_password'                     => 'openstack',
+      'rabbit_userid'                       => 'admin',
+      'rabbit_heartbeat_timeout_threshold'  => '60',
+      'rabbit_heartbeat_rate'               => '10',
+      'default_domain'                      => 'other_domain',
     }
 
   httpd_params = {'service_name' => 'httpd'}.merge(default_params)
@@ -175,7 +180,7 @@
     end
 
     it 'should contain correct revoke driver' do
-      should contain_keystone_config('revoke/driver').with_value(param_hash['revoke_driver'])
+      is_expected.to contain_keystone_config('revoke/driver').with_value(param_hash['revoke_driver'])
     end
 
     it 'should ensure proper setting of admin_endpoint and public_endpoint' do
@@ -192,7 +197,12 @@
     end
 
     it 'should contain correct rabbit_password' do
-      is_expected.to contain_keystone_config('DEFAULT/rabbit_password').with_value(param_hash['rabbit_password']).with_secret(true)
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/rabbit_password').with_value(param_hash['rabbit_password']).with_secret(true)
+    end
+
+    it 'should contain correct rabbit heartbeat configuration' do
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value(param_hash['rabbit_heartbeat_timeout_threshold'])
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/heartbeat_rate').with_value(param_hash['rabbit_heartbeat_rate'])
     end
 
     it 'should remove max_token_size param by default' do
@@ -211,6 +221,11 @@
         is_expected.to contain_keystone_config('DEFAULT/public_workers').with_value('2')
       end
     end
+
+    if param_hash['default_domain']
+      it { is_expected.to contain_keystone_domain(param_hash['default_domain']).with(:is_default => true) }
+      it { is_expected.to contain_anchor('default_domain_created') }
+    end
   end
 
   [default_params, override_params].each do |param_hash|
@@ -229,6 +244,8 @@
         'hasrestart' => true
       ) }
 
+      it { is_expected.to contain_anchor('keystone_started') }
+
     end
   end
 
@@ -245,11 +262,11 @@
 
     it do
       expect {
-        should contain_service(platform_parameters[:service_name]).with('ensure' => 'running')
+        is_expected.to contain_service(platform_parameters[:service_name]).with('ensure' => 'running')
       }.to raise_error(RSpec::Expectations::ExpectationNotMetError, /expected that the catalogue would contain Service\[#{platform_parameters[:service_name]}\]/)
     end
 
-    it { should contain_class('keystone::service').with(
+    it { is_expected.to contain_class('keystone::service').with(
       'ensure'          => 'stopped',
       'service_name'    => platform_parameters[:service_name],
       'enable'          => false,
@@ -276,6 +293,7 @@
       'hasstatus'  => true,
       'hasrestart' => true
     ) }
+    it { is_expected.to contain_anchor('keystone_started') }
   end
 
   describe 'when configuring signing token provider' do
@@ -629,11 +647,11 @@
     end
 
     it do
-      is_expected.to contain_keystone_config('DEFAULT/rabbit_use_ssl').with_value('true')
-      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_ca_certs').with_value('/path/to/ssl/ca/certs')
-      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_certfile').with_value('/path/to/ssl/cert/file')
-      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_keyfile').with_value('/path/to/ssl/keyfile')
-      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_version').with_value('TLSv1')
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/rabbit_use_ssl').with_value('true')
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/kombu_ssl_ca_certs').with_value('/path/to/ssl/ca/certs')
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/kombu_ssl_certfile').with_value('/path/to/ssl/cert/file')
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/kombu_ssl_keyfile').with_value('/path/to/ssl/keyfile')
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/kombu_ssl_version').with_value('TLSv1')
     end
   end
 
@@ -649,11 +667,11 @@
     end
 
     it do
-      is_expected.to contain_keystone_config('DEFAULT/rabbit_use_ssl').with_value('false')
-      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_ca_certs').with_ensure('absent')
-      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_certfile').with_ensure('absent')
-      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_keyfile').with_ensure('absent')
-      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_version').with_ensure('absent')
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/rabbit_use_ssl').with_value('false')
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/kombu_ssl_ca_certs').with_ensure('absent')
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/kombu_ssl_certfile').with_ensure('absent')
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/kombu_ssl_keyfile').with_ensure('absent')
+      is_expected.to contain_keystone_config('oslo_messaging_rabbit/kombu_ssl_version').with_ensure('absent')
     end
   end
 
@@ -845,6 +863,51 @@
     end
   end
 
+  shared_examples_for "when configuring default domain" do
+    describe 'with default config' do
+      let :params do
+        default_params
+      end
+      it { is_expected.to_not contain_exec('restart_keystone') }
+    end
+    describe 'with default domain and eventlet service is managed and enabled' do
+      let :params do
+        default_params.merge({
+          'default_domain'=> 'test',
+        })
+      end
+      it { is_expected.to contain_exec('restart_keystone').with(
+        'command' => "service #{platform_parameters[:service_name]} restart",
+      ) }
+      it { is_expected.to contain_anchor('default_domain_created') }
+    end
+    describe 'with default domain and wsgi service is managed and enabled' do
+      let :pre_condition do
+        'include ::apache'
+      end
+      let :params do
+        default_params.merge({
+          'default_domain'=> 'test',
+          'service_name'  => 'httpd',
+        })
+      end
+      it { is_expected.to contain_exec('restart_keystone').with(
+        'command' => "service #{platform_parameters[:httpd_service_name]} restart",
+      ) }
+      it { is_expected.to contain_anchor('default_domain_created') }
+    end
+    describe 'with default domain and service is not managed' do
+      let :params do
+        default_params.merge({
+          'default_domain' => 'test',
+          'manage_service' => false,
+        })
+      end
+      it { is_expected.to_not contain_exec('restart_keystone') }
+      it { is_expected.to contain_anchor('default_domain_created') }
+    end
+  end
+
   context 'on RedHat platforms' do
     let :facts do
       global_facts.merge({
@@ -855,11 +918,13 @@
 
     let :platform_parameters do
       {
-        :service_name => 'openstack-keystone'
+        :service_name       => 'openstack-keystone',
+        :httpd_service_name => 'httpd',
       }
     end
 
     it_configures 'when using default class parameters for httpd'
+    it_configures 'when configuring default domain'
   end
 
   context 'on Debian platforms' do
@@ -873,10 +938,12 @@
 
     let :platform_parameters do
       {
-        :service_name => 'keystone'
+        :service_name       => 'keystone',
+        :httpd_service_name => 'apache2',
       }
     end
 
     it_configures 'when using default class parameters for httpd'
+    it_configures 'when configuring default domain'
   end
 end
diff --git a/keystone/spec/defines/keystone_resource_authtoken_spec.rb b/keystone/spec/defines/keystone_resource_authtoken_spec.rb
new file mode 100644
index 000000000..06894070b
--- /dev/null
+++ b/keystone/spec/defines/keystone_resource_authtoken_spec.rb
@@ -0,0 +1,198 @@
+require 'spec_helper'
+
+describe 'keystone::resource::authtoken' do
+
+  let (:title) { 'keystone_config' }
+
+  let :required_params do
+    { :username     => 'keystone',
+      :password     => 'secret',
+      :auth_url     => 'http://127.0.0.1:35357/',
+      :project_name => 'services' }
+  end
+
+  shared_examples 'shared examples' do
+
+    context 'with only required parameters' do
+      let :params do
+        required_params
+      end
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/username').with(
+        :value  => 'keystone',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/user_id').with(
+        :ensure => 'absent',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/password').with(
+        :value  => 'secret',
+        :secret => true,
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/auth_plugin').with(
+        :value  => 'password',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/auth_url').with(
+        :value  => 'http://127.0.0.1:35357/',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/project_name').with(
+        :value  => 'services',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/project_id').with(
+        :ensure => 'absent',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/user_domain_name').with(
+        :ensure => 'absent',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/project_domain_name').with(
+        :ensure => 'absent',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/user_domain_id').with(
+        :ensure => 'absent',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/project_domain_id').with(
+        :ensure => 'absent',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/domain_name').with(
+        :ensure => 'absent',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/domain_id').with(
+        :ensure => 'absent',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/trust_id').with(
+        :ensure => 'absent',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/cacert').with(
+        :ensure => 'absent',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/cert').with(
+        :ensure => 'absent',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/key').with(
+        :ensure => 'absent',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/insecure').with(
+        :value => 'false',
+      )}
+
+    end
+
+    context 'when omitting a required parameter password' do
+      let :params do
+        required_params.delete(:password)
+      end
+      it { expect { is_expected.to raise_error(Puppet::Error) } }
+    end
+
+    context 'when specifying auth_url' do
+      let :params do
+        required_params.merge({:auth_url => 'https://host:11111/v3/'})
+      end
+      it { is_expected.to contain_keystone_config('keystone_authtoken/auth_url').with(
+        :value  => 'https://host:11111/v3/',
+      )}
+
+    end
+
+    context 'when specifying project and scope_domain' do
+      let :params do
+        required_params.merge({:domain_name => 'domain'})
+      end
+      it { expect { is_expected.to raise_error(Puppet::Error, 'Cannot specify both a project (project_name or project_id) and a domain (domain_name or domain_id)') } }
+    end
+
+    context 'when specifying neither project nor domain' do
+      let :params do
+        required_params.delete(:project_name)
+      end
+      it { expect { is_expected.to raise_error(Puppet::Error, 'Must specify either a project (project_name or project_id, for a project scoped token) or a domain (domain_name or domain_id, for a domain scoped token)') } }
+    end
+
+    context 'when specifying domain in name' do
+      let :params do
+        required_params.merge({
+          :username            => 'keystone::userdomain',
+          :project_name        => 'services::projdomain',
+          :default_domain_name => 'shouldnotuse'
+        })
+      end
+      it { is_expected.to contain_keystone_config('keystone_authtoken/user_domain_name').with(
+        :value => 'userdomain',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/project_domain_name').with(
+        :value => 'projdomain',
+      )}
+
+    end
+
+    context 'when specifying domain in parameters' do
+      let :params do
+        required_params.merge({
+          :username            => 'keystone::userdomain',
+          :user_domain_name    => 'realuserdomain',
+          :project_name        => 'services::projdomain',
+          :project_domain_name => 'realprojectdomain',
+          :default_domain_name => 'shouldnotuse'
+        })
+      end
+      it { is_expected.to contain_keystone_config('keystone_authtoken/user_domain_name').with(
+        :value => 'realuserdomain',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/project_domain_name').with(
+        :value => 'realprojectdomain',
+      )}
+
+    end
+
+    context 'when specifying only default domain' do
+      let :params do
+        required_params.merge({
+          :default_domain_name => 'defaultdomain'
+        })
+      end
+      it { is_expected.to contain_keystone_config('keystone_authtoken/user_domain_name').with(
+        :value => 'defaultdomain',
+      )}
+
+      it { is_expected.to contain_keystone_config('keystone_authtoken/project_domain_name').with(
+        :value => 'defaultdomain',
+      )}
+
+    end
+
+  end
+
+  context 'on a Debian osfamily' do
+    let :facts do
+      { :osfamily => "Debian" }
+    end
+
+    include_examples 'shared examples'
+  end
+
+  context 'on a RedHat osfamily' do
+    let :facts do
+      { :osfamily => 'RedHat' }
+    end
+
+    include_examples 'shared examples'
+  end
+end
diff --git a/keystone/spec/defines/keystone_resource_service_identity_spec.rb b/keystone/spec/defines/keystone_resource_service_identity_spec.rb
index 18979635e..63ef98ad9 100644
--- a/keystone/spec/defines/keystone_resource_service_identity_spec.rb
+++ b/keystone/spec/defines/keystone_resource_service_identity_spec.rb
@@ -69,6 +69,69 @@
       it { expect { is_expected.to raise_error(Puppet::Error) } }
     end
 
+    context 'with user domain' do
+      let :params do
+        required_params.merge({:user_domain => 'userdomain'})
+      end
+      it { is_expected.to contain_keystone_domain('userdomain').with(
+        :ensure   => 'present',
+      )}
+      it { is_expected.to contain_keystone_user(title).with(
+        :ensure   => 'present',
+        :password => 'secrete',
+        :email    => 'neutron@localhost',
+        :tenant   => 'services',
+        :domain   => 'userdomain',
+      )}
+      it { is_expected.to contain_keystone_user_role("#{title}@services").with(
+        :ensure => 'present',
+        :roles  => ['admin'],
+      )}
+    end
+    context 'with user and project domain' do
+      let :params do
+        required_params.merge({
+          :user_domain => 'userdomain',
+          :project_domain => 'projdomain',
+        })
+      end
+      it { is_expected.to contain_keystone_user(title).with(
+        :ensure   => 'present',
+        :password => 'secrete',
+        :email    => 'neutron@localhost',
+        :tenant   => 'services',
+        :domain   => 'userdomain',
+      )}
+      it { is_expected.to contain_keystone_domain('userdomain').with(
+        :ensure   => 'present',
+      )}
+      it { is_expected.to contain_keystone_user_role("#{title}@services").with(
+        :ensure => 'present',
+        :roles  => ['admin'],
+      )}
+    end
+    context 'with default domain only' do
+      let :params do
+        required_params.merge({
+          :default_domain => 'defaultdomain',
+        })
+      end
+      it { is_expected.to contain_keystone_user(title).with(
+        :ensure   => 'present',
+        :password => 'secrete',
+        :email    => 'neutron@localhost',
+        :tenant   => 'services',
+        :domain   => 'defaultdomain',
+      )}
+      it { is_expected.to contain_keystone_domain('defaultdomain').with(
+        :ensure   => 'present',
+      )}
+      it { is_expected.to contain_keystone_user_role("#{title}@services").with(
+        :ensure => 'present',
+        :roles  => ['admin'],
+      )}
+    end
+
   end
 
   context 'on a Debian osfamily' do
diff --git a/keystone/spec/spec_helper.rb b/keystone/spec/spec_helper.rb
index 78594f8ae..fb2fcd0c0 100644
--- a/keystone/spec/spec_helper.rb
+++ b/keystone/spec/spec_helper.rb
@@ -7,3 +7,16 @@
   c.alias_it_should_behave_like_to :it_configures, 'configures'
   c.alias_it_should_behave_like_to :it_raises, 'raises'
 end
+
+def setup_provider_tests
+  Puppet::Provider::Keystone.class_exec do
+    def self.reset
+      @admin_endpoint = nil
+      @tenant_hash    = nil
+      @admin_token    = nil
+      @keystone_file  = nil
+      Puppet::Provider::Keystone.default_domain_id = nil
+      @domain_hash = nil
+    end
+  end
+end
diff --git a/keystone/spec/spec_helper_acceptance.rb b/keystone/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/keystone/spec/spec_helper_acceptance.rb
+++ b/keystone/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/keystone/spec/unit/provider/keystone_domain/openstack_spec.rb b/keystone/spec/unit/provider/keystone_domain/openstack_spec.rb
index 497f09bae..c57373202 100644
--- a/keystone/spec/unit/provider/keystone_domain/openstack_spec.rb
+++ b/keystone/spec/unit/provider/keystone_domain/openstack_spec.rb
@@ -2,26 +2,12 @@
 require 'spec_helper'
 require 'puppet/provider/keystone_domain/openstack'
 
-provider_class = Puppet::Type.type(:keystone_domain).provider(:openstack)
+setup_provider_tests
 
-class Puppet::Provider::Keystone
-  def self.reset
-    @admin_endpoint = nil
-    @tenant_hash    = nil
-    @admin_token    = nil
-    @keystone_file  = nil
-    @domain_id_to_name = nil
-    @default_domain_id = nil
-    @domain_hash = nil
-  end
-end
+provider_class = Puppet::Type.type(:keystone_domain).provider(:openstack)
 
 describe provider_class do
 
-  after :each do
-    provider_class.reset
-  end
-
   shared_examples 'authenticated with environment variables' do
     ENV['OS_USERNAME']     = 'test'
     ENV['OS_PASSWORD']     = 'abc123'
@@ -48,6 +34,18 @@ def self.reset
       provider_class.new(resource)
     end
 
+    let(:another_class) do
+      class AnotherKlass < Puppet::Provider::Keystone
+        @credentials = Puppet::Provider::Openstack::CredentialsV3.new
+      end
+      AnotherKlass
+    end
+
+    after :each do
+      provider_class.reset
+      another_class.reset
+    end
+
     it_behaves_like 'authenticated with environment variables' do
       describe '#create' do
         it 'creates a domain' do
@@ -115,12 +113,12 @@ def self.reset
         end
 
         it 'creates a default domain' do
-          File.expects(:exists?).returns(true)
+          File.expects(:exists?).twice.returns(true)
           mock = {
             'identity' => {'default_domain_id' => ' default'}
           }
-          Puppet::Util::IniConfig::File.expects(:new).returns(mock)
-          mock.expects(:read).with('/etc/keystone/keystone.conf')
+          Puppet::Util::IniConfig::File.expects(:new).twice.returns(mock)
+          mock.expects(:read).twice.with('/etc/keystone/keystone.conf')
           mock.expects(:store)
           provider.class.expects(:openstack)
                         .with('domain', 'create', '--format', 'shell', ['foo', '--enable', '--description', 'foo'])
@@ -129,9 +127,13 @@ def self.reset
 description="foo"
 enabled=True
 ')
+          expect(provider.class.default_domain_id).to eq('default')
+          expect(another_class.default_domain_id).to eq('default')
           provider.create
           expect(provider.exists?).to be_truthy
           expect(mock['identity']['default_domain_id']).to eq('1cb05cfed7c24279be884ba4f6520262')
+          expect(provider.class.default_domain_id).to eq('1cb05cfed7c24279be884ba4f6520262')
+          expect(another_class.default_domain_id).to eq('1cb05cfed7c24279be884ba4f6520262')
         end
       end
 
@@ -154,6 +156,8 @@ def self.reset
           provider.destroy
           expect(provider.exists?).to be_falsey
           expect(kcmock['identity']['default_domain_id']).to eq('default')
+          expect(provider.class.default_domain_id).to eq('default')
+          expect(another_class.default_domain_id).to eq('default')
         end
       end
 
diff --git a/keystone/spec/unit/provider/keystone_paste_ini/ini_setting_spec.rb b/keystone/spec/unit/provider/keystone_paste_ini/ini_setting_spec.rb
index 2eff5d63f..56379487f 100644
--- a/keystone/spec/unit/provider/keystone_paste_ini/ini_setting_spec.rb
+++ b/keystone/spec/unit/provider/keystone_paste_ini/ini_setting_spec.rb
@@ -23,7 +23,7 @@
       {:name => 'dude/foo', :value => 'bar'}
     )
     provider = provider_class.new(resource)
-    provider.section.should == 'dude'
-    provider.setting.should == 'foo'
+    expect(provider.section).to eq('dude')
+    expect(provider.setting).to eq('foo')
   end
 end
diff --git a/keystone/spec/unit/provider/keystone_spec.rb b/keystone/spec/unit/provider/keystone_spec.rb
index 44d265f52..e1035540f 100644
--- a/keystone/spec/unit/provider/keystone_spec.rb
+++ b/keystone/spec/unit/provider/keystone_spec.rb
@@ -3,122 +3,200 @@
 require 'puppet/provider/keystone'
 require 'tempfile'
 
+setup_provider_tests
+
 klass = Puppet::Provider::Keystone
 
 class Puppet::Provider::Keystone
   @credentials = Puppet::Provider::Openstack::CredentialsV3.new
-
-  def self.reset
-    @admin_endpoint = nil
-    @tenant_hash    = nil
-    @admin_token    = nil
-    @keystone_file  = nil
-    @domain_id_to_name = nil
-    @default_domain_id = nil
-    @domain_hash = nil
-  end
 end
 
 describe Puppet::Provider::Keystone do
 
+  let(:another_class) do
+    class AnotherKlass < Puppet::Provider::Keystone
+      @credentials = Puppet::Provider::Openstack::CredentialsV3.new
+    end
+    AnotherKlass
+  end
+
   after :each do
     klass.reset
+    another_class.reset
   end
 
-  describe 'when retrieving the security token' do
-    it 'should return nothing if there is no keystone config file' do
+  describe '#ssl?' do
+    it 'should be false if there is no keystone file' do
       File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(false)
-      expect(klass.get_admin_token).to be_nil
+      expect(klass.ssl?).to be_falsey
     end
 
-    it 'should return nothing if the keystone config file does not have a DEFAULT section' do
+    it 'should be false if ssl is not configured in keystone file' do
       mock = {}
       File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
       Puppet::Util::IniConfig::File.expects(:new).returns(mock)
       mock.expects(:read).with('/etc/keystone/keystone.conf')
-      expect(klass.get_admin_token).to be_nil
+      expect(klass.ssl?).to be_falsey
     end
 
-    it 'should fail if the keystone config file does not contain an admin token' do
-      mock = {'DEFAULT' => {'not_a_token' => 'foo'}}
+    it 'should be false if ssl is configured and disable in keystone file' do
+      mock = {'ssl' => {'enable' => 'False'}}
       File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
       Puppet::Util::IniConfig::File.expects(:new).returns(mock)
       mock.expects(:read).with('/etc/keystone/keystone.conf')
-      expect(klass.get_admin_token).to be_nil
+      expect(klass.ssl?).to be_falsey
     end
 
-    it 'should parse the admin token if it is in the config file' do
-      mock = {'DEFAULT' => {'admin_token' => 'foo'}}
+    it 'should be true if ssl is configured and enabled in keystone file' do
+      mock = {'ssl' => {'enable' => 'True'}}
       File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
       Puppet::Util::IniConfig::File.expects(:new).returns(mock)
       mock.expects(:read).with('/etc/keystone/keystone.conf')
-      expect(klass.get_admin_token).to eq('foo')
+      expect(klass.ssl?).to be_truthy
+    end
+  end
+
+  describe '#get_admin_endpoint' do
+    it 'should return nothing if there is no keystone config file' do
+      expect(klass.get_admin_endpoint).to be_nil
+    end
+
+    it 'should use the admin_endpoint from keystone config file with no trailing slash' do
+      mock = {'DEFAULT' => {'admin_endpoint' => 'https://keystone.example.com/'}}
+      File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
+      Puppet::Util::IniConfig::File.expects(:new).returns(mock)
+      mock.expects(:read).with('/etc/keystone/keystone.conf')
+      expect(klass.get_admin_endpoint).to eq('https://keystone.example.com')
     end
 
     it 'should use the specified bind_host in the admin endpoint' do
-      mock = {'DEFAULT' => {'admin_bind_host' => '192.168.56.210', 'admin_port' => '35357' }}
+      mock = {'DEFAULT' => {'admin_bind_host' => '192.168.56.210', 'admin_port' => '5001' }}
       File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
       Puppet::Util::IniConfig::File.expects(:new).returns(mock)
       mock.expects(:read).with('/etc/keystone/keystone.conf')
-      expect(klass.get_admin_endpoint).to eq('http://192.168.56.210:35357/v3/')
+      expect(klass.get_admin_endpoint).to eq('http://192.168.56.210:5001')
     end
 
     it 'should use localhost in the admin endpoint if bind_host is 0.0.0.0' do
-      mock = {'DEFAULT' => { 'admin_bind_host' => '0.0.0.0', 'admin_port' => '35357' }}
+      mock = {'DEFAULT' => { 'admin_bind_host' => '0.0.0.0', 'admin_port' => '5001' }}
       File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
       Puppet::Util::IniConfig::File.expects(:new).returns(mock)
       mock.expects(:read).with('/etc/keystone/keystone.conf')
-      expect(klass.get_admin_endpoint).to eq('http://127.0.0.1:35357/v3/')
+      expect(klass.get_admin_endpoint).to eq('http://127.0.0.1:5001')
     end
 
     it 'should use [::1] in the admin endpoint if bind_host is ::0' do
-      mock = {'DEFAULT' => { 'admin_bind_host' => '::0', 'admin_port' => '35357' }}
+      mock = {'DEFAULT' => { 'admin_bind_host' => '::0', 'admin_port' => '5001' }}
       File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
       Puppet::Util::IniConfig::File.expects(:new).returns(mock)
       mock.expects(:read).with('/etc/keystone/keystone.conf')
-      expect(klass.get_admin_endpoint).to eq('http://[::1]:35357/v3/')
+      expect(klass.get_admin_endpoint).to eq('http://[::1]:5001')
     end
 
     it 'should use localhost in the admin endpoint if bind_host is unspecified' do
-      mock = {'DEFAULT' => { 'admin_port' => '35357' }}
+      mock = {'DEFAULT' => { 'admin_port' => '5001' }}
       File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
       Puppet::Util::IniConfig::File.expects(:new).returns(mock)
       mock.expects(:read).with('/etc/keystone/keystone.conf')
-      expect(klass.get_admin_endpoint).to eq('http://127.0.0.1:35357/v3/')
+      expect(klass.get_admin_endpoint).to eq('http://127.0.0.1:5001')
     end
 
     it 'should use https if ssl is enabled' do
-      mock = {'DEFAULT' => {'admin_bind_host' => '192.168.56.210', 'admin_port' => '35357' }, 'ssl' => {'enable' => 'True'}}
+      mock = {'DEFAULT' => {'admin_bind_host' => '192.168.56.210', 'admin_port' => '5001' }, 'ssl' => {'enable' => 'True'}}
       File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
       Puppet::Util::IniConfig::File.expects(:new).returns(mock)
       mock.expects(:read).with('/etc/keystone/keystone.conf')
-      expect(klass.get_admin_endpoint).to eq('https://192.168.56.210:35357/v3/')
+      expect(klass.get_admin_endpoint).to eq('https://192.168.56.210:5001')
     end
 
     it 'should use http if ssl is disabled' do
-      mock = {'DEFAULT' => {'admin_bind_host' => '192.168.56.210', 'admin_port' => '35357' }, 'ssl' => {'enable' => 'False'}}
+      mock = {'DEFAULT' => {'admin_bind_host' => '192.168.56.210', 'admin_port' => '5001' }, 'ssl' => {'enable' => 'False'}}
       File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
       Puppet::Util::IniConfig::File.expects(:new).returns(mock)
       mock.expects(:read).with('/etc/keystone/keystone.conf')
-      expect(klass.get_admin_endpoint).to eq('http://192.168.56.210:35357/v3/')
+      expect(klass.get_admin_endpoint).to eq('http://192.168.56.210:5001')
     end
+  end
 
-    it 'should use the defined admin_endpoint if available' do
-      mock = {'DEFAULT' => {'admin_endpoint' => 'https://keystone.example.com' }, 'ssl' => {'enable' => 'False'}}
+  describe '#get_auth_url' do
+    it 'should return nothing when OS_AUTH_URL is no defined in either the environment or the openrc file and there is no keystone configuration file' do
+      home = ENV['HOME']
+      ENV.clear
+      File.expects(:exists?).with("#{home}/openrc").returns(false)
+      File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(false)
+      expect(klass.get_auth_url).to be_nil
+    end
+
+    it 'should return the OS_AUTH_URL from the environment' do
+      ENV.clear
+      ENV['OS_AUTH_URL'] = 'http://127.0.0.1:5001'
+      expect(klass.get_auth_url).to eq('http://127.0.0.1:5001')
+    end
+
+    it 'should return the OS_AUTH_URL from the openrc file when there is no OS_AUTH_URL in the environment' do
+      home = ENV['HOME']
+      ENV.clear
+      mock = {'OS_AUTH_URL' => 'http://127.0.0.1:5001'}
+      klass.expects(:get_os_vars_from_rcfile).with("#{home}/openrc").returns(mock)
+      expect(klass.get_auth_url).to eq('http://127.0.0.1:5001')
+    end
+
+    it 'should use admin_endpoint when nothing else is available' do
+      ENV.clear
+      mock = 'http://127.0.0.1:5001'
+      klass.expects(:admin_endpoint).returns(mock)
+      expect(klass.get_auth_url).to eq('http://127.0.0.1:5001')
+    end
+  end
+
+  describe '#get_service_url when retrieving the security token' do
+    it 'should return nothing when OS_URL is not defined in environment' do
+      ENV.clear
+      expect(klass.get_service_url).to be_nil
+    end
+
+    it 'should return the OS_URL from the environment' do
+      ENV['OS_URL'] = 'http://127.0.0.1:5001/v3'
+      expect(klass.get_service_url).to eq('http://127.0.0.1:5001/v3')
+    end
+
+    it 'should use admin_endpoint with the API version number' do
+      ENV.clear
+      mock = 'http://127.0.0.1:5001'
+      klass.expects(:admin_endpoint).twice.returns(mock)
+      expect(klass.get_service_url).to eq('http://127.0.0.1:5001/v3')
+    end
+  end
+
+  describe 'when retrieving the security token' do
+    it 'should return nothing if there is no keystone config file' do
+      File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(false)
+      expect(klass.get_admin_token).to be_nil
+    end
+
+    it 'should return nothing if the keystone config file does not have a DEFAULT section' do
+      mock = {}
       File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
       Puppet::Util::IniConfig::File.expects(:new).returns(mock)
       mock.expects(:read).with('/etc/keystone/keystone.conf')
-      expect(klass.get_admin_endpoint).to eq('https://keystone.example.com/v3/')
+      expect(klass.get_admin_token).to be_nil
     end
 
-    it 'should handle an admin_endpoint with a trailing slash' do
-      mock = {'DEFAULT' => {'admin_endpoint' => 'https://keystone.example.com/' }, 'ssl' => {'enable' => 'False'}}
+    it 'should fail if the keystone config file does not contain an admin token' do
+      mock = {'DEFAULT' => {'not_a_token' => 'foo'}}
       File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
       Puppet::Util::IniConfig::File.expects(:new).returns(mock)
       mock.expects(:read).with('/etc/keystone/keystone.conf')
-      expect(klass.get_admin_endpoint).to eq('https://keystone.example.com/v3/')
+      expect(klass.get_admin_token).to be_nil
     end
 
+    it 'should parse the admin token if it is in the config file' do
+      mock = {'DEFAULT' => {'admin_token' => 'foo'}}
+      File.expects(:exists?).with("/etc/keystone/keystone.conf").returns(true)
+      Puppet::Util::IniConfig::File.expects(:new).returns(mock)
+      mock.expects(:read).with('/etc/keystone/keystone.conf')
+      expect(klass.get_admin_token).to eq('foo')
+    end
   end
 
   describe 'when using domains' do
@@ -153,6 +231,29 @@ def self.reset
 ')
       expect(klass.name_and_domain('foo')).to eq(['foo', 'SomeName'])
     end
+    it 'should return the default_domain_id from one class set in another class' do
+      ENV['OS_USERNAME']     = 'test'
+      ENV['OS_PASSWORD']     = 'abc123'
+      ENV['OS_PROJECT_NAME'] = 'test'
+      ENV['OS_AUTH_URL']     = 'http://127.0.0.1:35357/v3'
+      klass.expects(:openstack)
+           .with('domain', 'list', '--quiet', '--format', 'csv', [])
+           .returns('"ID","Name","Enabled","Description"
+"default","Default",True,"default domain"
+"somename","SomeName",True,"some domain"
+')
+      another_class.expects(:openstack)
+                   .with('domain', 'list', '--quiet', '--format', 'csv', [])
+                   .returns('"ID","Name","Enabled","Description"
+"default","Default",True,"default domain"
+"somename","SomeName",True,"some domain"
+')
+      expect(klass.default_domain).to eq('Default')
+      expect(another_class.default_domain).to eq('Default')
+      klass.default_domain_id = 'somename'
+      expect(klass.default_domain).to eq('SomeName')
+      expect(another_class.default_domain).to eq('SomeName')
+    end
     it 'should return Default if default_domain_id is not configured' do
       ENV['OS_USERNAME']     = 'test'
       ENV['OS_PASSWORD']     = 'abc123'
@@ -169,5 +270,54 @@ def self.reset
 ')
       expect(klass.name_and_domain('foo')).to eq(['foo', 'Default'])
     end
+    it 'should list all domains when requesting a domain name from an ID' do
+      ENV['OS_USERNAME']     = 'test'
+      ENV['OS_PASSWORD']     = 'abc123'
+      ENV['OS_PROJECT_NAME'] = 'test'
+      ENV['OS_AUTH_URL']     = 'http://127.0.0.1:35357/v3'
+      klass.expects(:openstack)
+           .with('domain', 'list', '--quiet', '--format', 'csv', [])
+           .returns('"ID","Name","Enabled","Description"
+"somename","SomeName",True,"default domain"
+')
+      expect(klass.domain_name_from_id('somename')).to eq('SomeName')
+    end
+    it 'should lookup a domain when not found in the hash' do
+      ENV['OS_USERNAME']     = 'test'
+      ENV['OS_PASSWORD']     = 'abc123'
+      ENV['OS_PROJECT_NAME'] = 'test'
+      ENV['OS_AUTH_URL']     = 'http://127.0.0.1:35357/v3'
+      klass.expects(:openstack)
+           .with('domain', 'list', '--quiet', '--format', 'csv', [])
+           .returns('"ID","Name","Enabled","Description"
+"somename","SomeName",True,"default domain"
+')
+      klass.expects(:openstack)
+           .with('domain', 'show', '--format', 'shell', 'another')
+           .returns('
+name="AnOther"
+id="another"
+')
+      expect(klass.domain_name_from_id('somename')).to eq('SomeName')
+      expect(klass.domain_name_from_id('another')).to eq('AnOther')
+    end
+    it 'should print an error when there is no such domain' do
+      ENV['OS_USERNAME']     = 'test'
+      ENV['OS_PASSWORD']     = 'abc123'
+      ENV['OS_PROJECT_NAME'] = 'test'
+      ENV['OS_AUTH_URL']     = 'http://127.0.0.1:35357/v3'
+      klass.expects(:openstack)
+           .with('domain', 'list', '--quiet', '--format', 'csv', [])
+           .returns('"ID","Name","Enabled","Description"
+"somename","SomeName",True,"default domain"
+')
+      klass.expects(:openstack)
+           .with('domain', 'show', '--format', 'shell', 'doesnotexist')
+           .returns('
+')
+      klass.expects(:err)
+           .with('Could not find domain with id [doesnotexist]')
+      expect(klass.domain_name_from_id('doesnotexist')).to eq(nil)
+    end
   end
 end
diff --git a/keystone/spec/unit/provider/keystone_tenant/openstack_spec.rb b/keystone/spec/unit/provider/keystone_tenant/openstack_spec.rb
index fd17e4250..8cfcf1b24 100644
--- a/keystone/spec/unit/provider/keystone_tenant/openstack_spec.rb
+++ b/keystone/spec/unit/provider/keystone_tenant/openstack_spec.rb
@@ -2,19 +2,9 @@
 require 'spec_helper'
 require 'puppet/provider/keystone_tenant/openstack'
 
-provider_class = Puppet::Type.type(:keystone_tenant).provider(:openstack)
+setup_provider_tests
 
-class Puppet::Provider::Keystone
-  def self.reset
-    @admin_endpoint = nil
-    @tenant_hash    = nil
-    @admin_token    = nil
-    @keystone_file  = nil
-    @domain_id_to_name = nil
-    @default_domain_id = nil
-    @domain_hash = nil
-  end
-end
+provider_class = Puppet::Type.type(:keystone_tenant).provider(:openstack)
 
 describe provider_class do
 
@@ -203,6 +193,7 @@ def before_hook(domainlist)
         provider.create
         expect(provider.exists?).to be_truthy
         expect(provider.id).to eq("project-id")
+        expect(provider.name).to eq('foo::foo_domain')
       end
     end
 
@@ -230,6 +221,7 @@ def before_hook(domainlist)
         provider.create
         expect(provider.exists?).to be_truthy
         expect(provider.id).to eq("project-id")
+        expect(provider.name).to eq('foo::bar_domain')
       end
     end
   end
diff --git a/keystone/spec/unit/provider/keystone_user/openstack_spec.rb b/keystone/spec/unit/provider/keystone_user/openstack_spec.rb
index 3f545d0cf..f3836ef1d 100644
--- a/keystone/spec/unit/provider/keystone_user/openstack_spec.rb
+++ b/keystone/spec/unit/provider/keystone_user/openstack_spec.rb
@@ -1,9 +1,16 @@
 require 'puppet'
 require 'spec_helper'
 require 'puppet/provider/keystone_user/openstack'
+require 'puppet/provider/openstack'
+
+setup_provider_tests
 
 provider_class = Puppet::Type.type(:keystone_user).provider(:openstack)
 
+def project_class
+  Puppet::Type.type(:keystone_tenant).provider(:openstack)
+end
+
 describe provider_class do
 
   shared_examples 'authenticated with environment variables' do
@@ -13,6 +20,11 @@
     ENV['OS_AUTH_URL']     = 'http://127.0.0.1:5000'
   end
 
+  after :each do
+    provider_class.reset
+    project_class.reset
+  end
+
   let(:user_attrs) do
     {
       :name         => 'foo',
@@ -21,6 +33,7 @@
       :password     => 'foo',
       :tenant       => 'foo',
       :email        => 'foo@example.com',
+      :domain       => 'foo_domain',
     }
   end
 
@@ -32,22 +45,110 @@
     provider_class.new(resource)
   end
 
+  def before_hook(delete, missing, noproject, user_cached, project_only)
+    unless noproject
+      project_class.expects(:openstack).once
+                   .with('domain', 'list', '--quiet', '--format', 'csv', [])
+                   .returns('"ID","Name","Enabled","Description"
+"default","Default",True,"default"
+"foo_domain_id","foo_domain",True,"foo domain"
+"bar_domain_id","bar_domain",True,"bar domain"
+"another_domain_id","another_domain",True,"another domain"
+"disabled_domain_id","disabled_domain",False,"disabled domain"
+')
+    end
+
+    if project_only
+      return
+    end
+
+    provider.class.expects(:openstack).once
+                  .with('domain', 'list', '--quiet', '--format', 'csv', [])
+                  .returns('"ID","Name","Enabled","Description"
+"default","Default",True,"default"
+"foo_domain_id","foo_domain",True,"foo domain"
+"bar_domain_id","bar_domain",True,"bar domain"
+"another_domain_id","another_domain",True,"another domain"
+"disabled_domain_id","disabled_domain",False,"disabled domain"
+')
+    if user_cached
+      return # using cached user, so no user list
+    end
+    if noproject
+      project = ''
+    else
+      project = 'foo'
+    end
+    # delete will call the search again and should not return the deleted user
+    foo_returns = ['"ID","Name","Project Id","Domain","Description","Email","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo",' + project + ',"foo_domain_id","foo description","foo@example.com",True
+"2cb05cfed7c24279be884ba4f6520262","foo",' + project + ',"bar_domain_id","foo description","foo@example.com",True
+"3cb05cfed7c24279be884ba4f6520262","foo",' + project + ',"another_domain_id","foo description","foo@example.com",True
+']
+    nn = 1
+    if delete
+      nn = 2
+      foo_returns << ''
+    end
+    if missing
+      foo_returns = ['']
+    end
+    provider.class.expects(:openstack).times(nn)
+                  .with('user', 'list', '--quiet', '--format', 'csv', ['--long'])
+                  .returns(*foo_returns)
+  end
+
+  before :each, :default => true do
+    before_hook(false, false, false, false, false)
+  end
+  before :each, :delete => true do
+    before_hook(true, false, false, false, false)
+  end
+  before :each, :missing => true do
+    before_hook(false, true, false, false, false)
+  end
+  before :each, :noproject => true do
+    before_hook(false, false, true, false, false)
+  end
+  before :each, :default_https => true do
+    before_hook(false, false, false, false, false)
+  end
+  before :each, :user_cached => true do
+    before_hook(false, false, false, true, false)
+  end
+  before :each, :nohooks => true do
+    # do nothing
+  end
+  before :each, :project_only => true do
+    before_hook(false, false, false, false, true)
+  end
+  before :each, :noproject_user_cached => true do
+    before_hook(false, false, true, true, false)
+  end
+
   describe 'when managing a user' do
     it_behaves_like 'authenticated with environment variables' do
-      describe '#create' do
+      describe '#create', :project_only => true do
         it 'creates a user' do
-          provider.class.stubs(:openstack)
-                        .with('user', 'list', '--quiet', '--format', 'csv', '--long')
-                        .returns('"ID","Name","Project","Email","Enabled"
-"1cb05cfed7c24279be884ba4f6520262","foo","foo","foo@example.com",True
+          project_class.expects(:openstack)
+                       .with('project', 'list', '--quiet', '--format', 'csv', '--long')
+                       .returns('"ID","Name","Domain ID","Description","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo","foo_domain_id","foo",True
+"2cb05cfed7c24279be884ba4f6520262","foo","bar_domain_id","foo",True
+')
+          provider.class.expects(:openstack)
+                        .with('role', 'show', '--format', 'shell', '_member_')
+                        .returns('
+name="_member_"
 ')
-          provider.class.stubs(:openstack)
-                        .with('user', 'create', '--format', 'shell', ['foo', '--enable', '--password', 'foo', '--project', 'foo', '--email', 'foo@example.com'])
+          provider.class.expects(:openstack)
+                        .with('role', 'add', ['_member_', '--project', '2cb05cfed7c24279be884ba4f6520262', '--user', '12b23f07d4a3448d8189521ab09610b0'])
+          provider.class.expects(:openstack)
+                        .with('user', 'create', '--format', 'shell', ['foo', '--enable', '--password', 'foo', '--email', 'foo@example.com', '--domain', 'foo_domain'])
                         .returns('email="foo@example.com"
 enabled="True"
 id="12b23f07d4a3448d8189521ab09610b0"
 name="foo"
-project_id="5e2001b2248540f191ff22627dc0c2d7"
 username="foo"
 ')
           provider.create
@@ -57,11 +158,9 @@
 
       describe '#destroy' do
         it 'destroys a user' do
-          provider.class.stubs(:openstack)
-                        .with('user', 'list', '--quiet', '--format', 'csv', '--long')
-                        .returns('"ID","Name","Project","Email","Enabled"')
-          provider.class.stubs(:openstack)
-                        .with('user', 'delete', [])
+          provider.instance_variable_get('@property_hash')[:id] = 'my-user-id'
+          provider.class.expects(:openstack)
+                        .with('user', 'delete', 'my-user-id')
           provider.destroy
           expect(provider.exists?).to be_falsey
         end
@@ -71,9 +170,6 @@
       describe '#exists' do
         context 'when user does not exist' do
           subject(:response) do
-            provider.class.stubs(:openstack)
-                          .with('user', 'list', '--quiet', '--format', 'csv', '--long')
-                          .returns('"ID","Name","Project","Email","Enabled"')
             response = provider.exists?
           end
 
@@ -81,129 +177,128 @@
         end
       end
 
-      describe '#instances' do
+      describe '#instances', :noproject => true do
         it 'finds every user' do
-          provider.class.stubs(:openstack)
-                        .with('user', 'list', '--quiet', '--format', 'csv', '--long')
-                        .returns('"ID","Name","Project","Email","Enabled"
-"1cb05cfed7c24279be884ba4f6520262","foo","foo","foo@example.com",True
-')
-          instances = Puppet::Type::Keystone_user::ProviderOpenstack.instances
-          expect(instances.count).to eq(1)
+          instances = provider.class.instances
+          expect(instances.count).to eq(3)
+          expect(instances[0].name).to eq('foo')
+          expect(instances[0].domain).to eq('another_domain')
+          expect(instances[1].name).to eq('foo::foo_domain')
+          expect(instances[2].name).to eq('foo::bar_domain')
         end
       end
 
       describe '#tenant' do
-        it 'gets the tenant with default backend' do
-          provider.class.stubs(:openstack)
-                        .with('user', 'list', '--quiet', '--format', 'csv', '--long')
-                        .returns('"ID","Name","Project","Email","Enabled"
-"1cb05cfed7c24279be884ba4f6520262","foo","foo","foo@example.com",True
+        it 'gets the tenant with default backend', :user_cached => true do
+          project_class.expects(:openstack)
+                       .with('project', 'list', '--quiet', '--format', 'csv', '--long')
+                       .returns('"ID","Name","Domain ID","Description","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo","foo_domain_id","foo",True
+"2cb05cfed7c24279be884ba4f6520262","bar","bar_domain_id","bar",True
 ')
-          provider.class.stubs(:openstack)
-                        .with('user role', 'list', '--quiet', '--format', 'csv', ['foo', '--project', 'foo'])
-                        .returns('"ID","Name","Project","User"
-"9fe2ff9ee4384b1894a90878d3e92bab","_member_","foo","foo"
+          provider.class.expects(:openstack)
+                        .with('project', 'list', '--quiet', '--format', 'csv', ['--user', '1cb05cfed7c24279be884ba4f6520262', '--long'])
+                        .returns('"ID","Name","Domain ID","Description","Enabled"
+"foo_project_id1","foo","foo_domain_id","",True
 ')
+          provider.instance_variable_get('@property_hash')[:id] = '1cb05cfed7c24279be884ba4f6520262'
           tenant = provider.tenant
           expect(tenant).to eq('foo')
         end
 
-        it 'gets the tenant with LDAP backend' do
-          provider.class.stubs(:openstack)
-                        .with('user', 'list', '--quiet', '--format', 'csv', '--long')
-                        .returns('"ID","Name","Project","Email","Enabled"
-"1cb05cfed7c24279be884ba4f6520262","foo","","foo@example.com",True
+        it 'gets the tenant with LDAP backend', :user_cached => true do
+          provider.instance_variable_get('@property_hash')[:id] = '1cb05cfed7c24279be884ba4f6520262'
+          project_class.expects(:openstack)
+                       .with('project', 'list', '--quiet', '--format', 'csv', '--long')
+                       .returns('"ID","Name","Domain ID","Description","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo","foo_domain_id","foo",True
+"2cb05cfed7c24279be884ba4f6520262","bar","bar_domain_id","bar",True
 ')
           provider.class.expects(:openstack)
-                        .with('user role', 'list', '--quiet', '--format', 'csv', ['foo', '--project', 'foo'])
-                        .returns('"ID","Name","Project","User"
-"1cb05cfed7c24279be884ba4f6520262","foo","foo","foo"
+                        .with('project', 'list', '--quiet', '--format', 'csv', ['--user', '1cb05cfed7c24279be884ba4f6520262', '--long'])
+                        .returns('"ID","Name","Domain ID","Description","Enabled"
+"foo_project_id1","foo","foo_domain_id","",True
+"bar_project_id2","bar","bar_domain_id","",True
+"foo_project_id2","foo","another_domain_id","",True
 ')
           tenant = provider.tenant
           expect(tenant).to eq('foo')
         end
       end
-
-      describe '#tenant=' do
+      describe '#tenant=', :project_only => true do
         context 'when using default backend' do
           it 'sets the tenant' do
+            provider.instance_variable_get('@property_hash')[:id] = '1cb05cfed7c24279be884ba4f6520262'
+            provider.instance_variable_get('@property_hash')[:domain] = 'foo_domain'
+            project_class.expects(:openstack)
+                         .with('project', 'list', '--quiet', '--format', 'csv', '--long')
+                         .returns('"ID","Name","Domain ID","Description","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo","foo_domain_id","foo",True
+"2cb05cfed7c24279be884ba4f6520262","bar","bar_domain_id","bar",True
+')
             provider.class.expects(:openstack)
-                          .with('user', 'set', ['foo', '--project', 'bar'])
+                          .with('role', 'show', '--format', 'shell', '_member_')
+                          .returns('name="_member_"')
             provider.class.expects(:openstack)
-                          .with('user role', 'list', '--quiet', '--format', 'csv', ['foo', '--project', 'bar'])
-                          .returns('"ID","Name","Project","User"
-"9fe2ff9ee4384b1894a90878d3e92bab","_member_","bar","foo"
-')
+                          .with('role', 'add', ['_member_', '--project', '2cb05cfed7c24279be884ba4f6520262', '--user', '1cb05cfed7c24279be884ba4f6520262'])
             provider.tenant=('bar')
           end
         end
-
         context 'when using LDAP read-write backend' do
           it 'sets the tenant when _member_ role exists' do
-            provider.class.expects(:openstack)
-                          .with('user', 'set', ['foo', '--project', 'bar'])
-            provider.class.expects(:openstack)
-                          .with('user role', 'list', '--quiet', '--format', 'csv', ['foo', '--project', 'bar'])
-                          .returns('')
-            provider.class.expects(:openstack)
-                          .with('role', 'show', '--format', 'shell', ['_member_'])
-                          .returns('id="9fe2ff9ee4384b1894a90878d3e92bab"
-name="_member_"
+            provider.instance_variable_get('@property_hash')[:id] = '1cb05cfed7c24279be884ba4f6520262'
+            provider.instance_variable_get('@property_hash')[:domain] = 'foo_domain'
+            project_class.expects(:openstack)
+                         .with('project', 'list', '--quiet', '--format', 'csv', '--long')
+                         .returns('"ID","Name","Domain ID","Description","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo","foo_domain_id","foo",True
+"2cb05cfed7c24279be884ba4f6520262","bar","bar_domain_id","bar",True
 ')
             provider.class.expects(:openstack)
-                          .with('role', 'add', ['_member_', '--project', 'bar', '--user', 'foo'])
+                          .with('role', 'show', '--format', 'shell', '_member_')
+                          .returns('name="_member_"')
+            provider.class.expects(:openstack)
+                          .with('role', 'add', ['_member_', '--project', '2cb05cfed7c24279be884ba4f6520262', '--user', '1cb05cfed7c24279be884ba4f6520262'])
             provider.tenant=('bar')
           end
           it 'sets the tenant when _member_ role does not exist' do
+            provider.instance_variable_get('@property_hash')[:id] = '1cb05cfed7c24279be884ba4f6520262'
+            provider.instance_variable_get('@property_hash')[:domain] = 'foo_domain'
+            project_class.expects(:openstack)
+                         .with('project', 'list', '--quiet', '--format', 'csv', '--long')
+                         .returns('"ID","Name","Domain ID","Description","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo","foo_domain_id","foo",True
+"2cb05cfed7c24279be884ba4f6520262","bar","bar_domain_id","bar",True
+')
             provider.class.expects(:openstack)
-                          .with('user', 'set', ['foo', '--project', 'bar'])
-            provider.class.expects(:openstack)
-                          .with('user role', 'list', '--quiet', '--format', 'csv', ['foo', '--project', 'bar'])
-                          .returns('')
-            provider.class.expects(:openstack)
-                          .with('role', 'show', '--format', 'shell', ['_member_'])
+                          .with('role', 'show', '--format', 'shell', '_member_')
                           .raises(Puppet::ExecutionFailure, 'no such role _member_')
             provider.class.expects(:openstack)
-                          .with('role', 'create', '--format', 'shell', ['_member_'])
+                          .with('role', 'create', '--format', 'shell', '_member_')
                           .returns('name="_member_"')
             provider.class.expects(:openstack)
-                          .with('role', 'add', ['_member_', '--project', 'bar', '--user', 'foo'])
-                          .returns('id="8wr2ff9ee4384b1894a90878d3e92bab"
-name="_member_"
-')
+                          .with('role', 'add', ['_member_', '--project', '2cb05cfed7c24279be884ba4f6520262', '--user', '1cb05cfed7c24279be884ba4f6520262'])
             provider.tenant=('bar')
           end
         end
-
-# This doesn't make sense, need to clarify what's happening with LDAP mock
-=begin
-        context 'when using LDAP read-only backend' do
+        context 'when using LDAP read-only backend', :nohooks => true do
           it 'sets the tenant when _member_ role exists' do
-            provider.class.expects(:openstack)
-                          .with('user', 'set', [['foo', '--project', 'bar']])
-                          .raises(Puppet::ExecutionFailure, 'You are not authorized to perform the requested action: LDAP user update')
-            provider.class.expects(:openstack)
-                           .with('user role', 'list', '--quiet', '--format', 'csv', [['foo', '--project', 'bar']])
-                           .returns('')
-            provider.class.expects(:openstack)
-                          .with('role', 'show', '--format', 'shell', [['_member_']])
-                          .returns('id="9fe2ff9ee4384b1894a90878d3e92bab"
-name="_member_"
+            provider.instance_variable_get('@property_hash')[:id] = '1cb05cfed7c24279be884ba4f6520262'
+            provider.instance_variable_get('@property_hash')[:domain] = 'foo_domain'
+            project_class.expects(:openstack)
+                         .with('project', 'list', '--quiet', '--format', 'csv', '--long')
+                         .returns('"ID","Name","Domain ID","Description","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo","foo_domain_id","foo",True
+"2cb05cfed7c24279be884ba4f6520262","bar","bar_domain_id","bar",True
 ')
             provider.class.expects(:openstack)
-                          .with('role', 'add', [['_member_', '--project', 'bar', '--user', 'foo']])
-            provider.tenant=('bar')
-          end
-
-          it 'sets the tenant and gets an unexpected exception message' do
+                          .with('role', 'show', '--format', 'shell', '_member_')
+                          .returns('name="_member_"')
             provider.class.expects(:openstack)
-                          .with('user', 'set', [['foo', '--project', 'bar']])
-                          .raises(Puppet::ExecutionFailure, 'unknown error message')
-            expect{ provider.tenant=('bar') }.to raise_error(Puppet::ExecutionFailure, /unknown error message/)
+                          .with('role', 'add', ['_member_', '--project', '2cb05cfed7c24279be884ba4f6520262', '--user', '1cb05cfed7c24279be884ba4f6520262'])
+            provider.tenant=('bar')
           end
         end
-=end
       end
     end
   end
@@ -217,6 +312,7 @@
         :password     => 'foo',
         :tenant       => 'foo',
         :email        => 'foo@example.com',
+        :domain       => 'foo_domain',
       }
     end
 
@@ -229,12 +325,25 @@
     end
 
     shared_examples 'with auth-url environment variable' do
-      ENV['OS_AUTH_URL'] = 'http://localhost:5000'
+      ENV['OS_AUTH_URL'] = 'http://127.0.0.1:5000'
     end
 
     it_behaves_like 'with auth-url environment variable' do
-      it 'checks the password' do
-        Puppet::Provider::Openstack.stubs(:openstack)
+      it 'checks the password', :noproject_user_cached => true do
+        provider.instance_variable_get('@property_hash')[:id] = '1cb05cfed7c24279be884ba4f6520262'
+        mock_creds = Puppet::Provider::Openstack::CredentialsV3.new
+        mock_creds.auth_url='http://127.0.0.1:5000'
+        mock_creds.password='foo'
+        mock_creds.username='foo'
+        mock_creds.user_id='1cb05cfed7c24279be884ba4f6520262'
+        mock_creds.project_id='project-id-1'
+        Puppet::Provider::Openstack::CredentialsV3.expects(:new).returns(mock_creds)
+        Puppet::Provider::Openstack.expects(:openstack)
+                      .with('project', 'list', '--quiet', '--format', 'csv', ['--user', '1cb05cfed7c24279be884ba4f6520262', '--long'])
+                      .returns('"ID","Name","Domain ID","Description","Enabled"
+"project-id-1","foo","foo_domain_id","foo",True
+')
+        Puppet::Provider::Openstack.expects(:openstack)
                       .with('token', 'issue', ['--format', 'value'])
                       .returns('2015-05-14T04:06:05Z
 e664a386befa4a30878dcef20e79f167
@@ -245,14 +354,48 @@
         expect(password).to eq('foo')
       end
 
-      it 'fails the password check' do
-        Puppet::Provider::Openstack.stubs(:openstack)
+      it 'fails the password check', :noproject_user_cached => true do
+        provider.instance_variable_get('@property_hash')[:id] = '1cb05cfed7c24279be884ba4f6520262'
+        Puppet::Provider::Openstack.expects(:openstack)
+                      .with('project', 'list', '--quiet', '--format', 'csv', ['--user', '1cb05cfed7c24279be884ba4f6520262', '--long'])
+                      .returns('"ID","Name","Domain ID","Description","Enabled"
+"project-id-1","foo","foo_domain_id","foo",True
+')
+        Puppet::Provider::Openstack.expects(:openstack)
                       .with('token', 'issue', ['--format', 'value'])
                       .raises(Puppet::ExecutionFailure, 'HTTP 401 invalid authentication')
         password = provider.password
         expect(password).to eq(nil)
       end
+
+      it 'checks the password with domain scoped token', :nohooks => true do
+        provider.instance_variable_get('@property_hash')[:id] = '1cb05cfed7c24279be884ba4f6520262'
+        provider.instance_variable_get('@property_hash')[:domain] = 'foo_domain'
+        mock_creds = Puppet::Provider::Openstack::CredentialsV3.new
+        mock_creds.auth_url='http://127.0.0.1:5000'
+        mock_creds.password='foo'
+        mock_creds.username='foo'
+        mock_creds.user_id='1cb05cfed7c24279be884ba4f6520262'
+        mock_creds.domain_name='foo_domain'
+        Puppet::Provider::Openstack::CredentialsV3.expects(:new).returns(mock_creds)
+        Puppet::Provider::Openstack.expects(:openstack)
+                      .with('project', 'list', '--quiet', '--format', 'csv', ['--user', '1cb05cfed7c24279be884ba4f6520262', '--long'])
+                      .returns('"ID","Name","Domain ID","Description","Enabled"
+')
+        Puppet::Provider::Openstack.expects(:openstack)
+                      .with('token', 'issue', ['--format', 'value'])
+                      .returns('2015-05-14T04:06:05Z
+e664a386befa4a30878dcef20e79f167
+8dce2ae9ecd34c199d2877bf319a3d06
+ac43ec53d5a74a0b9f51523ae41a29f0
+')
+        password = provider.password
+        expect(password).to eq('foo')
+      end
     end
+  end
+
+  describe 'when updating a user with unmanaged password', :nohooks => true do
 
     describe 'when updating a user with unmanaged password' do
 
@@ -265,13 +408,239 @@
           :replace_password => 'False',
           :tenant           => 'foo',
           :email            => 'foo@example.com',
+          :domain           => 'foo_domain',
         }
       end
 
+      let(:resource) do
+        Puppet::Type::Keystone_user.new(user_attrs)
+      end
+
+      let :provider do
+        provider_class.new(resource)
+      end
+
       it 'should not try to check password' do
         expect(provider.password).to eq('foo')
       end
     end
+  end
+
+  it_behaves_like 'authenticated with environment variables' do
+    describe 'v3 domains with no domain in resource', :user_cached => true do
+      let(:user_attrs) do
+        {
+          :name         => 'foo',
+          :ensure       => 'present',
+          :enabled      => 'True',
+          :password     => 'foo',
+          :tenant       => 'foo',
+          :email        => 'foo@example.com',
+        }
+      end
+
+      it 'adds default domain to commands' do
+        mock = {
+          'identity' => {'default_domain_id' => 'foo_domain_id'}
+        }
+        Puppet::Util::IniConfig::File.expects(:new).returns(mock)
+        File.expects(:exists?).with('/etc/keystone/keystone.conf').returns(true)
+        mock.expects(:read).with('/etc/keystone/keystone.conf')
+        provider.class.expects(:openstack)
+                     .with('project', 'list', '--quiet', '--format', 'csv', ['--user', '1cb05cfed7c24279be884ba4f6520262', '--long'])
+                     .returns('"ID","Name"
+')
+        project_class.expects(:openstack)
+                     .with('project', 'list', '--quiet', '--format', 'csv', '--long')
+                     .returns('"ID","Name","Domain ID","Description","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo","foo_domain_id","foo",True
+"2cb05cfed7c24279be884ba4f6520262","bar","bar_domain_id","bar",True
+')
+        provider.class.expects(:openstack)
+                      .with('role', 'show', '--format', 'shell', '_member_')
+                      .returns('
+name="_member_"
+')
+        provider.class.expects(:openstack)
+                      .with('role', 'add', ['_member_', '--project', '1cb05cfed7c24279be884ba4f6520262', '--user', '1cb05cfed7c24279be884ba4f6520262'])
+        provider.class.expects(:openstack)
+                      .with('user', 'create', '--format', 'shell', ['foo', '--enable', '--password', 'foo', '--email', 'foo@example.com', '--domain', 'foo_domain'])
+                    .returns('email="foo@example.com"
+enabled="True"
+id="1cb05cfed7c24279be884ba4f6520262"
+name="foo"
+username="foo"
+')
+        provider.create
+        expect(provider.exists?).to be_truthy
+        expect(provider.id).to eq("1cb05cfed7c24279be884ba4f6520262")
+      end
+    end
+
+    describe 'v3 domains with domain in resource', :project_only => true do
+      let(:user_attrs) do
+        {
+          :name         => 'foo',
+          :ensure       => 'present',
+          :enabled      => 'True',
+          :password     => 'foo',
+          :tenant       => 'foo',
+          :email        => 'foo@example.com',
+          :domain       => 'bar_domain',
+        }
+      end
+
+      it 'uses given domain in commands' do
+        project_class.expects(:openstack)
+                     .with('project', 'list', '--quiet', '--format', 'csv', '--long')
+                     .returns('"ID","Name","Domain ID","Description","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo","foo_domain_id","foo",True
+"2cb05cfed7c24279be884ba4f6520262","bar","bar_domain_id","bar",True
+')
+        provider.class.expects(:openstack)
+                      .with('role', 'show', '--format', 'shell', '_member_')
+                      .returns('
+name="_member_"
+')
+        provider.class.expects(:openstack)
+                      .with('role', 'add', ['_member_', '--project', '1cb05cfed7c24279be884ba4f6520262', '--user', '2cb05cfed7c24279be884ba4f6520262'])
+        provider.class.expects(:openstack)
+                      .with('user', 'create', '--format', 'shell', ['foo', '--enable', '--password', 'foo', '--email', 'foo@example.com', '--domain', 'bar_domain'])
+                      .returns('email="foo@example.com"
+enabled="True"
+id="2cb05cfed7c24279be884ba4f6520262"
+name="foo"
+username="foo"
+')
+        provider.create
+        expect(provider.exists?).to be_truthy
+        expect(provider.id).to eq("2cb05cfed7c24279be884ba4f6520262")
+      end
+    end
+
+    describe 'v3 domains with domain in name/title', :project_only => true do
+      let(:user_attrs) do
+        {
+          :name         => 'foo::bar_domain',
+          :ensure       => 'present',
+          :enabled      => 'True',
+          :password     => 'foo',
+          :tenant       => 'foo',
+          :email        => 'foo@example.com',
+        }
+      end
+
+      it 'uses given domain in commands' do
+        project_class.expects(:openstack)
+                     .with('project', 'list', '--quiet', '--format', 'csv', '--long')
+                     .returns('"ID","Name","Domain ID","Description","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo","foo_domain_id","foo",True
+"2cb05cfed7c24279be884ba4f6520262","bar","bar_domain_id","bar",True
+')
+        provider.class.expects(:openstack)
+                      .with('role', 'show', '--format', 'shell', '_member_')
+                      .returns('
+name="_member_"
+')
+        provider.class.expects(:openstack)
+                      .with('role', 'add', ['_member_', '--project', '1cb05cfed7c24279be884ba4f6520262', '--user', '2cb05cfed7c24279be884ba4f6520262'])
+        provider.class.expects(:openstack)
+                      .with('user', 'create', '--format', 'shell', ['foo', '--enable', '--password', 'foo', '--email', 'foo@example.com', '--domain', 'bar_domain'])
+                      .returns('email="foo@example.com"
+enabled="True"
+id="2cb05cfed7c24279be884ba4f6520262"
+name="foo"
+username="foo"
+')
+        provider.create
+        expect(provider.exists?).to be_truthy
+        expect(provider.id).to eq("2cb05cfed7c24279be884ba4f6520262")
+        expect(provider.name).to eq('foo::bar_domain')
+      end
+    end
 
+    describe 'v3 domains with domain in name/title and in resource', :project_only => true do
+      let(:user_attrs) do
+        {
+          :name         => 'foo::bar_domain',
+          :ensure       => 'present',
+          :enabled      => 'True',
+          :password     => 'foo',
+          :tenant       => 'foo',
+          :email        => 'foo@example.com',
+          :domain       => 'foo_domain',
+        }
+      end
+
+      it 'uses the resource domain in commands' do
+        project_class.expects(:openstack)
+                     .with('project', 'list', '--quiet', '--format', 'csv', '--long')
+                     .returns('"ID","Name","Domain ID","Description","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo","foo_domain_id","foo",True
+"2cb05cfed7c24279be884ba4f6520262","bar","bar_domain_id","bar",True
+')
+        provider.class.expects(:openstack)
+                      .with('role', 'show', '--format', 'shell', '_member_')
+                      .returns('
+name="_member_"
+')
+        provider.class.expects(:openstack)
+                      .with('role', 'add', ['_member_', '--project', '1cb05cfed7c24279be884ba4f6520262', '--user', '2cb05cfed7c24279be884ba4f6520262'])
+        provider.class.expects(:openstack)
+                      .with('user', 'create', '--format', 'shell', ['foo', '--enable', '--password', 'foo', '--email', 'foo@example.com', '--domain', 'foo_domain'])
+                      .returns('email="foo@example.com"
+enabled="True"
+id="2cb05cfed7c24279be884ba4f6520262"
+name="foo"
+username="foo"
+')
+        provider.create
+        expect(provider.exists?).to be_truthy
+        expect(provider.id).to eq("2cb05cfed7c24279be884ba4f6520262")
+        expect(provider.name).to eq('foo::bar_domain')
+      end
+    end
+
+    describe 'v3 domains with domain in name/title and in resource and in tenant', :project_only => true do
+      let(:user_attrs) do
+        {
+          :name         => 'foo::bar_domain',
+          :ensure       => 'present',
+          :enabled      => 'True',
+          :password     => 'foo',
+          :tenant       => 'foo::foo_domain',
+          :email        => 'foo@example.com',
+          :domain       => 'foo_domain',
+        }
+      end
+
+      it 'uses the resource domain in commands' do
+        project_class.expects(:openstack)
+                     .with('project', 'list', '--quiet', '--format', 'csv', '--long')
+                     .returns('"ID","Name","Domain ID","Description","Enabled"
+"1cb05cfed7c24279be884ba4f6520262","foo","foo_domain_id","foo",True
+"2cb05cfed7c24279be884ba4f6520262","foo","bar_domain_id","foo",True
+')
+        provider.class.expects(:openstack)
+                      .with('role', 'show', '--format', 'shell', '_member_')
+                      .returns('
+name="_member_"
+')
+        provider.class.expects(:openstack)
+                      .with('role', 'add', ['_member_', '--project', '1cb05cfed7c24279be884ba4f6520262', '--user', '2cb05cfed7c24279be884ba4f6520262'])
+        provider.class.expects(:openstack)
+                      .with('user', 'create', '--format', 'shell', ['foo', '--enable', '--password', 'foo', '--email', 'foo@example.com', '--domain', 'foo_domain'])
+                      .returns('email="foo@example.com"
+enabled="True"
+id="2cb05cfed7c24279be884ba4f6520262"
+name="foo"
+username="foo"
+')
+        provider.create
+        expect(provider.exists?).to be_truthy
+        expect(provider.id).to eq("2cb05cfed7c24279be884ba4f6520262")
+        expect(provider.name).to eq('foo::bar_domain')
+      end
+    end
   end
 end
diff --git a/keystone/spec/unit/provider/keystone_user_role/openstack_spec.rb b/keystone/spec/unit/provider/keystone_user_role/openstack_spec.rb
index 2490adc52..51c147535 100644
--- a/keystone/spec/unit/provider/keystone_user_role/openstack_spec.rb
+++ b/keystone/spec/unit/provider/keystone_user_role/openstack_spec.rb
@@ -2,10 +2,190 @@
 require 'spec_helper'
 require 'puppet/provider/keystone_user_role/openstack'
 
+setup_provider_tests
+
 provider_class = Puppet::Type.type(:keystone_user_role).provider(:openstack)
+def user_class
+  Puppet::Type.type(:keystone_user).provider(:openstack)
+end
+def project_class
+  Puppet::Type.type(:keystone_tenant).provider(:openstack)
+end
 
 describe provider_class do
 
+  after :each do
+    provider_class.reset
+  end
+
+  # assumes Enabled is the last column - no quotes
+  def list_to_csv(thelist)
+    if thelist.is_a?(String)
+      return ''
+    end
+    str=""
+    thelist.each do |rec|
+      if rec.is_a?(String)
+        return ''
+      end
+      rec.each do |xx|
+        if xx.equal?(rec.last)
+          # True/False have no quotes
+          if xx == 'True' or xx == 'False'
+            str = str + xx + "\n"
+          else
+            str = str + '"' + xx + '"' + "\n"
+          end
+        else
+          str = str + '"' + xx + '",'
+        end
+      end
+    end
+    str
+  end
+
+  def before_need_instances
+    provider.class.expects(:openstack).once
+      .with('domain', 'list', '--quiet', '--format', 'csv')
+      .returns('"ID","Name","Enabled","Description"
+"foo_domain_id","foo_domain",True,"foo domain"
+"bar_domain_id","bar_domain",True,"bar domain"
+"another_domain_id","another_domain",True,"another domain"
+"disabled_domain_id","disabled_domain",False,"disabled domain"
+')
+    project_list = [['project-id-1','foo','foo_domain_id','foo project in foo domain','True'],
+                    ['project-id-2','foo','bar_domain_id','foo project in bar domain','True'],
+                    ['project-id-3','bar','foo_domain_id','bar project in foo domain','True'],
+                    ['project-id-4','etc','another_domain_id','another project','True']]
+
+    user_list_for_project = {
+      'project-id-1' => [['user-id-1','foo@example.com','foo','foo_domain','foo user','foo@foo_domain','True'],
+                         ['user-id-2','bar@example.com','foo','foo_domain','bar user','bar@foo_domain','True']],
+      'project-id-2' => [['user-id-3','foo@bar.com','foo','bar_domain','foo user','foo@bar_domain','True'],
+                         ['user-id-4','bar@bar.com','foo','bar_domain','bar user','bar@bar_domain','True']]
+    }
+    user_list_for_project.default = ''
+
+    user_list_for_domain = {
+      'foo_domain_id' => [['user-id-1','foo@example.com','foo','foo_domain','foo user','foo@foo_domain','True'],
+                          ['user-id-2','bar@example.com','foo','foo_domain','bar user','bar@foo_domain','True']],
+      'bar_domain_id' => [['user-id-3','foo@bar.com','foo','bar_domain','foo user','foo@bar_domain','True'],
+                          ['user-id-4','bar@bar.com','foo','bar_domain','bar user','bar@bar_domain','True']]
+    }
+    user_list_for_domain.default = ''
+
+    role_list_for_project_user = {
+      'project-id-1' => {
+        'user-id-1' => [['role-id-1','foo','foo','foo'],
+                        ['role-id-2','bar','foo','foo']]
+      },
+      'project-id-2' => {
+        'user-id-3' => [['role-id-1','foo','foo','foo'],
+                        ['role-id-2','bar','foo','foo']]
+      }
+    }
+    role_list_for_project_user.default = ''
+
+    role_list_for_domain_user = {
+      'foo_domain_id' => {
+        'user-id-2' => [['role-id-1','foo','foo_domain','foo'],
+                        ['role-id-2','bar','foo_domain','foo']]
+      },
+      'bar_domain_id' => {
+        'user-id-4' => [['role-id-1','foo','bar_domain','foo'],
+                        ['role-id-2','bar','bar_domain','foo']]
+      }
+    }
+    role_list_for_project_user.default = ''
+
+    provider.class.expects(:openstack).once
+                  .with('project', 'list', '--quiet', '--format', 'csv', ['--long'])
+                  .returns('"ID","Name","Domain ID","Description","Enabled"' + "\n" + list_to_csv(project_list))
+    project_list.each do |rec|
+      csvlist = list_to_csv(user_list_for_project[rec[0]])
+      provider.class.expects(:openstack)
+                    .with('user', 'list', '--quiet', '--format', 'csv', ['--long', '--project', rec[0]])
+                    .returns('"ID","Name","Project","Domain","Description","Email","Enabled"' + "\n" + csvlist)
+      next if csvlist == ''
+      user_list_for_project[rec[0]].each do |urec|
+        csvlist = ''
+        if role_list_for_project_user.has_key?(rec[0]) and
+            role_list_for_project_user[rec[0]].has_key?(urec[0])
+          csvlist = list_to_csv(role_list_for_project_user[rec[0]][urec[0]])
+        end
+        provider.class.expects(:openstack)
+                      .with('role', 'list', '--quiet', '--format', 'csv', ['--project', rec[0], '--user', urec[0]])
+                      .returns('"ID","Name","Project","User"' + "\n" + csvlist)
+      end
+    end
+    ['foo_domain_id', 'bar_domain_id'].each do |domid|
+      csvlist = list_to_csv(user_list_for_domain[domid])
+      provider.class.expects(:openstack)
+                    .with('user', 'list', '--quiet', '--format', 'csv', ['--long', '--domain', domid])
+                    .returns('"ID","Name","Project","Domain","Description","Email","Enabled"' + "\n" + csvlist)
+      next if csvlist == ''
+      user_list_for_domain[domid].each do |urec|
+        csvlist = ''
+        if role_list_for_domain_user.has_key?(domid) and
+            role_list_for_domain_user[domid].has_key?(urec[0])
+          csvlist = list_to_csv(role_list_for_domain_user[domid][urec[0]])
+        end
+        provider.class.expects(:openstack)
+                      .with('role', 'list', '--quiet', '--format', 'csv', ['--domain', domid, '--user', urec[0]])
+                      .returns('"ID","Name","Domain","User"' + "\n" + csvlist)
+      end
+    end
+  end
+
+  def before_common(destroy, nolist=false, instances=false)
+    rolelistprojectuser = [['role-id-1','foo','foo','foo'],
+                           ['role-id-2','bar','foo','foo']]
+    csvlist = list_to_csv(rolelistprojectuser)
+    rolelistreturns = ['"ID","Name","Project","User"' + "\n" + csvlist]
+    nn = 1
+    if destroy
+      rolelistreturns = ['']
+      nn = 1
+    end
+    unless nolist
+      provider.class.expects(:openstack).times(nn)
+                    .with('role', 'list', '--quiet', '--format', 'csv', ['--project', 'project-id-1', '--user', 'user-id-1'])
+                    .returns(*rolelistreturns)
+    end
+
+    userhash = {:id => 'user-id-1', :name => 'foo@example.com'}
+    usermock = user_class.new(userhash)
+    unless instances
+      usermock.expects(:exists?).with(any_parameters).returns(true)
+      user_class.expects(:new).twice.with(any_parameters).returns(usermock)
+    end
+    user_class.expects(:instances).with(any_parameters).returns([usermock])
+
+    projecthash = {:id => 'project-id-1', :name => 'foo'}
+    projectmock = project_class.new(projecthash)
+    unless instances
+      projectmock.expects(:exists?).with(any_parameters).returns(true)
+      project_class.expects(:new).with(any_parameters).returns(projectmock)
+    end
+    project_class.expects(:instances).with(any_parameters).returns([projectmock])
+  end
+
+  before :each, :default => true do
+    before_common(false)
+  end
+
+  before :each, :destroy => true do
+    before_common(true)
+  end
+
+  before :each, :nolist => true do
+    before_common(true, true)
+  end
+
+  before :each, :instances => true do
+    before_common(true, true, true)
+  end
+
   shared_examples 'authenticated with environment variables' do
     ENV['OS_USERNAME']     = 'test'
     ENV['OS_PASSWORD']     = 'abc123'
@@ -31,59 +211,83 @@
         provider_class.new(resource)
       end
 
-      before(:each) do
-        provider.class.stubs(:openstack)
-                      .with('user', 'list', '--quiet', '--format', 'csv', ['foo', '--project', 'foo'])
-                      .returns('"ID","Name","Project","User"
-"1cb05cfed7c24279be884ba4f6520262","foo","foo","foo"
-')
-      end
-
-      describe '#create' do
+      describe '#create', :default => true do
         it 'adds all the roles to the user' do
-          provider.class.stubs(:openstack)
-                        .with('role', 'add', ['foo', '--project', 'foo', '--user', 'foo'])
-          provider.class.stubs(:openstack)
-                        .with('role', 'add', ['bar', '--project', 'foo', '--user', 'foo'])
-          provider.class.stubs(:openstack)
-                        .with('user role', 'list', '--quiet', '--format', 'csv', ['foo', '--project', 'foo'])
-                        .returns('"ID","Name","Project","User"
-"1cb05ed7c24279be884ba4f6520262","foo","foo","foo"
-"2cb05ed7c24279be884ba4f6520262","bar","foo","foo"
-')
+          provider.class.expects(:openstack)
+                        .with('role', 'add', ['foo', '--project', 'project-id-1', '--user', 'user-id-1'])
+          provider.class.expects(:openstack)
+                        .with('role', 'add', ['bar', '--project', 'project-id-1', '--user', 'user-id-1'])
           provider.create
           expect(provider.exists?).to be_truthy
         end
       end
 
-      describe '#destroy' do
+      describe '#destroy', :destroy => true do
         it 'removes all the roles from a user' do
-          provider.class.stubs(:openstack)
-                        .with('user role', 'list', '--quiet', '--format', 'csv', ['foo', '--project', 'foo'])
-                        .returns('"ID","Name","Project","User"')
-          provider.class.stubs(:openstack)
-                        .with('role', 'remove', ['foo', '--project', 'foo', '--user', 'foo'])
-          provider.class.stubs(:openstack)
-                        .with('role', 'remove', ['bar', '--project', 'foo', '--user', 'foo'])
+          provider.instance_variable_get('@property_hash')[:roles] = ['foo', 'bar']
+          provider.class.expects(:openstack)
+                        .with('role', 'remove', ['foo', '--project', 'project-id-1', '--user', 'user-id-1'])
+          provider.class.expects(:openstack)
+                        .with('role', 'remove', ['bar', '--project', 'project-id-1', '--user', 'user-id-1'])
           provider.destroy
           expect(provider.exists?).to be_falsey
         end
 
       end
 
-      describe '#exists' do
+      describe '#exists', :default => true do
         subject(:response) do
-          provider.class.stubs(:openstack)
-                        .with('user role', 'list', '--quiet', '--format', 'csv', ['foo', '--project', 'foo'])
-                        .returns('"ID","Name","Project","User"
-"1cb05ed7c24279be884ba4f6520262","foo","foo","foo"
-')
           response = provider.exists?
         end
 
         it { is_expected.to be_truthy }
 
       end
+
+      describe '#instances', :instances => true do
+        it 'finds every user role' do
+          provider.class.expects(:openstack)
+                        .with('role', 'list', '--quiet', '--format', 'csv', [])
+                        .returns('"ID","Name"
+"foo-role-id","foo"
+"bar-role-id","bar"
+')
+          provider.class.expects(:openstack)
+                        .with('role assignment', 'list', '--quiet', '--format', 'csv', [])
+                        .returns('
+"Role","User","Group","Project","Domain"
+"foo-role-id","user-id-1","","project-id-1",""
+"bar-role-id","user-id-1","","project-id-1",""
+')
+          instances = provider.class.instances
+          expect(instances.count).to eq(1)
+          expect(instances[0].name).to eq('foo@example.com@foo')
+          expect(instances[0].roles).to eq(['foo', 'bar'])
+        end
+      end
+
+      describe '#roles=', :nolist => true do
+        let(:user_role_attrs) do
+          {
+            :name         => 'foo@foo',
+            :ensure       => 'present',
+            :roles        => ['one', 'two'],
+          }
+        end
+
+        it 'applies the new roles' do
+          provider.instance_variable_get('@property_hash')[:roles] = ['foo', 'bar']
+          provider.class.expects(:openstack)
+                        .with('role', 'remove', ['foo', '--project', 'project-id-1', '--user', 'user-id-1'])
+          provider.class.expects(:openstack)
+                        .with('role', 'remove', ['bar', '--project', 'project-id-1', '--user', 'user-id-1'])
+          provider.class.expects(:openstack)
+                        .with('role', 'add', ['one', '--project', 'project-id-1', '--user', 'user-id-1'])
+          provider.class.expects(:openstack)
+                        .with('role', 'add', ['two', '--project', 'project-id-1', '--user', 'user-id-1'])
+          provider.roles=(['one', 'two'])
+        end
+      end
     end
   end
 end
diff --git a/keystone/spec/unit/type/keystone_paste_ini_spec.rb b/keystone/spec/unit/type/keystone_paste_ini_spec.rb
index 98f7157b6..2eae98a04 100644
--- a/keystone/spec/unit/type/keystone_paste_ini_spec.rb
+++ b/keystone/spec/unit/type/keystone_paste_ini_spec.rb
@@ -18,6 +18,6 @@
   end
   it 'should accept a valid value' do
     @keystone_paste_ini[:value] = 'bar'
-    @keystone_paste_ini[:value].should == 'bar'
+    expect(@keystone_paste_ini[:value]).to eq('bar')
   end
 end
diff --git a/keystone/spec/unit/type/keystone_user_spec.rb b/keystone/spec/unit/type/keystone_user_spec.rb
new file mode 100644
index 000000000..789af435f
--- /dev/null
+++ b/keystone/spec/unit/type/keystone_user_spec.rb
@@ -0,0 +1,25 @@
+require 'spec_helper'
+require 'puppet'
+require 'puppet/type/keystone_user'
+
+describe Puppet::Type.type(:keystone_user) do
+
+  before :each do
+    @project = Puppet::Type.type(:keystone_user).new(
+    :name   => 'foo',
+    :domain => 'foo-domain',
+    )
+
+    @domain = @project.parameter('domain')
+  end
+
+  it 'should not be in sync for domain changes' do
+    expect { @domain.insync?('not-the-domain') }.to raise_error(Puppet::Error, /The domain cannot be changed from/)
+    expect { @domain.insync?(nil) }.to raise_error(Puppet::Error, /The domain cannot be changed from/)
+  end
+
+  it 'should be in sync if domain is the same' do
+    expect(@domain.insync?('foo-domain')).to be true
+  end
+
+end
diff --git a/kmod/.fixtures.yml b/kmod/.fixtures.yml
new file mode 100644
index 000000000..f172a1973
--- /dev/null
+++ b/kmod/.fixtures.yml
@@ -0,0 +1,5 @@
+fixtures:
+  repositories:
+    "stdlib": "git://github.com/puppetlabs/puppetlabs-stdlib.git"
+  symlinks:
+    "kmod": "#{source_dir}"
diff --git a/kmod/.gitignore b/kmod/.gitignore
new file mode 100644
index 000000000..65839fa01
--- /dev/null
+++ b/kmod/.gitignore
@@ -0,0 +1,10 @@
+pkg/
+Gemfile.lock
+vendor/
+spec/fixtures/
+.vagrant/
+.bundle/
+coverage/
+log/
+.*.swp
+*~
diff --git a/kmod/.puppet-lint.rc b/kmod/.puppet-lint.rc
new file mode 100644
index 000000000..d8f5c59ef
--- /dev/null
+++ b/kmod/.puppet-lint.rc
@@ -0,0 +1,5 @@
+--fail-on-warnings
+--relative
+--no-80chars
+--no-documentation
+--no-class_inherits_from_params_class-check
diff --git a/kmod/.sync.yml b/kmod/.sync.yml
new file mode 100644
index 000000000..d62948585
--- /dev/null
+++ b/kmod/.sync.yml
@@ -0,0 +1,3 @@
+---
+.travis.yml:
+  forge_password: "QvaBWqv7ZaB34BzONHPxZy+1OW+eBP4dZmhDobAVFD20kOP4O4QHdCe9kS3y3JRXrNW3wuiuegNzoKb+JvqQrZPQF3Ea0DO4uCPVrnVbrnmGC0p7v2VDA1tsb2snnSMa5mC6+3wYMwS27zRSQ7vN3AwDKMdp/jcPbTEpnv/+314="
diff --git a/kmod/.travis.yml b/kmod/.travis.yml
new file mode 100644
index 000000000..e5397c5b7
--- /dev/null
+++ b/kmod/.travis.yml
@@ -0,0 +1,32 @@
+---
+language: ruby
+sudo: false
+cache: bundler
+bundler_args: --without system_tests
+script: ["bundle exec rake validate", "bundle exec rake lint", "bundle exec rake spec SPEC_OPTS='--format documentation'", "bundle exec rake metadata"]
+matrix:
+  fast_finish: true
+  include:
+  - rvm: 1.8.7
+    env: PUPPET_GEM_VERSION="~> 3.0" FACTER_GEM_VERSION="~> 1.7.0"
+  - rvm: 1.9.3
+    env: PUPPET_GEM_VERSION="~> 3.0"
+  - rvm: 2.0.0
+    env: PUPPET_GEM_VERSION="~> 3.0"
+  - rvm: 2.0.0
+    env: PUPPET_GEM_VERSION="~> 3.0" FUTURE_PARSER="yes"
+  - rvm: 2.1.6
+    env: PUPPET_GEM_VERSION="~> 4.0"
+notifications:
+  email: false
+deploy:
+  provider: puppetforge
+  user: camptocamp
+  password:
+    secure: "QvaBWqv7ZaB34BzONHPxZy+1OW+eBP4dZmhDobAVFD20kOP4O4QHdCe9kS3y3JRXrNW3wuiuegNzoKb+JvqQrZPQF3Ea0DO4uCPVrnVbrnmGC0p7v2VDA1tsb2snnSMa5mC6+3wYMwS27zRSQ7vN3AwDKMdp/jcPbTEpnv/+314="
+  on:
+    tags: true
+    # all_branches is required to use tags
+    all_branches: true
+    # Only publish if our main Ruby target builds
+    rvm: 1.9.3
diff --git a/kmod/CHANGELOG.md b/kmod/CHANGELOG.md
new file mode 100644
index 000000000..54daf6d69
--- /dev/null
+++ b/kmod/CHANGELOG.md
@@ -0,0 +1,81 @@
+## 2015-08-27 - Release 2.1.0
+
+Add minimal SuSE support
+
+## 2015-08-21 - Release 2.0.11
+
+Use docker for acceptance tests
+
+## 2015-06-26 - Release 2.0.10
+
+Fix strict_variables activation with rspec-puppet 2.2
+
+## 2015-05-28 - Release 2.0.9
+
+Add beaker_spec_helper to Gemfile
+
+## 2015-05-26 - Release 2.0.8
+
+Use random application order in nodeset
+
+## 2015-05-26 - Release 2.0.7
+
+add utopic & vivid nodesets
+
+## 2015-05-25 - Release 2.0.6
+
+Don't allow failure on Puppet 4
+
+## 2015-05-13 - Release 2.0.5
+
+Add puppet-lint-file_source_rights-check gem
+
+## 2015-05-12 - Release 2.0.4
+
+Don't pin beaker
+
+## 2015-04-27 - Release 2.0.3
+
+Add nodeset ubuntu-12.04-x86_64-openstack
+
+## 2015-04-18 - Release 2.0.2
+
+- Add beaker nodeset
+
+## 2015-04-15 - Release 2.0.1
+
+- Fix kmod::install's file class parameter's default
+
+## 2015-04-03 - Release 2.0.0
+
+- Add kmod::option and refactored everything to use kmod::setting
+- removed obsolete generic.pp
+
+## 2015-03-24 - Release 1.0.6
+
+- Lint
+
+## 2015-01-19 - Release 1.0.5
+
+- Fix relative class inclusions
+
+## 2015-01-07 - Release 1.0.4
+
+- Fix unquoted strings in cases
+
+## 2014-12-16 - Release 1.0.1
+
+- Fix for future parser
+
+## 2014-10-20 - Release 1.0.0
+
+- Setup automatic Forge releases
+
+## 2014-07-02 - Release 0.1.1
+
+- Fix deprecation warnings, #22
+
+## 2014-07-02 - Release 0.1.0
+
+- Add unit tests
+- Various improvements
diff --git a/kmod/Gemfile b/kmod/Gemfile
new file mode 100644
index 000000000..0cb59337f
--- /dev/null
+++ b/kmod/Gemfile
@@ -0,0 +1,47 @@
+source ENV['GEM_SOURCE'] || "https://rubygems.org"
+
+group :development, :unit_tests do
+  gem 'rake',                                              :require => false
+  gem 'rspec', '< 3.2',                                    :require => false if RUBY_VERSION =~ /^1.8/
+  gem 'rspec-puppet',                                      :require => false
+  gem 'puppetlabs_spec_helper',                            :require => false
+  gem 'metadata-json-lint',                                :require => false
+  gem 'puppet-lint',                                       :require => false
+  gem 'puppet-lint-unquoted_string-check',                 :require => false
+  gem 'puppet-lint-empty_string-check',                    :require => false
+  gem 'puppet-lint-spaceship_operator_without_tag-check',  :require => false
+  gem 'puppet-lint-variable_contains_upcase',              :require => false
+  gem 'puppet-lint-absolute_classname-check',              :require => false
+  gem 'puppet-lint-undef_in_function-check',               :require => false
+  gem 'puppet-lint-leading_zero-check',                    :require => false
+  gem 'puppet-lint-trailing_comma-check',                  :require => false
+  gem 'puppet-lint-file_ensure-check',                     :require => false
+  gem 'puppet-lint-version_comparison-check',              :require => false
+  gem 'puppet-lint-fileserver-check',                      :require => false
+  gem 'puppet-lint-file_source_rights-check',              :require => false
+  gem 'puppet-lint-alias-check',                           :require => false
+  gem 'rspec-puppet-facts',                                :require => false
+  gem 'github_changelog_generator',                        :require => false, :git => 'https://github.com/raphink/github-changelog-generator.git', :branch => 'dev/all_patches' if RUBY_VERSION !~ /^1.8/
+  gem 'puppet-blacksmith',                                 :require => false if RUBY_VERSION !~ /^1.8/
+end
+
+group :system_tests do
+  gem 'beaker',              :require => false
+  gem 'beaker-rspec',        :require => false
+  gem 'beaker_spec_helper',  :require => false
+  gem 'serverspec',          :require => false
+end
+
+if facterversion = ENV['FACTER_GEM_VERSION']
+  gem 'facter', facterversion, :require => false
+else
+  gem 'facter', :require => false
+end
+
+if puppetversion = ENV['PUPPET_GEM_VERSION']
+  gem 'puppet', puppetversion, :require => false
+else
+  gem 'puppet', :require => false
+end
+
+# vim:ft=ruby
diff --git a/kmod/LICENSE b/kmod/LICENSE
new file mode 100644
index 000000000..8d968b6cb
--- /dev/null
+++ b/kmod/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!) The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/kmod/README.md b/kmod/README.md
new file mode 100644
index 000000000..5b378dbae
--- /dev/null
+++ b/kmod/README.md
@@ -0,0 +1,116 @@
+# Kmod Puppet module
+
+[![Puppet Forge Version](http://img.shields.io/puppetforge/v/camptocamp/kmod.svg)](https://forge.puppetlabs.com/camptocamp/kmod)
+[![Puppet Forge Downloads](http://img.shields.io/puppetforge/dt/camptocamp/kmod.svg)](https://forge.puppetlabs.com/camptocamp/kmod)
+[![Build Status](https://img.shields.io/travis/camptocamp/puppet-kmod/master.svg)](https://travis-ci.org/camptocamp/puppet-kmod)
+[![Puppet Forge Endorsement](https://img.shields.io/puppetforge/e/camptocamp/kmod.svg)](https://forge.puppetlabs.com/camptocamp/kmod)
+[![Gemnasium](https://img.shields.io/gemnasium/camptocamp/puppet-kmod.svg)](https://gemnasium.com/camptocamp/puppet-kmod)
+[![By Camptocamp](https://img.shields.io/badge/by-camptocamp-fb7047.svg)](http://www.camptocamp.com)
+
+## Description
+
+This module provides definitions to manipulate modprobe.conf (5) stanzas:
+
+ * kmod::alias
+ * kmod::install
+ * kmod::blacklist
+
+It depends on Augeas with the modprobe lens.
+
+## Usage
+
+This module has five main defined types:
+
+  * kmod::load
+  * kmod::alias
+  * kmod::option
+  * kmod::install
+  * kmod::blacklist
+
+
+### kmod::load
+
+Loads a module using modprobe and manages persistent modules in /etc/sysconfig/modules
+
+```puppet
+  kmod::load { 'mymodule': }
+```
+
+### kmod::alias
+
+Adds an alias to modprobe.conf, by default `/etc/modprobe.d/<name>.conf` is assumed for a filename.
+
+```puppet
+  kmod::alias { 'bond0':
+    modulename => 'bonding',
+  }
+```
+
+Params:
+* `modulename`: Name of the module to alias
+* `aliasname`: Name of the alias (defaults to the resource title)
+* `file`: File to write to (see above default)
+
+### kmod::option
+
+Adds an option to modprobe.conf
+
+```puppet
+  kmod::option { 'bond0 mode':
+    module  => 'bond0',
+    option  => 'mode',
+    value   => '1',
+  }
+
+  kmod::option { 'bond0':
+    option => 'mode',
+    value  => '1',
+  }
+```
+
+Params:
+* `option`: Name of the parameter to add
+* `value`: Value of the parameter
+* `module`: Name of the module (if ommited, the resource title is used)
+* `file`: File to write to (defaults to `/etc/modprobe.d/<module name>.conf`)
+
+### kmod::blacklist
+
+Manages modprobe blacklist entries. Blacklist entries prevents module aliases from being used, 
+but would not prevent the module from being loaded.
+To prevent a module from being loaded use `kmod::install`
+
+```puppet
+  kmod::blacklist { 'foo': }
+```
+
+Params:
+* `file`: File to write to, defaults to `/etc/modprobe.d/blacklist.conf`
+
+### kmod::install
+
+Manage modprobe install entries
+
+```puppet
+   kmod::install { 'pcspkr': }
+```
+
+If you want to ensure that module can't be loaded at all you can do the following:
+```puppet
+   kmod::install { 'dccp': command => '/bin/false' }
+```
+
+Params:
+* `file`: File to write to (defaults to `/etc/modprobe.d/<module name>.conf`)
+* `command`: (optional) command associated with the install, defaults to `/bin/true`
+
+
+
+## Contributing
+
+Please report bugs and feature request using [GitHub issue
+tracker](https://github.com/camptocamp/puppet-kmod/issues).
+
+For pull requests, it is very much appreciated to check your Puppet manifest
+with [puppet-lint](https://github.com/camptocamp/puppet-kmod/issues) to follow the recommended Puppet style guidelines from the
+[Puppet Labs style guide](http://docs.puppetlabs.com/guides/style_guide.html).
diff --git a/kmod/Rakefile b/kmod/Rakefile
new file mode 100644
index 000000000..adcac180c
--- /dev/null
+++ b/kmod/Rakefile
@@ -0,0 +1,23 @@
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+
+Rake::Task[:lint].clear
+PuppetLint::RakeTask.new :lint do |config|
+  config.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp", "vendor/**/*.pp"]
+  config.disable_checks = ['80chars']
+  config.fail_on_warnings = true
+end
+
+PuppetSyntax.exclude_paths = ["spec/fixtures/**/*.pp", "vendor/**/*"]
+
+# Publishing tasks
+unless RUBY_VERSION =~ /^1\.8/
+  require 'puppet_blacksmith'
+  require 'puppet_blacksmith/rake_tasks'
+  require 'github_changelog_generator/task'
+  GitHubChangelogGenerator::RakeTask.new :changelog do |config|
+    m = Blacksmith::Modulefile.new
+    config.future_release = m.version
+    config.release_url = "https://forge.puppetlabs.com/#{m.author}/#{m.name}/%s"
+  end
+end
diff --git a/kmod/manifests/alias.pp b/kmod/manifests/alias.pp
new file mode 100644
index 000000000..dcdb974f7
--- /dev/null
+++ b/kmod/manifests/alias.pp
@@ -0,0 +1,26 @@
+# = Define: kmod::alias
+#
+# == Example
+#
+#     kmod::alias { 'bond0':
+#       alias => 'bonding',
+#     }
+#
+define kmod::alias(
+  $source,
+  $ensure     = 'present',
+  $file       = "/etc/modprobe.d/${name}.conf",
+  $aliasname  = $name,
+) {
+
+  include ::kmod
+
+  kmod::setting { "kmod::alias ${title}":
+    module   => $aliasname,
+    file     => $file,
+    category => 'alias',
+    option   => 'modulename',
+    value    => $source,
+  }
+
+}
diff --git a/kmod/manifests/blacklist.pp b/kmod/manifests/blacklist.pp
new file mode 100644
index 000000000..1dddddaa3
--- /dev/null
+++ b/kmod/manifests/blacklist.pp
@@ -0,0 +1,27 @@
+#
+# == Definition: kmod::blacklist
+#
+# Set a kernel module as blacklisted.
+#
+# Parameters:
+# - *ensure*: present/absent;
+# - *file*: optionally, set the file where the stanza is written.
+#
+# Example usage:
+#
+#   kmod::blacklist { 'pcspkr': }
+#
+define kmod::blacklist(
+  $ensure=present,
+  $file='/etc/modprobe.d/blacklist.conf',
+) {
+
+
+  kmod::setting { "kmod::blacklist ${title}":
+    ensure   => $ensure,
+    module   => $name,
+    file     => $file,
+    category => 'blacklist',
+  }
+
+}
diff --git a/kmod/manifests/init.pp b/kmod/manifests/init.pp
new file mode 100644
index 000000000..14da62ba0
--- /dev/null
+++ b/kmod/manifests/init.pp
@@ -0,0 +1,21 @@
+#
+# == Class: kmod
+#
+# Ensures a couple of mandatory files are present before managing their
+# content.
+#
+#
+class kmod {
+
+  if versioncmp($::augeasversion, '0.9.0') < 0 {
+    fail('Augeas 0.10.0 or higher required')
+  }
+  file { '/etc/modprobe.d': ensure => directory }
+
+  file { [
+      '/etc/modprobe.d/modprobe.conf',
+      '/etc/modprobe.d/aliases.conf',
+      '/etc/modprobe.d/blacklist.conf',
+    ]: ensure => file,
+  }
+}
diff --git a/kmod/manifests/install.pp b/kmod/manifests/install.pp
new file mode 100644
index 000000000..8f6bb74c0
--- /dev/null
+++ b/kmod/manifests/install.pp
@@ -0,0 +1,30 @@
+#
+# == Definition: kmod::install
+#
+# Set a kernel module as installed.
+#
+# Parameters:
+# - *ensure*: present/absent;
+# - *command*: optionally, set the command associated with the kernel module;
+# - *file*: optionally, set the file where the stanza is written.
+#
+# Example usage:
+#
+#   kmod::install { 'pcspkr': }
+#
+define kmod::install(
+  $ensure=present,
+  $command='/bin/true',
+  $file="/etc/modprobe.d/${name}.conf",
+) {
+
+  kmod::setting { "kmod::install ${title}":
+    ensure   => $ensure,
+    module   => $name,
+    file     => $file,
+    category => 'install',
+    option   => 'command',
+    value    => $command,
+  }
+
+}
diff --git a/kmod/manifests/load.pp b/kmod/manifests/load.pp
new file mode 100644
index 000000000..07525681b
--- /dev/null
+++ b/kmod/manifests/load.pp
@@ -0,0 +1,87 @@
+#
+# == Definition: kmod::load
+#
+# Manage a kernel module in /etc/modules.
+#
+# Parameters:
+# - *ensure*: present/absent;
+# - *file*: optionally, set the file where the stanza is written.
+#
+# Example usage:
+#
+#   kmod::load { 'sha256': }
+#
+define kmod::load(
+  $ensure=present,
+  $file='/etc/modules',
+) {
+
+  case $ensure {
+    'present': {
+      case $::osfamily {
+        'Debian': {
+          $changes = "clear '${name}'"
+        }
+        'Suse': {
+          $changes = "set MODULES_LOADED_ON_BOOT/value[.='${name}'] '${name}'"
+        }
+        default: { }
+      }
+
+      exec { "modprobe ${name}":
+        path   => '/bin:/sbin:/usr/bin:/usr/sbin',
+        unless => "egrep -q '^${name} ' /proc/modules",
+      }
+    }
+
+    'absent': {
+      case $::osfamily {
+        'Debian': {
+          $changes = "rm '${name}'"
+        }
+        'Suse': {
+          $changes = "rm MODULES_LOADED_ON_BOOT/value[.='${name}']"
+        }
+        default: { }
+      }
+
+      exec { "modprobe -r ${name}":
+        path   => '/bin:/sbin:/usr/bin:/usr/sbin',
+        onlyif => "egrep -q '^${name} ' /proc/modules",
+      }
+    }
+
+    default: { fail "${module_name}: unknown ensure value ${ensure}" }
+  }
+
+  case $::osfamily {
+    'Debian': {
+      augeas {"Manage ${name} in ${file}":
+        incl    => $file,
+        lens    => 'Modules.lns',
+        changes => $changes,
+      }
+    }
+    'RedHat': {
+      file { "/etc/sysconfig/modules/${name}.modules":
+        ensure  => $ensure,
+        mode    => '0755',
+        content => template('kmod/redhat.modprobe.erb'),
+      }
+    }
+    'Suse': {
+      $kernelfile = $file ? {
+        '/etc/modules' => '/etc/sysconfig/kernel',
+        default        => $file,
+      }
+      augeas { "sysconfig_kernel_MODULES_LOADED_ON_BOOT_${name}":
+        lens    => 'Shellvars_list.lns',
+        incl    => $kernelfile,
+        changes => $changes,
+      }
+    }
+    default: {
+      fail "${module_name}: Unknown OS family ${::osfamily}"
+    }
+  }
+}
diff --git a/kmod/manifests/option.pp b/kmod/manifests/option.pp
new file mode 100644
index 000000000..8597138f6
--- /dev/null
+++ b/kmod/manifests/option.pp
@@ -0,0 +1,35 @@
+# = Define: kmod::alias
+#
+# == Example
+#
+#     kmod::option { 'bond0':
+#       option => 'bonding',
+#     }
+#
+define kmod::option(
+  $option,
+  $value,
+  $module = $name,
+  $ensure = 'present',
+  $file   = undef,
+) {
+
+  include ::kmod
+
+  $target_file = $file ? {
+    undef   => "/etc/modprobe.d/${module}.conf",
+    default => $file,
+  }
+
+
+  kmod::setting { "kmod::option ${title}":
+    ensure   => $ensure,
+    module   => $module,
+    category => 'options',
+    file     => $target_file,
+    option   => $option,
+    value    => $value,
+  }
+
+}
+
diff --git a/kmod/manifests/setting.pp b/kmod/manifests/setting.pp
new file mode 100644
index 000000000..b554d1646
--- /dev/null
+++ b/kmod/manifests/setting.pp
@@ -0,0 +1,45 @@
+# = Define: kmod::setting
+#
+# == Example
+#
+#
+define kmod::setting(
+  $file,
+  $category,
+  $option = undef,
+  $value = undef,
+  $module = $name,
+  $ensure = 'present',
+) {
+
+  include ::kmod
+
+  ensure_resource('file', $file, { 'ensure' => 'file'} )
+  case $ensure {
+    'present': {
+      if $option {
+        $changes = [
+          "set ${category}[. = '${module}'] ${module}",
+          "set ${category}[. = '${module}']/${option} ${value}",
+        ]
+      } else {
+        $changes = [
+          "set ${category}[. = '${module}'] ${module}",
+        ]
+      }
+    }
+
+    'absent': {
+      $changes = "rm ${category}[. = '${module}']"
+    }
+
+    default: { fail ( "unknown ensure value ${ensure}" ) }
+  }
+
+  augeas { "kmod::setting ${title} ${module}":
+    incl    => $file,
+    lens    => 'Modprobe.lns',
+    changes => $changes,
+    require => File[$file],
+  }
+}
diff --git a/kmod/metadata.json b/kmod/metadata.json
new file mode 100644
index 000000000..25cb4b183
--- /dev/null
+++ b/kmod/metadata.json
@@ -0,0 +1,44 @@
+{
+  "name": "camptocamp-kmod",
+  "version": "2.1.0",
+  "author": "camptocamp",
+  "summary": "Manage Linux kernel modules with Puppet",
+  "license": "Apache-2.0",
+  "source": "https://github.com/camptocamp/puppet-kmod",
+  "project_page": "https://github.com/camptocamp/puppet-kmod",
+  "issues_url": "https://github.com/camptocamp/puppet-kmod/issues",
+  "description": "Manage Linux kernel modules with Puppet",
+  "dependencies": [
+
+  ],
+  "operatingsystem_support": [
+    {
+      "operatingsystem": "Debian",
+      "operatingsystemrelease": [
+        "6",
+        "7"
+      ]
+    },
+    {
+      "operatingsystem": "Ubuntu",
+      "operatingsystemrelease": [
+        "12.04",
+        "14.04"
+      ]
+    },
+    {
+      "operatingsystem": "SLES",
+      "operatingsystemrelease": [
+        "11"
+      ]
+    },
+    {
+      "operatingsystem": "RedHat",
+      "operatingsystemrelease": [
+        "5",
+        "6",
+        "7"
+      ]
+    }
+  ]
+}
diff --git a/kmod/spec/acceptance/nodesets/centos-5-x86_64-docker.yml b/kmod/spec/acceptance/nodesets/centos-5-x86_64-docker.yml
new file mode 100644
index 000000000..679afb04d
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/centos-5-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  centos-5-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-5-x86_64
+    hypervisor : docker
+    image: centos:5
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'yum install -y crontabs tar wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/centos-6-x86_64-docker.yml b/kmod/spec/acceptance/nodesets/centos-6-x86_64-docker.yml
new file mode 100644
index 000000000..9cab03d08
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/centos-6-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  centos-6-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-6-x86_64
+    hypervisor : docker
+    image: centos:6
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'yum install -y crontabs tar wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/centos-6-x86_64-openstack.yml b/kmod/spec/acceptance/nodesets/centos-6-x86_64-openstack.yml
new file mode 100644
index 000000000..e325b9e90
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/centos-6-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  centos-6-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-6-x86_64
+    hypervisor : openstack
+    flavor: m1.small
+    image: centos-6-latest
+    user: root
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/kmod/spec/acceptance/nodesets/centos-6-x86_64-vagrant.yml b/kmod/spec/acceptance/nodesets/centos-6-x86_64-vagrant.yml
new file mode 100644
index 000000000..f06036ecc
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/centos-6-x86_64-vagrant.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  centos-6-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-6-x86_64
+    hypervisor : vagrant
+    box : camptocamp/centos-6-x86_64
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/centos-7-x86_64-docker.yml b/kmod/spec/acceptance/nodesets/centos-7-x86_64-docker.yml
new file mode 100644
index 000000000..0bc972711
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/centos-7-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  centos-7-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-7-x86_64
+    hypervisor : docker
+    image: centos:7
+    docker_preserve_image: true
+    docker_cmd: '["/usr/sbin/init"]'
+    docker_image_commands:
+      - 'yum install -y crontabs tar wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/centos-7-x86_64-openstack.yml b/kmod/spec/acceptance/nodesets/centos-7-x86_64-openstack.yml
new file mode 100644
index 000000000..9003c8678
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/centos-7-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  centos-7-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-7-x86_64
+    hypervisor : openstack
+    flavor: m1.small
+    image: centos-7-latest
+    user: centos
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/kmod/spec/acceptance/nodesets/centos-7-x86_64-vagrant.yml b/kmod/spec/acceptance/nodesets/centos-7-x86_64-vagrant.yml
new file mode 100644
index 000000000..95402e546
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/centos-7-x86_64-vagrant.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  centos-7-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-7-x86_64
+    hypervisor : vagrant
+    box : camptocamp/centos-7-x86_64
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/debian-6-x86_64-docker.yml b/kmod/spec/acceptance/nodesets/debian-6-x86_64-docker.yml
new file mode 100644
index 000000000..359dae7dc
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/debian-6-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  debian-6-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-6-amd64
+    hypervisor : docker
+    image: debian:6
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/debian-6-x86_64-openstack.yml b/kmod/spec/acceptance/nodesets/debian-6-x86_64-openstack.yml
new file mode 100644
index 000000000..c6c192fe4
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/debian-6-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  debian-6-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-6-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: debian-6-latest
+    user: debian
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/kmod/spec/acceptance/nodesets/debian-6-x86_64-vagrant.yml b/kmod/spec/acceptance/nodesets/debian-6-x86_64-vagrant.yml
new file mode 100644
index 000000000..03db0fa76
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/debian-6-x86_64-vagrant.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  debian-6-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-6-amd64
+    hypervisor : vagrant
+    box : puppetlabs/debian-6.0.10-64-nocm
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/debian-7-x86_64-docker.yml b/kmod/spec/acceptance/nodesets/debian-7-x86_64-docker.yml
new file mode 100644
index 000000000..fc11f5748
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/debian-7-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  debian-7-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-7-amd64
+    hypervisor : docker
+    image: debian:7
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y cron wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/debian-7-x86_64-openstack.yml b/kmod/spec/acceptance/nodesets/debian-7-x86_64-openstack.yml
new file mode 100644
index 000000000..017b4c743
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/debian-7-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  debian-7-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-7-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: debian-7-latest
+    user: debian
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/kmod/spec/acceptance/nodesets/debian-7-x86_64-vagrant.yml b/kmod/spec/acceptance/nodesets/debian-7-x86_64-vagrant.yml
new file mode 100644
index 000000000..8ed1264df
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/debian-7-x86_64-vagrant.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  debian-7-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-7-amd64
+    hypervisor : vagrant
+    box : camptocamp/debian-7-amd64
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/debian-8-x86_64-docker.yml b/kmod/spec/acceptance/nodesets/debian-8-x86_64-docker.yml
new file mode 100644
index 000000000..86a55e156
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/debian-8-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  debian-8-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-8-amd64
+    hypervisor : docker
+    image: debian:8
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y cron wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/debian-8-x86_64-openstack.yml b/kmod/spec/acceptance/nodesets/debian-8-x86_64-openstack.yml
new file mode 100644
index 000000000..003b6f4bd
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/debian-8-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  debian-8-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-8-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: debian-8-latest
+    user: debian
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/kmod/spec/acceptance/nodesets/debian-8-x86_64-vagrant.yml b/kmod/spec/acceptance/nodesets/debian-8-x86_64-vagrant.yml
new file mode 100644
index 000000000..5cc7f0c5a
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/debian-8-x86_64-vagrant.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  debian-8-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-8-amd64
+    hypervisor : vagrant
+    box : camptocamp/debian-8-amd64
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/ubuntu-10.04-x86_64-docker.yml b/kmod/spec/acceptance/nodesets/ubuntu-10.04-x86_64-docker.yml
new file mode 100644
index 000000000..933dee605
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/ubuntu-10.04-x86_64-docker.yml
@@ -0,0 +1,13 @@
+HOSTS:
+  ubuntu-1004-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-10.04-amd64
+    hypervisor : docker
+    image: ubuntu:10.04
+    # This stops the image from being deleted on completion, speeding up the process.
+    docker_preserve_image: true
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/ubuntu-12.04-x86_64-docker.yml b/kmod/spec/acceptance/nodesets/ubuntu-12.04-x86_64-docker.yml
new file mode 100644
index 000000000..f0ec72b86
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/ubuntu-12.04-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  ubuntu-1204-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-12.04-amd64
+    hypervisor : docker
+    image: ubuntu:12.04
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/ubuntu-12.04-x86_64-openstack.yml b/kmod/spec/acceptance/nodesets/ubuntu-12.04-x86_64-openstack.yml
new file mode 100644
index 000000000..f81b04b74
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/ubuntu-12.04-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  ubuntu-1204-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-12.04-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: ubuntu-1204-latest
+    user: ubuntu
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/kmod/spec/acceptance/nodesets/ubuntu-14.04-x86_64-docker.yml b/kmod/spec/acceptance/nodesets/ubuntu-14.04-x86_64-docker.yml
new file mode 100644
index 000000000..6fb9281e5
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/ubuntu-14.04-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  ubuntu-1404-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-14.04-amd64
+    hypervisor : docker
+    image: ubuntu:14.04
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/ubuntu-14.04-x86_64-openstack.yml b/kmod/spec/acceptance/nodesets/ubuntu-14.04-x86_64-openstack.yml
new file mode 100644
index 000000000..2eeb912d9
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/ubuntu-14.04-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  ubuntu-1404-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-14.04-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: ubuntu-1404-latest
+    user: ubuntu
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/kmod/spec/acceptance/nodesets/ubuntu-14.04-x86_64-vagrant.yml b/kmod/spec/acceptance/nodesets/ubuntu-14.04-x86_64-vagrant.yml
new file mode 100644
index 000000000..3b3769539
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/ubuntu-14.04-x86_64-vagrant.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  ubuntu-1404-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-14.04-amd64
+    hypervisor : vagrant
+    box : puppetlabs/ubuntu-14.04-64-nocm
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/ubuntu-14.10-x86_64-docker.yml b/kmod/spec/acceptance/nodesets/ubuntu-14.10-x86_64-docker.yml
new file mode 100644
index 000000000..2be425c54
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/ubuntu-14.10-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  ubuntu-1410-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-14.10-amd64
+    hypervisor : docker
+    image: ubuntu:14.10
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/ubuntu-14.10-x86_64-openstack.yml b/kmod/spec/acceptance/nodesets/ubuntu-14.10-x86_64-openstack.yml
new file mode 100644
index 000000000..58a2acd26
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/ubuntu-14.10-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  ubuntu-1410-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-14.10-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: ubuntu-1410-latest
+    user: ubuntu
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/kmod/spec/acceptance/nodesets/ubuntu-15.04-x86_64-docker.yml b/kmod/spec/acceptance/nodesets/ubuntu-15.04-x86_64-docker.yml
new file mode 100644
index 000000000..caed722c2
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/ubuntu-15.04-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  ubuntu-1504-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-15.04-amd64
+    hypervisor : docker
+    image: ubuntu:15.04
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/kmod/spec/acceptance/nodesets/ubuntu-15.04-x86_64-openstack.yml b/kmod/spec/acceptance/nodesets/ubuntu-15.04-x86_64-openstack.yml
new file mode 100644
index 000000000..22ef76c4e
--- /dev/null
+++ b/kmod/spec/acceptance/nodesets/ubuntu-15.04-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  ubuntu-1504-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-15.04-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: ubuntu-1504-latest
+    user: ubuntu
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/kmod/spec/classes/kmod_spec.rb b/kmod/spec/classes/kmod_spec.rb
new file mode 100644
index 000000000..f37f8c096
--- /dev/null
+++ b/kmod/spec/classes/kmod_spec.rb
@@ -0,0 +1,26 @@
+require 'spec_helper'
+
+describe 'kmod', :type => :class do
+
+  on_supported_os.each do |os, facts|
+    context "on #{os} with augeas 0.8.9" do
+      let(:facts) do facts.merge({:augeasversion => '0.8.9'}) end
+      it do
+        expect {
+          should compile
+        }.to raise_error(/Augeas 0.10.0 or higher required/)
+      end
+    end
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(  { :augeasversion => '1.2.0' } )
+      end
+
+      it { should contain_class('kmod') }
+      it { should contain_file('/etc/modprobe.d').with({ 'ensure' => 'directory' }) }
+      ['modprobe.conf','aliases.conf','blacklist.conf'].each do |file|
+        it { should contain_file("/etc/modprobe.d/#{file}").with({ 'ensure' => 'file' }) }
+      end
+    end
+  end
+end
diff --git a/kmod/spec/defines/kmod_alias_spec.rb b/kmod/spec/defines/kmod_alias_spec.rb
new file mode 100644
index 000000000..298009e40
--- /dev/null
+++ b/kmod/spec/defines/kmod_alias_spec.rb
@@ -0,0 +1,42 @@
+require 'spec_helper'
+
+describe 'kmod::alias', :type => :define do
+  let(:title) { 'foo' }
+
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge( {:augeasversion => '1.2.0'} )
+      end
+
+      let(:default_params) do { :source =>'bar', :file => '/baz' } end
+
+      context 'when a file is specified' do
+        let(:params) do default_params end
+        it { should contain_kmod__alias('foo') }
+        it { should contain_kmod__setting('kmod::alias foo') .with({
+          'ensure'    => 'present',
+          'module'    => 'foo',
+          'file'      => '/baz',
+          'category'  => 'alias',
+          'option'    => 'modulename',
+          'value'     => 'bar'
+        }) }
+      end
+
+      context 'when a file is specified and an aliasname' do
+        let(:params) do default_params.merge!({ :aliasname => 'tango' }) end
+        it { should contain_kmod__alias('foo') }
+        it { should contain_kmod__setting('kmod::alias foo') .with({
+          'ensure'    => 'present',
+          'module'    => 'tango',
+          'file'      => '/baz',
+          'category'  => 'alias',
+          'option'    => 'modulename',
+          'value'     => 'bar'
+        }) }
+      end
+
+    end
+  end
+end
diff --git a/kmod/spec/defines/kmod_blacklist_spec.rb b/kmod/spec/defines/kmod_blacklist_spec.rb
new file mode 100644
index 000000000..908eebd65
--- /dev/null
+++ b/kmod/spec/defines/kmod_blacklist_spec.rb
@@ -0,0 +1,49 @@
+require 'spec_helper'
+
+describe 'kmod::blacklist', :type => :define do
+  let(:title) { 'foo' }
+
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge({
+          :augeasversion => '1.2.0',
+        })
+      end
+
+      context 'when ensure is set to present' do
+        let(:params) do { :ensure => 'present', :file => '/bar/baz' } end
+        it { should contain_kmod__blacklist('foo') }
+        it { should contain_kmod__setting('kmod::blacklist foo').with({
+          'ensure'     => 'present',
+          'category'   => 'blacklist',
+          'module'     => 'foo',
+          'file'       => '/bar/baz'
+        }) }
+      end
+
+
+      context 'when file is not specified' do
+        let(:params) do { :ensure => 'present' } end
+        it { should contain_kmod__blacklist('foo') }
+        it { should contain_kmod__setting('kmod::blacklist foo').with({
+          'ensure'     => 'present',
+          'category'   => 'blacklist',
+          'module'     => 'foo',
+          'file'       => '/etc/modprobe.d/blacklist.conf'
+        }) }
+      end
+
+      context 'when ensure is set to absent' do
+        let(:params) do { :ensure => 'absent', :file => '/bar/baz' } end
+        it { should contain_kmod__blacklist('foo') }
+        it { should contain_kmod__setting('kmod::blacklist foo').with({
+          'ensure'     => 'absent',
+          'category'   => 'blacklist',
+          'module'     => 'foo',
+          'file'       => '/bar/baz'
+        }) }
+      end
+    end
+  end
+end
diff --git a/kmod/spec/defines/kmod_install_spec.rb b/kmod/spec/defines/kmod_install_spec.rb
new file mode 100644
index 000000000..a8937ccf9
--- /dev/null
+++ b/kmod/spec/defines/kmod_install_spec.rb
@@ -0,0 +1,26 @@
+require 'spec_helper'
+
+describe 'kmod::install', :type => :define do
+  let(:title) { 'foo' }
+
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge({
+          :augeasversion => '1.2.0',
+        })
+      end
+
+      let(:params) do { :ensure => 'present', :command => '/bin/true', :file => '/etc/modprobe.d/modprobe.conf' } end
+      it { should contain_kmod__install('foo') }
+      it { should contain_kmod__setting('kmod::install foo').with({
+        'ensure'    => 'present',
+        'category'  => 'install',
+        'module'    => 'foo',
+        'option'    => 'command',
+        'value'     => '/bin/true',
+        'file'      => '/etc/modprobe.d/modprobe.conf'
+      }) }
+    end
+  end
+end
diff --git a/kmod/spec/defines/kmod_load_spec.rb b/kmod/spec/defines/kmod_load_spec.rb
new file mode 100644
index 000000000..0e124b23e
--- /dev/null
+++ b/kmod/spec/defines/kmod_load_spec.rb
@@ -0,0 +1,67 @@
+require 'spec_helper'
+
+describe 'kmod::load', :type => :define do
+  let(:title) { 'foo' }
+
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge( { :augeasversion => '1.2.0' } )
+      end
+
+      context 'with ensure set to present' do
+        let(:params) do { :ensure => 'present', :file => '/foo/bar' } end
+        it { should contain_kmod__load('foo') }
+        it { should contain_exec('modprobe foo').with({'unless' => "egrep -q '^foo ' /proc/modules"}) }
+
+        case facts[:osfamily]
+        when 'Debian'
+          it { should contain_augeas('Manage foo in /foo/bar').with({
+            'incl'    => '/foo/bar',
+            'lens'    => 'Modules.lns',
+            'changes' => "clear 'foo'"
+          }) }
+        when 'Suse'
+          it { should contain_augeas('sysconfig_kernel_MODULES_LOADED_ON_BOOT_foo').with({
+            'incl'    => '/foo/bar',
+            'lens'    => 'Shellvars_list.lns',
+            'changes' => "set MODULES_LOADED_ON_BOOT/value[.='foo'] 'foo'"
+          }) }
+        when 'RedHat'
+          it { should contain_file('/etc/sysconfig/modules/foo.modules').with({
+            'ensure'  => 'present',
+            'mode'    => '0755',
+            'content' => /exec \/sbin\/modprobe foo > \/dev\/null 2>&1/
+          })}
+        end
+      end
+
+      context 'with ensure set to absent' do
+        let(:params) do { :ensure => 'absent', :file => '/foo/bar' } end
+        it { should contain_kmod__load('foo') }
+        it { should contain_exec('modprobe -r foo').with({ 'onlyif' => "egrep -q '^foo ' /proc/modules" }) }
+
+        case facts[:osfamily]
+        when 'Debian'
+          it { should contain_augeas('Manage foo in /foo/bar').with({
+            'incl'    => '/foo/bar',
+            'lens'    => 'Modules.lns',
+            'changes' => "rm 'foo'"
+          })}
+        when 'Suse'
+          it { should contain_augeas('sysconfig_kernel_MODULES_LOADED_ON_BOOT_foo').with({
+            'incl'    => '/foo/bar',
+            'lens'    => 'Shellvars_list.lns',
+            'changes' => "rm MODULES_LOADED_ON_BOOT/value[.='foo']"
+          }) }
+        when 'RedHat'
+          it { should contain_file('/etc/sysconfig/modules/foo.modules').with({
+            'ensure'  => 'absent',
+            'mode'    => '0755',
+            'content' => /exec \/sbin\/modprobe foo > \/dev\/null 2>&1/
+          })}
+        end
+      end
+    end
+  end
+end
diff --git a/kmod/spec/defines/kmod_setting_spec.rb b/kmod/spec/defines/kmod_setting_spec.rb
new file mode 100644
index 000000000..5f3673427
--- /dev/null
+++ b/kmod/spec/defines/kmod_setting_spec.rb
@@ -0,0 +1,40 @@
+require 'spec_helper'
+
+describe 'kmod::setting', :type => :define do
+  let(:title) { 'foo' }
+
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge({
+          :augeasversion => '1.2.0',
+        })
+      end
+
+      let(:default_params) do { :file => 'modprobe.conf'  } end
+      let(:params) do default_params end
+
+      context 'add an alias' do
+        let(:params) do default_params.merge({ :category => 'alias', :option => 'modulename', :value => 'tango' }) end
+        it { should contain_kmod__setting('foo')}
+        it { should contain_augeas('kmod::setting foo foo').with({
+          'incl'    => 'modprobe.conf',
+          'lens'    => 'Modprobe.lns',
+          'changes' => [ "set alias[. = 'foo'] foo", "set alias[. = 'foo']/modulename tango" ],
+          'require' => 'File[modprobe.conf]'
+        })}
+      end
+      context 'add a blacklist' do
+        let(:params) do { :file => '/etc/modprobe.d/blacklist.conf', :category => 'blacklist'  } end
+        it { should contain_kmod__setting('foo')}
+        it { should contain_augeas('kmod::setting foo foo').with({
+          'incl'    => '/etc/modprobe.d/blacklist.conf',
+          'lens'    => 'Modprobe.lns',
+          'changes' => [ "set blacklist[. = 'foo'] foo" ],
+          'require' => 'File[/etc/modprobe.d/blacklist.conf]'
+        })}
+      end
+
+    end
+  end
+end
diff --git a/kmod/spec/spec.opts b/kmod/spec/spec.opts
new file mode 100644
index 000000000..91cd6427e
--- /dev/null
+++ b/kmod/spec/spec.opts
@@ -0,0 +1,6 @@
+--format
+s
+--colour
+--loadby
+mtime
+--backtrace
diff --git a/kmod/spec/spec_helper.rb b/kmod/spec/spec_helper.rb
new file mode 100644
index 000000000..94d30d5ce
--- /dev/null
+++ b/kmod/spec/spec_helper.rb
@@ -0,0 +1,42 @@
+require 'puppetlabs_spec_helper/module_spec_helper'
+require 'rspec-puppet-facts'
+include RspecPuppetFacts
+
+
+RSpec.configure do |c|
+  c.include PuppetlabsSpec::Files
+
+  c.before :each do
+    # Store any environment variables away to be restored later
+    @old_env = {}
+    ENV.each_key {|k| @old_env[k] = ENV[k]}
+
+    c.strict_variables = Gem::Version.new(Puppet.version) >= Gem::Version.new('3.5')
+    Puppet.features.stubs(:root?).returns(true)
+  end
+
+  c.after :each do
+    PuppetlabsSpec::Files.cleanup
+  end
+end
+
+require 'pathname'
+dir = Pathname.new(__FILE__).parent
+Puppet[:modulepath] = File.join(dir, 'fixtures', 'modules')
+
+# There's no real need to make this version dependent, but it helps find
+# regressions in Puppet
+#
+# 1. Workaround for issue #16277 where default settings aren't initialised from
+# a spec and so the libdir is never initialised (3.0.x)
+# 2. Workaround for 2.7.20 that now only loads types for the current node
+# environment (#13858) so Puppet[:modulepath] seems to get ignored
+# 3. Workaround for 3.5 where context hasn't been configured yet,
+# ticket https://tickets.puppetlabs.com/browse/MODULES-823
+#
+ver = Gem::Version.new(Puppet.version.split('-').first)
+if Gem::Requirement.new("~> 2.7.20") =~ ver || Gem::Requirement.new("~> 3.0.0") =~ ver || Gem::Requirement.new("~> 3.5") =~ ver || Gem::Requirement.new("~> 4.0")
+  puts "augeasproviders: setting Puppet[:libdir] to work around broken type autoloading"
+  # libdir is only a single dir, so it can only workaround loading of one external module
+  Puppet[:libdir] = "#{Puppet[:modulepath]}/augeasproviders_core/lib"
+end
diff --git a/kmod/templates/redhat.modprobe.erb b/kmod/templates/redhat.modprobe.erb
new file mode 100644
index 000000000..389df3418
--- /dev/null
+++ b/kmod/templates/redhat.modprobe.erb
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+# file managed by puppet
+
+exec /sbin/modprobe <%= @name %> > /dev/null 2>&1
diff --git a/manila/CHANGELOG.md b/manila/CHANGELOG.md
new file mode 100644
index 000000000..5cc2dcc87
--- /dev/null
+++ b/manila/CHANGELOG.md
@@ -0,0 +1,4 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+- Initial release of the puppet-manila module
diff --git a/manila/README.md b/manila/README.md
index b352daf4e..56df97022 100644
--- a/manila/README.md
+++ b/manila/README.md
@@ -1,7 +1,7 @@
 manila
 =======
 
-1.0.0 - 2014.2.0 - Juno
+6.0.0 - 2015.1.0 - Kilo
 
 #### Table of Contents
 
diff --git a/manila/manifests/init.pp b/manila/manifests/init.pp
index 9725ca59b..3ab7172c4 100644
--- a/manila/manifests/init.pp
+++ b/manila/manifests/init.pp
@@ -279,8 +279,8 @@
       'oslo_messaging_rabbit/rabbit_userid':       value => $rabbit_userid;
       'oslo_messaging_rabbit/rabbit_virtual_host': value => $rabbit_virtual_host;
       'oslo_messaging_rabbit/rabbit_use_ssl':      value => $rabbit_use_ssl;
-      'DEFAULT/control_exchange':    value => $control_exchange;
-      'DEFAULT/amqp_durable_queues': value => $amqp_durable_queues;
+      'DEFAULT/control_exchange':                  value => $control_exchange;
+      'oslo_messaging_rabbit/amqp_durable_queues': value => $amqp_durable_queues;
     }
 
     if $rabbit_hosts {
diff --git a/manila/metadata.json b/manila/metadata.json
index 8e3fbb96a..b930a28b4 100644
--- a/manila/metadata.json
+++ b/manila/metadata.json
@@ -1,10 +1,10 @@
 {
-  "name": "stackforge-manila",
-  "version": "5.0.0",
-  "author": "NetApp and StackForge Contributors",
+  "name": "openstack-manila",
+  "version": "6.0.0",
+  "author": "NetApp and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Manila",
   "license": "Apache-2.0",
-  "source": "git://github.com/stackforge/puppet-manila.git",
+  "source": "git://github.com/openstack/puppet-manila.git",
   "project_page": "https://launchpad.net/puppet-manila",
   "issues_url": "https://bugs.launchpad.net/puppet-manila",
   "requirements": [
@@ -33,10 +33,10 @@
   "dependencies": [
     { "name": "dprince/qpid", "version_requirement": ">=1.0.0 <2.0.0" },
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
-    { "name": "stackforge/keystone", "version_requirement": ">=5.0.0 <6.0.0" },
-    { "name": "stackforge/glance", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/keystone", "version_requirement": ">=6.0.0 <7.0.0" },
+    { "name": "openstack/glance", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/rabbitmq", "version_requirement": ">=2.0.2 <6.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
-    { "name": "stackforge/openstacklib", "version_requirement": ">=5.0.0 <6.0.0" }
+    { "name": "openstack/openstacklib", "version_requirement": ">=6.0.0 <7.0.0" }
   ]
 }
diff --git a/manila/spec/classes/manila_spec.rb b/manila/spec/classes/manila_spec.rb
index 4fe4ca38f..6d2fef593 100644
--- a/manila/spec/classes/manila_spec.rb
+++ b/manila/spec/classes/manila_spec.rb
@@ -287,7 +287,7 @@
       req_params
     end
 
-    it { is_expected.to contain_manila_config('DEFAULT/amqp_durable_queues').with_value(false) }
+    it { is_expected.to contain_manila_config('oslo_messaging_rabbit/amqp_durable_queues').with_value(false) }
   end
 
   describe 'with amqp_durable_queues enabled' do
@@ -297,7 +297,7 @@
       })
     end
 
-    it { is_expected.to contain_manila_config('DEFAULT/amqp_durable_queues').with_value(true) }
+    it { is_expected.to contain_manila_config('oslo_messaging_rabbit/amqp_durable_queues').with_value(true) }
   end
 
   describe 'with sqlite' do
diff --git a/manila/spec/spec_helper_acceptance.rb b/manila/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/manila/spec/spec_helper_acceptance.rb
+++ b/manila/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/mongodb/lib/puppet/provider/mongodb.rb b/mongodb/lib/puppet/provider/mongodb.rb
index 101f3fd6a..c0670769f 100644
--- a/mongodb/lib/puppet/provider/mongodb.rb
+++ b/mongodb/lib/puppet/provider/mongodb.rb
@@ -80,7 +80,11 @@ def self.mongo_eval(cmd, db = 'admin')
         cmd = mongorc_file + cmd
     end
 
-    out = mongo([db, '--quiet', '--host', get_conn_string, '--eval', cmd])
+    if ipv6_is_enabled
+      out = mongo([db, '--quiet', '--ipv6', '--host', get_conn_string, '--eval', cmd])
+    else
+      out = mongo([db, '--quiet', '--host', get_conn_string, '--eval', cmd])
+    end
 
     out.gsub!(/ObjectId\(([^)]*)\)/, '\1')
     out
diff --git a/mongodb/lib/puppet/provider/mongodb_replset/mongo.rb b/mongodb/lib/puppet/provider/mongodb_replset/mongo.rb
index ca3fcf845..0b5c0347d 100644
--- a/mongodb/lib/puppet/provider/mongodb_replset/mongo.rb
+++ b/mongodb/lib/puppet/provider/mongodb_replset/mongo.rb
@@ -113,6 +113,22 @@ def self.get_mongod_conf_file
     file
   end
 
+  def self.ipv6_is_enabled
+    file = get_mongod_conf_file
+    config = YAML.load_file(file)
+    if config.kind_of?(Hash)
+      ipv6 = config['net.ipv6']
+    else # It has to be a key-value store
+      config = {}
+      File.readlines(file).collect do |line|
+        k,v = line.split('=')
+        config[k.rstrip] = v.lstrip.chomp if k and v
+      end
+      ipv6 = config['ipv6']
+    end
+    ipv6
+  end
+
   def self.get_replset_properties
 
     conn_string = get_conn_string
@@ -229,11 +245,13 @@ def mongo_command(command, host, retries=4)
   end
 
   def self.mongo_command(command, host=nil, retries=4)
+    has_ipv6 = ipv6_is_enabled
     # Allow waiting for mongod to become ready
     # Wait for 2 seconds initially and double the delay at each retry
     wait = 2
     begin
       args = Array.new
+      args << '--ipv6' if has_ipv6
       args << '--quiet'
       args << ['--host',host] if host
       args << ['--eval',"printjson(#{command})"]
diff --git a/n1k_vsm/.fixtures.yml b/n1k_vsm/.fixtures.yml
new file mode 100644
index 000000000..d54b7e67d
--- /dev/null
+++ b/n1k_vsm/.fixtures.yml
@@ -0,0 +1,5 @@
+fixtures:
+  repositories:
+    'stdlib': 'git://github.com/puppetlabs/puppetlabs-stdlib.git'
+  symlinks:
+    "n1k_vsm": "#{source_dir}"
diff --git a/n1k_vsm/Gemfile b/n1k_vsm/Gemfile
index 8de97162d..6d4ce9a07 100644
--- a/n1k_vsm/Gemfile
+++ b/n1k_vsm/Gemfile
@@ -1,8 +1,30 @@
-source 'https://rubygems.org'
+source ENV['GEM_SOURCE'] || "https://rubygems.org"
 
 group :development, :test do
-  gem 'puppetlabs_spec_helper', :require => false
-  gem 'puppet-lint', '~> 0.3.2'
+  gem 'puppetlabs_spec_helper',               :require => 'false'
+  gem 'rspec-puppet', '~> 2.2.0',             :require => 'false'
+  gem 'metadata-json-lint',                   :require => 'false'
+  gem 'puppet-lint-param-docs',               :require => 'false'
+  gem 'puppet-lint-absolute_classname-check', :require => 'false'
+  gem 'puppet-lint-absolute_template_path',   :require => 'false'
+  gem 'puppet-lint-trailing_newline-check',   :require => 'false'
+  gem 'puppet-lint-unquoted_string-check',    :require => 'false'
+  gem 'puppet-lint-leading_zero-check',       :require => 'false'
+  gem 'puppet-lint-variable_contains_upcase', :require => 'false'
+  gem 'puppet-lint-numericvariable',          :require => 'false'
+  gem 'json',                                 :require => 'false'
+  gem 'webmock',                              :require => 'false'
+end
+
+group :system_tests do
+  gem 'beaker-rspec',                 :require => 'false'
+  gem 'beaker-puppet_install_helper', :require => 'false'
+end
+
+if facterversion = ENV['FACTER_GEM_VERSION']
+  gem 'facter', facterversion, :require => false
+else
+  gem 'facter', :require => false
 end
 
 if puppetversion = ENV['PUPPET_GEM_VERSION']
@@ -10,3 +32,5 @@ if puppetversion = ENV['PUPPET_GEM_VERSION']
 else
   gem 'puppet', :require => false
 end
+
+# vim:ft=ruby
diff --git a/n1k_vsm/manifests/deploy.pp b/n1k_vsm/manifests/deploy.pp
index b39afe6cb..4427b264c 100644
--- a/n1k_vsm/manifests/deploy.pp
+++ b/n1k_vsm/manifests/deploy.pp
@@ -5,14 +5,31 @@
 #
 class n1k_vsm::deploy
 {
+  require ::n1k_vsm
+  include ::n1k_vsm
+
   #ensure tap interfaces and deploy the vsm
   $ctrltap  = 'vsm-ctrl0'
   $mgmttap  = 'vsm-mgmt0'
   $pkttap   = 'vsm-pkt0'
 
+  # Validate and get the array of digits for the vsm_mac_base (or use default)
+  # Using _vmb as the name for the final string to increase readability
+  $tmp_mac_base = regsubst($n1k_vsm::vsm_mac_base, '[^0-9a-fA-F]+', '')
+  if size($tmp_mac_base) < 7 {
+    $vmb = split('005dc79', '')
+  } else {
+    $vmb = split($tmp_mac_base, '')
+  }
+
+  # Generate MACs for VSM
+  $ctrlmac  = "52:54:${vmb[0]}${vmb[1]}:${vmb[2]}${vmb[3]}:${vmb[4]}${vmb[5]}:${vmb[6]}1"
+  $mgmtmac  = "52:54:${vmb[0]}${vmb[1]}:${vmb[2]}${vmb[3]}:${vmb[4]}${vmb[5]}:${vmb[6]}2"
+  $pktmac   = "52:54:${vmb[0]}${vmb[1]}:${vmb[2]}${vmb[3]}:${vmb[4]}${vmb[5]}:${vmb[6]}3"
+
   exec { 'Exec_create_disk':
     command => "/usr/bin/qemu-img create -f raw ${n1k_vsm::diskfile} ${n1k_vsm::disksize}G",
-    unless  => "/usr/bin/virsh list --all | grep -c ${n1k_vsm::vsmname}",
+    creates => $n1k_vsm::diskfile,
   }
 
   $targetxmlfile = "/var/spool/cisco/vsm/vsm_${n1k_vsm::vsm_role}_deploy.xml"
@@ -21,19 +38,49 @@
     owner   => 'root',
     group   => 'root',
     mode    => '0666',
+    seltype => 'virt_content_t',
     content => template('n1k_vsm/vsm_vm.xml.erb'),
     require => Exec['Exec_create_disk'],
   }
 
-  exec { 'Exec_Define_VSM':
-    command => "/usr/bin/virsh define ${targetxmlfile}",
-    unless  => "/usr/bin/virsh list --all | grep -c ${n1k_vsm::vsmname}",
-  }
+  # Don't start VSM if this is pacemaker controlled deployment
+  if !($n1k_vsm::pacemaker_control) {
+    exec { 'Exec_Define_VSM':
+      command => "/usr/bin/virsh define ${targetxmlfile}",
+      unless  => "/usr/bin/virsh list --all | grep -c ${n1k_vsm::vsmname}",
+      require => File['File_Target_XML_File'],
+    }
 
-  exec { 'Exec_Launch_VSM':
-    command => "/usr/bin/virsh start ${n1k_vsm::vsmname}",
-    unless  => "/usr/bin/virsh list --all | grep ${n1k_vsm::vsmname} | grep -c running",
-  }
+    exec { 'Exec_Launch_VSM':
+      command => "/usr/bin/virsh start ${n1k_vsm::vsmname}",
+      unless  => ("/usr/bin/virsh list --all | grep ${n1k_vsm::vsmname} | grep -c running"),
+      require => Exec['Exec_Define_VSM'],
+    }
+  } else {
+    # For pacemker controlled deployment, set up the secondary VSM as well
+    # ensure tap interfaces and deploy the vsm
+    $ctrltap_s  = 'vsm-ctrl1'
+    $mgmttap_s  = 'vsm-mgmt1'
+    $pkttap_s   = 'vsm-pkt1'
+    # Generate MACs
+    $ctrlmac_s  = "52:54:${vmb[0]}${vmb[1]}:${vmb[2]}${vmb[3]}:${vmb[4]}${vmb[5]}:${vmb[6]}4"
+    $mgmtmac_s  = "52:54:${vmb[0]}${vmb[1]}:${vmb[2]}${vmb[3]}:${vmb[4]}${vmb[5]}:${vmb[6]}5"
+    $pktmac_s   = "52:54:${vmb[0]}${vmb[1]}:${vmb[2]}${vmb[3]}:${vmb[4]}${vmb[5]}:${vmb[6]}6"
 
-  Exec['Exec_create_disk'] -> File['File_Target_XML_File'] -> Exec['Exec_Define_VSM'] -> Exec['Exec_Launch_VSM']
+    exec { 'Exec_create_disk_Secondary':
+      command => "/usr/bin/qemu-img create -f raw ${n1k_vsm::diskfile_s} ${n1k_vsm::disksize}G",
+      creates => $n1k_vsm::diskfile_s,
+    }
+
+    $targetxmlfile_s = "/var/spool/cisco/vsm/vsm_${n1k_vsm::vsm_role_s}_deploy.xml"
+    file { 'File_Target_XML_File_Secondary':
+      path    => $targetxmlfile_s,
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0666',
+      seltype => 'virt_content_t',
+      content => template('n1k_vsm/vsm_vm_secondary.xml.erb'),
+      require => Exec['Exec_create_disk_Secondary'],
+    }
+  }
 }
diff --git a/n1k_vsm/manifests/init.pp b/n1k_vsm/manifests/init.pp
index a9ee4e83c..ddcd42d00 100644
--- a/n1k_vsm/manifests/init.pp
+++ b/n1k_vsm/manifests/init.pp
@@ -36,6 +36,24 @@
 # [*n1kv_version*]
 #  (required) Version of the Nexus1000v VSM
 #
+# [*pacemaker_control*]
+#  (optional) Set to determine if pacemaker will control the VSM. If true will deploy both
+#  primary and secondary VSMs on all nodes and will not start VSM. Defaults to false and
+#  thus is optional unless this functionality is being used.
+#
+# [*existing_bridge*]
+#  (required) If VSM should be installed behind an existing bridge, this should be set to
+#  true and the bridge name should be provided in phy_if_bridge.
+#
+# [*vsm_mac_base*]
+#  (optional) If set, provides randomization for the MAC addresses for the VSM VM(s).
+#  Should be a (random) hexadecimal number of at least 7 digits (more is fine).
+#
+# [*phy_bridge_vlan*]
+#  (optional) In the case that the management interface is a bridge with a tagged
+#  uplink port, the VLAN tag for that uplink port can be provided which will
+#  be applied on the patch port connecting vsm-br and the management bridge.
+#
 class n1k_vsm(
     $n1kv_source       = '',
     $n1kv_version      = 'latest',
@@ -47,6 +65,10 @@
     $vsm_mgmt_ip,
     $vsm_mgmt_netmask,
     $vsm_mgmt_gateway,
+    $pacemaker_control = false,
+    $existing_bridge   = false,
+    $vsm_mac_base      = '',
+    $phy_bridge_vlan   = 0,
 ) {
 
     if($::osfamily != 'Redhat') {
@@ -55,6 +77,15 @@
       fail("Unsupported osfamily ${::osfamily}")
     }
 
+    # Ensure role is set to primary for pacemaker controlled deployment
+    # Additionally setup the extra variables for the secondary VSM
+    if ($n1k_vsm::pacemaker_control) {
+      $vsm_role_s = 'secondary'
+      $vsmname_s  = 'vsm-s'
+      $imgfile_s  = "/var/spool/cisco/vsm/${vsm_role_s}_repacked.iso"
+      $diskfile_s = "/var/spool/cisco/vsm/${vsm_role_s}_disk"
+    }
+
     if ($n1k_vsm::vsm_role == 'primary') or ($n1k_vsm::vsm_role == 'standalone') {
       $vsmname          = 'vsm-p'
       $mgmtip           = $vsm_mgmt_ip
@@ -73,23 +104,22 @@
     $disksize           = 4
     $imgfile            = "/var/spool/cisco/vsm/${n1k_vsm::vsm_role}_repacked.iso"
     $diskfile           = "/var/spool/cisco/vsm/${n1k_vsm::vsm_role}_disk"
-    $ovsbridge          = 'vsm-br'
+
+    #Set bridge name properly
+    $ovsbridge        = 'vsm-br'
 
     #VSM installation will be done only once. Will not respond to puppet sync
-    $_phy_ip_addr       = inline_template("<%= scope.lookupvar('::ipaddress_${n1k_vsm::phy_if_bridge}') %>")
-    if $_phy_ip_addr != '' {
-      $phy_ip_addr      = inline_template("<%= scope.lookupvar('::ipaddress_${n1k_vsm::phy_if_bridge}') %>")
-      $phy_ip_mask      = inline_template("<%= scope.lookupvar('::netmask_${n1k_vsm::phy_if_bridge}') %>")
-      $gw_intf          = $n1k_vsm::phy_gateway
-      include n1k_vsm::pkgprep_ovscfg
+    $_check_phy_if_bridge = regsubst($n1k_vsm::phy_if_bridge, '[.:-]+', '_', 'G')
+    $_phy_mac_addr        = inline_template("<%= scope.lookupvar('::macaddress_${_check_phy_if_bridge}') %>")
+    if $_phy_mac_addr != '' {
+        include ::n1k_vsm::pkgprep_ovscfg
     }
 
     notify {"Arg: intf ${phy_if_bridge} vsm_role ${vsm_role} domainid ${vsm_domain_id}" : withpath => true}
-    notify {"ip ${phy_ip_addr} mask ${phy_ip_mask} gw ${n1k_vsm::phy_gateway}" : withpath => true}
-    notify {"gw_dv ${gw_intf} ovs ${ovsbridge} vsmname ${n1k_vsm::vsmname}" : withpath => true}
+    notify {"ovs ${ovsbridge} vsmname ${n1k_vsm::vsmname}" : withpath => true}
     notify {"mgmtip ${n1k_vsm::mgmtip} vsm_mask ${n1k_vsm::mgmtnetmask} vsm_gw ${n1k_vsm::mgmtgateway}": withpath => false}
 
-    include n1k_vsm::vsmprep
-    include n1k_vsm::deploy
+    include ::n1k_vsm::vsmprep
+    include ::n1k_vsm::deploy
     Class['n1k_vsm::vsmprep'] -> Class['n1k_vsm::deploy']
 }
diff --git a/n1k_vsm/manifests/pkgprep_ovscfg.pp b/n1k_vsm/manifests/pkgprep_ovscfg.pp
index 577cd9fb4..512646da3 100644
--- a/n1k_vsm/manifests/pkgprep_ovscfg.pp
+++ b/n1k_vsm/manifests/pkgprep_ovscfg.pp
@@ -4,8 +4,8 @@
 #
 class n1k_vsm::pkgprep_ovscfg
 {
-  require n1k_vsm
-  include n1k_vsm
+  require ::n1k_vsm
+  include ::n1k_vsm
 
   case $::osfamily {
     'RedHat': {
@@ -19,7 +19,7 @@
       # VSM dependent packages installation section
       package { 'Package_qemu-kvm':
         ensure => installed,
-        name   => 'qemu-kvm',
+        name   => 'qemu-kvm-rhev',
       }
 
       package {'Package_libvirt':
@@ -53,17 +53,8 @@
         unless  => '/usr/bin/virsh net-info default | /bin/grep -c \'Autostart: .* no\'',
       }
 
-      package { 'Package_ovs':
-        ensure => installed,
-        name   => 'openvswitch',
-      }
-
-      # bring up OVS and perform interface configuration
-      service { 'Service_ovs':
-        ensure => running,
-        name   => 'openvswitch',
-        enable => true,
-      }
+      # Ensure OVS is present
+      require vswitch::ovs
 
       package { 'genisoimage':
         ensure => installed,
@@ -71,62 +62,119 @@
       }
 
       notify { "Debug br ${n1k_vsm::ovsbridge} intf ${n1k_vsm::phy_if_bridge} ." : withpath => true }
-      notify { "Debug ${n1k_vsm::vsmname} ip ${n1k_vsm::phy_ip_addr} mask ${n1k_vsm::phy_ip_mask} gw_intf ${n1k_vsm::gw_intf}" : withpath => true }
-
-      # Check if we've already configured the ovs
-      if $n1k_vsm::gw_intf != $n1k_vsm::ovsbridge {
-        # Modify Ovs bridge inteface configuation file
-        augeas { 'Augeas_modify_ifcfg-ovsbridge':
-          name    => $n1k_vsm::ovsbridge,
-          context => "/files/etc/sysconfig/network-scripts/ifcfg-${n1k_vsm::ovsbridge}",
-          changes => [
-            'set TYPE OVSBridge',
-            "set DEVICE ${n1k_vsm::ovsbridge}",
-            'set DEVICETYPE ovs',
-            "set OVSREQUIRES ${n1k_vsm::ovsbridge}",
-            'set NM_CONTROLLED no',
-            'set BOOTPROTO none',
-            'set ONBOOT yes',
-            'set DEFROUTE yes',
-            'set MTU 1500',
-            "set NAME ${n1k_vsm::ovsbridge}",
-            "set IPADDR ${n1k_vsm::phy_ip_addr}",
-            "set NETMASK ${n1k_vsm::phy_ip_mask}",
-            "set GATEWAY ${n1k_vsm::phy_gateway}",
-            'set USERCTL no',
-          ],
+
+      $_ovsbridge     = regsubst($n1k_vsm::ovsbridge, '[.:-]+', '_', 'G')
+      $_ovsbridge_mac = inline_template("<%= scope.lookupvar('::macaddress_${_ovsbridge}') %>")
+
+      # Check if we've already configured the vsm bridge, skip configuration if so
+      if ($_ovsbridge_mac == '') {
+
+        #Gather info from the port/bridge including IP if needed
+        $_phy_if_bridge     = regsubst($n1k_vsm::phy_if_bridge, '[.:-]+', '_', 'G')
+        $_phy_ip_addr       = inline_template("<%= scope.lookupvar('::ipaddress_${_phy_if_bridge}') %>")
+        if $_phy_ip_addr != '' and !($n1k_vsm::existing_bridge) {
+          $phy_ip_addr      = inline_template("<%= scope.lookupvar('::ipaddress_${_phy_if_bridge}') %>")
+          $phy_ip_mask      = inline_template("<%= scope.lookupvar('::netmask_${_phy_if_bridge}') %>")
+          $gw_intf          = $n1k_vsm::phy_gateway
+
+          notify {"ip ${phy_ip_addr} mask ${phy_ip_mask} gw ${n1k_vsm::phy_gateway} gw_dv ${gw_intf}" : withpath => true}
+
+          # Modify Ovs bridge inteface configuation file (including IP)
+          augeas { 'Augeas_modify_ifcfg-ovsbridge':
+            name    => $n1k_vsm::ovsbridge,
+            context => "/files/etc/sysconfig/network-scripts/ifcfg-${n1k_vsm::ovsbridge}",
+            changes => [
+              'set TYPE OVSBridge',
+              "set DEVICE ${n1k_vsm::ovsbridge}",
+              'set DEVICETYPE ovs',
+              "set OVSREQUIRES ${n1k_vsm::ovsbridge}",
+              'set NM_CONTROLLED no',
+              'set BOOTPROTO none',
+              'set ONBOOT yes',
+              'set DEFROUTE yes',
+              'set MTU 1500',
+              "set NAME ${n1k_vsm::ovsbridge}",
+              "set IPADDR ${phy_ip_addr}",
+              "set NETMASK ${phy_ip_mask}",
+              "set GATEWAY ${n1k_vsm::phy_gateway}",
+              'set USERCTL no',
+            ],
+          }
+        } elsif ($n1k_vsm::existing_bridge) {
+          # Modify Ovs bridge inteface configuation file (without IP)
+          augeas { 'Augeas_modify_ifcfg-ovsbridge':
+            name    => $n1k_vsm::ovsbridge,
+            context => "/files/etc/sysconfig/network-scripts/ifcfg-${n1k_vsm::ovsbridge}",
+            changes => [
+              'set TYPE OVSBridge',
+              "set DEVICE ${n1k_vsm::ovsbridge}",
+              'set DEVICETYPE ovs',
+              "set OVSREQUIRES ${n1k_vsm::ovsbridge}",
+              'set NM_CONTROLLED no',
+              'set BOOTPROTO none',
+              'set ONBOOT yes',
+              'set DEFROUTE yes',
+              'set MTU 1500',
+              "set NAME ${n1k_vsm::ovsbridge}",
+              'set USERCTL no',
+            ],
+          }
+        } else {
+          # Error out here due to invalid interface specification
+          fail('Interface to be bridged for VSM must have IP address')
         }
 
-        # Modify Physical Interface config file
-        augeas { 'Augeas_modify_ifcfg-phy_if_bridge':
-          name    => $n1k_vsm::phy_if_bridge,
-          context => "/files/etc/sysconfig/network-scripts/ifcfg-${n1k_vsm::phy_if_bridge}",
-          changes => [
-            'set TYPE OVSPort',
-            "set DEVICE ${n1k_vsm::phy_if_bridge}",
-            'set DEVICETYPE ovs',
-            "set OVS_BRIDGE ${n1k_vsm::ovsbridge}",
-            'set NM_CONTROLLED no',
-            'set BOOTPROTO none',
-            'set ONBOOT yes',
-            "set NAME ${n1k_vsm::phy_if_bridge}",
-            'rm IPADDR',
-            'rm NETMASK',
-            'rm GATEWAY',
-            'set USERCTL no',
-          ],
-          notify  => Service['Service_network'],
+        exec { 'Flap_n1kv_bridge':
+          command => "/sbin/ifdown ${n1k_vsm::ovsbridge} && /sbin/ifup ${n1k_vsm::ovsbridge}",
+          require => Augeas['Augeas_modify_ifcfg-ovsbridge'],
         }
-        # Make sure that networking comes fine after reboot
-        file { 'Create_Init_File':
-          replace => 'yes',
-          path    => '/etc/init.d/n1kv',
-          owner   => 'root',
-          group   => 'root',
-          mode    => '0775',
-          source  => 'puppet:///modules/n1k_vsm/n1kv',
+
+        if !($n1k_vsm::existing_bridge) {
+          # If there isn't an existing bridge, the interface is a port, and we
+          # need to add it to vsm-br
+
+          # Modify Physical Interface config file
+          augeas { 'Augeas_modify_ifcfg-phy_if_bridge':
+            name    => $n1k_vsm::phy_if_bridge,
+            context => "/files/etc/sysconfig/network-scripts/ifcfg-${n1k_vsm::phy_if_bridge}",
+            changes => [
+              'set TYPE OVSPort',
+              "set DEVICE ${n1k_vsm::phy_if_bridge}",
+              'set DEVICETYPE ovs',
+              "set OVS_BRIDGE ${n1k_vsm::ovsbridge}",
+              'set NM_CONTROLLED no',
+              'set BOOTPROTO none',
+              'set ONBOOT yes',
+              "set NAME ${n1k_vsm::phy_if_bridge}",
+              'set DEFROUTE no',
+              'set IPADDR ""',
+              'rm NETMASK',
+              'rm GATEWAY',
+              'set USERCTL no',
+            ],
+          }
+          exec { 'Flap_n1kv_phy_if':
+            command => "/sbin/ifdown ${n1k_vsm::phy_if_bridge} && /sbin/ifup ${n1k_vsm::phy_if_bridge}",
+            require => Augeas['Augeas_modify_ifcfg-phy_if_bridge'],
+          }
+        } else {
+          # If there is an existing bridge- create patch ports to connect vsm-br to it
+          exec { 'Create_patch_port_on_existing_bridge':
+            command => "/bin/ovs-vsctl --may-exist add-port ${n1k_vsm::phy_if_bridge} ${n1k_vsm::phy_if_bridge}-${n1k_vsm::ovsbridge} -- set Interface ${n1k_vsm::phy_if_bridge}-${n1k_vsm::ovsbridge} type=patch options:peer=${n1k_vsm::ovsbridge}-${n1k_vsm::phy_if_bridge}",
+            require => Exec['Flap_n1kv_bridge'],
+          }
+          exec { 'Create_patch_port_on_vsm_bridge':
+            command => "/bin/ovs-vsctl --may-exist add-port ${n1k_vsm::ovsbridge} ${n1k_vsm::ovsbridge}-${n1k_vsm::phy_if_bridge} -- set Interface ${n1k_vsm::ovsbridge}-${n1k_vsm::phy_if_bridge} type=patch options:peer=${n1k_vsm::phy_if_bridge}-${n1k_vsm::ovsbridge}",
+            require => Exec['Flap_n1kv_bridge'],
+          }
+          if ($n1k_vsm::phy_bridge_vlan > 0) and ($n1k_vsm::phy_bridge_vlan < 4096) {
+            exec { 'Tag_patch_port':
+              command => "/bin/ovs-vsctl set port ${n1k_vsm::phy_if_bridge}-${n1k_vsm::ovsbridge} tag=${n1k_vsm::phy_bridge_vlan}",
+              require => Exec['Create_patch_port_on_existing_bridge'],
+            }
+          }
         }
-      }  # endif of if "${n1k_vsm::gw_intf}" != "${n1k_vsm::ovsbridge}"
+      } # endif of if ($_ovsbridge_mac == '')
     }
     'Ubuntu': {
     }
diff --git a/n1k_vsm/manifests/vsmprep.pp b/n1k_vsm/manifests/vsmprep.pp
index 32447022f..f26f9e004 100644
--- a/n1k_vsm/manifests/vsmprep.pp
+++ b/n1k_vsm/manifests/vsmprep.pp
@@ -5,9 +5,9 @@
 #
 class n1k_vsm::vsmprep
 {
-  include 'stdlib'
-  require n1k_vsm
-  include n1k_vsm
+  include ::stdlib
+  require ::n1k_vsm
+  include ::n1k_vsm
 
   # prepare vsm folders
   ensure_resource('file', '/var/spool/cisco/', {
@@ -35,12 +35,9 @@
     }
   } else {
     $vsmimage_uri   = 'unspec'
+    $vsm_path       = '/opt/cisco/vsm'
   }
 
-#  exec { 'Prev_VSM':
-#    command => "/bin/rm -f /var/spool/cisco/vsm/* || /bin/true",
-#  }
-
   if $vsmimage_uri == 'file' {
     #specify location on target-host where image file will be downloaded to.
     file { $vsmtgtimg:
@@ -63,8 +60,9 @@
       }
     }
     package {'nexus-1000v-iso':
-        ensure => $n1k_vsm::n1kv_version,
-        name   => 'nexus-1000v-iso'
+        ensure   => 'present',
+        name     => 'nexus-1000v-iso',
+        provider => 'yum',
     }
   }
 
@@ -78,10 +76,30 @@
     source => 'puppet:///modules/n1k_vsm/repackiso.py',
   }
 
+  # copy the latest VSM image to known name
+  if $n1k_vsm::n1kv_version == '' or $n1k_vsm::n1kv_version == 'latest'{
+    exec { 'Exec_VSM_Rename':
+      command => "/bin/cp ${vsm_path}/`/bin/ls ${vsm_path} | /bin/sort -r | /bin/grep -m 1 iso` ${vsm_path}/current-n1000v.iso",
+      creates => "${vsm_path}/current-n1000v.iso",
+    }
+  } else {
+    exec { 'Exec_VSM_Rename_with_version':
+      command => "/bin/cp ${vsm_path}/n1000v-dk9.${n1k_vsm::n1kv_version}.iso ${vsm_path}/current-n1000v.iso",
+      creates => "${vsm_path}/current-n1000v.iso",
+    }
+  }
+
   # Now generate ovf xml file and repackage the iso
   exec { 'Exec_VSM_Repackage_Script':
-    command => "/tmp/repackiso.py -i/var/spool/cisco/vsm/${n1k_vsm::n1kv_version}.iso -d${n1k_vsm::vsm_domain_id} -n${n1k_vsm::vsmname} -m${n1k_vsm::mgmtip} -s${n1k_vsm::mgmtnetmask} -g${n1k_vsm::mgmtgateway} -p${n1k_vsm::vsm_admin_passwd} -r${n1k_vsm::vsm_role} -f/var/spool/cisco/vsm/${n1k_vsm::vsm_role}_repacked.iso ",
-    unless  => "/usr/bin/virsh list --all | grep -c ${n1k_vsm::vsmname}",
+    command => "/tmp/repackiso.py -i${vsm_path}/current-n1000v.iso -d${n1k_vsm::vsm_domain_id} -n${n1k_vsm::vsmname} -m${n1k_vsm::mgmtip} -s${n1k_vsm::mgmtnetmask} -g${n1k_vsm::mgmtgateway} -p${n1k_vsm::vsm_admin_passwd} -r${n1k_vsm::vsm_role} -f/var/spool/cisco/vsm/${n1k_vsm::vsm_role}_repacked.iso",
+    creates => "/var/spool/cisco/vsm/${n1k_vsm::vsm_role}_repacked.iso",
   }
 
+  # If we're under pacemaker_control, create a secondary VSM iso as well
+  if ($n1k_vsm::pacemaker_control) {
+    exec { 'Exec_VSM_Repackage_Script_secondary':
+      command => "/tmp/repackiso.py -i${vsm_path}/current-n1000v.iso -d${n1k_vsm::vsm_domain_id} -n${n1k_vsm::vsmname_s} -m${n1k_vsm::mgmtip} -s${n1k_vsm::mgmtnetmask} -g${n1k_vsm::mgmtgateway} -p${n1k_vsm::vsm_admin_passwd} -r${n1k_vsm::vsm_role_s} -f/var/spool/cisco/vsm/${n1k_vsm::vsm_role_s}_repacked.iso",
+      creates => "/var/spool/cisco/vsm/${n1k_vsm::vsm_role_s}_repacked.iso",
+    }
+  }
 }
diff --git a/n1k_vsm/spec/acceptance/nodesets/centos-70-x64.yml b/n1k_vsm/spec/acceptance/nodesets/centos-70-x64.yml
new file mode 100644
index 000000000..5f097e9fe
--- /dev/null
+++ b/n1k_vsm/spec/acceptance/nodesets/centos-70-x64.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  centos-server-70-x64:
+    roles:
+      - master
+    platform: el-7-x86_64
+    box: puppetlabs/centos-7.0-64-nocm
+    box_url: https://vagrantcloud.com/puppetlabs/centos-7.0-64-nocm
+    hypervisor: vagrant
+CONFIG:
+  log_level: debug
+  type: foss
diff --git a/n1k_vsm/spec/acceptance/nodesets/default.yml b/n1k_vsm/spec/acceptance/nodesets/default.yml
new file mode 100644
index 000000000..3bb3e6264
--- /dev/null
+++ b/n1k_vsm/spec/acceptance/nodesets/default.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  ubuntu-server-1404-x64:
+    roles:
+      - master
+    platform: ubuntu-14.04-amd64
+    box: puppetlabs/ubuntu-14.04-64-nocm
+    box_url: https://vagrantcloud.com/puppetlabs/ubuntu-14.04-64-nocm
+    hypervisor: vagrant
+CONFIG:
+  log_level: debug
+  type: git
diff --git a/n1k_vsm/spec/acceptance/nodesets/nodepool-centos7.yml b/n1k_vsm/spec/acceptance/nodesets/nodepool-centos7.yml
new file mode 100644
index 000000000..c55287420
--- /dev/null
+++ b/n1k_vsm/spec/acceptance/nodesets/nodepool-centos7.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  centos-70-x64:
+    roles:
+      - master
+    platform: el-7-x86_64
+    hypervisor: none
+    ip: 127.0.0.1
+CONFIG:
+  type: foss
+  set_env: false
diff --git a/n1k_vsm/spec/acceptance/nodesets/nodepool-trusty.yml b/n1k_vsm/spec/acceptance/nodesets/nodepool-trusty.yml
new file mode 100644
index 000000000..7f503cadd
--- /dev/null
+++ b/n1k_vsm/spec/acceptance/nodesets/nodepool-trusty.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  ubuntu-1404-x64:
+    roles:
+      - master
+    platform: ubuntu-14.04-amd64
+    hypervisor: none
+    ip: 127.0.0.1
+CONFIG:
+  type: foss
+  set_env: false
diff --git a/n1k_vsm/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml b/n1k_vsm/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
new file mode 100644
index 000000000..3bb3e6264
--- /dev/null
+++ b/n1k_vsm/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  ubuntu-server-1404-x64:
+    roles:
+      - master
+    platform: ubuntu-14.04-amd64
+    box: puppetlabs/ubuntu-14.04-64-nocm
+    box_url: https://vagrantcloud.com/puppetlabs/ubuntu-14.04-64-nocm
+    hypervisor: vagrant
+CONFIG:
+  log_level: debug
+  type: git
diff --git a/n1k_vsm/spec/classes/n1kv_vsm_pkgprep_ovscfg_spec.rb b/n1k_vsm/spec/classes/n1kv_vsm_pkgprep_ovscfg_spec.rb
new file mode 100644
index 000000000..3f01a0848
--- /dev/null
+++ b/n1k_vsm/spec/classes/n1kv_vsm_pkgprep_ovscfg_spec.rb
@@ -0,0 +1,292 @@
+#
+# Copyright (C) 2015 Cisco Systems Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'n1k_vsm::pkgprep_ovscfg' do
+
+  let :params do
+    {  }
+  end
+
+  shared_examples_for 'n1k vsm pkgprep_ovscfg' do
+
+    context 'for default values' do
+      let :pre_condition do
+        "class { 'n1k_vsm':
+           phy_if_bridge     => 'eth0',
+           phy_gateway       => '1.1.1.3',
+           vsm_domain_id     => '1',
+           vsm_admin_passwd  => 'secrete',
+           vsm_mgmt_ip       => '1.1.1.1',
+           vsm_mgmt_netmask  => '255.255.255.0',
+           vsm_mgmt_gateway  => '1.1.1.2',
+           existing_bridge   => false,
+         }"
+      end
+      let :facts do
+        {
+          :ipaddress_eth0 => '1.1.1.1',
+          :netmask_eth0 => '255.255.255.0',
+          :osfamily => 'RedHat'
+        }
+      end
+
+      it 'should require vswitch::ovs' do
+         is_expected.to contain_class('vswitch::ovs')
+      end
+
+      it 'create ovs bridge' do
+        is_expected.to contain_augeas('Augeas_modify_ifcfg-ovsbridge').with(
+          'name'    => 'vsm-br',
+          'context' => '/files/etc/sysconfig/network-scripts/ifcfg-vsm-br',
+          'changes' => ['set TYPE OVSBridge',
+              'set DEVICE vsm-br',
+              'set DEVICETYPE ovs',
+              'set OVSREQUIRES vsm-br',
+              'set NM_CONTROLLED no',
+              'set BOOTPROTO none',
+              'set ONBOOT yes',
+              'set DEFROUTE yes',
+              'set MTU 1500',
+              'set NAME vsm-br',
+              'set IPADDR 1.1.1.1',
+              'set NETMASK 255.255.255.0',
+              'set GATEWAY 1.1.1.3',
+              'set USERCTL no']
+        )
+      end
+
+      it 'flap bridge' do
+        is_expected.to contain_exec('Flap_n1kv_bridge').with(
+          'command'  => '/sbin/ifdown vsm-br && /sbin/ifup vsm-br',
+        ).that_requires('Augeas[Augeas_modify_ifcfg-ovsbridge]')
+      end
+
+      it 'attach phy if port to bridge' do
+        is_expected.to contain_augeas('Augeas_modify_ifcfg-phy_if_bridge').with(
+          'name'    => 'eth0',
+          'context' => '/files/etc/sysconfig/network-scripts/ifcfg-eth0',
+        )
+      end
+
+      it 'flap port' do
+        is_expected.to contain_exec('Flap_n1kv_phy_if').with(
+          'command'  => '/sbin/ifdown eth0 && /sbin/ifup eth0',
+        ).that_requires('Augeas[Augeas_modify_ifcfg-phy_if_bridge]')
+      end
+    end
+
+    context 'for existing bridge' do
+      let :pre_condition do
+        "class { 'n1k_vsm':
+           phy_if_bridge     => 'br_ex',
+           phy_gateway       => '1.1.1.3',
+           vsm_domain_id     => '1',
+           vsm_admin_passwd  => 'secrete',
+           vsm_mgmt_ip       => '1.1.1.1',
+           vsm_mgmt_netmask  => '255.255.255.0',
+           vsm_mgmt_gateway  => '1.1.1.2',
+           existing_bridge   => true,
+         }"
+      end
+      let :facts do
+        {
+          :ipaddress_br_ex => '1.1.1.6',
+          :osfamily        => 'RedHat'
+        }
+      end
+
+      it 'should require vswitch::ovs' do
+         is_expected.to contain_class('vswitch::ovs')
+      end
+
+      it 'create ovs bridge' do
+        is_expected.to contain_augeas('Augeas_modify_ifcfg-ovsbridge').with(
+          'name'    => 'vsm-br',
+          'context' => '/files/etc/sysconfig/network-scripts/ifcfg-vsm-br',
+          'changes' => ['set TYPE OVSBridge',
+              'set DEVICE vsm-br',
+              'set DEVICETYPE ovs',
+              'set OVSREQUIRES vsm-br',
+              'set NM_CONTROLLED no',
+              'set BOOTPROTO none',
+              'set ONBOOT yes',
+              'set DEFROUTE yes',
+              'set MTU 1500',
+              'set NAME vsm-br',
+              'set USERCTL no']
+        )
+      end
+
+      it 'flap bridge' do
+        is_expected.to contain_exec('Flap_n1kv_bridge').with(
+          'command'  => '/sbin/ifdown vsm-br && /sbin/ifup vsm-br',
+        ).that_requires('Augeas[Augeas_modify_ifcfg-ovsbridge]')
+      end
+
+      it 'create patch port on existing bridge' do
+        is_expected.to contain_exec('Create_patch_port_on_existing_bridge').with(
+          'command' => '/bin/ovs-vsctl --may-exist add-port br_ex br_ex-vsm-br -- set Interface br_ex-vsm-br type=patch options:peer=vsm-br-br_ex'
+        ).that_requires('Exec[Flap_n1kv_bridge]')
+      end
+
+      it 'create patch port on vsm bridge' do
+        is_expected.to contain_exec('Create_patch_port_on_vsm_bridge').with(
+          'command' => '/bin/ovs-vsctl --may-exist add-port vsm-br vsm-br-br_ex -- set Interface vsm-br-br_ex type=patch options:peer=br_ex-vsm-br'
+        ).that_requires('Exec[Flap_n1kv_bridge]')
+      end
+    end
+
+    context 'for existing bridge no ip' do
+      let :pre_condition do
+        "class { 'n1k_vsm':
+           phy_if_bridge     => 'br_ex',
+           phy_gateway       => '1.1.1.3',
+           vsm_domain_id     => '1',
+           vsm_admin_passwd  => 'secrete',
+           vsm_mgmt_ip       => '1.1.1.1',
+           vsm_mgmt_netmask  => '255.255.255.0',
+           vsm_mgmt_gateway  => '1.1.1.2',
+           existing_bridge   => true,
+         }"
+      end
+      let :facts do
+        {
+          :osfamily        => 'RedHat'
+        }
+      end
+
+      it 'should require vswitch::ovs' do
+         is_expected.to contain_class('vswitch::ovs')
+      end
+
+      it 'create ovs bridge' do
+        is_expected.to contain_augeas('Augeas_modify_ifcfg-ovsbridge').with(
+          'name'    => 'vsm-br',
+          'context' => '/files/etc/sysconfig/network-scripts/ifcfg-vsm-br',
+          'changes' => ['set TYPE OVSBridge',
+              'set DEVICE vsm-br',
+              'set DEVICETYPE ovs',
+              'set OVSREQUIRES vsm-br',
+              'set NM_CONTROLLED no',
+              'set BOOTPROTO none',
+              'set ONBOOT yes',
+              'set DEFROUTE yes',
+              'set MTU 1500',
+              'set NAME vsm-br',
+              'set USERCTL no']
+        )
+      end
+
+      it 'flap bridge' do
+        is_expected.to contain_exec('Flap_n1kv_bridge').with(
+          'command'  => '/sbin/ifdown vsm-br && /sbin/ifup vsm-br',
+        ).that_requires('Augeas[Augeas_modify_ifcfg-ovsbridge]')
+      end
+
+      it 'create patch port on existing bridge' do
+        is_expected.to contain_exec('Create_patch_port_on_existing_bridge').with(
+          'command' => '/bin/ovs-vsctl --may-exist add-port br_ex br_ex-vsm-br -- set Interface br_ex-vsm-br type=patch options:peer=vsm-br-br_ex'
+        ).that_requires('Exec[Flap_n1kv_bridge]')
+      end
+
+      it 'create patch port on vsm bridge' do
+        is_expected.to contain_exec('Create_patch_port_on_vsm_bridge').with(
+          'command' => '/bin/ovs-vsctl --may-exist add-port vsm-br vsm-br-br_ex -- set Interface vsm-br-br_ex type=patch options:peer=br_ex-vsm-br'
+        ).that_requires('Exec[Flap_n1kv_bridge]')
+      end
+    end
+
+    context 'for existing bridge tagged' do
+      let :pre_condition do
+        "class { 'n1k_vsm':
+           phy_if_bridge     => 'br_ex',
+           phy_gateway       => '1.1.1.3',
+           vsm_domain_id     => '1',
+           vsm_admin_passwd  => 'secrete',
+           vsm_mgmt_ip       => '1.1.1.1',
+           vsm_mgmt_netmask  => '255.255.255.0',
+           vsm_mgmt_gateway  => '1.1.1.2',
+           existing_bridge   => true,
+           phy_bridge_vlan   => 100,
+         }"
+      end
+      let :facts do
+        {
+          :ipaddress_br_ex => '1.1.1.6',
+          :osfamily        => 'RedHat'
+        }
+      end
+
+      it 'should require vswitch::ovs' do
+         is_expected.to contain_class('vswitch::ovs')
+      end
+
+      it 'create ovs bridge' do
+        is_expected.to contain_augeas('Augeas_modify_ifcfg-ovsbridge').with(
+          'name'    => 'vsm-br',
+          'context' => '/files/etc/sysconfig/network-scripts/ifcfg-vsm-br',
+          'changes' => ['set TYPE OVSBridge',
+              'set DEVICE vsm-br',
+              'set DEVICETYPE ovs',
+              'set OVSREQUIRES vsm-br',
+              'set NM_CONTROLLED no',
+              'set BOOTPROTO none',
+              'set ONBOOT yes',
+              'set DEFROUTE yes',
+              'set MTU 1500',
+              'set NAME vsm-br',
+              'set USERCTL no']
+        )
+      end
+
+      it 'flap bridge' do
+        is_expected.to contain_exec('Flap_n1kv_bridge').with(
+          'command'  => '/sbin/ifdown vsm-br && /sbin/ifup vsm-br',
+        ).that_requires('Augeas[Augeas_modify_ifcfg-ovsbridge]')
+      end
+
+      it 'create patch port on existing bridge' do
+        is_expected.to contain_exec('Create_patch_port_on_existing_bridge').with(
+          'command' => '/bin/ovs-vsctl --may-exist add-port br_ex br_ex-vsm-br -- set Interface br_ex-vsm-br type=patch options:peer=vsm-br-br_ex'
+        ).that_requires('Exec[Flap_n1kv_bridge]')
+      end
+
+      it 'create patch port on vsm bridge' do
+        is_expected.to contain_exec('Create_patch_port_on_vsm_bridge').with(
+          'command' => '/bin/ovs-vsctl --may-exist add-port vsm-br vsm-br-br_ex -- set Interface vsm-br-br_ex type=patch options:peer=br_ex-vsm-br'
+        ).that_requires('Exec[Flap_n1kv_bridge]')
+      end
+
+      it 'tag patch port' do
+        is_expected.to contain_exec('Tag_patch_port').with(
+          'command' => '/bin/ovs-vsctl set port br_ex-vsm-br tag=100'
+        ).that_requires('Exec[Create_patch_port_on_existing_bridge]')
+      end
+    end
+  end
+
+  context 'on RedHat platforms' do
+    let :facts do
+      { :osfamily => 'RedHat' }
+    end
+
+    it_configures 'n1k vsm pkgprep_ovscfg'
+  end
+
+end
+
diff --git a/n1k_vsm/spec/classes/n1kv_vsm_spec.rb b/n1k_vsm/spec/classes/n1kv_vsm_spec.rb
new file mode 100644
index 000000000..564802b6d
--- /dev/null
+++ b/n1k_vsm/spec/classes/n1kv_vsm_spec.rb
@@ -0,0 +1,21 @@
+#
+# Copyright (C) 2015 eNovance SAS <licensing@enovance.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'n1k_vsm' do
+
+end
diff --git a/n1k_vsm/spec/classes/n1kv_vsm_vsmprep_spec.rb b/n1k_vsm/spec/classes/n1kv_vsm_vsmprep_spec.rb
new file mode 100644
index 000000000..84500f718
--- /dev/null
+++ b/n1k_vsm/spec/classes/n1kv_vsm_vsmprep_spec.rb
@@ -0,0 +1,243 @@
+#
+# Copyright (C) 2015 Cisco Systems Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+
+require 'spec_helper'
+
+describe 'n1k_vsm::vsmprep' do
+
+  let :params do
+    { }
+  end
+
+  shared_examples_for 'n1k vsm prep' do
+
+    context 'get vsm from file' do
+      let :pre_condition do
+        "class { 'n1k_vsm':
+           phy_gateway      => '1.1.1.3',
+           vsm_domain_id    => '1',
+           vsm_admin_passwd => 'secrete',
+           vsm_mgmt_ip      => '1.1.1.1',
+           vsm_mgmt_netmask => '255.255.255.0',
+           vsm_mgmt_gateway => '1.1.1.2',
+           n1kv_version     => '5.2.1.SK3.2.2a-1',
+           n1kv_source      => 'vsm_test',
+           vsm_role         => 'primary',
+         }"
+      end
+
+      it 'gets vsm from file' do
+        is_expected.to contain_file('/var/spool/cisco/vsm/vsm_test').with(
+          'source' => 'puppet:///modules/n1k_vsm/vsm_test',
+        )
+      end
+
+      it 'runs repackage iso script' do
+        is_expected.to contain_exec('Exec_VSM_Repackage_Script').with(
+          :command => '/tmp/repackiso.py -i/var/spool/cisco/vsm/current-n1000v.iso -d1 -nvsm-p -m1.1.1.1 -s255.255.255.0 -g1.1.1.2 -psecrete -rprimary -f/var/spool/cisco/vsm/primary_repacked.iso',
+          :creates => '/var/spool/cisco/vsm/primary_repacked.iso'
+        )
+      end
+    end
+
+    context 'get vsm from specified repo' do
+      let :pre_condition do
+        "class { 'n1k_vsm':
+           phy_gateway      => '1.1.1.3',
+           vsm_domain_id    => '1',
+           vsm_admin_passwd => 'secrete',
+           vsm_mgmt_ip      => '1.1.1.1',
+           vsm_mgmt_netmask => '255.255.255.0',
+           vsm_mgmt_gateway => '1.1.1.2',
+           n1kv_version     => '5.2.1.SK3.2.2a-1',
+           n1kv_source      => 'http://vsm_test',
+           vsm_role         => 'primary',
+         }"
+      end
+
+      it 'configures specified repo' do
+        is_expected.to contain_yumrepo('cisco-vsm-repo').with(
+          'baseurl' => 'http://vsm_test',
+          'gpgkey'  => 'http://vsm_test/RPM-GPG-KEY'
+        )
+      end
+
+      # Currently we always just check if VSM is present
+      it 'installs latest n1kv sofware' do
+        is_expected.to contain_package('nexus-1000v-iso').with(
+          :ensure  => 'present',
+        )
+      end
+      it 'runs repackage iso script' do
+        is_expected.to contain_exec('Exec_VSM_Repackage_Script').with(
+          :command => '/tmp/repackiso.py -i/opt/cisco/vsm/current-n1000v.iso -d1 -nvsm-p -m1.1.1.1 -s255.255.255.0 -g1.1.1.2 -psecrete -rprimary -f/var/spool/cisco/vsm/primary_repacked.iso',
+          :creates => '/var/spool/cisco/vsm/primary_repacked.iso'
+        )
+      end
+    end
+
+    context 'get vsm from pre-configured repo' do
+      let :pre_condition do
+        "class { 'n1k_vsm':
+           phy_gateway      => '1.1.1.3',
+           vsm_domain_id    => '1',
+           vsm_admin_passwd => 'secrete',
+           vsm_mgmt_ip      => '1.1.1.1',
+           vsm_mgmt_netmask => '255.255.255.0',
+           vsm_mgmt_gateway => '1.1.1.2',
+           n1kv_version     => '5.2.1.SK3.2.2a-1',
+           vsm_role         => 'primary',
+         }"
+      end
+
+      # Currently we always just check if VSM is present
+      it 'installs latest n1kv sofware' do
+        is_expected.to contain_package('nexus-1000v-iso').with(
+          :ensure  => 'present',
+        )
+      end
+
+      it 'runs repackage iso script' do
+        is_expected.to contain_exec('Exec_VSM_Repackage_Script').with(
+          :command => '/tmp/repackiso.py -i/opt/cisco/vsm/current-n1000v.iso -d1 -nvsm-p -m1.1.1.1 -s255.255.255.0 -g1.1.1.2 -psecrete -rprimary -f/var/spool/cisco/vsm/primary_repacked.iso',
+          :creates => '/var/spool/cisco/vsm/primary_repacked.iso'
+        )
+      end
+    end
+
+    context 'get vsm from pre-configured repo secondary' do
+      let :pre_condition do
+        "class { 'n1k_vsm':
+           phy_gateway      => '1.1.1.3',
+           vsm_domain_id    => '1',
+           vsm_admin_passwd => 'secrete',
+           vsm_mgmt_ip      => '1.1.1.1',
+           vsm_mgmt_netmask => '255.255.255.0',
+           vsm_mgmt_gateway => '1.1.1.2',
+           n1kv_version     => '5.2.1.SK3.2.2a-1',
+           vsm_role         => 'secondary',
+         }"
+      end
+
+      # Currently we always just check if VSM is present
+      it 'installs latest n1kv sofware' do
+        is_expected.to contain_package('nexus-1000v-iso').with(
+          :ensure  => 'present',
+        )
+      end
+
+      it 'runs repackage iso script' do
+        is_expected.to contain_exec('Exec_VSM_Repackage_Script').with(
+          :command => '/tmp/repackiso.py -i/opt/cisco/vsm/current-n1000v.iso -d1 -nvsm-s -m0.0.0.0 -s0.0.0.0 -g0.0.0.0 -psecrete -rsecondary -f/var/spool/cisco/vsm/secondary_repacked.iso',
+          :creates => '/var/spool/cisco/vsm/secondary_repacked.iso'
+        )
+      end
+    end
+
+    context 'get vsm from pre-configured repo pacemaker controlled' do
+      let :pre_condition do
+        "class { 'n1k_vsm':
+           phy_gateway      => '1.1.1.3',
+           vsm_domain_id    => '1',
+           vsm_admin_passwd => 'secrete',
+           vsm_mgmt_ip      => '1.1.1.1',
+           vsm_mgmt_netmask => '255.255.255.0',
+           vsm_mgmt_gateway => '1.1.1.2',
+           n1kv_version     => '5.2.1.SK3.2.2a-1',
+           pacemaker_control => true,
+         }"
+      end
+
+      # Currently we always just check if VSM is present
+      it 'installs latest n1kv sofware' do
+        is_expected.to contain_package('nexus-1000v-iso').with(
+          :ensure  => 'present',
+        )
+      end
+
+      it 'runs rename with version' do
+        is_expected.to contain_exec('Exec_VSM_Rename_with_version').with(
+          :command => '/bin/cp /opt/cisco/vsm/n1000v-dk9.5.2.1.SK3.2.2a-1.iso /opt/cisco/vsm/current-n1000v.iso',
+          :creates => '/opt/cisco/vsm/current-n1000v.iso'
+        )
+      end
+
+      it 'runs repackage iso script' do
+        is_expected.to contain_exec('Exec_VSM_Repackage_Script').with(
+          :command => '/tmp/repackiso.py -i/opt/cisco/vsm/current-n1000v.iso -d1 -nvsm-p -m1.1.1.1 -s255.255.255.0 -g1.1.1.2 -psecrete -rprimary -f/var/spool/cisco/vsm/primary_repacked.iso',
+          :creates => '/var/spool/cisco/vsm/primary_repacked.iso'
+        )
+      end
+
+      it 'runs repackage iso script secondary' do
+        is_expected.to contain_exec('Exec_VSM_Repackage_Script_secondary').with(
+          :command => '/tmp/repackiso.py -i/opt/cisco/vsm/current-n1000v.iso -d1 -nvsm-s -m1.1.1.1 -s255.255.255.0 -g1.1.1.2 -psecrete -rsecondary -f/var/spool/cisco/vsm/secondary_repacked.iso',
+          :creates => '/var/spool/cisco/vsm/secondary_repacked.iso'
+        )
+      end
+    end
+    context 'get vsm from pre-configured repo pacemaker controlled latest version' do
+      let :pre_condition do
+        "class { 'n1k_vsm':
+           phy_gateway      => '1.1.1.3',
+           vsm_domain_id    => '1',
+           vsm_admin_passwd => 'secrete',
+           vsm_mgmt_ip      => '1.1.1.1',
+           vsm_mgmt_netmask => '255.255.255.0',
+           vsm_mgmt_gateway => '1.1.1.2',
+           n1kv_version     => 'latest',
+           pacemaker_control => true,
+         }"
+      end
+
+      # Currently we always just check if VSM is present
+      it 'installs latest n1kv sofware' do
+        is_expected.to contain_package('nexus-1000v-iso').with(
+          :ensure  => 'present',
+        )
+      end
+
+      it 'runs rename without version' do
+        is_expected.to contain_exec('Exec_VSM_Rename').with(
+          :creates => '/opt/cisco/vsm/current-n1000v.iso'
+        )
+      end
+
+      it 'runs repackage iso script' do
+        is_expected.to contain_exec('Exec_VSM_Repackage_Script').with(
+          :command => '/tmp/repackiso.py -i/opt/cisco/vsm/current-n1000v.iso -d1 -nvsm-p -m1.1.1.1 -s255.255.255.0 -g1.1.1.2 -psecrete -rprimary -f/var/spool/cisco/vsm/primary_repacked.iso',
+          :creates => '/var/spool/cisco/vsm/primary_repacked.iso'
+        )
+      end
+
+      it 'runs repackage iso script secondary' do
+        is_expected.to contain_exec('Exec_VSM_Repackage_Script_secondary').with(
+          :command => '/tmp/repackiso.py -i/opt/cisco/vsm/current-n1000v.iso -d1 -nvsm-s -m1.1.1.1 -s255.255.255.0 -g1.1.1.2 -psecrete -rsecondary -f/var/spool/cisco/vsm/secondary_repacked.iso',
+          :creates => '/var/spool/cisco/vsm/secondary_repacked.iso'
+        )
+      end
+    end
+  end
+
+  context 'on RedHat platforms' do
+    let :facts do
+      { :osfamily => 'RedHat' }
+    end
+
+    it_configures 'n1k vsm prep'
+  end
+
+end
diff --git a/n1k_vsm/spec/shared_examples.rb b/n1k_vsm/spec/shared_examples.rb
new file mode 100644
index 000000000..fec0eacc9
--- /dev/null
+++ b/n1k_vsm/spec/shared_examples.rb
@@ -0,0 +1,5 @@
+shared_examples_for "a Puppet::Error" do |description|
+  it "with message matching #{description.inspect}" do
+    expect { is_expected.to have_class_count(1) }.to raise_error(Puppet::Error, description)
+  end
+end
diff --git a/n1k_vsm/spec/spec_helper.rb b/n1k_vsm/spec/spec_helper.rb
new file mode 100644
index 000000000..700be6a27
--- /dev/null
+++ b/n1k_vsm/spec/spec_helper.rb
@@ -0,0 +1,19 @@
+require 'puppetlabs_spec_helper/module_spec_helper'
+require 'shared_examples'
+require 'webmock/rspec'
+
+RSpec.configure do |c|
+  c.alias_it_should_behave_like_to :it_configures, 'configures'
+  c.alias_it_should_behave_like_to :it_raises, 'raises'
+
+  c.default_facts = {
+    :kernel         => 'Linux',
+    :concat_basedir => '/var/lib/puppet/concat',
+    :memorysize     => '1000 MB',
+    :processorcount => '1',
+    :puppetversion  => '3.7.3',
+    :uniqueid       => '123'
+  }
+end
+
+at_exit { RSpec::Puppet::Coverage.report! }
diff --git a/n1k_vsm/spec/spec_helper_acceptance.rb b/n1k_vsm/spec/spec_helper_acceptance.rb
new file mode 100644
index 000000000..429e807c4
--- /dev/null
+++ b/n1k_vsm/spec/spec_helper_acceptance.rb
@@ -0,0 +1,56 @@
+require 'beaker-rspec'
+require 'beaker/puppet_install_helper'
+
+run_puppet_install_helper
+
+RSpec.configure do |c|
+  # Project root
+  proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+  modname = JSON.parse(open('metadata.json').read)['name'].split('-')[1]
+
+  # Readable test descriptions
+  c.formatter = :documentation
+
+  # Configure all nodes in nodeset
+  c.before :suite do
+    # Install module and dependencies
+    hosts.each do |host|
+
+      # install git
+      install_package host, 'git'
+
+      zuul_ref = ENV['ZUUL_REF']
+      zuul_branch = ENV['ZUUL_BRANCH']
+      zuul_url = ENV['ZUUL_URL']
+
+      repo = 'openstack/puppet-openstack-integration'
+
+      # Start out with clean moduledir, don't trust r10k to purge it
+      on host, "rm -rf /etc/puppet/modules/*"
+      # Install dependent modules via git or zuul
+      r = on host, "test -e /usr/zuul-env/bin/zuul-cloner", { :acceptable_exit_codes => [0,1] }
+      if r.exit_code == 0
+        zuul_clone_cmd = '/usr/zuul-env/bin/zuul-cloner '
+        zuul_clone_cmd += '--cache-dir /opt/git '
+        zuul_clone_cmd += "--zuul-ref #{zuul_ref} "
+        zuul_clone_cmd += "--zuul-branch #{zuul_branch} "
+        zuul_clone_cmd += "--zuul-url #{zuul_url} "
+        zuul_clone_cmd += "git://git.openstack.org #{repo}"
+        on host, zuul_clone_cmd
+      else
+        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+      end
+
+      on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
+
+      # Install the module being tested
+      on host, "rm -fr /etc/puppet/modules/#{modname}"
+      puppet_module_install(:source => proj_root, :module_name => modname)
+
+      on host, "rm -fr #{repo}"
+
+      # List modules installed to help with debugging
+      on host, puppet('module','list'), { :acceptable_exit_codes => 0 }
+    end
+  end
+end
diff --git a/n1k_vsm/templates/vsm_vm.xml.erb b/n1k_vsm/templates/vsm_vm.xml.erb
index 82a2a013e..7096724b6 100644
--- a/n1k_vsm/templates/vsm_vm.xml.erb
+++ b/n1k_vsm/templates/vsm_vm.xml.erb
@@ -41,6 +41,9 @@
                     <virtualport type='openvswitch' />
                     <target dev='<%= @ctrltap %>'/>
                     <model type='e1000'/>
+                    <% if scope.lookupvar('n1k_vsm::pacemaker_control') == true %>
+                    <mac address='<%= @ctrlmac %>'/>
+                    <% end %>
                     <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
           </interface>
 
@@ -49,6 +52,9 @@
                     <virtualport type='openvswitch' />
                     <target dev='<%= @mgmttap %>'/>
                     <model type='e1000'/>
+                    <% if scope.lookupvar('n1k_vsm::pacemaker_control') == true %>
+                    <mac address='<%= @mgmtmac %>'/>
+                    <% end %>
                     <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
           </interface> 
 
@@ -57,6 +63,9 @@
                     <virtualport type='openvswitch' />
                     <target dev='<%= @pkttap %>'/>
                     <model type='e1000'/>
+                    <% if scope.lookupvar('n1k_vsm::pacemaker_control') == true %>
+                    <mac address='<%= @pktmac %>'/>
+                    <% end %>
                     <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
           </interface> 
 
diff --git a/n1k_vsm/templates/vsm_vm_secondary.xml.erb b/n1k_vsm/templates/vsm_vm_secondary.xml.erb
new file mode 100644
index 000000000..cbd237bfa
--- /dev/null
+++ b/n1k_vsm/templates/vsm_vm_secondary.xml.erb
@@ -0,0 +1,92 @@
+<domain type='kvm' >
+     <name><%= scope.lookupvar('n1k_vsm::vsmname_s') %></name>
+     <memory unit='KiB'><%= scope.lookupvar('n1k_vsm::memory') %></memory>
+     <vcpu placement='static'> <%= scope.lookupvar('n1k_vsm::vcpu') %></vcpu>
+
+     <os>
+          <type arch='x86_64' machine='pc-i440fx-rhel7.1.0'>hvm</type>
+          <boot dev='hd'/>
+          <boot dev='cdrom'/>
+     </os>
+
+     <features> <acpi/> <apic/> <pae/> </features>
+
+     <clock offset='localtime'/>
+     <on_poweroff>destroy</on_poweroff>
+     <on_reboot>restart</on_reboot>
+     <on_crash>restart</on_crash>
+
+     <devices>
+          <emulator>/usr/libexec/qemu-kvm</emulator>
+          <disk type='file' device='disk'>
+               <driver name='qemu' type='raw'/>
+               <source file='<%= scope.lookupvar('n1k_vsm::diskfile_s') %>'/>
+               <target dev='hda' bus='ide'/>
+          </disk>
+
+          <disk type='file' device='cdrom'>
+               <driver name='qemu' type='raw'/>
+               <source file='<%= scope.lookupvar('n1k_vsm::imgfile_s') %>'/>
+               <target dev='hdb' bus='ide'/>
+               <readonly/>
+          </disk>
+
+          <controller type='ide' index='0'>
+                    <alias name='ide0'/>
+                    <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
+          </controller>
+
+          <interface type='bridge'>
+                    <source bridge='<%= scope.lookupvar('n1k_vsm::ovsbridge') %>'/>
+                    <virtualport type='openvswitch' />
+                    <target dev='<%= @ctrltap_s %>'/>
+                    <model type='e1000'/>
+                    <% if scope.lookupvar('n1k_vsm::pacemaker_control') == true %>
+                    <mac address='<%= @ctrlmac_s %>'/>
+                    <% end %>
+                    <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
+          </interface>
+
+          <interface type='bridge'>
+                    <source bridge='<%= scope.lookupvar('n1k_vsm::ovsbridge') %>'/>
+                    <virtualport type='openvswitch' />
+                    <target dev='<%= @mgmttap_s %>'/>
+                    <model type='e1000'/>
+                    <% if scope.lookupvar('n1k_vsm::pacemaker_control') == true %>
+                    <mac address='<%= @mgmtmac_s %>'/>
+                    <% end %>
+                    <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+          </interface>
+
+          <interface type='bridge'>
+                    <source bridge='<%= scope.lookupvar('n1k_vsm::ovsbridge') %>'/>
+                    <virtualport type='openvswitch' />
+                    <target dev='<%= @pkttap_s %>'/>
+                    <model type='e1000'/>
+                    <% if scope.lookupvar('n1k_vsm::pacemaker_control') == true %>
+                    <mac address='<%= @pktmac_s %>'/>
+                    <% end %>
+                    <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+          </interface>
+
+          <input type='mouse' bus='ps2'/>
+
+          <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0' keymap='en-us'>
+                  <listen type='address' address='0.0.0.0'/>
+          </graphics>
+
+          <video>
+                  <model type='cirrus' vram='9216' heads='1'/>
+                  <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+          </video>
+
+          <memballoon model='virtio'>
+                  <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+          </memballoon>
+
+          <console type='pty' tty='/dev/pts/<%= scope.lookupvar('n1k_vsm::consolepts') %>'>
+                   <source path='/dev/pts/<%= scope.lookupvar('n1k_vsm::consolepts') %>'/>
+                   <target port='0'/>
+          </console>
+      </devices>
+</domain>
diff --git a/neutron/CHANGELOG.md b/neutron/CHANGELOG.md
index bebeeaafe..95589050f 100644
--- a/neutron/CHANGELOG.md
+++ b/neutron/CHANGELOG.md
@@ -1,3 +1,51 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+This is a backwards-incompatible major release for OpenStack Kilo.
+
+####Backwards-incompatible changes
+- Remove deprecated parameters
+- Drop OVS & LB monolitic plugins
+- Use libreswan on fedora
+- Move rabbit/kombu settings to oslo_messaging_rabbit section
+- FWaaS: update packaging for Debian & Ubuntu
+- Don't specify a nova region by default
+- Do not create tun and int bridges manually
+
+####Features
+- Puppet 4.x support
+- Refactorise Keystone resources management
+- Add 'state_path' and 'lock_path' to neutron class
+- Add service_name parameter to neutron::server class
+- DB: Added postgresql backend using openstacklib helper
+- Subscribe neutron db sync to db connection setting
+- Ensure DB is provisioned before db-sync
+- Add support for identity_uri
+- Notify the ovs-agent service if the config changes
+- Add portdb and fastpath_flood to n1kv.conf
+- Add fwaas package for Kilo in Red Hat platforms
+- Add memcache_servers parameter to base neutron class
+- Add MidoNet plugin support
+- Add PLUMgrid plugin support
+- Add OpenContrail plugin support
+- Tag all neutron packages
+- Allow to configure Nova metadata protocol
+- Configure OVS mechanism agent configs in its config file
+- Don't manage chmod for /etc/neutron and neutron.conf
+- Introduce public_url, internal_url and admin_url
+- Allow customization of dhcp_domain setting
+- Add manage_service parameter to all agents
+- Add ability to specify auth_region
+
+####Bugfixes
+- Fix l3 agent network_device_mtu deprecation
+- Set allow_automatic_l3agent_failover in neutron.conf instead of l3_agent.ini
+- Fix parsing of network gateway id for router
+
+####Maintenance
+- Acceptance tests with Beaker
+- Fix spec tests for RSpec 3.x and Puppet 4.x
+
 ##2015-06-17 - 5.1.0
 ###Summary
 
diff --git a/neutron/README.md b/neutron/README.md
index 518a59f8c..82c03b422 100644
--- a/neutron/README.md
+++ b/neutron/README.md
@@ -1,7 +1,7 @@
 neutron
 ===================================
 
-5.1.0 - 2014.2 - Juno
+6.0.0 - 2015.1 - Kilo
 
 #### Table of Contents
 
diff --git a/neutron/examples/cisco_ml2.pp b/neutron/examples/cisco_ml2.pp
new file mode 100644
index 000000000..9d2efe623
--- /dev/null
+++ b/neutron/examples/cisco_ml2.pp
@@ -0,0 +1,64 @@
+class { '::neutron':
+  enabled         => true,
+  bind_host       => '127.0.0.1',
+  rabbit_host     => '127.0.0.1',
+  rabbit_user     => 'neutron',
+  rabbit_password => 'rabbit_secret',
+  verbose         => true,
+  debug           => true,
+}
+
+class { '::neutron::server':
+  auth_uri      => 'http://127.0.0.1:5000',
+  auth_password => 'keystone_secret',
+}
+
+class { '::neutron::plugins::ml2':
+  type_drivers         => ['vlan', 'nexus_vxlan'],
+  tenant_network_types => ['nexus_vxlan'],
+  network_vlan_ranges  => ['physnet:2000:2020'],
+  mechanism_drivers    => ['openvswitch', 'cisco_ucsm', 'cisco_nexus'],
+}
+
+class {'::neutron::plugins::ml2::cisco::ucsm':
+  ucsm_ip        => '127.0.0.1',
+  ucsm_username  => 'admin',
+  ucsm_password  => 'password',
+  ucsm_host_list => 'host1:profile1, host2:profile2',
+}
+
+class {'::neutron::plugins::ml2::cisco::nexus':
+  managed_physical_network => 'physnet',
+  nexus_config             => {
+    'n9372-1' => {
+      'username'     => 'admin',
+      'password'     => 'password',
+      'ssh_port'     => 22,
+      'ip_address'   => '127.0.0.1',
+      'nve_src_intf' => 1,
+      'physnet'      => 'physnet',
+      'servers'      => {
+        'control1' => 'ethernet:1/1',
+        'control2' => 'ethernet:1/2'
+      }
+    },
+    'n9372-2' => {
+      'username'     => 'admin',
+      'password'     => 'password',
+      'ssh_port'     => 22,
+      'ip_address'   => '127.0.0.1',
+      'nve_src_intf' => 1,
+      'physnet'      => 'physnet',
+      'servers'      => {
+        'compute1' => 'ethernet:1/1',
+        'compute2' => 'ethernet:1/2'
+      }
+    }
+  },
+}
+
+class {'::neutron::plugins::ml2::cisco::type_nexus_vxlan':
+  vni_ranges   => '20000:22000',
+  mcast_ranges => '224.0.0.1:224.0.0.4',
+}
+
diff --git a/neutron/lib/puppet/provider/neutron_plugin_nuage/ini_setting.rb b/neutron/lib/puppet/provider/neutron_plugin_nuage/ini_setting.rb
new file mode 100644
index 000000000..65d2d7622
--- /dev/null
+++ b/neutron/lib/puppet/provider/neutron_plugin_nuage/ini_setting.rb
@@ -0,0 +1,11 @@
+Puppet::Type.type(:neutron_plugin_nuage).provide(
+  :ini_setting,
+  :parent => Puppet::Type.type(:openstack_config).provider(:ini_setting)
+) do
+
+  def file_path
+    '/etc/neutron/plugins/nuage/plugin.ini'
+  end
+
+end
+
diff --git a/neutron/lib/puppet/provider/nova_admin_tenant_id_setter/ini_setting.rb b/neutron/lib/puppet/provider/nova_admin_tenant_id_setter/ini_setting.rb
deleted file mode 100644
index 06199ee4b..000000000
--- a/neutron/lib/puppet/provider/nova_admin_tenant_id_setter/ini_setting.rb
+++ /dev/null
@@ -1,196 +0,0 @@
-## NB: This must work with Ruby 1.8!
-
-# This providers permits the nova_admin_tenant_id paramter in neutron.conf
-# to be set by providing a nova_admin_tenant_name to the Puppet module and
-# using the Keystone REST API to translate the name into the corresponding
-# UUID.
-#
-# This requires that tenant names be unique.  If there are multiple matches
-# for a given tenant name, this provider will raise an exception.
-
-require 'rubygems'
-require 'net/http'
-require 'net/https'
-require 'json'
-require 'puppet/util/inifile'
-
-class KeystoneError < Puppet::Error
-end
-
-class KeystoneConnectionError < KeystoneError
-end
-
-class KeystoneAPIError < KeystoneError
-end
-
-# Provides common request handling semantics to the other methods in
-# this module.
-#
-# +req+::
-#   An HTTPRequest object
-# +url+::
-#   A parsed URL (returned from URI.parse)
-def neutron_handle_request(req, url)
-    begin
-        # There is issue with ipv6 where address has to be in brackets, this causes the
-        # underlying ruby TCPSocket to fail. Net::HTTP.new will fail without brackets on
-        # joining the ipv6 address with :port or passing brackets to TCPSocket. It was
-        # found that if we use Net::HTTP.start with url.hostname the incriminated code
-        # won't be hit.
-        use_ssl = url.scheme == "https" ? true : false
-        http = Net::HTTP.start(url.hostname, url.port, {:use_ssl => use_ssl})
-        res = http.request(req)
-
-        if res.code != '200'
-            raise KeystoneAPIError, "Received error response from Keystone server at #{url}: #{res.message}"
-        end
-    rescue Errno::ECONNREFUSED => detail
-        raise KeystoneConnectionError, "Failed to connect to Keystone server at #{url}: #{detail}"
-    rescue SocketError => detail
-        raise KeystoneConnectionError, "Failed to connect to Keystone server at #{url}: #{detail}"
-    end
-
-    res
-end
-
-# Authenticates to a Keystone server and obtains an authentication token.
-# It returns a 2-element +[token, authinfo]+, where +token+ is a token
-# suitable for passing to openstack apis in the +X-Auth-Token+ header, and
-# +authinfo+ is the complete response from Keystone, including the service
-# catalog (if available).
-#
-# +auth_url+::
-#   Keystone endpoint URL.  This function assumes API version
-#   2.0 and an administrative endpoint, so this will typically look like
-#   +http://somehost:35357/v2.0+.
-#
-# +username+::
-#   Username for authentication.
-#
-# +password+::
-#   Password for authentication
-#
-# +tenantID+::
-#   Tenant UUID
-#
-# +tenantName+::
-#   Tenant name
-#
-def keystone_v2_authenticate(auth_url,
-                             username,
-                             password,
-                             tenantId=nil,
-                             tenantName=nil)
-
-    post_args = {
-        'auth' => {
-            'passwordCredentials' => {
-                'username' => username,
-                'password' => password
-            },
-        }}
-
-    if tenantId
-        post_args['auth']['tenantId'] = tenantId
-    end
-
-    if tenantName
-        post_args['auth']['tenantName'] = tenantName
-    end
-
-    url = URI.parse("#{auth_url}/tokens")
-    req = Net::HTTP::Post.new url.path
-    req['content-type'] = 'application/json'
-    req.body = post_args.to_json
-
-    res = neutron_handle_request(req, url)
-    data = JSON.parse res.body
-    return data['access']['token']['id']
-end
-
-# Queries a Keystone server to a list of all tenants.
-#
-# +auth_url+::
-#   Keystone endpoint.  See the notes for +auth_url+ in
-#   +keystone_v2_authenticate+.
-#
-# +token+::
-#   A Keystone token that will be passed in requests as the value of the
-#   +X-Auth-Token+ header.
-#
-def keystone_v2_tenants(auth_url,
-                        token)
-
-    url = URI.parse("#{auth_url}/tenants")
-    req = Net::HTTP::Get.new url.path
-    req['content-type'] = 'application/json'
-    req['x-auth-token'] = token
-
-    res = neutron_handle_request(req, url)
-    data = JSON.parse res.body
-    data['tenants']
-end
-
-Puppet::Type.type(:nova_admin_tenant_id_setter).provide(:ruby) do
-    @tenant_id = nil
-
-    def authenticate
-        keystone_v2_authenticate(
-          @resource[:auth_url],
-          @resource[:auth_username],
-          @resource[:auth_password],
-          nil,
-          @resource[:auth_tenant_name])
-    end
-
-    def find_tenant_by_name (token)
-        tenants  = keystone_v2_tenants(
-            @resource[:auth_url],
-            token)
-
-        tenants.select{|tenant| tenant['name'] == @resource[:tenant_name]}
-    end
-
-    def exists?
-      ini_file  = Puppet::Util::IniConfig::File.new
-      ini_file.read("/etc/neutron/neutron.conf")
-      ini_file['DEFAULT'] && ini_file['DEFAULT']['nova_admin_tenant_id'] && ini_file['DEFAULT']['nova_admin_tenant_id'] == tenant_id
-    end
-
-    def create
-        config
-    end
-
-    def tenant_id
-      @tenant_id ||= get_tenant_id
-    end
-
-    # This looks for the tenant specified by the 'tenant_name' parameter to
-    # the resource and returns the corresponding UUID if there is a single
-    # match.
-    #
-    # Raises a KeystoneAPIError if:
-    #
-    # - There are multiple matches, or
-    # - There are zero matches
-    def get_tenant_id
-        token = authenticate
-        tenants = find_tenant_by_name(token)
-
-        if tenants.length == 1
-            return tenants[0]['id']
-        elsif tenants.length > 1
-            raise KeystoneAPIError, 'Found multiple matches for tenant name'
-        else
-            raise KeystoneAPIError, 'Unable to find matching tenant'
-        end
-    end
-
-    def config
-        Puppet::Type.type(:neutron_config).new(
-            {:name => 'DEFAULT/nova_admin_tenant_id', :value => "#{tenant_id}"}
-        ).create
-    end
-
-end
-
diff --git a/neutron/lib/puppet/type/neutron_plugin_nuage.rb b/neutron/lib/puppet/type/neutron_plugin_nuage.rb
new file mode 100644
index 000000000..60319ac41
--- /dev/null
+++ b/neutron/lib/puppet/type/neutron_plugin_nuage.rb
@@ -0,0 +1,24 @@
+Puppet::Type.newtype(:neutron_plugin_nuage) do
+
+  ensurable
+
+  newparam(:name, :namevar => true) do
+    desc 'Section/setting name to manage for nuage/plugin.ini'
+    newvalues(/\S+\/\S+/)
+  end
+
+  newproperty(:value) do
+    desc 'The value of the settings to be defined.'
+    munge do |value|
+      value = value.to_s.strip
+      value.capitalize! if value =~ /^(true|false)$/i
+      value
+    end
+  end
+
+  autorequire(:package) do
+    'neutron-plugin-nuage'
+  end
+
+end
+
diff --git a/neutron/lib/puppet/type/nova_admin_tenant_id_setter.rb b/neutron/lib/puppet/type/nova_admin_tenant_id_setter.rb
deleted file mode 100644
index d79e86c72..000000000
--- a/neutron/lib/puppet/type/nova_admin_tenant_id_setter.rb
+++ /dev/null
@@ -1,32 +0,0 @@
-Puppet::Type.newtype(:nova_admin_tenant_id_setter) do
-
-    ensurable
-
-    newparam(:name, :namevar => true) do
-        desc 'The name of the setting to update'
-    end
-
-    newparam(:tenant_name) do
-        desc 'The nova admin tenant name'
-    end
-
-    newparam(:auth_url) do
-        desc 'The Keystone endpoint URL'
-        defaultto 'http://localhost:35357/v2.0'
-    end
-
-    newparam(:auth_username) do
-        desc 'Username with which to authenticate'
-        defaultto 'admin'
-    end
-
-    newparam(:auth_password) do
-        desc 'Password with which to authenticate'
-    end
-
-    newparam(:auth_tenant_name) do
-        desc 'Tenant name with which to authenticate'
-        defaultto 'admin'
-    end
-end
-
diff --git a/neutron/manifests/agents/lbaas.pp b/neutron/manifests/agents/lbaas.pp
index f73c39468..995909e3f 100644
--- a/neutron/manifests/agents/lbaas.pp
+++ b/neutron/manifests/agents/lbaas.pp
@@ -77,14 +77,6 @@
     'haproxy/user_group':         value => $user_group;
   }
 
-  Package['neutron']            -> Package['neutron-lbaas-agent']
-  Package['neutron-lbaas-agent'] -> Neutron_config<||>
-  Package['neutron-lbaas-agent'] -> Neutron_lbaas_agent_config<||>
-  package { 'neutron-lbaas-agent':
-    ensure => $package_ensure,
-    name   => $::neutron::params::lbaas_agent_package,
-    tag    => 'openstack',
-  }
   if $manage_service {
     if $enabled {
       $service_ensure = 'running'
@@ -93,6 +85,12 @@
     }
   }
 
+  if ! defined(Class['::neutron::agents::lbaas::package']) {
+    class { '::neutron::agents::lbaas::package':
+      package_ensure => $package_ensure,
+    }
+  }
+
   service { 'neutron-lbaas-service':
     ensure  => $service_ensure,
     name    => $::neutron::params::lbaas_agent_service,
diff --git a/neutron/manifests/agents/lbaas/package.pp b/neutron/manifests/agents/lbaas/package.pp
new file mode 100644
index 000000000..9b8ea9297
--- /dev/null
+++ b/neutron/manifests/agents/lbaas/package.pp
@@ -0,0 +1,23 @@
+# == Class: neutron::agents:lbaas::package
+#
+# Installs Neutron Load Balancing agent package.
+#
+# === Parameters
+#
+# [*package_ensure*]
+#   (optional) Ensure state for package. Defaults to 'present'.
+#
+class neutron::agents::lbaas::package (
+  $package_ensure = present,
+) {
+  include ::neutron::params
+
+  Package['neutron']             -> Package['neutron-lbaas-agent']
+  Package['neutron-lbaas-agent'] -> Neutron_config<||>
+  Package['neutron-lbaas-agent'] -> Neutron_lbaas_agent_config<||>
+  package { 'neutron-lbaas-agent':
+    ensure => $package_ensure,
+    name   => $::neutron::params::lbaas_agent_package,
+    tag    => 'openstack',
+  }
+}
diff --git a/neutron/manifests/agents/ml2/ovs.pp b/neutron/manifests/agents/ml2/ovs.pp
index 4dc0b6d59..697d55bc8 100644
--- a/neutron/manifests/agents/ml2/ovs.pp
+++ b/neutron/manifests/agents/ml2/ovs.pp
@@ -118,8 +118,8 @@
     fail('Local ip for ovs agent must be set when tunneling is enabled')
   }
 
-  if $enable_distributed_routing and ! $l2_population {
-    fail('L2 population must be enabled when DVR is enabled')
+  if $enable_tunneling and $enable_distributed_routing and ! $l2_population {
+    fail('L2 population must be enabled when DVR and tunneling are enabled')
   }
 
   Package['neutron-ovs-agent'] -> Neutron_agent_ovs<||>
diff --git a/neutron/manifests/agents/n1kv_vem.pp b/neutron/manifests/agents/n1kv_vem.pp
index 35113a917..1159a0505 100644
--- a/neutron/manifests/agents/n1kv_vem.pp
+++ b/neutron/manifests/agents/n1kv_vem.pp
@@ -9,6 +9,10 @@
 #   (required) N1KV VSM(Virtual Supervisor Module) VM's IP.
 #   Defaults to 127.0.0.1
 #
+# [*n1kv_vsm_ipv6*]
+#   (required) N1KV VSM(Virtual Supervisor Module) VM's IP.
+#   Defaults to ::1
+#
 # [*n1kv_vsm_domainid*]
 #   (required) N1KV VSM DomainID.
 #   Defaults to 1000
@@ -101,6 +105,7 @@
 #
 class neutron::agents::n1kv_vem (
   $n1kv_vsm_ip          = '127.0.0.1',
+  $n1kv_vsm_ipv6        = '::1',
   $n1kv_vsm_domain_id   = 1000,
   $host_mgmt_intf       = 'eth1',
   $uplink_profile       = {},
diff --git a/neutron/manifests/agents/vpnaas.pp b/neutron/manifests/agents/vpnaas.pp
index 93dc44dac..8ac808c73 100644
--- a/neutron/manifests/agents/vpnaas.pp
+++ b/neutron/manifests/agents/vpnaas.pp
@@ -54,6 +54,11 @@
 ) {
 
   include ::neutron::params
+  if ! defined(Class['::neutron::agents::vpnaas::package']) {
+    class { '::neutron::agents::vpnaas::package':
+      package_ensure => $package_ensure,
+    }
+  }
 
   Neutron_config<||>              ~> Service['neutron-vpnaas-service']
   Neutron_vpnaas_agent_config<||> ~> Service['neutron-vpnaas-service']
@@ -90,18 +95,6 @@
     }
   }
 
-  if $::neutron::params::vpnaas_agent_package {
-    Package['neutron']            -> Package['neutron-vpnaas-agent']
-    Package['neutron-vpnaas-agent'] -> Neutron_vpnaas_agent_config<||>
-    package { 'neutron-vpnaas-agent':
-      ensure => $package_ensure,
-      name   => $::neutron::params::vpnaas_agent_package,
-      tag    => 'openstack',
-    }
-  } else {
-    Package['neutron'] -> Neutron_vpnaas_agent_config<||>
-  }
-
   if $manage_service {
     if $enabled {
       $service_ensure = 'running'
diff --git a/neutron/manifests/agents/vpnaas/package.pp b/neutron/manifests/agents/vpnaas/package.pp
new file mode 100644
index 000000000..2fc103a33
--- /dev/null
+++ b/neutron/manifests/agents/vpnaas/package.pp
@@ -0,0 +1,26 @@
+# == Class: neutron::agents:vpnaas::package
+#
+# Installs Neutron VPN agent.
+#
+# === Parameters
+#
+# [*package_ensure*]
+#   (optional) Ensure state for package. Defaults to 'present'.
+#
+class neutron::agents::vpnaas::package (
+  $package_ensure = present,
+) {
+
+  if $::neutron::params::vpnaas_agent_package {
+    Package['neutron']            -> Package['neutron-vpnaas-agent']
+    Package['neutron-vpnaas-agent'] -> Neutron_vpnaas_agent_config<||>
+    package { 'neutron-vpnaas-agent':
+      ensure => $package_ensure,
+      name   => $::neutron::params::vpnaas_agent_package,
+      tag    => 'openstack',
+    }
+  } else {
+    Package['neutron'] -> Neutron_vpnaas_agent_config<||>
+  }
+
+}
diff --git a/neutron/manifests/config.pp b/neutron/manifests/config.pp
index 927fbf3cc..8ed85ac78 100644
--- a/neutron/manifests/config.pp
+++ b/neutron/manifests/config.pp
@@ -63,7 +63,10 @@
 # [**plugin_opencontrail_config**]
 #   (optional) Manage configuration of plugins/opencontrail/ContrailPlugin.ini
 #
-# [**plugin_ml2_config**]
+# [*plugin_nuage_config*]
+#   (optional) Manage configuration of plugins/nuage/plugin.ini
+#
+# [*plugin_ml2_config*]
 #   (optional) Manage configuration of ml2_conf.ini
 #
 # [**plugin_ovs_config**]
@@ -88,6 +91,7 @@
   $plugin_midonet_config         = {},
   $plugin_plumgrid_config        = {},
   $plugin_opencontrail_config    = {},
+  $plugin_nuage_config           = {},
   $plugin_ml2_config             = {},
   $plugin_ovs_config             = {},
 ) {
@@ -107,6 +111,7 @@
   validate_hash($plugin_midonet_config)
   validate_hash($plugin_plumgrid_config)
   validate_hash($plugin_opencontrail_config)
+  validate_hash($plugin_nuage_config)
   validate_hash($plugin_ml2_config)
   validate_hash($plugin_ovs_config)
 
@@ -124,6 +129,7 @@
   create_resources('neutron_plugin_midonet', $plugin_midonet_config)
   create_resources('neutron_plugin_plumgrid', $plugin_plumgrid_config)
   create_resources('neutron_plugin_opencontrail', $plugin_opencontrail_config)
+  create_resources('neutron_plugin_nuage', $plugin_nuage_config)
   create_resources('neutron_plugin_ml2', $plugin_ml2_config)
   create_resources('neutron_plugin_ovs', $plugin_ovs_config)
 }
diff --git a/neutron/manifests/db/sync.pp b/neutron/manifests/db/sync.pp
new file mode 100644
index 000000000..463d83030
--- /dev/null
+++ b/neutron/manifests/db/sync.pp
@@ -0,0 +1,58 @@
+#
+# Class to execute neutron dbsync
+#
+class neutron::db::sync (
+  $service_plugins = $::neutron::service_plugins
+) {
+
+  include ::neutron::params
+
+  Package<| title == 'neutron-server' |> -> Exec['neutron-db-sync']
+  Package<| title == 'neutron' |> -> Exec['neutron-db-sync']
+  Neutron_config<||> ~> Exec['neutron-db-sync']
+  Neutron_config<| title == 'database/connection' |> ~> Exec['neutron-db-sync']
+  Exec['neutron-db-sync'] ~> Service <| title == 'neutron-server' |>
+
+  exec { 'neutron-db-sync':
+    command     => 'neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini upgrade head',
+    path        => '/usr/bin',
+    refreshonly => true,
+    logoutput   => on_failure,
+  }
+
+  if ($service_plugins and ('lbaas' in $service_plugins or
+      'neutron.services.loadbalancer.plugin.LoadBalancerPlugin' in $service_plugins)) {
+    Exec['neutron-db-sync'] ~> Exec['neutron-db-sync-lbaas']
+    Exec['neutron-db-sync-lbaas'] ~> Service <| title == 'neutron-server' |>
+    exec { 'neutron-db-sync-lbaas':
+      command     => 'neutron-db-manage  --service lbaas --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini upgrade head',
+      path        => '/usr/bin',
+      refreshonly => true,
+      logoutput   => on_failure,
+    }
+  }
+
+  if ($service_plugins and ('firewall' in $service_plugins or
+      'neutron.services.firewall.fwaas_plugin.FirewallPlugin' in $service_plugins)) {
+    Exec['neutron-db-sync'] ~> Exec['neutron-db-sync-fwaas']
+    Exec['neutron-db-sync-fwaas'] ~> Service <| title == 'neutron-server' |>
+    exec { 'neutron-db-sync-fwaas':
+      command     => 'neutron-db-manage  --service fwaas --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini upgrade head',
+      path        => '/usr/bin',
+      refreshonly => true,
+      logoutput   => on_failure,
+    }
+  }
+
+  if ($service_plugins and ('vpnaas' in $service_plugins or
+      'neutron_vpnaas.services.vpn.plugin:VPNDriverPlugin' in $service_plugins)) {
+    Exec['neutron-db-sync'] ~> Exec['neutron-db-sync-vpnaas']
+    Exec['neutron-db-sync-vpnaas'] ~> Service <| title == 'neutron-server' |>
+    exec { 'neutron-db-sync-vpnaas':
+      command     => 'neutron-db-manage  --service vpnaas --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini upgrade head',
+      path        => '/usr/bin',
+      refreshonly => true,
+      logoutput   => on_failure,
+    }
+  }
+}
diff --git a/neutron/manifests/init.pp b/neutron/manifests/init.pp
index c1d732e29..2cfdafa40 100644
--- a/neutron/manifests/init.pp
+++ b/neutron/manifests/init.pp
@@ -32,7 +32,7 @@
 # [*core_plugin*]
 #   (optional) Neutron plugin provider
 #   Defaults to openvswitch
-#   Could be bigswitch, brocade, cisco, embrane, hyperv, linuxbridge, midonet, ml2, mlnx, nec, nicira, plumgrid, ryu, opencontrail (full path)
+#   Could be bigswitch, brocade, cisco, embrane, hyperv, linuxbridge, midonet, ml2, mlnx, nec, nicira, plumgrid, ryu, nuage, opencontrail (full path)
 #
 #   Example for opencontrail:
 #
@@ -127,6 +127,21 @@
 #   multiple RabbitMQ Brokers.
 #   Defaults to false
 #
+# [*rabbit_heartbeat_timeout_threshold*]
+#   (optional) Number of seconds after which the RabbitMQ broker is considered
+#   down if the heartbeat keepalive fails.  Any value >0 enables heartbeats.
+#   Heartbeating helps to ensure the TCP connection to RabbitMQ isn't silently
+#   closed, resulting in missed or lost messages from the queue.
+#   (Requires kombu >= 3.0.7 and amqp >= 1.4.0)
+#   Defaults to 0
+#
+# [*rabbit_heartbeat_rate*]
+#   (optional) How often during the rabbit_heartbeat_timeout_threshold period to
+#   check the heartbeat on RabbitMQ connection.  (i.e. rabbit_heartbeat_rate=2
+#   when rabbit_heartbeat_timeout_threshold=60, the heartbeat will be checked
+#   every 30 seconds.
+#   Defaults to 2
+#
 # [*rabbit_use_ssl*]
 #   (optional) Connect over SSL for RabbitMQ
 #   Defaults to false
@@ -215,72 +230,73 @@
 #   Defaults to: /var/lib/neutron/lock
 #
 class neutron (
-  $enabled                     = true,
-  $package_ensure              = 'present',
-  $verbose                     = false,
-  $debug                       = false,
-  $bind_host                   = '0.0.0.0',
-  $bind_port                   = '9696',
-  $core_plugin                 = 'openvswitch',
-  $service_plugins             = undef,
-  $auth_strategy               = 'keystone',
-  $base_mac                    = 'fa:16:3e:00:00:00',
-  $mac_generation_retries      = 16,
-  $dhcp_lease_duration         = 86400,
-  $dhcp_agents_per_network     = 1,
-  $network_device_mtu          = undef,
-  $dhcp_agent_notification     = true,
-  $allow_bulk                  = true,
-  $allow_pagination            = false,
-  $allow_sorting               = false,
-  $allow_overlapping_ips       = false,
-  $api_extensions_path         = undef,
-  $root_helper                 = 'sudo neutron-rootwrap /etc/neutron/rootwrap.conf',
-  $report_interval             = '30',
-  $memcache_servers            = false,
-  $control_exchange            = 'neutron',
-  $rpc_backend                 = 'neutron.openstack.common.rpc.impl_kombu',
-  $rabbit_password             = false,
-  $rabbit_host                 = 'localhost',
-  $rabbit_hosts                = false,
-  $rabbit_port                 = '5672',
-  $rabbit_user                 = 'guest',
-  $rabbit_virtual_host         = '/',
-  $rabbit_use_ssl              = false,
-  $kombu_ssl_ca_certs          = undef,
-  $kombu_ssl_certfile          = undef,
-  $kombu_ssl_keyfile           = undef,
-  $kombu_ssl_version           = 'TLSv1',
-  $kombu_reconnect_delay       = '1.0',
-  $qpid_hostname               = 'localhost',
-  $qpid_port                   = '5672',
-  $qpid_username               = 'guest',
-  $qpid_password               = 'guest',
-  $qpid_heartbeat              = 60,
-  $qpid_protocol               = 'tcp',
-  $qpid_tcp_nodelay            = true,
-  $qpid_reconnect              = true,
-  $qpid_reconnect_timeout      = 0,
-  $qpid_reconnect_limit        = 0,
-  $qpid_reconnect_interval_min = 0,
-  $qpid_reconnect_interval_max = 0,
-  $qpid_reconnect_interval     = 0,
-  $use_ssl                     = false,
-  $cert_file                   = false,
-  $key_file                    = false,
-  $ca_file                     = false,
-  $use_syslog                  = false,
-  $log_facility                = 'LOG_USER',
-  $log_file                    = false,
-  $log_dir                     = '/var/log/neutron',
-  $state_path                  = '/var/lib/neutron',
-  $lock_path                   = '/var/lib/neutron/lock',
+  $enabled                            = true,
+  $package_ensure                     = 'present',
+  $verbose                            = false,
+  $debug                              = false,
+  $bind_host                          = '0.0.0.0',
+  $bind_port                          = '9696',
+  $core_plugin                        = 'openvswitch',
+  $service_plugins                    = undef,
+  $auth_strategy                      = 'keystone',
+  $base_mac                           = 'fa:16:3e:00:00:00',
+  $mac_generation_retries             = 16,
+  $dhcp_lease_duration                = 86400,
+  $dhcp_agents_per_network            = 1,
+  $network_device_mtu                 = undef,
+  $dhcp_agent_notification            = true,
+  $allow_bulk                         = true,
+  $allow_pagination                   = false,
+  $allow_sorting                      = false,
+  $allow_overlapping_ips              = false,
+  $api_extensions_path                = undef,
+  $root_helper                        = 'sudo neutron-rootwrap /etc/neutron/rootwrap.conf',
+  $report_interval                    = '30',
+  $memcache_servers                   = false,
+  $control_exchange                   = 'neutron',
+  $rpc_backend                        = 'neutron.openstack.common.rpc.impl_kombu',
+  $rabbit_password                    = false,
+  $rabbit_host                        = 'localhost',
+  $rabbit_hosts                       = false,
+  $rabbit_port                        = '5672',
+  $rabbit_user                        = 'guest',
+  $rabbit_virtual_host                = '/',
+  $rabbit_heartbeat_timeout_threshold = 0,
+  $rabbit_heartbeat_rate              = 2,
+  $rabbit_use_ssl                     = false,
+  $kombu_ssl_ca_certs                 = undef,
+  $kombu_ssl_certfile                 = undef,
+  $kombu_ssl_keyfile                  = undef,
+  $kombu_ssl_version                  = 'TLSv1',
+  $kombu_reconnect_delay              = '1.0',
+  $qpid_hostname                      = 'localhost',
+  $qpid_port                          = '5672',
+  $qpid_username                      = 'guest',
+  $qpid_password                      = 'guest',
+  $qpid_heartbeat                     = 60,
+  $qpid_protocol                      = 'tcp',
+  $qpid_tcp_nodelay                   = true,
+  $qpid_reconnect                     = true,
+  $qpid_reconnect_timeout             = 0,
+  $qpid_reconnect_limit               = 0,
+  $qpid_reconnect_interval_min        = 0,
+  $qpid_reconnect_interval_max        = 0,
+  $qpid_reconnect_interval            = 0,
+  $use_ssl                            = false,
+  $cert_file                          = false,
+  $key_file                           = false,
+  $ca_file                            = false,
+  $use_syslog                         = false,
+  $log_facility                       = 'LOG_USER',
+  $log_file                           = false,
+  $log_dir                            = '/var/log/neutron',
+  $state_path                         = '/var/lib/neutron',
+  $lock_path                          = '/var/lib/neutron/lock',
 ) {
 
   include ::neutron::params
 
   Package['neutron'] -> Neutron_config<||>
-  Package['neutron'] -> Nova_Admin_Tenant_Id_Setter<||>
 
   if $use_ssl {
     if !$cert_file {
@@ -388,6 +404,30 @@
   if $service_plugins {
     if is_array($service_plugins) {
       neutron_config { 'DEFAULT/service_plugins': value => join($service_plugins, ',') }
+
+      if ('lbaas' in $service_plugins or
+          'neutron.services.loadbalancer.plugin.LoadBalancerPlugin' in $service_plugins) {
+        if ! defined(Class['::neutron::agents::lbaas::package']) {
+          class { '::neutron::agents::lbaas::package':
+            package_ensure => $package_ensure,
+          }
+        }
+      }
+
+      if ('firewall' in $service_plugins or
+          'neutron.services.firewall.fwaas_plugin.FirewallPlugin' in $service_plugins) {
+        include ::neutron::services::fwaas
+      }
+
+      if ('vpnaas' in $service_plugins or
+          'neutron_vpnaas.services.vpn.plugin:VPNDriverPlugin' in $service_plugins) {
+        if ! defined(Class['::neutron::agents::vpnaas::package']) {
+          class { '::neutron::agents::vpnaas::package':
+            package_ensure => $package_ensure,
+          }
+        }
+      }
+
     } else {
       fail('service_plugins should be an array.')
     }
@@ -419,11 +459,13 @@
     }
 
     neutron_config {
-      'oslo_messaging_rabbit/rabbit_userid':         value => $rabbit_user;
-      'oslo_messaging_rabbit/rabbit_password':       value => $rabbit_password, secret => true;
-      'oslo_messaging_rabbit/rabbit_virtual_host':   value => $rabbit_virtual_host;
-      'oslo_messaging_rabbit/rabbit_use_ssl':        value => $rabbit_use_ssl;
-      'oslo_messaging_rabbit/kombu_reconnect_delay': value => $kombu_reconnect_delay;
+      'oslo_messaging_rabbit/rabbit_userid':                value => $rabbit_user;
+      'oslo_messaging_rabbit/rabbit_password':              value => $rabbit_password, secret => true;
+      'oslo_messaging_rabbit/rabbit_virtual_host':          value => $rabbit_virtual_host;
+      'oslo_messaging_rabbit/heartbeat_timeout_threshold':  value => $rabbit_heartbeat_timeout_threshold;
+      'oslo_messaging_rabbit/heartbeat_rate':               value => $rabbit_heartbeat_rate;
+      'oslo_messaging_rabbit/rabbit_use_ssl':               value => $rabbit_use_ssl;
+      'oslo_messaging_rabbit/kombu_reconnect_delay':        value => $kombu_reconnect_delay;
     }
 
     if $rabbit_use_ssl {
diff --git a/neutron/manifests/params.pp b/neutron/manifests/params.pp
index 8b817651c..f5382b29f 100644
--- a/neutron/manifests/params.pp
+++ b/neutron/manifests/params.pp
@@ -27,9 +27,10 @@
     $sriov_nic_agent_service = 'neutron-sriov-nic-agent'
     $sriov_nic_agent_package = 'openstack-neutron-sriov-nic-agent'
 
-    $cisco_server_package  = 'openstack-neutron-cisco'
-    $cisco_config_file     = '/etc/neutron/plugins/cisco/cisco_plugins.ini'
-    $cisco_ml2_config_file = '/etc/neutron/plugins/ml2/ml2_conf_cisco.ini'
+    $cisco_server_package                   = 'openstack-neutron-cisco'
+    $cisco_config_file                      = '/etc/neutron/plugins/cisco/cisco_plugins.ini'
+    # Add templated Cisco Nexus ML2 config to confdir
+    $cisco_ml2_mech_cisco_nexus_config_file = '/etc/neutron/conf.d/neutron-server/ml2_mech_cisco_nexus.ini'
 
     $opencontrail_plugin_package = 'neutron-plugin-contrail'
     $opencontrail_config_file    = '/etc/neutron/plugins/opencontrail/ContrailPlugin.ini'
@@ -43,6 +44,8 @@
 
     $nvp_server_package = 'openstack-neutron-nicira'
 
+    $nuage_config_file    = '/etc/neutron/plugins/nuage/plugin.ini'
+
     $dhcp_agent_package = false
     $dhcp_agent_service = 'neutron-dhcp-agent'
 
@@ -56,7 +59,7 @@
     $metering_agent_package = 'openstack-neutron-metering-agent'
     $metering_agent_service = 'neutron-metering-agent'
 
-    $vpnaas_agent_package = 'openstack-neutron-vpn-agent'
+    $vpnaas_agent_package = 'openstack-neutron-vpnaas'
     $vpnaas_agent_service = 'neutron-vpn-agent'
     if $::operatingsystemrelease =~ /^7.*/ or $::operatingsystem == 'Fedora' {
       $openswan_package     = 'libreswan'
@@ -106,9 +109,9 @@
     $sriov_nic_agent_service = 'neutron-plugin-sriov-agent'
     $sriov_nic_agent_package = 'neutron-plugin-sriov-agent'
 
-    $cisco_server_package  = 'neutron-plugin-cisco'
-    $cisco_config_file     = '/etc/neutron/plugins/cisco/cisco_plugins.ini'
-    $cisco_ml2_config_file = '/etc/neutron/plugins/ml2/ml2_conf_cisco.ini'
+    $cisco_server_package                   = 'neutron-plugin-cisco'
+    $cisco_config_file                      = '/etc/neutron/plugins/cisco/cisco_plugins.ini'
+    $cisco_ml2_mech_cisco_nexus_config_file = '/etc/neutron/plugins/ml2/ml2_mech_cisco_nexus.ini'
 
     $opencontrail_plugin_package = 'neutron-plugin-contrail'
     $opencontrail_config_file    = '/etc/neutron/plugins/opencontrail/ContrailPlugin.ini'
@@ -122,6 +125,8 @@
 
     $nvp_server_package = 'neutron-plugin-nicira'
 
+    $nuage_config_file    = '/etc/neutron/plugins/nuage/plugin.ini'
+
     $dhcp_agent_package = 'neutron-dhcp-agent'
     $dhcp_agent_service = 'neutron-dhcp-agent'
 
diff --git a/neutron/manifests/plugins/ml2/cisco.pp b/neutron/manifests/plugins/ml2/cisco.pp
new file mode 100644
index 000000000..05ea71499
--- /dev/null
+++ b/neutron/manifests/plugins/ml2/cisco.pp
@@ -0,0 +1,31 @@
+#
+# Install the Cisco plugins and generate the config file
+# from parameters in the other classes.
+#
+# === Parameters
+#
+# [*package_ensure*]
+# (optional) The intended state of the neutron-plugin-cisco
+# package, i.e. any of the possible values of the 'ensure'
+# property for a package resource type.
+# Defaults to 'present'
+#
+
+class neutron::plugins::ml2::cisco (
+  $package_ensure = 'present'
+) {
+  include ::neutron::params
+  require ::neutron::plugins::ml2
+
+  if($::osfamily != 'Redhat') {
+    # Drivers are only packaged for RedHat at this time
+    fail("Unsupported osfamily ${::osfamily}")
+  }
+
+  ensure_resource('package', 'python-networking-cisco',
+    {
+      ensure => $package_ensure,
+      tag    => 'openstack',
+    }
+  )
+}
diff --git a/neutron/manifests/plugins/ml2/cisco/nexus.pp b/neutron/manifests/plugins/ml2/cisco/nexus.pp
index 76b1adebf..e9a686060 100644
--- a/neutron/manifests/plugins/ml2/cisco/nexus.pp
+++ b/neutron/manifests/plugins/ml2/cisco/nexus.pp
@@ -5,42 +5,131 @@
 #
 # === Parameters
 #
-# [*neutron_config*]
-# Neutron switch configuration for ml2_cisco_conf.ini
+# [*nexus_config*]
+# (required) Nexus switch configuration for ml2_cisco_conf.ini
 # Example nexus config format:
 #  { 'switch_hostname' => {'username' => 'admin',
 #    'ssh_port' => 22,
 #    'password' => "password",
 #    'ip_address' => "172.18.117.28",
+#    'nve_src_intf' => 1,
+#    'physnet' => "physnet1",
 #    'servers' => {
 #      'control01' => "portchannel:20",
 #      'control02' => "portchannel:10"
 #    }}}
 #
+# [*managed_physical_network*]
+#   (required) The name of the physical_network managed via the Cisco
+#   Nexus Switch.  This string value must be present in the ml2_conf.ini
+#   network_vlan_ranges variable.
+#
+# [*vlan_name_prefix*]
+#   (optional) A short prefix to prepend to the VLAN number when creating a
+#   VLAN interface. For example, if an interface is being created for
+#   VLAN 2001 it will be named 'q-2001' using the default prefix.
+#   The total length allowed for the prefix name and VLAN is 32 characters,
+#   the prefix will be truncated if the total length is greater than 32.
+#   Defaults to 'q-'
+#
+# [*svi_round_robin*]
+#   (optional) A flag to enable round robin scheduling of routers for SVI.
+#   Defaults to false
+#
+# [*provider_vlan_name_prefix*]
+#   (optional) A short prefix to prepend to the VLAN number when creating a
+#   provider VLAN interface. For example, if an interface is being created
+#   for provider VLAN 3003 it will be named 'p-3003' using the default prefix.
+#   The total length allowed for the prefix name and VLAN is 32 characters,
+#   the prefix will be truncated if the total length is greater than 32.
+#   Defaults to 'p-'
+#
+# [*persistent_switch_config*]
+#   (optional) To make Nexus device persistent by running the Nexus
+#   CLI 'copy run start' after applying successful configurations.
+#   (default) This flag defaults to False keep consistent with
+#   existing functionality.
+#   Defaults to false
+#
+# [*switch_heartbeat_time*]
+#   (optional) Time interval to check the state of the Nexus device.
+#   (default) This value defaults to 0 seconds which disables this
+#   functionality.  When enabled, 30 seconds is suggested.
+#   Defaults to 0
+#
+# [*switch_replay_count*]
+#   (optional) Number of times to attempt config replay with switch.
+#   This variable depends on switch_heartbeat_time being enabled.
+#   Defaults to 3
+#
+# [*provider_vlan_auto_create*]
+#   (optional) A flag indicating whether OpenStack networking should manage the
+#   creation and removal of VLANs for provider networks on the Nexus
+#   switches. If the flag is set to False then OpenStack will not create or
+#   remove VLANs for provider networks, and the administrator needs to
+#   manage these interfaces manually or by external orchestration.
+#   Defaults to true
+#
+# [*provider_vlan_auto_trunk*]
+#   (optional) A flag indicating whether OpenStack networking should manage
+#   the adding and removing of provider VLANs from trunk ports on the Nexus
+#   switches. If the flag is set to False then OpenStack will not add or
+#   remove provider VLANs from trunk ports, and the administrator needs to
+#   manage these operations manually or by external orchestration.
+#   Defaults to true
+#
+# [*vxlan_global_config*]
+#   (optional) A flag indicating whether OpenStack networking should manage the
+#   creating and removing of the Nexus switch VXLAN global settings of 'feature
+#   nv overlay', 'feature vn-segment-vlan-based', 'interface nve 1' and the NVE
+#   subcommand 'source-interface loopback #'. If the flag is set to False
+#   (default) then OpenStack will not add or remove these VXLAN settings, and
+#   the administrator needs to manage these operations manually or by  external
+#   orchestration.
+#   Defaults to true
+#
+# [*host_key_checks*]
+#   (optional) A flag indicating whether or not to enable strict host key checks
+#   when connecting to Nexus switches.
+#   Defaults to false
+#
 
 class neutron::plugins::ml2::cisco::nexus (
-  $nexus_config = undef,
-)
-{
+  $nexus_config,
+  $managed_physical_network,
+  $vlan_name_prefix          = 'q-',
+  $svi_round_robin           = false,
+  $provider_vlan_name_prefix = 'p-',
+  $persistent_switch_config  = false,
+  $switch_heartbeat_time     = 0,
+  $switch_replay_count       = 3,
+  $provider_vlan_auto_create = true,
+  $provider_vlan_auto_trunk  = true,
+  $vxlan_global_config       = true,
+  $host_key_checks           = false
+) {
+  include ::neutron::plugins::ml2::cisco
 
-  if !$nexus_config {
-    fail('No nexus config specified')
+  neutron_plugin_ml2 {
+    'ml2_cisco/managed_physical_network'  : value => $managed_physical_network;
+    'ml2_cisco/vlan_name_prefix'          : value => $vlan_name_prefix;
+    'ml2_cisco/svi_round_robin'           : value => $svi_round_robin;
+    'ml2_cisco/provider_vlan_name_prefix' : value => $provider_vlan_name_prefix;
+    'ml2_cisco/persistent_switch_config'  : value => $persistent_switch_config;
+    'ml2_cisco/switch_heartbeat_time'     : value => $switch_heartbeat_time;
+    'ml2_cisco/switch_replay_count'       : value => $switch_replay_count;
+    'ml2_cisco/provider_vlan_auto_create' : value => $provider_vlan_auto_create;
+    'ml2_cisco/provider_vlan_auto_trunk'  : value => $provider_vlan_auto_trunk;
+    'ml2_cisco/vxlan_global_config'       : value => $vxlan_global_config;
+    'ml2_cisco/host_key_checks'           : value => $host_key_checks;
   }
 
-  # For Ubuntu: This package is not available upstream
-  # Please use the source from:
-  # https://launchpad.net/~cisco-openstack/+archive/python-ncclient
-  # and install it manually
-  package { 'python-ncclient':
-    ensure => installed,
-    tag    => 'openstack',
-  } ~> Service['neutron-server']
-
-  Neutron_plugin_ml2<||> ->
-  file { $::neutron::params::cisco_ml2_config_file:
+  file { 'nexus_config':
+    path    => $::neutron::params::cisco_ml2_mech_cisco_nexus_config_file,
     owner   => 'root',
-    group   => 'root',
-    content => template('neutron/ml2_conf_cisco.ini.erb'),
+    group   => 'neutron',
+    mode    => '0644',
+    content => template('neutron/ml2_mech_cisco_nexus_conf.erb'),
   } ~> Service['neutron-server']
 
   create_resources(neutron::plugins::ml2::cisco::nexus_creds, $nexus_config)
diff --git a/neutron/manifests/plugins/ml2/cisco/nexus1000v.pp b/neutron/manifests/plugins/ml2/cisco/nexus1000v.pp
new file mode 100644
index 000000000..0d05fc29b
--- /dev/null
+++ b/neutron/manifests/plugins/ml2/cisco/nexus1000v.pp
@@ -0,0 +1,119 @@
+#
+# Configure the Mech Driver for cisco nexus 1000v neutron plugin
+#
+# === Parameters
+#
+#[*n1kv_vsm_ip*]
+#IP(s) of N1KV VSM(Virtual Supervisor Module)
+#$n1kv_vsm_ip = 1.2.3.4, 5.6.7.8
+#Defaults to empty
+#
+#[*n1kv_vsm_username*]
+#Username of N1KV VSM(Virtual Supervisor Module)
+#Defaults to empty
+#
+#[*n1kv_vsm_password*]
+#Password of N1KV VSM(Virtual Supervisor Module)
+#Defaults to empty
+#
+#[*default_policy_profile*]
+# (Optional) Name of the policy profile to be associated with a port when no
+# policy profile is specified during port creates.
+# Default value:default-pp
+# default_policy_profile = default-pp
+#
+#[*default_vlan_network_profile*]
+# (Optional) Name of the VLAN network profile to be associated with a network.
+# Default value:default-vlan-np
+# default_vlan_network_profile = default-vlan-np
+#
+#[*default_vxlan_network_profile*]
+# (Optional) Name of the VXLAN network profile to be associated with a network.
+# Default value:default-vxlan-np
+# default_vxlan_network_profile = default-vxlan-np
+#
+#[*poll_duration*]
+# (Optional) Time in seconds for which the plugin polls the VSM for updates in
+# policy profiles.
+# Default value: 60
+# poll_duration = 60
+#
+#[*http_pool_size*]
+# (Optional) Number of threads to use to make HTTP requests to the VSM.
+# Default value: 4
+# http_pool_size = 4
+#
+#[*http_timeout*]
+# (Optional) Timeout duration in seconds for the http request
+# Default value: 15
+# http_timeout = 15
+#
+#[*sync_interval*]
+# (Optional) Time duration in seconds between consecutive neutron-VSM syncs
+# Default value: 300, the time between two consecutive syncs is 300 seconds.
+# sync_interval = 300
+#
+#[*max_vsm_retries*]
+# (Optional) Maximum number of retry attempts for VSM REST API.
+# Default value: 2, each HTTP request to VSM will be retried twice on
+# failures.
+# max_vsm_retries = 2
+#
+#[*restrict_policy_profiles*]
+# (Optional) Specify whether tenants are restricted from accessing all the
+# policy profiles.
+# Default value: False, indicating all tenants can access all policy profiles.
+# restrict_policy_profiles = False
+#
+#[*enable_vif_type_n1kv*]
+# (Optional) If set to True, the VIF type for portbindings is set to N1KV.
+# Otherwise the VIF type is set to OVS.
+# Default value: False, indicating that the VIF type will be set to OVS.
+# enable_vif_type_n1kv = False
+#
+class neutron::plugins::ml2::cisco::nexus1000v (
+  $n1kv_vsm_ip                          = undef,
+  $n1kv_vsm_username                    = undef,
+  $n1kv_vsm_password                    = undef,
+  $default_policy_profile               = 'default-pp',
+  $default_vlan_network_profile         = 'default-vlan-np',
+  $default_vxlan_network_profile        = 'default-vxlan-np',
+  $poll_duration                        = '60',
+  $http_pool_size                       = '4',
+  $http_timeout                         = '15',
+  $sync_interval                        = '300',
+  $max_vsm_retries                      = '2',
+  $restrict_policy_profiles             = 'False',
+  $enable_vif_type_n1kv                 = 'False',
+)
+{
+  if($::osfamily != 'Redhat') {
+    # Current support exists for Redhat family.
+    # Support for Debian will be added in the future.
+    fail("Unsupported osfamily ${::osfamily}")
+  }
+
+  package { 'python-networking-cisco':
+    require => Package['openstack-neutron'],
+    tag     => 'openstack',
+  }
+
+  $extension_drivers  = 'cisco_n1kv_ext'
+  neutron_plugin_ml2 {
+    'ml2/extension_drivers'                          : value => $extension_drivers;
+    'ml2_cisco_n1kv/n1kv_vsm_ips'                    : value => $n1kv_vsm_ip;
+    'ml2_cisco_n1kv/username'                        : value => $n1kv_vsm_username;
+    'ml2_cisco_n1kv/password'                        : value => $n1kv_vsm_password;
+    'ml2_cisco_n1kv/default_policy_profile'          : value => $default_policy_profile;
+    'ml2_cisco_n1kv/default_vlan_network_profile'    : value => $default_vlan_network_profile;
+    'ml2_cisco_n1kv/default_vxlan_network_profile'   : value => $default_vxlan_network_profile;
+    'ml2_cisco_n1kv/poll_duration'                   : value => $poll_duration;
+    'ml2_cisco_n1kv/http_pool_size'                  : value => $http_pool_size;
+    'ml2_cisco_n1kv/http_timeout'                    : value => $http_timeout;
+    'ml2_cisco_n1kv/sync_interval'                   : value => $sync_interval;
+    'ml2_cisco_n1kv/max_vsm_retries'                 : value => $max_vsm_retries;
+    'ml2_cisco_n1kv/restrict_policy_profiles'        : value => $restrict_policy_profiles;
+    'ml2_cisco_n1kv/enable_vif_type_n1kv'            : value => $enable_vif_type_n1kv;
+  }
+}
+
diff --git a/neutron/manifests/plugins/ml2/cisco/nexus_creds.pp b/neutron/manifests/plugins/ml2/cisco/nexus_creds.pp
index 16c262cb0..4b3cc0cbb 100644
--- a/neutron/manifests/plugins/ml2/cisco/nexus_creds.pp
+++ b/neutron/manifests/plugins/ml2/cisco/nexus_creds.pp
@@ -1,5 +1,7 @@
 #
-# Configure the Mech Driver for cisco neutron plugin
+# Defined type to configure the Cisco Nexus Switch Credentials
+# for use by the ML2 Mech Driver for Cisco Nexus Switches.
+#
 # More info available here:
 # https://wiki.openstack.org/wiki/Neutron/ML2/MechCiscoNexus
 #
@@ -7,25 +9,110 @@
 # neutron::plugins::ml2::cisco::nexus_creds used by
 # neutron::plugins::ml2::cisco::nexus
 #
+# === Parameters
+#
+# [*username*]
+# (required) The username for logging into the switch to manage it.
+#
+# [*password*]
+# (required) The password for logging into the switch to manage it.
+#
+# [*servers*]
+# (required) A hash of server names (key) mapped to the switch's
+# interfaces (value).  For each host connected to a port on the
+# switch, specify the hostname and the Nexus physical port/s
+# (interface/s) it is connected to.  The values in the hash can
+# be a comma separated list of interfaces mapped to the server.
+#
+# Hash Format:
+#
+#  {
+#     <hostname> => "<interfaceID1>,<interfaceID2>,<... interfaceID_N>"
+#  }
+#
+# Interface ID format options:
+#  "<intf_type>:<position>"
+#     Valid intf_type's are 'ethernet' and 'port-channel'.
+#     The default setting for <intf_type:> is 'ethernet' and need not be
+#     added to this setting.
+#
+# Example:
+#      {
+#        'control1' => 'ethernet:1/1',
+#        'control2' => 'ethernet:1/2',
+#        'compute1' => '1/3,1/4'
+#      }
+#
+# [*ip_address*]
+# (required) The IP address of the switch.
+#
+# [*ssh_port*]
+# (required) The SSH port to use when connecting to the switch.
+#
+# [*nve_src_intf*]
+# (optional) Only valid if VXLAN overlay is configured and
+# vxlan_global_config is set to True.
+#
+# The NVE source interface is a loopback interface that is configured on
+# the switch with valid /32 IP address. This /32 IP address must be known
+# by the transient devices in the transport network and the remote VTEPs.
+# This is accomplished by advertising it through a dynamic routing protocol
+# in the transport network. (NB: If no nve_src_intf is defined then a
+# default setting of 0 (creates "loopback0") will be used.)
+#
+# Defaults to undef.
+#
+# [*physnet*]
+# (optional) Only valid if VXLAN overlay is configured.
+# The physical network name defined in the network_vlan_ranges variable
+# (defined under the ml2_type_vlan section) that this switch is controlling.
+# The configured 'physnet' is the physical network domain that is connected
+# to this switch. The vlan ranges defined in network_vlan_ranges for a
+# a physical network are allocated dynamically and are unique per physical
+# network. These dynamic vlans may be reused across physical networks.
+#
+# Defaults to undef.
 
 define neutron::plugins::ml2::cisco::nexus_creds(
   $username,
   $password,
   $servers,
   $ip_address,
-  $ssh_port
+  $ssh_port,
+  $nve_src_intf = undef,
+  $physnet      = undef,
 ) {
+  # Ensure Neutron server is installed before configuring ssh keys
+  if ($::neutron::params::server_package) {
+    Package['neutron-server'] -> File['/var/lib/neutron/.ssh']
+    Package['neutron-server'] -> Exec["nexus_creds_${name}"]
+  } else {
+    Package['neutron'] -> File['/var/lib/neutron/.ssh']
+    Package['neutron'] -> Exec["nexus_creds_${name}"]
+  }
+
+  ensure_resource('file', '/var/lib/neutron/.ssh',
+    {
+      ensure => directory,
+      owner  => 'neutron',
+    }
+  )
+
+  $check_known_hosts = "/bin/cat /var/lib/neutron/.ssh/known_hosts | /bin/grep ${ip_address}"
 
-  file {'/var/lib/neutron/.ssh':
-    ensure  => directory,
-    owner   => 'neutron',
-    require => Package['neutron-server']
+  # Test to make sure switch is reachable before ssh-keyscan.
+  #  - ssh-keyscan timeouts fail silently so use ping to
+  #    report connectivity failures.
+  exec {"ping_test_${name}":
+    unless  => $check_known_hosts,
+    command => "/usr/bin/ping -c 1 ${ip_address}",
+    user    => 'neutron'
   }
 
-  exec {'nexus_creds':
-    unless  => "/bin/cat /var/lib/neutron/.ssh/known_hosts | /bin/grep ${username}",
+  exec {"nexus_creds_${name}":
+    unless  => $check_known_hosts,
     command => "/usr/bin/ssh-keyscan -t rsa ${ip_address} >> /var/lib/neutron/.ssh/known_hosts",
     user    => 'neutron',
-    require => [Package['neutron-server'], File['/var/lib/neutron/.ssh']]
+    require => [Exec["ping_test_${name}"], File['/var/lib/neutron/.ssh']]
   }
 }
diff --git a/neutron/manifests/plugins/ml2/cisco/type_nexus_vxlan.pp b/neutron/manifests/plugins/ml2/cisco/type_nexus_vxlan.pp
new file mode 100644
index 000000000..7e69bfbec
--- /dev/null
+++ b/neutron/manifests/plugins/ml2/cisco/type_nexus_vxlan.pp
@@ -0,0 +1,35 @@
+#
+# Configure the Nexus VXLAN Type Driver
+# More info available here:
+# http://docwiki.cisco.com/wiki/OpenStack/ML2NexusMechanismDriver
+#
+# === Parameters
+#
+# [*vni_ranges*]
+#   (required)
+#   Comma-separated list of <vni_min>:<vni_max> tuples enumerating
+#   ranges of VXLAN Network IDs that are available for tenant network
+#   allocation.
+#
+# [*mcast_ranges*]
+#   (required)
+#   Multicast groups for the VXLAN interface. When configured, will
+#   enable sending all broadcast traffic to this multicast group.
+#   Comma separated list of min:max ranges of multicast IP's.
+#   NOTE: must be a valid multicast IP, invalid IP's will be discarded
+#   Example:
+#   224.0.0.1:224.0.0.3,224.0.1.1:224.0.1.3
+#
+
+class neutron::plugins::ml2::cisco::type_nexus_vxlan (
+  $vni_ranges,
+  $mcast_ranges,
+) {
+  include ::neutron::plugins::ml2::cisco
+
+  neutron_plugin_ml2 {
+    'ml2_type_nexus_vxlan/vni_ranges'   : value => $vni_ranges;
+    'ml2_type_nexus_vxlan/mcast_ranges' : value => $mcast_ranges;
+  }
+}
+
diff --git a/neutron/manifests/plugins/ml2/cisco/ucsm.pp b/neutron/manifests/plugins/ml2/cisco/ucsm.pp
new file mode 100644
index 000000000..0a3ed131b
--- /dev/null
+++ b/neutron/manifests/plugins/ml2/cisco/ucsm.pp
@@ -0,0 +1,48 @@
+#
+# Configure the Mech Driver for Cisco UCSM plugin
+# More info available here:
+# http://docwiki.cisco.com/wiki/UCS_Mechanism_Driver_for_ML2_Plugin:_Kilo
+#
+# === Parameters
+#
+# [*ucsm_ip*]
+#   (required) IP address of the Cisco UCS Manager
+#
+# [*ucsm_username*]
+#   (required) Username to connect to the UCS Manager
+#
+# [*ucsm_password*]
+#   (required) Password to connect to the UCS Manager
+#
+# [*ucsm_host_list*]
+#   (required)
+#   Hostname to Service profile mapping for UCSM-controlled compute hosts
+#   Example:
+#   Hostname1:Serviceprofile1, Hostname2:Serviceprofile2
+#
+# [*supported_pci_devs*]
+#   (optional) SR-IOV and VM-FEX vendors supported by this plugin
+#   xxxx:yyyy represents vendor_id:product_id
+#   Defaults to undef
+#   Example:
+#   [ '2222:3333', '4444:5555' ]
+#
+
+class neutron::plugins::ml2::cisco::ucsm (
+  $ucsm_ip,
+  $ucsm_username,
+  $ucsm_password,
+  $ucsm_host_list,
+  $supported_pci_devs = undef,
+) {
+  include ::neutron::plugins::ml2::cisco
+
+  neutron_plugin_ml2 {
+    'ml2_cisco_ucsm/ucsm_ip'            : value => $ucsm_ip;
+    'ml2_cisco_ucsm/ucsm_username'      : value => $ucsm_username;
+    'ml2_cisco_ucsm/ucsm_password'      : value => $ucsm_password;
+    'ml2_cisco_ucsm/ucsm_host_list'     : value => $ucsm_host_list;
+    'ml2_cisco_ucsm/supported_pci_devs' : value => $supported_pci_devs;
+  }
+}
+
diff --git a/neutron/manifests/plugins/ml2/mech_driver.pp b/neutron/manifests/plugins/ml2/mech_driver.pp
index f2963cf7e..d452cbf4c 100644
--- a/neutron/manifests/plugins/ml2/mech_driver.pp
+++ b/neutron/manifests/plugins/ml2/mech_driver.pp
@@ -24,8 +24,8 @@
 ){
   if ($name == 'sriovnicswitch') {
     neutron_plugin_ml2 {
-      'ml2_sriov/supported_pci_vendor_dev': value => join($supported_pci_vendor_devs, ',');
-      'ml2_sriov/agent_required':           value => $sriov_agent_required;
+      'ml2_sriov/supported_pci_vendor_devs': value => join($supported_pci_vendor_devs, ',');
+      'ml2_sriov/agent_required':            value => $sriov_agent_required;
     }
   }
 }
diff --git a/neutron/manifests/plugins/ml2/type_driver.pp b/neutron/manifests/plugins/ml2/type_driver.pp
index af50157a9..892a3b66a 100644
--- a/neutron/manifests/plugins/ml2/type_driver.pp
+++ b/neutron/manifests/plugins/ml2/type_driver.pp
@@ -83,6 +83,9 @@
   elsif ($name == 'local') {
     warning('local type_driver is useful only for single-box, because it provides no connectivity between hosts')
   }
+  elsif ($name == 'nexus_vxlan') {
+    # Nexus_vxlan type driver has its own class separate from this one
+  }
   else {
     # detect an invalid type_drivers value
     fail('type_driver unknown.')
diff --git a/neutron/manifests/plugins/nuage.pp b/neutron/manifests/plugins/nuage.pp
new file mode 100644
index 000000000..9ed703a1a
--- /dev/null
+++ b/neutron/manifests/plugins/nuage.pp
@@ -0,0 +1,102 @@
+#
+# Configure the Nuage plugin for neutron.
+#
+# === Parameters
+#
+# [*nuage_net_partition_name*]
+#   (required) The net partition under which the VMs will be
+#   seen in the VSD
+#
+# [*nuage_vsd_ip*]
+#   (required) IP address of the Virtual Services Directory
+#
+# [*nuage_vsd_username*]
+#   (required) Username to be used to log into VSD
+#
+# [*nuage_vsd_password*]
+#   (required) Password to be used to log into VSD
+#
+# [*nuage_vsd_organization*]
+#   (required) Parameter required to log into VSD
+#
+# [*nuage_base_uri_version*]
+#   (required) URI version to be used based on the VSD release
+#   For example v3_0
+#
+# [*nuage_cms_id*]
+#   (required) CMS ID generated by the VSD
+#
+# [*nuage_auth_resource*]
+#   (optional) The auth resource value to be use to connect
+#   to VSD. The default is /me
+#
+# [*nuage_server_ssl*]
+#   (optional) Flag to determine whether to use ssl connection
+#   to connect to VSD. The default is True
+#
+#
+class neutron::plugins::nuage (
+  $nuage_net_partition_name,
+  $nuage_vsd_ip,
+  $nuage_vsd_username,
+  $nuage_vsd_password,
+  $nuage_vsd_organization,
+  $nuage_base_uri_version,
+  $nuage_cms_id,
+  $nuage_auth_resource    = '/me',
+  $nuage_server_ssl       = true,
+) {
+
+  include ::neutron::params
+
+  File['/etc/neutron/plugins/nuage/plugin.ini'] -> Neutron_plugin_nuage<||>
+  Neutron_plugin_nuage<||> ~> Service['neutron-server']
+  Neutron_plugin_nuage<||> ~> Exec<| title == 'neutron-db-sync' |>
+
+  file { '/etc/neutron/plugins/nuage':
+    ensure => directory,
+  }
+
+  if $::osfamily == 'Debian' {
+    file_line { '/etc/default/neutron-server:NEUTRON_PLUGIN_CONFIG':
+      path   => '/etc/default/neutron-server',
+      match  => '^NEUTRON_PLUGIN_CONFIG=(.*)$',
+      line   => "NEUTRON_PLUGIN_CONFIG=${::neutron::params::nuage_config_file}",
+      notify => Service['neutron-server'],
+    }
+  }
+
+  if $::osfamily == 'Redhat' {
+    File['/etc/neutron/plugin.ini'] ~> Exec<| title == 'neutron-db-sync' |>
+    file { '/etc/neutron/plugin.ini':
+      ensure  => link,
+      require => File['/etc/neutron/plugins/nuage/plugin.ini'],
+      target  => $::neutron::params::nuage_config_file,
+    }
+  }
+
+  file { '/etc/neutron/plugins/nuage/plugin.ini':
+    ensure  => file,
+    owner   => 'root',
+    group   => 'neutron',
+    require => File['/etc/neutron/plugins/nuage'],
+    mode    => '0640'
+  }
+
+  $nuage_base_uri_base = '/nuage/api'
+  neutron_plugin_nuage {
+    'RESTPROXY/default_net_partition_name': value => $nuage_net_partition_name;
+    'RESTPROXY/server':                     value => $nuage_vsd_ip;
+    'RESTPROXY/serverauth':                 value => "${nuage_vsd_username}:${nuage_vsd_password}";
+    'RESTPROXY/organization':               value => $nuage_vsd_organization;
+    'RESTPROXY/auth_resource':              value => $nuage_auth_resource;
+    'RESTPROXY/serverssl':                  value => $nuage_server_ssl;
+    'RESTPROXY/base_uri':                   value => "${nuage_base_uri_base}/${nuage_base_uri_version}";
+    'RESTPROXY/cms_id':                     value => $nuage_cms_id;
+  }
+
+  if ($::neutron::core_plugin != 'neutron.plugins.nuage.plugin.NuagePlugin') and
+    ($::neutron::core_plugin != 'nuage') {
+    fail('Nuage plugin should be the core_plugin in neutron.conf')
+  }
+}
diff --git a/neutron/manifests/server.pp b/neutron/manifests/server.pp
index 1ca854970..6107b285b 100644
--- a/neutron/manifests/server.pp
+++ b/neutron/manifests/server.pp
@@ -242,7 +242,6 @@
   include ::neutron::policy
   require keystone::python
 
-  Nova_admin_tenant_id_setter<||> ~> Service['neutron-server']
   Neutron_config<||>     ~> Service['neutron-server']
   Neutron_api_config<||> ~> Service['neutron-server']
   Class['neutron::policy'] ~> Service['neutron-server']
@@ -287,22 +286,7 @@
   }
 
   if $sync_db {
-    if ($::neutron::params::server_package) {
-      # Debian platforms
-      Package<| title == 'neutron-server' |> ~> Exec['neutron-db-sync']
-    } else {
-      # RH platforms
-      Package<| title == 'neutron' |> ~> Exec['neutron-db-sync']
-    }
-
-    exec { 'neutron-db-sync':
-      command     => 'neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini upgrade head',
-      path        => '/usr/bin',
-      before      => Service['neutron-server'],
-      subscribe   => Neutron_config['database/connection'],
-      refreshonly => true
-    }
-    Neutron_config<||> ~> Exec['neutron-db-sync']
+    include ::neutron::db::sync
   }
 
   neutron_config {
diff --git a/neutron/manifests/server/notifications.pp b/neutron/manifests/server/notifications.pp
index eef09ee15..cb90a4dbe 100644
--- a/neutron/manifests/server/notifications.pp
+++ b/neutron/manifests/server/notifications.pp
@@ -35,27 +35,79 @@
 #   currently).
 #   Defaults to 'http://127.0.0.1:8774/v2'
 #
-# [*nova_admin_auth_url*]
+# [*auth_plugin*]
+#   (optional) An authentication plugin to use with an OpenStack Identity server.
+#   Defaults to 'password'
+#
+# [*username*]
+#   (optional) Username for connection to nova in admin context
+#   Defaults to 'nova'
+#
+# [*password*]
+#   Password for connection to nova in admin context.
+#   Either password or nova_admin_password is required
+#
+# [*tenant_id*]
+#   (optional) The UUID of the admin nova tenant. If provided this takes
+#   precedence over tenant_name.
+#
+# [*tenant_name*]
+#   (optional) The name of the admin nova tenant
+#   Defaults to 'services'
+#
+# [*project_domain_id*]
+#   (optional) Nova project's domain ID
+#   Defaults to 'default'
+#
+# [*project_name*]
+#   (optional) Nova project's name
+#   Defaults to 'services'
+#
+# [*user_domain_id*]
+#   (optional) User's domain ID for connection to nova in admin context
+#   Defaults to 'default'
+#
+# [*auth_url*]
 #   (optional) Authorization URL for connection to nova in admin context.
+#   If version independent identity plugin is used available versions will be
+#   determined using auth_url
+#   Defaults to 'http://127.0.0.1:35357'
+#
+# [*region_name*]
+#   (optional) Name of nova region to use. Useful if keystone manages more than
+#   one region.
+#   Defaults to undef
+#
+# === Deprecated Parameters
+#
+# [*nova_admin_auth_url*]
+#   Deprecated. Auth plugins based authentication should be used instead
+#   Authorization URL for connection to nova in admin context.
 #   Defaults to 'http://127.0.0.1:35357/v2.0'
 #
 # [*nova_admin_username*]
+#   Deprecated. Auth plugins based authentication should be used instead
 #   (optional) Username for connection to nova in admin context
 #   Defaults to 'nova'
 #
 # [*nova_admin_tenant_name*]
-#   (optional) The name of the admin nova tenant
+#   Deprecated. Auth plugins based authentication should be used instead
+#   The name of the admin nova tenant
 #   Defaults to 'services'
 #
 # [*nova_admin_tenant_id*]
-#   (optional) The UUID of the admin nova tenant.  If provided this takes
-#   precedence over nova_admin_tenant_name.
+#   Deprecated. Auth plugins based authentication should be used instead
+#   The UUID of the admin nova tenant. If provided this takes precedence
+#   over nova_admin_tenant_name.
 #
 # [*nova_admin_password*]
-#   (required) Password for connection to nova in admin context.
+#   Deprecated. Auth plugins based authentication should be used instead
+#   Password for connection to nova in admin context.
+#   Either nova_admin_password or password is required
 #
 # [*nova_region_name*]
-#   (optional) Name of nova region to use. Useful if keystone manages more than
+#   Deprecated. region_name parameter should be used instead
+#   Name of nova region to use. Useful if keystone manages more than
 #   one region.
 #   Defaults to undef
 #
@@ -65,6 +117,17 @@
   $notify_nova_on_port_data_changes   = true,
   $send_events_interval               = '2',
   $nova_url                           = 'http://127.0.0.1:8774/v2',
+  $auth_plugin                        = 'password',
+  $username                           = 'nova',
+  $password                           = false,
+  $tenant_id                          = undef,
+  $tenant_name                        = 'services',
+  $project_domain_id                  = 'default',
+  $project_name                       = 'services',
+  $user_domain_id                     = 'default',
+  $auth_url                           = 'http://127.0.0.1:35357',
+  $region_name                        = undef,
+  # DEPRECATED PARAMETERS
   $nova_admin_auth_url                = 'http://127.0.0.1:35357/v2.0',
   $nova_admin_username                = 'nova',
   $nova_admin_tenant_name             = 'services',
@@ -76,25 +139,64 @@
   # Depend on the specified keystone_user resource, if it exists.
   Keystone_user <| title == 'nova' |> -> Class[neutron::server::notifications]
 
-  if ! $nova_admin_password {
-    fail('nova_admin_password must be set.')
+  if ! $nova_admin_password and ! $password {
+    fail('nova_admin_password or password must be set.')
   }
 
-  if ! ($nova_admin_tenant_id or $nova_admin_tenant_name) {
+  if $nova_admin_password and !($nova_admin_tenant_id or $nova_admin_tenant_name) {
     fail('You must provide either nova_admin_tenant_name or nova_admin_tenant_id.')
   }
 
+  if $password and !($tenant_id or $tenant_name) {
+    fail('You must provide either tenant_name or tenant_id.')
+  }
+
+  if $nova_admin_password {
+    warning('nova_admin-* parameters are deprecated and will be removed in a future release')
+    neutron_config {
+      'DEFAULT/nova_admin_auth_url': value => $nova_admin_auth_url;
+      'DEFAULT/nova_admin_username': value => $nova_admin_username;
+      'DEFAULT/nova_admin_password': value => $nova_admin_password, secret => true;
+    }
+
+    if $nova_admin_tenant_id {
+      neutron_config {
+        'DEFAULT/nova_admin_tenant_id': value => $nova_admin_tenant_id;
+      }
+    } else {
+      neutron_config {
+        'DEFAULT/nova_admin_tenant_name': value => $nova_admin_tenant_name;
+      }
+    }
+  }
+
+  if $password {
+    neutron_config {
+      'nova/auth_plugin':       value => $auth_plugin;
+      'nova/auth_url':          value => $auth_url;
+      'nova/username':          value => $username;
+      'nova/password':          value => $password, secret => true;
+      'nova/project_domain_id': value => $project_domain_id;
+      'nova/project_name':      value => $project_name;
+      'nova/user_domain_id':    value => $user_domain_id;
+      'nova/tenant_name':       value => $tenant_name;
+    }
+    if $tenant_id {
+      neutron_config {
+        'nova/tenant_id': value => $tenant_id;
+      }
+    }
+  }
+
   neutron_config {
     'DEFAULT/notify_nova_on_port_status_changes': value => $notify_nova_on_port_status_changes;
     'DEFAULT/notify_nova_on_port_data_changes':   value => $notify_nova_on_port_data_changes;
     'DEFAULT/send_events_interval':               value => $send_events_interval;
     'DEFAULT/nova_url':                           value => $nova_url;
-    'DEFAULT/nova_admin_auth_url':                value => $nova_admin_auth_url;
-    'DEFAULT/nova_admin_username':                value => $nova_admin_username;
-    'DEFAULT/nova_admin_password':                value => $nova_admin_password, secret => true;
   }
 
   if $nova_region_name {
+    warning('nova_region_name parameter is deprecated and will be removed in a future release')
     neutron_config {
       'DEFAULT/nova_region_name': value => $nova_region_name;
     }
@@ -104,18 +206,14 @@
     }
   }
 
-  if $nova_admin_tenant_id {
+  if $region_name {
     neutron_config {
-      'DEFAULT/nova_admin_tenant_id': value => $nova_admin_tenant_id;
+      'nova/region_name': value => $region_name;
     }
   } else {
-    nova_admin_tenant_id_setter {'nova_admin_tenant_id':
-      ensure           => present,
-      tenant_name      => $nova_admin_tenant_name,
-      auth_url         => $nova_admin_auth_url,
-      auth_username    => $nova_admin_username,
-      auth_password    => $nova_admin_password,
-      auth_tenant_name => $nova_admin_tenant_name,
+    neutron_config {
+      'nova/region_name': ensure => absent;
     }
   }
+
 }
diff --git a/neutron/metadata.json b/neutron/metadata.json
index 4b06568b8..37973491d 100644
--- a/neutron/metadata.json
+++ b/neutron/metadata.json
@@ -1,6 +1,6 @@
 {
-  "name": "stackforge-neutron",
-  "version": "5.1.0",
+  "name": "openstack-neutron",
+  "version": "6.0.0",
   "author": "OpenStack Contributors",
   "summary": "Puppet module for OpenStack Neutron",
   "license": "Apache-2.0",
@@ -32,11 +32,11 @@
   "description": "Installs and configures OpenStack Neutron (Networking).",
   "dependencies": [
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
-    { "name": "stackforge/keystone", "version_requirement": ">=5.0.0 <6.0.0" },
-    { "name": "stackforge/nova", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/keystone", "version_requirement": ">=6.0.0 <7.0.0" },
+    { "name": "openstack/nova", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
-    { "name": "stackforge/vswitch", "version_requirement": ">=1.0.0 <2.0.0" },
+    { "name": "openstack/vswitch", "version_requirement": ">=2.0.0 <3.0.0" },
     { "name": "duritong/sysctl", "version_requirement": ">=0.0.1 <1.0.0" },
-    { "name": "stackforge/openstacklib", "version_requirement": ">=5.0.0 <6.0.0" }
+    { "name": "openstack/openstacklib", "version_requirement": ">=6.0.0 <7.0.0" }
   ]
 }
diff --git a/neutron/spec/acceptance/basic_neutron_spec.rb b/neutron/spec/acceptance/basic_neutron_spec.rb
index 652a6e9f1..119a02f91 100644
--- a/neutron/spec/acceptance/basic_neutron_spec.rb
+++ b/neutron/spec/acceptance/basic_neutron_spec.rb
@@ -76,7 +76,9 @@ class { '::keystone::endpoint':
         public_url => "https://${::fqdn}:5000/",
         admin_url  => "https://${::fqdn}:35357/",
       }
-
+      class { '::neutron::services::fwaas':
+        enabled => true,
+      }
       # Neutron resources
       class { '::neutron':
         rabbit_user           => 'neutron',
@@ -88,6 +90,7 @@ class { '::neutron':
           'neutron.services.l3_router.l3_router_plugin.L3RouterPlugin',
           'neutron.services.loadbalancer.plugin.LoadBalancerPlugin',
           'neutron.services.metering.metering_plugin.MeteringPlugin',
+          'firewall',
         ],
       }
       class { '::neutron::db::mysql':
@@ -102,13 +105,13 @@ class { '::neutron::server':
         identity_uri        => 'http://127.0.0.1:35357/',
         sync_db             => true,
       }
+      class { '::neutron::agents::lbaas':
+        device_driver => 'neutron_lbaas.services.loadbalancer.drivers.haproxy.namespace_driver.HaproxyNSDriver',
+      }
       class { '::neutron::client': }
       class { '::neutron::quota': }
       class { '::neutron::agents::dhcp': }
       class { '::neutron::agents::l3': }
-      class { '::neutron::agents::lbaas':
-        device_driver => 'neutron_lbaas.services.loadbalancer.drivers.haproxy.namespace_driver.HaproxyNSDriver',
-      }
       class { '::neutron::agents::metering': }
       class { '::neutron::agents::ml2::ovs':
         enable_tunneling => true,
diff --git a/neutron/spec/classes/neutron_agents_ml2_ovs_spec.rb b/neutron/spec/classes/neutron_agents_ml2_ovs_spec.rb
index 48c34b567..d1dbbcf1c 100644
--- a/neutron/spec/classes/neutron_agents_ml2_ovs_spec.rb
+++ b/neutron/spec/classes/neutron_agents_ml2_ovs_spec.rb
@@ -164,13 +164,28 @@
         end
       end
 
-      context 'when l2 population is disabled and DVR enabled' do
+      context 'when l2 population is disabled and DVR and tunneling enabled' do
         before :each do
           params.merge!(:enable_distributed_routing => true,
-                        :l2_population              => false )
+                        :l2_population              => false,
+                        :enable_tunneling           => true,
+                        :local_ip                   => '127.0.0.1' )
         end
 
-        it_raises 'a Puppet::Error', /L2 population must be enabled when DVR is enabled/
+        it_raises 'a Puppet::Error', /L2 population must be enabled when DVR and tunneling are enabled/
+      end
+
+      context 'when DVR is enabled and l2 population and tunneling are disabled' do
+        before :each do
+          params.merge!(:enable_distributed_routing => true,
+                        :l2_population              => false,
+                        :enable_tunneling           => false )
+        end
+
+        it 'should enable DVR without L2 population' do
+          is_expected.to contain_neutron_agent_ovs('agent/enable_distributed_routing').with_value(true)
+          is_expected.to contain_neutron_agent_ovs('agent/l2_population').with_value(false)
+        end
       end
     end
   end
diff --git a/neutron/spec/classes/neutron_agents_n1kv_vem_spec.rb b/neutron/spec/classes/neutron_agents_n1kv_vem_spec.rb
index 484b63638..1e68817ae 100644
--- a/neutron/spec/classes/neutron_agents_n1kv_vem_spec.rb
+++ b/neutron/spec/classes/neutron_agents_n1kv_vem_spec.rb
@@ -67,6 +67,7 @@
     let :params do
     {
       :n1kv_vsm_ip        => '9.0.0.1',
+      :n1kv_vsm_ipv6      => '::3',
       :n1kv_vsm_domain_id => 900,
       :host_mgmt_intf     => 'eth9',
       :portdb             => 'ovs',
@@ -76,6 +77,8 @@
     it do
       is_expected.to contain_file('/etc/n1kv/n1kv.conf') \
         .with_content(/^l3control-ipaddr 9.0.0.1/)
+      is_expected.to contain_file('/etc/n1kv/n1kv.conf') \
+        .with_content(/^l3control-ipv6addr ::3/)
       is_expected.to contain_file('/etc/n1kv/n1kv.conf') \
         .with_content(/^switch-domain 900/)
       is_expected.to contain_file('/etc/n1kv/n1kv.conf') \
@@ -93,6 +96,30 @@
     end
   end
 
+  context 'verify n1kv.conf svs-mode with default IPv6 address' do
+    let :params do
+    {
+      :n1kv_vsm_ipv6 => '::1'
+    }
+    end
+    it do
+      is_expected.to contain_file('/etc/n1kv/n1kv.conf') \
+        .without_content(/^svs-mode V6/)
+    end
+  end
+
+  context 'verify n1kv.conf svs-mode with non-default IPv6 address' do
+    let :params do
+    {
+      :n1kv_vsm_ipv6 => '::3'
+    }
+    end
+    it do
+      is_expected.to contain_file('/etc/n1kv/n1kv.conf') \
+        .with_content(/^svs-mode V6/)
+    end
+  end
+
   context 'verify node_type' do
     let :params do
     {
diff --git a/neutron/spec/classes/neutron_agents_vpnaas_spec.rb b/neutron/spec/classes/neutron_agents_vpnaas_spec.rb
index 35b165cfb..91be65f5d 100644
--- a/neutron/spec/classes/neutron_agents_vpnaas_spec.rb
+++ b/neutron/spec/classes/neutron_agents_vpnaas_spec.rb
@@ -142,7 +142,7 @@
 
     let :platform_params do
       { :openswan_package     => 'openswan',
-        :vpnaas_agent_package => 'openstack-neutron-vpn-agent',
+        :vpnaas_agent_package => 'openstack-neutron-vpnaas',
         :vpnaas_agent_service => 'neutron-vpn-agent'}
     end
 
@@ -159,7 +159,7 @@
 
     let :platform_params do
       { :openswan_package     => 'libreswan',
-        :vpnaas_agent_package => 'openstack-neutron-vpn-agent',
+        :vpnaas_agent_package => 'openstack-neutron-vpnaas',
         :vpnaas_agent_service => 'neutron-vpn-agent'}
     end
 
diff --git a/neutron/spec/classes/neutron_init_spec.rb b/neutron/spec/classes/neutron_init_spec.rb
index 66b5a1641..8e224ea0d 100644
--- a/neutron/spec/classes/neutron_init_spec.rb
+++ b/neutron/spec/classes/neutron_init_spec.rb
@@ -56,6 +56,11 @@
 
     end
 
+    context 'with rabbitmq heartbeat configured' do
+      before { params.merge!( :rabbit_heartbeat_timeout_threshold => '60', :rabbit_heartbeat_rate => '10' ) }
+      it_configures 'rabbit with heartbeat configured'
+    end
+
     it_configures 'with SSL enabled with kombu'
     it_configures 'with SSL enabled without kombu'
     it_configures 'with SSL disabled'
@@ -109,6 +114,8 @@
       is_expected.to contain_neutron_config('oslo_messaging_rabbit/rabbit_password').with_value( params[:rabbit_password] )
       is_expected.to contain_neutron_config('oslo_messaging_rabbit/rabbit_password').with_secret( true )
       is_expected.to contain_neutron_config('oslo_messaging_rabbit/rabbit_virtual_host').with_value( params[:rabbit_virtual_host] )
+      is_expected.to contain_neutron_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('0')
+      is_expected.to contain_neutron_config('oslo_messaging_rabbit/heartbeat_rate').with_value('2')
       is_expected.to contain_neutron_config('oslo_messaging_rabbit/kombu_reconnect_delay').with_value( params[:kombu_reconnect_delay] )
     end
 
@@ -155,6 +162,13 @@
     end
   end
 
+  shared_examples_for 'rabbit with heartbeat configured' do
+    it 'in neutron.conf' do
+      is_expected.to contain_neutron_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('60')
+      is_expected.to contain_neutron_config('oslo_messaging_rabbit/heartbeat_rate').with_value('10')
+    end
+  end
+
   shared_examples_for 'with SSL socket options set' do
     before do
       params.merge!(
@@ -402,6 +416,9 @@
     end
 
     it do
+      is_expected.to contain_class('neutron::agents::lbaas::package')
+      is_expected.to contain_class('neutron::agents::vpnaas::package')
+      is_expected.to contain_class('neutron::services::fwaas')
       is_expected.to contain_neutron_config('DEFAULT/service_plugins').with_value('router,firewall,lbaas,vpnaas,metering')
     end
 
diff --git a/neutron/spec/classes/neutron_plugins_cisco_ml2_spec.rb b/neutron/spec/classes/neutron_plugins_cisco_ml2_spec.rb
index 73ddcf2e2..5fdbd10d5 100644
--- a/neutron/spec/classes/neutron_plugins_cisco_ml2_spec.rb
+++ b/neutron/spec/classes/neutron_plugins_cisco_ml2_spec.rb
@@ -62,3 +62,56 @@ class { 'neutron':
   end
 
 end
+
+
+describe 'neutron::plugins::ml2::cisco::nexus1000v' do
+
+  context 'verify default n1kv params in plugin.ini' do
+
+    let :facts do
+    { :operatingsystem           => 'RedHat',
+      :operatingsystemrelease    => '7',
+      :osfamily => 'RedHat'
+    }
+    end
+
+    let :params do
+    {
+       :n1kv_vsm_ip                   => '9.0.0.1',
+       :n1kv_vsm_username             => 'user1',
+       :n1kv_vsm_password             => 'pasSw0rd',
+       :default_policy_profile        => 'test-pp',
+       :default_vlan_network_profile  => 'test-vlan-np',
+       :default_vxlan_network_profile => 'test-vxlan-np',
+       :poll_duration                 => '120',
+       :http_pool_size                => '6',
+       :http_timeout                  => '60',
+       :sync_interval                 => '30',
+       :max_vsm_retries               => '3',
+       :restrict_policy_profiles      => 'False',
+       :enable_vif_type_n1kv          => 'True',
+    }
+    end
+    let :ml2_params do
+    {
+       :extension_drivers => 'cisco_n1kv_ext',
+    }
+    end
+    it do
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/n1kv_vsm_ips').with_value(params[:n1kv_vsm_ip])
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/username').with_value(params[:n1kv_vsm_username])
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/password').with_value(params[:n1kv_vsm_password])
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/default_policy_profile').with_value(params[:default_policy_profile])
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/default_vlan_network_profile').with_value(params[:default_vlan_network_profile])
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/default_vxlan_network_profile').with_value(params[:default_vxlan_network_profile])
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/poll_duration').with_value(params[:poll_duration])
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/http_pool_size').with_value(params[:http_pool_size])
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/http_timeout').with_value(params[:http_timeout])
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/sync_interval').with_value(params[:sync_interval])
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/max_vsm_retries').with_value(params[:max_vsm_retries])
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/restrict_policy_profiles').with_value(params[:restrict_policy_profiles])
+       is_expected.to contain_neutron_plugin_ml2('ml2_cisco_n1kv/enable_vif_type_n1kv').with_value(params[:enable_vif_type_n1kv])
+       is_expected.to contain_neutron_plugin_ml2('ml2/extension_drivers').with_value(ml2_params[:extension_drivers])
+    end
+  end
+end
diff --git a/neutron/spec/classes/neutron_plugins_ml2_spec.rb b/neutron/spec/classes/neutron_plugins_ml2_spec.rb
index f1b507355..2022fb2d1 100644
--- a/neutron/spec/classes/neutron_plugins_ml2_spec.rb
+++ b/neutron/spec/classes/neutron_plugins_ml2_spec.rb
@@ -193,7 +193,7 @@
         )
       end
       it 'configures sriov mechanism driver with agent_enabled' do
-        is_expected.to contain_neutron_plugin_ml2('ml2_sriov/supported_pci_vendor_dev').with_value(['15b3:1004,8086:10ca'])
+        is_expected.to contain_neutron_plugin_ml2('ml2_sriov/supported_pci_vendor_devs').with_value(['15b3:1004,8086:10ca'])
         is_expected.to contain_neutron_plugin_ml2('ml2_sriov/agent_required').with_value('true')
       end
     end
diff --git a/neutron/spec/classes/neutron_server_notifications_spec.rb b/neutron/spec/classes/neutron_server_notifications_spec.rb
index 8497f6480..93ed7a23a 100644
--- a/neutron/spec/classes/neutron_server_notifications_spec.rb
+++ b/neutron/spec/classes/neutron_server_notifications_spec.rb
@@ -26,6 +26,13 @@
             :notify_nova_on_port_data_changes   => true,
             :send_events_interval               => '2',
             :nova_url                           => 'http://127.0.0.1:8774/v2',
+            :auth_plugin                        => 'password',
+            :username                           => 'nova',
+            :tenant_name                        => 'services',
+            :project_domain_id                  => 'default',
+            :project_name                       => 'services',
+            :user_domain_id                     => 'default',
+            :auth_url                           => 'http://127.0.0.1:35357',
             :nova_admin_auth_url                => 'http://127.0.0.1:35357/v2.0',
             :nova_admin_username                => 'nova',
             :nova_admin_tenant_name             => 'services',
@@ -41,8 +48,8 @@
 
     let :params do
         {
-            :nova_admin_password  => 'secrete',
-            :nova_admin_tenant_id => 'UUID'
+            :password  => 'secrete',
+            :tenant_id => 'UUID'
         }
     end
 
@@ -56,12 +63,17 @@
             is_expected.to contain_neutron_config('DEFAULT/notify_nova_on_port_data_changes').with_value(true)
             is_expected.to contain_neutron_config('DEFAULT/send_events_interval').with_value('2')
             is_expected.to contain_neutron_config('DEFAULT/nova_url').with_value('http://127.0.0.1:8774/v2')
-            is_expected.to contain_neutron_config('DEFAULT/nova_admin_auth_url').with_value('http://127.0.0.1:35357/v2.0')
-            is_expected.to contain_neutron_config('DEFAULT/nova_admin_username').with_value('nova')
-            is_expected.to contain_neutron_config('DEFAULT/nova_admin_password').with_value('secrete')
-            is_expected.to contain_neutron_config('DEFAULT/nova_admin_password').with_secret( true )
-            is_expected.to contain_neutron_config('DEFAULT/nova_admin_tenant_id').with_value('UUID')
-            is_expected.to contain_neutron_config('DEFAULT/nova_region_name').with_ensure('absent')
+            is_expected.to contain_neutron_config('nova/auth_url').with_value('http://127.0.0.1:35357')
+            is_expected.to contain_neutron_config('nova/username').with_value('nova')
+            is_expected.to contain_neutron_config('nova/password').with_value('secrete')
+            is_expected.to contain_neutron_config('nova/password').with_secret( true )
+            is_expected.to contain_neutron_config('nova/tenant_id').with_value('UUID')
+            is_expected.to contain_neutron_config('nova/region_name').with_ensure('absent')
+            is_expected.not_to contain_neutron_config('DEFAULT/nova_admin_auth_url')
+            is_expected.not_to contain_neutron_config('DEFAULT/nova_admin_username')
+            is_expected.not_to contain_neutron_config('DEFAULT/nova_admin_password')
+            is_expected.not_to contain_neutron_config('DEFAULT/nova_admin_password')
+            is_expected.not_to contain_neutron_config('DEFAULT/nova_admin_tenant_id')
         end
 
         context 'when overriding parameters' do
@@ -71,10 +83,11 @@
                     :notify_nova_on_port_data_changes   => false,
                     :send_events_interval               => '10',
                     :nova_url                           => 'http://nova:8774/v3',
-                    :nova_admin_auth_url                => 'http://keystone:35357/v2.0',
-                    :nova_admin_username                => 'joe',
-                    :nova_region_name                   => 'MyRegion',
-                    :nova_admin_tenant_id               => 'UUID2'
+                    :auth_url                           => 'http://keystone:35357/v2.0',
+                    :auth_plugin                        => 'v2.password',
+                    :username                           => 'joe',
+                    :region_name                        => 'MyRegion',
+                    :tenant_id                          => 'UUID2'
                 )
             end
             it 'should configure neutron server with overrided parameters' do
@@ -82,21 +95,49 @@
                 is_expected.to contain_neutron_config('DEFAULT/notify_nova_on_port_data_changes').with_value(false)
                 is_expected.to contain_neutron_config('DEFAULT/send_events_interval').with_value('10')
                 is_expected.to contain_neutron_config('DEFAULT/nova_url').with_value('http://nova:8774/v3')
+                is_expected.to contain_neutron_config('nova/auth_url').with_value('http://keystone:35357/v2.0')
+                is_expected.to contain_neutron_config('nova/auth_plugin').with_value('v2.password')
+                is_expected.to contain_neutron_config('nova/username').with_value('joe')
+                is_expected.to contain_neutron_config('nova/password').with_value('secrete')
+                is_expected.to contain_neutron_config('nova/password').with_secret( true )
+                is_expected.to contain_neutron_config('nova/region_name').with_value('MyRegion')
+                is_expected.to contain_neutron_config('nova/tenant_id').with_value('UUID2')
+            end
+        end
+
+        context 'when using deprecated parameters' do
+            before :each do
+                params.merge!(
+                    :nova_admin_auth_url  => 'http://keystone:35357/v2.0',
+                    :nova_admin_username  => 'joe',
+                    :nova_admin_password  => 'secrete',
+                    :nova_region_name     => 'MyRegion',
+                    :nova_admin_tenant_id => 'UUID2',
+                    :password             => false
+                )
+            end
+            it 'should configure neutron server with deprecated parameters' do
                 is_expected.to contain_neutron_config('DEFAULT/nova_admin_auth_url').with_value('http://keystone:35357/v2.0')
                 is_expected.to contain_neutron_config('DEFAULT/nova_admin_username').with_value('joe')
                 is_expected.to contain_neutron_config('DEFAULT/nova_admin_password').with_value('secrete')
                 is_expected.to contain_neutron_config('DEFAULT/nova_admin_password').with_secret( true )
                 is_expected.to contain_neutron_config('DEFAULT/nova_region_name').with_value('MyRegion')
                 is_expected.to contain_neutron_config('DEFAULT/nova_admin_tenant_id').with_value('UUID2')
+                is_expected.not_to contain_neutron_config('nova/auth_url')
+                is_expected.not_to contain_neutron_config('nova/username')
+                is_expected.not_to contain_neutron_config('nova/password')
+                is_expected.not_to contain_neutron_config('nova/tenant_id')
             end
         end
 
-        context 'when no nova_admin_password is specified' do
+        context 'when no nova_admin_password or password is specified' do
             before :each do
-                params.merge!({ :nova_admin_password => false })
+                params.merge!({
+                  :nova_admin_password => false,
+                  :password            => false })
             end
 
-            it_raises 'a Puppet::Error', /nova_admin_password must be set./
+            it_raises 'a Puppet::Error', /nova_admin_password or password must be set./
         end
 
         context 'when no nova_admin_tenant_id and nova_admin_tenant_name specified' do
@@ -104,27 +145,36 @@
                 params.merge!({
                   :nova_admin_tenant_name => false,
                   :nova_admin_tenant_id   => false,
+                  :nova_admin_password    => 'secrete',
                 })
             end
 
             it_raises 'a Puppet::Error', /You must provide either nova_admin_tenant_name or nova_admin_tenant_id./
         end
 
-        context 'when providing a tenant name' do
+        context 'when no tenant_id and tenant_name specified' do
+            before :each do
+                params.merge!({
+                  :tenant_name => false,
+                  :tenant_id   => false,
+                  :password    => 'secrete',
+                })
+            end
+
+            it_raises 'a Puppet::Error', /You must provide either tenant_name or tenant_id./
+        end
+
+        context 'when providing a nova_tenant_name' do
             before :each do
                 params.merge!({
                   :nova_admin_tenant_name => 'services',
                   :nova_admin_tenant_id   => false,
+                  :nova_admin_password    => 'secrete',
+                  :password               => false
                 })
             end
-            it 'should configure nova admin tenant id' do
-              is_expected.to contain_nova_admin_tenant_id_setter('nova_admin_tenant_id').with(
-                :ensure           => 'present',
-                :tenant_name      => 'services',
-                :auth_url         => 'http://127.0.0.1:35357/v2.0',
-                :auth_password    => 'secrete',
-                :auth_tenant_name => 'services'
-              )
+            it 'should configure nova admin tenant name' do
+              is_expected.to contain_neutron_config('DEFAULT/nova_admin_tenant_name').with_value('services')
             end
         end
     end
diff --git a/neutron/spec/classes/neutron_server_spec.rb b/neutron/spec/classes/neutron_server_spec.rb
index ad0fbe1fa..b046fbae0 100644
--- a/neutron/spec/classes/neutron_server_spec.rb
+++ b/neutron/spec/classes/neutron_server_spec.rb
@@ -96,7 +96,7 @@
         :ensure  => 'running',
         :require => 'Class[Neutron]'
       )
-      is_expected.not_to contain_exec('neutron-db-sync')
+      is_expected.not_to contain_class('neutron::db::sync')
       is_expected.to contain_neutron_api_config('filter:authtoken/auth_admin_prefix').with(
         :ensure => 'absent'
       )
@@ -236,14 +236,8 @@
         :sync_db => true
       )
     end
-    it 'should exec neutron-db-sync' do
-      is_expected.to contain_exec('neutron-db-sync').with(
-        :command     => 'neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini upgrade head',
-        :path        => '/usr/bin',
-        :before      => 'Service[neutron-server]',
-        :subscribe   => 'Neutron_config[database/connection]',
-        :refreshonly => true
-      )
+    it 'includes neutron::db::sync' do
+      is_expected.to contain_class('neutron::db::sync')
     end
   end
 
diff --git a/neutron/spec/spec_helper_acceptance.rb b/neutron/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/neutron/spec/spec_helper_acceptance.rb
+++ b/neutron/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/neutron/spec/unit/provider/nova_admin_tenant_id_setter/neutron_spec.rb b/neutron/spec/unit/provider/nova_admin_tenant_id_setter/neutron_spec.rb
deleted file mode 100644
index 2dd22a988..000000000
--- a/neutron/spec/unit/provider/nova_admin_tenant_id_setter/neutron_spec.rb
+++ /dev/null
@@ -1,212 +0,0 @@
-require 'spec_helper'
-require 'puppet'
-require 'puppet/type/nova_admin_tenant_id_setter'
-
-provider_class = Puppet::Type.type(:nova_admin_tenant_id_setter).provider(:ruby)
-
-# used to simulate an authentication response from Keystone
-# (POST v2.0/tokens)
-auth_response = {
-    'access' => {
-        'token' => {
-            'id' => 'TOKEN',
-        }
-    }
-}
-
-# used to simulate a response to GET v2.0/tenants
-tenants_response = {
-    'tenants' => [
-        {
-            'name' => 'services',
-            'id'   => 'UUID_SERVICES'
-        },
-        {
-            'name' => 'multiple_matches_tenant',
-            'id'   => 'UUID1'
-        },
-        {
-            'name' => 'multiple_matches_tenant',
-            'id'   => 'UUID2'
-        },
-    ]
-}
-
-# Stub for ini_setting resource
-Puppet::Type.newtype(:ini_setting) do
-end
-
-# Stub for ini_setting provider
-Puppet::Type.newtype(:ini_setting).provide(:ruby) do
-    def create
-    end
-end
-
-describe 'Puppet::Type.type(:nova_admin_tenant_id_setter)' do
-    let :params do
-        {
-            :name             => 'nova_admin_tenant_id',
-            :tenant_name      => 'services',
-            :auth_username    => 'nova',
-            :auth_password    => 'secret',
-            :auth_tenant_name => 'admin',
-            :auth_url         => 'http://127.0.0.1:35357/v2.0',
-        }
-    end
-
-    it 'should have a non-nil provider' do
-        expect(provider_class).not_to be_nil
-    end
-
-    context 'when url is correct' do
-        before :each do
-            stub_request(:post, "http://127.0.0.1:35357/v2.0/tokens").
-                to_return(:status => 200,
-                          :body => auth_response.to_json,
-                          :headers => {})
-            stub_request(:get, "http://127.0.0.1:35357/v2.0/tenants").
-                with(:headers => {'X-Auth-Token'=>'TOKEN'}).
-                to_return(:status => 200,
-                          :body => tenants_response.to_json,
-                          :headers => {})
-        end
-
-        it 'should create a resource' do
-            resource = Puppet::Type::Nova_admin_tenant_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect(provider.create).to be_nil
-        end
-
-        context 'when tenant id already set' do
-            it 'should create a resource, with exists? true' do
-                mock = { 'DEFAULT' => { 'nova_admin_tenant_id' => 'UUID_SERVICES' } }
-                Puppet::Util::IniConfig::File.expects(:new).returns(mock)
-                mock.expects(:read).with('/etc/neutron/neutron.conf')
-
-                resource = Puppet::Type::Nova_admin_tenant_id_setter.new(params)
-                provider = provider_class.new(resource)
-                expect(provider.exists?).to be_truthy
-                expect(provider.create).to be_nil
-            end
-        end
-    end
-
-    # What happens if we ask for a tenant that does not exist?
-    context 'when tenant cannot be found' do
-        before :each do
-            stub_request(:post, "http://127.0.0.1:35357/v2.0/tokens").
-                to_return(:status => 200,
-                          :body => auth_response.to_json,
-                          :headers => {})
-            stub_request(:get, "http://127.0.0.1:35357/v2.0/tenants").
-                with(:headers => {'X-Auth-Token'=>'TOKEN'}).
-                to_return(:status => 200,
-                          :body => tenants_response.to_json,
-                          :headers => {})
-
-            params.merge!(:tenant_name => 'bad_tenant_name')
-        end
-
-        it 'should receive an api error' do
-            resource = Puppet::Type::Nova_admin_tenant_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect { provider.create }.to raise_error KeystoneAPIError, /Unable to find matching tenant/
-        end
-    end
-
-    # What happens if we ask for a tenant name that results in multiple
-    # matches?
-    context 'when there are multiple matching tenants' do
-        before :each do
-            stub_request(:post, "http://127.0.0.1:35357/v2.0/tokens").
-                to_return(:status => 200,
-                          :body => auth_response.to_json,
-                          :headers => {})
-            stub_request(:get, "http://127.0.0.1:35357/v2.0/tenants").
-                with(:headers => {'X-Auth-Token'=>'TOKEN'}).
-                to_return(:status => 200,
-                          :body => tenants_response.to_json,
-                          :headers => {})
-
-            params.merge!(:tenant_name => 'multiple_matches_tenant')
-        end
-
-        it 'should receive an api error' do
-            resource = Puppet::Type::Nova_admin_tenant_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect { provider.create }.to raise_error KeystoneAPIError, /Found multiple matches for tenant name/
-        end
-    end
-
-    # What happens if we pass a bad password?
-    context 'when password is incorrect' do
-        before :each do
-            stub_request(:post, "http://127.0.0.1:35357/v2.0/tokens").
-                to_return(:status => 401,
-                          :body => auth_response.to_json,
-                          :headers => {})
-        end
-
-        it 'should receive an authentication error' do
-            resource = Puppet::Type::Nova_admin_tenant_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect { provider.create }.to raise_error KeystoneAPIError
-        end
-    end
-
-    # What happens if the server is not listening?
-    context 'when keystone server is unavailable' do
-        before :each do
-            stub_request(:post, "http://127.0.0.1:35357/v2.0/tokens").to_raise Errno::ECONNREFUSED
-        end
-
-        it 'should receive a connection error' do
-            resource = Puppet::Type::Nova_admin_tenant_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect { provider.create }.to raise_error KeystoneConnectionError
-        end
-    end
-
-    # What happens if we mistype the hostname?
-    context 'when keystone server is unknown' do
-        before :each do
-            stub_request(:post, "http://127.0.0.1:35357/v2.0/tokens").to_raise SocketError, 'getaddrinfo: Name or service not known'
-        end
-
-        it 'should receive a connection error' do
-            resource = Puppet::Type::Nova_admin_tenant_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect { provider.create }.to raise_error KeystoneConnectionError
-        end
-    end
-
-    context 'when using secure keystone endpoint' do
-        before :each do
-            params.merge!(:auth_url => "https://127.0.0.1:35357/v2.0")
-            stub_request(:post, "https://127.0.0.1:35357/v2.0/tokens").
-                to_return(:status => 200,
-                          :body => auth_response.to_json,
-                          :headers => {})
-            stub_request(:get, "https://127.0.0.1:35357/v2.0/tenants").
-                with(:headers => {'X-Auth-Token'=>'TOKEN'}).
-                to_return(:status => 200,
-                          :body => tenants_response.to_json,
-                          :headers => {})
-        end
-
-        it 'should create a resource' do
-            resource = Puppet::Type::Nova_admin_tenant_id_setter.new(params)
-            provider = provider_class.new(resource)
-            expect(provider.exists?).to be_falsey
-            expect(provider.create).to be_nil
-        end
-    end
-
-end
-
diff --git a/neutron/templates/ml2_mech_cisco_nexus_conf.erb b/neutron/templates/ml2_mech_cisco_nexus_conf.erb
new file mode 100644
index 000000000..b9209274b
--- /dev/null
+++ b/neutron/templates/ml2_mech_cisco_nexus_conf.erb
@@ -0,0 +1,59 @@
+# Cisco Nexus Switch configurations.
+# Each switch to be managed by Openstack Neutron must be configured here.
+#
+# Cisco Nexus Switch Format.
+# [ml2_mech_cisco_nexus:<IP address of switch>]
+# <hostname>=<intf_type:port>       (1)
+# ssh_port=<ssh port>               (2)
+# username=<credential username>    (3)
+# password=<credential password>    (4)
+# nve_src_intf=<loopback number>    (5)
+# physnet=<physical network>        (6)
+#
+# (1) For each host connected to a port on the switch, specify the hostname
+#     and the Nexus physical port (interface) it is connected to.
+#     Valid intf_type's are 'ethernet' and 'port-channel'.
+#     The default setting for <intf_type:> is 'ethernet' and need not be
+#     added to this setting.
+# (2) The TCP port for connecting via SSH to manage the switch. This is
+#     port number 22 unless the switch has been configured otherwise.
+# (3) The username for logging into the switch to manage it.
+# (4) The password for logging into the switch to manage it.
+# (5) Only valid if VXLAN overlay is configured and vxlan_global_config is
+#     set to True.
+#     The NVE source interface is a loopback interface that is configured on
+#     the switch with valid /32 IP address. This /32 IP address must be known
+#     by the transient devices in the transport network and the remote VTEPs.
+#     This is accomplished by advertising it through a dynamic routing protocol
+#     in the transport network. (NB: If no nve_src_intf is defined then a
+#     default setting of 0 (creates "loopback0") will be used.)
+# (6) Only valid if VXLAN overlay is configured.
+#     The physical network name defined in the network_vlan_ranges variable
+#     (defined under the ml2_type_vlan section) that this switch is controlling.
+#     The configured 'physnet' is the physical network domain that is connected
+#     to this switch. The vlan ranges defined in network_vlan_ranges for a
+#     a physical network are allocated dynamically and are unique per physical
+#     network. These dynamic vlans may be reused across physical networks.
+#
+# Example:
+# [ml2_mech_cisco_nexus:1.1.1.1]
+# compute1=1/1
+# compute2=ethernet:1/2
+# compute3=port-channel:1
+# ssh_port=22
+# username=admin
+# password=mySecretPassword
+# nve_src_intf=1
+# physnet=physnet1
+
+<% @nexus_config.each do |switch_hostname, switch_data| %>
+[ML2_MECH_CISCO_NEXUS:<%= switch_data['ip_address'] %>]
+<%- switch_data['servers'].each do |host_name, port| -%>
+<%=host_name-%>=<%= port %>
+<%- end -%>
+ssh_port=<%= switch_data['ssh_port'] %>
+username=<%= switch_data['username'] %>
+password=<%= switch_data['password'] %>
+nve_src_intf=<%= switch_data['nve_src_intf'] %>
+physnet=<%= switch_data['physnet'] %>
+<% end %>
diff --git a/neutron/templates/n1kv.conf.erb b/neutron/templates/n1kv.conf.erb
index dd9409432..c2fccc340 100644
--- a/neutron/templates/n1kv.conf.erb
+++ b/neutron/templates/n1kv.conf.erb
@@ -29,6 +29,21 @@ switch-domain <%= @n1kv_vsm_domain_id %>
 # restart_on_modify: No
 l3control-ipaddr <%= @n1kv_vsm_ip %>
 
+# TAG: l3control-ipv6addr
+# Description: IPv6 Address of VSM Mgmt I/F
+# Optional: No
+# Default: ::1
+# restart_on_modify: No
+l3control-ipv6addr <%= @n1kv_vsm_ipv6 %>
+
+# Set svs-mode to V6 if IPv6 address for VSM
+# is set to something other than default ::1.
+# This tells VEM to communicate with VSM on
+# IPv6 instead of the default IPv4 option
+<% if @n1kv_vsm_ipv6 != '::1' -%>
+svs-mode V6
+<% end -%>
+
 # TAG: host-mgmt-intf
 # Description: Management interface of the Host
 # Optional: No (on N1KV, we need this
diff --git a/nova/CHANGELOG.md b/nova/CHANGELOG.md
index 70688bc4b..68dcbe8ac 100644
--- a/nova/CHANGELOG.md
+++ b/nova/CHANGELOG.md
@@ -1,3 +1,52 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+This is a backwards-incompatible major release for OpenStack Kilo.
+
+####Backwards-incompatible changes
+- Remove deprecated parameters
+- Disable file injection when using RBD as compute ephemeral storage
+- Remove Python Package Declaration
+- move setting of novncproxy_base_url
+- Move rabbit/kombu settings to oslo_messaging_rabbit section
+- MySQL: change default MySQL collate to utf8_general_ci
+- Moved spice configuration options from DEFAULT to spice section
+
+####Features
+- Puppet 4.x support
+- Refactorise Keystone resources management
+- Configure database parameters on the right nodes
+- Add parameters for availability zones configuration
+- Migrate postgresql backend to use openstacklib::db::postgresql
+- Allow auth_name and auth_name_v3 to be the same
+- Add an option to not configure RabbitMQ service
+- Database: add slave_connection support
+- Support for heal_instance_info_cache_interval
+- Only tag packages with openstack tag
+- Add PCI Passthrough/SR-IOV support
+- Add support for identity_uri
+- IPv6 support for migration check
+- Allow libvirt secret key setting from param
+- Adds OracleLinux support
+- Ensure /etc/nova exists before creating secret.xml
+- Run db-sync if nova packages are upgraded
+- Make package 'bridge-utils' install optional
+- Introduce public_url, internal_url and admin_url (and v3/ec2)
+- Better handling of package dependencies in nova generic_service
+- Add scheduler_driver parameter to nova::scheduler class
+- Add parameter to control use of rbd for the ephemeral storage
+- Install only required libvirt packages
+- keystone/auth: make service description configurable
+
+####Bugfixes
+- Fix catalog compilation when not configuring endpoint
+- Fix behaviour of 'set-secret-value virsh' exec
+- Fix variable access in RBD secret template
+
+####Maintenance
+- Acceptance tests with Beaker
+- Fix spec tests for RSpec 3.x and Puppet 4.x
+
 ##2015-06-17 - 5.1.0
 ###Summary
 
diff --git a/nova/README.md b/nova/README.md
index 9abc48838..02b0034b3 100644
--- a/nova/README.md
+++ b/nova/README.md
@@ -1,7 +1,7 @@
 nova
 ====
 
-5.1.0 - 2014.2 - Juno
+6.0.0 - 2015.1 - Kilo
 
 #### Table of Contents
 
diff --git a/nova/lib/puppet/provider/nova_admin/nova_manage.rb b/nova/lib/puppet/provider/nova_admin/nova_manage.rb
deleted file mode 100644
index 6dd4cb47c..000000000
--- a/nova/lib/puppet/provider/nova_admin/nova_manage.rb
+++ /dev/null
@@ -1,20 +0,0 @@
-Puppet::Type.type(:nova_admin).provide(:nova_manage) do
-
-  desc "Manage nova admin user"
-
-  optional_commands :nova_manage => 'nova-manage'
-
-  def exists?
-    nova_manage("user", "list").match(/^#{resource[:name]}$/)
-  end
-
-  def create
-    nova_manage("user", "admin", resource[:name])
-  end
-
-  def destroy
-    nova_manage("user", "delete", resource[:name])
-  end
-
-end
-
diff --git a/nova/lib/puppet/provider/nova_network/nova_manage.rb b/nova/lib/puppet/provider/nova_network/nova_manage.rb
index 6da03a39d..c4cb3bd10 100644
--- a/nova/lib/puppet/provider/nova_network/nova_manage.rb
+++ b/nova/lib/puppet/provider/nova_network/nova_manage.rb
@@ -2,7 +2,7 @@
 
   desc "Manage nova network"
 
-  optional_commands :nova_manage => 'nova-manage'
+  optional_commands :nova_manage => 'nova-manage', :nova => 'nova'
 
   # I need to setup caching and what-not to make this lookup performance not suck
   def self.instances
@@ -30,18 +30,19 @@ def create
       :dns2             => '--dns2',
       :gateway          => '--gateway',
       :bridge           => '--bridge',
-      :vlan_start       => '--vlan_start'
+      :vlan_start       => '--vlan-start',
+      :allowed_start    => '--allowed-start',
+      :allowed_end      => '--allowed-end',
     }.each do |param, opt|
       if resource[param]
         optional_opts.push(opt).push(resource[param])
       end
     end
 
-    nova_manage('network', 'create',
+    nova('network-create',
       resource[:label],
+      '--fixed-range-v4',
       resource[:name],
-      resource[:num_networks],
-      resource[:network_size],
       optional_opts
     )
   end
diff --git a/nova/lib/puppet/provider/nova_project/nova_manage.rb b/nova/lib/puppet/provider/nova_project/nova_manage.rb
deleted file mode 100644
index 31a818f72..000000000
--- a/nova/lib/puppet/provider/nova_project/nova_manage.rb
+++ /dev/null
@@ -1,19 +0,0 @@
-Puppet::Type.type(:nova_project).provide(:nova_manage) do
-
-  desc "Manage nova project"
-
-  optional_commands :nova_manage => 'nova-manage'
-
-  def exists?
-    nova_manage("project", "list").match(/^#{resource[:name]}$/)
-  end
-
-  def create
-    nova_manage("project", "create", resource[:name], resource[:owner])
-  end
-
-  def destroy
-    nova_manage("project", "delete", resource[:name])
-  end
-
-end
diff --git a/nova/lib/puppet/type/nova_admin.rb b/nova/lib/puppet/type/nova_admin.rb
deleted file mode 100644
index 2df9210bf..000000000
--- a/nova/lib/puppet/type/nova_admin.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-Puppet::Type.newtype(:nova_admin) do
-
-  @doc = "Manage creation/deletion of nova admin users."
-
-  ensurable
-
-  newparam(:name, :namevar => true) do
-    desc "The name of the admins."
-  end
-
-end
diff --git a/nova/lib/puppet/type/nova_network.rb b/nova/lib/puppet/type/nova_network.rb
index 3a750e02e..c9e654d93 100644
--- a/nova/lib/puppet/type/nova_network.rb
+++ b/nova/lib/puppet/type/nova_network.rb
@@ -37,6 +37,16 @@
   newparam(:dns2) do
   end
 
+  newparam(:allowed_start) do
+    desc 'Start of allowed addresses for instances'
+    newvalues(/^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/)
+  end
+
+  newparam(:allowed_end) do
+    desc 'End of allowed addresses for instances'
+    newvalues(/^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/)
+  end
+
   newparam(:vlan_start) do
   end
 
diff --git a/nova/lib/puppet/type/nova_project.rb b/nova/lib/puppet/type/nova_project.rb
deleted file mode 100644
index f538d2e2c..000000000
--- a/nova/lib/puppet/type/nova_project.rb
+++ /dev/null
@@ -1,21 +0,0 @@
-Puppet::Type.newtype(:nova_project) do
-
-  @doc = "Manage creation/deletion of nova projects."
-
-  ensurable
-
-  newparam(:name, :namevar => true) do
-    desc "The name of the project."
-  end
-
-  newparam(:owner) do
-    desc "Owner of this project. *This is only set on project creation*"
-  end
-
-  # newproperty(:owner) - this needs to be a property
-
-  autorequire(:nova_admin) do
-    [self[:owner]]
-  end
-
-end
diff --git a/nova/manifests/api.pp b/nova/manifests/api.pp
index a21eaf817..24cd2a960 100644
--- a/nova/manifests/api.pp
+++ b/nova/manifests/api.pp
@@ -98,6 +98,10 @@
 #   Class instead.
 #   Defaults to undef
 #
+# [*instance_name_template*]
+#   (optional) Template string to be used to generate instance names
+#   Defaults to undef
+#
 # [*sync_db*]
 #   (optional) Run nova-manage db sync on api nodes after installing the package.
 #   Defaults to true
@@ -172,8 +176,9 @@
   $ratelimits            = undef,
   $ratelimits_factory    =
     'nova.api.openstack.compute.limits:RateLimitingMiddleware.factory',
-  $validate              = false,
-  $validation_options    = {},
+  $validate                  = false,
+  $validation_options        = {},
+  $instance_name_template    = undef,
   # DEPRECATED PARAMETER
   $auth_protocol         = 'http',
   $auth_port             = 35357,
@@ -202,6 +207,16 @@
     warning('The conductor_workers parameter is deprecated and has no effect. Use workers parameter of nova::conductor class instead.')
   }
 
+  if $instance_name_template {
+    nova_config {
+      'DEFAULT/instance_name_template': value => $instance_name_template;
+    }
+  } else {
+    nova_config{
+      'DEFAULT/instance_name_template': ensure => absent;
+    }
+  }
+
   nova::generic_service { 'api':
     enabled        => $enabled,
     manage_service => $manage_service,
diff --git a/nova/manifests/compute/ironic.pp b/nova/manifests/compute/ironic.pp
index 52bb37596..ae5c8800f 100644
--- a/nova/manifests/compute/ironic.pp
+++ b/nova/manifests/compute/ironic.pp
@@ -24,13 +24,16 @@
 #   The url for Ironic api endpoint.
 #   Defaults to 'http://127.0.0.1:6385/v1'
 #
+# [*compute_driver*]
+#   (optional) Compute driver.
+#   Defaults to 'ironic.IronicDriver'
+#
 # [*admin_user*]
 #   (optional) DEPRECATED: Use admin_username instead.
 #
 # [*admin_passwd*]
 #   (optional) DEPRECATED: Use admin_password instead.
 #
-
 class nova::compute::ironic (
   $admin_username       = 'admin',
   $admin_password       = 'ironic',
@@ -40,6 +43,7 @@
   # DEPRECATED PARAMETERS
   $admin_user           = undef,
   $admin_passwd         = undef,
+  $compute_driver       = 'ironic.IronicDriver'
 ) {
 
   if $admin_user {
@@ -59,6 +63,6 @@
     'ironic/admin_url':                 value => $admin_url;
     'ironic/admin_tenant_name':         value => $admin_tenant_name;
     'ironic/api_endpoint':              value => $api_endpoint;
-    'DEFAULT/compute_driver':           value => 'nova.virt.ironic.IronicDriver';
+    'DEFAULT/compute_driver':           value => $compute_driver;
   }
 }
diff --git a/nova/manifests/compute/libvirt.pp b/nova/manifests/compute/libvirt.pp
index 7f7e5df65..f6834ca54 100644
--- a/nova/manifests/compute/libvirt.pp
+++ b/nova/manifests/compute/libvirt.pp
@@ -78,6 +78,10 @@
 #   (optional) libvirt service name.
 #   Defaults to $::nova::params::libvirt_service_name
 #
+# [*compute_driver*]
+#   (optional) Compute driver.
+#   Defaults to 'libvirt.LibvirtDriver'
+#
 class nova::compute::libvirt (
   $libvirt_virt_type                          = 'kvm',
   $vncserver_listen                           = '127.0.0.1',
@@ -92,6 +96,7 @@
   $remove_unused_resized_minimum_age_seconds  = undef,
   $remove_unused_original_minimum_age_seconds = undef,
   $libvirt_service_name                       = $::nova::params::libvirt_service_name,
+  $compute_driver                             = 'libvirt.LibvirtDriver'
 ) inherits nova::params {
 
   include ::nova::params
@@ -171,7 +176,7 @@
   }
 
   nova_config {
-    'DEFAULT/compute_driver':   value => 'libvirt.LibvirtDriver';
+    'DEFAULT/compute_driver':   value => $compute_driver;
     'DEFAULT/vncserver_listen': value => $vncserver_listen;
     'libvirt/virt_type':        value => $libvirt_virt_type;
     'libvirt/cpu_mode':         value => $libvirt_cpu_mode_real;
diff --git a/nova/manifests/compute/vmware.pp b/nova/manifests/compute/vmware.pp
index 5432e5bcf..40b2d460d 100644
--- a/nova/manifests/compute/vmware.pp
+++ b/nova/manifests/compute/vmware.pp
@@ -43,21 +43,25 @@
 #   default location for bug work-arounds.
 #   Defaults to None.
 #
-
+# [*compute_driver*]
+#   (optional) Compute driver.
+#   Defaults to 'vmwareapi.VMwareVCDriver'
+#
 class nova::compute::vmware(
   $host_ip,
   $host_username,
   $host_password,
   $cluster_name,
-  $api_retry_count=5,
-  $maximum_objects=100,
-  $task_poll_interval=5.0,
-  $use_linked_clone=true,
-  $wsdl_location=undef
+  $api_retry_count = 5,
+  $maximum_objects = 100,
+  $task_poll_interval = 5.0,
+  $use_linked_clone = true,
+  $wsdl_location = undef,
+  $compute_driver = 'vmwareapi.VMwareVCDriver'
 ) {
 
   nova_config {
-    'DEFAULT/compute_driver':      value => 'vmwareapi.VMwareVCDriver';
+    'DEFAULT/compute_driver':      value => $compute_driver;
     'VMWARE/host_ip':              value => $host_ip;
     'VMWARE/host_username':        value => $host_username;
     'VMWARE/host_password':        value => $host_password;
diff --git a/nova/manifests/compute/xenserver.pp b/nova/manifests/compute/xenserver.pp
index f28c0b486..cebd6d23e 100644
--- a/nova/manifests/compute/xenserver.pp
+++ b/nova/manifests/compute/xenserver.pp
@@ -13,24 +13,31 @@
 # [*xenapi_connection_password*]
 #   (required) Password for connection to XenServer/Xen Cloud Platform
 #
+# [*compute_driver*]
+#   (optional) Compute driver.
+#   Defaults to 'xenapi.XenAPIDriver'
+#
 # [*xenapi_inject_image*]
-#   (optional) This parameter was removed in Diablo and does nothing.
-#   Defaults to false
+#   (optional) DEPRECATED: This parameter does nothing.
 #
 class nova::compute::xenserver(
   $xenapi_connection_url,
   $xenapi_connection_username,
   $xenapi_connection_password,
-  $xenapi_inject_image=false
+  $compute_driver = 'xenapi.XenAPIDriver',
+  # DEPRECATED PARAMETERS
+  $xenapi_inject_image = undef,
 ) {
 
+  if $xenapi_inject_image != undef {
+    warning('The xenapi_inject_image parameter is deprecated and has no effect.')
+  }
+
   nova_config {
-    'DEFAULT/compute_driver':             value => 'xenapi.XenAPIDriver';
-    'DEFAULT/connection_type':            value => 'xenapi';
+    'DEFAULT/compute_driver':             value => $compute_driver;
     'DEFAULT/xenapi_connection_url':      value => $xenapi_connection_url;
     'DEFAULT/xenapi_connection_username': value => $xenapi_connection_username;
     'DEFAULT/xenapi_connection_password': value => $xenapi_connection_password;
-    'DEFAULT/xenapi_inject_image':        value => $xenapi_inject_image;
   }
 
   ensure_packages(['python-pip'])
diff --git a/nova/manifests/cron/archive_deleted_rows.pp b/nova/manifests/cron/archive_deleted_rows.pp
index b8335462e..9574977f9 100644
--- a/nova/manifests/cron/archive_deleted_rows.pp
+++ b/nova/manifests/cron/archive_deleted_rows.pp
@@ -45,18 +45,23 @@
 #    (optional) User with access to nova files.
 #    Defaults to 'nova'.
 #
+#  [*destination*]
+#    (optional) Path to file to which rows should be archived
+#    Defaults to '/var/log/nova/nova-rowsflush.log'.
+#
 class nova::cron::archive_deleted_rows (
-  $minute   = 1,
-  $hour     = 0,
-  $monthday = '*',
-  $month    = '*',
-  $weekday  = '*',
-  $max_rows = '100',
-  $user     = 'nova',
+  $minute      = 1,
+  $hour        = 0,
+  $monthday    = '*',
+  $month       = '*',
+  $weekday     = '*',
+  $max_rows    = '100',
+  $user        = 'nova',
+  $destination = '/var/log/nova/nova-rowsflush.log'
 ) {
 
   cron { 'nova-manage db archive_deleted_rows':
-    command     => "nova-manage db archive_deleted_rows --max_rows ${max_rows} >>/var/log/nova/nova-rowsflush.log 2>&1",
+    command     => "nova-manage db archive_deleted_rows --max_rows ${max_rows} >>${destination} 2>&1",
     environment => 'PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh',
     user        => $user,
     minute      => $minute,
diff --git a/nova/manifests/init.pp b/nova/manifests/init.pp
index 8b91bb7b2..ecf7d4089 100644
--- a/nova/manifests/init.pp
+++ b/nova/manifests/init.pp
@@ -72,6 +72,21 @@
 #   (optional) Use HA queues in RabbitMQ.
 #   Defaults to undef
 #
+# [*rabbit_heartbeat_timeout_threshold*]
+#   (optional) Number of seconds after which the RabbitMQ broker is considered
+#   down if the heartbeat keepalive fails.  Any value >0 enables heartbeats.
+#   Heartbeating helps to ensure the TCP connection to RabbitMQ isn't silently
+#   closed, resulting in missed or lost messages from the queue.
+#   (Requires kombu >= 3.0.7 and amqp >= 1.4.0)
+#   Defaults to 0
+#
+# [*rabbit_heartbeat_rate*]
+#   (optional) How often during the rabbit_heartbeat_timeout_threshold period to
+#   check the heartbeat on RabbitMQ connection.  (i.e. rabbit_heartbeat_rate=2
+#   when rabbit_heartbeat_timeout_threshold=60, the heartbeat will be checked
+#   every 30 seconds.
+#   Defaults to 2
+#
 # [*kombu_ssl_ca_certs*]
 #   (optional) SSL certification authority file (valid only if SSL enabled).
 #   Defaults to undef
@@ -245,65 +260,72 @@
 #   exceptions in the nova API service.
 #   Defaults to undef
 #
+# [*use_ipv6*]
+#   (optional) Use IPv6 or not.
+#   Defaults to false
+#
 class nova(
-  $ensure_package           = 'present',
-  $database_connection      = false,
-  $slave_connection         = false,
-  $database_idle_timeout    = 3600,
-  $rpc_backend              = 'rabbit',
-  $image_service            = 'nova.image.glance.GlanceImageService',
+  $ensure_package                     = 'present',
+  $database_connection                = false,
+  $slave_connection                   = false,
+  $database_idle_timeout              = 3600,
+  $rpc_backend                        = 'rabbit',
+  $image_service                      = 'nova.image.glance.GlanceImageService',
   # these glance params should be optional
   # this should probably just be configured as a glance client
-  $glance_api_servers       = 'localhost:9292',
-  $memcached_servers        = false,
-  $rabbit_host              = 'localhost',
-  $rabbit_hosts             = false,
-  $rabbit_password          = 'guest',
-  $rabbit_port              = '5672',
-  $rabbit_userid            = 'guest',
-  $rabbit_virtual_host      = '/',
-  $rabbit_use_ssl           = false,
-  $rabbit_ha_queues         = undef,
-  $kombu_ssl_ca_certs       = undef,
-  $kombu_ssl_certfile       = undef,
-  $kombu_ssl_keyfile        = undef,
-  $kombu_ssl_version        = 'TLSv1',
-  $amqp_durable_queues      = false,
-  $qpid_hostname            = 'localhost',
-  $qpid_port                = '5672',
-  $qpid_username            = 'guest',
-  $qpid_password            = 'guest',
-  $qpid_sasl_mechanisms     = false,
-  $qpid_heartbeat           = 60,
-  $qpid_protocol            = 'tcp',
-  $qpid_tcp_nodelay         = true,
-  $auth_strategy            = 'keystone',
-  $service_down_time        = 60,
-  $log_dir                  = '/var/log/nova',
-  $state_path               = '/var/lib/nova',
-  $lock_path                = $::nova::params::lock_path,
-  $verbose                  = false,
-  $debug                    = false,
-  $periodic_interval        = '60',
-  $report_interval          = '10',
-  $rootwrap_config          = '/etc/nova/rootwrap.conf',
-  $use_ssl                  = false,
-  $enabled_ssl_apis         = ['ec2', 'metadata', 'osapi_compute'],
-  $ca_file                  = false,
-  $cert_file                = false,
-  $key_file                 = false,
-  $nova_public_key          = undef,
-  $nova_private_key         = undef,
-  $use_syslog               = false,
-  $log_facility             = 'LOG_USER',
-  $install_utilities        = true,
-  $notification_driver      = [],
-  $notification_topics      = 'notifications',
-  $notify_api_faults        = false,
-  $notify_on_state_change   = undef,
+  $glance_api_servers                 = 'localhost:9292',
+  $memcached_servers                  = false,
+  $rabbit_host                        = 'localhost',
+  $rabbit_hosts                       = false,
+  $rabbit_password                    = 'guest',
+  $rabbit_port                        = '5672',
+  $rabbit_userid                      = 'guest',
+  $rabbit_virtual_host                = '/',
+  $rabbit_use_ssl                     = false,
+  $rabbit_heartbeat_timeout_threshold = 0,
+  $rabbit_heartbeat_rate              = 2,
+  $rabbit_ha_queues                   = undef,
+  $kombu_ssl_ca_certs                 = undef,
+  $kombu_ssl_certfile                 = undef,
+  $kombu_ssl_keyfile                  = undef,
+  $kombu_ssl_version                  = 'TLSv1',
+  $amqp_durable_queues                = false,
+  $qpid_hostname                      = 'localhost',
+  $qpid_port                          = '5672',
+  $qpid_username                      = 'guest',
+  $qpid_password                      = 'guest',
+  $qpid_sasl_mechanisms               = false,
+  $qpid_heartbeat                     = 60,
+  $qpid_protocol                      = 'tcp',
+  $qpid_tcp_nodelay                   = true,
+  $auth_strategy                      = 'keystone',
+  $service_down_time                  = 60,
+  $log_dir                            = '/var/log/nova',
+  $state_path                         = '/var/lib/nova',
+  $lock_path                          = $::nova::params::lock_path,
+  $verbose                            = false,
+  $debug                              = false,
+  $periodic_interval                  = '60',
+  $report_interval                    = '10',
+  $rootwrap_config                    = '/etc/nova/rootwrap.conf',
+  $use_ssl                            = false,
+  $enabled_ssl_apis                   = ['ec2', 'metadata', 'osapi_compute'],
+  $ca_file                            = false,
+  $cert_file                          = false,
+  $key_file                           = false,
+  $nova_public_key                    = undef,
+  $nova_private_key                   = undef,
+  $use_syslog                         = false,
+  $log_facility                       = 'LOG_USER',
+  $install_utilities                  = true,
+  $notification_driver                = [],
+  $notification_topics                = 'notifications',
+  $notify_api_faults                  = false,
+  $notify_on_state_change             = undef,
+  $use_ipv6                           = false,
   # DEPRECATED PARAMETERS
-  $mysql_module             = undef,
-  $os_region_name           = undef,
+  $mysql_module                       = undef,
+  $os_region_name                     = undef,
 ) inherits nova::params {
 
   # maintain backward compatibility
@@ -459,11 +481,13 @@
   if $rpc_backend == 'nova.openstack.common.rpc.impl_kombu' or $rpc_backend == 'rabbit' {
     # I may want to support exporting and collecting these
     nova_config {
-      'oslo_messaging_rabbit/rabbit_password':     value => $rabbit_password, secret => true;
-      'oslo_messaging_rabbit/rabbit_userid':       value => $rabbit_userid;
-      'oslo_messaging_rabbit/rabbit_virtual_host': value => $rabbit_virtual_host;
-      'oslo_messaging_rabbit/rabbit_use_ssl':      value => $rabbit_use_ssl;
-      'DEFAULT/amqp_durable_queues': value => $amqp_durable_queues;
+      'oslo_messaging_rabbit/rabbit_password':              value => $rabbit_password, secret => true;
+      'oslo_messaging_rabbit/rabbit_userid':                value => $rabbit_userid;
+      'oslo_messaging_rabbit/rabbit_virtual_host':          value => $rabbit_virtual_host;
+      'oslo_messaging_rabbit/rabbit_use_ssl':               value => $rabbit_use_ssl;
+      'oslo_messaging_rabbit/heartbeat_timeout_threshold':  value => $rabbit_heartbeat_timeout_threshold;
+      'oslo_messaging_rabbit/heartbeat_rate':               value => $rabbit_heartbeat_rate;
+      'DEFAULT/amqp_durable_queues':                        value => $amqp_durable_queues;
     }
 
     if $rabbit_use_ssl {
@@ -604,6 +628,7 @@
     'DEFAULT/service_down_time':   value => $service_down_time;
     'DEFAULT/rootwrap_config':     value => $rootwrap_config;
     'DEFAULT/report_interval':     value => $report_interval;
+    'DEFAULT/use_ipv6':            value => $use_ipv6;
   }
 
   if $notify_on_state_change and $notify_on_state_change in ['vm_state', 'vm_and_task_state'] {
diff --git a/nova/manifests/manage/network.pp b/nova/manifests/manage/network.pp
index 922b3ae47..536d7e3bd 100644
--- a/nova/manifests/manage/network.pp
+++ b/nova/manifests/manage/network.pp
@@ -19,30 +19,42 @@
 #   (optional) The vlan number to use if in vlan mode
 #   Defaults to undef
 #
+# [*allowed_start*]
+#   (optional) Start of allowed addresses for instances
+#   Defaults to undef
+#
+# [*allowed_end*]
+#   (optional) End of allowed addresses for instances
+#   Defaults to undef
+#
 # [*project*]
 #   (optional) Project that network should be associated with
 #   Defaults to undef
 #
 define nova::manage::network (
   $network,
-  $label        = 'novanetwork',
-  $num_networks = 1,
-  $network_size = 255,
-  $vlan_start   = undef,
-  $project      = undef
+  $label         = 'novanetwork',
+  $num_networks  = 1,
+  $network_size  = 255,
+  $vlan_start    = undef,
+  $project       = undef,
+  $allowed_start = undef,
+  $allowed_end   = undef,
 ) {
 
   File['/etc/nova/nova.conf'] -> Nova_network[$name]
   Exec<| title == 'nova-db-sync' |> -> Nova_network[$name]
 
   nova_network { $name:
-    ensure       => present,
-    network      => $network,
-    label        => $label,
-    num_networks => $num_networks,
-    network_size => $network_size,
-    project      => $project,
-    vlan_start   => $vlan_start,
+    ensure        => present,
+    network       => $network,
+    label         => $label,
+    num_networks  => $num_networks,
+    network_size  => $network_size,
+    project       => $project,
+    vlan_start    => $vlan_start,
+    allowed_start => $allowed_start,
+    allowed_end   => $allowed_end,
   }
 
 }
diff --git a/nova/manifests/network.pp b/nova/manifests/network.pp
index 94c01c139..6a2f4a421 100644
--- a/nova/manifests/network.pp
+++ b/nova/manifests/network.pp
@@ -59,6 +59,15 @@
 #   (optional) Whether to install and enable the service
 #   Defaults to true
 #
+# [*allowed_start*]
+#   (optional) Start of allowed addresses for instances
+#   Defaults to undef
+#
+# [*allowed_end*]
+#   (optional) End of allowed addresses for instances
+#   Defaults to undef
+#
+
 class nova::network(
   $private_interface = undef,
   $fixed_range       = '10.0.0.0/8',
@@ -71,7 +80,9 @@
   $config_overrides  = {},
   $create_networks   = true,
   $ensure_package    = 'present',
-  $install_service   = true
+  $install_service   = true,
+  $allowed_start     = undef,
+  $allowed_end       = undef,
 ) {
 
   include ::nova::params
@@ -107,10 +118,12 @@
 
   if $create_networks {
     nova::manage::network { 'nova-vm-net':
-      network      => $fixed_range,
-      num_networks => $num_networks,
-      network_size => $network_size,
-      vlan_start   => $vlan_start,
+      network       => $fixed_range,
+      num_networks  => $num_networks,
+      network_size  => $network_size,
+      vlan_start    => $vlan_start,
+      allowed_start => $allowed_start,
+      allowed_end   => $allowed_end,
     }
     if $floating_range {
       nova::manage::floating { 'nova-vm-floating':
diff --git a/nova/manifests/scheduler.pp b/nova/manifests/scheduler.pp
index 97955c36f..ee787142e 100644
--- a/nova/manifests/scheduler.pp
+++ b/nova/manifests/scheduler.pp
@@ -18,13 +18,13 @@
 #
 # [*scheduler_driver*]
 #   (optional) Default driver to use for the scheduler
-#   Defaults to 'nova.scheduler.host_manager.HostManager'
+#   Defaults to 'nova.scheduler.filter_scheduler.FilterScheduler'
 #
 class nova::scheduler(
   $enabled          = false,
   $manage_service   = true,
   $ensure_package   = 'present',
-  $scheduler_driver = 'nova.scheduler.host_manager.HostManager',
+  $scheduler_driver = 'nova.scheduler.filter_scheduler.FilterScheduler',
 ) {
 
   include ::nova::db
diff --git a/nova/manifests/vncproxy/common.pp b/nova/manifests/vncproxy/common.pp
index 15b46330d..c10d80514 100644
--- a/nova/manifests/vncproxy/common.pp
+++ b/nova/manifests/vncproxy/common.pp
@@ -23,11 +23,11 @@
   $vncproxy_path     = undef,
 ) {
 
-  $vncproxy_host_real     = pick(
+  $vncproxy_host_real     = ipv6_add_bracket_maybe(pick(
     $vncproxy_host,
     $::nova::compute::vncproxy_host,
     $::nova::vncproxy::host,
-    false)
+    false))
   $vncproxy_protocol_real = pick(
     $vncproxy_protocol,
     $::nova::compute::vncproxy_protocol,
@@ -43,7 +43,6 @@
     $::nova::compute::vncproxy_path,
     $::nova::vncproxy::vncproxy_path,
     '/vnc_auto.html')
-
   if ($vncproxy_host_real) {
     $vncproxy_base_url = "${vncproxy_protocol_real}://${vncproxy_host_real}:${vncproxy_port_real}${vncproxy_path_real}"
     # config for vnc proxy
diff --git a/nova/metadata.json b/nova/metadata.json
index a42c33a59..4b4f43dca 100644
--- a/nova/metadata.json
+++ b/nova/metadata.json
@@ -1,6 +1,6 @@
 {
-  "name": "stackforge-nova",
-  "version": "5.1.0",
+  "name": "openstack-nova",
+  "version": "6.0.0",
   "author": "Puppet Labs and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Nova",
   "license": "Apache-2.0",
@@ -33,12 +33,12 @@
   "dependencies": [
     { "name": "dprince/qpid", "version_requirement": ">=1.0.0 <2.0.0" },
     { "name": "duritong/sysctl", "version_requirement": ">=0.0.1 <1.0.0" },
-    { "name": "stackforge/cinder", "version_requirement": ">=5.0.0 <6.0.0" },
-    { "name": "stackforge/glance", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/cinder", "version_requirement": ">=6.0.0 <7.0.0" },
+    { "name": "openstack/glance", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
-    { "name": "stackforge/keystone", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/keystone", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/rabbitmq", "version_requirement": ">=2.0.2 <6.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
-    { "name": "stackforge/openstacklib", "version_requirement": ">=5.0.0 <6.0.0" }
+    { "name": "openstack/openstacklib", "version_requirement": ">=6.0.0 <7.0.0" }
   ]
 }
diff --git a/nova/spec/classes/nova_api_spec.rb b/nova/spec/classes/nova_api_spec.rb
index 6fe090a8d..74424ba95 100644
--- a/nova/spec/classes/nova_api_spec.rb
+++ b/nova/spec/classes/nova_api_spec.rb
@@ -55,6 +55,8 @@
           'keystone_authtoken/admin_password').with_value('passw0rd').with_secret(true)
       end
 
+      it { is_expected.to contain_nova_config('DEFAULT/instance_name_template').with_ensure('absent')}
+
       it 'configures various stuff' do
         is_expected.to contain_nova_config('DEFAULT/ec2_listen').with('value' => '0.0.0.0')
         is_expected.to contain_nova_config('DEFAULT/osapi_compute_listen').with('value' => '0.0.0.0')
@@ -256,6 +258,17 @@
       it { is_expected.to contain_nova_config('database/idle_timeout').with_value('30') }
     end
 
+    context 'with custom instance_name_template' do
+      before do
+        params.merge!({
+          :instance_name_template => 'instance-%08x',
+        })
+      end
+      it 'configures instance_name_template' do
+        is_expected.to contain_nova_config('DEFAULT/instance_name_template').with_value('instance-%08x');
+      end
+    end
+
     context 'with custom keystone identity_uri' do
       before do
         params.merge!({
diff --git a/nova/spec/classes/nova_compute_ironic_spec.rb b/nova/spec/classes/nova_compute_ironic_spec.rb
index d5433f753..401839526 100644
--- a/nova/spec/classes/nova_compute_ironic_spec.rb
+++ b/nova/spec/classes/nova_compute_ironic_spec.rb
@@ -2,13 +2,37 @@
 
 describe 'nova::compute::ironic' do
 
-  it 'configures ironic in nova.conf' do
-    is_expected.to contain_nova_config('ironic/admin_username').with_value('admin')
-    is_expected.to contain_nova_config('ironic/admin_password').with_value('ironic')
-    is_expected.to contain_nova_config('ironic/admin_url').with_value('http://127.0.0.1:35357/v2.0')
-    is_expected.to contain_nova_config('ironic/admin_tenant_name').with_value('services')
-    is_expected.to contain_nova_config('ironic/api_endpoint').with_value('http://127.0.0.1:6385/v1')
-    is_expected.to contain_nova_config('DEFAULT/compute_driver').with_value('nova.virt.ironic.IronicDriver')
+  context 'with default parameters' do
+    it 'configures ironic in nova.conf' do
+      is_expected.to contain_nova_config('ironic/admin_username').with_value('admin')
+      is_expected.to contain_nova_config('ironic/admin_password').with_value('ironic')
+      is_expected.to contain_nova_config('ironic/admin_url').with_value('http://127.0.0.1:35357/v2.0')
+      is_expected.to contain_nova_config('ironic/admin_tenant_name').with_value('services')
+      is_expected.to contain_nova_config('ironic/api_endpoint').with_value('http://127.0.0.1:6385/v1')
+      is_expected.to contain_nova_config('DEFAULT/compute_driver').with_value('ironic.IronicDriver')
+    end
+  end
+
+  context 'with overridden parameters' do
+    let :params do
+      {
+        :admin_username    => 'ironic',
+        :admin_password    => 's3cr3t',
+        :admin_url         => 'http://10.0.0.10:35357/v2.0',
+        :admin_tenant_name => 'services2',
+        :api_endpoint      => 'http://10.0.0.10:6385/v1',
+        :compute_driver    => 'ironic.FoobarDriver'
+      }
+    end
+
+    it 'configures ironic in nova.conf' do
+      is_expected.to contain_nova_config('ironic/admin_username').with_value('ironic')
+      is_expected.to contain_nova_config('ironic/admin_password').with_value('s3cr3t')
+      is_expected.to contain_nova_config('ironic/admin_url').with_value('http://10.0.0.10:35357/v2.0')
+      is_expected.to contain_nova_config('ironic/admin_tenant_name').with_value('services2')
+      is_expected.to contain_nova_config('ironic/api_endpoint').with_value('http://10.0.0.10:6385/v1')
+      is_expected.to contain_nova_config('DEFAULT/compute_driver').with_value('ironic.FoobarDriver')
+    end
   end
 
   context 'with deprecated parameters' do
diff --git a/nova/spec/classes/nova_compute_libvirt_spec.rb b/nova/spec/classes/nova_compute_libvirt_spec.rb
index 87b144054..0082578ac 100644
--- a/nova/spec/classes/nova_compute_libvirt_spec.rb
+++ b/nova/spec/classes/nova_compute_libvirt_spec.rb
@@ -58,10 +58,12 @@
           :remove_unused_kernels                      => true,
           :remove_unused_resized_minimum_age_seconds  => 3600,
           :remove_unused_original_minimum_age_seconds => 3600,
-          :libvirt_service_name                       => 'custom_service'
+          :libvirt_service_name                       => 'custom_service',
+          :compute_driver                             => 'libvirt.FoobarDriver',
         }
       end
 
+      it { is_expected.to contain_nova_config('DEFAULT/compute_driver').with_value('libvirt.FoobarDriver')}
       it { is_expected.to contain_nova_config('libvirt/virt_type').with_value('qemu')}
       it { is_expected.to contain_nova_config('libvirt/cpu_mode').with_value('host-passthrough')}
       it { is_expected.to contain_nova_config('libvirt/disk_cachemodes').with_value('file=directsync,block=none')}
diff --git a/nova/spec/classes/nova_compute_vmware_spec.rb b/nova/spec/classes/nova_compute_vmware_spec.rb
index 90ef18b53..9bd295045 100644
--- a/nova/spec/classes/nova_compute_vmware_spec.rb
+++ b/nova/spec/classes/nova_compute_vmware_spec.rb
@@ -14,7 +14,8 @@
      :maximum_objects => 100,
      :task_poll_interval => 10.5,
      :use_linked_clone => false,
-     :wsdl_location => 'http://127.0.0.1:8080/vmware/SDK/wsdl/vim25/vimService.wsdl'}
+     :wsdl_location => 'http://127.0.0.1:8080/vmware/SDK/wsdl/vim25/vimService.wsdl',
+     :compute_driver => 'vmwareapi.FoobarDriver' }
   end
 
   it 'configures vmwareapi in nova.conf' do
@@ -42,6 +43,7 @@
     end
 
     it 'configures vmwareapi in nova.conf' do
+      is_expected.to contain_nova_config('DEFAULT/compute_driver').with_value(params[:compute_driver])
       is_expected.to contain_nova_config('VMWARE/api_retry_count').with_value(params[:api_retry_count])
       is_expected.to contain_nova_config('VMWARE/maximum_objects').with_value(params[:maximum_objects])
       is_expected.to contain_nova_config('VMWARE/task_poll_interval').with_value(params[:task_poll_interval])
diff --git a/nova/spec/classes/nova_compute_xenserver_spec.rb b/nova/spec/classes/nova_compute_xenserver_spec.rb
index ccb8cfb87..5aaf2d899 100644
--- a/nova/spec/classes/nova_compute_xenserver_spec.rb
+++ b/nova/spec/classes/nova_compute_xenserver_spec.rb
@@ -12,11 +12,9 @@
 
     it 'configures xenapi in nova.conf' do
       is_expected.to contain_nova_config('DEFAULT/compute_driver').with_value('xenapi.XenAPIDriver')
-      is_expected.to contain_nova_config('DEFAULT/connection_type').with_value('xenapi')
       is_expected.to contain_nova_config('DEFAULT/xenapi_connection_url').with_value(params[:xenapi_connection_url])
       is_expected.to contain_nova_config('DEFAULT/xenapi_connection_username').with_value(params[:xenapi_connection_username])
       is_expected.to contain_nova_config('DEFAULT/xenapi_connection_password').with_value(params[:xenapi_connection_password])
-      is_expected.to contain_nova_config('DEFAULT/xenapi_inject_image').with_value(false)
     end
 
     it 'installs xenapi with pip' do
@@ -26,4 +24,14 @@
       )
     end
   end
+
+  context 'with overridden parameters' do
+    before do
+      params.merge!({:compute_driver => 'xenapi.FoobarDriver'})
+    end
+
+    it 'configures xenapi in nova.conf' do
+      is_expected.to contain_nova_config('DEFAULT/compute_driver').with_value('xenapi.FoobarDriver')
+    end
+  end
 end
diff --git a/nova/spec/classes/nova_cron_archive_deleted_rows_spec.rb b/nova/spec/classes/nova_cron_archive_deleted_rows_spec.rb
index a1e724fa0..c1f89dc30 100644
--- a/nova/spec/classes/nova_cron_archive_deleted_rows_spec.rb
+++ b/nova/spec/classes/nova_cron_archive_deleted_rows_spec.rb
@@ -6,16 +6,27 @@
     { :osfamily => 'Debian' }
   end
 
-  it 'configures a cron' do
-    is_expected.to contain_cron('nova-manage db archive_deleted_rows').with(
-      :command     => 'nova-manage db archive_deleted_rows --max_rows 100 >>/var/log/nova/nova-rowsflush.log 2>&1',
-      :environment => 'PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh',
-      :user        => 'nova',
-      :minute      => 1,
+  let :params do
+    { :minute      => 1,
       :hour        => 0,
       :monthday    => '*',
       :month       => '*',
       :weekday     => '*',
+      :max_rows    => '100',
+      :user        => 'nova',
+      :destination => '/var/log/nova/nova-rowsflush.log' }
+  end
+
+  it 'configures a cron' do
+    is_expected.to contain_cron('nova-manage db archive_deleted_rows').with(
+      :command     => "nova-manage db archive_deleted_rows --max_rows #{params[:max_rows]} >>#{params[:destination]} 2>&1",
+      :environment => 'PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh',
+      :user        => params[:user],
+      :minute      => params[:minute],
+      :hour        => params[:hour],
+      :monthday    => params[:monthday],
+      :month       => params[:month],
+      :weekday     => params[:weekday],
       :require     => 'Package[nova-common]',
     )
   end
diff --git a/nova/spec/classes/nova_init_spec.rb b/nova/spec/classes/nova_init_spec.rb
index 368cb6a12..b042f60ff 100644
--- a/nova/spec/classes/nova_init_spec.rb
+++ b/nova/spec/classes/nova_init_spec.rb
@@ -62,6 +62,8 @@
         is_expected.to contain_nova_config('oslo_messaging_rabbit/rabbit_port').with_value('5672')
         is_expected.to contain_nova_config('oslo_messaging_rabbit/rabbit_userid').with_value('guest')
         is_expected.to contain_nova_config('oslo_messaging_rabbit/rabbit_virtual_host').with_value('/')
+        is_expected.to contain_nova_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('0')
+        is_expected.to contain_nova_config('oslo_messaging_rabbit/heartbeat_rate').with_value('2')
       end
 
       it 'configures various things' do
@@ -73,6 +75,7 @@
         is_expected.to contain_nova_config('DEFAULT/service_down_time').with_value('60')
         is_expected.to contain_nova_config('DEFAULT/rootwrap_config').with_value('/etc/nova/rootwrap.conf')
         is_expected.to contain_nova_config('DEFAULT/report_interval').with_value('10')
+        is_expected.to contain_nova_config('DEFAULT/use_ipv6').with_value(false)
         is_expected.to contain_nova_config('DEFAULT/os_region_name').with_ensure('absent')
       end
 
@@ -88,27 +91,30 @@
     context 'with overridden parameters' do
 
       let :params do
-        { :verbose                  => true,
-          :debug                    => true,
-          :log_dir                  => '/var/log/nova2',
-          :image_service            => 'nova.image.local.LocalImageService',
-          :rabbit_host              => 'rabbit',
-          :rabbit_userid            => 'rabbit_user',
-          :rabbit_port              => '5673',
-          :rabbit_password          => 'password',
-          :rabbit_ha_queues         => 'undef',
-          :lock_path                => '/var/locky/path',
-          :state_path               => '/var/lib/nova2',
-          :service_down_time        => '120',
-          :auth_strategy            => 'foo',
-          :ensure_package           => '2012.1.1-15.el6',
-          :memcached_servers        => ['memcached01:11211', 'memcached02:11211'],
-          :install_utilities        => false,
-          :notification_driver      => 'ceilometer.compute.nova_notifier',
-          :notification_topics      => 'openstack',
-          :notify_api_faults        => true,
-          :report_interval          => '60',
-          :os_region_name           => 'MyRegion' }
+        { :verbose                            => true,
+          :debug                              => true,
+          :log_dir                            => '/var/log/nova2',
+          :image_service                      => 'nova.image.local.LocalImageService',
+          :rabbit_host                        => 'rabbit',
+          :rabbit_userid                      => 'rabbit_user',
+          :rabbit_port                        => '5673',
+          :rabbit_password                    => 'password',
+          :rabbit_ha_queues                   => 'undef',
+          :rabbit_heartbeat_timeout_threshold => '60',
+          :rabbit_heartbeat_rate              => '10',
+          :lock_path                          => '/var/locky/path',
+          :state_path                         => '/var/lib/nova2',
+          :service_down_time                  => '120',
+          :auth_strategy                      => 'foo',
+          :ensure_package                     => '2012.1.1-15.el6',
+          :memcached_servers                  => ['memcached01:11211', 'memcached02:11211'],
+          :install_utilities                  => false,
+          :notification_driver                => 'ceilometer.compute.nova_notifier',
+          :notification_topics                => 'openstack',
+          :notify_api_faults                  => true,
+          :report_interval                    => '60',
+          :os_region_name                     => 'MyRegion',
+          :use_ipv6                           => true }
       end
 
       it 'installs packages' do
@@ -133,6 +139,8 @@
         is_expected.to contain_nova_config('oslo_messaging_rabbit/rabbit_port').with_value('5673')
         is_expected.to contain_nova_config('oslo_messaging_rabbit/rabbit_userid').with_value('rabbit_user')
         is_expected.to contain_nova_config('oslo_messaging_rabbit/rabbit_virtual_host').with_value('/')
+        is_expected.to contain_nova_config('oslo_messaging_rabbit/heartbeat_timeout_threshold').with_value('60')
+        is_expected.to contain_nova_config('oslo_messaging_rabbit/heartbeat_rate').with_value('10')
       end
 
       it 'configures memcached_servers' do
@@ -151,6 +159,7 @@
         is_expected.to contain_nova_config('DEFAULT/notify_api_faults').with_value(true)
         is_expected.to contain_nova_config('DEFAULT/report_interval').with_value('60')
         is_expected.to contain_nova_config('DEFAULT/os_region_name').with_value('MyRegion')
+        is_expected.to contain_nova_config('DEFAULT/use_ipv6').with_value('true')
       end
 
       context 'with multiple notification_driver' do
diff --git a/nova/spec/classes/nova_scheduler_spec.rb b/nova/spec/classes/nova_scheduler_spec.rb
index 9b589eb14..b2235bc50 100644
--- a/nova/spec/classes/nova_scheduler_spec.rb
+++ b/nova/spec/classes/nova_scheduler_spec.rb
@@ -24,7 +24,7 @@
       :ensure    => 'running'
     )}
 
-    it { is_expected.to contain_nova_config('DEFAULT/scheduler_driver').with_value('nova.scheduler.host_manager.HostManager') }
+    it { is_expected.to contain_nova_config('DEFAULT/scheduler_driver').with_value('nova.scheduler.filter_scheduler.FilterScheduler') }
 
     context 'with manage_service as false' do
       let :params do
diff --git a/nova/spec/classes/nova_vnc_proxy_spec.rb b/nova/spec/classes/nova_vnc_proxy_spec.rb
index 4fe3ab612..c103a9c2c 100644
--- a/nova/spec/classes/nova_vnc_proxy_spec.rb
+++ b/nova/spec/classes/nova_vnc_proxy_spec.rb
@@ -1,4 +1,6 @@
 require 'spec_helper'
+# LP1492636 - Cohabitation of compile matcher and webmock
+WebMock.disable_net_connect!(:allow => "169.254.169.254")
 
 describe 'nova::vncproxy' do
 
@@ -6,57 +8,59 @@
     'include nova'
   end
 
-  let :params do
-    {:enabled => true}
-  end
+    context 'with default parameters' do
 
-  describe 'on debian platforms' do
-    let :facts do
-      { :osfamily => 'Debian' }
-    end
+      describe 'on debian platforms' do
+        let :facts do
+          @default_facts.merge({ :osfamily => 'Debian' })
+      end
 
-    it { is_expected.to contain_package('python-numpy').with(
-      :ensure => 'present',
-      :name   => 'python-numpy'
-    )}
+      it { is_expected.to contain_package('python-numpy').with(
+        :ensure => 'present',
+        :name   => 'python-numpy'
+      )}
 
-    it { is_expected.to contain_nova_config('DEFAULT/novncproxy_host').with(:value => '0.0.0.0') }
-    it { is_expected.to contain_nova_config('DEFAULT/novncproxy_port').with(:value => '6080') }
-    it { is_expected.to contain_nova_config('DEFAULT/novncproxy_base_url').with(:value => 'http://0.0.0.0:6080/vnc_auto.html') }
+      it { is_expected.to contain_nova_config('DEFAULT/novncproxy_host').with(:value => '0.0.0.0') }
+      it { is_expected.to contain_nova_config('DEFAULT/novncproxy_port').with(:value => '6080') }
+      it { is_expected.to contain_nova_config('DEFAULT/novncproxy_base_url').with(:value => 'http://0.0.0.0:6080/vnc_auto.html') }
 
-    it { is_expected.to contain_package('nova-vncproxy').with(
-      :name   => 'nova-novncproxy',
-      :ensure => 'present'
-    ) }
-    it { is_expected.to contain_service('nova-vncproxy').with(
-      :name      => 'nova-novncproxy',
-      :hasstatus => true,
-      :ensure    => 'running'
-    )}
+      it { is_expected.to contain_package('nova-vncproxy').with(
+        :name   => 'nova-novncproxy',
+        :ensure => 'present'
+      ) }
+      it { is_expected.to contain_service('nova-vncproxy').with(
+        :name      => 'nova-novncproxy',
+        :hasstatus => true,
+        :ensure    => 'running'
+      )}
 
-    describe 'with manage_service as false' do
-      let :params do
-        { :enabled        => true,
-          :manage_service => false
-        }
+      describe 'with manage_service as false' do
+        let :params do
+          { :enabled        => true,
+            :manage_service => false
+          }
+        end
+        it { is_expected.to contain_service('nova-vncproxy').without_ensure }
       end
-      it { is_expected.to contain_service('nova-vncproxy').without_ensure }
-    end
 
-    describe 'with package version' do
-      let :params do
-        {:ensure_package => '2012.1-2'}
+      describe 'with package version' do
+        let :params do
+          {:ensure_package => '2012.1-2'}
+        end
+        it { is_expected.to contain_package('nova-vncproxy').with(
+          'ensure' => '2012.1-2'
+        )}
       end
-      it { is_expected.to contain_package('nova-vncproxy').with(
-        'ensure' => '2012.1-2'
-      )}
     end
-
   end
 
   describe 'on debian OS' do
       let :facts do
-        { :osfamily => 'Debian', :operatingsystem => 'Debian' }
+        @default_facts.merge({
+          :osfamily        => 'Debian',
+          :operatingsystem => 'Debian',
+          :os_package_type => 'debian'
+        })
       end
       it { is_expected.to contain_package('nova-vncproxy').with(
         :name   => "nova-consoleproxy",
@@ -69,11 +73,29 @@
       )}
   end
 
+  describe 'on Ubuntu OS with Debian packages' do
+      let :facts do
+        @default_facts.merge({
+          :osfamily        => 'Debian',
+          :operatingsystem => 'Ubuntu',
+          :os_package_type => 'debian'
+        })
+      end
+      it { is_expected.to contain_package('nova-vncproxy').with(
+        :name   => "nova-consoleproxy",
+        :ensure => 'present'
+      )}
+      it { is_expected.to contain_service('nova-vncproxy').with(
+        :name      => 'nova-novncproxy',
+        :hasstatus => true,
+        :ensure    => 'running'
+      )}
+  end
 
   describe 'on Redhatish platforms' do
 
     let :facts do
-      { :osfamily => 'Redhat' }
+      @default_facts.merge({ :osfamily => 'Redhat' })
     end
 
     it { is_expected.to contain_package('python-numpy').with(
@@ -85,4 +107,10 @@
 
   end
 
+  describe 'Support IPv6' do
+    let(:facts) { @default_facts.merge({ :osfamily => 'Debian'}) }
+    let(:params) { { :host => '2001::1' } }
+      it { is_expected.to contain_nova_config('DEFAULT/novncproxy_base_url').with(:value => 'http://[2001::1]:6080/vnc_auto.html') }
+  end
+
 end
diff --git a/nova/spec/defines/nova_manage_networks_spec.rb b/nova/spec/defines/nova_manage_networks_spec.rb
index e177c054e..b8ec36876 100644
--- a/nova/spec/defines/nova_manage_networks_spec.rb
+++ b/nova/spec/defines/nova_manage_networks_spec.rb
@@ -21,11 +21,13 @@
       }
     end
     it { is_expected.to contain_nova_network('foo').with(
-      :ensure       => 'present',
-      :network      => '10.0.0.0/24',
-      :label        => 'novanetwork',
-      :num_networks => 1,
-      :project      => nil
+      :ensure        => 'present',
+      :network       => '10.0.0.0/24',
+      :label         => 'novanetwork',
+      :num_networks  => 1,
+      :project       => nil,
+      :allowed_start => nil,
+      :allowed_end   => nil,
     ) }
   end
   describe 'when overriding num networks' do
@@ -53,4 +55,20 @@
       :project => 'foo'
     ) }
   end
+
+  describe 'when overriding allowed range' do
+    let :params do
+      {
+        :network       => '10.0.0.0/20',
+        :allowed_start => '10.0.0.1',
+        :allowed_end   => '10.0.0.5'
+      }
+    end
+    it { is_expected.to contain_nova_network('foo').with(
+      :network       => '10.0.0.0/20',
+      :allowed_start => '10.0.0.1',
+      :allowed_end   => '10.0.0.5'
+    ) }
+  end
+
 end
diff --git a/nova/spec/spec_helper_acceptance.rb b/nova/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/nova/spec/spec_helper_acceptance.rb
+++ b/nova/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/openstack_extras/CHANGELOG.md b/openstack_extras/CHANGELOG.md
index 0337785df..e9bb37bb0 100644
--- a/openstack_extras/CHANGELOG.md
+++ b/openstack_extras/CHANGELOG.md
@@ -1,3 +1,29 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+This is a backwards-incompatible major release for OpenStack Kilo.
+
+####Backwards-incompatible changes
+- repo: bump to Kilo by default
+
+####Features
+- Puppet 4.x support
+- Add hash based repository management
+- Add pacemaker provider for HA services
+- Add auth file from openstack repo
+- Support native OS primitive classes in Pacemaker
+- Support cloned resources in Pacemaker
+- auth_file: allow to change the path
+- repo/redhat: manage EPEL with metalink instead of baseurl
+
+####Bugfixes
+- Ensure python-mysqldb is installed before MySQL db_sync
+- Fix dependency on nova-common package
+
+####Maintenance
+- repo/apt: update to support apt 2.1.0 module
+- Increase major bound on puppetlabs-apt
+
 ##2014-11-21 - 5.0.0
 ###Summary
 
diff --git a/openstack_extras/README.md b/openstack_extras/README.md
index e0488f76d..fbbea5145 100644
--- a/openstack_extras/README.md
+++ b/openstack_extras/README.md
@@ -1,7 +1,7 @@
 openstack_extras
 ============
 
-5.0.0 - 2014.2.0 - Juno
+6.0.0 - 2015.1.0 - Kilo
 
 #### Table of Contents
 
diff --git a/openstack_extras/metadata.json b/openstack_extras/metadata.json
index 384010a36..979433203 100644
--- a/openstack_extras/metadata.json
+++ b/openstack_extras/metadata.json
@@ -1,6 +1,6 @@
 {
-  "name": "stackforge-openstack_extras",
-  "version": "5.0.0",
+  "name": "openstack-openstack_extras",
+  "version": "6.0.0",
   "author": "OpenStack Contributors",
   "summary": "Puppet OpenStack Extras Module",
   "license": "Apache-2.0",
diff --git a/openstacklib/CHANGELOG.md b/openstacklib/CHANGELOG.md
index 944eb5df7..9c36e17e9 100644
--- a/openstacklib/CHANGELOG.md
+++ b/openstacklib/CHANGELOG.md
@@ -1,3 +1,26 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+This is a backwards-incompatible major release for OpenStack Kilo.
+
+####Backwards-incompatible changes
+- MySQL: change default MySQL collate to utf8_general_ci
+
+####Features
+- Puppet 4.x support
+- Add db::postgresql to openstacklib
+- Implement openstacklib::wsgi::apache
+- Move openstackclient parent provider to openstacklib
+- Keystone V3 API support
+- Restructures authentication for resource providers
+
+####Bugfixes
+- Properly handle policy values containing spaces
+
+####Maintenance
+- Bump mysql version to 3.x
+- Acceptance tests with Beaker
+
 ##2015-06-17 - 5.1.0
 ###Summary
 
diff --git a/openstacklib/README.md b/openstacklib/README.md
index 90fb090d0..e97677d15 100644
--- a/openstacklib/README.md
+++ b/openstacklib/README.md
@@ -1,7 +1,8 @@
 openstacklib
 ============
 
-5.1.0 - 2014.2 - Juno
+6.0.0 - 2015.1 - Kilo
+
 #### Table of Contents
 
 1. [Overview - What is the openstacklib module?](#overview)
diff --git a/openstacklib/lib/puppet/parser/functions/ipv6_add_bracket_maybe.rb b/openstacklib/lib/puppet/parser/functions/ipv6_add_bracket_maybe.rb
new file mode 100644
index 000000000..53f368f37
--- /dev/null
+++ b/openstacklib/lib/puppet/parser/functions/ipv6_add_bracket_maybe.rb
@@ -0,0 +1,22 @@
+require 'ipaddr'
+
+module Puppet::Parser::Functions
+  newfunction(:ipv6_add_bracket_maybe, 
+              :type => :rvalue, 
+              :arity => 1,
+              :doc => <<-EOD
+    Add brackets if the argument is an IPv6 address. 
+    Returns the argument otherwise.
+    EOD
+  ) do |args|
+    ip = args[0]
+    begin
+      if IPAddr.new(ip).ipv6?
+        ip = "[#{ip}]" unless ip.match(/\[.+\]/)
+      end
+    rescue ArgumentError => e
+      # ignore it
+    end
+    return ip
+  end
+end
diff --git a/openstacklib/metadata.json b/openstacklib/metadata.json
index bc79e797f..6520213a1 100644
--- a/openstacklib/metadata.json
+++ b/openstacklib/metadata.json
@@ -1,6 +1,6 @@
 {
-  "name": "stackforge-openstacklib",
-  "version": "5.1.0",
+  "name": "openstack-openstacklib",
+  "version": "6.0.0",
   "author": "Puppet Labs and OpenStack Contributors",
   "summary": "Puppet OpenStack Libraries",
   "license": "Apache-2.0",
diff --git a/openstacklib/spec/spec_helper_acceptance.rb b/openstacklib/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/openstacklib/spec/spec_helper_acceptance.rb
+++ b/openstacklib/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/pacemaker/README.md b/pacemaker/README.md
index a860b9ace..dd7b1088c 100644
--- a/pacemaker/README.md
+++ b/pacemaker/README.md
@@ -46,6 +46,14 @@ Installs Pacemaker and corosync and creates a cluster
 
 The pacemaker::corosync resource must be executed on each node
 
+If one wants to set non default settings for corosync the `cluster_setup_extras` variable can be used
+
+    class {"pacemaker::corosync":
+        cluster_name => "cluster_name",
+        cluster_members => "clu-host-1 clu-host-2 clu-host-3",
+        cluster_setup_extras => {'--totem' => '10000', '--ipv6' => ''},
+    }
+
 ### Disable stonith
     class {"pacemaker::stonith":
         disable => true,
diff --git a/pacemaker/lib/puppet/provider/pcmk_constraint/default.rb b/pacemaker/lib/puppet/provider/pcmk_constraint/default.rb
index 83902b720..1c7c426c9 100644
--- a/pacemaker/lib/puppet/provider/pcmk_constraint/default.rb
+++ b/pacemaker/lib/puppet/provider/pcmk_constraint/default.rb
@@ -7,7 +7,11 @@ def create
         when :location
             cmd = 'constraint location add ' + @resource[:name] + ' '  + @resource[:resource] + ' ' + @resource[:location] + ' ' + @resource[:score]
         when :colocation
-            cmd = 'constraint colocation add ' + @resource[:resource] + ' with ' + @resource[:location] + ' ' + @resource[:score]
+            if @resource[:master_slave]
+                cmd = 'constraint colocation add ' + @resource[:resource] + ' with master ' + @resource[:location] + ' ' + @resource[:score]
+            else 
+                cmd = 'constraint colocation add ' + @resource[:resource] + ' with ' + @resource[:location] + ' ' + @resource[:score]
+            end
         else
             fail(String(@resource[:constraint_type]) + ' is an invalid location type')
         end
@@ -37,7 +41,11 @@ def exists?
             when :location
                 return true if line.include? @resource[:name]
             when :colocation
-                return true if line.include? @resource[:resource] + ' with ' + @resource[:location]
+                if @resource[:master_slave]
+                  return true if line.include? @resource[:resource] + ' with ' + @resource[:location] and line.include? "with-rsc-role:Master" 
+                else
+                  return true if line.include? @resource[:resource] + ' with ' + @resource[:location] 
+                end
             end
         end
         # return false if constraint not found
diff --git a/pacemaker/lib/puppet/provider/pcmk_resource_default/pcs.rb b/pacemaker/lib/puppet/provider/pcmk_resource_default/pcs.rb
new file mode 100644
index 000000000..ecc1aba22
--- /dev/null
+++ b/pacemaker/lib/puppet/provider/pcmk_resource_default/pcs.rb
@@ -0,0 +1,54 @@
+# Currently the implementation is somewhat naive (will not work great
+# with ensure => absent, unless the correct current value is also
+# specified). For more proper handling, prefetching should be
+# implemented and `value` should be switched from a param to a
+# property. This should be possible to do without breaking the
+# interface of the resource type.
+Puppet::Type.type(:pcmk_resource_default).provide(:pcs) do
+  desc 'Manages default values for pacemaker resource options via pcs'
+
+  def create
+    name = @resource[:name]
+    value = @resource[:value]
+
+    cmd = "resource defaults #{name}='#{value}'"
+
+    pcs(cmd)
+  end
+
+  def destroy
+    name = @resource[:name]
+
+    cmd = 'resource defaults #{name}='
+    pcs(cmd)
+  end
+
+  def exists?
+    name = @resource[:name]
+    value = @resource[:value]
+
+    cmd = 'resource defaults'
+    status, _ = pcs(cmd,
+                    :grep => "^#{name}: #{value}$",
+                    :allow_failure => true)
+    status == 0
+  end
+
+  def pcs(cmd, options={})
+    full_cmd = "pcs #{cmd}"
+
+    if options[:grep]
+      full_cmd += " | grep '#{options[:grep]}'"
+    end
+
+    Puppet.debug("Running #{full_cmd}")
+    output = `#{full_cmd}`
+    status = $?.exitstatus
+
+    if status != 0 && !options[:allow_failure]
+      raise Puppet::Error("#{full_cmd} returned #{status}, output: #{output}")
+    end
+
+    [status, output]
+  end
+end
diff --git a/pacemaker/lib/puppet/type/pcmk_constraint.rb b/pacemaker/lib/puppet/type/pcmk_constraint.rb
index 96250d83d..d109e4424 100644
--- a/pacemaker/lib/puppet/type/pcmk_constraint.rb
+++ b/pacemaker/lib/puppet/type/pcmk_constraint.rb
@@ -22,5 +22,10 @@
     newparam(:score) do
         desc "Score"
     end
+    newparam(:master_slave) do
+        desc "Enable master/slave support with multistage"
+        newvalues(:true)
+        newvalues(:false)
+    end
 
 end
diff --git a/pacemaker/lib/puppet/type/pcmk_resource_default.rb b/pacemaker/lib/puppet/type/pcmk_resource_default.rb
new file mode 100644
index 000000000..e342d80a2
--- /dev/null
+++ b/pacemaker/lib/puppet/type/pcmk_resource_default.rb
@@ -0,0 +1,16 @@
+require 'puppet/parameter/boolean'
+
+Puppet::Type.newtype(:pcmk_resource_default) do
+  @doc = "A default value for pacemaker resource options"
+
+  ensurable
+
+  newparam(:name) do
+    desc "A unique name of the option"
+  end
+
+  newparam(:value) do
+    desc "A default value for the option"
+  end
+
+end
diff --git a/pacemaker/manifests/constraint/colocation.pp b/pacemaker/manifests/constraint/colocation.pp
index c679c00e8..eedbbae68 100644
--- a/pacemaker/manifests/constraint/colocation.pp
+++ b/pacemaker/manifests/constraint/colocation.pp
@@ -1,12 +1,14 @@
 define pacemaker::constraint::colocation ($source,
                                           $target,
                                           $score,
+                                          $master_slave=false,
                                           $ensure=present) {
     pcmk_constraint {"colo-$source-$target":
        constraint_type => colocation,
        resource        => $source,
        location        => $target,
        score           => $score,
+       master_slave    => $master_slave,
        ensure          => $ensure,
        require => Exec["wait-for-settle"],
    }
diff --git a/pacemaker/manifests/corosync.pp b/pacemaker/manifests/corosync.pp
index b28866993..50fad1cd1 100644
--- a/pacemaker/manifests/corosync.pp
+++ b/pacemaker/manifests/corosync.pp
@@ -6,7 +6,9 @@
 # [*cluster_name*]
 #   The name of the cluster (no whitespace)
 # [*cluster_members*]
-#   A space-separted list of cluster IP's or names
+#   A space-separted list of cluster IP's or names to run the authentication against
+# [*cluster_members_rrp*]
+#   A space-separated list of cluster IP's or names pair where each component represent a resource on respectively ring0 and ring1
 # [*setup_cluster*]
 #   If your cluster includes pcsd, this should be set to true for just
 #    one node in cluster.  Else set to true for all nodes.
@@ -18,15 +20,24 @@
 #   Number of tries for settle.
 # [*settle_try_sleep*]
 #   Time to sleep after each seetle try.
+# [*remote_authkey*]
+#   Value of /etc/pacemaker/authkey.  Useful for pacemaker_remote.
+# [*cluster_setup_extras*]
+#   Hash additional configuration when pcs cluster setup is run
+#   Example : {'--token' => '10000', '--ipv6' => '', '--join' => '100' }
+
 
 class pacemaker::corosync(
   $cluster_members,
-  $cluster_name     = 'clustername',
-  $setup_cluster    = true,
-  $manage_fw        = true,
-  $settle_timeout   = '3600',
-  $settle_tries     = '360',
-  $settle_try_sleep = '10',
+  $cluster_members_rrp  = undef,
+  $cluster_name         = 'clustername',
+  $setup_cluster        = true,
+  $manage_fw            = true,
+  $settle_timeout       = '3600',
+  $settle_tries         = '360',
+  $settle_try_sleep     = '10',
+  $remote_authkey       = undef,
+  $cluster_setup_extras = {},
 ) inherits pacemaker {
   include ::pacemaker::params
 
@@ -36,6 +47,12 @@
       dport  => ['5404', '5405'],
       action => 'accept',
     }
+    firewall { '001 corosync mcast ipv6':
+      proto    => 'udp',
+      dport    => ['5404', '5405'],
+      action   => 'accept',
+      provider => 'ip6tables',
+    }
   }
 
   if $pcsd_mode {
@@ -45,6 +62,12 @@
         dport  => ['2224'],
         action => 'accept',
       }
+      firewall { '001 pcsd ipv6':
+        proto    => 'tcp',
+        dport    => ['2224'],
+        action   => 'accept',
+        provider => 'ip6tables',
+      }
     }
     Service['pcsd'] ->
     # we have more fragile when-to-start pacemaker conditions with pcsd
@@ -69,9 +92,18 @@
   }
 
   if $setup_cluster {
+
+    if ! $cluster_members_rrp {
+      $cluster_members_rrp_real = $cluster_members
+    } else {
+      $cluster_members_rrp_real = $cluster_members_rrp
+    }
+
+    $cluster_setup_extras_real = inline_template('<%= @cluster_setup_extras.flatten.join(" ") %>')
+
     exec {"Create Cluster $cluster_name":
       creates => "/etc/cluster/cluster.conf",
-      command => "/usr/sbin/pcs cluster setup --name $cluster_name $cluster_members",
+      command => "/usr/sbin/pcs cluster setup --name $cluster_name $cluster_members_rrp_real $cluster_setup_extras_real",
       unless => "/usr/bin/test -f /etc/corosync/corosync.conf",
       require => Class["::pacemaker::install"],
     }
@@ -89,6 +121,29 @@
       Exec["wait-for-settle"]
   }
 
+  if $remote_authkey {
+    file { 'etc-pacemaker':
+      ensure => directory,
+      path    => '/etc/pacemaker',
+      owner   => 'hacluster',
+      group   => 'haclient',
+      mode    => '0750',
+    } ->
+    file { 'etc-pacemaker-authkey':
+      path    => '/etc/pacemaker/authkey',
+      owner   => 'hacluster',
+      group   => 'haclient',
+      mode    => '0640',
+      content => $remote_authkey,
+    }
+    if $setup_cluster {
+      File['etc-pacemaker-authkey'] -> Exec["Create Cluster $cluster_name"]
+    }
+    if $pcsd_mode {
+      File['etc-pacemaker-authkey'] -> Service['pcsd']
+    }
+  }
+
   exec {"wait-for-settle":
     timeout   => $settle_timeout,
     tries     => $settle_tries,
diff --git a/pacemaker/manifests/params.pp b/pacemaker/manifests/params.pp
index 4a212799b..d2698ab92 100644
--- a/pacemaker/manifests/params.pp
+++ b/pacemaker/manifests/params.pp
@@ -9,7 +9,7 @@
         $pcsd_mode = false
         $services_manager = 'lsb'
       } else {
-        $package_list = ["pacemaker","pcs","fence-agents-all"]
+        $package_list = ["pacemaker","pcs","fence-agents-all","pacemaker-libs"]
         $pcsd_mode = true
         $services_manager = 'systemd'
       }
diff --git a/pacemaker/manifests/resource/ip.pp b/pacemaker/manifests/resource/ip.pp
index 09ec0344c..09a0f7ed5 100644
--- a/pacemaker/manifests/resource/ip.pp
+++ b/pacemaker/manifests/resource/ip.pp
@@ -44,7 +44,10 @@
       default => " nic=${nic}"
   }
 
-  pcmk_resource { "ip-${ip_address}":
+  # pcs dislikes colons from IPv6 addresses. Replacing them with dots.
+  $resource_name = regsubst($ip_address, '(:)', '.', 'G')
+
+  pcmk_resource { "ip-${resource_name}":
     ensure             => $ensure,
     resource_type      => 'IPaddr2',
     resource_params    => "ip=${ip_address}${cidr_option}${nic_option}",
diff --git a/pacemaker/manifests/resource_defaults.pp b/pacemaker/manifests/resource_defaults.pp
new file mode 100644
index 000000000..eacef669a
--- /dev/null
+++ b/pacemaker/manifests/resource_defaults.pp
@@ -0,0 +1,12 @@
+class pacemaker::resource_defaults(
+  $defaults,
+  $ensure = 'present',
+) {
+  create_resources(
+    "pcmk_resource_default",
+    $defaults,
+    {
+      ensure => $ensure,
+    }
+  )
+}
diff --git a/pacemaker/manifests/stonith/fence_xvm.pp b/pacemaker/manifests/stonith/fence_xvm.pp
index cba974c7b..e67b108b2 100644
--- a/pacemaker/manifests/stonith/fence_xvm.pp
+++ b/pacemaker/manifests/stonith/fence_xvm.pp
@@ -103,15 +103,32 @@
         proto    => 'igmp',
         action   => 'accept',
       }
+      firewall { "003 fence_xvm ipv6":
+        proto    => 'igmp',
+        action   => 'accept',
+        provider => 'ip6tables',
+      }
       firewall { "004 fence_xvm":
         proto    => 'udp',
-        dport     => '1229',
+        dport    => '1229',
         action   => 'accept',
       }
+      firewall { "004 fence_xvm ipv6":
+        proto    => 'udp',
+        dport    => '1229',
+        action   => 'accept',
+        provider => 'ip6tables',
+      }
       firewall { "005 fence_xvm":
         proto    => 'tcp',
-        dport     => '1229',
+        dport    => '1229',
+        action   => 'accept',
+      }
+      firewall { "005 fence_xvm ipv6":
+        proto    => 'tcp',
+        dport    => '1229',
         action   => 'accept',
+        provider => 'ip6tables',
       }
     }
 
diff --git a/pacemaker/manifests/stonith/xvm.pp b/pacemaker/manifests/stonith/xvm.pp
index 5aff60ab6..21aa0cfd0 100644
--- a/pacemaker/manifests/stonith/xvm.pp
+++ b/pacemaker/manifests/stonith/xvm.pp
@@ -36,15 +36,32 @@
         proto    => 'igmp',
         action   => 'accept',
       }
+      firewall { "003 fence_xvm ipv6":
+        proto    => 'igmp',
+        action   => 'accept',
+        provider => 'ip6tables',
+      }
       firewall { "004 fence_xvm":
         proto    => 'udp',
-        dport     => '1229',
+        dport    => '1229',
+        action   => 'accept',
+      }
+      firewall { "004 fence_xvm ipv6":
+        proto    => 'udp',
+        dport    => '1229',
         action   => 'accept',
+        provider => 'ip6tables',
       }
       firewall { "005 fence_xvm":
+        proto    => 'tcp',
+        dport    => '1229',
+        action   => 'accept',
+      }
+      firewall { "005 fence_xvm ipv6":
         proto    => 'tcp',
         dport     => '1229',
         action   => 'accept',
+        provider => 'ip6tables',
       }
     }
 
diff --git a/rabbitmq/README.md b/rabbitmq/README.md
index a29252695..3a0e4ab22 100644
--- a/rabbitmq/README.md
+++ b/rabbitmq/README.md
@@ -221,6 +221,8 @@ RabbitMQ Environment Variables in rabbitmq_env.config
 
 The erlang cookie to use for clustering - must be the same between all nodes.
 This value has no default and must be set explicitly if using clustering.
+If you run Pacemaker and you don't want to use RabbitMQ buildin cluster, you can
+set config_cluster to 'False' and set 'erlang_cookie'.
 
 ####`file_limit`
 
@@ -272,6 +274,13 @@ Boolean, whether or not to manage package repositories.
 
 The port for the RabbitMQ management interface.
 
+####`management_ssl`
+
+Enable/Disable SSL for the maangement port.
+Has an effect only if ssl => true.
+Default is true.
+Valid values are true or false.
+
 ####`node_ip_address`
 
 The value of NODE_IP_ADDRESS in rabbitmq_env.config
diff --git a/rabbitmq/lib/puppet/provider/rabbitmq_erlang_cookie/ruby.rb b/rabbitmq/lib/puppet/provider/rabbitmq_erlang_cookie/ruby.rb
index 58c8b3c96..74a96168f 100644
--- a/rabbitmq/lib/puppet/provider/rabbitmq_erlang_cookie/ruby.rb
+++ b/rabbitmq/lib/puppet/provider/rabbitmq_erlang_cookie/ruby.rb
@@ -16,7 +16,7 @@ def exists?
   def content=(value)
     if resource[:force] == :true # Danger!
       puppet('resource', 'service', resource[:service_name], 'ensure=stopped')
-      FileUtils.rm_rf(resource[:rabbitmq_home] + File::PATH_SEPARATOR + 'mnesia')
+      FileUtils.rm_rf(resource[:rabbitmq_home] + File::SEPARATOR + 'mnesia')
       File.open(resource[:path], 'w') do |cookie|
         cookie.chmod(0400)
         cookie.write(value)
diff --git a/rabbitmq/lib/puppet/type/rabbitmq_policy.rb b/rabbitmq/lib/puppet/type/rabbitmq_policy.rb
index 259a1d66c..8b796d21c 100644
--- a/rabbitmq/lib/puppet/type/rabbitmq_policy.rb
+++ b/rabbitmq/lib/puppet/type/rabbitmq_policy.rb
@@ -87,6 +87,18 @@ def validate_definition(definition)
         raise ArgumentError, "Invalid expires value '#{expires_val}'"
       end
     end
+    if definition.key? 'message-ttl'
+      message_ttl_val = definition['message-ttl']
+      unless message_ttl_val.to_i.to_s == message_ttl_val
+        raise ArgumentError, "Invalid message-ttl value '#{message_ttl_val}'"
+      end
+    end
+    if definition.key? 'max-length'
+      max_length_val = definition['max-length']
+      unless max_length_val.to_i.to_s == max_length_val
+        raise ArgumentError, "Invalid max-length value '#{max_length_val}'"
+      end
+    end
   end
 
   def munge_definition(definition)
@@ -96,6 +108,12 @@ def munge_definition(definition)
     if definition.key? 'expires'
       definition['expires'] = definition['expires'].to_i
     end
+    if definition.key? 'message-ttl'
+      definition['message-ttl'] = definition['message-ttl'].to_i
+    end
+    if definition.key? 'max-length'
+      definition['max-length'] = definition['max-length'].to_i
+    end
     definition
   end
 end
diff --git a/rabbitmq/manifests/config.pp b/rabbitmq/manifests/config.pp
index 159ae68db..7f7ffd693 100644
--- a/rabbitmq/manifests/config.pp
+++ b/rabbitmq/manifests/config.pp
@@ -17,6 +17,7 @@
   $erlang_cookie              = $rabbitmq::erlang_cookie
   $interface                  = $rabbitmq::interface
   $management_port            = $rabbitmq::management_port
+  $management_ssl             = $rabbitmq::management_ssl
   $node_ip_address            = $rabbitmq::node_ip_address
   $plugin_dir                 = $rabbitmq::plugin_dir
   $rabbitmq_user              = $rabbitmq::rabbitmq_user
@@ -138,35 +139,31 @@
           notify      => Class['Rabbitmq::Service'],
           refreshonly => true,
         }
-      } else {
-        file { '/etc/security/limits.d/rabbitmq-server.conf':
-          content => template('rabbitmq/limits.conf'),
-          owner   => '0',
-          group   => '0',
-          mode    => '0644',
-          notify  => Class['Rabbitmq::Service'],
-        }
+      }
+      file { '/etc/security/limits.d/rabbitmq-server.conf':
+        content => template('rabbitmq/limits.conf'),
+        owner   => '0',
+        group   => '0',
+        mode    => '0644',
+        notify  => Class['Rabbitmq::Service'],
       }
     }
     default: {
     }
   }
 
-  if $config_cluster {
-
-    if $erlang_cookie == undef {
-      fail('You must set the $erlang_cookie value in order to configure clustering.')
-    } else {
-      rabbitmq_erlang_cookie { "${rabbitmq_home}/.erlang.cookie":
-        content        => $erlang_cookie,
-        force          => $wipe_db_on_cookie_change,
-        rabbitmq_user  => $rabbitmq_user,
-        rabbitmq_group => $rabbitmq_group,
-        rabbitmq_home  => $rabbitmq_home,
-        service_name   => $service_name,
-        before         => File['rabbitmq.config'],
-        notify         => Class['rabbitmq::service'],
-      }
+  if $erlang_cookie == undef and $config_cluster {
+    fail('You must set the $erlang_cookie value in order to configure clustering.')
+  } elsif $erlang_cookie != undef {
+    rabbitmq_erlang_cookie { "${rabbitmq_home}/.erlang.cookie":
+      content        => $erlang_cookie,
+      force          => $wipe_db_on_cookie_change,
+      rabbitmq_user  => $rabbitmq_user,
+      rabbitmq_group => $rabbitmq_group,
+      rabbitmq_home  => $rabbitmq_home,
+      service_name   => $service_name,
+      before         => File['rabbitmq.config'],
+      notify         => Class['rabbitmq::service'],
     }
   }
 }
diff --git a/rabbitmq/manifests/init.pp b/rabbitmq/manifests/init.pp
index 4e115f9b2..36e0ca0c2 100644
--- a/rabbitmq/manifests/init.pp
+++ b/rabbitmq/manifests/init.pp
@@ -15,6 +15,7 @@
   $erlang_cookie              = $rabbitmq::params::erlang_cookie,
   $interface                  = $rabbitmq::params::interface,
   $management_port            = $rabbitmq::params::management_port,
+  $management_ssl             = $rabbitmq::params::management_ssl,
   $node_ip_address            = $rabbitmq::params::node_ip_address,
   $package_apt_pin            = $rabbitmq::params::package_apt_pin,
   $package_ensure             = $rabbitmq::params::package_ensure,
@@ -101,9 +102,7 @@
   }
   validate_bool($wipe_db_on_cookie_change)
   validate_bool($tcp_keepalive)
-  if ! is_integer($file_limit) {
-    validate_re($file_limit, '^(unlimited|infinity)$', '$file_limit must be an integer, \'unlimited\', or \'infinity\'.')
-  }
+  validate_re($file_limit, '^(\d+|-1|unlimited|infinity)$', '$file_limit must be a positive integer, \'-1\', \'unlimited\', or \'infinity\'.')
   # Validate service parameters.
   validate_re($service_ensure, '^(running|stopped)$')
   validate_bool($service_manage)
diff --git a/rabbitmq/manifests/install/rabbitmqadmin.pp b/rabbitmq/manifests/install/rabbitmqadmin.pp
index bf545eea4..cbb10e106 100644
--- a/rabbitmq/manifests/install/rabbitmqadmin.pp
+++ b/rabbitmq/manifests/install/rabbitmqadmin.pp
@@ -1,16 +1,17 @@
 #
 class rabbitmq::install::rabbitmqadmin {
 
-  if($rabbitmq::ssl) {
+  if($rabbitmq::ssl and $rabbitmq::management_ssl) {
     $management_port = $rabbitmq::ssl_management_port
+    $protocol        = 'https'
   }
   else {
     $management_port = $rabbitmq::management_port
+    $protocol        = 'http'
   }
 
   $default_user = $rabbitmq::default_user
   $default_pass = $rabbitmq::default_pass
-  $protocol = $rabbitmq::ssl ? { false => 'http', default => 'https' }
 
   staging::file { 'rabbitmqadmin':
     target      => "${rabbitmq::rabbitmq_home}/rabbitmqadmin",
diff --git a/rabbitmq/manifests/params.pp b/rabbitmq/manifests/params.pp
index 7366d9579..aec39e42d 100644
--- a/rabbitmq/manifests/params.pp
+++ b/rabbitmq/manifests/params.pp
@@ -66,9 +66,10 @@
   #install
   $admin_enable               = true
   $management_port            = '15672'
+  $management_ssl             = true
   $package_apt_pin            = ''
   $package_gpg_key            = 'http://www.rabbitmq.com/rabbitmq-signing-key-public.asc'
-  $repos_ensure               = true
+  $repos_ensure               = false
   $manage_repos               = undef
   $service_ensure             = 'running'
   $service_manage             = true
@@ -117,5 +118,5 @@
   $environment_variables      = {}
   $config_variables           = {}
   $config_kernel_variables    = {}
-  $file_limit                 = 16384
+  $file_limit                 = '16384'
 }
diff --git a/rabbitmq/spec/classes/rabbitmq_spec.rb b/rabbitmq/spec/classes/rabbitmq_spec.rb
index 534ba4f1f..45b4b7cd2 100644
--- a/rabbitmq/spec/classes/rabbitmq_spec.rb
+++ b/rabbitmq/spec/classes/rabbitmq_spec.rb
@@ -150,8 +150,8 @@
       it { should contain_file('/etc/default/rabbitmq-server').with_content(/ulimit -n infinity/) }
     end
 
-    context 'with file_limit => -1' do
-      let(:params) {{ :file_limit => -1 }}
+    context 'with file_limit => \'-1\'' do
+      let(:params) {{ :file_limit => '-1' }}
       it { should contain_file('/etc/default/rabbitmq-server').with_content(/ulimit -n -1/) }
     end
 
@@ -160,10 +160,17 @@
       it { should contain_file('/etc/default/rabbitmq-server').with_content(/ulimit -n 1234/) }
     end
 
-    context 'with file_limit => foo' do
+    context 'with file_limit => \'-42\'' do
+      let(:params) {{ :file_limit => '-42' }}
+      it 'does not compile' do
+        expect { catalogue }.to raise_error(Puppet::Error, /\$file_limit must be a positive integer, '-1', 'unlimited', or 'infinity'/)
+      end
+    end
+
+    context 'with file_limit => \'foo\'' do
       let(:params) {{ :file_limit => 'foo' }}
       it 'does not compile' do
-        expect { catalogue }.to raise_error(Puppet::Error, /\$file_limit must be an integer, 'unlimited', or 'infinity'/)
+        expect { catalogue }.to raise_error(Puppet::Error, /\$file_limit must be a positive integer, '-1', 'unlimited', or 'infinity'/)
       end
     end
   end
@@ -174,6 +181,72 @@
       should contain_class('rabbitmq::repo::rhel')
       should contain_exec('rpm --import http://www.rabbitmq.com/rabbitmq-signing-key-public.asc')
     end
+
+    context 'with file_limit => \'unlimited\'' do
+      let(:params) {{ :file_limit => 'unlimited' }}
+      it { should contain_file('/etc/security/limits.d/rabbitmq-server.conf').with(
+        'owner'   => '0',
+        'group'   => '0',
+        'mode'    => '0644',
+        'notify'  => 'Class[Rabbitmq::Service]',
+        'content' => 'rabbitmq soft nofile unlimited
+rabbitmq hard nofile unlimited
+'
+      ) }
+    end
+
+    context 'with file_limit => \'infinity\'' do
+      let(:params) {{ :file_limit => 'infinity' }}
+      it { should contain_file('/etc/security/limits.d/rabbitmq-server.conf').with(
+        'owner'   => '0',
+        'group'   => '0',
+        'mode'    => '0644',
+        'notify'  => 'Class[Rabbitmq::Service]',
+        'content' => 'rabbitmq soft nofile infinity
+rabbitmq hard nofile infinity
+'
+      ) }
+    end
+
+    context 'with file_limit => \'-1\'' do
+      let(:params) {{ :file_limit => '-1' }}
+      it { should contain_file('/etc/security/limits.d/rabbitmq-server.conf').with(
+        'owner'   => '0',
+        'group'   => '0',
+        'mode'    => '0644',
+        'notify'  => 'Class[Rabbitmq::Service]',
+        'content' => 'rabbitmq soft nofile -1
+rabbitmq hard nofile -1
+'
+      ) }
+    end
+
+    context 'with file_limit => \'1234\'' do
+      let(:params) {{ :file_limit => '1234' }}
+      it { should contain_file('/etc/security/limits.d/rabbitmq-server.conf').with(
+        'owner'   => '0',
+        'group'   => '0',
+        'mode'    => '0644',
+        'notify'  => 'Class[Rabbitmq::Service]',
+        'content' => 'rabbitmq soft nofile 1234
+rabbitmq hard nofile 1234
+'
+      ) }
+    end
+
+    context 'with file_limit => \'-42\'' do
+      let(:params) {{ :file_limit => '-42' }}
+      it 'does not compile' do
+        expect { catalogue }.to raise_error(Puppet::Error, /\$file_limit must be a positive integer, '-1', 'unlimited', or 'infinity'/)
+      end
+    end
+
+    context 'with file_limit => \'foo\'' do
+      let(:params) {{ :file_limit => 'foo' }}
+      it 'does not compile' do
+        expect { catalogue }.to raise_error(Puppet::Error, /\$file_limit must be a positive integer, '-1', 'unlimited', or 'infinity'/)
+      end
+    end
   end
 
   context 'on Redhat' do
@@ -264,7 +337,7 @@
       'notify'      => 'Class[Rabbitmq::Service]',
       'refreshonly' => true
     ) }
-    context 'with file_limit => unlimited' do
+    context 'with file_limit => \'unlimited\'' do
       let(:params) {{ :file_limit => 'unlimited' }}
       it { should contain_file('/etc/systemd/system/rabbitmq-server.service.d/limits.conf').with(
         'owner'   => '0',
@@ -277,7 +350,7 @@
       ) }
     end
 
-    context 'with file_limit => infinity' do
+    context 'with file_limit => \'infinity\'' do
       let(:params) {{ :file_limit => 'infinity' }}
       it { should contain_file('/etc/systemd/system/rabbitmq-server.service.d/limits.conf').with(
         'owner'   => '0',
@@ -290,8 +363,8 @@
       ) }
     end
 
-    context 'with file_limit => -1' do
-      let(:params) {{ :file_limit => -1 }}
+    context 'with file_limit => \'-1\'' do
+      let(:params) {{ :file_limit => '-1' }}
       it { should contain_file('/etc/systemd/system/rabbitmq-server.service.d/limits.conf').with(
         'owner'   => '0',
         'group'   => '0',
@@ -315,76 +388,6 @@
 '
       ) }
     end
-
-    context 'with file_limit => foo' do
-      let(:params) {{ :file_limit => 'foo' }}
-      it 'does not compile' do
-        expect { catalogue }.to raise_error(Puppet::Error, /\$file_limit must be an integer, 'unlimited', or 'infinity'/)
-      end
-    end
-  end
-
-  context 'on RedHat before 7.0' do
-    let(:facts) {{ :osfamily => 'RedHat', :operatingsystemmajrelease => '6' }}
-
-    context 'with file_limit => unlimited' do
-      let(:params) {{ :file_limit => 'unlimited' }}
-      it { should contain_file('/etc/security/limits.d/rabbitmq-server.conf').with(
-        'owner'   => '0',
-        'group'   => '0',
-        'mode'    => '0644',
-        'notify'  => 'Class[Rabbitmq::Service]',
-        'content' => 'rabbitmq soft nofile unlimited
-rabbitmq hard nofile unlimited
-'
-      ) }
-    end
-
-    context 'with file_limit => infinity' do
-      let(:params) {{ :file_limit => 'infinity' }}
-      it { should contain_file('/etc/security/limits.d/rabbitmq-server.conf').with(
-        'owner'   => '0',
-        'group'   => '0',
-        'mode'    => '0644',
-        'notify'  => 'Class[Rabbitmq::Service]',
-        'content' => 'rabbitmq soft nofile infinity
-rabbitmq hard nofile infinity
-'
-      ) }
-    end
-
-    context 'with file_limit => -1' do
-      let(:params) {{ :file_limit => -1 }}
-      it { should contain_file('/etc/security/limits.d/rabbitmq-server.conf').with(
-        'owner'   => '0',
-        'group'   => '0',
-        'mode'    => '0644',
-        'notify'  => 'Class[Rabbitmq::Service]',
-        'content' => 'rabbitmq soft nofile -1
-rabbitmq hard nofile -1
-'
-      ) }
-    end
-
-    context 'with file_limit => \'1234\'' do
-      let(:params) {{ :file_limit => '1234' }}
-      it { should contain_file('/etc/security/limits.d/rabbitmq-server.conf').with(
-        'owner'   => '0',
-        'group'   => '0',
-        'mode'    => '0644',
-        'notify'  => 'Class[Rabbitmq::Service]',
-        'content' => 'rabbitmq soft nofile 1234
-rabbitmq hard nofile 1234
-'
-      ) }
-    end
-
-    context 'with file_limit => foo' do
-      let(:params) {{ :file_limit => 'foo' }}
-      it 'does not compile' do
-        expect { catalogue }.to raise_error(Puppet::Error, /\$file_limit must be an integer, 'unlimited', or 'infinity'/)
-      end
-    end
   end
 
   ['Debian', 'RedHat', 'SUSE', 'Archlinux'].each do |distro|
@@ -471,6 +474,25 @@
           end
         end
 
+        describe 'with erlang_cookie set but without config_cluster' do
+          let(:params) {{
+            :config_cluster           => false,
+            :erlang_cookie            => 'TESTCOOKIE',
+          }}
+          it 'contains the rabbitmq_erlang_cookie' do
+            should contain_rabbitmq_erlang_cookie('/var/lib/rabbitmq/.erlang.cookie')
+          end
+        end
+
+        describe 'without erlang_cookie and without config_cluster' do
+          let(:params) {{
+            :config_cluster           => false,
+          }}
+          it 'contains the rabbitmq_erlang_cookie' do
+            should_not contain_rabbitmq_erlang_cookie('/var/lib/rabbitmq/.erlang.cookie')
+          end
+        end
+
         describe 'and sets appropriate configuration' do
           let(:params) {{
             :config_cluster           => true,
@@ -640,6 +662,79 @@
         end
       end
 
+      describe 'ssl options and mangament_ssl false' do
+        let(:params) {
+          { :ssl => true,
+            :ssl_port => 3141,
+            :ssl_cacert => '/path/to/cacert',
+            :ssl_cert => '/path/to/cert',
+            :ssl_key => '/path/to/key',
+            :management_ssl => false,
+            :management_port => 13142
+        } }
+
+        it 'should set ssl options to specified values' do
+          should contain_file('rabbitmq.config').with_content(
+            %r{ssl_listeners, \[3141\]}
+          )
+          should contain_file('rabbitmq.config').with_content(
+            %r{ssl_options, \[}
+          )
+          should contain_file('rabbitmq.config').with_content(
+            %r{cacertfile,"/path/to/cacert"}
+          )
+          should contain_file('rabbitmq.config').with_content(
+            %r{certfile,"/path/to/cert"}
+          )
+          should contain_file('rabbitmq.config').with_content(
+            %r{keyfile,"/path/to/key"}
+          )
+        end
+        it 'should set non ssl port for management port' do
+          should contain_file('rabbitmq.config').with_content(
+            %r{port, 13142}
+          )
+        end
+      end
+
+        describe 'ssl options and mangament_ssl true' do
+        let(:params) {
+          { :ssl => true,
+            :ssl_port => 3141,
+            :ssl_cacert => '/path/to/cacert',
+            :ssl_cert => '/path/to/cert',
+            :ssl_key => '/path/to/key',
+            :management_ssl => true,
+            :ssl_management_port => 13141
+        } }
+
+        it 'should set ssl options to specified values' do
+          should contain_file('rabbitmq.config').with_content(
+            %r{ssl_listeners, \[3141\]}
+          )
+          should contain_file('rabbitmq.config').with_content(
+            %r{ssl_opts, }
+          )
+          should contain_file('rabbitmq.config').with_content(
+            %r{ssl_options, \[}
+          )
+          should contain_file('rabbitmq.config').with_content(
+            %r{cacertfile,"/path/to/cacert"}
+          )
+          should contain_file('rabbitmq.config').with_content(
+            %r{certfile,"/path/to/cert"}
+          )
+          should contain_file('rabbitmq.config').with_content(
+            %r{keyfile,"/path/to/key"}
+          )
+        end
+        it 'should set ssl managment port to specified values' do 
+          should contain_file('rabbitmq.config').with_content(
+            %r{port, 13141}
+          )
+        end
+      end
+
       describe 'ssl options' do
         let(:params) {
           { :ssl => true,
@@ -811,10 +906,11 @@
           should contain_file('rabbitmq.config').with_content(%r{listener, \[})
           should contain_file('rabbitmq.config').with_content(%r{port, 5926\}})
           should contain_file('rabbitmq.config').with_content(%r{ssl, true\}})
-          should contain_file('rabbitmq.config').with_content(%r{ssl_opts, \[\{cacertfile, "/path/to/cacert"\},})
+          should contain_file('rabbitmq.config').with_content(%r{ssl_opts, \[})
+          should contain_file('rabbitmq.config').with_content(%r{cacertfile, "/path/to/cacert"\},})
           should contain_file('rabbitmq.config').with_content(%r{certfile, "/path/to/cert"\},})
           should contain_file('rabbitmq.config').with_content(%r{keyfile, "/path/to/key"\}})
-          should contain_file('rabbitmq.config').with_content(%r{,\{versions, \['tlsv1.1', 'tlsv1.2'\]\}[\r\n ]*\]\}})
+          should contain_file('rabbitmq.config').with_content(%r{,\{versions, \['tlsv1.1', 'tlsv1.2'\]\}})
         end
       end
 
@@ -833,9 +929,10 @@
           should contain_file('rabbitmq.config').with_content(%r{listener, \[})
           should contain_file('rabbitmq.config').with_content(%r{port, 3141\}})
           should contain_file('rabbitmq.config').with_content(%r{ssl, true\}})
-          should contain_file('rabbitmq.config').with_content(%r{ssl_opts, \[\{cacertfile, "/path/to/cacert"\},})
+          should contain_file('rabbitmq.config').with_content(%r{ssl_opts, \[})
+          should contain_file('rabbitmq.config').with_content(%r{cacertfile, "/path/to/cacert"\},})
           should contain_file('rabbitmq.config').with_content(%r{certfile, "/path/to/cert"\},})
-          should contain_file('rabbitmq.config').with_content(%r{keyfile, "/path/to/key"\}[\r\n ]*\]\}})
+          should contain_file('rabbitmq.config').with_content(%r{keyfile, "/path/to/key"\}})
         end
       end
 
@@ -868,9 +965,10 @@
           should contain_file('rabbitmq.config').with_content(%r{listener, \[})
           should contain_file('rabbitmq.config').with_content(%r{port, 3141\},})
           should contain_file('rabbitmq.config').with_content(%r{ssl, true\},})
-          should contain_file('rabbitmq.config').with_content(%r{ssl_opts, \[\{cacertfile, "/path/to/cacert"\},})
+          should contain_file('rabbitmq.config').with_content(%r{ssl_opts, \[})
+          should contain_file('rabbitmq.config').with_content(%r{cacertfile, "/path/to/cacert"\},})
           should contain_file('rabbitmq.config').with_content(%r{certfile, "/path/to/cert"\},})
-          should contain_file('rabbitmq.config').with_content(%r{keyfile, "/path/to/key"\}[\r\n ]*\]\}})
+          should contain_file('rabbitmq.config').with_content(%r{keyfile, "/path/to/key"\}})
         end
       end
 
diff --git a/rabbitmq/spec/unit/puppet/type/rabbitmq_policy_spec.rb b/rabbitmq/spec/unit/puppet/type/rabbitmq_policy_spec.rb
index 36bf2a73f..ff96b1d8f 100644
--- a/rabbitmq/spec/unit/puppet/type/rabbitmq_policy_spec.rb
+++ b/rabbitmq/spec/unit/puppet/type/rabbitmq_policy_spec.rb
@@ -116,4 +116,32 @@
       @policy[:definition] = definition
     }.to raise_error(Puppet::Error, /Invalid expires value.*future/)
   end
+
+  it 'should accept and convert the message-ttl value' do
+    definition = {'message-ttl' => '1800000'}
+    @policy[:definition] = definition
+    @policy[:definition]['message-ttl'].should be_a(Fixnum)
+    @policy[:definition]['message-ttl'].should == 1800000
+  end
+
+  it 'should not accept non-numeric message-ttl value' do
+    definition = {'message-ttl' => 'future'}
+    expect {
+      @policy[:definition] = definition
+    }.to raise_error(Puppet::Error, /Invalid message-ttl value.*future/)
+  end
+
+  it 'should accept and convert the max-length value' do
+    definition = {'max-length' => '1800000'}
+    @policy[:definition] = definition
+    @policy[:definition]['max-length'].should be_a(Fixnum)
+    @policy[:definition]['max-length'].should == 1800000
+  end
+
+  it 'should not accept non-numeric max-length value' do
+    definition = {'max-length' => 'future'}
+    expect {
+      @policy[:definition] = definition
+    }.to raise_error(Puppet::Error, /Invalid max-length value.*future/)
+  end
 end
diff --git a/rabbitmq/templates/rabbitmq.config.erb b/rabbitmq/templates/rabbitmq.config.erb
index 71b777621..3426ebd7e 100644
--- a/rabbitmq/templates/rabbitmq.config.erb
+++ b/rabbitmq/templates/rabbitmq.config.erb
@@ -67,10 +67,12 @@
 <%- if @admin_enable -%>,
   {rabbitmq_management, [
     {listener, [
-<%- if @ssl -%>
+<%- if @ssl && @management_ssl -%>
       {port, <%= @ssl_management_port %>},
       {ssl, true},
-      {ssl_opts, [<%- if @ssl_cacert != 'UNSET' -%>{cacertfile, "<%= @ssl_cacert %>"},<%- end -%>
+      {ssl_opts, [<%- if @ssl_cacert != 'UNSET' %>
+                  {cacertfile, "<%= @ssl_cacert %>"},
+                  <%- end -%>
 
                   {certfile, "<%= @ssl_cert %>"},
                   {keyfile, "<%= @ssl_key %>"}
diff --git a/rabbitmq/templates/rabbitmqadmin.conf.erb b/rabbitmq/templates/rabbitmqadmin.conf.erb
index d76c81147..5ea629c22 100644
--- a/rabbitmq/templates/rabbitmqadmin.conf.erb
+++ b/rabbitmq/templates/rabbitmqadmin.conf.erb
@@ -1,5 +1,5 @@
 [default]
-<% if @ssl -%>
+<% if @ssl && @management_ssl -%>
 ssl = True
 port = <%= @ssl_management_port %>
 <% else -%>
diff --git a/redis/templates/redis-sentinel.conf.erb b/redis/templates/redis-sentinel.conf.erb
index 8678e9466..a3e6f2d71 100644
--- a/redis/templates/redis-sentinel.conf.erb
+++ b/redis/templates/redis-sentinel.conf.erb
@@ -1,6 +1,6 @@
 port <%= @sentinel_port %>
 dir <%= @working_dir %>
-<% if scope.lookupvar('::redis::daemonize') -%>daemonize yes<% else -%>daemonize no<% end %>
+<% if @daemonize -%>daemonize yes<% else -%>daemonize no<% end %>
 pidfile <%= @pid_file %>
 
 sentinel monitor <%= @master_name %> <%= @redis_host %> <%= @redis_port %> <%= @quorum %>
diff --git a/redis/templates/redis.conf.erb b/redis/templates/redis.conf.erb
index 1be215f91..b98964521 100644
--- a/redis/templates/redis.conf.erb
+++ b/redis/templates/redis.conf.erb
@@ -14,20 +14,20 @@
 
 # By default Redis does not run as a daemon. Use 'yes' if you need it.
 # Note that Redis will write a pid file in /var/run/redis.pid when daemonized.
-<% if scope.lookupvar('::redis::daemonize') -%>daemonize yes<% else -%>daemonize no<% end -%>
+<% if @daemonize -%>daemonize yes<% else -%>daemonize no<% end -%>
 
 # When running daemonized, Redis writes a pid file in /var/run/redis.pid by
 # default. You can specify a custom pid file location here.
-pidfile <%= scope.lookupvar('::redis::pid_file') %>
+pidfile <%= @pid_file %>
 
 # Accept connections on the specified port, default is 6379.
 # If port 0 is specified Redis will not listen on a TCP socket.
-port <%= scope.lookupvar('::redis::port') %>
+port <%= @port %>
 
 # If you want you can bind a single interface, if the bind option is not
 # specified all the interfaces will listen for incoming connections.
 #
-bind <%= scope.lookupvar('::redis::bind') %>
+bind <%= @bind %>
 
 # Specify the path for the unix socket that will be used to listen for
 # incoming connections. There is no default, so Redis will not listen
@@ -37,7 +37,7 @@ bind <%= scope.lookupvar('::redis::bind') %>
 # unixsocketperm 755
 
 # Close the connection after a client is idle for N seconds (0 to disable)
-timeout <%= scope.lookupvar('::redis::timeout') %>
+timeout <%= @timeout %>
 
 # Set server verbosity to 'debug'
 # it can be one of:
@@ -45,27 +45,27 @@ timeout <%= scope.lookupvar('::redis::timeout') %>
 # verbose (many rarely useful info, but not a mess like the debug level)
 # notice (moderately verbose, what you want in production probably)
 # warning (only very important / critical messages are logged)
-loglevel <%= scope.lookupvar('::redis::log_level') %>
+loglevel <%= @log_level %>
 
 # Specify the log file name. Also 'stdout' can be used to force
 # Redis to log on the standard output. Note that if you use standard
 # output for logging but daemonize, logs will be sent to /dev/null
-logfile <%= scope.lookupvar('::redis::log_file') %>
+logfile <%= @log_file %>
 
 # To enable logging to the system logger, just set 'syslog-enabled' to yes,
 # and optionally update the other syslog parameters to suit your needs.
-<% if scope.lookupvar('::redis::syslog_enabled') %>syslog-enabled yes<% else %>syslog-enabled no<% end %>
+<% if @syslog_enabled %>syslog-enabled yes<% else %>syslog-enabled no<% end %>
 
 # Specify the syslog identity.
 # syslog-ident redis
 
 # Specify the syslog facility.  Must be USER or between LOCAL0-LOCAL7.
-<% if scope.lookupvar('::redis::syslog_facility') %>syslog-facility <%= scope.lookupvar('::redis::syslog_facility') %><% else %># syslog-facility local0<% end %>
+<% if @syslog_facility %>syslog-facility <%= @syslog_facility %><% else %># syslog-facility local0<% end %>
 
 # Set the number of databases. The default database is DB 0, you can select
 # a different one on a per-connection basis using SELECT <dbid> where
 # dbid is a number between 0 and 'databases'-1
-databases <%= scope.lookupvar('::redis::databases') %>
+databases <%= @databases %>
 
 ################################ SNAPSHOTTING  #################################
 #
@@ -112,7 +112,7 @@ stop-writes-on-bgsave-error yes
 # For default that's set to 'yes' as it's almost always a win.
 # If you want to save some CPU in the saving child set it to 'no' but
 # the dataset will likely be bigger if you have compressible values or keys.
-<% if scope.lookupvar('::redis::rdbcompression') -%>rdbcompression yes<% else -%>rdbcompression no<% end -%>
+<% if @rdbcompression -%>rdbcompression yes<% else -%>rdbcompression no<% end -%>
 
 # Since verison 5 of RDB a CRC64 checksum is placed at the end of the file.
 # This makes the format more resistant to corruption but there is a performance
@@ -124,7 +124,7 @@ stop-writes-on-bgsave-error yes
 rdbchecksum yes
 
 # The filename where to dump the DB
-dbfilename <%= scope.lookupvar('::redis::dbfilename') %>
+dbfilename <%= @dbfilename %>
 
 # The working directory.
 #
@@ -134,7 +134,7 @@ dbfilename <%= scope.lookupvar('::redis::dbfilename') %>
 # Also the Append Only File will be created inside this directory.
 #
 # Note that you must specify a directory here, not a file name.
-dir <%= scope.lookupvar('::redis::workdir') %>
+dir <%= @workdir %>
 
 ################################# REPLICATION #################################
 
@@ -144,7 +144,7 @@ dir <%= scope.lookupvar('::redis::workdir') %>
 # different interval, or to listen to another port, and so on.
 #
 # slaveof <masterip> <masterport>
-<% if scope.lookupvar('::redis::slaveof') -%>slaveof <%= scope.lookupvar('::redis::slaveof') %><% end -%>
+<% if @slaveof -%>slaveof <%= @slaveof %><% end -%>
 
 # If the master is password protected (using the "requirepass" configuration
 # directive below) it is possible to tell the slave to authenticate before
@@ -152,7 +152,7 @@ dir <%= scope.lookupvar('::redis::workdir') %>
 # refuse the slave request.
 #
 # masterauth <master-password>
-<% if scope.lookupvar('::redis::masterauth') -%>masterauth <%= scope.lookupvar('::redis::masterauth') %><% end -%>
+<% if @masterauth -%>masterauth <%= @masterauth %><% end -%>
 
 # When a slave lost the connection with the master, or when the replication
 # is still in progress, the slave can act in two different ways:
@@ -165,7 +165,7 @@ dir <%= scope.lookupvar('::redis::workdir') %>
 #    an error "SYNC with master in progress" to all the kind of commands
 #    but to INFO and SLAVEOF.
 #
-slave-serve-stale-data <% if scope.lookupvar('::redis::slave_serve_stale_data') -%>yes<% else -%>no<% end -%>
+slave-serve-stale-data <% if @slave_serve_stale_data -%>yes<% else -%>no<% end -%>
 
 # You can configure a slave instance to accept writes or not. Writing against
 # a slave instance may be useful to store some ephemeral data (because data
@@ -181,7 +181,7 @@ slave-serve-stale-data <% if scope.lookupvar('::redis::slave_serve_stale_data')
 # such as CONFIG, DEBUG, and so forth. To a limited extend you can improve
 # security of read only slaves using 'rename-command' to shadow all the
 # administrative / dangerous commands.
-slave-read-only <% if scope.lookupvar('::redis::slave_read_only') -%>yes<% else -%>no<% end -%>
+slave-read-only <% if @slave_read_only -%>yes<% else -%>no<% end -%>
 
 # Slaves send PINGs to server in a predefined interval. It's possible to change
 # this interval with the repl_ping_slave_period option. The default value is 10
@@ -196,7 +196,7 @@ slave-read-only <% if scope.lookupvar('::redis::slave_read_only') -%>yes<% else
 # specified for repl-ping-slave-period otherwise a timeout will be detected
 # every time there is low traffic between the master and the slave.
 #
-repl-timeout <%= scope.lookupvar('::redis::repl_timeout') %>
+repl-timeout <%= @repl_timeout %>
 
 # The slave priority is an integer number published by Redis in the INFO output.
 # It is used by Redis Sentinel in order to select a slave to promote into a
@@ -226,7 +226,7 @@ slave-priority 100
 # 150k passwords per second against a good box. This means that you should
 # use a very strong password otherwise it will be very easy to break.
 #
-<% if scope.lookupvar('::redis::requirepass') -%>requirepass <%= scope.lookupvar('::redis::requirepass') %><% end -%>
+<% if @requirepass -%>requirepass <%= @requirepass %><% end -%>
 
 # Command renaming.
 #
@@ -255,7 +255,7 @@ slave-priority 100
 # Once the limit is reached Redis will close all the new connections sending
 # an error 'max number of clients reached'.
 #
-maxclients <%= scope.lookupvar('::redis::maxclients') %>
+maxclients <%= @maxclients %>
 
 # Don't use more memory than the specified amount of bytes.
 # When the memory limit is reached Redis will try to remove keys
@@ -281,7 +281,7 @@ maxclients <%= scope.lookupvar('::redis::maxclients') %>
 # output buffers (but this is not needed if the policy is 'noeviction').
 #
 # maxmemory <bytes>
-<% if scope.lookupvar('::redis::maxmemory') -%>maxmemory <%= scope.lookupvar('::redis::maxmemory') %><% end -%>
+<% if @maxmemory -%>maxmemory <%= @maxmemory %><% end -%>
 
 # MAXMEMORY POLICY: how Redis will select what to remove when maxmemory
 # is reached? You can select among five behavior:
@@ -305,7 +305,7 @@ maxclients <%= scope.lookupvar('::redis::maxclients') %>
 # The default is:
 #
 # maxmemory-policy volatile-lru
-<% if scope.lookupvar('::redis::maxmemory_policy') -%>maxmemory-policy <%= scope.lookupvar('::redis::maxmemory_policy') %><% end -%>
+<% if @maxmemory_policy -%>maxmemory-policy <%= @maxmemory_policy %><% end -%>
 
 # LRU and minimal TTL algorithms are not precise algorithms but approximated
 # algorithms (in order to save memory), so you can select as well the sample
@@ -314,7 +314,7 @@ maxclients <%= scope.lookupvar('::redis::maxclients') %>
 # using the following configuration directive.
 #
 # maxmemory-samples 3
-<% if scope.lookupvar('::redis::maxmemory_samples') -%>maxmemory-samples <%= scope.lookupvar('::redis::maxmemory_samples') %><% end -%>
+<% if @maxmemory_samples -%>maxmemory-samples <%= @maxmemory_samples %><% end -%>
 
 ############################## APPEND ONLY MODE ###############################
 
@@ -336,7 +336,7 @@ maxclients <%= scope.lookupvar('::redis::maxclients') %>
 #
 # Please check http://redis.io/topics/persistence for more information.
 
-<% if scope.lookupvar('::redis::appendonly') -%>appendonly yes<% else -%>appendonly no<% end -%>
+<% if @appendonly -%>appendonly yes<% else -%>appendonly no<% end -%>
 
 # The name of the append only file (default: "appendonly.aof")
 # appendfilename appendonly.aof
@@ -364,7 +364,7 @@ maxclients <%= scope.lookupvar('::redis::maxclients') %>
 #
 # If unsure, use "everysec".
 
-appendfsync <%= scope.lookupvar('::redis::appendfsync') %>
+appendfsync <%= @appendfsync %>
 
 # When the AOF fsync policy is set to always or everysec, and a background
 # saving process (a background save or AOF log background rewriting) is
@@ -384,7 +384,7 @@ appendfsync <%= scope.lookupvar('::redis::appendfsync') %>
 #
 # If you have latency problems turn this to "yes". Otherwise leave it as
 # "no" that is the safest pick from the point of view of durability.
-<% if scope.lookupvar('::redis::no_appendfsync_on_rewrite') -%>no-appendfsync-on-rewrite yes<% else -%>no-appendfsync-on-rewrite no<% end -%>
+<% if @no_appendfsync_on_rewrite -%>no-appendfsync-on-rewrite yes<% else -%>no-appendfsync-on-rewrite no<% end -%>
 
 # Automatic rewrite of the append only file.
 # Redis is able to automatically rewrite the log file implicitly calling
@@ -403,8 +403,8 @@ appendfsync <%= scope.lookupvar('::redis::appendfsync') %>
 # Specify a percentage of zero in order to disable the automatic AOF
 # rewrite feature.
 
-auto-aof-rewrite-percentage <%= scope.lookupvar('::redis::auto_aof_rewrite_percentage') %>
-auto-aof-rewrite-min-size   <%= scope.lookupvar('::redis::auto_aof_rewrite_min_size') %>
+auto-aof-rewrite-percentage <%= @auto_aof_rewrite_percentage %>
+auto-aof-rewrite-min-size   <%= @auto_aof_rewrite_min_size %>
 
 ################################ LUA SCRIPTING  ###############################
 
@@ -442,38 +442,38 @@ lua-time-limit 5000
 # The following time is expressed in microseconds, so 1000000 is equivalent
 # to one second. Note that a negative number disables the slow log, while
 # a value of zero forces the logging of every command.
-slowlog-log-slower-than <%= scope.lookupvar('::redis::slowlog_log_slower_than') %>
+slowlog-log-slower-than <%= @slowlog_log_slower_than %>
 
 # There is no limit to this length. Just be aware that it will consume memory.
 # You can reclaim memory used by the slow log with SLOWLOG RESET.
-slowlog-max-len <%= scope.lookupvar('::redis::slowlog_max_len') %>
+slowlog-max-len <%= @slowlog_max_len %>
 
 ############################### ADVANCED CONFIG ###############################
 
 # Hashes are encoded using a memory efficient data structure when they have a
 # small number of entries, and the biggest entry does not exceed a given
 # threshold. These thresholds can be configured using the following directives.
-hash-max-ziplist-entries <%= scope.lookupvar('::redis::hash_max_ziplist_entries') %>
-hash-max-ziplist-value <%= scope.lookupvar('::redis::hash_max_ziplist_value') %>
+hash-max-ziplist-entries <%= @hash_max_ziplist_entries %>
+hash-max-ziplist-value <%= @hash_max_ziplist_value %>
 
 # Similarly to hashes, small lists are also encoded in a special way in order
 # to save a lot of space. The special representation is only used when
 # you are under the following limits:
-list-max-ziplist-entries <%= scope.lookupvar('::redis::list_max_ziplist_entries') %>
-list-max-ziplist-value <%= scope.lookupvar('::redis::list_max_ziplist_value') %>
+list-max-ziplist-entries <%= @list_max_ziplist_entries %>
+list-max-ziplist-value <%= @list_max_ziplist_value %>
 
 # Sets have a special encoding in just one case: when a set is composed
 # of just strings that happens to be integers in radix 10 in the range
 # of 64 bit signed integers.
 # The following configuration setting sets the limit in the size of the
 # set in order to use this special memory saving encoding.
-set-max-intset-entries <%= scope.lookupvar('::redis::set_max_intset_entries') %>
+set-max-intset-entries <%= @set_max_intset_entries %>
 
 # Similarly to hashes and lists, sorted sets are also specially encoded in
 # order to save a lot of space. This encoding is only used when the length and
 # elements of a sorted set are below the following limits:
-zset-max-ziplist-entries <%= scope.lookupvar('::redis::zset_max_ziplist_entries') %>
-zset-max-ziplist-value <%= scope.lookupvar('::redis::zset_max_ziplist_value') %>
+zset-max-ziplist-entries <%= @zset_max_ziplist_entries %>
+zset-max-ziplist-value <%= @zset_max_ziplist_value %>
 
 # Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in
 # order to help rehashing the main Redis hash table (the one mapping top-level
@@ -493,7 +493,7 @@ zset-max-ziplist-value <%= scope.lookupvar('::redis::zset_max_ziplist_value') %>
 #
 # use "activerehashing yes" if you don't have such hard requirements but
 # want to free memory asap when possible.
-<% if scope.lookupvar('::redis::activerehashing') -%>activerehashing yes<% else -%>activerehashing no<% end -%>
+<% if @activerehashing -%>activerehashing yes<% else -%>activerehashing no<% end -%>
 
 # The client output buffer limits can be used to force disconnection of clients
 # that are not reading data from the server fast enough for some reason (a
@@ -541,7 +541,7 @@ client-output-buffer-limit pubsub 32mb 8mb 60
 #
 # include /path/to/local.conf
 # include /path/to/other.conf
-<% if scope.lookupvar('::redis::extra_config_file') -%>
-include <%= scope.lookupvar('::redis::extra_config_file') %>
+<% if @extra_config_file -%>
+include <%= @extra_config_file %>
 <% end -%>
 
diff --git a/sahara/CHANGELOG.md b/sahara/CHANGELOG.md
new file mode 100644
index 000000000..9f217799c
--- /dev/null
+++ b/sahara/CHANGELOG.md
@@ -0,0 +1,4 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+- Initial release of the puppet-sahara module
diff --git a/sahara/README.md b/sahara/README.md
index a8d5a5a5a..1c617bd07 100644
--- a/sahara/README.md
+++ b/sahara/README.md
@@ -1,6 +1,8 @@
 sahara
 ======
 
+6.0.0 - 2015.1 - Kilo
+
 #### Table of Contents
 
 1. [Overview - What is the sahara module?](#overview)
diff --git a/sahara/examples/basic.pp b/sahara/examples/basic.pp
index a217ca364..ee66f1ccd 100644
--- a/sahara/examples/basic.pp
+++ b/sahara/examples/basic.pp
@@ -31,13 +31,13 @@
   database_connection => 'mysql://sahara:a_big_secret@127.0.0.1:3306/sahara',
   verbose             => true,
   debug               => true,
-  keystone_username   => 'admin',
-  keystone_password   => 'secrets_everywhere',
-  keystone_tenant     => 'admin',
-  keystone_url        => 'http://127.0.0.1:5000/v2.0/',
-  identity_url        => 'http://127.0.0.1:35357/',
-  service_host        => '0.0.0.0',
-  service_port        => 8386,
+  admin_user          => 'admin',
+  admin_password      => 'secrets_everywhere',
+  admin_tenant_name   => 'admin',
+  auth_uri            => 'http://127.0.0.1:5000/v2.0/',
+  identity_uri        => 'http://127.0.0.1:35357/',
+  host                => '0.0.0.0',
+  port                => 8386,
   use_floating_ips    => true,
 }
 
diff --git a/sahara/manifests/init.pp b/sahara/manifests/init.pp
index dfe4e73e6..2237bc9df 100644
--- a/sahara/manifests/init.pp
+++ b/sahara/manifests/init.pp
@@ -37,11 +37,11 @@
 #   If set to boolean false, it will not log to any directory.
 #   Defaults to '/var/log/sahara'
 #
-# [*service_host*]
+# [*host*]
 #   (Optional) Hostname for sahara to listen on
 #   Defaults to '0.0.0.0'.
 #
-# [*service_port*]
+# [*port*]
 #   (Optional) Port for sahara to listen on
 #   Defaults to 8386.
 #
@@ -59,26 +59,64 @@
 #
 # == keystone authentication options
 #
-# [*keystone_username*]
-#   (Optional) Username for sahara credentials
+# [*admin_user*]
+#   (Optional) Service user name
 #   Defaults to 'admin'.
 #
-# [*keystone_password*]
-#   (Optional) Password for sahara credentials
+# [*admin_password*]
+#   (Optional) Service user password.
 #   Defaults to false.
 #
-# [*keystone_tenant*]
-#   (Optional) Tenant for keystone_username
+# [*admin_tenant_name*]
+#   (Optional) Service tenant name.
 #   Defaults to 'admin'.
 #
-# [*keystone_url*]
-#   (Optional) Public identity endpoint
+# [*auth_uri*]
+#   (Optional) Complete public Identity API endpoint.
 #   Defaults to 'http://127.0.0.1:5000/v2.0/'.
 #
-# [*identity_url*]
-#   (Optional) Admin identity endpoint
+# [*identity_uri*]
+#   (Optional) Complete admin Identity API endpoint.
+#   This should specify the unversioned root endpoint.
 #   Defaults to 'http://127.0.0.1:35357/'.
 #
+# == DEPRECATED PARAMETERS
+#
+# [*service_host*]
+#   (Optional) DEPRECATED: Use host instead.
+#   Hostname for sahara to listen on
+#   Defaults to undef.
+#
+# [*service_port*]
+#   (Optional) DEPRECATED: Use port instead.
+#   Port for sahara to listen on
+#   Defaults to undef.
+#
+# [*keystone_username*]
+#   (Optional) DEPRECATED: Use admin_user instead.
+#   Username for sahara credentials
+#   Defaults to undef.
+#
+# [*keystone_password*]
+#   (Optional) DEPRECATED: Use admin_password instead.
+#   Password for sahara credentials
+#   Defaults to undef.
+#
+# [*keystone_tenant*]
+#   (Optional) DEPRECATED: Use admin_tenant_name instead.
+#   Tenant for keystone_username
+#   Defaults to undef.
+#
+# [*keystone_url*]
+#   (Optional) DEPRECATED: Use auth_uri instead.
+#   Public identity endpoint
+#   Defaults to undef.
+#
+# [*identity_url*]
+#   (Optional) DEPRECATED: Use identity_uri instead.
+#   Admin identity endpoint
+#   Defaults to undef.
+#
 class sahara(
   $manage_service      = true,
   $enabled             = true,
@@ -88,20 +126,77 @@
   $use_syslog          = false,
   $log_facility        = 'LOG_USER',
   $log_dir             = '/var/log/sahara',
-  $service_host        = '0.0.0.0',
-  $service_port        = 8386,
+  $host                = '0.0.0.0',
+  $port                = '8386',
   $use_neutron         = false,
   $use_floating_ips    = true,
   $database_connection = 'mysql://sahara:secrete@localhost:3306/sahara',
-  $keystone_username   = 'admin',
-  $keystone_password   = false,
-  $keystone_tenant     = 'admin',
-  $keystone_url        = 'http://127.0.0.1:5000/v2.0/',
-  $identity_url        = 'http://127.0.0.1:35357/',
+  $admin_user          = 'admin',
+  $admin_password      = false,
+  $admin_tenant_name   = 'admin',
+  $auth_uri            = 'http://127.0.0.1:5000/v2.0/',
+  $identity_uri        = 'http://127.0.0.1:35357/',
+  # DEPRECATED PARAMETERS
+  $service_host        = undef,
+  $service_port        = undef,
+  $keystone_username   = undef,
+  $keystone_password   = undef,
+  $keystone_tenant     = undef,
+  $keystone_url        = undef,
+  $identity_url        = undef,
 ) {
   include ::sahara::params
   include ::sahara::policy
 
+  if $service_host {
+    warning('The service_host parameter is deprecated. Use host parameter instead')
+    $host_real = $service_host
+  } else {
+    $host_real = $host
+  }
+
+  if $service_port {
+    warning('The service_port parameter is deprecated. Use port parameter instead')
+    $port_real = $service_port
+  } else {
+    $port_real = $port
+  }
+
+  if $keystone_username {
+    warning('The keystone_username parameter is deprecated. Use admin_user parameter instead')
+    $admin_user_real = $keystone_username
+  } else {
+    $admin_user_real = $admin_user
+  }
+
+  if $keystone_password {
+    warning('The keystone_password parameter is deprecated. Use admin_password parameter instead')
+    $admin_password_real = $keystone_password
+  } else {
+    $admin_password_real = $admin_password
+  }
+
+  if $keystone_tenant {
+    warning('The keystone_tenant parameter is deprecated. Use admin_tenant_name parameter instead')
+    $admin_tenant_name_real = $keystone_tenant
+  } else {
+    $admin_tenant_name_real = $admin_tenant_name
+  }
+
+  if $keystone_url {
+    warning('The keystone_url parameter is deprecated. Use auth_uri parameter instead')
+    $auth_uri_real = $keystone_url
+  } else {
+    $auth_uri_real = $auth_uri
+  }
+
+  if $identity_url {
+    warning('The identity_url parameter is deprecated. Use identity_uri parameter instead')
+    $identity_uri_real = $identity_url
+  } else {
+    $identity_uri_real = $identity_uri
+  }
+
   if $::osfamily == 'RedHat' {
     $group_require = Package['sahara']
     $dir_require = Package['sahara']
@@ -186,24 +281,23 @@
   sahara_config {
     'DEFAULT/use_neutron': value => $use_neutron;
     'DEFAULT/use_floating_ips': value => $use_floating_ips;
-    'DEFAULT/host': value => $service_host;
-    'DEFAULT/port': value => $service_port;
-    'DEFAULT/debug': value => $debug;
-    'DEFAULT/verbose': value => $verbose;
-
+    'DEFAULT/host':             value => $host_real;
+    'DEFAULT/port':             value => $port_real;
+    'DEFAULT/debug':            value => $debug;
+    'DEFAULT/verbose':          value => $verbose;
     'database/connection':
       value => $database_connection,
       secret => true;
   }
 
-  if $keystone_password {
+  if $admin_password_real {
     sahara_config {
-      'keystone_authtoken/auth_uri': value => $keystone_url;
-      'keystone_authtoken/identity_uri': value => $identity_url;
-      'keystone_authtoken/admin_user': value => $keystone_username;
-      'keystone_authtoken/admin_tenant_name': value => $keystone_tenant;
+      'keystone_authtoken/auth_uri':          value => $auth_uri_real;
+      'keystone_authtoken/identity_uri':      value => $identity_uri_real;
+      'keystone_authtoken/admin_user':        value => $admin_user_real;
+      'keystone_authtoken/admin_tenant_name': value => $admin_tenant_name_real;
       'keystone_authtoken/admin_password':
-        value => $keystone_password,
+        value => $admin_password_real,
         secret => true;
     }
   }
@@ -220,12 +314,12 @@
 
   if $use_syslog {
     sahara_config {
-      'DEFAULT/use_syslog':           value => true;
-      'DEFAULT/syslog_log_facility':  value => $log_facility;
+      'DEFAULT/use_syslog':          value => true;
+      'DEFAULT/syslog_log_facility': value => $log_facility;
     }
   } else {
     sahara_config {
-      'DEFAULT/use_syslog':           value => false;
+      'DEFAULT/use_syslog': value => false;
     }
   }
 
diff --git a/sahara/manifests/notify/qpid.pp b/sahara/manifests/notify/qpid.pp
index 82289e52c..8577d5edf 100644
--- a/sahara/manifests/notify/qpid.pp
+++ b/sahara/manifests/notify/qpid.pp
@@ -56,11 +56,13 @@
 #   (Optional) The default exchange to scope topics.
 #   Defaults to 'openstack'.
 #
+# == DEPRECATED PARAMETERS
+#
 #  [*kombu_ssl_version*]
 #    (optional) SSL version to use (valid only if SSL enabled).
 #    Valid values are TLSv1, SSLv23 and SSLv3. SSLv2 may be
 #    available on some distributions.
-#    Defaults to 'TLSv1'
+#    Defaults to undef
 #
 # [*kombu_ssl_keyfile*]
 #   (Optional) SSL key file (valid only if SSL enabled).
@@ -76,7 +78,7 @@
 #
 # [*kombu_reconnect_delay*]
 #   (Optional) Backoff on cancel notification (valid only if SSL enabled).
-#   Defaults to '1.0'; floating-point value.
+#   Defaults to undef
 #
 class sahara::notify::qpid(
   $durable_queues         = false,
@@ -92,59 +94,52 @@
   $qpid_topology_version  = 2,
   $notification_topics    = 'notifications',
   $control_exchange       = 'openstack',
-  $kombu_ssl_version      = 'TLSv1',
+  # DEPRECATED PARAMETERS
+  $kombu_ssl_version      = undef,
   $kombu_ssl_keyfile      = undef,
   $kombu_ssl_certfile     = undef,
   $kombu_ssl_ca_certs     = undef,
-  $kombu_reconnect_delay  = '1.0',
+  $kombu_reconnect_delay  = undef,
 ) {
-  if $qpid_protocol == 'ssl' {
-    if !$kombu_ssl_keyfile {
-      fail('kombu_ssl_keyfile must be set when using SSL in qpid')
-    }
-    if !$kombu_ssl_certfile {
-      fail('kombu_ssl_certfile must be set when using SSL in qpid')
-    }
-    if !$kombu_ssl_ca_certs {
-      fail('kombu_ca_certs must be set when using SSL in qpid')
-    }
-    sahara_config {
-      'DEFAULT/kombu_ssl_version': value => $kombu_ssl_version;
-      'DEFAULT/kombu_ssl_keyfile': value => $kombu_ssl_keyfile;
-      'DEFAULT/kombu_ssl_certfile': value => $kombu_ssl_certfile;
-      'DEFAULT/kombu_ssl_ca_certs': value => $kombu_ssl_ca_certs;
-      'DEFAULT/kombu_reconnect_delay': value => $kombu_reconnect_delay;
-    }
-  } elsif $qpid_protocol == 'tcp' {
-    sahara_config {
-      'DEFAULT/kombu_ssl_version': ensure => absent;
-      'DEFAULT/kombu_ssl_keyfile': ensure => absent;
-      'DEFAULT/kombu_ssl_certfile': ensure => absent;
-      'DEFAULT/kombu_ssl_ca_certs': ensure => absent;
-      'DEFAULT/kombu_reconnect_delay': ensure => absent;
-    }
-  } else {
-    fail("valid qpid_protocol settings are 'tcp' and 'ssl' only")
+
+  if $kombu_ssl_version {
+    warning('The kombu_ssl_version parameter is deprecated and has no effect.')
+  }
+
+  if $kombu_ssl_keyfile {
+    warning('The kombu_ssl_keyfile parameter is deprecated and has no effect.')
+  }
+
+  if $kombu_ssl_certfile {
+    warning('The kombu_ssl_certfile is deprecated and has no effect.')
+  }
+
+  if $kombu_ssl_ca_certs {
+    warning('The kombu_ssl_ca_certs is deprecated and has no effect.')
+  }
+
+  if $kombu_reconnect_delay {
+    warning('The kombu_reconnect_delay is deprecated and has no effect.')
   }
 
   sahara_config {
-    'DEFAULT/rpc_backend': value => 'qpid';
-    'DEFAULT/qpid_hosts': value => '$qpid_hostname:$qpid_port';
+    'DEFAULT/rpc_backend':                        value => 'qpid';
+    'oslo_messaging_qpid/qpid_hosts':             value => '$qpid_hostname:$qpid_port';
 
-    'DEFAULT/amqp_durable_queues': value => $durable_queues;
-    'DEFAULT/qpid_hostname': value => $qpid_hostname;
-    'DEFAULT/qpid_port': value => $qpid_port;
-    'DEFAULT/qpid_username': value => $qpid_username;
-    'DEFAULT/qpid_password':
+    'oslo_messaging_qpid/amqp_durable_queues':    value => $durable_queues;
+    'oslo_messaging_qpid/qpid_hostname':          value => $qpid_hostname;
+    'oslo_messaging_qpid/qpid_port':              value => $qpid_port;
+    'oslo_messaging_qpid/qpid_username':          value => $qpid_username;
+    'oslo_messaging_qpid/qpid_password':
       value => $qpid_password,
       secret => true;
-    'DEFAULT/qpid_sasl_mechanisms': value => $qpid_sasl_mechanisms;
-    'DEFAULT/qpid_heartbeat': value => $qpid_heartbeat;
-    'DEFAULT/qpid_protocol': value => $qpid_protocol;
-    'DEFAULT/qpid_tcp_nodelay': value => $qpid_tcp_nodelay;
-    'DEFAULT/qpid_receiver_capacity': value => $qpid_receiver_capacity;
-    'DEFAULT/qpid_topology_version': value => $qpid_topology_version;
-    'DEFAULT/notification_topics': value => $notification_topics;
-    'DEFAULT/control_exchange': value => $control_exchange;
+    'oslo_messaging_qpid/qpid_sasl_mechanisms':   value => $qpid_sasl_mechanisms;
+    'oslo_messaging_qpid/qpid_heartbeat':         value => $qpid_heartbeat;
+    'oslo_messaging_qpid/qpid_protocol':          value => $qpid_protocol;
+    'oslo_messaging_qpid/qpid_tcp_nodelay':       value => $qpid_tcp_nodelay;
+    'oslo_messaging_qpid/qpid_receiver_capacity': value => $qpid_receiver_capacity;
+    'oslo_messaging_qpid/qpid_topology_version':  value => $qpid_topology_version;
+    'DEFAULT/notification_topics':                value => $notification_topics;
+    'DEFAULT/control_exchange':                   value => $control_exchange;
   }
 }
diff --git a/sahara/manifests/notify/rabbitmq.pp b/sahara/manifests/notify/rabbitmq.pp
index 387637474..2b5610647 100644
--- a/sahara/manifests/notify/rabbitmq.pp
+++ b/sahara/manifests/notify/rabbitmq.pp
@@ -104,6 +104,7 @@
   $kombu_ssl_ca_certs    = undef,
   $kombu_reconnect_delay = '1.0',
 ) {
+
   if $rabbit_use_ssl {
 
     if $kombu_ssl_ca_certs {
@@ -125,9 +126,9 @@
     }
 
     if $kombu_ssl_version {
-      sahara_config { 'oslo_messaging_rabbit/kombu_ssl_version':  value => $kombu_ssl_version; }
+      sahara_config { 'oslo_messaging_rabbit/kombu_ssl_version': value => $kombu_ssl_version; }
     } else {
-      sahara_config { 'oslo_messaging_rabbit/kombu_ssl_version':  ensure => absent; }
+      sahara_config { 'oslo_messaging_rabbit/kombu_ssl_version': ensure => absent; }
     }
 
   } else {
@@ -154,20 +155,20 @@
   }
 
   sahara_config {
-    'oslo_messaging_rabbit/rpc_backend': value => 'rabbit';
-    'DEFAULT/amqp_durable_queues': value => $durable_queues;
-    'oslo_messaging_rabbit/rabbit_use_ssl': value => $rabbit_use_ssl;
-    'oslo_messaging_rabbit/rabbit_userid': value => $rabbit_userid;
+    'DEFAULT/rpc_backend':                         value => 'rabbit';
+    'oslo_messaging_rabbit/amqp_durable_queues':   value => $durable_queues;
+    'oslo_messaging_rabbit/rabbit_use_ssl':        value => $rabbit_use_ssl;
+    'oslo_messaging_rabbit/rabbit_userid':         value => $rabbit_userid;
     'oslo_messaging_rabbit/rabbit_password':
       value => $rabbit_password,
       secret => true;
-    'oslo_messaging_rabbit/rabbit_login_method': value => $rabbit_login_method;
-    'oslo_messaging_rabbit/rabbit_virtual_host': value => $rabbit_virtual_host;
+    'oslo_messaging_rabbit/rabbit_login_method':   value => $rabbit_login_method;
+    'oslo_messaging_rabbit/rabbit_virtual_host':   value => $rabbit_virtual_host;
     'oslo_messaging_rabbit/rabbit_retry_interval': value => $rabbit_retry_interval;
-    'oslo_messaging_rabbit/rabbit_retry_backoff': value => $rabbit_retry_backoff;
-    'oslo_messaging_rabbit/rabbit_max_retries': value => $rabbit_max_retries;
-    'DEFAULT/notification_topics': value => $notification_topics;
-    'DEFAULT/control_exchange': value => $control_exchange;
+    'oslo_messaging_rabbit/rabbit_retry_backoff':  value => $rabbit_retry_backoff;
+    'oslo_messaging_rabbit/rabbit_max_retries':    value => $rabbit_max_retries;
+    'DEFAULT/notification_topics':                 value => $notification_topics;
+    'DEFAULT/control_exchange':                    value => $control_exchange;
     'oslo_messaging_rabbit/kombu_reconnect_delay': value => $kombu_reconnect_delay;
   }
 }
diff --git a/sahara/manifests/notify/zeromq.pp b/sahara/manifests/notify/zeromq.pp
index d65441bcf..638ceaf47 100644
--- a/sahara/manifests/notify/zeromq.pp
+++ b/sahara/manifests/notify/zeromq.pp
@@ -32,11 +32,13 @@
 #   (Optional) TTL for zeromq messages.
 #   Defaults to 30.
 #
+# == DEPRECATED PARAMETERS
+#
 #  [*kombu_ssl_version*]
 #    (optional) SSL version to use (valid only if SSL enabled).
 #    Valid values are TLSv1, SSLv23 and SSLv3. SSLv2 may be
 #    available on some distributions.
-#    Defaults to 'TLSv1'
+#    Defaults to undef
 #
 # [*kombu_ssl_keyfile*]
 #   (Optional) SSL key file (valid only if SSL enabled).
@@ -52,7 +54,7 @@
 #
 # [*kombu_reconnect_delay*]
 #   (Optional) Backoff on cancel notification (valid only if SSL enabled).
-#   Defaults to '1.0'; floating-point value.
+#   Defaults to undef
 #
 class sahara::notify::zeromq(
   $zeromq_bind_address    = '*',
@@ -62,47 +64,42 @@
   $zeromq_ipc_dir         = '/var/run/openstack',
   $zeromq_host            = 'sahara',
   $cast_timeout           = 30,
-  $kombu_ssl_version      = 'TLSv1',
+  # DEPRECATED PARAMETERS
+  $kombu_ssl_version      = undef,
   $kombu_ssl_keyfile      = undef,
   $kombu_ssl_certfile     = undef,
   $kombu_ssl_ca_certs     = undef,
-  $kombu_reconnect_delay  = '1.0',
+  $kombu_reconnect_delay  = undef,
 ) {
-  if $kombu_ssl_keyfile or $kombu_ssl_certfile or $kombu_ssl_ca_certs {
-    if !$kombu_ssl_keyfile {
-      fail('kombu_ssl_keyfile must be set when using SSL in zeromq')
-    }
-    if !$kombu_ssl_certfile {
-      fail('kombu_ssl_certfile must be set when using SSL in zeromq')
-    }
-    if !$kombu_ssl_ca_certs {
-      fail('kombu_ca_certs must be set when using SSL in zeromq')
-    }
-    sahara_config {
-      'DEFAULT/kombu_ssl_version': value => $kombu_ssl_version;
-      'DEFAULT/kombu_ssl_keyfile': value => $kombu_ssl_keyfile;
-      'DEFAULT/kombu_ssl_certfile': value => $kombu_ssl_certfile;
-      'DEFAULT/kombu_ssl_ca_certs': value => $kombu_ssl_ca_certs;
-      'DEFAULT/kombu_reconnect_delay': value => $kombu_reconnect_delay;
-    }
-  } else {
-    sahara_config {
-      'DEFAULT/kombu_ssl_version': ensure => absent;
-      'DEFAULT/kombu_ssl_keyfile': ensure => absent;
-      'DEFAULT/kombu_ssl_certfile': ensure => absent;
-      'DEFAULT/kombu_ssl_ca_certs': ensure => absent;
-      'DEFAULT/kombu_reconnect_delay': ensure => absent;
-    }
+
+  if $kombu_ssl_version {
+    warning('The kombu_ssl_version parameter is deprecated and has no effect.')
+  }
+
+  if $kombu_ssl_keyfile {
+    warning('The kombu_ssl_keyfile parameter is deprecated and has no effect.')
+  }
+
+  if $kombu_ssl_certfile {
+    warning('The kombu_ssl_certfile is deprecated and has no effect.')
+  }
+
+  if $kombu_ssl_ca_certs {
+    warning('The kombu_ssl_ca_certs is deprecated and has no effect.')
+  }
+
+  if $kombu_reconnect_delay {
+    warning('The kombu_reconnect_delay is deprecated and has no effect.')
   }
 
   sahara_config {
-    'DEFAULT/rpc_backend': value => 'zmq';
-    'DEFAULT/rpc_zmq_bind_address': value => $zeromq_bind_address;
-    'DEFAULT/rpc_zmq_port': value => $zeromq_port;
-    'DEFAULT/rpc_zmq_contexts': value => $zeromq_contexts;
+    'DEFAULT/rpc_backend':           value => 'zmq';
+    'DEFAULT/rpc_zmq_bind_address':  value => $zeromq_bind_address;
+    'DEFAULT/rpc_zmq_port':          value => $zeromq_port;
+    'DEFAULT/rpc_zmq_contexts':      value => $zeromq_contexts;
     'DEFAULT/rpc_zmq_topic_backlog': value => $zeromq_topic_backlog;
-    'DEFAULT/rpc_zmq_ipc_dir': value => $zeromq_ipc_dir;
-    'DEFAULT/rpc_zmq_host': value => $zeromq_host;
-    'DEFAULT/rpc_cast_timeout': value => $cast_timeout;
+    'DEFAULT/rpc_zmq_ipc_dir':       value => $zeromq_ipc_dir;
+    'DEFAULT/rpc_zmq_host':          value => $zeromq_host;
+    'DEFAULT/rpc_cast_timeout':      value => $cast_timeout;
   }
 }
diff --git a/sahara/metadata.json b/sahara/metadata.json
index bc78a7631..ae1144d90 100644
--- a/sahara/metadata.json
+++ b/sahara/metadata.json
@@ -1,10 +1,10 @@
 {
-  "name": "stackforge-sahara",
-  "version": "5.0.0",
-  "author": "Red Hat and StackForge Contributors",
+  "name": "openstack-sahara",
+  "version": "6.0.0",
+  "author": "Red Hat and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Sahara",
   "license": "Apache-2.0",
-  "source": "git://github.com/stackforge/puppet-sahara.git",
+  "source": "git://github.com/openstack/puppet-sahara.git",
   "project_page": "https://launchpad.net/puppet-sahara",
   "issues_url": "https://bugs.launchpad.net/puppet-sahara",
   "requirements": [
@@ -28,10 +28,10 @@
   "description": "Installs and configures OpenStack Sahara (Data Processing).",
   "dependencies": [
     { "name": "duritong/sysctl", "version_requirement": ">=0.0.1 <1.0.0" },
-    { "name": "stackforge/keystone", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/keystone", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
     { "name": "puppetlabs/postgresql", "version_requirement": ">=3.0.0" },
-    { "name": "stackforge/openstacklib", "version_requirement": ">=5.0.0" }
+    { "name": "openstack/openstacklib", "version_requirement": ">=6.0.0 <7.0.0" }
   ]
 }
diff --git a/sahara/spec/acceptance/basic_sahara_spec.rb b/sahara/spec/acceptance/basic_sahara_spec.rb
index 180f34954..d5a8d5e76 100644
--- a/sahara/spec/acceptance/basic_sahara_spec.rb
+++ b/sahara/spec/acceptance/basic_sahara_spec.rb
@@ -80,7 +80,7 @@ class { '::keystone::endpoint':
       # Sahara resources
       class { '::sahara':
         database_connection => 'mysql://sahara:a_big_secret@127.0.0.1/sahara?charset=utf8',
-        keystone_password   => 'a_big_secret',
+        admin_password      => 'a_big_secret',
       }
       class { '::sahara::db::mysql':
         password => 'a_big_secret',
diff --git a/sahara/spec/classes/sahara_init_spec.rb b/sahara/spec/classes/sahara_init_spec.rb
index 7cb52c1c0..87c870f71 100644
--- a/sahara/spec/classes/sahara_init_spec.rb
+++ b/sahara/spec/classes/sahara_init_spec.rb
@@ -7,7 +7,7 @@
 
   let :params do
     {
-      :keystone_password => 'secrete'
+      :admin_password => 'secrete'
     }
   end
 
@@ -18,6 +18,64 @@
     it { is_expected.to contain_exec('sahara-dbmanage') }
   end
 
+  shared_examples_for 'sahara config' do
+    context 'with default params' do
+      it { is_expected.to contain_sahara_config('DEFAULT/use_neutron').with_value('false') }
+      it { is_expected.to contain_sahara_config('DEFAULT/use_floating_ips').with_value('true') }
+      it { is_expected.to contain_sahara_config('DEFAULT/host').with_value('0.0.0.0') }
+      it { is_expected.to contain_sahara_config('DEFAULT/port').with_value('8386') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/auth_uri').with_value('http://127.0.0.1:5000/v2.0/') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/identity_uri').with_value('http://127.0.0.1:35357/') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/admin_user').with_value('admin') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/admin_tenant_name').with_value('admin') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/admin_password').with_value('secrete').with_secret(true) }
+    end
+
+    context 'with passing params' do
+      let :params do {
+        :use_neutron       => 'true',
+        :host              => 'localhost',
+        :port              => '8387',
+        :auth_uri          => 'http://8.8.8.8:5000/v2.0/',
+        :identity_uri      => 'http://8.8.8.8:35357/',
+        :admin_user        => 'sahara',
+        :admin_tenant_name => 'sahara-tenant',
+        :admin_password    => 'new_password',
+      }
+      end
+
+      it { is_expected.to contain_sahara_config('DEFAULT/use_neutron').with_value('true') }
+      it { is_expected.to contain_sahara_config('DEFAULT/host').with_value('localhost') }
+      it { is_expected.to contain_sahara_config('DEFAULT/port').with_value('8387') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/auth_uri').with_value('http://8.8.8.8:5000/v2.0/') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/identity_uri').with_value('http://8.8.8.8:35357/') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/admin_user').with_value('sahara') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/admin_tenant_name').with_value('sahara-tenant') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/admin_password').with_value('new_password').with_secret(true) }
+    end
+
+    context 'with deprecated params' do
+      let :params do {
+        :service_host      => 'localhost',
+        :service_port      => '8387',
+        :keystone_url      => 'http://8.8.8.8:5000/v2.0/',
+        :identity_url      => 'http://8.8.8.8:35357/',
+        :keystone_username => 'sahara',
+        :keystone_tenant   => 'sahara-tenant',
+        :keystone_password => 'new_password',
+      }
+      end
+
+      it { is_expected.to contain_sahara_config('DEFAULT/host').with_value('localhost') }
+      it { is_expected.to contain_sahara_config('DEFAULT/port').with_value('8387') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/auth_uri').with_value('http://8.8.8.8:5000/v2.0/') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/identity_uri').with_value('http://8.8.8.8:35357/') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/admin_user').with_value('sahara') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/admin_tenant_name').with_value('sahara-tenant') }
+      it { is_expected.to contain_sahara_config('keystone_authtoken/admin_password').with_value('new_password').with_secret(true) }
+    end
+  end
+
   shared_examples_for 'sahara logging' do
     context 'with syslog disabled' do
       it { is_expected.to contain_sahara_config('DEFAULT/use_syslog').with_value(false) }
@@ -62,6 +120,7 @@
     end
 
     it_configures 'sahara'
+    it_configures 'sahara config'
     it_configures 'sahara logging'
 
     it_behaves_like 'generic sahara service', {
@@ -76,6 +135,7 @@
     end
 
     it_configures 'sahara'
+    it_configures 'sahara config'
     it_configures 'sahara logging'
 
     it_behaves_like 'generic sahara service', {
diff --git a/sahara/spec/classes/sahara_notify_qpid_spec.rb b/sahara/spec/classes/sahara_notify_qpid_spec.rb
index fa645beef..3cb51fcb0 100644
--- a/sahara/spec/classes/sahara_notify_qpid_spec.rb
+++ b/sahara/spec/classes/sahara_notify_qpid_spec.rb
@@ -11,12 +11,12 @@
       {:qpid_password => 'pass'}
     end
 
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_username').with_value('guest') }
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_password').with_value('pass') }
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_password').with_value(params[:qpid_password]).with_secret(true) }
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_hostname').with_value('localhost') }
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_port').with_value('5672') }
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_protocol').with_value('tcp') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_username').with_value('guest') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_password').with_value('pass') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_password').with_value(params[:qpid_password]).with_secret(true) }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_hostname').with_value('localhost') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_port').with_value('5672') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_protocol').with_value('tcp') }
   end
 
   describe 'when passing params' do
@@ -28,10 +28,10 @@
         :qpid_port     => '5673'
       }
     end
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_username').with_value('guest2') }
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_hostname').with_value('localhost2') }
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_port').with_value('5673') }
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_protocol').with_value('tcp') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_username').with_value('guest2') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_hostname').with_value('localhost2') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_port').with_value('5673') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_protocol').with_value('tcp') }
   end
 
   describe 'when configuring with ssl' do
@@ -42,17 +42,11 @@
         :qpid_hostname => 'localhost3',
         :qpid_port     => '5671',
         :qpid_protocol => 'ssl',
-        :kombu_ssl_keyfile => '/srv/sahara_ssl.key',
-        :kombu_ssl_certfile => '/srv/sahara_ssl.crt',
-        :kombu_ssl_ca_certs => '/srv/cacert',
       }
     end
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_username').with_value('guest3') }
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_hostname').with_value('localhost3') }
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_port').with_value('5671') }
-    it { is_expected.to contain_sahara_config('DEFAULT/qpid_protocol').with_value('ssl') }
-    it { is_expected.to contain_sahara_config('DEFAULT/kombu_ssl_keyfile').with_value('/srv/sahara_ssl.key') }
-    it { is_expected.to contain_sahara_config('DEFAULT/kombu_ssl_certfile').with_value('/srv/sahara_ssl.crt') }
-    it { is_expected.to contain_sahara_config('DEFAULT/kombu_ssl_ca_certs').with_value('/srv/cacert') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_username').with_value('guest3') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_hostname').with_value('localhost3') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_port').with_value('5671') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_qpid/qpid_protocol').with_value('ssl') }
   end
 end
diff --git a/sahara/spec/classes/sahara_notify_rabbitmq_spec.rb b/sahara/spec/classes/sahara_notify_rabbitmq_spec.rb
index 66f6abd66..acf1c31ee 100644
--- a/sahara/spec/classes/sahara_notify_rabbitmq_spec.rb
+++ b/sahara/spec/classes/sahara_notify_rabbitmq_spec.rb
@@ -17,7 +17,7 @@
     it { is_expected.to contain_sahara_config('oslo_messaging_rabbit/rabbit_port').with_value('5672') }
     it { is_expected.to contain_sahara_config('oslo_messaging_rabbit/rabbit_hosts').with_value('localhost:5672') }
     it { is_expected.to contain_sahara_config('oslo_messaging_rabbit/rabbit_ha_queues').with_value('false') }
-    it { is_expected.to contain_sahara_config('DEFAULT/amqp_durable_queues').with_value('false') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_rabbit/amqp_durable_queues').with_value('false') }
     it { is_expected.to contain_sahara_config('oslo_messaging_rabbit/rabbit_virtual_host').with_value('/') }
     it { is_expected.to contain_sahara_config('DEFAULT/control_exchange').with_value('openstack') }
     it { is_expected.to contain_sahara_config('DEFAULT/notification_topics').with_value('notifications') }
@@ -101,7 +101,7 @@
     it { is_expected.to contain_sahara_config('oslo_messaging_rabbit/rabbit_host').with_value('localhost2') }
     it { is_expected.to contain_sahara_config('oslo_messaging_rabbit/rabbit_port').with_value('5673') }
     it { is_expected.to contain_sahara_config('oslo_messaging_rabbit/rabbit_hosts').with_value('localhost2:5673') }
-    it { is_expected.to contain_sahara_config('DEFAULT/amqp_durable_queues').with_value('true') }
+    it { is_expected.to contain_sahara_config('oslo_messaging_rabbit/amqp_durable_queues').with_value('true') }
   end
 
   describe 'when passing params for multiple rabbit hosts' do
@@ -120,13 +120,4 @@
     it { is_expected.to_not contain_sahara_config('oslo_messaging_rabbit/rabbit_host') }
   end
 
-  describe 'when using deprecated params' do
-    let :params do
-      {
-        :durable_queues  => true,
-        :rabbit_password        => 'pass'
-      }
-    end
-    it { is_expected.to contain_sahara_config('DEFAULT/amqp_durable_queues').with_value('true') }
-  end
 end
diff --git a/sahara/spec/spec_helper_acceptance.rb b/sahara/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/sahara/spec/spec_helper_acceptance.rb
+++ b/sahara/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/swift/CHANGELOG.md b/swift/CHANGELOG.md
index 96f997976..5feeae935 100644
--- a/swift/CHANGELOG.md
+++ b/swift/CHANGELOG.md
@@ -1,3 +1,37 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+This is a backwards-incompatible major release for OpenStack Kilo.
+
+####Backwards-incompatible changes
+- Remove deprecated class (swift::proxy::proxy-logging)
+- Use keystonemiddleware instead of client
+- Removal of SSH Components
+
+####Features
+- Puppet 4.x support
+- Allow setting reseller_prefix for keystone filter
+- Add manage_service feature
+- Refactorise Keystone resources management
+- Add seed parameter to ringbuilder::rebalance
+- Add support for identity_uri
+- Provide a mean to change the default rsync chmod
+- Add ability to override service name for service catalog
+- Add node_timeout parameter for proxy-server.conf
+- Full ipv6 support
+- Tag all Swift packages
+- Notify services if swift.conf is modified
+- Add rsyslog logging support to object-server
+- Handle both string and array for memcache param
+- Introduce public_url(_s3), internal_url(_s3) and admin_url(_s3)
+- Add max_header_size field for PKI tokens
+
+####Bugfixes
+- Fix swift::proxy::ceilometer
+
+####Maintenance
+- Acceptance tests with Beaker
+
 ##2015-06-17 - 5.1.0
 ###Summary
 
diff --git a/swift/README.md b/swift/README.md
index 54993526e..7c561912c 100644
--- a/swift/README.md
+++ b/swift/README.md
@@ -1,41 +1,41 @@
-swift
-=======
+OpenStack Puppet Modules
+========================
 
-5.1.0 - 2014.2 - Juno
+6.0.0 - 2015.1 - Kilo
 
-#### Table of Contents
+[Puppet](http://puppetlabs.com/puppet/puppet-open-source) modules shared between
+[Packstack](https://github.com/stackforge/packstack) and [Foreman](http://theforeman.org/).
 
-1. [Overview - What is the swift module?](#overview)
-2. [Module Description - What does the module do?](#module-description)
-3. [Setup - The basics of getting started with swift](#setup)
-4. [Reference - The classes, defines,functions and facts available in this module](#reference)
-5. [Implementation - An under-the-hood peek at what the module is doing](#implementation)
-6. [Limitations - OS compatibility, etc.](#limitations)
-7. [Development - Guide for contributing to the module](#development)
-8. [Contributors - Those with commits](#contributors)
+How to add a new Puppet module
+------------------------------
 
-Overview
---------
+First you have to install [bade](https://github.com/paramite/bade), a utility
+for managing Puppet modules using GIT subtrees.
 
-The swift module is a part of [OpenStack](https://github.com/openstack), an effort by the Openstack infrastructure team to provide continuous integration testing and code review for Openstack and Openstack community projects as part of the core software.  The module itself is used to flexibly configure and manage the object storage service for Openstack.
+    git clone https://github.com/paramite/bade
+    cd bade
+    python setup.py develop
 
-Module Description
-------------------
+Then create a [fork of the OpenStack Puppet Modules repository](https://help.github.com/articles/fork-a-repo/)
+and [create a local clone of it](https://help.github.com/articles/fork-a-repo/#step-2-create-a-local-clone-of-your-fork).
 
-The swift module is a thorough attempt to make Puppet capable of managing the entirety of swift.  This includes manifests to provision such things as keystone, storage backends, proxies, and the ring.  Types are shipped as part of the swift module to assist in manipulation of configuration files.  The classes in this module will deploy Swift using best practices for a typical deployment.
+    git clone git@github.com:YOUR_USERNAME/openstack-puppet-modules.git
+    cd openstack-puppet-modules
 
-This module is tested in combination with other modules needed to build and leverage an entire Openstack software stack.  These modules can be found, all pulled together in the [openstack module](https://github.com/stackforge/puppet-openstack).  In addition, this module requires Puppet's [exported resources](http://docs.puppetlabs.com/puppet/3/reference/lang_exported.html).
+Now create a new [branch](http://git-scm.com/book/en/v2/Git-Branching-Basic-Branching-and-Merging) in your local clone.
 
-Setup
------
+    git checkout -b NAME_OF_THE_MODULE
+
+Afterwards add the new Puppet module, `puppet-module-collectd` in this example.
 
-**What the swift module affects**
+    bade add --upstream https://github.com/pdxcat/puppet-module-collectd.git --hash cf79540be4623eb9da287f6d579ec4a4f4ddc39b --commit
 
-* swift, the object storage service for Openstack.
+Finally add some more details (e.g. why you want to add this Puppet module)
+to the commit message, push the branch and [initiate a pull request](https://help.github.com/articles/using-pull-requests/#initiating-the-pull-request).
 
 ### Installing swift
 
-    example% puppet module install puppetlabs/swift
+    puppet module install openstack/swift
 
 ### Beginning with swift
 
@@ -214,6 +214,15 @@ The byte size that dd uses when it creates the file system.
 ####`seek`
 The size of the file system that will be created.  Defaults to 25000.
 
+### Class: swift::objectexpirer
+Class that will set Swift object expirer, for scheduled deletion of objects.
+
+```puppet
+class { 'swift::objectexpirer': }
+```
+
+It is assumed that the object expirer service will usually be installed in a proxy node. On Red Hat-based distributions, if the class is included in a non-proxy node, the openstack-swift-proxy package will need to be installed.
+
 ### Verifying installation
 
 This modules ships with a simple Ruby script that validates whether or not your swift cluster is functional.
diff --git a/swift/lib/puppet/provider/swift_object_expirer_config/ini_setting.rb b/swift/lib/puppet/provider/swift_object_expirer_config/ini_setting.rb
new file mode 100644
index 000000000..6dadad309
--- /dev/null
+++ b/swift/lib/puppet/provider/swift_object_expirer_config/ini_setting.rb
@@ -0,0 +1,27 @@
+Puppet::Type.type(:swift_object_expirer_config).provide(
+  :ini_setting,
+  :parent => Puppet::Type.type(:ini_setting).provider(:ruby)
+) do
+
+  def section
+    resource[:name].split('/', 2).first
+  end
+
+  def setting
+    resource[:name].split('/', 2).last
+  end
+
+  def separator
+    '='
+  end
+
+  def self.file_path
+    '/etc/swift/object-expirer.conf'
+  end
+
+  # added for backwards compatibility with older versions of inifile
+  def file_path
+    self.class.file_path
+  end
+
+end
diff --git a/swift/lib/puppet/type/swift_object_expirer_config.rb b/swift/lib/puppet/type/swift_object_expirer_config.rb
new file mode 100644
index 000000000..7877cb81f
--- /dev/null
+++ b/swift/lib/puppet/type/swift_object_expirer_config.rb
@@ -0,0 +1,52 @@
+Puppet::Type.newtype(:swift_object_expirer_config) do
+
+  ensurable
+
+  newparam(:name, :namevar => true) do
+    desc 'Section/setting name to manage from /etc/swift/object-expirer.conf'
+    newvalues(/\S+\/\S+/)
+  end
+
+  newproperty(:value) do
+    desc 'The value of the setting to be defined.'
+    munge do |value|
+      value = value.to_s.strip
+      value.capitalize! if value =~ /^(true|false)$/i
+      value
+    end
+
+    def is_to_s( currentvalue )
+      if resource.secret?
+        return '[old secret redacted]'
+      else
+        return currentvalue
+      end
+    end
+
+    def should_to_s( newvalue )
+      if resource.secret?
+        return '[new secret redacted]'
+      else
+        return newvalue
+      end
+    end
+  end
+
+  newparam(:secret, :boolean => true) do
+    desc 'Whether to hide the value from Puppet logs. Defaults to `false`.'
+    newvalues(:true, :false)
+    defaultto false
+  end
+
+  # Require the package providing object-expirer to be present
+  if Facter['osfamily'].value == 'Debian'
+    autorequire(:package) do
+      'swift-object-expirer'
+    end
+  elsif Facter['osfamily'].value == 'RedHat'
+    autorequire(:package) do
+      'openstack-swift-proxy'
+    end
+  end
+
+end
diff --git a/swift/manifests/init.pp b/swift/manifests/init.pp
index 7416c58a5..81a0f88c6 100644
--- a/swift/manifests/init.pp
+++ b/swift/manifests/init.pp
@@ -56,7 +56,8 @@
     mode   => '2770',
   }
   user {'swift':
-    ensure => present,
+    ensure  => present,
+    require => Package['swift'],
   }
   file { '/var/lib/swift':
     ensure => directory,
diff --git a/swift/manifests/objectexpirer.pp b/swift/manifests/objectexpirer.pp
new file mode 100644
index 000000000..0e2bde7fb
--- /dev/null
+++ b/swift/manifests/objectexpirer.pp
@@ -0,0 +1,120 @@
+# Class swift::objectexpirer
+#
+# == Parameters
+#  [*enabled*]
+#    (optional) Should the service be enabled.
+#    Defaults to true
+#
+#  [*manage_service*]
+#    (optional) Whether the service should be managed by Puppet.
+#    Defaults to true.
+#
+#  [*package_ensure*]
+#    (optional) Value of package resource parameter 'ensure'.
+#    Defaults to 'present'.
+#
+#  [*pipeline*]
+#    (optional) The list of elements of the object expirer pipeline.
+#    Defaults to ['catch_errors', 'cache', 'proxy-server']
+#
+#  [*auto_create_account_prefix*]
+#    (optional) Prefix to use when automatically creating accounts.
+#    Defaults to '.'.
+#
+#  [*concurrency*]
+#    (optional) Number of replication workers to spawn.
+#    Defaults to 1.
+#
+#  [*expiring_objects_account_name*]
+#    (optional) Account name used for expiring objects.
+#    Defaults to 'expiring_objects'.
+#
+#  [*interval*]
+#    (optional) Minimum time for a pass to take.
+#    Defaults to 300.
+#
+#  [*process*]
+#    (optional) Which part of the work defined by $processes
+#    will this instance take.
+#    Defaults to 0.
+#
+#  [*processes*]
+#    (optional) How many parts to divide the work into, one part per
+#    process. 0 means a single process will do all work.
+#    Defaults to 0.
+#
+#  [*reclaim_age*]
+#    (optional) Time elapsed in seconds before an object can be
+#    reclaimed.
+#    Defaults to 604800 (1 week).
+#
+#  [*recon_cache_path*]
+#    (optional) Directory where stats for a few items will be stored.
+#    Defaults to '/var/cache/swift'.
+#
+#  [*report_interval*]
+#    (optional) Report interval
+#    Defaults to 300.
+#
+
+class swift::objectexpirer(
+  $manage_service                = true,
+  $enabled                       = true,
+  $package_ensure                = 'present',
+  $pipeline                      = ['catch_errors', 'cache', 'proxy-server'],
+  $auto_create_account_prefix    = '.',
+  $concurrency                   = 1,
+  $expiring_objects_account_name = 'expiring_objects',
+  $interval                      = 300,
+  $process                       = 0,
+  $processes                     = 0,
+  $reclaim_age                   = 604800,
+  $recon_cache_path              = '/var/cache/swift',
+  $report_interval               = 300,
+) {
+
+  include ::swift::params
+
+  Swift_config<| |> ~> Service['swift-object-expirer']
+  Swift_object_expirer_config<||> ~> Service['swift-object-expirer']
+
+  # On Red Hat platforms, it may be defined already,
+  # because it is part of openstack-swift-proxy
+  if $::swift::params::object_expirer_package_name != $::swift::params::proxy_package_name {
+    package { 'swift-object-expirer':
+      ensure => $package_ensure,
+      name   => $::swift::params::object_expirer_package_name,
+      tag    => ['openstack', 'swift-package'],
+    }
+  }
+
+  swift_object_expirer_config {
+    'pipeline:main/pipeline':                       value => join($pipeline, ' ');
+    'object-expirer/auto_create_account_prefix':    value => $auto_create_account_prefix;
+    'object-expirer/concurrency':                   value => $concurrency;
+    'object-expirer/expiring_objects_account_name': value => $expiring_objects_account_name;
+    'object-expirer/interval':                      value => $interval;
+    'object-expirer/process':                       value => $process;
+    'object-expirer/processes':                     value => $processes;
+    'object-expirer/reclaim_age':                   value => $reclaim_age;
+    'object-expirer/recon_cache_path':              value => $recon_cache_path;
+    'object-expirer/report_interval':               value => $report_interval;
+  }
+
+  if $manage_service {
+    if $enabled {
+      $service_ensure = 'running'
+    } else {
+      $service_ensure = 'stopped'
+    }
+  }
+
+  service { 'swift-object-expirer':
+    ensure   => $service_ensure,
+    name     => $::swift::params::object_expirer_service_name,
+    enable   => $enabled,
+    provider => $::swift::params::service_provider,
+    tag      => 'swift-service',
+  }
+}
+
diff --git a/swift/manifests/params.pp b/swift/manifests/params.pp
index feaa197da..a4aa65d89 100644
--- a/swift/manifests/params.pp
+++ b/swift/manifests/params.pp
@@ -12,6 +12,8 @@
       $object_auditor_service_name       = 'swift-object-auditor'
       $object_replicator_service_name    = 'swift-object-replicator'
       $object_updater_service_name       = 'swift-object-updater'
+      $object_expirer_package_name       = 'swift-object-expirer'
+      $object_expirer_service_name       = 'swift-object-expirer'
       $container_package_name            = 'swift-container'
       $container_service_name            = 'swift-container'
       $container_auditor_service_name    = 'swift-container-auditor'
@@ -39,6 +41,8 @@
       $object_auditor_service_name       = 'openstack-swift-object-auditor'
       $object_replicator_service_name    = 'openstack-swift-object-replicator'
       $object_updater_service_name       = 'openstack-swift-object-updater'
+      $object_expirer_package_name       = 'openstack-swift-proxy'
+      $object_expirer_service_name       = 'openstack-swift-object-expirer'
       $container_package_name            = 'openstack-swift-container'
       $container_service_name            = 'openstack-swift-container'
       $container_auditor_service_name    = 'openstack-swift-container-auditor'
diff --git a/swift/metadata.json b/swift/metadata.json
index 037d324d5..931aa1fc0 100644
--- a/swift/metadata.json
+++ b/swift/metadata.json
@@ -1,6 +1,6 @@
 {
-  "name": "stackforge-swift",
-  "version": "5.1.0",
+  "name": "openstack-swift",
+  "version": "6.0.0",
   "author": "Puppet Labs and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Swift",
   "license": "Apache-2.0",
@@ -32,7 +32,7 @@
   "description": "Installs and configures OpenStack Swift (Object Storage).",
   "dependencies": [
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
-    { "name": "stackforge/keystone", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/keystone", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/rsync", "version_requirement": ">=0.2.0 <1.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
     { "name": "puppetlabs/xinetd", "version_requirement": ">=1.0.1 <2.0.0" },
diff --git a/swift/spec/acceptance/basic_swift_spec.rb b/swift/spec/acceptance/basic_swift_spec.rb
index ff6325b07..54cd2224f 100644
--- a/swift/spec/acceptance/basic_swift_spec.rb
+++ b/swift/spec/acceptance/basic_swift_spec.rb
@@ -98,6 +98,9 @@ class { '::swift::proxy':
       class { '::swift::proxy::authtoken':
         admin_password => 'a_big_secret',
       }
+      class {'::swift::objectexpirer':
+        interval => 600,
+      }
       class { ['::swift::proxy::healthcheck', '::swift::proxy::cache', '::swift::proxy::tempauth']: }
       EOS
 
diff --git a/swift/spec/spec_helper_acceptance.rb b/swift/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/swift/spec/spec_helper_acceptance.rb
+++ b/swift/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/tempest/CHANGELOG.md b/tempest/CHANGELOG.md
index 9cfa27941..42b7891f2 100644
--- a/tempest/CHANGELOG.md
+++ b/tempest/CHANGELOG.md
@@ -1,3 +1,17 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+This is a major release for OpenStack Kilo.
+
+####Features
+- Puppet 4.x support
+- Allow to activate Ceilometer tests
+- Allow to not manage Tempest code in Puppet
+- Implement more Tempest options
+
+####Maintenance
+- Acceptance tests with Beaker
+
 ##2015-06-17 - 5.1.0
 ###Summary
 
diff --git a/tempest/README.markdown b/tempest/README.markdown
index 63b4c7795..5a082493f 100644
--- a/tempest/README.markdown
+++ b/tempest/README.markdown
@@ -1,7 +1,7 @@
 Tempest
 =======
 
-5.1.0 - 2014.2 - Juno
+6.0.0 - 2015.1 - Kilo
 
 Module for installing and configuring tempest.
 
diff --git a/tempest/manifests/config.pp b/tempest/manifests/config.pp
new file mode 100644
index 000000000..ab137b750
--- /dev/null
+++ b/tempest/manifests/config.pp
@@ -0,0 +1,30 @@
+# == Class: tempest::config
+#
+# This class is used to manage arbitrary Tempest configurations.
+#
+# === Parameters
+#
+# [*tempest_config*]
+#   (optional) Allow configuration of arbitrary Tempest configurations.
+#   The value is an hash of tempest_config resources. Example:
+#   { 'DEFAULT/foo' => { value => 'fooValue'},
+#     'DEFAULT/bar' => { value => 'barValue'}
+#   }
+#   In yaml format, Example:
+#   tempest_config:
+#     DEFAULT/foo:
+#       value: fooValue
+#     DEFAULT/bar:
+#       value: barValue
+#
+#   NOTE: The configuration MUST NOT be already handled by this module
+#   or Puppet catalog compilation will fail with duplicate resources.
+#
+class tempest::config (
+  $tempest_config        = {},
+) {
+
+  validate_hash($tempest_config)
+
+  create_resources('tempest_config', $tempest_config)
+}
diff --git a/tempest/manifests/init.pp b/tempest/manifests/init.pp
index e60520a9f..82917102d 100644
--- a/tempest/manifests/init.pp
+++ b/tempest/manifests/init.pp
@@ -32,6 +32,7 @@
   # tempest.conf parameters
   #
   $identity_uri              = undef,
+  $identity_uri_v3           = undef,
   $cli_dir                   = undef,
   $lock_path                 = '/var/lib/tempest',
   $debug                     = false,
@@ -52,6 +53,7 @@
   $admin_password            = undef,
   $admin_tenant_name         = undef,
   $admin_role                = undef,
+  $admin_domain_name         = undef,
   # image information
   $image_ref                 = undef,
   $image_ref_alt             = undef,
@@ -80,6 +82,7 @@
   $swift_available           = false,
   $keystone_v2               = true,
   $keystone_v3               = true,
+  $auth_version              = 'v2',
 ) {
 
   include '::tempest::params'
@@ -160,13 +163,16 @@
     'identity/admin_tenant_name':        value => $admin_tenant_name;
     'identity/admin_username':           value => $admin_username;
     'identity/admin_role':               value => $admin_role;
+    'identity/admin_domain_name':        value => $admin_domain_name;
     'identity/alt_password':             value => $alt_password, secret => true;
     'identity/alt_tenant_name':          value => $alt_tenant_name;
     'identity/alt_username':             value => $alt_username;
     'identity/password':                 value => $password, secret => true;
     'identity/tenant_name':              value => $tenant_name;
     'identity/uri':                      value => $identity_uri;
+    'identity/uri_v3':                   value => $identity_uri_v3;
     'identity/username':                 value => $username;
+    'identity/auth_version':             value => $auth_version;
     'identity-feature-enabled/api_v2':   value => $keystone_v2;
     'identity-feature-enabled/api_v3':   value => $keystone_v3;
     'network/public_network_id':         value => $public_network_id;
diff --git a/tempest/metadata.json b/tempest/metadata.json
index a07e05e7a..08973e2a6 100644
--- a/tempest/metadata.json
+++ b/tempest/metadata.json
@@ -1,6 +1,6 @@
 {
-  "name": "stackforge-tempest",
-  "version": "5.1.0",
+  "name": "openstack-tempest",
+  "version": "6.0.0",
   "author": "OpenStack Contributors",
   "summary": "Puppet module for OpenStack Tempest",
   "license": "Apache-2.0",
diff --git a/tempest/spec/classes/tempest_config_spec.rb b/tempest/spec/classes/tempest_config_spec.rb
new file mode 100644
index 000000000..3deeee021
--- /dev/null
+++ b/tempest/spec/classes/tempest_config_spec.rb
@@ -0,0 +1,20 @@
+require 'spec_helper'
+
+describe 'tempest::config' do
+
+  let :params do
+    { :tempest_config => {
+        'DEFAULT/foo' => { 'value'  => 'fooValue' },
+        'DEFAULT/bar' => { 'value'  => 'barValue' },
+        'DEFAULT/baz' => { 'ensure' => 'absent' }
+      }
+    }
+  end
+
+  it 'configures arbitrary tempest configurations' do
+    is_expected.to contain_tempest_config('DEFAULT/foo').with_value('fooValue')
+    is_expected.to contain_tempest_config('DEFAULT/bar').with_value('barValue')
+    is_expected.to contain_tempest_config('DEFAULT/baz').with_ensure('absent')
+  end
+
+end
diff --git a/tempest/spec/classes/tempest_spec.rb b/tempest/spec/classes/tempest_spec.rb
index 38cec0baa..eaafbd026 100644
--- a/tempest/spec/classes/tempest_spec.rb
+++ b/tempest/spec/classes/tempest_spec.rb
@@ -162,10 +162,12 @@
           is_expected.to contain_tempest_config('compute/resize_available').with(:value => nil)
           is_expected.to contain_tempest_config('compute/allow_tenant_isolation').with(:value => nil)
           is_expected.to contain_tempest_config('identity/admin_password').with(:value => nil)
+          is_expected.to contain_tempest_config('identity/admin_domain_name').with(:value => nil)
           is_expected.to contain_tempest_config('identity/admin_password').with_secret( true )
           is_expected.to contain_tempest_config('identity/admin_tenant_name').with(:value => nil)
           is_expected.to contain_tempest_config('identity/admin_username').with(:value => nil)
           is_expected.to contain_tempest_config('identity/admin_role').with(:value => nil)
+          is_expected.to contain_tempest_config('identity/auth_version').with(:value => 'v2')
           is_expected.to contain_tempest_config('identity/alt_password').with(:value => nil)
           is_expected.to contain_tempest_config('identity/alt_password').with_secret( true )
           is_expected.to contain_tempest_config('identity/alt_tenant_name').with(:value => nil)
@@ -174,6 +176,7 @@
           is_expected.to contain_tempest_config('identity/password').with_secret( true )
           is_expected.to contain_tempest_config('identity/tenant_name').with(:value => nil)
           is_expected.to contain_tempest_config('identity/uri').with(:value => nil)
+          is_expected.to contain_tempest_config('identity/uri_v3').with(:value => nil)
           is_expected.to contain_tempest_config('identity/username').with(:value => nil)
           is_expected.to contain_tempest_config('identity-feature-enabled/api_v2').with(:value => true)
           is_expected.to contain_tempest_config('identity-feature-enabled/api_v3').with(:value => true)
diff --git a/tempest/spec/spec_helper_acceptance.rb b/tempest/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/tempest/spec/spec_helper_acceptance.rb
+++ b/tempest/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/tripleo/.fixtures.yml b/tripleo/.fixtures.yml
new file mode 100644
index 000000000..e3ab8f9cd
--- /dev/null
+++ b/tripleo/.fixtures.yml
@@ -0,0 +1,6 @@
+fixtures:
+  repositories:
+    'firewall': 'git://github.com/puppetlabs/puppetlabs-firewall.git'
+    'stdlib': 'git://github.com/puppetlabs/puppetlabs-stdlib.git'
+  symlinks:
+    "tripleo": "#{source_dir}"
diff --git a/tripleo/.gitignore b/tripleo/.gitignore
index 9897b6f7e..4dd84f06e 100644
--- a/tripleo/.gitignore
+++ b/tripleo/.gitignore
@@ -1,5 +1,10 @@
-*.swp
-spec/fixtures/modules/*
-pkg
+pkg/
 Gemfile.lock
-.vagrant/*
+vendor/
+spec/fixtures/
+.vagrant/
+.bundle/
+coverage/
+.idea/
+*.swp
+*.iml
diff --git a/tripleo/.sync.yml b/tripleo/.sync.yml
new file mode 100644
index 000000000..66a03c649
--- /dev/null
+++ b/tripleo/.sync.yml
@@ -0,0 +1,3 @@
+---
+spec/spec_helper.rb:
+  unmanaged: true
diff --git a/tripleo/Gemfile b/tripleo/Gemfile
index 10b37ac52..6d4ce9a07 100644
--- a/tripleo/Gemfile
+++ b/tripleo/Gemfile
@@ -1,26 +1,30 @@
-source 'https://rubygems.org'
+source ENV['GEM_SOURCE'] || "https://rubygems.org"
 
 group :development, :test do
-  gem 'puppetlabs_spec_helper', :require => false
-  gem 'rspec-puppet', '~> 2.1.0', :require => false
-
-  gem 'metadata-json-lint'
-  gem 'puppet-lint-param-docs'
-  gem 'puppet-lint-absolute_classname-check'
-  gem 'puppet-lint-absolute_template_path'
-  gem 'puppet-lint-trailing_newline-check'
-
-  # Puppet 4.x related lint checks
-  gem 'puppet-lint-unquoted_string-check'
-  gem 'puppet-lint-leading_zero-check'
-  gem 'puppet-lint-variable_contains_upcase'
-  gem 'puppet-lint-numericvariable'
+  gem 'puppetlabs_spec_helper',               :require => 'false'
+  gem 'rspec-puppet', '~> 2.2.0',             :require => 'false'
+  gem 'metadata-json-lint',                   :require => 'false'
+  gem 'puppet-lint-param-docs',               :require => 'false'
+  gem 'puppet-lint-absolute_classname-check', :require => 'false'
+  gem 'puppet-lint-absolute_template_path',   :require => 'false'
+  gem 'puppet-lint-trailing_newline-check',   :require => 'false'
+  gem 'puppet-lint-unquoted_string-check',    :require => 'false'
+  gem 'puppet-lint-leading_zero-check',       :require => 'false'
+  gem 'puppet-lint-variable_contains_upcase', :require => 'false'
+  gem 'puppet-lint-numericvariable',          :require => 'false'
+  gem 'json',                                 :require => 'false'
+  gem 'webmock',                              :require => 'false'
+end
 
-  gem 'json'
-  gem 'webmock'
-  gem 'r10k'
-  gem 'librarian-puppet-simple', '~> 0.0.3'
+group :system_tests do
+  gem 'beaker-rspec',                 :require => 'false'
+  gem 'beaker-puppet_install_helper', :require => 'false'
+end
 
+if facterversion = ENV['FACTER_GEM_VERSION']
+  gem 'facter', facterversion, :require => false
+else
+  gem 'facter', :require => false
 end
 
 if puppetversion = ENV['PUPPET_GEM_VERSION']
diff --git a/tripleo/Rakefile b/tripleo/Rakefile
index 56dc07de3..bc08f437c 100644
--- a/tripleo/Rakefile
+++ b/tripleo/Rakefile
@@ -1,7 +1,21 @@
 require 'puppetlabs_spec_helper/rake_tasks'
 require 'puppet-lint/tasks/puppet-lint'
+require 'puppet-syntax/tasks/puppet-syntax'
 
-PuppetLint.configuration.fail_on_warnings = true
-PuppetLint.configuration.send('disable_80chars')
-PuppetLint.configuration.send('disable_class_parameter_defaults')
-PuppetLint.configuration.send('disable_class_inherits_from_params_class')
+PuppetSyntax.exclude_paths ||= []
+PuppetSyntax.exclude_paths << "spec/fixtures/**/*"
+PuppetSyntax.exclude_paths << "pkg/**/*"
+PuppetSyntax.exclude_paths << "vendor/**/*"
+
+Rake::Task[:lint].clear
+PuppetLint::RakeTask.new :lint do |config|
+  config.ignore_paths = ["spec/**/*.pp", "vendor/**/*.pp"]
+  config.fail_on_warnings = true
+  config.log_format = '%{path}:%{linenumber}:%{KIND}: %{message}'
+  config.disable_checks = ["80chars", "class_inherits_from_params_class", "class_parameter_defaults", "only_variable_string"]
+end
+
+desc "Run acceptance tests"
+RSpec::Core::RakeTask.new(:acceptance) do |t|
+  t.pattern = 'spec/acceptance'
+end
diff --git a/tripleo/lib/facter/netmask_ipv6.rb b/tripleo/lib/facter/netmask_ipv6.rb
new file mode 100644
index 000000000..526148530
--- /dev/null
+++ b/tripleo/lib/facter/netmask_ipv6.rb
@@ -0,0 +1,47 @@
+require 'ipaddr'
+
+def netmask6(value)
+  if value
+    ip = IPAddr.new('::0').mask(value)
+    ip.inspect.split('/')[1].gsub('>', '')
+  end
+end
+
+if Facter.value('facterversion')[0].to_i < 3
+  Facter::Util::IP.get_interfaces.each do |interface|
+    Facter.add('netmask6_' + Facter::Util::IP.alphafy(interface)) do
+      setcode do
+        tmp = []
+        regex = %r{inet6\s+.*\s+(?:prefixlen)\s+(\d+)}x
+        output_int = Facter::Util::IP.get_output_for_interface_and_label(interface, 'netmask6')
+
+        output_int.each_line do |line|
+          prefixlen = nil
+          matches = line.match(regex)
+          prefixlen = matches[1] if matches
+
+          if prefixlen
+            value = netmask6(prefixlen)
+            tmp.push(value)
+          end
+        end
+
+        tmp.shift if tmp
+      end
+    end
+  end
+
+  Facter.add('netmask6') do
+    setcode do
+      prefixlen = nil
+      regex = %r{#{Facter.value(:ipaddress6)}.*?(?:prefixlen)\s*(\d+)}x
+
+      String(Facter::Util::IP.exec_ifconfig(['2>/dev/null'])).split(/\n/).collect do |line|
+        matches = line.match(regex)
+        prefixlen = matches[1] if matches
+      end
+
+      netmask6(prefixlen) if prefixlen
+    end
+  end
+end
diff --git a/tripleo/lib/facter/tripleo_ipv6_interfaces.rb b/tripleo/lib/facter/tripleo_ipv6_interfaces.rb
new file mode 100644
index 000000000..75f2d5038
--- /dev/null
+++ b/tripleo/lib/facter/tripleo_ipv6_interfaces.rb
@@ -0,0 +1,46 @@
+
+require 'ipaddr'
+
+
+ipv6_regex = /inet6 ((?>[0-9,a-f,A-F]*\:{1,2})+[0-9,a-f,A-F]{0,4}\/[0-9]{1,3})/
+
+
+def get_ipv6_output(interface)
+  cmd = ['/sbin/ip', '/usr/sbin/ip'].select {
+    |path| File.executable?(path)
+  }.first
+  Facter::Core::Execution.execute(
+    "#{cmd} -6 addr show dev #{interface}"
+  )
+end
+
+
+Facter.add("tripleo_ipv6_interfaces") do
+  setcode do
+    value = {}
+    Facter::Util::IP.get_interfaces.each do |interface|
+      interface = Facter::Util::IP.alphafy(interface)
+      # skip interfaces which don't have ipv6 address
+      begin
+        ip_output = get_ipv6_output(interface)
+        if ! ipv6_regex.match ip_output
+          raise Facter::Core::Execution::ExecutionFailure
+        end
+      rescue Facter::Core::Execution::ExecutionFailure
+        next
+      end
+      value[interface] = []
+      ip_output.each_line do |line|
+        if match = ipv6_regex.match(line)
+          cidr = IPAddr.new match[1]
+          cidr_arr = cidr.inspect().split('/', 2)
+          value[interface].push({
+              'ipaddress' => cidr_arr[0].split('IPv6:', 2)[1],
+              'netmask' => cidr_arr[1].split('>', 2)[0]
+          })
+        end
+      end
+    end
+    value
+  end
+end
diff --git a/tripleo/lib/puppet/parser/functions/interface_for_ip.rb b/tripleo/lib/puppet/parser/functions/interface_for_ip.rb
index 1c6712035..fd68be0c2 100644
--- a/tripleo/lib/puppet/parser/functions/interface_for_ip.rb
+++ b/tripleo/lib/puppet/parser/functions/interface_for_ip.rb
@@ -8,25 +8,31 @@ module Puppet::Parser::Functions
   newfunction(:interface_for_ip, :type => :rvalue, :doc => "Find the bind IP address for the provided subnet.") do |arg|
     if arg[0].class == String
       begin
-        ip_to_find = arg[0]
+        ip1 = IPAddr.new(arg[0])
         Dir.foreach('/sys/class/net/') do |interface|
-          next if interface == '.' or interface == '..'
+          next if interface == '.' || interface == '..'
           iface_no_dash = interface.gsub('-', '_')
-          interface_ip = lookupvar("ipaddress_#{iface_no_dash}")
-          netmask = lookupvar("netmask_#{iface_no_dash}")
-          if not interface_ip.nil? then
-            ip1=IPAddr.new(interface_ip)
-            ip2=IPAddr.new(ip_to_find)
-            if ip1.mask(netmask) == ip2.mask(netmask) then
-              return interface
-            end
+
+          if ip1.ipv4?
+            ipaddress_name = "ipaddress_#{iface_no_dash}"
+            netmask_name   = "netmask_#{iface_no_dash}"
+          else
+            ipaddress_name = "ipaddress6_#{iface_no_dash}"
+            netmask_name   = "netmask6_#{iface_no_dash}"
+          end
+
+          interface_ip = lookupvar(ipaddress_name)
+          netmask = lookupvar(netmask_name)
+          unless interface_ip.nil? then
+            ip2 = IPAddr.new(interface_ip)
+            return interface if ip1.mask(netmask) == ip2.mask(netmask)
           end
         end
-      rescue JSON::ParserError
-        raise Puppet::ParseError, "Syntax error: #{arg[0]} is invalid"
+      rescue IPAddr::InvalidAddressError => e
+        raise Puppet::ParseError, "#{e}: #{arg[0]}"
       end
     else
-      raise Puppet::ParseError, "Syntax error: #{arg[0]} is not a String"
+      raise Puppet::ParseError, "Syntax error: #{arg[0]} must be a String"
     end
     return ''
   end
diff --git a/tripleo/lib/puppet/parser/functions/is_ipv6_address.rb b/tripleo/lib/puppet/parser/functions/is_ipv6_address.rb
new file mode 100644
index 000000000..e7c4bd471
--- /dev/null
+++ b/tripleo/lib/puppet/parser/functions/is_ipv6_address.rb
@@ -0,0 +1,25 @@
+#
+# is_ipv6_address.rb
+#
+
+require 'ipaddr'
+
+module Puppet::Parser::Functions
+  newfunction(:is_ipv6_address, :type => :rvalue,
+              :doc => ("Returns true if the string passed to this function" +
+                       "is a valid IPv6 address.")) do |arguments|
+
+    if (arguments.size != 1) then
+      raise(Puppet::ParseError, "is_ipv6_address(): Wrong number of arguments "+
+        "given #{arguments.size} for 1")
+    end
+
+    begin
+      ip = IPAddr.new(arguments[0])
+    rescue ArgumentError
+      return false
+    end
+
+    return ip.ipv6?
+  end
+end
diff --git a/tripleo/lib/puppet/provider/package_manifest/flat_file.rb b/tripleo/lib/puppet/provider/package_manifest/flat_file.rb
new file mode 100644
index 000000000..96e033be8
--- /dev/null
+++ b/tripleo/lib/puppet/provider/package_manifest/flat_file.rb
@@ -0,0 +1,39 @@
+
+require 'set'
+
+
+Puppet::Type.type(:package_manifest).provide(:flat_file) do
+
+  desc "Write package manifest to a flat file"
+
+  def exists?
+    # exists? is always run before create, so we can create package list here
+    @packages = resource.catalog.resources.collect { |r|
+        r.name if r.type == :package
+    }.compact.sort
+
+    exists = File.exist?(resource[:path])
+    if exists
+      new_content = Set.new @packages
+      old_content = Set.new(
+        File.open(resource[:path], 'r').each_line.collect{ |pkg| pkg.strip() }
+      )
+      exists = new_content == old_content
+    end
+    exists
+  end
+
+  def create
+    FileUtils.mkdir_p(File.dirname(resource[:path]))
+    File.open(resource[:path], 'w') do |f|
+      @packages.each do |pkg_name|
+        f.puts(pkg_name)
+      end
+    end
+  end
+
+  def destroy
+    File.delete(resource[:path])
+  end
+
+end
diff --git a/tripleo/lib/puppet/type/package_manifest.rb b/tripleo/lib/puppet/type/package_manifest.rb
new file mode 100644
index 000000000..9ee3270f1
--- /dev/null
+++ b/tripleo/lib/puppet/type/package_manifest.rb
@@ -0,0 +1,8 @@
+Puppet::Type.newtype(:package_manifest) do
+
+  ensurable
+  newparam(:path, :namevar => true) do
+    newvalues(/\S+\/\S+/)
+  end
+
+end
diff --git a/tripleo/manifests/firewall.pp b/tripleo/manifests/firewall.pp
new file mode 100644
index 000000000..769888106
--- /dev/null
+++ b/tripleo/manifests/firewall.pp
@@ -0,0 +1,91 @@
+#
+# Copyright (C) 2015 eNovance SAS <licensing@enovance.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo
+#
+# Configure the TripleO firewall
+#
+# === Parameters:
+#
+# [*manage_firewall*]
+#  (optional) Completely enable or disable firewall settings
+#  (false means disabled, and true means enabled)
+#  Defaults to false
+#
+# [*firewall_rules*]
+#   (optional) Allow to add custom firewall rules
+#   Should be an hash.
+#   Default to {}
+#
+# [*purge_firewall_rules*]
+#   (optional) Boolean, purge all firewall resources
+#   Defaults to false
+#
+# [*firewall_pre_extras*]
+#   (optional) Allow to add custom parameters to firewall rules (pre stage)
+#   Should be an hash.
+#   Default to {}
+#
+# [*firewall_post_extras*]
+#   (optional) Allow to add custom parameters to firewall rules (post stage)
+#   Should be an hash.
+#   Default to {}
+#
+class tripleo::firewall(
+  $manage_firewall      = false,
+  $firewall_rules       = {},
+  $purge_firewall_rules = false,
+  $firewall_pre_extras  = {},
+  $firewall_post_extras = {},
+) {
+
+  include ::stdlib
+
+  if $manage_firewall {
+
+    # Only purges IPv4 rules
+    if $purge_firewall_rules {
+      resources { 'firewall':
+        purge => true
+      }
+    }
+
+    # anyone can add your own rules
+    # example with Hiera:
+    #
+    # tripleo::firewall::rules:
+    #   '300 allow custom application 1':
+    #     port: 999
+    #     proto: udp
+    #     action: accept
+    #   '301 allow custom application 2':
+    #     port: 8081
+    #     proto: tcp
+    #     action: accept
+    #
+    create_resources('tripleo::firewall::rule', $firewall_rules)
+
+    ensure_resource('class', 'tripleo::firewall::pre', {
+      'firewall_settings' => $firewall_pre_extras,
+      'stage'             => 'setup',
+    })
+
+    ensure_resource('class', 'tripleo::firewall::post', {
+      'stage'             => 'runtime',
+      'firewall_settings' => $firewall_post_extras,
+    })
+  }
+
+}
diff --git a/tripleo/manifests/firewall/post.pp b/tripleo/manifests/firewall/post.pp
new file mode 100644
index 000000000..b76db7593
--- /dev/null
+++ b/tripleo/manifests/firewall/post.pp
@@ -0,0 +1,51 @@
+#
+# Copyright (C) 2015 eNovance SAS <licensing@enovance.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::firewall::post
+#
+# Firewall rules during 'post' Puppet stage
+#
+# === Parameters:
+#
+# [*debug*]
+#   (optional) Set log output to debug output
+#   Defaults to false
+#
+# [*firewall_settings*]
+#   (optional) Allow to add custom parameters to firewall rules
+#   Should be an hash.
+#   Default to {}
+#
+class tripleo::firewall::post(
+  $debug             = false,
+  $firewall_settings = {},
+){
+
+  if $debug {
+    warning('debug is enabled, the traffic is not blocked.')
+  } else {
+    firewall { '998 log all':
+      proto => 'all',
+      jump  => 'LOG',
+    }
+    tripleo::firewall::rule{ '999 drop all':
+      proto  => 'all',
+      action => 'drop',
+      extras => $firewall_settings,
+    }
+    notice('At this stage, all network traffic is blocked.')
+  }
+
+}
diff --git a/tripleo/manifests/firewall/pre.pp b/tripleo/manifests/firewall/pre.pp
new file mode 100644
index 000000000..2d7203a66
--- /dev/null
+++ b/tripleo/manifests/firewall/pre.pp
@@ -0,0 +1,57 @@
+#
+# Copyright (C) 2015 eNovance SAS <licensing@enovance.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: tripleo::firewall::pre
+#
+# Firewall rules during 'pre' Puppet stage
+#
+# === Parameters:
+#
+# [*firewall_settings*]
+#   (optional) Allow to add custom parameters to firewall rules
+#   Should be an hash.
+#   Default to {}
+#
+class tripleo::firewall::pre(
+  $firewall_settings = {},
+){
+
+  # ensure the correct packages are installed
+  include ::firewall
+
+  # defaults 'pre' rules
+  tripleo::firewall::rule{ '000 accept related established rules':
+    proto  => 'all',
+    state  => ['RELATED', 'ESTABLISHED'],
+    extras => $firewall_settings,
+  }
+
+  tripleo::firewall::rule{ '001 accept all icmp':
+    proto  => 'icmp',
+    extras => $firewall_settings,
+  }
+
+  tripleo::firewall::rule{ '002 accept all to lo interface':
+    proto   => 'all',
+    iniface => 'lo',
+    extras  => $firewall_settings,
+  }
+
+  tripleo::firewall::rule{ '003 accept ssh':
+    port   => '22',
+    extras => $firewall_settings,
+  }
+
+}
diff --git a/tripleo/manifests/firewall/rule.pp b/tripleo/manifests/firewall/rule.pp
new file mode 100644
index 000000000..02afbc2d9
--- /dev/null
+++ b/tripleo/manifests/firewall/rule.pp
@@ -0,0 +1,80 @@
+#
+# Copyright (C) 2015 eNovance SAS <licensing@enovance.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Define: tripleo::firewall::rule
+#
+# Define used to manage IPtables rules.
+#
+# === Parameters:
+#
+# [*port*]
+#  (optional) The port associated to the rule.
+#  Defaults to undef
+#
+# [*proto*]
+#  (optional) The protocol associated to the rule.
+#  Defaults to 'tcp'
+#
+# [*action*]
+#  (optional) The action policy associated to the rule.
+#  Defaults to 'accept'
+#
+# [*state*]
+#  (optional) Array of states associated to the rule..
+#  Defaults to ['NEW']
+#
+# [*source*]
+#  (optional) The source IP address associated to the rule.
+#  Defaults to '0.0.0.0/0'
+#
+# [*iniface*]
+#  (optional) The network interface associated to the rule.
+#  Defaults to undef
+#
+# [*chain*]
+#  (optional) The chain associated to the rule.
+#  Defaults to 'INPUT'
+#
+# [*extras*]
+#  (optional) Hash of any puppetlabs-firewall supported parameters.
+#  Defaults to {}
+#
+define tripleo::firewall::rule (
+  $port    = undef,
+  $proto   = 'tcp',
+  $action  = 'accept',
+  $state   = ['NEW'],
+  $source  = '0.0.0.0/0',
+  $iniface = undef,
+  $chain   = 'INPUT',
+  $extras  = {},
+) {
+
+  $basic = {
+    'port'    => $port,
+    'proto'   => $proto,
+    'action'  => $action,
+    'state'   => $state,
+    'source'  => $source,
+    'iniface' => $iniface,
+    'chain'   => $chain,
+  }
+
+  $rule = merge($basic, $extras)
+  validate_hash($rule)
+
+  create_resources('firewall', { "${title}" => $rule })
+
+}
diff --git a/tripleo/manifests/loadbalancer.pp b/tripleo/manifests/loadbalancer.pp
index f9877a658..09ac7a10e 100644
--- a/tripleo/manifests/loadbalancer.pp
+++ b/tripleo/manifests/loadbalancer.pp
@@ -24,12 +24,26 @@
 #  Defaults to true
 #
 # [*haproxy_service_manage*]
-#  Will be passed as value for service_manage to haproxy module.
+#  Will be passed as value for service_manage to HAProxy module.
 #  Defaults to true
 #
 # [*haproxy_global_maxconn*]
-#  The value to use as maxconn in the haproxy global config section.
-#  Defaults to 10000
+#  The value to use as maxconn in the HAProxy global config section.
+#  Defaults to 20480
+#
+# [*haproxy_default_maxconn*]
+#  The value to use as maxconn in the HAProxy default config section.
+#  Defaults to 4096
+#
+# [*haproxy_listen_bind_param*]
+#  A list of params to be added to the HAProxy listener bind directive. By
+#  default the 'transparent' param is added but it should be cleared if
+#  one of the *_virtual_ip addresses is a wildcard, eg. 0.0.0.0
+#  Defaults to [ 'transparent' ]
+#
+# [*haproxy_log_address*]
+#  The IPv4, IPv6 or filesystem socket path of the syslog server.
+#  Defaults to '/dev/log'
 #
 # [*controller_host*]
 #  (Deprecated)Host or group of hosts to load-balance the services
@@ -102,6 +116,11 @@
 #  When set, enables SSL on the Cinder public API endpoint using the specified file.
 #  Defaults to undef
 #
+# [*manila_certificate*]
+#  Filename of an HAProxy-compatible certificate and key file
+#  When set, enables SSL on the Manila public API endpoint using the specified file.
+#  Defaults to undef
+#
 # [*glance_certificate*]
 #  Filename of an HAProxy-compatible certificate and key file
 #  When set, enables SSL on the Glance public API endpoint using the specified file.
@@ -153,6 +172,10 @@
 #  (optional) Enable or not Cinder API binding
 #  Defaults to false
 #
+# [*manila*]
+#  (optional) Enable or not Manila API binding
+#  Defaults to false
+#
 # [*glance_api*]
 #  (optional) Enable or not Glance API binding
 #  Defaults to false
@@ -231,7 +254,10 @@
   $storage_mgmt_virtual_ip   = false,
   $manage_vip                = true,
   $haproxy_service_manage    = true,
-  $haproxy_global_maxconn    = 10000,
+  $haproxy_global_maxconn    = 20480,
+  $haproxy_default_maxconn   = 4096,
+  $haproxy_listen_bind_param = [ 'transparent' ],
+  $haproxy_log_address       = '/dev/log',
   $controller_host           = undef,
   $controller_hosts          = undef,
   $controller_hosts_names    = undef,
@@ -239,6 +265,7 @@
   $keystone_certificate      = undef,
   $neutron_certificate       = undef,
   $cinder_certificate        = undef,
+  $manila_certificate        = undef,
   $glance_certificate        = undef,
   $nova_certificate          = undef,
   $ceilometer_certificate    = undef,
@@ -250,6 +277,7 @@
   $keystone_public           = false,
   $neutron                   = false,
   $cinder                    = false,
+  $manila                    = false,
   $glance_api                = false,
   $glance_registry           = false,
   $nova_ec2                  = false,
@@ -380,6 +408,11 @@
   } else {
     $cinder_bind_certificate = $service_certificate
   }
+  if $manila_certificate {
+    $manila_bind_certificate = $manila_certificate
+  } else {
+    $manila_bind_certificate = $service_certificate
+  }
   if $glance_certificate {
     $glance_bind_certificate = $glance_certificate
   } else {
@@ -420,186 +453,217 @@
   $keystone_admin_api_vip = hiera('keystone_admin_api_vip', $controller_virtual_ip)
   if $keystone_bind_certificate {
     $keystone_public_bind_opts = {
-      "${keystone_public_api_vip}:5000" => [],
-      "${public_virtual_ip}:13000" => ['ssl', 'crt', $keystone_bind_certificate],
+      "${keystone_public_api_vip}:5000" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13000" => union($haproxy_listen_bind_param, ['ssl', 'crt', $keystone_bind_certificate]),
     }
     $keystone_admin_bind_opts = {
-      "${keystone_admin_api_vip}:35357" => [],
-      "${public_virtual_ip}:13357" => ['ssl', 'crt', $keystone_bind_certificate],
+      "${keystone_admin_api_vip}:35357" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13357" => union($haproxy_listen_bind_param, ['ssl', 'crt', $keystone_bind_certificate]),
     }
   } else {
     $keystone_public_bind_opts = {
-      "${keystone_public_api_vip}:5000" => [],
-      "${public_virtual_ip}:5000" => [],
+      "${keystone_public_api_vip}:5000" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:5000" => $haproxy_listen_bind_param,
     }
     $keystone_admin_bind_opts = {
-      "${keystone_admin_api_vip}:35357" => [],
-      "${public_virtual_ip}:35357" => [],
+      "${keystone_admin_api_vip}:35357" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:35357" => $haproxy_listen_bind_param,
     }
   }
 
   $neutron_api_vip = hiera('neutron_api_vip', $controller_virtual_ip)
   if $neutron_bind_certificate {
     $neutron_bind_opts = {
-      "${neutron_api_vip}:9696" => [],
-      "${public_virtual_ip}:13696" => ['ssl', 'crt', $neutron_bind_certificate],
+      "${neutron_api_vip}:9696" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13696" => union($haproxy_listen_bind_param, ['ssl', 'crt', $neutron_bind_certificate]),
     }
   } else {
     $neutron_bind_opts = {
-      "${neutron_api_vip}:9696" => [],
-      "${public_virtual_ip}:9696" => [],
+      "${neutron_api_vip}:9696" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:9696" => $haproxy_listen_bind_param,
     }
   }
 
   $cinder_api_vip = hiera('cinder_api_vip', $controller_virtual_ip)
   if $cinder_bind_certificate {
     $cinder_bind_opts = {
-      "${cinder_api_vip}:8776" => [],
-      "${public_virtual_ip}:13776" => ['ssl', 'crt', $cinder_bind_certificate],
+      "${cinder_api_vip}:8776" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13776" => union($haproxy_listen_bind_param, ['ssl', 'crt', $cinder_bind_certificate]),
     }
   } else {
     $cinder_bind_opts = {
-      "${cinder_api_vip}:8776" => [],
-      "${public_virtual_ip}:8776" => [],
+      "${cinder_api_vip}:8776" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:8776" => $haproxy_listen_bind_param,
+    }
+  }
+
+  $manila_api_vip = hiera('manila_api_vip', $controller_virtual_ip)
+  if $manila_bind_certificate {
+    $manila_bind_opts = {
+      "${manila_api_vip}:8786" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13786" => union($haproxy_listen_bind_param, ['ssl', 'crt', $manila_bind_certificate]),
+    }
+  } else {
+    $manila_bind_opts = {
+      "${manila_api_vip}:8786" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:8786" => $haproxy_listen_bind_param,
     }
   }
 
   $glance_api_vip = hiera('glance_api_vip', $controller_virtual_ip)
   if $glance_bind_certificate {
     $glance_bind_opts = {
-      "${glance_api_vip}:9292" => [],
-      "${public_virtual_ip}:13292" => ['ssl', 'crt', $glance_bind_certificate],
+      "${glance_api_vip}:9292" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13292" => union($haproxy_listen_bind_param, ['ssl', 'crt', $glance_bind_certificate]),
     }
   } else {
     $glance_bind_opts = {
-      "${glance_api_vip}:9292" => [],
-      "${public_virtual_ip}:9292" => [],
+      "${glance_api_vip}:9292" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:9292" => $haproxy_listen_bind_param,
     }
   }
 
   $nova_api_vip = hiera('nova_api_vip', $controller_virtual_ip)
   if $nova_bind_certificate {
     $nova_osapi_bind_opts = {
-      "${nova_api_vip}:8774" => [],
-      "${public_virtual_ip}:13774" => ['ssl', 'crt', $nova_bind_certificate],
+      "${nova_api_vip}:8774" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13774" => union($haproxy_listen_bind_param, ['ssl', 'crt', $nova_bind_certificate]),
     }
     $nova_ec2_bind_opts = {
-      "${nova_api_vip}:8773" => [],
-      "${public_virtual_ip}:13773" => ['ssl', 'crt', $nova_bind_certificate],
+      "${nova_api_vip}:8773" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13773" => union($haproxy_listen_bind_param, ['ssl', 'crt', $nova_bind_certificate]),
     }
     $nova_novnc_bind_opts = {
-      "${nova_api_vip}:6080" => [],
-      "${public_virtual_ip}:13080" => ['ssl', 'crt', $nova_bind_certificate],
+      "${nova_api_vip}:6080" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13080" => union($haproxy_listen_bind_param, ['ssl', 'crt', $nova_bind_certificate]),
     }
   } else {
     $nova_osapi_bind_opts = {
-      "${nova_api_vip}:8774" => [],
-      "${public_virtual_ip}:8774" => [],
+      "${nova_api_vip}:8774" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:8774" => $haproxy_listen_bind_param,
     }
     $nova_ec2_bind_opts = {
-      "${nova_api_vip}:8773" => [],
-      "${public_virtual_ip}:8773" => [],
+      "${nova_api_vip}:8773" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:8773" => $haproxy_listen_bind_param,
     }
     $nova_novnc_bind_opts = {
-      "${nova_api_vip}:6080" => [],
-      "${public_virtual_ip}:6080" => [],
+      "${nova_api_vip}:6080" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:6080" => $haproxy_listen_bind_param,
     }
   }
 
+  $nova_metadata_vip = hiera('nova_metadata_vip', $controller_virtual_ip)
+  $nova_metadata_bind_opts = {
+    "${nova_metadata_vip}:8775" => $haproxy_listen_bind_param,
+  }
+
   $ceilometer_api_vip = hiera('ceilometer_api_vip', $controller_virtual_ip)
   if $ceilometer_bind_certificate {
     $ceilometer_bind_opts = {
-      "${ceilometer_api_vip}:8777" => [],
-      "${public_virtual_ip}:13777" => ['ssl', 'crt', $ceilometer_bind_certificate],
+      "${ceilometer_api_vip}:8777" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13777" => union($haproxy_listen_bind_param, ['ssl', 'crt', $ceilometer_bind_certificate]),
     }
   } else {
     $ceilometer_bind_opts = {
-      "${ceilometer_api_vip}:8777" => [],
-      "${public_virtual_ip}:8777" => [],
+      "${ceilometer_api_vip}:8777" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:8777" => $haproxy_listen_bind_param,
     }
   }
 
   $swift_proxy_vip = hiera('swift_proxy_vip', $controller_virtual_ip)
   if $swift_bind_certificate {
     $swift_bind_opts = {
-      "${swift_proxy_vip}:8080" => [],
-      "${public_virtual_ip}:13080" => ['ssl', 'crt', $swift_bind_certificate],
+      "${swift_proxy_vip}:8080" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13808" => union($haproxy_listen_bind_param, ['ssl', 'crt', $swift_bind_certificate]),
     }
   } else {
     $swift_bind_opts = {
-      "${swift_proxy_vip}:8080" => [],
-      "${public_virtual_ip}:8080" => [],
+      "${swift_proxy_vip}:8080" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:8080" => $haproxy_listen_bind_param,
     }
   }
 
   $heat_api_vip = hiera('heat_api_vip', $controller_virtual_ip)
   if $heat_bind_certificate {
     $heat_bind_opts = {
-      "${heat_api_vip}:8004" => [],
-      "${public_virtual_ip}:13004" => ['ssl', 'crt', $heat_bind_certificate],
+      "${heat_api_vip}:8004" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13004" => union($haproxy_listen_bind_param, ['ssl', 'crt', $heat_bind_certificate]),
     }
     $heat_options = {
-      'option' => [ 'httpchk GET /' ],
       'rsprep' => "^Location:\\ http://${public_virtual_ip}(.*) Location:\\ https://${public_virtual_ip}\\1",
+      'http-request' => ['set-header X-Forwarded-Proto https if { ssl_fc }'],
     }
     $heat_cw_bind_opts = {
-      "${heat_api_vip}:8003" => [],
-      "${public_virtual_ip}:13003" => ['ssl', 'crt', $heat_bind_certificate],
+      "${heat_api_vip}:8003" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13003" => union($haproxy_listen_bind_param, ['ssl', 'crt', $heat_bind_certificate]),
     }
     $heat_cfn_bind_opts = {
-      "${heat_api_vip}:8000" => [],
-      "${public_virtual_ip}:13000" => ['ssl', 'crt', $heat_bind_certificate],
+      "${heat_api_vip}:8000" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13800" => union($haproxy_listen_bind_param, ['ssl', 'crt', $heat_bind_certificate]),
     }
   } else {
     $heat_bind_opts = {
-      "${heat_api_vip}:8004" => [],
-      "${public_virtual_ip}:8004" => [],
-    }
-    $heat_options = {
-      'option' => [ 'httpchk GET /' ],
+      "${heat_api_vip}:8004" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:8004" => $haproxy_listen_bind_param,
     }
+    $heat_options = {}
     $heat_cw_bind_opts = {
-      "${heat_api_vip}:8003" => [],
-      "${public_virtual_ip}:8003" => [],
+      "${heat_api_vip}:8003" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:8003" => $haproxy_listen_bind_param,
     }
     $heat_cfn_bind_opts = {
-      "${heat_api_vip}:8000" => [],
-      "${public_virtual_ip}:8000" => [],
+      "${heat_api_vip}:8000" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:8000" => $haproxy_listen_bind_param,
     }
   }
 
   $horizon_vip = hiera('horizon_vip', $controller_virtual_ip)
   if $horizon_bind_certificate {
     $horizon_bind_opts = {
-      "${horizon_vip}:80" => [],
-      "${public_virtual_ip}:443" => ['ssl', 'crt', $horizon_bind_certificate],
+      "${horizon_vip}:80" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:443" => union($haproxy_listen_bind_param, ['ssl', 'crt', $horizon_bind_certificate]),
     }
   } else {
     $horizon_bind_opts = {
-      "${horizon_vip}:80" => [],
-      "${public_virtual_ip}:80" => [],
+      "${horizon_vip}:80" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:80" => $haproxy_listen_bind_param,
     }
   }
 
   $ironic_api_vip = hiera('ironic_api_vip', $controller_virtual_ip)
   if $ironic_bind_certificate {
     $ironic_bind_opts = {
-      "${ironic_api_vip}:6385" => [],
-      "${public_virtual_ip}:13385" => ['ssl', 'crt', $ironic_bind_certificate],
+      "${ironic_api_vip}:6385" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:13385" => union($haproxy_listen_bind_param, ['ssl', 'crt', $ironic_bind_certificate]),
     }
   } else {
     $ironic_bind_opts = {
-      "${ironic_api_vip}:6385" => [],
-      "${public_virtual_ip}:6385" => [],
+      "${ironic_api_vip}:6385" => $haproxy_listen_bind_param,
+      "${public_virtual_ip}:6385" => $haproxy_listen_bind_param,
     }
   }
 
+  $mysql_vip = hiera('mysql_vip', $controller_virtual_ip)
+  $mysql_bind_opts = {
+    "${mysql_vip}:3306" => $haproxy_listen_bind_param,
+  }
+
+  $rabbitmq_vip = hiera('rabbitmq_vip', $controller_virtual_ip)
+  $rabbitmq_bind_opts = {
+    "${rabbitmq_vip}:5672" => $haproxy_listen_bind_param,
+  }
+
+  $redis_vip = hiera('redis_vip', $controller_virtual_ip)
+  $redis_bind_opts = {
+    "${redis_vip}:6379" => $haproxy_listen_bind_param,
+  }
+
   sysctl::value { 'net.ipv4.ip_nonlocal_bind': value => '1' }
 
   class { '::haproxy':
     service_manage   => $haproxy_service_manage,
     global_options   => {
-      'log'     => '/dev/log local0',
+      'log'     => "${haproxy_log_address} local0",
       'pidfile' => '/var/run/haproxy.pid',
       'user'    => 'haproxy',
       'group'   => 'haproxy',
@@ -610,11 +674,17 @@
       'mode'    => 'tcp',
       'log'     => 'global',
       'retries' => '3',
-      'option'  => [ 'tcpka', 'tcplog' ],
       'timeout' => [ 'http-request 10s', 'queue 1m', 'connect 10s', 'client 1m', 'server 1m', 'check 10s' ],
+      'maxconn' => $haproxy_default_maxconn,
     },
   }
 
+  Haproxy::Listen {
+    options => {
+      'option' => [],
+    }
+  }
+
   haproxy::listen { 'haproxy.stats':
     ipaddress        => $controller_virtual_ip,
     ports            => '1993',
@@ -628,9 +698,6 @@
   if $keystone_admin {
     haproxy::listen { 'keystone_admin':
       bind             => $keystone_admin_bind_opts,
-      options          => {
-        'option' => [ 'httpchk GET /' ],
-      },
       collect_exported => false,
     }
     haproxy::balancermember { 'keystone_admin':
@@ -645,10 +712,11 @@
   if $keystone_public {
     haproxy::listen { 'keystone_public':
       bind             => $keystone_public_bind_opts,
+      collect_exported => false,
+      mode             => 'http', # Needed for http-request option
       options          => {
-        'option' => [ 'httpchk GET /' ],
+          'http-request' => ['set-header X-Forwarded-Proto https if { ssl_fc }'],
       },
-      collect_exported => false,
     }
     haproxy::balancermember { 'keystone_public':
       listening_service => 'keystone_public',
@@ -662,9 +730,6 @@
   if $neutron {
     haproxy::listen { 'neutron':
       bind             => $neutron_bind_opts,
-      options          => {
-        'option' => [ 'httpchk GET /' ],
-      },
       collect_exported => false,
     }
     haproxy::balancermember { 'neutron':
@@ -679,9 +744,6 @@
   if $cinder {
     haproxy::listen { 'cinder':
       bind             => $cinder_bind_opts,
-      options          => {
-        'option' => [ 'httpchk GET /' ],
-      },
       collect_exported => false,
     }
     haproxy::balancermember { 'cinder':
@@ -693,14 +755,28 @@
     }
   }
 
-  if $glance_api {
-    haproxy::listen { 'glance_api':
-      bind             => $glance_bind_opts,
+  if $manila {
+    haproxy::listen { 'manila':
+      bind             => $manila_bind_opts,
       options          => {
         'option' => [ 'httpchk GET /' ],
       },
       collect_exported => false,
     }
+    haproxy::balancermember { 'manila':
+      listening_service => 'manila',
+      ports             => '8786',
+      ipaddresses       => hiera('manila_api_node_ips', $controller_hosts_real),
+      server_names      => $controller_hosts_names_real,
+      options           => ['check', 'inter 2000', 'rise 2', 'fall 5'],
+    }
+  }
+
+  if $glance_api {
+    haproxy::listen { 'glance_api':
+      bind             => $glance_bind_opts,
+      collect_exported => false,
+    }
     haproxy::balancermember { 'glance_api':
       listening_service => 'glance_api',
       ports             => '9292',
@@ -712,11 +788,7 @@
 
   if $glance_registry {
     haproxy::listen { 'glance_registry':
-      ipaddress        => hiera('glance_registry_vip', $controller_virtual_ip),
-      ports            => 9191,
-      options          => {
-        'mode' => 'tcp',
-      },
+      bind             => $glance_registry_bind_opts,
       collect_exported => false,
     }
     haproxy::balancermember { 'glance_registry':
@@ -731,9 +803,6 @@
   if $nova_ec2 {
     haproxy::listen { 'nova_ec2':
       bind             => $nova_ec2_bind_opts,
-      options          => {
-        'option' => [ 'httpchk GET /' ],
-      },
       collect_exported => false,
     }
     haproxy::balancermember { 'nova_ec2':
@@ -748,10 +817,11 @@
   if $nova_osapi {
     haproxy::listen { 'nova_osapi':
       bind             => $nova_osapi_bind_opts,
+      collect_exported => false,
+      mode             => 'http',
       options          => {
-        'option' => [ 'httpchk GET /' ],
+          'http-request' => ['set-header X-Forwarded-Proto https if { ssl_fc }'],
       },
-      collect_exported => false,
     }
     haproxy::balancermember { 'nova_osapi':
       listening_service => 'nova_osapi',
@@ -764,11 +834,7 @@
 
   if $nova_metadata {
     haproxy::listen { 'nova_metadata':
-      ipaddress        => hiera('nova_metadata_vip', $controller_virtual_ip),
-      ports            => 8775,
-      options          => {
-        'option' => [ 'httpchk GET /' ],
-      },
+      bind             => $nova_metadata_bind_opts,
       collect_exported => false,
     }
     haproxy::balancermember { 'nova_metadata':
@@ -784,7 +850,7 @@
     haproxy::listen { 'nova_novncproxy':
       bind             => $nova_novnc_bind_opts,
       options          => {
-        'option' => [ 'httpchk GET /' ],
+        'balance' => 'source',
       },
       collect_exported => false,
     }
@@ -807,16 +873,13 @@
       ports             => '8777',
       ipaddresses       => hiera('ceilometer_api_node_ips', $controller_hosts_real),
       server_names      => $controller_hosts_names_real,
-      options           => [],
+      options           => ['check', 'inter 2000', 'rise 2', 'fall 5'],
     }
   }
 
   if $swift_proxy_server {
     haproxy::listen { 'swift_proxy_server':
       bind             => $swift_bind_opts,
-      options          => {
-        'option' => [ 'httpchk GET /info' ],
-      },
       collect_exported => false,
     }
     haproxy::balancermember { 'swift_proxy_server':
@@ -847,9 +910,6 @@
   if $heat_cloudwatch {
     haproxy::listen { 'heat_cloudwatch':
       bind             => $heat_cw_bind_opts,
-      options          => {
-        'option' => [ 'httpchk GET /' ],
-      },
       collect_exported => false,
     }
     haproxy::balancermember { 'heat_cloudwatch':
@@ -864,9 +924,6 @@
   if $heat_cfn {
     haproxy::listen { 'heat_cfn':
       bind             => $heat_cfn_bind_opts,
-      options          => {
-        'option' => [ 'httpchk GET /' ],
-      },
       collect_exported => false,
     }
     haproxy::balancermember { 'heat_cfn':
@@ -882,8 +939,9 @@
     haproxy::listen { 'horizon':
       bind             => $horizon_bind_opts,
       options          => {
-        'option' => [ 'httpchk GET /' ],
+        'cookie' => 'SERVERID insert indirect nocache',
       },
+      mode             => 'http',
       collect_exported => false,
     }
     haproxy::balancermember { 'horizon':
@@ -897,7 +955,7 @@
 
   if $mysql_clustercheck {
     $mysql_listen_options = {
-        'option'      => [ 'httpchk' ],
+        'option'      => [ 'tcpka', 'httpchk' ],
         'timeout'     => [ 'client 0', 'server 0' ],
         'stick-table' => 'type ip size 1000',
         'stick'       => 'on dst',
@@ -920,14 +978,13 @@
       ports             => '6385',
       ipaddresses       => hiera('ironic_api_node_ips', $controller_hosts_real),
       server_names      => $controller_hosts_names_real,
-      options           => [],
+      options           => ['check', 'inter 2000', 'rise 2', 'fall 5'],
     }
   }
 
   if $mysql {
     haproxy::listen { 'mysql':
-      ipaddress        => [hiera('mysql_vip', $controller_virtual_ip)],
-      ports            => 3306,
+      bind             => $mysql_bind_opts,
       options          => $mysql_listen_options,
       collect_exported => false,
     }
@@ -942,9 +999,9 @@
 
   if $rabbitmq {
     haproxy::listen { 'rabbitmq':
-      ipaddress        => [hiera('rabbitmq_vip', $controller_virtual_ip)],
-      ports            => 5672,
+      bind             => $rabbitmq_bind_opts,
       options          => {
+        'option'  => [ 'tcpka' ],
         'timeout' => [ 'client 0', 'server 0' ],
       },
       collect_exported => false,
@@ -960,11 +1017,9 @@
 
   if $redis {
     haproxy::listen { 'redis':
-      ipaddress        => [hiera('redis_vip', $controller_virtual_ip)],
-      ports            => 6379,
+      bind             => $redis_bind_opts,
       options          => {
         'timeout'   => [ 'client 0', 'server 0' ],
-        'mode'      => 'tcp',
         'balance'   => 'first',
         'option'    => ['tcp-check',],
         'tcp-check' => ['send info\ replication\r\n','expect string role:master'],
diff --git a/tripleo/manifests/noop.pp b/tripleo/manifests/noop.pp
new file mode 100644
index 000000000..53da9b9b4
--- /dev/null
+++ b/tripleo/manifests/noop.pp
@@ -0,0 +1,68 @@
+# Copyright 2015 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# == Class: tripleo::noop
+#
+# Enable noop mode for various Puppet resource types via collectors.
+#
+# === Parameters:
+# [*package*]
+#  Whether Package resources should be noop.
+#  Defaults to true
+#
+# [*file*]
+#  Whether File resources should be noop.
+#  Defaults to true
+#
+# [*service*]
+#  Whether Service resources should be noop.
+#  Defaults to true
+#
+# [*exec*]
+#  Whether Exec resources should be noop.
+#  Defaults to true
+#
+# [*user*]
+#  Whether User resources should be noop.
+#  Defaults to true
+#
+# [*group*]
+#  Whether Group resources should be noop.
+#  Defaults to true
+#
+# [*cron*]
+#  Whether Cron resources should be noop.
+#  Defaults to true
+#
+#
+class tripleo::noop (
+  $package = true,
+  $file = true,
+  $service = true,
+  $exec = true,
+  $user = true,
+  $group = true,
+  $cron = true,
+) {
+
+  Package <| |> { noop => $package}
+  File <| |> { noop => $file}
+  Service <| |> { noop => $service}
+  Exec <| |> { noop => $exec}
+  User <| |> { noop => $user}
+  Group <| |> { noop => $group}
+  Cron <| |> { noop => $cron}
+
+}
diff --git a/tripleo/manifests/packages.pp b/tripleo/manifests/packages.pp
index 6a5813a2c..ac11efd23 100644
--- a/tripleo/manifests/packages.pp
+++ b/tripleo/manifests/packages.pp
@@ -32,7 +32,7 @@
   $enable_upgrade = false,
 ) {
 
-  if !$enable_install {
+  if !$enable_install and !$enable_upgrade {
     case $::osfamily {
       'RedHat': {
         Package <| |> { provider => 'norpm' }
@@ -44,9 +44,6 @@
   }
 
   if $enable_upgrade {
-    if !$enable_install {
-      fail('Package upgrades require that enable_install be set to true')
-    }
     Package <| |> { ensure => 'latest' }
   }
 
diff --git a/tripleo/spec/acceptance/nodesets/centos-70-x64.yml b/tripleo/spec/acceptance/nodesets/centos-70-x64.yml
new file mode 100644
index 000000000..5f097e9fe
--- /dev/null
+++ b/tripleo/spec/acceptance/nodesets/centos-70-x64.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  centos-server-70-x64:
+    roles:
+      - master
+    platform: el-7-x86_64
+    box: puppetlabs/centos-7.0-64-nocm
+    box_url: https://vagrantcloud.com/puppetlabs/centos-7.0-64-nocm
+    hypervisor: vagrant
+CONFIG:
+  log_level: debug
+  type: foss
diff --git a/tripleo/spec/acceptance/nodesets/default.yml b/tripleo/spec/acceptance/nodesets/default.yml
new file mode 100644
index 000000000..3bb3e6264
--- /dev/null
+++ b/tripleo/spec/acceptance/nodesets/default.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  ubuntu-server-1404-x64:
+    roles:
+      - master
+    platform: ubuntu-14.04-amd64
+    box: puppetlabs/ubuntu-14.04-64-nocm
+    box_url: https://vagrantcloud.com/puppetlabs/ubuntu-14.04-64-nocm
+    hypervisor: vagrant
+CONFIG:
+  log_level: debug
+  type: git
diff --git a/tripleo/spec/acceptance/nodesets/nodepool-centos7.yml b/tripleo/spec/acceptance/nodesets/nodepool-centos7.yml
new file mode 100644
index 000000000..c55287420
--- /dev/null
+++ b/tripleo/spec/acceptance/nodesets/nodepool-centos7.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  centos-70-x64:
+    roles:
+      - master
+    platform: el-7-x86_64
+    hypervisor: none
+    ip: 127.0.0.1
+CONFIG:
+  type: foss
+  set_env: false
diff --git a/tripleo/spec/acceptance/nodesets/nodepool-trusty.yml b/tripleo/spec/acceptance/nodesets/nodepool-trusty.yml
new file mode 100644
index 000000000..7f503cadd
--- /dev/null
+++ b/tripleo/spec/acceptance/nodesets/nodepool-trusty.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  ubuntu-1404-x64:
+    roles:
+      - master
+    platform: ubuntu-14.04-amd64
+    hypervisor: none
+    ip: 127.0.0.1
+CONFIG:
+  type: foss
+  set_env: false
diff --git a/tripleo/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml b/tripleo/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
new file mode 100644
index 000000000..3bb3e6264
--- /dev/null
+++ b/tripleo/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  ubuntu-server-1404-x64:
+    roles:
+      - master
+    platform: ubuntu-14.04-amd64
+    box: puppetlabs/ubuntu-14.04-64-nocm
+    box_url: https://vagrantcloud.com/puppetlabs/ubuntu-14.04-64-nocm
+    hypervisor: vagrant
+CONFIG:
+  log_level: debug
+  type: git
diff --git a/tripleo/spec/classes/tripleo_firewall_spec.rb b/tripleo/spec/classes/tripleo_firewall_spec.rb
new file mode 100644
index 000000000..c1249b9fa
--- /dev/null
+++ b/tripleo/spec/classes/tripleo_firewall_spec.rb
@@ -0,0 +1,114 @@
+#
+# Copyright (C) 2015 eNovance SAS <licensing@enovance.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# Unit tests for tripleo
+#
+
+require 'spec_helper'
+
+describe 'tripleo::firewall' do
+
+  let :params do
+    { }
+  end
+
+  shared_examples_for 'tripleo node' do
+
+    context 'with firewall enabled' do
+      before :each do
+        params.merge!(
+          :manage_firewall => true,
+        )
+      end
+
+      it 'configure basic pre firewall rules' do
+        is_expected.to contain_firewall('000 accept related established rules').with(
+          :proto  => 'all',
+          :state  => ['RELATED', 'ESTABLISHED'],
+          :action => 'accept',
+        )
+        is_expected.to contain_firewall('001 accept all icmp').with(
+          :proto  => 'icmp',
+          :action => 'accept',
+          :state  => ['NEW'],
+        )
+        is_expected.to contain_firewall('002 accept all to lo interface').with(
+          :proto   => 'all',
+          :iniface => 'lo',
+          :action  => 'accept',
+          :state   => ['NEW'],
+        )
+        is_expected.to contain_firewall('003 accept ssh').with(
+          :port   => '22',
+          :proto  => 'tcp',
+          :action => 'accept',
+          :state  => ['NEW'],
+        )
+      end
+
+      it 'configure basic post firewall rules' do
+        is_expected.to contain_firewall('999 drop all').with(
+          :proto  => 'all',
+          :action => 'drop',
+          :source => '0.0.0.0/0',
+        )
+      end
+    end
+
+    context 'with custom firewall rules' do
+      before :each do
+        params.merge!(
+          :manage_firewall     => true,
+          :firewall_rules => {
+            '300 add custom application 1' => {'port' => '999', 'proto' => 'udp', 'action' => 'accept'},
+            '301 add custom application 2' => {'port' => '8081', 'proto' => 'tcp', 'action' => 'accept'}
+          }
+        )
+      end
+      it 'configure custom firewall rules' do
+        is_expected.to contain_firewall('300 add custom application 1').with(
+          :port   => '999',
+          :proto  => 'udp',
+          :action => 'accept',
+          :state  => ['NEW'],
+        )
+        is_expected.to contain_firewall('301 add custom application 2').with(
+          :port   => '8081',
+          :proto  => 'tcp',
+          :action => 'accept',
+          :state  => ['NEW'],
+        )
+      end
+    end
+
+  end
+
+  context 'on Debian platforms' do
+    let :facts do
+      { :osfamily => 'Debian' }
+    end
+
+    it_configures 'tripleo node'
+  end
+
+  context 'on RedHat platforms' do
+    let :facts do
+      { :osfamily => 'RedHat' }
+    end
+
+    it_configures 'tripleo node'
+  end
+
+end
diff --git a/tripleo/spec/classes/tripleo_init_spec.rb b/tripleo/spec/classes/tripleo_init_spec.rb
new file mode 100644
index 000000000..57b45e2a4
--- /dev/null
+++ b/tripleo/spec/classes/tripleo_init_spec.rb
@@ -0,0 +1,23 @@
+#
+# Copyright (C) 2015 eNovance SAS <licensing@enovance.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# Unit tests for tripleo
+#
+
+require 'spec_helper'
+
+describe 'tripleo' do
+
+end
diff --git a/tripleo/spec/spec_helper.rb b/tripleo/spec/spec_helper.rb
index 0171d5dd0..700be6a27 100644
--- a/tripleo/spec/spec_helper.rb
+++ b/tripleo/spec/spec_helper.rb
@@ -1,5 +1,6 @@
 require 'puppetlabs_spec_helper/module_spec_helper'
 require 'shared_examples'
+require 'webmock/rspec'
 
 RSpec.configure do |c|
   c.alias_it_should_behave_like_to :it_configures, 'configures'
@@ -14,3 +15,5 @@
     :uniqueid       => '123'
   }
 end
+
+at_exit { RSpec::Puppet::Coverage.report! }
diff --git a/tripleo/spec/spec_helper_acceptance.rb b/tripleo/spec/spec_helper_acceptance.rb
new file mode 100644
index 000000000..429e807c4
--- /dev/null
+++ b/tripleo/spec/spec_helper_acceptance.rb
@@ -0,0 +1,56 @@
+require 'beaker-rspec'
+require 'beaker/puppet_install_helper'
+
+run_puppet_install_helper
+
+RSpec.configure do |c|
+  # Project root
+  proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+  modname = JSON.parse(open('metadata.json').read)['name'].split('-')[1]
+
+  # Readable test descriptions
+  c.formatter = :documentation
+
+  # Configure all nodes in nodeset
+  c.before :suite do
+    # Install module and dependencies
+    hosts.each do |host|
+
+      # install git
+      install_package host, 'git'
+
+      zuul_ref = ENV['ZUUL_REF']
+      zuul_branch = ENV['ZUUL_BRANCH']
+      zuul_url = ENV['ZUUL_URL']
+
+      repo = 'openstack/puppet-openstack-integration'
+
+      # Start out with clean moduledir, don't trust r10k to purge it
+      on host, "rm -rf /etc/puppet/modules/*"
+      # Install dependent modules via git or zuul
+      r = on host, "test -e /usr/zuul-env/bin/zuul-cloner", { :acceptable_exit_codes => [0,1] }
+      if r.exit_code == 0
+        zuul_clone_cmd = '/usr/zuul-env/bin/zuul-cloner '
+        zuul_clone_cmd += '--cache-dir /opt/git '
+        zuul_clone_cmd += "--zuul-ref #{zuul_ref} "
+        zuul_clone_cmd += "--zuul-branch #{zuul_branch} "
+        zuul_clone_cmd += "--zuul-url #{zuul_url} "
+        zuul_clone_cmd += "git://git.openstack.org #{repo}"
+        on host, zuul_clone_cmd
+      else
+        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+      end
+
+      on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
+
+      # Install the module being tested
+      on host, "rm -fr /etc/puppet/modules/#{modname}"
+      puppet_module_install(:source => proj_root, :module_name => modname)
+
+      on host, "rm -fr #{repo}"
+
+      # List modules installed to help with debugging
+      on host, puppet('module','list'), { :acceptable_exit_codes => 0 }
+    end
+  end
+end
diff --git a/tripleo/spec/unit/type/package_manifest_spec.rb b/tripleo/spec/unit/type/package_manifest_spec.rb
new file mode 100644
index 000000000..096564c30
--- /dev/null
+++ b/tripleo/spec/unit/type/package_manifest_spec.rb
@@ -0,0 +1,37 @@
+
+require 'puppet'
+require 'puppet/type/package_manifest'
+
+describe 'Puppet::Type.type(:package_manifest)' do
+  before :each do
+    @manifest = Puppet::Type.type(:package_manifest).new(
+        :path => '/tmp/test_package_manifest.txt', :ensure => 'present'
+    )
+  end
+
+  it 'should require a path' do
+    expect {
+      Puppet::Type.type(:package_manifest).new({})
+  }.to raise_error Puppet::Error
+  end
+
+  it 'should not require a value when ensure is absent' do
+    Puppet::Type.type(:package_manifest).new(
+        :path => '/tmp/test_package_manifest.txt', :ensure => :absent
+    )
+  end
+
+  it 'should accept valid ensure values' do
+    @manifest[:ensure] = :present
+    expect(@manifest[:ensure]).to eq(:present)
+    @manifest[:ensure] = :absent
+    expect(@manifest[:ensure]).to eq(:absent)
+  end
+
+  it 'should not accept invalid ensure values' do
+    expect {
+      @manifest[:ensure] = :latest
+    }.to raise_error(Puppet::Error, /Invalid value/)
+  end
+
+end
diff --git a/trove/CHANGELOG.md b/trove/CHANGELOG.md
new file mode 100644
index 000000000..f8faa92a0
--- /dev/null
+++ b/trove/CHANGELOG.md
@@ -0,0 +1,4 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+- Initial release of the puppet-trove module
diff --git a/trove/README.md b/trove/README.md
index 06271ae03..98b235006 100644
--- a/trove/README.md
+++ b/trove/README.md
@@ -1,6 +1,8 @@
 puppet-trove
 =============
 
+6.0.0 - 2015.1 - Kilo
+
 #### Table of Contents
 
 1. [Overview - What is the trove module?](#overview)
diff --git a/trove/manifests/config.pp b/trove/manifests/config.pp
new file mode 100644
index 000000000..93d63136d
--- /dev/null
+++ b/trove/manifests/config.pp
@@ -0,0 +1,84 @@
+#
+# Copyright (C) 2015  UnitedStack <devops@unitedstack.com>
+#
+# Author: Xingchao Yu <xingchao@unitedstack.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# == Class: trove::config
+#
+# This class is used to manage arbitrary trove configurations.
+#
+# === Parameters
+#
+# [*trove_config*]
+#   (optional) Allow configuration of arbitrary trove configurations.
+#   The value is an hash of trove_config resources.
+#   Defaults to {}
+#
+# [*trove_taskmanager_config*]
+#   (optional) Allow configuration of arbitrary trove taskmanager configurations.
+#   The value is an hash of trove_taskmanager_config resources.
+#   Defaults to {}
+#
+# [*trove_conductor_config*]
+#   (optional) Allow configuration of arbitrary trove conductor configurations.
+#   The value is an hash of trove_conductor_config resources.
+#   Defaults to {}
+#
+# [*trove_guestagent_config*]
+#   (optional) Allow configuration of arbitrary trove guestagent configurations.
+#   The value is an hash of trove_guestagent_config resources.
+#   Defaults to {}
+#
+# [*trove_api_paste_ini*]
+#   (optional) Allow configuration of arbitrary trove paste api configurations.
+#   The value is an hash of trove_paste_api_ini resources.
+#   Defaults to {}
+#
+#   Example:
+#   { 'DEFAULT/foo' => { value => 'fooValue'},
+#     'DEFAULT/bar' => { value => 'barValue'}
+#   }
+#
+#   In yaml format, Example:
+#   trove_config:
+#     DEFAULT/foo:
+#       value: fooValue
+#     DEFAULT/bar:
+#       value: barValue
+#
+#   NOTE: The configuration MUST NOT be already handled by this module
+#   or Puppet catalog compilation will fail with duplicate resources.
+#
+class trove::config (
+  $trove_config             = {},
+  $trove_taskmanager_config = {},
+  $trove_conductor_config   = {},
+  $trove_guestagent_config  = {},
+  $trove_api_paste_ini      = {},
+) {
+
+  validate_hash($trove_config)
+  validate_hash($trove_taskmanager_config)
+  validate_hash($trove_conductor_config)
+  validate_hash($trove_guestagent_config)
+  validate_hash($trove_api_paste_ini)
+
+  create_resources('trove_config', $trove_config)
+  create_resources('trove_taskmanager_config', $trove_taskmanager_config)
+  create_resources('trove_conductor_config', $trove_conductor_config)
+  create_resources('trove_guestagent_config', $trove_guestagent_config)
+  create_resources('trove_api_paste_ini', $trove_api_paste_ini)
+
+}
diff --git a/trove/manifests/keystone/auth.pp b/trove/manifests/keystone/auth.pp
index b39761ca7..b76309ac5 100644
--- a/trove/manifests/keystone/auth.pp
+++ b/trove/manifests/keystone/auth.pp
@@ -195,8 +195,10 @@
 
   $real_service_name = pick($service_name, $auth_name)
 
-  Keystone_user_role["${auth_name}@${tenant}"]        ~> Service <| name == 'trove-server' |>
-  Keystone_endpoint["${region}/${real_service_name}"] ~> Service <| name == 'trove-server' |>
+  Keystone_user_role["${auth_name}@${tenant}"] ~> Service <| name == 'trove-server' |>
+
+  Keystone_endpoint<| title == "${region}/${real_service_name}" |>
+        ~> Service <| name == 'trove-server' |>
 
   keystone::resource::service_identity { 'trove':
     configure_user      => true,
diff --git a/trove/metadata.json b/trove/metadata.json
index e5d06d86d..b635a4585 100644
--- a/trove/metadata.json
+++ b/trove/metadata.json
@@ -1,10 +1,10 @@
 {
-  "name": "stackforge-trove",
-  "version": "5.0.0",
-  "author": "eNovance and StackForge Contributors",
+  "name": "openstack-trove",
+  "version": "6.0.0",
+  "author": "eNovance and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Trove",
   "license": "Apache-2.0",
-  "source": "git://github.com/stackforge/puppet-trove.git",
+  "source": "git://github.com/openstack/puppet-trove.git",
   "project_page": "https://launchpad.net/puppet-trove",
   "issues_url": "https://bugs.launchpad.net/puppet-trove",
   "requirements": [
@@ -32,8 +32,8 @@
   "description": "Installs and configures OpenStack Trove (Database service).",
   "dependencies": [
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
-    { "name": "stackforge/keystone", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/keystone", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
-    { "name": "stackforge/openstacklib", "version_requirement": ">=5.0.0 <6.0.0" }
+    { "name": "openstack/openstacklib", "version_requirement": ">=6.0.0 <7.0.0" }
   ]
 }
diff --git a/trove/spec/classes/trove_config_spec.rb b/trove/spec/classes/trove_config_spec.rb
new file mode 100644
index 000000000..233945b9b
--- /dev/null
+++ b/trove/spec/classes/trove_config_spec.rb
@@ -0,0 +1,63 @@
+require 'spec_helper'
+
+describe 'trove::config' do
+
+  let :params do
+    { :trove_config => {
+        'DEFAULT/foo' => { 'value'  => 'fooValue' },
+        'DEFAULT/bar' => { 'value'  => 'barValue' },
+        'DEFAULT/baz' => { 'ensure' => 'absent' }
+      },
+      :trove_taskmanager_config => {
+        'DEFAULT/foo2' => { 'value'  => 'fooValue' },
+        'DEFAULT/bar2' => { 'value'  => 'barValue' },
+        'DEFAULT/baz2' => { 'ensure' => 'absent' }
+      },
+      :trove_conductor_config => {
+        'DEFAULT/foo2' => { 'value'  => 'fooValue' },
+        'DEFAULT/bar2' => { 'value'  => 'barValue' },
+        'DEFAULT/baz2' => { 'ensure' => 'absent' }
+      },
+      :trove_guestagent_config => {
+        'DEFAULT/foo2' => { 'value'  => 'fooValue' },
+        'DEFAULT/bar2' => { 'value'  => 'barValue' },
+        'DEFAULT/baz2' => { 'ensure' => 'absent' }
+      },
+      :trove_api_paste_ini => {
+        'DEFAULT/foo2' => { 'value'  => 'fooValue' },
+        'DEFAULT/bar2' => { 'value'  => 'barValue' },
+        'DEFAULT/baz2' => { 'ensure' => 'absent' }
+      }
+    }
+  end
+
+  it 'configures arbitrary trove configurations' do
+    is_expected.to contain_trove_config('DEFAULT/foo').with_value('fooValue')
+    is_expected.to contain_trove_config('DEFAULT/bar').with_value('barValue')
+    is_expected.to contain_trove_config('DEFAULT/baz').with_ensure('absent')
+  end
+
+  it 'configures arbitrary trove taskmanager configurations' do
+    is_expected.to contain_trove_taskmanager_config('DEFAULT/foo2').with_value('fooValue')
+    is_expected.to contain_trove_taskmanager_config('DEFAULT/bar2').with_value('barValue')
+    is_expected.to contain_trove_taskmanager_config('DEFAULT/baz2').with_ensure('absent')
+  end
+
+  it 'configures arbitrary trove conductor configurations' do
+    is_expected.to contain_trove_conductor_config('DEFAULT/foo2').with_value('fooValue')
+    is_expected.to contain_trove_conductor_config('DEFAULT/bar2').with_value('barValue')
+    is_expected.to contain_trove_conductor_config('DEFAULT/baz2').with_ensure('absent')
+  end
+
+  it 'configures arbitrary trove guestagent configurations' do
+    is_expected.to contain_trove_guestagent_config('DEFAULT/foo2').with_value('fooValue')
+    is_expected.to contain_trove_guestagent_config('DEFAULT/bar2').with_value('barValue')
+    is_expected.to contain_trove_guestagent_config('DEFAULT/baz2').with_ensure('absent')
+  end
+
+  it 'configures arbitrary trove api-paste configurations' do
+    is_expected.to contain_trove_api_paste_ini('DEFAULT/foo2').with_value('fooValue')
+    is_expected.to contain_trove_api_paste_ini('DEFAULT/bar2').with_value('barValue')
+    is_expected.to contain_trove_api_paste_ini('DEFAULT/baz2').with_ensure('absent')
+  end
+end
diff --git a/trove/spec/classes/trove_keystone_auth_spec.rb b/trove/spec/classes/trove_keystone_auth_spec.rb
index 63204e9d5..dde648f47 100644
--- a/trove/spec/classes/trove_keystone_auth_spec.rb
+++ b/trove/spec/classes/trove_keystone_auth_spec.rb
@@ -130,4 +130,12 @@
     it { is_expected.to contain_keystone_endpoint('RegionOne/trove_service') }
   end
 
+  describe 'when disabling endpoint configuration' do
+    let :params do
+      { :configure_endpoint => false,
+        :password           => 'trove_password' }
+    end
+
+    it { is_expected.to_not contain_keystone_endpoint('RegionOne/neutron') }
+  end
 end
diff --git a/trove/spec/spec_helper_acceptance.rb b/trove/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/trove/spec/spec_helper_acceptance.rb
+++ b/trove/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"
diff --git a/tuskar/CHANGELOG.md b/tuskar/CHANGELOG.md
new file mode 100644
index 000000000..2c923da3c
--- /dev/null
+++ b/tuskar/CHANGELOG.md
@@ -0,0 +1,4 @@
+##2015-07-08 - 6.0.0
+###Summary
+
+- Initial release of the puppet-tuskar module
diff --git a/tuskar/README.md b/tuskar/README.md
index cc951f880..ce38bab2d 100644
--- a/tuskar/README.md
+++ b/tuskar/README.md
@@ -1,6 +1,8 @@
 puppet-tuskar
 =============
 
+6.0.0 - 2015.1 - Kilo
+
 #### Table of Contents
 
 1. [Overview - What is the tuskar module?](#overview)
diff --git a/tuskar/metadata.json b/tuskar/metadata.json
index 74adfe2fe..b6af43303 100644
--- a/tuskar/metadata.json
+++ b/tuskar/metadata.json
@@ -1,10 +1,10 @@
 {
-  "name": "stackforge-tuskar",
-  "version": "5.0.0",
-  "author": "eNovance and StackForge Contributors",
+  "name": "openstack-tuskar",
+  "version": "6.0.0",
+  "author": "eNovance and OpenStack Contributors",
   "summary": "Puppet module for OpenStack Tuskar",
   "license": "Apache-2.0",
-  "source": "git://github.com/stackforge/puppet-tuskar.git",
+  "source": "git://github.com/openstack/puppet-tuskar.git",
   "project_page": "https://launchpad.net/puppet-tuskar",
   "issues_url": "https://bugs.launchpad.net/puppet-tuskar",
   "requirements": [
@@ -32,8 +32,8 @@
   "description": "Installs and configures OpenStack Tuskar (Management service).",
   "dependencies": [
     { "name": "puppetlabs/inifile", "version_requirement": ">=1.0.0 <2.0.0" },
-    { "name": "stackforge/keystone", "version_requirement": ">=5.0.0 <6.0.0" },
+    { "name": "openstack/keystone", "version_requirement": ">=6.0.0 <7.0.0" },
     { "name": "puppetlabs/stdlib", "version_requirement": ">=4.0.0 <5.0.0" },
-    { "name": "stackforge/openstacklib", "version_requirement": ">=5.0.0 <6.0.0" }
+    { "name": "openstack/openstacklib", "version_requirement": ">=6.0.0 <7.0.0" }
   ]
 }
diff --git a/vswitch/CHANGELOG.md b/vswitch/CHANGELOG.md
new file mode 100644
index 000000000..a9635a2a4
--- /dev/null
+++ b/vswitch/CHANGELOG.md
@@ -0,0 +1,14 @@
+##2015-07-08 - 2.0.0
+###Summary
+
+This is a major release for OpenStack Kilo but contains no API-breaking
+changes.
+
+
+####Features
+- Puppet 4.x support
+- make dkms on Debian/Ubuntu optional
+
+####Maintenance
+- Acceptance tests with Beaker
+- Fix spec tests for RSpec 3.x and Puppet 4.x
diff --git a/vswitch/README.md b/vswitch/README.md
index 449bebe4b..94a5c3c7d 100644
--- a/vswitch/README.md
+++ b/vswitch/README.md
@@ -1,7 +1,7 @@
 VSwitch
 =======
 
-1.1.0 - 2014.2 - Juno
+2.0.0 - 2015.1 - Kilo
 
 A Puppet module providing things for vSwitches. At the moment OVS is the only
 one I've added but please feel free to contribute new providers through
diff --git a/vswitch/lib/puppet/provider/vs_port/ovs_redhat.rb b/vswitch/lib/puppet/provider/vs_port/ovs_redhat.rb
index 41f644542..398cdf43b 100644
--- a/vswitch/lib/puppet/provider/vs_port/ovs_redhat.rb
+++ b/vswitch/lib/puppet/provider/vs_port/ovs_redhat.rb
@@ -10,7 +10,11 @@
   'NM_CONTROLLED' => 'no',
   'NOZEROCONF'    => 'yes' }
 
-Puppet::Type.type(:vs_port).provide(:ovs_redhat, :parent => :ovs) do
+Puppet::Type.type(:vs_port).provide(
+  :ovs_redhat,
+  :parent => Puppet::Type.type(:vs_port).provider(:ovs)
+) do
+
   desc 'Openvswitch port manipulation for RedHat OSes family'
 
   confine    :osfamily => :redhat
diff --git a/vswitch/metadata.json b/vswitch/metadata.json
index 9dc0d6132..4d963a466 100644
--- a/vswitch/metadata.json
+++ b/vswitch/metadata.json
@@ -1,7 +1,7 @@
 {
-  "name": "stackforge-vswitch",
-  "version": "1.1.0",
-  "author": "Endre Karlson, Dan Bode and StackForge Contributors",
+  "name": "openstack-vswitch",
+  "version": "2.0.0",
+  "author": "Endre Karlson, Dan Bode and OpenStack Contributors",
   "license": "Apache-2.0",
   "source": "git://github.com/openstack/puppet-vswitch.git",
   "project_page": "https://launchpad.net/puppet-vswitch",
diff --git a/vswitch/spec/spec_helper_acceptance.rb b/vswitch/spec/spec_helper_acceptance.rb
index 429e807c4..144b31e3f 100644
--- a/vswitch/spec/spec_helper_acceptance.rb
+++ b/vswitch/spec/spec_helper_acceptance.rb
@@ -38,7 +38,7 @@
         zuul_clone_cmd += "git://git.openstack.org #{repo}"
         on host, zuul_clone_cmd
       else
-        on host, "git clone https://git.openstack.org/#{repo} #{repo}"
+        on host, "git clone -b stable/kilo https://git.openstack.org/#{repo} #{repo}"
       end
 
       on host, "ZUUL_REF=#{zuul_ref} ZUUL_BRANCH=#{zuul_branch} ZUUL_URL=#{zuul_url} bash #{repo}/install_modules.sh"