diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml
index b102d81c93..4a9c980be5 100644
--- a/ansible/group_vars/all.yml
+++ b/ansible/group_vars/all.yml
@@ -103,6 +103,8 @@ docker_client_timeout: 120
 
 # Docker networking options
 docker_disable_default_iptables_rules: "no"
+docker_disable_default_network: "no"
+docker_disable_ip_forward: "no"
 
 # Retention settings for Docker logs
 docker_log_max_file: "5"
diff --git a/ansible/roles/baremetal/tasks/install.yml b/ansible/roles/baremetal/tasks/install.yml
index 3e7cbb1ff1..5bab800fa3 100644
--- a/ansible/roles/baremetal/tasks/install.yml
+++ b/ansible/roles/baremetal/tasks/install.yml
@@ -46,6 +46,26 @@
   changed_when: false
   register: running_containers
 
+# APT starts Docker engine right after installation, which creates
+# iptables rules before we disable iptables in Docker config
+
+- name: Check if docker systemd unit exists
+  stat:
+    path: /etc/systemd/system/docker.service
+  register: docker_unit_file
+
+- name: Mask the docker systemd unit on Debian/Ubuntu
+  file:
+    src: /dev/null
+    dest: /etc/systemd/system/docker.service
+    owner: root
+    group: root
+    state: link
+  become: true
+  when:
+    - ansible_os_family == 'Debian'
+    - not docker_unit_file.stat.exists
+
 - name: Install apt packages
   package:
     name: "{{ (debian_pkg_install | join(' ')).split() }}"
@@ -73,6 +93,26 @@
   when: ansible_os_family == 'RedHat'
   register: rpm_install_result
 
+# Workaround older Ansible that fails systemd tasks
+# when unit is masked
+
+- name: Check if docker service is masked
+  become: True
+  stat:
+    path: /etc/systemd/system/docker.service
+  register: docker_unit_masked
+  when: ansible_os_family == 'Debian'
+
+- name: Unmask docker service
+  become: True
+  file:
+    path: /etc/systemd/system/docker.service
+    state: absent
+  when:
+    - ansible_os_family == 'Debian'
+    - docker_unit_masked.stat.islnk
+    - docker_unit_masked.stat.lnk_source == '/dev/null'
+
 # If any packages were updated, and any containers were running, wait for the
 # daemon to come up and start all previously running containers.
 
@@ -80,10 +120,11 @@
     # At some point (at least on CentOS 7) Docker CE stopped starting
     # automatically after an upgrade from legacy docker . Start it manually.
     - name: Start docker
-      service:
+      systemd:
         name: docker
         state: started
         enabled: yes
+        masked: no
       become: True
 
     - name: Wait for Docker to start
@@ -125,7 +166,8 @@
 
 - name: Install docker SDK for python
   pip:
-    name: docker
+    # NOTE(mnasiadka): docker 5.0.0 lacks six in deps but requires it
+    name: docker<5.0.0
     executable: "{{ virtualenv is none | ternary('pip' ~ host_python_major_version, omit) }}"
     virtualenv: "{{ virtualenv is none | ternary(omit, virtualenv) }}"
     virtualenv_site_packages: "{{ virtualenv is none | ternary(omit, virtualenv_site_packages) }}"
diff --git a/ansible/roles/baremetal/tasks/post-install.yml b/ansible/roles/baremetal/tasks/post-install.yml
index 5fa5da1ab5..0687ce023f 100644
--- a/ansible/roles/baremetal/tasks/post-install.yml
+++ b/ansible/roles/baremetal/tasks/post-install.yml
@@ -93,7 +93,7 @@
 - name: Warn about docker default iptables
   debug:
     msg: >-
-      Docker default iptables rules will be disabled by default from the Victoria 11.0.0
+      Docker default iptables rules will be disabled by default from the Wallaby 12.0.0
       release. If you have any non-Kolla containers that need this functionality, you should
       plan a migration for this change, or set docker_disable_default_iptables_rules to false.
   when: not docker_disable_default_iptables_rules | bool
@@ -103,6 +103,34 @@
     docker_config: "{{ docker_config | combine({'iptables': false}) }}"
   when: docker_disable_default_iptables_rules | bool
 
+- name: Warn about docker default networking
+  debug:
+    msg: >-
+      Docker default network on docker0 will be disabled by default from the
+      Wallaby 12.0.0 release. If you have any non-Kolla containers that need
+      this functionality, you should plan a migration for this change, or set
+      docker_disable_default_network to false.
+  when: not docker_disable_default_network | bool
+
+- name: Disable docker default network on docker0
+  set_fact:
+    docker_config: "{{ docker_config | combine({'bridge': 'none'}) }}"
+  when: docker_disable_default_network | bool
+
+- name: Warn about docker ip_forward
+  debug:
+    msg: >-
+      Docker ip_forward will be disabled by default from the
+      Wallaby 12.0.0 release. If you have any non-Kolla containers that need
+      this functionality, you should plan a migration for this change, or set
+      docker_disable_ip_forward to false.
+  when: not docker_disable_ip_forward | bool
+
+- name: Disable docker ip_forward
+  set_fact:
+    docker_config: "{{ docker_config | combine({'ip-forward': false}) }}"
+  when: docker_disable_ip_forward | bool
+
 - name: Merge custom docker config
   set_fact:
     docker_config: "{{ docker_config | combine(docker_custom_config) }}"
@@ -189,22 +217,25 @@
   when: create_kolla_user | bool
 
 - name: Start docker
-  service:
+  systemd:
     name: docker
     state: started
+    masked: no
   become: True
 
 - name: Restart docker
-  service:
+  systemd:
     name: docker
     state: restarted
+    masked: no
   become: True
   when: docker_configured.changed or docker_reloaded.changed
 
 - name: Enable docker
-  service:
+  systemd:
     name: docker
     enabled: yes
+    masked: no
   become: True
 
 - name: Stop time service
diff --git a/ansible/roles/cinder/templates/cinder.conf.j2 b/ansible/roles/cinder/templates/cinder.conf.j2
index b2e24392f9..aea8206c06 100644
--- a/ansible/roles/cinder/templates/cinder.conf.j2
+++ b/ansible/roles/cinder/templates/cinder.conf.j2
@@ -209,6 +209,7 @@ connection_string = {{ osprofiler_backend_connection_string }}
 {% if enable_barbican | bool %}
 [barbican]
 auth_endpoint = {{ keystone_internal_url }}
+barbican_endpoint_type = internal
 {% endif %}
 
 [coordination]
diff --git a/ansible/roles/common/templates/conf/output/00-local.conf.j2 b/ansible/roles/common/templates/conf/output/00-local.conf.j2
index 169ec735e7..5e2064b29f 100644
--- a/ansible/roles/common/templates/conf/output/00-local.conf.j2
+++ b/ansible/roles/common/templates/conf/output/00-local.conf.j2
@@ -11,7 +11,7 @@
   </store>
 {% if log_direct_to_elasticsearch %}
   <store>
-       type elasticsearch
+       @type elasticsearch
        host {{ elasticsearch_address }}
        port {{ elasticsearch_port }}
        scheme {{ fluentd_elasticsearch_scheme }}
@@ -66,7 +66,7 @@
   </store>
 {% if log_direct_to_elasticsearch %}
   <store>
-       type elasticsearch
+       @type elasticsearch
        host {{ elasticsearch_address }}
        port {{ elasticsearch_port }}
        scheme {{ fluentd_elasticsearch_scheme }}
diff --git a/ansible/roles/glance/templates/glance-api.conf.j2 b/ansible/roles/glance/templates/glance-api.conf.j2
index 3b9a40dceb..4cf588818e 100644
--- a/ansible/roles/glance/templates/glance-api.conf.j2
+++ b/ansible/roles/glance/templates/glance-api.conf.j2
@@ -110,3 +110,9 @@ trace_sqlalchemy = true
 hmac_keys = {{ osprofiler_secret }}
 connection_string = {{ osprofiler_backend_connection_string }}
 {% endif %}
+
+{% if enable_barbican | bool %}
+[barbican]
+auth_endpoint = {{ keystone_internal_url }}
+barbican_endpoint_type = internal
+{% endif %}
diff --git a/ansible/roles/haproxy/tasks/upgrade.yml b/ansible/roles/haproxy/tasks/upgrade.yml
index 17fcbe07c0..6d515fc55c 100644
--- a/ansible/roles/haproxy/tasks/upgrade.yml
+++ b/ansible/roles/haproxy/tasks/upgrade.yml
@@ -16,6 +16,8 @@
   notify:
     - Restart keepalived container
 
+- import_tasks: check-containers.yml
+
 # NOTE(yoctozepto): haproxy role handlers should not be flushed early.
 # site.yml handles all haproxy things in a dedicated play.
 # This is to avoid extra haproxy service restart.
diff --git a/ansible/roles/horizon/tasks/policy_item.yml b/ansible/roles/horizon/tasks/policy_item.yml
index 7e4e814be2..d8a777d207 100644
--- a/ansible/roles/horizon/tasks/policy_item.yml
+++ b/ansible/roles/horizon/tasks/policy_item.yml
@@ -2,7 +2,7 @@
 
 # Update policy file name
 - set_fact:
-    supported_policy_files: "{{ supported_policy_format_list | map('regex_replace', '(.*)', '{{ project_name }}_\\1') | list }}"
+    supported_policy_files: "{{ supported_policy_format_list | map('regex_replace', '(.+)', '{{ project_name }}_\\1') | list }}"
 
 - name: Check if policies shall be overwritten
   local_action: stat path="{{ fullpath }}"
diff --git a/ansible/roles/iscsi/templates/iscsid.json.j2 b/ansible/roles/iscsi/templates/iscsid.json.j2
index f44cf16c97..cfa4d9f358 100644
--- a/ansible/roles/iscsi/templates/iscsid.json.j2
+++ b/ansible/roles/iscsi/templates/iscsid.json.j2
@@ -1,4 +1,4 @@
 {
-    "command": "iscsid -d 8 -f --pid=/run/iscsid.pid",
+    "command": "iscsid -d 8 -f",
     "config_files": []
 }
diff --git a/ansible/roles/mariadb/tasks/recover_cluster.yml b/ansible/roles/mariadb/tasks/recover_cluster.yml
index 0aec1eaa71..f3ee6a90f7 100644
--- a/ansible/roles/mariadb/tasks/recover_cluster.yml
+++ b/ansible/roles/mariadb/tasks/recover_cluster.yml
@@ -73,7 +73,7 @@
       shell:
         cmd: |
           if [[ ! -z {{ hostvars[inventory_hostname]['seqno'] }} && ! -z {{ hostvars[item]['seqno'] }} &&
-          {{ hostvars[inventory_hostname]['seqno'] }} =~ ^[0-9]+$ && {{ hostvars[item]['seqno'] }} =~ ^[0-9]+$ &&
+          {{ hostvars[inventory_hostname]['seqno'] }} =~ ^-?[0-9]+$ && {{ hostvars[item]['seqno'] }} =~ ^-?[0-9]+$ &&
           {{ hostvars[inventory_hostname]['seqno'] }} -lt {{ hostvars[item]['seqno'] }} ]]; then echo {{ hostvars[item]['seqno'] }}; fi
       with_items: "{{ groups['mariadb'] }}"
       register: seqno_compare
diff --git a/ansible/roles/neutron/tasks/config.yml b/ansible/roles/neutron/tasks/config.yml
index 2a8a80d2bb..b3a5e48363 100644
--- a/ansible/roles/neutron/tasks/config.yml
+++ b/ansible/roles/neutron/tasks/config.yml
@@ -136,6 +136,7 @@
     - "Restart {{ item.key }} container"
 
 - name: Copying over sriov_agent.ini
+  become: true
   vars:
     service_name: "neutron-sriov-agent"
     neutron_sriov_agent: "{{ neutron_services[service_name] }}"
diff --git a/ansible/roles/neutron/templates/neutron.conf.j2 b/ansible/roles/neutron/templates/neutron.conf.j2
index 19b07ad2cb..e08240197c 100644
--- a/ansible/roles/neutron/templates/neutron.conf.j2
+++ b/ansible/roles/neutron/templates/neutron.conf.j2
@@ -136,11 +136,6 @@ drivers = ovs
 drivers = ovs
 {% endif %}
 
-{% if enable_octavia | bool %}
-[octavia]
-base_url = {{ internal_protocol }}://{{ octavia_internal_fqdn | put_address_in_context('url') }}:{{ octavia_api_port }}
-{% endif %}
-
 {% if enable_designate | bool %}
 [designate]
 url = {{ internal_protocol }}://{{ designate_internal_fqdn | put_address_in_context('url') }}:{{ designate_api_port }}/v2
diff --git a/ansible/roles/nova-cell/tasks/external_ceph.yml b/ansible/roles/nova-cell/tasks/external_ceph.yml
index f4634801f0..32b63729b8 100644
--- a/ansible/roles/nova-cell/tasks/external_ceph.yml
+++ b/ansible/roles/nova-cell/tasks/external_ceph.yml
@@ -131,6 +131,7 @@
       enabled: "{{ cinder_backend_ceph }}"
   notify:
     - Restart nova-libvirt container
+  no_log: True
 
 - name: Ensuring config directory has correct owner and permission
   become: true
diff --git a/ansible/roles/nova-cell/templates/nova.conf.j2 b/ansible/roles/nova-cell/templates/nova.conf.j2
index b61199ee2a..b798a296fd 100644
--- a/ansible/roles/nova-cell/templates/nova.conf.j2
+++ b/ansible/roles/nova-cell/templates/nova.conf.j2
@@ -231,6 +231,7 @@ connection_string = {{ osprofiler_backend_connection_string }}
 {% if enable_barbican | bool %}
 [barbican]
 auth_endpoint = {{ keystone_internal_url }}
+barbican_endpoint_type = internal
 {% endif %}
 
 {% if nova_compute_virt_type == "xenapi" %}
diff --git a/ansible/roles/nova/templates/nova.conf.j2 b/ansible/roles/nova/templates/nova.conf.j2
index 206be296fe..98cf559a28 100644
--- a/ansible/roles/nova/templates/nova.conf.j2
+++ b/ansible/roles/nova/templates/nova.conf.j2
@@ -197,4 +197,5 @@ connection_string = {{ osprofiler_backend_connection_string }}
 {% if enable_barbican | bool %}
 [barbican]
 auth_endpoint = {{ keystone_internal_url }}
+barbican_endpoint_type = internal
 {% endif %}
diff --git a/ansible/roles/prometheus/templates/prometheus-alertmanager.json.j2 b/ansible/roles/prometheus/templates/prometheus-alertmanager.json.j2
index d10aa8f0cb..562b910758 100644
--- a/ansible/roles/prometheus/templates/prometheus-alertmanager.json.j2
+++ b/ansible/roles/prometheus/templates/prometheus-alertmanager.json.j2
@@ -1,5 +1,5 @@
 {
-    "command": "/opt/prometheus_alertmanager/alertmanager --config.file=/etc/prometheus/alertmanager.yml --web.listen-address={{ api_interface_address | put_address_in_context('url') }}:{{ prometheus_alertmanager_port }} --web.external-url={{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ prometheus_alertmanager_port }} {% if groups["prometheus-alertmanager"] | length > 1 %} --cluster.listen-address={{ api_interface_address | put_address_in_context('url') }}:{{ prometheus_alertmanager_cluster_port }} {% for host in groups["prometheus-alertmanager"] %} --cluster.peer={{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_alertmanager_cluster_port'] }}{% endfor %}{% endif %} --storage.path /var/lib/prometheus",
+    "command": "/opt/prometheus_alertmanager/alertmanager --config.file=/etc/prometheus/alertmanager.yml --web.listen-address={{ api_interface_address | put_address_in_context('url') }}:{{ prometheus_alertmanager_port }} --web.external-url={{ internal_protocol }}://{{ kolla_internal_fqdn | put_address_in_context('url') }}:{{ prometheus_alertmanager_port }} --cluster.listen-address={% if groups["prometheus-alertmanager"] | length > 1 %}{{ api_interface_address | put_address_in_context('url') }}:{{ prometheus_alertmanager_cluster_port }} {% for host in groups["prometheus-alertmanager"] %} --cluster.peer={{ 'api' | kolla_address(host) | put_address_in_context('url') }}:{{ hostvars[host]['prometheus_alertmanager_cluster_port'] }}{% endfor %}{% endif %} --storage.path /var/lib/prometheus",
     "config_files": [
         {
             "source": "{{ container_config_directory }}/prometheus-alertmanager.yml",
diff --git a/ansible/roles/rabbitmq/handlers/main.yml b/ansible/roles/rabbitmq/handlers/main.yml
index f3b78de856..cd5e39eb57 100644
--- a/ansible/roles/rabbitmq/handlers/main.yml
+++ b/ansible/roles/rabbitmq/handlers/main.yml
@@ -1,5 +1,19 @@
 ---
-- name: Restart rabbitmq container
+# NOTE(mgoddard): These tasks perform a 'full stop upgrade', which is necessary when moving between
+# major releases. In future kolla-ansible releases we may be able to change this to a rolling
+# restart. For info on this process see https://www.rabbitmq.com/upgrade.html
+
+- name: Restart first rabbitmq container
+  vars:
+    service_name: "rabbitmq"
+    service: "{{ rabbitmq_services[service_name] }}"
+  include_tasks: 'restart_services.yml'
+  when:
+    - kolla_action != "config"
+    - inventory_hostname == groups[service.group] | first
+  listen: Restart rabbitmq container
+
+- name: Restart remaining rabbitmq containers
   vars:
     service_name: "rabbitmq"
     service: "{{ rabbitmq_services[service_name] }}"
@@ -7,4 +21,6 @@
   when:
     - kolla_action != "config"
     - inventory_hostname == item
+    - inventory_hostname != groups[service.group] | first
   loop: "{{ groups[service.group] }}"
+  listen: Restart rabbitmq container
diff --git a/ansible/roles/swift/templates/proxy-server.conf.j2 b/ansible/roles/swift/templates/proxy-server.conf.j2
index 958b4bf535..4845ae402b 100644
--- a/ansible/roles/swift/templates/proxy-server.conf.j2
+++ b/ansible/roles/swift/templates/proxy-server.conf.j2
@@ -98,5 +98,5 @@ use = egg:swift#s3api
 
 [filter:s3token]
 use = egg:swift#s3token
-www_authenticate_uri = {{ keystone_internal_url }}/v3
+auth_uri = {{ keystone_internal_url }}/v3
 {% endif %}
diff --git a/doc/source/admin/advanced-configuration.rst b/doc/source/admin/advanced-configuration.rst
index 4834e891c7..45767d417e 100644
--- a/doc/source/admin/advanced-configuration.rst
+++ b/doc/source/admin/advanced-configuration.rst
@@ -265,27 +265,34 @@ operator needs to create ``/etc/kolla/config/global.conf`` with content:
    [database]
    max_pool_size = 100
 
-In case the operators want to customize ``policy.json`` file, they should
-create a full policy file for specific project in the same directory like above
-and Kolla will overwrite default policy file with it. Be aware, with some
-projects are keeping full policy file in source code, operators just need to
-copy it but with some others are defining default rules in codebase, they have
-to generate it.
+OpenStack policy customisation
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-For example to overwrite ``policy.json`` file of Neutron project, the operator
-needs to grab ``policy.json`` from Neutron project source code, update rules
-and then put it to ``/etc/kolla/config/neutron/policy.json``.
+OpenStack services allow customisation of policy. Since the Queens release,
+default policy configuration is defined within the source code for each
+service, meaning that operators only need to override rules they wish to
+change. Projects typically provide documentation on their default policy
+configuration, for example, :keystone-doc:`Keystone <configuration/policy>`.
 
-.. note::
+Policy can be customised via JSON or YAML files. As of the Wallaby release, the
+JSON format is deprecated in favour of YAML. One major benefit of YAML is that
+it allows for the use of comments.
 
-   Currently kolla-ansible only support JSON and YAML format for policy file.
+For example, to customise the Neutron policy in YAML format, the operator
+should add the customised rules in ``/etc/kolla/config/neutron/policy.yaml``.
 
-The operator can make these changes after services were already deployed by
-using following command:
+The operator can make these changes after services have been deployed by using
+the following command:
 
 .. code-block:: console
 
-   kolla-ansible reconfigure
+   kolla-ansible deploy
+
+In order to present a user with the correct interface, Horizon includes policy
+for other services. Customisations made to those services may need to be
+replicated in Horizon. For example, to customise the Neutron policy in YAML
+format for Horizon, the operator should add the customised rules in
+``/etc/kolla/config/horizon/neutron_policy.yaml``.
 
 IP Address Constrained Environments
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/doc/source/user/centos8.rst b/doc/source/user/centos8.rst
index fb1457f643..2b5586974c 100644
--- a/doc/source/user/centos8.rst
+++ b/doc/source/user/centos8.rst
@@ -52,8 +52,8 @@ is to differentiate CentOS 7 and CentOS 8 container images.
 Migrating from CentOS 7 to CentOS 8
 -----------------------------------
 
-This section describes how to migrate an existing deployment from CentOS 7 to
-CentOS 8.
+This section describes how to migrate an existing Train deployment from CentOS
+7 to CentOS 8.
 
 There is no supported upgrade path from CentOS 7 to CentOS 8. Since we want to
 use the same major versions of CentOS in the host and containers, the hosts
@@ -65,8 +65,8 @@ level workflow is:
 * upgrade services to ensure compatibility with those available in CentOS 8
 * migrate hosts to CentOS 8 in batches
 
-Note that in a multi-node system it is possible to have a mix of CentOS 7 and
-CentOS 8 hosts while the migration takes place.
+Note that in a multi-node system on the Train release it is possible to have a
+mix of CentOS 7 and CentOS 8 hosts while the migration takes place.
 
 Service compatibility
 ~~~~~~~~~~~~~~~~~~~~~
diff --git a/doc/source/user/multinode.rst b/doc/source/user/multinode.rst
index 030faac25f..af0ef031c2 100644
--- a/doc/source/user/multinode.rst
+++ b/doc/source/user/multinode.rst
@@ -75,7 +75,7 @@ IP address and port on which the registry is listening:
 
    docker_custom_config:
      registry-mirrors:
-       - 192.168.1.100:4000
+       - http://192.168.1.100:4000
 
 .. _edit-inventory:
 
diff --git a/doc/source/user/quickstart.rst b/doc/source/user/quickstart.rst
index dab12be6e1..7f3d63e48e 100644
--- a/doc/source/user/quickstart.rst
+++ b/doc/source/user/quickstart.rst
@@ -98,11 +98,12 @@ If not installing Kolla Ansible in a virtual environment, skip this section.
    The virtual environment should be activated before running any commands that
    depend on packages installed in it.
 
-#. Ensure the latest version of pip is installed:
+#. Ensure the latest version of pip and setuptools are installed:
 
    .. code-block:: console
 
       pip install -U pip
+      pip install -U setuptools
 
 #. Install `Ansible <http://www.ansible.com>`__. Currently, Kolla Ansible
    requires Ansible 2.6 to 2.9.
@@ -130,11 +131,12 @@ If installing Kolla Ansible in a virtual environment, skip this section.
 
       sudo apt-get install python-pip
 
-#. Ensure the latest version of pip is installed:
+#. Ensure the latest version of pip and setuptools are installed:
 
    .. code-block:: console
 
       sudo pip install -U pip
+      sudo pip install -U setuptools
 
 #. Install `Ansible <http://www.ansible.com>`__. Currently, Kolla Ansible
    requires Ansible 2.6 to 2.9.
diff --git a/doc/source/user/virtual-environments.rst b/doc/source/user/virtual-environments.rst
index 8af28527f9..5de5a11c2f 100644
--- a/doc/source/user/virtual-environments.rst
+++ b/doc/source/user/virtual-environments.rst
@@ -21,6 +21,7 @@ python virtual environment on the Ansible control host. For example:
    virtualenv /path/to/venv
    source /path/to/venv/bin/activate
    pip install -U pip
+   pip install -U setuptools
    pip install kolla-ansible
    deactivate
 
diff --git a/releasenotes/notes/bug-1862765-a6cad9fd2d3f0f48.yaml b/releasenotes/notes/bug-1862765-a6cad9fd2d3f0f48.yaml
new file mode 100644
index 0000000000..52f899dbc0
--- /dev/null
+++ b/releasenotes/notes/bug-1862765-a6cad9fd2d3f0f48.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Fix the issue when Swift deployed with S3 Token Middleware enabled.
+    Fixes `LP#1862765 <https://bugs.launchpad.net/kolla-ansible/+bug/1862765>`__
diff --git a/releasenotes/notes/bug-1923203-f9ff247befc4bd75.yaml b/releasenotes/notes/bug-1923203-f9ff247befc4bd75.yaml
new file mode 100644
index 0000000000..6073ed7b15
--- /dev/null
+++ b/releasenotes/notes/bug-1923203-f9ff247befc4bd75.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixed an issue when Docker was configured after startup on Debian/Ubuntu,
+    which resulted in iptables rules being created - before they were disabled.
+    `LP#1923203 <https://launchpad.net/bugs/1923203>`__
diff --git a/releasenotes/notes/bug-1923467-80973d9fbe1f5287.yaml b/releasenotes/notes/bug-1923467-80973d9fbe1f5287.yaml
new file mode 100644
index 0000000000..df5a3a7462
--- /dev/null
+++ b/releasenotes/notes/bug-1923467-80973d9fbe1f5287.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    A bug where sriov_agent.ini wasn't copied due to ``Permission denied``
+    error was fixed.
+    `LP#1923467 <https://launchpad.net/bugs/1923467>`__
diff --git a/releasenotes/notes/bug-1928915-482b2d53bb2a4d92.yaml b/releasenotes/notes/bug-1928915-482b2d53bb2a4d92.yaml
new file mode 100644
index 0000000000..a009da5955
--- /dev/null
+++ b/releasenotes/notes/bug-1928915-482b2d53bb2a4d92.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixed an issue where docker python SDK 5.0.0 was failing due to missing
+    six - introduced a constraint to install version lower than 5.x.
+    `LP#1928915 <https://launchpad.net/bugs/1928915>`__
diff --git a/releasenotes/notes/bug-1930293-d8a524f2070e6779.yaml b/releasenotes/notes/bug-1930293-d8a524f2070e6779.yaml
new file mode 100644
index 0000000000..f16c156556
--- /dev/null
+++ b/releasenotes/notes/bug-1930293-d8a524f2070e6779.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Fixes more-than-2-node RabbitMQ upgrade failing randomly.
+    `LP#1930293 <https://launchpad.net/bugs/1930293>`__.
diff --git a/releasenotes/notes/bug-1933033-76746d127285cfe8.yaml b/releasenotes/notes/bug-1933033-76746d127285cfe8.yaml
new file mode 100644
index 0000000000..88e4789cca
--- /dev/null
+++ b/releasenotes/notes/bug-1933033-76746d127285cfe8.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixes ``iscsid`` failing in current CentOS 8 based images due to
+    pid file being needlessly set.
+    `LP#1933033 <https://launchpad.net/bugs/1933033>`__
diff --git a/releasenotes/notes/disable-alertmanager-clustering-ec70f5f970c4933a.yaml b/releasenotes/notes/disable-alertmanager-clustering-ec70f5f970c4933a.yaml
new file mode 100644
index 0000000000..2fc3503a11
--- /dev/null
+++ b/releasenotes/notes/disable-alertmanager-clustering-ec70f5f970c4933a.yaml
@@ -0,0 +1,7 @@
+---
+fixes:
+  - |
+    Fixes potential issue with Alertmanger in non-HA deployments. In this
+    scenario, peer gossip protocol is now disabled and Alertmanager won't
+    try to form a cluster with non-existing other instances.
+    `LP#1926463 <https://bugs.launchpad.net/kolla-ansible/+bug/1926463>`__
diff --git a/releasenotes/notes/docker-disable-bridge-14df8b7fddbd5000.yaml b/releasenotes/notes/docker-disable-bridge-14df8b7fddbd5000.yaml
new file mode 100644
index 0000000000..23ab9632a9
--- /dev/null
+++ b/releasenotes/notes/docker-disable-bridge-14df8b7fddbd5000.yaml
@@ -0,0 +1,9 @@
+---
+features:
+  - |
+    Adds a new flag, ``docker_disable_default_network``, which
+    defaults to ``no``. Docker is using ``172.17.0.0/16`` by default for bridge
+    networking on ``docker0``, and this might cause routing problems for
+    operator networks. Setting this flag to ``yes`` will disable Docker's
+    bridge networking. This feature will be enabled by default from the
+    Wallaby 12.0.0 release.
diff --git a/releasenotes/notes/docker-disable-ip-forward-b0490b71f9f07cd6.yaml b/releasenotes/notes/docker-disable-ip-forward-b0490b71f9f07cd6.yaml
new file mode 100644
index 0000000000..025a53ba10
--- /dev/null
+++ b/releasenotes/notes/docker-disable-ip-forward-b0490b71f9f07cd6.yaml
@@ -0,0 +1,9 @@
+---
+fixes:
+  - |
+    Adds a new flag, ``docker_disable_ip_forward``, which
+    defaults to ``no`` and can be used (by setting ``yes``) to
+    disable docker's ``ip-forward`` option which makes docker set
+    ``net.ipv4.ip_forward`` sysctl to ``1``.
+    This is to protect from creating all-forwarding hosts.
+    `LP#1931615 <https://launchpad.net/bugs/1931615>`__
diff --git a/releasenotes/notes/fix-keepalived-upgrade-a395e39dc946e618.yaml b/releasenotes/notes/fix-keepalived-upgrade-a395e39dc946e618.yaml
new file mode 100644
index 0000000000..f499cc5a22
--- /dev/null
+++ b/releasenotes/notes/fix-keepalived-upgrade-a395e39dc946e618.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixes an issue with keepalived which was not recreated during an upgrade if
+    configuration is unchanged. `LP#1928362
+    <https://bugs.launchpad.net/kolla-ansible/+bug/1928362>`__
diff --git a/tests/deploy-bifrost.sh b/tests/deploy-bifrost.sh
index 86e3d15363..1a3a414d59 100755
--- a/tests/deploy-bifrost.sh
+++ b/tests/deploy-bifrost.sh
@@ -14,7 +14,7 @@ function deploy_bifrost {
     # Deploy the bifrost container.
     # TODO(mgoddard): add pull action when we have a local registry service in
     # CI.
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv deploy-bifrost &> /tmp/logs/ansible/deploy-bifrost
+    kolla-ansible -i ${RAW_INVENTORY} -vvv deploy-bifrost &> /tmp/logs/ansible/deploy-bifrost
 }
 
 
diff --git a/tests/deploy.sh b/tests/deploy.sh
index 18861e9336..a413854a2a 100755
--- a/tests/deploy.sh
+++ b/tests/deploy.sh
@@ -16,12 +16,11 @@ function deploy {
     #TODO(inc0): Post-deploy complains that /etc/kolla is not writable. Probably we need to include become there
     sudo chmod -R 777 /etc/kolla
     # Actually do the deployment
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv prechecks &> /tmp/logs/ansible/deploy-prechecks
-    # TODO(jeffrey4l): add pull action when we have a local registry
-    # service in CI
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv deploy &> /tmp/logs/ansible/deploy
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv post-deploy &> /tmp/logs/ansible/post-deploy
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv check &> /tmp/logs/ansible/check-deploy
+    kolla-ansible -i ${RAW_INVENTORY} -vvv prechecks &> /tmp/logs/ansible/deploy-prechecks
+    kolla-ansible -i ${RAW_INVENTORY} -vvv pull &> /tmp/logs/ansible/pull
+    kolla-ansible -i ${RAW_INVENTORY} -vvv deploy &> /tmp/logs/ansible/deploy
+    kolla-ansible -i ${RAW_INVENTORY} -vvv post-deploy &> /tmp/logs/ansible/post-deploy
+    kolla-ansible -i ${RAW_INVENTORY} -vvv check &> /tmp/logs/ansible/check-deploy
 }
 
 
diff --git a/tests/post.yml b/tests/post.yml
index 400cf3c365..5f0eb18059 100644
--- a/tests/post.yml
+++ b/tests/post.yml
@@ -46,27 +46,3 @@
         mode: pull
         rsync_opts:
           - "--quiet"
-
-- hosts: primary
-  environment:
-    PATH: "{{ ansible_env.HOME + '/.local/bin:' + ansible_env.PATH }}"
-  tasks:
-    - name: check for existence of ara sqlite
-      stat:
-        path: "{{ ansible_env.HOME }}/.ara/ansible.sqlite"
-      register: ara_stat_result
-
-    - block:
-        - name: ensure ara-report folder existence
-          file:
-            path: "{{ zuul.executor.log_root }}/{{ inventory_hostname }}/ara-report"
-            state: directory
-          delegate_to: localhost
-          run_once: true
-
-        - name: download ara sqlite
-          synchronize:
-            src: "{{ ansible_env.HOME }}/.ara/ansible.sqlite"
-            dest: "{{ zuul.executor.log_root }}/{{ inventory_hostname }}/ara-report/"
-            mode: pull
-      when: ara_stat_result.stat.exists
diff --git a/tests/pre.yml b/tests/pre.yml
index 339994c4b1..1d00c6f217 100644
--- a/tests/pre.yml
+++ b/tests/pre.yml
@@ -3,6 +3,8 @@
   any_errors_fatal: true
   vars:
     logs_dir: "/tmp/logs"
+    # NOTE(mgoddard): Use Python 3 only for CentOS 8 on stable/train.
+    playbook_python_version: "{{ '3' if ansible_os_family == 'RedHat' and ansible_distribution_major_version == '8' else '2' }}"
   roles:
     - bindep
     - multi-node-firewall
@@ -65,9 +67,9 @@
 
     - name: Ensure latest pip is installed
       become: true
-      pip:
-        name: pip<21
-        state: latest
+      command: >-
+        python{{ playbook_python_version }} -m pip install --upgrade
+        pip<21
 
     - name: Ensure /tmp/logs/ dir
       file:
diff --git a/tests/reconfigure.sh b/tests/reconfigure.sh
index db0854cff7..d513eb3efe 100755
--- a/tests/reconfigure.sh
+++ b/tests/reconfigure.sh
@@ -12,9 +12,9 @@ function reconfigure {
 
     # TODO(jeffrey4l): make some configure file change and
     # trigger a real reconfigure
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv prechecks &> /tmp/logs/ansible/reconfigure-prechecks
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv reconfigure &> /tmp/logs/ansible/reconfigure
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv check &> /tmp/logs/ansible/check-reconfigure
+    kolla-ansible -i ${RAW_INVENTORY} -vvv prechecks &> /tmp/logs/ansible/reconfigure-prechecks
+    kolla-ansible -i ${RAW_INVENTORY} -vvv reconfigure &> /tmp/logs/ansible/reconfigure
+    kolla-ansible -i ${RAW_INVENTORY} -vvv check &> /tmp/logs/ansible/check-reconfigure
 }
 
 
diff --git a/tests/run.yml b/tests/run.yml
index 72cdc095aa..5a6a5cae7c 100644
--- a/tests/run.yml
+++ b/tests/run.yml
@@ -162,6 +162,13 @@
         state: directory
       become: true
 
+    # Workaround for distutils.errors.DistutilsError: Could not find suitable
+    # distribution for Requirement.parse('pbr>=2.0.0') in the next task
+    - name: ensure setuptools is updated
+      command: >-
+        python{{ playbook_python_version }} -m pip install --user --upgrade
+        setuptools
+
     - name: install kolla-ansible and dependencies
       vars:
         # Test latest ansible version on Ubuntu and CentOS 8, minimum supported on others.
@@ -169,25 +176,11 @@
           {{ base_distro == 'ubuntu' or
              (base_distro == 'centos' and groups['all'] | map('extract', hostvars, 'ansible_distribution_major_version') | map('int') | list | max == 8) }}
         ansible_version_constraint: "{{ '<2.10,!=2.9.12' if ansible_version_latest else '<2.7' }}"
-      pip:
-        name:
-          - "{{ kolla_ansible_src_dir }}"
-          - "ansible{{ ansible_version_constraint }}"
-          - "ara<1.0.0"
-          # NOTE(mgoddard): pyfakefs 4.0.0 dropped support for Python 2.
-          - "pyfakefs{% if playbook_python_version == '2' %}<4{% endif %}"
-          # NOTE(yoctozepto): alembic 1.5.0 dropped support for SQLAlchemy 1.2.
-          # This does not affect Python 3 where pip uses the new resolver.
-          - "alembic{% if playbook_python_version == '2' %}<1.5{% endif %}"
-        # TODO(mgoddard): Always use pip3 when previous_release is ussuri.
-        executable: "pip{{ playbook_python_version }}"
-        extra_args: "-c {{ upper_constraints_file }} --user"
-
-    # TODO(mgoddard): Always use python3 when previous_release is ussuri.
-    - name: get ARA callback plugin path
-      command: "python{{ playbook_python_version }} -m ara.setup.callback_plugins"
-      changed_when: false
-      register: ara_callback_plugins
+      command: >-
+        python{{ playbook_python_version }} -m pip install --user
+        -c {{ upper_constraints_file }}
+        {{ kolla_ansible_src_dir }}
+        ansible{{ ansible_version_constraint }}
 
     - name: template ansible.cfg
       template:
@@ -426,10 +419,10 @@
           when: item.when | default(true)
 
         - name: upgrade kolla-ansible
-          pip:
-            name: "{{ kolla_ansible_src_dir }}"
-            executable: "pip{{ playbook_python_version }}"
-            extra_args: "-c {{ upper_constraints_file }} --user"
+          command: >-
+            python{{ playbook_python_version }} -m pip install --user
+            -c {{ upper_constraints_file }}
+            {{ kolla_ansible_src_dir }}
 
         # Update passwords.yml to include any new passwords added in this
         # release.
diff --git a/tests/setup_gate.sh b/tests/setup_gate.sh
deleted file mode 120000
index fbacb3f920..0000000000
--- a/tests/setup_gate.sh
+++ /dev/null
@@ -1 +0,0 @@
-../tools/setup_gate.sh
\ No newline at end of file
diff --git a/tests/setup_gate.sh b/tests/setup_gate.sh
new file mode 100755
index 0000000000..2eaecaadd1
--- /dev/null
+++ b/tests/setup_gate.sh
@@ -0,0 +1,141 @@
+#!/bin/bash
+
+set -o xtrace
+set -o errexit
+set -o pipefail
+
+# Enable unbuffered output for Ansible in Jenkins.
+export PYTHONUNBUFFERED=1
+
+
+function setup_openstack_clients {
+    # Prepare virtualenv for openstack deployment tests
+    local packages=(python-openstackclient python-heatclient)
+    if [[ $SCENARIO == zun ]]; then
+        packages+=(python-zunclient)
+    fi
+    if [[ $SCENARIO == ironic ]]; then
+        packages+=(python-ironicclient)
+    fi
+    if [[ $SCENARIO == masakari ]]; then
+        packages+=(python-masakariclient)
+    fi
+    if [[ $SCENARIO == scenario_nfv ]]; then
+        packages+=(python-tackerclient python-barbicanclient python-mistralclient)
+    fi
+    virtualenv ~/openstackclient-venv
+    ~/openstackclient-venv/bin/pip install -U pip
+    ~/openstackclient-venv/bin/pip install -U setuptools
+    ~/openstackclient-venv/bin/pip install -c $UPPER_CONSTRAINTS ${packages[@]}
+}
+
+function prepare_images {
+    if [[ "${BUILD_IMAGE}" == "False" ]]; then
+        return
+    fi
+
+    if [[ $SCENARIO != "bifrost" ]]; then
+        GATE_IMAGES="^cron,^fluentd,^glance,^haproxy,^keepalived,^keystone,^kolla-toolbox,^mariadb,^memcached,^neutron,^nova-,^openvswitch,^rabbitmq,^horizon,^chrony,^heat,^placement"
+    else
+        GATE_IMAGES="bifrost"
+    fi
+
+    if [[ $SCENARIO == "ceph" ]]; then
+        GATE_IMAGES+=",^ceph,^cinder"
+    fi
+
+    if [[ $SCENARIO == "zun" ]]; then
+        GATE_IMAGES+=",^zun,^kuryr,^etcd,^cinder,^iscsid"
+        if [[ $BASE_DISTRO != "centos" ]] || [[ $BASE_DISTRO_MAJOR_VERSION -eq 7 ]]; then
+            GATE_IMAGES+=",^tgtd"
+        fi
+    fi
+
+    if [[ $SCENARIO == "scenario_nfv" ]]; then
+        GATE_IMAGES+=",^tacker,^mistral,^redis,^barbican"
+    fi
+    if [[ $SCENARIO == "ironic" ]]; then
+        GATE_IMAGES+=",^dnsmasq,^ironic,^iscsid"
+    fi
+    if [[ $SCENARIO == "masakari" ]]; then
+        GATE_IMAGES+=",^masakari"
+    fi
+
+    if [[ $SCENARIO == "swift" ]]; then
+        GATE_IMAGES+=",^swift"
+    fi
+
+    if [[ $SCENARIO == "mariadb" ]]; then
+        GATE_IMAGES="^cron,^haproxy,^keepalived,^kolla-toolbox,^mariadb"
+    fi
+
+    if [[ $SCENARIO == "prometheus-efk" ]]; then
+        GATE_IMAGES="^cron,^elasticsearch,^fluentd,^grafana,^haproxy,^keepalived,^kibana,^kolla-toolbox,^mariadb,^memcached,^prometheus,^rabbitmq"
+    fi
+
+    # NOTE(yoctozepto): we cannot build and push at the same time on debian
+    # buster see https://github.com/docker/for-linux/issues/711.
+    PUSH="true"
+    if [[ "debian" == $BASE_DISTRO ]]; then
+        PUSH="false"
+    fi
+
+    sudo tee /etc/kolla/kolla-build.conf <<EOF
+[DEFAULT]
+namespace = lokolla
+base = ${BASE_DISTRO}
+install_type = ${INSTALL_TYPE}
+tag = ${TAG}
+profile = gate
+registry = 127.0.0.1:4000
+push = ${PUSH}
+logs_dir = /tmp/logs/build
+template_override = /etc/kolla/template_overrides.j2
+EOF
+
+    # TODO(mgoddard): Remove this if block when CentOS 7 is no longer
+    # supported.
+    if [[ $BASE_DISTRO == "centos" ]] && [[ $BASE_DISTRO_MAJOR_VERSION -eq 8 ]]; then
+        sudo tee -a /etc/kolla/kolla-build.conf <<EOF
+base_tag = 8
+EOF
+    fi
+
+    sudo tee -a /etc/kolla/kolla-build.conf <<EOF
+[profiles]
+gate = ${GATE_IMAGES}
+EOF
+
+    mkdir -p /tmp/logs/build
+
+    sudo docker run -d -p 4000:5000 --restart=always -v /opt/kolla_registry/:/var/lib/registry --name registry registry:2
+
+    virtualenv ~/kolla-venv
+    . ~/kolla-venv/bin/activate
+
+    # Install newest setuptools to avoid issues on Python 2
+    pip install -U pip
+    pip install -U setuptools
+
+    pip install -c $UPPER_CONSTRAINTS "${KOLLA_SRC_DIR}"
+
+    sudo ~/kolla-venv/bin/kolla-build
+
+    # NOTE(yoctozepto): due to debian buster we push after images are built
+    # see https://github.com/docker/for-linux/issues/711
+    if [[ "debian" == $BASE_DISTRO ]]; then
+        for img in $(sudo docker image ls --format '{{ .Repository }}:{{ .Tag }}' | grep lokolla/); do
+            sudo docker push $img;
+        done
+    fi
+
+    deactivate
+}
+
+
+setup_openstack_clients
+
+RAW_INVENTORY=/etc/kolla/inventory
+kolla-ansible -i ${RAW_INVENTORY} -e ansible_user=$USER -vvv bootstrap-servers &> /tmp/logs/ansible/bootstrap-servers
+
+prepare_images
diff --git a/tests/templates/ansible.cfg.j2 b/tests/templates/ansible.cfg.j2
index 256a2efd70..49bbcdf40c 100644
--- a/tests/templates/ansible.cfg.j2
+++ b/tests/templates/ansible.cfg.j2
@@ -1,6 +1,6 @@
 [defaults]
-callback_plugins = {{ ara_callback_plugins.stdout }}
 host_key_checking = False
 
 [ssh_connection]
 pipelining = True
+retries = 3
diff --git a/tests/test-mariadb.sh b/tests/test-mariadb.sh
index 6d26e994a5..5fbccd7bae 100755
--- a/tests/test-mariadb.sh
+++ b/tests/test-mariadb.sh
@@ -11,7 +11,7 @@ export PYTHONUNBUFFERED=1
 
 function mariadb_stop {
     echo "Stopping the database cluster"
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv stop --yes-i-really-really-mean-it --tags mariadb --skip-tags common
+    kolla-ansible -i ${RAW_INVENTORY} -vvv stop --yes-i-really-really-mean-it --tags mariadb --skip-tags common
     if [[ $(sudo docker ps -q | grep mariadb | wc -l) -ne 0 ]]; then
         echo "Failed to stop MariaDB cluster"
         return 1
@@ -21,7 +21,7 @@ function mariadb_stop {
 function mariadb_recovery {
     # Recover the database cluster.
     echo "Recovering the database cluster"
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv mariadb_recovery --tags mariadb --skip-tags common
+    kolla-ansible -i ${RAW_INVENTORY} -vvv mariadb_recovery --tags mariadb --skip-tags common
 }
 
 function test_recovery {
diff --git a/tests/upgrade-bifrost.sh b/tests/upgrade-bifrost.sh
index 72966166a4..c50c921ee0 100755
--- a/tests/upgrade-bifrost.sh
+++ b/tests/upgrade-bifrost.sh
@@ -15,7 +15,7 @@ function upgrade_bifrost {
     # CI.
     # TODO(mgoddard): make some configuration file changes and trigger a real
     # upgrade.
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv deploy-bifrost &> /tmp/logs/ansible/upgrade-bifrost
+    kolla-ansible -i ${RAW_INVENTORY} -vvv deploy-bifrost &> /tmp/logs/ansible/upgrade-bifrost
 }
 
 
diff --git a/tests/upgrade.sh b/tests/upgrade.sh
index c0ce10e441..a3a608f0da 100755
--- a/tests/upgrade.sh
+++ b/tests/upgrade.sh
@@ -10,10 +10,10 @@ export PYTHONUNBUFFERED=1
 function upgrade {
     RAW_INVENTORY=/etc/kolla/inventory
 
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv prechecks &> /tmp/logs/ansible/upgrade-prechecks
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv pull &> /tmp/logs/ansible/pull-upgrade
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv upgrade &> /tmp/logs/ansible/upgrade
-    tools/kolla-ansible -i ${RAW_INVENTORY} -vvv check &> /tmp/logs/ansible/check-upgrade
+    kolla-ansible -i ${RAW_INVENTORY} -vvv prechecks &> /tmp/logs/ansible/upgrade-prechecks
+    kolla-ansible -i ${RAW_INVENTORY} -vvv pull &> /tmp/logs/ansible/pull-upgrade
+    kolla-ansible -i ${RAW_INVENTORY} -vvv upgrade &> /tmp/logs/ansible/upgrade
+    kolla-ansible -i ${RAW_INVENTORY} -vvv check &> /tmp/logs/ansible/check-upgrade
 }
 
 
diff --git a/tools/kolla-ansible b/tools/kolla-ansible
index 077d3a71b8..ab23a8542c 100755
--- a/tools/kolla-ansible
+++ b/tools/kolla-ansible
@@ -22,6 +22,7 @@ function check_environment_coherence {
     local ansible_python_cmdline
     # NOTE(yoctozepto): may have multiple parts
     ansible_python_cmdline=${ansible_shebang_line#\#\!}
+    ansible_python_version=$($ansible_python_cmdline -c 'import sys; print(str(sys.version_info[0])+"."+str(sys.version_info[1]))')
 
     if ! $ansible_python_cmdline --version &>/dev/null; then
         echo "ERROR: Ansible Python is not functional." >&2
@@ -66,21 +67,38 @@ function check_environment_coherence {
 
 function find_base_dir {
     local dir_name
+    local python_dir
     dir_name=$(dirname "$0")
     # NOTE(yoctozepto): Fix the case where dir_name is a symlink and VIRTUAL_ENV might not be. This
     # happens with pyenv-virtualenv, see https://bugs.launchpad.net/kolla-ansible/+bug/1903887
     dir_name=$(readlink -e "$dir_name")
+    python_dir="python${ansible_python_version}"
     if [ -z "$SNAP" ]; then
         if [[ ${dir_name} == "/usr/bin" ]]; then
-            BASEDIR=/usr/share/kolla-ansible
+            if test -f /usr/lib/${python_dir}/*-packages/kolla-ansible.egg-link; then
+                # Editable install.
+                BASEDIR="$(head -n1 /usr/lib/${python_dir}/*-packages/kolla-ansible.egg-link)"
+            else
+                BASEDIR=/usr/share/kolla-ansible
+            fi
         elif [[ ${dir_name} == "/usr/local/bin" ]]; then
-            BASEDIR=/usr/local/share/kolla-ansible
+            if test -f /usr/local/lib/${python_dir}/*-packages/kolla-ansible.egg-link; then
+                # Editable install.
+                BASEDIR="$(head -n1 /usr/local/lib/${python_dir}/*-packages/kolla-ansible.egg-link)"
+            else
+                BASEDIR=/usr/local/share/kolla-ansible
+            fi
         elif [[ ${dir_name} == ~/.local/bin ]]; then
-            BASEDIR=~/.local/share/kolla-ansible
+            if test -f ~/.local/lib/${python_dir}/*-packages/kolla-ansible.egg-link; then
+                # Editable install.
+                BASEDIR="$(head -n1 ~/.local/lib/${python_dir}/*-packages/kolla-ansible.egg-link)"
+            else
+                BASEDIR=~/.local/share/kolla-ansible
+            fi
         elif [[ -n ${VIRTUAL_ENV} ]] && [[ ${dir_name} == "$(readlink -e "${VIRTUAL_ENV}/bin")" ]]; then
-            if test -f ${VIRTUAL_ENV}/lib/python*/site-packages/kolla-ansible.egg-link; then
+            if test -f ${VIRTUAL_ENV}/lib/${python_dir}/site-packages/kolla-ansible.egg-link; then
                 # Editable install.
-                BASEDIR="$(head -n1 ${VIRTUAL_ENV}/lib/python*/site-packages/kolla-ansible.egg-link)"
+                BASEDIR="$(head -n1 ${VIRTUAL_ENV}/lib/${python_dir}/*-packages/kolla-ansible.egg-link)"
             else
                 BASEDIR="${VIRTUAL_ENV}/share/kolla-ansible"
             fi
diff --git a/tools/setup_gate.sh b/tools/setup_gate.sh
deleted file mode 100755
index 8fb9882021..0000000000
--- a/tools/setup_gate.sh
+++ /dev/null
@@ -1,136 +0,0 @@
-#!/bin/bash
-
-set -o xtrace
-set -o errexit
-set -o pipefail
-
-# Enable unbuffered output for Ansible in Jenkins.
-export PYTHONUNBUFFERED=1
-
-
-function setup_openstack_clients {
-    # Prepare virtualenv for openstack deployment tests
-    local packages=(python-openstackclient python-heatclient)
-    if [[ $SCENARIO == zun ]]; then
-        packages+=(python-zunclient)
-    fi
-    if [[ $SCENARIO == ironic ]]; then
-        packages+=(python-ironicclient)
-    fi
-    if [[ $SCENARIO == masakari ]]; then
-        packages+=(python-masakariclient)
-    fi
-    if [[ $SCENARIO == scenario_nfv ]]; then
-        packages+=(python-tackerclient python-barbicanclient python-mistralclient)
-    fi
-    virtualenv ~/openstackclient-venv
-    ~/openstackclient-venv/bin/pip install -U pip
-    ~/openstackclient-venv/bin/pip install -c $UPPER_CONSTRAINTS ${packages[@]}
-}
-
-function prepare_images {
-    if [[ "${BUILD_IMAGE}" == "False" ]]; then
-        return
-    fi
-
-    if [[ $SCENARIO != "bifrost" ]]; then
-        GATE_IMAGES="^cron,^fluentd,^glance,^haproxy,^keepalived,^keystone,^kolla-toolbox,^mariadb,^memcached,^neutron,^nova-,^openvswitch,^rabbitmq,^horizon,^chrony,^heat,^placement"
-    else
-        GATE_IMAGES="bifrost"
-    fi
-
-    if [[ $SCENARIO == "ceph" ]]; then
-        GATE_IMAGES+=",^ceph,^cinder"
-    fi
-
-    if [[ $SCENARIO == "zun" ]]; then
-        GATE_IMAGES+=",^zun,^kuryr,^etcd,^cinder,^iscsid"
-        if [[ $BASE_DISTRO != "centos" ]] || [[ $BASE_DISTRO_MAJOR_VERSION -eq 7 ]]; then
-            GATE_IMAGES+=",^tgtd"
-        fi
-    fi
-
-    if [[ $SCENARIO == "scenario_nfv" ]]; then
-        GATE_IMAGES+=",^tacker,^mistral,^redis,^barbican"
-    fi
-    if [[ $SCENARIO == "ironic" ]]; then
-        GATE_IMAGES+=",^dnsmasq,^ironic,^iscsid"
-    fi
-    if [[ $SCENARIO == "masakari" ]]; then
-        GATE_IMAGES+=",^masakari"
-    fi
-
-    if [[ $SCENARIO == "swift" ]]; then
-        GATE_IMAGES+=",^swift"
-    fi
-
-    if [[ $SCENARIO == "mariadb" ]]; then
-        GATE_IMAGES="^cron,^haproxy,^keepalived,^kolla-toolbox,^mariadb"
-    fi
-
-    if [[ $SCENARIO == "prometheus-efk" ]]; then
-        GATE_IMAGES="^cron,^elasticsearch,^fluentd,^grafana,^haproxy,^keepalived,^kibana,^kolla-toolbox,^mariadb,^memcached,^prometheus,^rabbitmq"
-    fi
-
-    # NOTE(yoctozepto): we cannot build and push at the same time on debian
-    # buster see https://github.com/docker/for-linux/issues/711.
-    PUSH="true"
-    if [[ "debian" == $BASE_DISTRO ]]; then
-        PUSH="false"
-    fi
-
-    sudo tee /etc/kolla/kolla-build.conf <<EOF
-[DEFAULT]
-namespace = lokolla
-base = ${BASE_DISTRO}
-install_type = ${INSTALL_TYPE}
-tag = ${TAG}
-profile = gate
-registry = 127.0.0.1:4000
-push = ${PUSH}
-logs_dir = /tmp/logs/build
-template_override = /etc/kolla/template_overrides.j2
-EOF
-
-    # TODO(mgoddard): Remove this if block when CentOS 7 is no longer
-    # supported.
-    if [[ $BASE_DISTRO == "centos" ]] && [[ $BASE_DISTRO_MAJOR_VERSION -eq 8 ]]; then
-        sudo tee -a /etc/kolla/kolla-build.conf <<EOF
-base_tag = 8
-EOF
-    fi
-
-    sudo tee -a /etc/kolla/kolla-build.conf <<EOF
-[profiles]
-gate = ${GATE_IMAGES}
-EOF
-
-    mkdir -p /tmp/logs/build
-
-    sudo docker run -d -p 4000:5000 --restart=always -v /opt/kolla_registry/:/var/lib/registry --name registry registry:2
-
-    virtualenv ~/kolla-venv
-    . ~/kolla-venv/bin/activate
-
-    pip install -c $UPPER_CONSTRAINTS "${KOLLA_SRC_DIR}"
-
-    sudo ~/kolla-venv/bin/kolla-build
-
-    # NOTE(yoctozepto): due to debian buster we push after images are built
-    # see https://github.com/docker/for-linux/issues/711
-    if [[ "debian" == $BASE_DISTRO ]]; then
-        for img in $(sudo docker image ls --format '{{ .Repository }}:{{ .Tag }}' | grep lokolla/); do
-            sudo docker push $img;
-        done
-    fi
-
-    deactivate
-}
-
-
-setup_openstack_clients
-
-RAW_INVENTORY=/etc/kolla/inventory
-tools/kolla-ansible -i ${RAW_INVENTORY} -e ansible_user=$USER -vvv bootstrap-servers &> /tmp/logs/ansible/bootstrap-servers
-
-prepare_images
diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml
index 22dd552e7d..db97691578 100644
--- a/zuul.d/base.yaml
+++ b/zuul.d/base.yaml
@@ -32,13 +32,6 @@
       kolla_internal_vip_address: "192.0.2.10"
       address_family: 'ipv4'
       configure_swap_size: 0
-    host-vars:
-      primary:
-        ansible_python_interpreter: python2
-      secondary1:
-        ansible_python_interpreter: python2
-      secondary2:
-        ansible_python_interpreter: python2
     roles:
       - zuul: zuul/zuul-jobs
 
diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml
index 74edc0c7e7..d68ead2ff7 100644
--- a/zuul.d/jobs.yaml
+++ b/zuul.d/jobs.yaml
@@ -11,15 +11,6 @@
     name: kolla-ansible-centos8-source
     parent: kolla-ansible-base
     nodeset: kolla-ansible-centos8
-    # NOTE(mgoddard): Use Python3 on CentOS 8 jobs, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      primary:
-        ansible_python_interpreter: python3
-      secondary1:
-        ansible_python_interpreter: python3
-      secondary2:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
       install_type: source
@@ -29,13 +20,6 @@
     parent: kolla-ansible-base
     nodeset: kolla-ansible-centos-mixed-7-8
     voting: false
-    # NOTE(mgoddard): Use Python3 on CentOS 8 hosts, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      secondary1:
-        ansible_python_interpreter: python3
-      secondary2:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
       install_type: source
@@ -79,15 +63,6 @@
     parent: kolla-ansible-base
     nodeset: kolla-ansible-centos8
     voting: false
-    # NOTE(mgoddard): Use Python3 on CentOS 8 jobs, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      primary:
-        ansible_python_interpreter: python3
-      secondary1:
-        ansible_python_interpreter: python3
-      secondary2:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
       install_type: binary
@@ -151,15 +126,6 @@
     name: kolla-ansible-centos8-source-mariadb
     parent: kolla-ansible-mariadb-base
     nodeset: kolla-ansible-centos8-multi
-    # NOTE(mgoddard): Use Python3 on CentOS 8 jobs, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      primary:
-        ansible_python_interpreter: python3
-      secondary1:
-        ansible_python_interpreter: python3
-      secondary2:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
       install_type: source
@@ -239,15 +205,6 @@
     name: kolla-ansible-centos8-source-bifrost
     parent: kolla-ansible-bifrost-base
     nodeset: kolla-ansible-centos8
-    # NOTE(mgoddard): Use Python3 on CentOS 8 jobs, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      primary:
-        ansible_python_interpreter: python3
-      secondary1:
-        ansible_python_interpreter: python3
-      secondary2:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
 
@@ -263,15 +220,6 @@
     name: kolla-ansible-centos8-source-zun
     parent: kolla-ansible-zun-base
     nodeset: kolla-ansible-centos8-multi
-    # NOTE(mgoddard): Use Python3 on CentOS 8 jobs, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      primary:
-        ansible_python_interpreter: python3
-      secondary1:
-        ansible_python_interpreter: python3
-      secondary2:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
       install_type: source
@@ -296,15 +244,6 @@
     name: kolla-ansible-centos8-source-swift
     parent: kolla-ansible-swift-base
     nodeset: kolla-ansible-centos8-multi
-    # NOTE(mgoddard): Use Python3 on CentOS 8 jobs, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      primary:
-        ansible_python_interpreter: python3
-      secondary1:
-        ansible_python_interpreter: python3
-      secondary2:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
       install_type: source
@@ -332,15 +271,6 @@
     name: kolla-ansible-centos8-source-scenario-nfv
     parent: kolla-ansible-scenario-nfv-base
     nodeset: kolla-ansible-centos8-multi
-    # NOTE(mgoddard): Use Python3 on CentOS 8 jobs, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      primary:
-        ansible_python_interpreter: python3
-      secondary1:
-        ansible_python_interpreter: python3
-      secondary2:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
       install_type: source
@@ -357,15 +287,6 @@
     name: kolla-ansible-centos8-source-ironic
     parent: kolla-ansible-ironic-base
     nodeset: kolla-ansible-centos8
-    # NOTE(mgoddard): Use Python3 on CentOS 8 jobs, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      primary:
-        ansible_python_interpreter: python3
-      secondary1:
-        ansible_python_interpreter: python3
-      secondary2:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
       install_type: source
@@ -382,15 +303,6 @@
     name: kolla-ansible-centos8-binary-ironic
     parent: kolla-ansible-ironic-base
     nodeset: kolla-ansible-centos8
-    # NOTE(mgoddard): Use Python3 on CentOS 8 jobs, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      primary:
-        ansible_python_interpreter: python3
-      secondary1:
-        ansible_python_interpreter: python3
-      secondary2:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
       install_type: binary
@@ -437,15 +349,6 @@
     name: kolla-ansible-centos8-source-masakari
     parent: kolla-ansible-masakari-base
     nodeset: kolla-ansible-centos8
-    # NOTE(mgoddard): Use Python3 on CentOS 8 jobs, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      primary:
-        ansible_python_interpreter: python3
-      secondary1:
-        ansible_python_interpreter: python3
-      secondary2:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
       install_type: source
@@ -465,15 +368,6 @@
     parent: kolla-ansible-base
     nodeset: kolla-ansible-centos8-multi
     voting: false
-    # NOTE(mgoddard): Use Python3 on CentOS 8 jobs, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      primary:
-        ansible_python_interpreter: python3
-      secondary1:
-        ansible_python_interpreter: python3
-      secondary2:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
       install_type: source
@@ -491,11 +385,6 @@
     name: kolla-ansible-centos8-source-prometheus-efk
     parent: kolla-ansible-prometheus-efk-base
     nodeset: kolla-ansible-centos8
-    # NOTE(mgoddard): Use Python3 on CentOS 8 jobs, overriding the use of
-    # Python 2 from the base job.
-    host-vars:
-      primary:
-        ansible_python_interpreter: python3
     vars:
       base_distro: centos
       install_type: source