diff --git a/.zuul.yaml b/.zuul.yaml
index b5477d1a8f..579292b487 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -28,11 +28,17 @@
         nodes:
           - controller
 
+
+# TODO(frickler): drop this dummy nodeset once all references have been removed
 - nodeset:
     name: openstack-single-node-bionic
+    nodes: []
+
+- nodeset:
+    name: devstack-single-node-almalinux-10
     nodes:
       - name: controller
-        label: ubuntu-bionic
+        label: almalinux-10-8GB
     groups:
       - name: tempest
         nodes:
@@ -49,38 +55,40 @@
           - controller
 
 - nodeset:
-    name: devstack-single-node-opensuse-15
+    name: devstack-single-node-centos-10-stream
     nodes:
       - name: controller
-        label: opensuse-15
+        label: centos-10-stream-8GB
     groups:
       - name: tempest
         nodes:
           - controller
 
 - nodeset:
-    name: devstack-single-node-debian-bookworm
+    name: devstack-single-node-debian-trixie
     nodes:
       - name: controller
-        label: debian-bookworm
+        label: debian-trixie-8GB
     groups:
       - name: tempest
         nodes:
           - controller
 
-# Note(sean-k-mooney): this is still used by horizon for
-# horizon-integration-tests, horizon-integration-pytest and
-# horizon-ui-pytest, remove when horizon is updated.
 - nodeset:
-    name: devstack-single-node-debian-bullseye
+    name: devstack-single-node-debian-bookworm
     nodes:
       - name: controller
-        label: debian-bullseye
+        label: debian-bookworm
     groups:
       - name: tempest
         nodes:
           - controller
 
+# TODO(frickler): drop this dummy nodeset once all references have been removed
+- nodeset:
+    name: devstack-single-node-opensuse-15
+    nodes: []
+
 - nodeset:
     name: devstack-single-node-rockylinux-9
     nodes:
@@ -91,6 +99,46 @@
         nodes:
           - controller
 
+- nodeset:
+    name: devstack-single-node-rockylinux-10
+    nodes:
+      - name: controller
+        label: rockylinux-10-8GB
+    groups:
+      - name: tempest
+        nodes:
+          - controller
+
+- nodeset:
+    name: openstack-two-node-centos-10-stream
+    nodes:
+      - name: controller
+        label: centos-10-stream-8GB
+      - name: compute1
+        label: centos-10-stream-8GB
+    groups:
+      # Node where tests are executed and test results collected
+      - name: tempest
+        nodes:
+          - controller
+      # Nodes running the compute service
+      - name: compute
+        nodes:
+          - controller
+          - compute1
+      # Nodes that are not the controller
+      - name: subnode
+        nodes:
+          - compute1
+      # Switch node for multinode networking setup
+      - name: switch
+        nodes:
+          - controller
+      # Peer nodes for multinode networking setup
+      - name: peers
+        nodes:
+          - compute1
+
 - nodeset:
     name: openstack-two-node-centos-9-stream
     nodes:
@@ -211,13 +259,21 @@
         nodes:
           - compute1
 
+
+# TODO(frickler): drop this dummy nodeset once all references have been removed
 - nodeset:
     name: openstack-two-node-bionic
+    nodes: []
+
+- nodeset:
+    name: openstack-three-node-focal
     nodes:
       - name: controller
-        label: ubuntu-bionic
+        label: ubuntu-focal
       - name: compute1
-        label: ubuntu-bionic
+        label: ubuntu-focal
+      - name: compute2
+        label: ubuntu-focal
     groups:
       # Node where tests are executed and test results collected
       - name: tempest
@@ -228,10 +284,12 @@
         nodes:
           - controller
           - compute1
+          - compute2
       # Nodes that are not the controller
       - name: subnode
         nodes:
           - compute1
+          - compute2
       # Switch node for multinode networking setup
       - name: switch
         nodes:
@@ -240,16 +298,20 @@
       - name: peers
         nodes:
           - compute1
+          - compute2
 
+# TODO(frickler): drop this dummy nodeset once all references have been removed
 - nodeset:
-    name: openstack-three-node-focal
+    name: openstack-three-node-bionic
+    nodes: []
+
+- nodeset:
+    name: devstack-two-node-debian-bookworm
     nodes:
       - name: controller
-        label: ubuntu-focal
+        label: debian-bookworm
       - name: compute1
-        label: ubuntu-focal
-      - name: compute2
-        label: ubuntu-focal
+        label: debian-bookworm
     groups:
       # Node where tests are executed and test results collected
       - name: tempest
@@ -260,12 +322,10 @@
         nodes:
           - controller
           - compute1
-          - compute2
       # Nodes that are not the controller
       - name: subnode
         nodes:
           - compute1
-          - compute2
       # Switch node for multinode networking setup
       - name: switch
         nodes:
@@ -274,17 +334,14 @@
       - name: peers
         nodes:
           - compute1
-          - compute2
 
 - nodeset:
-    name: openstack-three-node-bionic
+    name: devstack-two-node-debian-trixie
     nodes:
       - name: controller
-        label: ubuntu-bionic
+        label: debian-trixie-8GB
       - name: compute1
-        label: ubuntu-bionic
-      - name: compute2
-        label: ubuntu-bionic
+        label: debian-trixie-8GB
     groups:
       # Node where tests are executed and test results collected
       - name: tempest
@@ -295,12 +352,10 @@
         nodes:
           - controller
           - compute1
-          - compute2
       # Nodes that are not the controller
       - name: subnode
         nodes:
           - compute1
-          - compute2
       # Switch node for multinode networking setup
       - name: switch
         nodes:
@@ -309,7 +364,6 @@
       - name: peers
         nodes:
           - compute1
-          - compute2
 
 - job:
     name: devstack-base
@@ -327,6 +381,12 @@
       nodes (everything but the controller).
     required-projects:
       - opendev.org/openstack/devstack
+      # this is a workaround for a packaging bug in ubuntu
+      # remove when https://bugs.launchpad.net/nova/+bug/2109592
+      # is resolved and oslo.config is not a dep of the novnc deb
+      # via the defunct python3-novnc package.
+      - novnc/novnc
+
     roles:
       - zuul: opendev.org/openstack/openstack-zuul-jobs
     vars:
@@ -344,7 +404,6 @@
         LOG_COLOR: false
         VERBOSE: true
         VERBOSE_NO_TIMESTAMP: true
-        NOVNC_FROM_PACKAGE: true
         ERROR_ON_CLONE: true
         # Gate jobs can't deal with nested virt. Disable it by default.
         LIBVIRT_TYPE: '{{ devstack_libvirt_type | default("qemu") }}'
@@ -357,6 +416,7 @@
         '{{ devstack_conf_dir }}/.localrc.auto': logs
         '{{ devstack_conf_dir }}/.stackenv': logs
         '{{ devstack_log_dir }}/dstat-csv.log': logs
+        '{{ devstack_log_dir }}/atop': logs
         '{{ devstack_log_dir }}/devstacklog.txt': logs
         '{{ devstack_log_dir }}/devstacklog.txt.summary': logs
         '{{ devstack_log_dir }}/tcpdump.pcap': logs
@@ -378,6 +438,7 @@
         /etc/sudoers.d: logs
         '{{ stage_dir }}/iptables.txt': logs
         '{{ stage_dir }}/df.txt': logs
+        '{{ stage_dir }}/mount.txt': logs
         '{{ stage_dir }}/pip2-freeze.txt': logs
         '{{ stage_dir }}/pip3-freeze.txt': logs
         '{{ stage_dir }}/dpkg-l.txt': logs
@@ -416,7 +477,6 @@
           LOG_COLOR: false
           VERBOSE: true
           VERBOSE_NO_TIMESTAMP: true
-          NOVNC_FROM_PACKAGE: true
           ERROR_ON_CLONE: true
           LIBVIRT_TYPE: qemu
         devstack_services:
@@ -424,7 +484,7 @@
     pre-run: playbooks/pre.yaml
     run: playbooks/devstack.yaml
     post-run: playbooks/post.yaml
-    irrelevant-files:
+    irrelevant-files: &common-irrelevant-files
       # Documentation related
       - ^.*\.rst$
       - ^api-ref/.*$
@@ -433,7 +493,11 @@
       # Translations
       - ^.*/locale/.*po$
       # pre-commit config
-      - ^.pre-commit-config.yaml$
+      - ^\.pre-commit-config\.yaml$
+      # gitignore config
+      - ^\.gitignore$
+      # gitreview config
+      - ^\.gitreview$
 
 - job:
     name: devstack-minimal
@@ -441,7 +505,7 @@
     description: |
       Minimal devstack base job, intended for use by jobs that need
       less than the normal minimum set of required-projects.
-    nodeset: openstack-single-node-jammy
+    nodeset: openstack-single-node-noble
     required-projects:
       - opendev.org/openstack/requirements
     vars:
@@ -587,7 +651,7 @@
         ovsdb-server: true
         # Neutron services
         q-svc: true
-        q-ovn-metadata-agent: true
+        q-ovn-agent: true
         # Swift services
         s-account: true
         s-container: true
@@ -624,7 +688,7 @@
           ovs-vswitchd: true
           ovsdb-server: true
           # Neutron services
-          q-ovn-metadata-agent: true
+          q-ovn-agent: true
           # Cinder services
           c-bak: true
           c-vol: true
@@ -688,7 +752,7 @@
 - job:
     name: devstack-multinode
     parent: devstack
-    nodeset: openstack-two-node-jammy
+    nodeset: openstack-two-node-noble
     description: |
       Simple multinode test to verify multinode functionality on devstack side.
       This is not meant to be used as a parent job.
@@ -697,14 +761,50 @@
 # we often have to rush things through devstack to stabilise the gate,
 # and these platforms don't have the round-the-clock support to avoid
 # becoming blockers in that situation.
+- job:
+    name: devstack-platform-almalinux-purple-lion-ovn-source
+    parent: tempest-full-py3
+    description: AlmaLinux 10 platform test
+    nodeset: devstack-single-node-almalinux-10
+    timeout: 9000
+    voting: false
+    vars:
+      configure_swap_size: 4096
+      devstack_localrc:
+        OVN_BUILD_FROM_SOURCE: True
+        OVN_BRANCH: "branch-24.03"
+        OVS_BRANCH: "branch-3.3"
+        OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
+
+- job:
+    name: devstack-platform-centos-10-stream
+    parent: tempest-full-py3
+    description: CentOS 10 Stream platform test
+    nodeset: devstack-single-node-centos-10-stream
+    timeout: 9000
+    voting: false
+
 - job:
     name: devstack-platform-centos-9-stream
     parent: tempest-full-py3
     description: CentOS 9 Stream platform test
     nodeset: devstack-single-node-centos-9-stream
+    vars:
+      devstack_localrc:
+        # TODO(ykarel) Remove this when moving to 10-stream
+        PYTHON3_VERSION: 3.11
     timeout: 9000
     voting: false
 
+- job:
+    name: devstack-platform-debian-trixie
+    parent: tempest-full-py3
+    description: Debian Trixie platform test
+    nodeset: devstack-single-node-debian-trixie
+    timeout: 9000
+    vars:
+      configure_swap_size: 4096
+
 - job:
     name: devstack-platform-debian-bookworm
     parent: tempest-full-py3
@@ -727,33 +827,37 @@
     voting: false
     vars:
       configure_swap_size: 4096
+      devstack_localrc:
+        # TODO(ykarel) Remove this when moving to rocky10
+        PYTHON3_VERSION: 3.11
 
 - job:
-    name: devstack-platform-ubuntu-noble
+    name: devstack-platform-rocky-red-quartz
     parent: tempest-full-py3
-    description: Ubuntu 24.04 LTS (noble) platform test
-    nodeset: openstack-single-node-noble
+    description: Rocky Linux Red Quartz platform test
+    nodeset: devstack-single-node-rockylinux-10
     timeout: 9000
+    voting: false
     vars:
-      configure_swap_size: 8192
+      configure_swap_size: 4096
 
 - job:
-    name: devstack-platform-ubuntu-jammy-ovn-source
-    parent: devstack-platform-ubuntu-jammy
-    description: Ubuntu 22.04 LTS (jammy) platform test (OVN from source)
+    name: devstack-platform-ubuntu-noble-ovn-source
+    parent: devstack-platform-ubuntu-noble
+    description: Ubuntu 24.04 LTS (noble) platform test (OVN from source)
     voting: false
     vars:
       devstack_localrc:
         OVN_BUILD_FROM_SOURCE: True
-        OVN_BRANCH: "v21.06.0"
-        OVS_BRANCH: "a4b04276ab5934d087669ff2d191a23931335c87"
+        OVN_BRANCH: "branch-24.03"
+        OVS_BRANCH: "branch-3.3"
         OVS_SYSCONFDIR: "/usr/local/etc/openvswitch"
 
 - job:
-    name: devstack-platform-ubuntu-jammy-ovs
+    name: devstack-platform-ubuntu-noble-ovs
     parent: tempest-full-py3
-    description: Ubuntu 22.04 LTS (jammy) platform test (OVS)
-    nodeset: openstack-single-node-jammy
+    description: Ubuntu 24.04 LTS (noble) platform test (OVS)
+    nodeset: openstack-single-node-noble
     voting: false
     timeout: 9000
     vars:
@@ -855,7 +959,7 @@
 
 - job:
     name: devstack-unit-tests
-    nodeset: ubuntu-jammy
+    nodeset: ubuntu-noble
     description: |
       Runs unit tests on devstack project.
 
@@ -872,52 +976,42 @@
         - devstack
         - devstack-ipv6
         - devstack-enforce-scope
+        - devstack-platform-almalinux-purple-lion-ovn-source
+        - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
+        - devstack-platform-debian-trixie
         - devstack-platform-rocky-blue-onyx
-        - devstack-platform-ubuntu-jammy-ovn-source
-        - devstack-platform-ubuntu-jammy-ovs
-        - devstack-platform-ubuntu-noble
+        - devstack-platform-rocky-red-quartz
+        - devstack-platform-ubuntu-noble-ovn-source
+        - devstack-platform-ubuntu-noble-ovs
         - devstack-multinode
         - devstack-unit-tests
         - openstack-tox-bashate
-        - ironic-tempest-bios-ipmi-direct-tinyipa
+        - ironic-tempest-bios-ipmi-autodetect
         - swift-dsvm-functional
         - grenade:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - neutron-ovs-grenade-multinode:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - neutron-ovn-tempest-ovs-release:
             voting: false
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - tempest-multinode-full-py3:
             voting: false
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - openstacksdk-functional-devstack:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - tempest-ipv6-only:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - nova-ceph-multistore:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
     gate:
       jobs:
         - devstack
         - devstack-ipv6
         - devstack-platform-debian-bookworm
+        - devstack-platform-debian-trixie
         - devstack-platform-ubuntu-noble
         # NOTE(danms): Disabled due to instability, see comment in the job
         # definition above.
@@ -927,27 +1021,17 @@
         - devstack-unit-tests
         - openstack-tox-bashate
         - neutron-ovs-grenade-multinode:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
-        - ironic-tempest-bios-ipmi-direct-tinyipa
+            irrelevant-files: *common-irrelevant-files
+        - ironic-tempest-bios-ipmi-autodetect
         - swift-dsvm-functional
         - grenade:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - openstacksdk-functional-devstack:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - tempest-ipv6-only:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - nova-ceph-multistore:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
     # Please add a note on each job and conditions for the job not
     # being experimental any more, so we can keep this list somewhat
     # pruned.
@@ -956,15 +1040,6 @@
     #    things, this job is not experimental but often is used to test
     #    things that are not yet production ready or to test what will be
     #    the new default after a deprecation period has ended.
-    # * neutron-fullstack-with-uwsgi: maintained by neutron for fullstack test
-    #    when neutron-api is served by uwsgi, it's in exprimental for testing.
-    #    the next cycle we can remove this  job if things turn out to be
-    #    stable enough.
-    # * neutron-functional-with-uwsgi: maintained by neutron for functional
-    #    test. Next cycle we can remove this one if things turn out to be
-    #    stable engouh with uwsgi.
-    # * neutron-ovn-tempest-with-uwsgi: maintained by neutron for tempest test.
-    #    Next cycle we can remove this if everything run out stable enough.
     # * nova-multi-cell: maintained by nova and now is voting in the
     #    check queue for nova changes but relies on devstack configuration
 
@@ -972,38 +1047,27 @@
       jobs:
         - nova-multi-cell
         - nova-next
-        - neutron-fullstack-with-uwsgi
-        - neutron-functional-with-uwsgi
-        - neutron-ovn-tempest-with-uwsgi
         - devstack-plugin-ceph-tempest-py3:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - neutron-ovs-tempest-dvr:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - neutron-ovs-tempest-dvr-ha-multinode-full:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - cinder-tempest-lvm-multibackend:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - tempest-pg-full:
-            irrelevant-files:
-              - ^.*\.rst$
-              - ^doc/.*$
+            irrelevant-files: *common-irrelevant-files
         - devstack-no-tls-proxy
     periodic:
       jobs:
         - devstack-no-tls-proxy
     periodic-weekly:
       jobs:
+        - devstack-platform-almalinux-purple-lion-ovn-source
+        - devstack-platform-centos-10-stream
         - devstack-platform-centos-9-stream
         - devstack-platform-debian-bookworm
         - devstack-platform-rocky-blue-onyx
-        - devstack-platform-ubuntu-jammy-ovn-source
-        - devstack-platform-ubuntu-jammy-ovs
-        - devstack-platform-ubuntu-noble
+        - devstack-platform-rocky-red-quartz
+        - devstack-platform-ubuntu-noble-ovn-source
+        - devstack-platform-ubuntu-noble-ovs
diff --git a/clean.sh b/clean.sh
index 6a31cc624a..6dbcb053bc 100755
--- a/clean.sh
+++ b/clean.sh
@@ -40,7 +40,7 @@ source $TOP_DIR/lib/rpc_backend
 
 source $TOP_DIR/lib/tls
 
-source $TOP_DIR/lib/oslo
+source $TOP_DIR/lib/libraries
 source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
@@ -102,7 +102,7 @@ if is_service_enabled nova && [[ -r $NOVA_PLUGINS/hypervisor-$VIRT_DRIVER ]]; th
 fi
 
 # Clean out /etc
-sudo rm -rf /etc/keystone /etc/glance /etc/nova /etc/cinder /etc/swift /etc/neutron /etc/openstack/
+sudo rm -rf $KEYSTONE_CONF_DIR $GLANCE_CONF_DIR $NOVA_CONF_DIR $PLACEMENT_CONF_DIR $CINDER_CONF_DIR $SWIFT_CONF_DIR $NEUTRON_CONF_DIR $OPENSTACKCLIENT_CONF_DIR
 
 # Clean out tgt
 sudo rm -f /etc/tgt/conf.d/*
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 9a1fd4e179..3cfba716ca 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -323,7 +323,7 @@ a file, keep service logs and disable color in the stored files.
 
    [[local|localrc]]
    DEST=/opt/stack/
-   LOGFILE=$LOGDIR/stack.sh.log
+   LOGFILE=$DEST/stack.sh.log
    LOG_COLOR=False
 
 Database Backend
diff --git a/doc/source/guides/multinode-lab.rst b/doc/source/guides/multinode-lab.rst
index 658422b0af..ef339f1f5c 100644
--- a/doc/source/guides/multinode-lab.rst
+++ b/doc/source/guides/multinode-lab.rst
@@ -24,7 +24,7 @@ Install a couple of packages to bootstrap configuration:
 
 ::
 
-    apt-get install -y git sudo || yum install -y git sudo
+    apt-get install -y git sudo || dnf install -y git sudo
 
 Network Configuration
 ---------------------
@@ -210,6 +210,48 @@ only needs to be performed for subnodes.
 
 .. _Cells v2: https://docs.openstack.org/nova/latest/user/cells.html
 
+Configure Tempest Node to run the Tempest tests
+-----------------------------------------------
+
+If there is a need to execute Tempest tests against different Cluster
+Controller node then it can be done by re-using the ``local.conf`` file from
+the Cluster Controller node but with not enabled Controller services in
+``ENABLED_SERVICES`` variable. This variable needs to contain only ``tempest``
+as a configured service. Then variable ``SERVICES_FOR_TEMPEST`` must be
+configured to contain those services that were enabled on the Cluster
+Controller node in the ``ENABLED_SERVICES`` variable. For example the
+``local.conf`` file could look as follows:
+
+::
+
+    [[local|localrc]]
+    HOST_IP=192.168.42.12 # change this per compute node
+    FIXED_RANGE=10.4.128.0/20
+    FLOATING_RANGE=192.168.42.128/25
+    LOGFILE=/opt/stack/logs/stack.sh.log
+    ADMIN_PASSWORD=labstack
+    DATABASE_PASSWORD=supersecret
+    RABBIT_PASSWORD=supersecret
+    SERVICE_PASSWORD=supersecret
+    DATABASE_TYPE=mysql
+    SERVICE_HOST=192.168.42.11
+    MYSQL_HOST=$SERVICE_HOST
+    RABBIT_HOST=$SERVICE_HOST
+    GLANCE_HOSTPORT=$SERVICE_HOST:9292
+    NOVA_VNC_ENABLED=True
+    NOVNCPROXY_URL="http://$SERVICE_HOST:6080/vnc_lite.html"
+    VNCSERVER_LISTEN=$HOST_IP
+    VNCSERVER_PROXYCLIENT_ADDRESS=$VNCSERVER_LISTEN
+    ENABLED_SERVICES=tempest
+    SERVICES_FOR_TEMPEST=keystone,nova,neutron,glance
+
+Then just execute the devstack:
+
+::
+
+    ./stack.sh
+
+
 Cleaning Up After DevStack
 --------------------------
 
diff --git a/doc/source/guides/neutron.rst b/doc/source/guides/neutron.rst
index fb36b3ec5b..a7adeeff73 100644
--- a/doc/source/guides/neutron.rst
+++ b/doc/source/guides/neutron.rst
@@ -451,44 +451,6 @@ by default. If you want to remove all the extension drivers (even
 'port_security'), set ``Q_ML2_PLUGIN_EXT_DRIVERS`` to blank.
 
 
-Using Linux Bridge instead of Open vSwitch
-------------------------------------------
-
-The configuration for using the Linux Bridge ML2 driver is fairly
-straight forward. The Linux Bridge configuration for DevStack is similar
-to the :ref:`Open vSwitch based single interface <single-interface-ovs>`
-setup, with small modifications for the interface mappings.
-
-
-::
-
-    [[local|localrc]]
-    HOST_IP=172.18.161.6
-    SERVICE_HOST=172.18.161.6
-    MYSQL_HOST=172.18.161.6
-    RABBIT_HOST=172.18.161.6
-    GLANCE_HOSTPORT=172.18.161.6:9292
-    ADMIN_PASSWORD=secret
-    DATABASE_PASSWORD=secret
-    RABBIT_PASSWORD=secret
-    SERVICE_PASSWORD=secret
-
-    ## Neutron options
-    Q_USE_SECGROUP=True
-    FLOATING_RANGE="172.18.161.0/24"
-    IPV4_ADDRS_SAFE_TO_USE="10.0.0.0/24"
-    Q_FLOATING_ALLOCATION_POOL=start=172.18.161.250,end=172.18.161.254
-    PUBLIC_NETWORK_GATEWAY="172.18.161.1"
-    PUBLIC_INTERFACE=eth0
-
-    Q_USE_PROVIDERNET_FOR_PUBLIC=True
-
-    # Linuxbridge Settings
-    Q_AGENT=linuxbridge
-    LB_PHYSICAL_INTERFACE=eth0
-    PUBLIC_PHYSICAL_NETWORK=default
-    LB_INTERFACE_MAPPINGS=default:eth0
-
 Using MacVTap instead of Open vSwitch
 ------------------------------------------
 
@@ -556,7 +518,7 @@ the MacVTap mechanism driver:
 
     [[local|localrc]]
     ...
-    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,linuxbridge,macvtap
+    Q_ML2_PLUGIN_MECHANISM_DRIVERS=openvswitch,macvtap
     ...
 
 For the MacVTap compute node, use this local.conf:
diff --git a/doc/source/guides/single-machine.rst b/doc/source/guides/single-machine.rst
index a4385b5b4b..263fbb9d6f 100644
--- a/doc/source/guides/single-machine.rst
+++ b/doc/source/guides/single-machine.rst
@@ -62,7 +62,7 @@ to have sudo privileges:
 
 .. code-block:: console
 
-    $ apt-get install sudo -y || yum install -y sudo
+    $ apt-get install sudo -y || dnf install -y sudo
     $ echo "stack ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/stack
 
 .. note:: On some systems you may need to use ``sudo visudo``.
@@ -81,7 +81,7 @@ We'll grab the latest version of DevStack via https:
 
 .. code-block:: console
 
-    $ sudo apt-get install git -y || sudo yum install -y git
+    $ sudo apt-get install git -y || sudo dnf install -y git
     $ git clone https://opendev.org/openstack/devstack
     $ cd devstack
 
diff --git a/doc/source/guides/single-vm.rst b/doc/source/guides/single-vm.rst
index 7dac18b333..4272a4b180 100644
--- a/doc/source/guides/single-vm.rst
+++ b/doc/source/guides/single-vm.rst
@@ -56,8 +56,8 @@ passed as the user-data file when booting the VM.
     write_files:
       - content: |
             #!/bin/sh
-            DEBIAN_FRONTEND=noninteractive sudo apt-get -qqy update || sudo yum update -qy
-            DEBIAN_FRONTEND=noninteractive sudo apt-get install -qqy git || sudo yum install -qy git
+            DEBIAN_FRONTEND=noninteractive sudo apt-get -qqy update || sudo dnf update -qy
+            DEBIAN_FRONTEND=noninteractive sudo apt-get install -qqy git || sudo dnf install -qy git
             sudo chown stack:stack /home/stack
             cd /home/stack
             git clone https://opendev.org/openstack/devstack
diff --git a/doc/source/index.rst b/doc/source/index.rst
index 70871ef876..a07bb84922 100644
--- a/doc/source/index.rst
+++ b/doc/source/index.rst
@@ -40,7 +40,7 @@ Start with a clean and minimal install of a Linux system. DevStack
 attempts to support the two latest LTS releases of Ubuntu,
 Rocky Linux 9 and openEuler.
 
-If you do not have a preference, Ubuntu 22.04 (Jammy) is the
+If you do not have a preference, Ubuntu 24.04 (Noble) is the
 most tested, and will probably go the smoothest.
 
 Add Stack User (optional)
diff --git a/doc/source/networking.rst b/doc/source/networking.rst
index 05b4f34164..10e1c3ff2c 100644
--- a/doc/source/networking.rst
+++ b/doc/source/networking.rst
@@ -213,7 +213,7 @@ install ``sshuttle`` on your localhost:
 
 .. code-block:: bash
 
-    sudo apt-get install sshuttle || yum install sshuttle
+    sudo apt-get install sshuttle || dnf install sshuttle
 
 Finally, start ``sshuttle`` on your localhost using the floating IP address
 range. For example, assuming you are using the default value for
diff --git a/doc/source/overview.rst b/doc/source/overview.rst
index 4384081769..c978e8d2cf 100644
--- a/doc/source/overview.rst
+++ b/doc/source/overview.rst
@@ -52,12 +52,6 @@ Web Server
 
 -  Apache
 
-OpenStack Network
------------------
-
--  Neutron: A basic configuration approximating the original FlatDHCP
-   mode using linuxbridge or OpenVSwitch.
-
 Services
 --------
 
diff --git a/doc/source/plugin-registry.rst b/doc/source/plugin-registry.rst
index 8b9d1f2b96..560668f2a0 100644
--- a/doc/source/plugin-registry.rst
+++ b/doc/source/plugin-registry.rst
@@ -24,6 +24,7 @@ official OpenStack projects.
 ======================================== ===
 Plugin Name                              URL
 ======================================== ===
+openstack/aetos                          `https://opendev.org/openstack/aetos <https://opendev.org/openstack/aetos>`__
 openstack/aodh                           `https://opendev.org/openstack/aodh <https://opendev.org/openstack/aodh>`__
 openstack/barbican                       `https://opendev.org/openstack/barbican <https://opendev.org/openstack/barbican>`__
 openstack/blazar                         `https://opendev.org/openstack/blazar <https://opendev.org/openstack/blazar>`__
@@ -31,20 +32,22 @@ openstack/ceilometer                     `https://opendev.org/openstack/ceilomet
 openstack/cloudkitty                     `https://opendev.org/openstack/cloudkitty <https://opendev.org/openstack/cloudkitty>`__
 openstack/cyborg                         `https://opendev.org/openstack/cyborg <https://opendev.org/openstack/cyborg>`__
 openstack/designate                      `https://opendev.org/openstack/designate <https://opendev.org/openstack/designate>`__
+openstack/designate-tempest-plugin       `https://opendev.org/openstack/designate-tempest-plugin <https://opendev.org/openstack/designate-tempest-plugin>`__
 openstack/devstack-plugin-amqp1          `https://opendev.org/openstack/devstack-plugin-amqp1 <https://opendev.org/openstack/devstack-plugin-amqp1>`__
 openstack/devstack-plugin-ceph           `https://opendev.org/openstack/devstack-plugin-ceph <https://opendev.org/openstack/devstack-plugin-ceph>`__
 openstack/devstack-plugin-container      `https://opendev.org/openstack/devstack-plugin-container <https://opendev.org/openstack/devstack-plugin-container>`__
 openstack/devstack-plugin-kafka          `https://opendev.org/openstack/devstack-plugin-kafka <https://opendev.org/openstack/devstack-plugin-kafka>`__
 openstack/devstack-plugin-nfs            `https://opendev.org/openstack/devstack-plugin-nfs <https://opendev.org/openstack/devstack-plugin-nfs>`__
 openstack/devstack-plugin-open-cas       `https://opendev.org/openstack/devstack-plugin-open-cas <https://opendev.org/openstack/devstack-plugin-open-cas>`__
+openstack/devstack-plugin-prometheus     `https://opendev.org/openstack/devstack-plugin-prometheus <https://opendev.org/openstack/devstack-plugin-prometheus>`__
 openstack/freezer                        `https://opendev.org/openstack/freezer <https://opendev.org/openstack/freezer>`__
 openstack/freezer-api                    `https://opendev.org/openstack/freezer-api <https://opendev.org/openstack/freezer-api>`__
 openstack/freezer-tempest-plugin         `https://opendev.org/openstack/freezer-tempest-plugin <https://opendev.org/openstack/freezer-tempest-plugin>`__
 openstack/freezer-web-ui                 `https://opendev.org/openstack/freezer-web-ui <https://opendev.org/openstack/freezer-web-ui>`__
+openstack/grian-ui                       `https://opendev.org/openstack/grian-ui <https://opendev.org/openstack/grian-ui>`__
 openstack/heat                           `https://opendev.org/openstack/heat <https://opendev.org/openstack/heat>`__
 openstack/heat-dashboard                 `https://opendev.org/openstack/heat-dashboard <https://opendev.org/openstack/heat-dashboard>`__
 openstack/ironic                         `https://opendev.org/openstack/ironic <https://opendev.org/openstack/ironic>`__
-openstack/ironic-inspector               `https://opendev.org/openstack/ironic-inspector <https://opendev.org/openstack/ironic-inspector>`__
 openstack/ironic-prometheus-exporter     `https://opendev.org/openstack/ironic-prometheus-exporter <https://opendev.org/openstack/ironic-prometheus-exporter>`__
 openstack/ironic-ui                      `https://opendev.org/openstack/ironic-ui <https://opendev.org/openstack/ironic-ui>`__
 openstack/keystone                       `https://opendev.org/openstack/keystone <https://opendev.org/openstack/keystone>`__
@@ -56,9 +59,6 @@ openstack/manila-tempest-plugin          `https://opendev.org/openstack/manila-t
 openstack/manila-ui                      `https://opendev.org/openstack/manila-ui <https://opendev.org/openstack/manila-ui>`__
 openstack/masakari                       `https://opendev.org/openstack/masakari <https://opendev.org/openstack/masakari>`__
 openstack/mistral                        `https://opendev.org/openstack/mistral <https://opendev.org/openstack/mistral>`__
-openstack/monasca-api                    `https://opendev.org/openstack/monasca-api <https://opendev.org/openstack/monasca-api>`__
-openstack/monasca-events-api             `https://opendev.org/openstack/monasca-events-api <https://opendev.org/openstack/monasca-events-api>`__
-openstack/monasca-tempest-plugin         `https://opendev.org/openstack/monasca-tempest-plugin <https://opendev.org/openstack/monasca-tempest-plugin>`__
 openstack/networking-bagpipe             `https://opendev.org/openstack/networking-bagpipe <https://opendev.org/openstack/networking-bagpipe>`__
 openstack/networking-baremetal           `https://opendev.org/openstack/networking-baremetal <https://opendev.org/openstack/networking-baremetal>`__
 openstack/networking-bgpvpn              `https://opendev.org/openstack/networking-bgpvpn <https://opendev.org/openstack/networking-bgpvpn>`__
@@ -80,7 +80,6 @@ openstack/osprofiler                     `https://opendev.org/openstack/osprofil
 openstack/ovn-bgp-agent                  `https://opendev.org/openstack/ovn-bgp-agent <https://opendev.org/openstack/ovn-bgp-agent>`__
 openstack/ovn-octavia-provider           `https://opendev.org/openstack/ovn-octavia-provider <https://opendev.org/openstack/ovn-octavia-provider>`__
 openstack/rally-openstack                `https://opendev.org/openstack/rally-openstack <https://opendev.org/openstack/rally-openstack>`__
-openstack/shade                          `https://opendev.org/openstack/shade <https://opendev.org/openstack/shade>`__
 openstack/skyline-apiserver              `https://opendev.org/openstack/skyline-apiserver <https://opendev.org/openstack/skyline-apiserver>`__
 openstack/storlets                       `https://opendev.org/openstack/storlets <https://opendev.org/openstack/storlets>`__
 openstack/tacker                         `https://opendev.org/openstack/tacker <https://opendev.org/openstack/tacker>`__
@@ -168,7 +167,6 @@ x/rsd-virt-for-nova                      `https://opendev.org/x/rsd-virt-for-nov
 x/scalpels                               `https://opendev.org/x/scalpels <https://opendev.org/x/scalpels>`__
 x/slogging                               `https://opendev.org/x/slogging <https://opendev.org/x/slogging>`__
 x/stackube                               `https://opendev.org/x/stackube <https://opendev.org/x/stackube>`__
-x/tap-as-a-service-dashboard             `https://opendev.org/x/tap-as-a-service-dashboard <https://opendev.org/x/tap-as-a-service-dashboard>`__
 x/tatu                                   `https://opendev.org/x/tatu <https://opendev.org/x/tatu>`__
 x/trio2o                                 `https://opendev.org/x/trio2o <https://opendev.org/x/trio2o>`__
 x/valet                                  `https://opendev.org/x/valet <https://opendev.org/x/valet>`__
diff --git a/doc/source/plugins.rst b/doc/source/plugins.rst
index dd75b5a22d..fe567e2277 100644
--- a/doc/source/plugins.rst
+++ b/doc/source/plugins.rst
@@ -232,7 +232,7 @@ an early phase of its execution.  These packages may be defined in a
 plugin as files that contain new-line separated lists of packages
 required by the plugin
 
-Supported packaging systems include apt and yum across multiple
+Supported packaging systems include apt and dnf across multiple
 distributions.  To enable a plugin to hook into this and install
 package dependencies, packages may be listed at the following
 locations in the top-level of the plugin repository:
diff --git a/files/apache-cinder-api.template b/files/apache-cinder-api.template
index e1246f11b6..e401803abc 100644
--- a/files/apache-cinder-api.template
+++ b/files/apache-cinder-api.template
@@ -6,21 +6,13 @@ Listen %PUBLICPORT%
     WSGIScriptAlias / %CINDER_BIN_DIR%/cinder-wsgi
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
+    ErrorLogFormat "%{cu}t %M"
     ErrorLog /var/log/%APACHE_NAME%/c-api.log
     %SSLENGINE%
     %SSLCERTFILE%
     %SSLKEYFILE%
 
     <Directory %CINDER_BIN_DIR%>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
+        Require all granted
     </Directory>
 </VirtualHost>
diff --git a/files/apache-horizon.template b/files/apache-horizon.template
index da7a7d26c3..c6c55ecf27 100644
--- a/files/apache-horizon.template
+++ b/files/apache-horizon.template
@@ -21,19 +21,9 @@
     <Directory %HORIZON_DIR%/>
         Options Indexes FollowSymLinks MultiViews
         AllowOverride None
-        # Apache 2.4 uses mod_authz_host for access control now (instead of
-        #  "Allow")
-        <IfVersion < 2.4>
-            Order allow,deny
-            Allow from all
-        </IfVersion>
-        <IfVersion >= 2.4>
-            Require all granted
-        </IfVersion>
+        Require all granted
     </Directory>
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%{cu}t %M"
-    </IfVersion>
+    ErrorLogFormat "%{cu}t %M"
     ErrorLog /var/log/%APACHE_NAME%/horizon_error.log
     LogLevel warn
     CustomLog /var/log/%APACHE_NAME%/horizon_access.log combined
diff --git a/files/apache-nova-api.template b/files/apache-nova-api.template
index bcf406edf3..66fcf73cf2 100644
--- a/files/apache-nova-api.template
+++ b/files/apache-nova-api.template
@@ -6,9 +6,7 @@ Listen %PUBLICPORT%
     WSGIScriptAlias / %PUBLICWSGI%
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%M"
-    </IfVersion>
+    ErrorLogFormat "%M"
     ErrorLog /var/log/%APACHE_NAME%/nova-api.log
     %SSLENGINE%
     %SSLCERTFILE%
diff --git a/files/apache-nova-metadata.template b/files/apache-nova-metadata.template
index 6231c1ced8..64be03166e 100644
--- a/files/apache-nova-metadata.template
+++ b/files/apache-nova-metadata.template
@@ -6,9 +6,7 @@ Listen %PUBLICPORT%
     WSGIScriptAlias / %PUBLICWSGI%
     WSGIApplicationGroup %{GLOBAL}
     WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%M"
-    </IfVersion>
+    ErrorLogFormat "%M"
     ErrorLog /var/log/%APACHE_NAME%/nova-metadata.log
     %SSLENGINE%
     %SSLCERTFILE%
diff --git a/files/apache-placement-api.template b/files/apache-placement-api.template
deleted file mode 100644
index 011abb95fc..0000000000
--- a/files/apache-placement-api.template
+++ /dev/null
@@ -1,27 +0,0 @@
-# NOTE(sbauza): This virtualhost is only here because some directives can
-# only be set by a virtualhost or server context, so that's why the port is not bound.
-# TODO(sbauza): Find a better way to identify a free port that is not corresponding to an existing
-# vhost.
-<VirtualHost *:8780>
-    WSGIDaemonProcess placement-api processes=%APIWORKERS% threads=1 user=%USER% display-name=%{GROUP} %VIRTUALENV%
-    WSGIProcessGroup placement-api
-    WSGIScriptAlias / %PUBLICWSGI%
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-    <IfVersion >= 2.4>
-      ErrorLogFormat "%M"
-    </IfVersion>
-    ErrorLog /var/log/%APACHE_NAME%/placement-api.log
-    %SSLENGINE%
-    %SSLCERTFILE%
-    %SSLKEYFILE%
-</VirtualHost>
-
-Alias /placement %PUBLICWSGI%
-<Location /placement>
-    SetHandler wsgi-script
-    Options +ExecCGI
-    WSGIProcessGroup placement-api
-    WSGIApplicationGroup %{GLOBAL}
-    WSGIPassAuthorization On
-</Location>
diff --git a/files/debs/general b/files/debs/general
index 364f3cc6e2..0cddcf05f4 100644
--- a/files/debs/general
+++ b/files/debs/general
@@ -11,10 +11,8 @@ gettext  # used for compiling message catalogs
 git
 graphviz # needed for docs
 iputils-ping
-libapache2-mod-proxy-uwsgi
 libffi-dev # for pyOpenSSL
 libjpeg-dev # Pillow 3.0.0
-libpcre3-dev # for python-pcre
 libpq-dev  # psycopg2
 libssl-dev # for pyOpenSSL
 libsystemd-dev # for systemd-python
@@ -35,5 +33,4 @@ tcpdump
 unzip
 uuid-runtime
 wget
-wget
 zlib1g-dev
diff --git a/files/rpms/general b/files/rpms/general
index 8a5755cc37..6f4572c708 100644
--- a/files/rpms/general
+++ b/files/rpms/general
@@ -10,9 +10,10 @@ glibc-langpack-en # dist:rhel9
 graphviz # needed only for docs
 httpd
 httpd-devel
-iptables-nft # dist:rhel9
+iptables-nft # dist:rhel9,rhel10
 iptables-services
-java-1.8.0-openjdk-headless
+java-1.8.0-openjdk-headless # not:rhel10
+java-21-openjdk-headless # dist:rhel10
 libffi-devel
 libjpeg-turbo-devel # Pillow 3.0.0
 libxml2-devel # lxml
@@ -23,7 +24,8 @@ net-tools
 openssh-server
 openssl
 openssl-devel # to rebuild pyOpenSSL if needed
-pcre-devel # for python-pcre
+pcre2-devel # dist:rhel10 for python-pcre2
+pcre-devel # not:rhel10 for python-pcre
 pkgconfig
 postgresql-devel  # psycopg2
 psmisc
diff --git a/files/rpms/n-cpu b/files/rpms/n-cpu
index 7ce5a72d6b..3d50f3a062 100644
--- a/files/rpms/n-cpu
+++ b/files/rpms/n-cpu
@@ -1,10 +1,9 @@
 cryptsetup
 dosfstools
-genisoimage # not:rhel9
 iscsi-initiator-utils
 libosinfo
 lvm2
 sg3_utils
 # Stuff for diablo volumes
 sysfsutils
-xorriso # not:rhel8
+xorriso
diff --git a/files/rpms/nova b/files/rpms/nova
index e0f13b854a..d0f843bb60 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -1,7 +1,6 @@
 conntrack-tools
 curl
 ebtables
-genisoimage # not:rhel9 required for config_drive
 iptables
 iputils
 kernel-modules # not:openEuler-22.03
@@ -11,4 +10,4 @@ polkit
 rabbitmq-server # NOPRIME
 sqlite
 sudo
-xorriso # not:rhel8
+xorriso
diff --git a/files/rpms/swift b/files/rpms/swift
index 49a1833dc4..c3921a47d4 100644
--- a/files/rpms/swift
+++ b/files/rpms/swift
@@ -4,4 +4,3 @@ memcached
 rsync-daemon
 sqlite
 xfsprogs
-xinetd # not:f36,rhel9
diff --git a/files/swift/rsyncd.conf b/files/swift/rsyncd.conf
index c49f716fa7..937d6c4b9a 100644
--- a/files/swift/rsyncd.conf
+++ b/files/swift/rsyncd.conf
@@ -6,74 +6,74 @@ address = 127.0.0.1
 
 [account6612]
 max connections = 25
-path = %SWIFT_DATA_DIR%/1/node/
+path = %SWIFT_DATA_DIR%/1/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/account6612.lock
 
 [account6622]
 max connections = 25
-path = %SWIFT_DATA_DIR%/2/node/
+path = %SWIFT_DATA_DIR%/2/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/account6622.lock
 
 [account6632]
 max connections = 25
-path = %SWIFT_DATA_DIR%/3/node/
+path = %SWIFT_DATA_DIR%/3/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/account6632.lock
 
 [account6642]
 max connections = 25
-path = %SWIFT_DATA_DIR%/4/node/
+path = %SWIFT_DATA_DIR%/4/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/account6642.lock
 
 
 [container6611]
 max connections = 25
-path = %SWIFT_DATA_DIR%/1/node/
+path = %SWIFT_DATA_DIR%/1/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/container6611.lock
 
 [container6621]
 max connections = 25
-path = %SWIFT_DATA_DIR%/2/node/
+path = %SWIFT_DATA_DIR%/2/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/container6621.lock
 
 [container6631]
 max connections = 25
-path = %SWIFT_DATA_DIR%/3/node/
+path = %SWIFT_DATA_DIR%/3/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/container6631.lock
 
 [container6641]
 max connections = 25
-path = %SWIFT_DATA_DIR%/4/node/
+path = %SWIFT_DATA_DIR%/4/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/container6641.lock
 
 
 [object6613]
 max connections = 25
-path = %SWIFT_DATA_DIR%/1/node/
+path = %SWIFT_DATA_DIR%/1/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/object6613.lock
 
 [object6623]
 max connections = 25
-path = %SWIFT_DATA_DIR%/2/node/
+path = %SWIFT_DATA_DIR%/2/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/object6623.lock
 
 [object6633]
 max connections = 25
-path = %SWIFT_DATA_DIR%/3/node/
+path = %SWIFT_DATA_DIR%/3/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/object6633.lock
 
 [object6643]
 max connections = 25
-path = %SWIFT_DATA_DIR%/4/node/
+path = %SWIFT_DATA_DIR%/4/
 read only = false
 lock file = %SWIFT_DATA_DIR%/run/object6643.lock
diff --git a/functions b/functions
index 42d08d7c4a..63c6318c2e 100644
--- a/functions
+++ b/functions
@@ -47,6 +47,10 @@ function short_source {
 # export it so child shells have access to the 'short_source' function also.
 export -f short_source
 
+EXTRA_FILES_RETRY=${EXTRA_FILES_RETRY:-3}
+EXTRA_FILES_RETRY_ERRORS=${EXTRA_FILES_RETRY_ERRORS:-"500,503"}
+EXTRA_FILES_DOWNLOAD_TIMEOUT=${EXTRA_FILES_DOWNLOAD_TIMEOUT:-2}
+EXTRA_FILES_RETRY_TIMEOUT=${EXTRA_FILES_RETRY_TIMEOUT:-10}
 # Download a file from a URL
 #
 # Will check cache (in $FILES) or download given URL.
@@ -55,17 +59,20 @@ export -f short_source
 #
 # Will echo the local path to the file as the output.  Will die on
 # failure to download.
-#
+
 # Files can be pre-cached for CI environments, see EXTRA_CACHE_URLS
 # and tools/image_list.sh
 function get_extra_file {
     local file_url=$1
-
-    file_name=$(basename "$file_url")
+    local retry_args="--retry-on-host-error --retry-on-http-error=${EXTRA_FILES_RETRY_ERRORS} "
+    retry_args+="-t ${EXTRA_FILES_DOWNLOAD_TIMEOUT} --waitretry=${EXTRA_FILES_RETRY_TIMEOUT} "
+    retry_args+="--tries=${EXTRA_FILES_RETRY} --retry-connrefused"
+    # Using Bash parameter expansion (##*/) instead of external 'basename'
+    local file_name="${file_url##*/}"
     if [[ $file_url != file* ]]; then
         # If the file isn't cache, download it
         if [[ ! -f $FILES/$file_name ]]; then
-            wget --progress=dot:giga -t 2 -c $file_url -O $FILES/$file_name
+            wget --progress=dot:giga  ${retry_args} -c $file_url -O $FILES/$file_name
             if [[ $? -ne 0 ]]; then
                 die "$file_url could not be downloaded"
             fi
@@ -74,7 +81,7 @@ function get_extra_file {
         return
     else
         # just strip the file:// bit and that's the path to the file
-        echo $file_url | sed 's/$file:\/\///g'
+        echo "${file_url#file://}"
     fi
 }
 
@@ -147,7 +154,8 @@ function upload_image {
                 if [[ $rc -ne 0 ]]; then
                     if [[ "$attempt" -eq "$max_attempts" ]]; then
                         echo "Not found: $image_url"
-                        return
+                        # Signal failure to download to the caller, so they can fail early
+                        return 1
                     fi
                     echo "Download failed, retrying in $attempt second, attempt: $attempt"
                     sleep $attempt
diff --git a/functions-common b/functions-common
index e265256ccf..b3a4b57f01 100644
--- a/functions-common
+++ b/functions-common
@@ -43,6 +43,9 @@ declare -A -g GITREPO
 declare -A -g GITBRANCH
 declare -A -g GITDIR
 
+# Systemd service file environment variables per service
+declare -A -g SYSTEMD_ENV_VARS
+
 KILL_PATH="$(which kill)"
 
 # Save these variables to .stackenv
@@ -51,6 +54,8 @@ STACK_ENV_VARS="BASE_SQL_CONN DATA_DIR DEST ENABLED_SERVICES HOST_IP \
     LOGFILE OS_CACERT SERVICE_HOST STACK_USER TLS_IP \
     HOST_IPV6 SERVICE_IP_VERSION TUNNEL_ENDPOINT_IP TUNNEL_IP_VERSION"
 
+OPENSTACKCLIENT_CONF_DIR=/etc/openstack
+
 
 # Saves significant environment variables to .stackenv for later use
 # Refers to a lot of globals, only TOP_DIR and STACK_ENV_VARS are required to
@@ -76,10 +81,10 @@ function write_clouds_yaml {
     # overridable. There is currently no usecase where doing so makes sense, so
     # it's not currently configurable.
 
-    CLOUDS_YAML=/etc/openstack/clouds.yaml
+    CLOUDS_YAML=${OPENSTACKCLIENT_CONF_DIR}/clouds.yaml
 
-    sudo mkdir -p $(dirname $CLOUDS_YAML)
-    sudo chown -R $STACK_USER /etc/openstack
+    sudo mkdir -p $OPENSTACKCLIENT_CONF_DIR
+    sudo chown -R $STACK_USER $OPENSTACKCLIENT_CONF_DIR
 
     CA_CERT_ARG=''
     if [ -f "$SSL_BUNDLE_FILE" ]; then
@@ -420,7 +425,7 @@ function _ensure_lsb_release {
     elif [[ -x $(command -v zypper 2>/dev/null) ]]; then
         sudo zypper -n install lsb-release
     elif [[ -x $(command -v dnf 2>/dev/null) ]]; then
-        sudo dnf install -y redhat-lsb-core || sudo dnf install -y openeuler-lsb
+        sudo dnf install -y python3-distro || sudo dnf install -y openeuler-lsb
     else
         die $LINENO "Unable to find or auto-install lsb_release"
     fi
@@ -433,15 +438,12 @@ function _ensure_lsb_release {
 #  - os_VENDOR
 #  - os_PACKAGE
 function GetOSVersion {
-    # CentOS Stream 9 and RHEL 9 do not provide lsb_release
+    # CentOS Stream 9 or later and RHEL 9 or later do not provide lsb_release
     source /etc/os-release
-    if [[ "${ID}${VERSION}" == "centos9" ]] || [[ "${ID}${VERSION}" =~ "rhel9" ]]; then
+    if [[ "${ID}" =~ (almalinux|centos|rocky|rhel) ]]; then
         os_RELEASE=${VERSION_ID}
-        os_CODENAME="n/a"
+        os_CODENAME=$(echo $VERSION | grep -oP '(?<=[(])[^)]*' || echo 'n/a')
         os_VENDOR=$(echo $NAME | tr -d '[:space:]')
-    elif [[ "${ID}${VERSION}" =~ "rocky9" ]]; then
-        os_VENDOR="Rocky"
-        os_RELEASE=${VERSION_ID}
     else
         _ensure_lsb_release
 
@@ -480,11 +482,10 @@ function GetDistro {
         "$os_VENDOR" =~ (AlmaLinux) || \
         "$os_VENDOR" =~ (Scientific) || \
         "$os_VENDOR" =~ (OracleServer) || \
-        "$os_VENDOR" =~ (Rocky) || \
+        "$os_VENDOR" =~ (RockyLinux) || \
         "$os_VENDOR" =~ (Virtuozzo) ]]; then
-        # Drop the . release as we assume it's compatible
-        # XXX re-evaluate when we get RHEL10
-        DISTRO="rhel${os_RELEASE::1}"
+        MAJOR_VERSION=$(echo $os_RELEASE | cut -d. -f1)
+        DISTRO="rhel${MAJOR_VERSION}"
     elif [[ "$os_VENDOR" =~ (openEuler) ]]; then
         DISTRO="openEuler-$os_RELEASE"
     else
@@ -518,17 +519,6 @@ function is_arch {
     [[ "$(uname -m)" == "$1" ]]
 }
 
-# Determine if current distribution is an Oracle distribution
-# is_oraclelinux
-function is_oraclelinux {
-    if [[ -z "$os_VENDOR" ]]; then
-        GetOSVersion
-    fi
-
-    [ "$os_VENDOR" = "OracleServer" ]
-}
-
-
 # Determine if current distribution is a Fedora-based distribution
 # (Fedora, RHEL, CentOS, Rocky, etc).
 # is_fedora
@@ -542,7 +532,7 @@ function is_fedora {
         [ "$os_VENDOR" = "RedHatEnterpriseServer" ] || \
         [ "$os_VENDOR" = "RedHatEnterprise" ] || \
         [ "$os_VENDOR" = "RedHatEnterpriseLinux" ] || \
-        [ "$os_VENDOR" = "Rocky" ] || \
+        [ "$os_VENDOR" = "RockyLinux" ] || \
         [ "$os_VENDOR" = "CentOS" ] || [ "$os_VENDOR" = "CentOSStream" ] || \
         [ "$os_VENDOR" = "AlmaLinux" ] || \
         [ "$os_VENDOR" = "OracleServer" ] || [ "$os_VENDOR" = "Virtuozzo" ]
@@ -1642,6 +1632,9 @@ function _run_under_systemd {
         user=$STACK_USER
     fi
     local env_vars="$5"
+    if [[ -v SYSTEMD_ENV_VARS[$service] ]]; then
+        env_vars="${SYSTEMD_ENV_VARS[$service]} $env_vars"
+    fi
     if [[ "$command" =~ "uwsgi" ]] ; then
         if [[ "$GLOBAL_VENV" == "True" ]] ; then
             cmd="$cmd --venv $DEVSTACK_VENV"
diff --git a/inc/ini-config b/inc/ini-config
index f65e42d3a5..920d4775fa 100644
--- a/inc/ini-config
+++ b/inc/ini-config
@@ -189,8 +189,10 @@ function iniset {
     local option=$3
     local value=$4
 
-    # Escape the ampersand character (&)
-    value=$(echo $value | sed -e 's/&/\\&/g')
+    # Escape the ampersand (&) and backslash (\) characters for sed
+    # Order of substitution matters: we escape backslashes first before
+    # adding more backslashes to escape ampersands
+    value=$(echo $value | sed -e 's/\\/\\\\/g' -e 's/&/\\&/g')
 
     if [[ -z $section || -z $option ]]; then
         $xtrace
diff --git a/inc/meta-config b/inc/meta-config
index be73b60800..1215bb8307 100644
--- a/inc/meta-config
+++ b/inc/meta-config
@@ -185,11 +185,15 @@ function merge_config_group {
                 break
             fi
             dir=$(dirname $realconfigfile)
-            if [[ -d $dir ]]; then
-                merge_config_file $localfile $group $configfile
-            else
-                die $LINENO "bogus config file specification $configfile ($configfile=$realconfigfile, $dir is not a directory)"
+
+            test -e $dir && ! test -d $dir && die $LINENO "bogus config file specification $configfile ($configfile=$realconfigfile, $dir exists but it is not a directory)"
+
+            if ! [[ -e $dir ]] ; then
+                sudo mkdir -p $dir || die $LINENO "could not create the directory of $real_configfile ($configfile)"
+                sudo chown ${STACK_USER} $dir
             fi
+
+            merge_config_file $localfile $group $configfile
         done
     done
 }
diff --git a/inc/python b/inc/python
index 2083b74dc1..3969c1fa82 100644
--- a/inc/python
+++ b/inc/python
@@ -40,11 +40,8 @@ function setup_devstack_virtualenv {
         # Using system site packages to enable nova to use libguestfs.
         # This package is currently installed via the distro and not
         # available on pypi.
-        python$PYTHON3_VERSION -m venv --system-site-packages $DEVSTACK_VENV
-        pip_install -U pip setuptools
-        #NOTE(rpittau): workaround for simplejson removal in osc
-        #  https://review.opendev.org/c/openstack/python-openstackclient/+/920001
-        pip_install -U simplejson
+        $PYTHON -m venv --system-site-packages "${DEVSTACK_VENV}"
+        pip_install -U pip setuptools[core]
     fi
     if [[ ":$PATH:" != *":$DEVSTACK_VENV/bin:"* ]] ; then
         export PATH="$DEVSTACK_VENV/bin:$PATH"
@@ -199,13 +196,7 @@ function pip_install {
         echo "Using python $PYTHON3_VERSION to install $package_dir"
     else
         local cmd_pip="python$PYTHON3_VERSION -m pip"
-        # See
-        #  https://github.com/pypa/setuptools/issues/2232
-        #  http://lists.openstack.org/pipermail/openstack-discuss/2020-August/016905.html
-        # this makes setuptools >=50 use the platform distutils.
-        # We only want to do this on global pip installs, not if
-        # installing in a virtualenv
-        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8 SETUPTOOLS_USE_DISTUTILS=stdlib "
+        local sudo_pip="sudo -H LC_ALL=en_US.UTF-8"
         echo "Using python $PYTHON3_VERSION to install $package_dir"
     fi
 
@@ -282,8 +273,7 @@ function use_library_from_git {
 function lib_installed_from_git {
     local name=$1
     local safe_name
-    safe_name=$(python -c "from pkg_resources import safe_name; \
-        print(safe_name('${name}'))")
+    safe_name=$(python -c "from packaging import canonicalize_name; print(canonicalize_name('${name}'))")
     # Note "pip freeze" doesn't always work here, because it tries to
     # be smart about finding the remote of the git repo the package
     # was installed from.  This doesn't work with zuul which clones
@@ -498,11 +488,7 @@ function install_python3 {
     if is_ubuntu; then
         apt_get install python${PYTHON3_VERSION} python${PYTHON3_VERSION}-dev
     elif is_fedora; then
-        if [ "$os_VENDOR" = "Fedora" ]; then
-            install_package python${PYTHON3_VERSION//.}
-        else
-            install_package python${PYTHON3_VERSION//.} python${PYTHON3_VERSION//.}-devel
-        fi
+        install_package python${PYTHON3_VERSION}-devel python${PYTHON3_VERSION}-pip
     fi
 }
 
diff --git a/lib/apache b/lib/apache
index 1420f76ff2..b3379a7cde 100644
--- a/lib/apache
+++ b/lib/apache
@@ -53,13 +53,16 @@ APACHE_LOG_DIR="/var/log/${APACHE_NAME}"
 # Enable apache mod and restart apache if it isn't already enabled.
 function enable_apache_mod {
     local mod=$1
+    local should_restart=$2
     # Apache installation, because we mark it NOPRIME
     if is_ubuntu; then
         # Skip mod_version as it is not a valid mod to enable
         # on debuntu, instead it is built in.
         if [[ "$mod" != "version" ]] && ! a2query -m $mod ; then
             sudo a2enmod $mod
-            restart_apache_server
+            if [[ "$should_restart" != "norestart" ]] ; then
+                restart_apache_server
+            fi
         fi
     elif is_fedora; then
         # pass
@@ -79,14 +82,14 @@ function install_apache_uwsgi {
     fi
 
     if is_ubuntu; then
-        local pkg_list="uwsgi uwsgi-plugin-python3 libapache2-mod-proxy-uwsgi"
+        local pkg_list="uwsgi uwsgi-plugin-python3"
         install_package ${pkg_list}
     # NOTE(ianw) 2022-02-03 : Fedora 35 needs to skip this and fall
     # into the install-from-source because the upstream packages
     # didn't fix Python 3.10 compatibility before release.  Should be
     # fixed in uwsgi 4.9.0; can remove this when packages available
     # or we drop this release
-    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ f36 ]]; then
+    elif is_fedora && ! is_openeuler && ! [[ $DISTRO =~ rhel9 ]]; then
         # Note httpd comes with mod_proxy_uwsgi and it is loaded by
         # default; the mod_proxy_uwsgi package actually conflicts now.
         # See:
@@ -113,15 +116,13 @@ function install_apache_uwsgi {
     fi
 
     if is_ubuntu; then
-        # we've got to enable proxy and proxy_uwsgi for this to work
-        sudo a2enmod proxy
-        sudo a2enmod proxy_uwsgi
-    elif is_fedora; then
-        # redhat is missing a nice way to turn on/off modules
-        echo "LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so" \
-            | sudo tee /etc/httpd/conf.modules.d/02-proxy-uwsgi.conf
+        if ! a2query -m proxy || ! a2query -m proxy_uwsgi ; then
+            # we've got to enable proxy and proxy_uwsgi for this to work
+            sudo a2enmod proxy
+            sudo a2enmod proxy_uwsgi
+            restart_apache_server
+        fi
     fi
-    restart_apache_server
 }
 
 # install_apache_wsgi() - Install Apache server and wsgi module
@@ -136,7 +137,7 @@ function install_apache_wsgi {
         install_package libapache2-mod-wsgi-py3
     elif is_fedora; then
         sudo rm -f /etc/httpd/conf.d/000-*
-        install_package httpd python3-mod_wsgi
+        install_package httpd python${PYTHON3_VERSION}-mod_wsgi
         # rpm distros dont enable httpd by default so enable it to support reboots.
         sudo systemctl enable httpd
         # For consistency with Ubuntu, switch to the worker mpm, as
@@ -293,6 +294,8 @@ function write_uwsgi_config {
     iniset "$conf" uwsgi add-header "Connection: close"
     # This ensures that file descriptors aren't shared between processes.
     iniset "$conf" uwsgi lazy-apps true
+    # Starting time of the WSGi server
+    iniset "$conf" uwsgi start-time %t
 
     # If we said bind directly to http, then do that and don't start the apache proxy
     if [[ -n "$http" ]]; then
@@ -311,9 +314,7 @@ function write_uwsgi_config {
 # For services using chunked encoding, the only services known to use this
 # currently are Glance and Swift, we need to use an http proxy instead of
 # mod_proxy_uwsgi because the chunked encoding gets dropped. See:
-# https://github.com/unbit/uwsgi/issues/1540 You can workaround this on python2
-# but that involves having apache buffer the request before sending it to
-# uwsgi.
+# https://github.com/unbit/uwsgi/issues/1540.
 function write_local_uwsgi_http_config {
     local conf=$1
     local wsgi=$2
@@ -367,6 +368,8 @@ function write_local_uwsgi_http_config {
     iniset "$conf" uwsgi http-keepalive false
     # Increase socket timeout for slow chunked uploads
     iniset "$conf" uwsgi socket-timeout 30
+    # Starting time of the WSGi server
+    iniset "$conf" uwsgi start-time %t
 
     enable_apache_mod proxy
     enable_apache_mod proxy_http
diff --git a/lib/atop b/lib/atop
new file mode 100644
index 0000000000..25c8e9a83f
--- /dev/null
+++ b/lib/atop
@@ -0,0 +1,49 @@
+#!/bin/bash
+#
+# lib/atop
+# Functions to start and stop atop
+
+# Dependencies:
+#
+# - ``functions`` file
+
+# ``stack.sh`` calls the entry points in this order:
+#
+# - configure_atop
+# - install_atop
+# - start_atop
+# - stop_atop
+
+# Save trace setting
+_XTRACE_ATOP=$(set +o | grep xtrace)
+set +o xtrace
+
+function configure_atop {
+    mkdir -p $LOGDIR/atop
+    cat <<EOF | sudo tee /etc/default/atop >/dev/null
+# /etc/default/atop
+# see man atoprc for more possibilities to configure atop execution
+
+LOGOPTS="-R"
+LOGINTERVAL=${ATOP_LOGINTERVAL:-"30"}
+LOGGENERATIONS=${ATOP_LOGGENERATIONS:-"1"}
+LOGPATH=$LOGDIR/atop
+EOF
+}
+
+function install_atop {
+    install_package atop
+}
+
+# start_() - Start running processes
+function start_atop {
+    start_service atop
+}
+
+# stop_atop() stop atop process
+function stop_atop {
+    stop_service atop
+}
+
+# Restore xtrace
+$_XTRACE_ATOP
diff --git a/lib/cinder b/lib/cinder
index 259018e7ab..ca641c2949 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -59,10 +59,11 @@ else
 fi
 
 CINDER_STATE_PATH=${CINDER_STATE_PATH:=$DATA_DIR/cinder}
+OS_BRICK_LOCK_PATH=${OS_BRICK_LOCK_PATH:=$DATA_DIR/os_brick}
 
 CINDER_CONF_DIR=/etc/cinder
 CINDER_CONF=$CINDER_CONF_DIR/cinder.conf
-CINDER_UWSGI=$CINDER_BIN_DIR/cinder-wsgi
+CINDER_UWSGI=cinder.wsgi.api:application
 CINDER_UWSGI_CONF=$CINDER_CONF_DIR/cinder-api-uwsgi.ini
 CINDER_API_PASTE_INI=$CINDER_CONF_DIR/api-paste.ini
 
@@ -303,15 +304,6 @@ function configure_cinder {
 
     cp $CINDER_DIR/etc/cinder/api-paste.ini $CINDER_API_PASTE_INI
 
-    inicomment $CINDER_API_PASTE_INI filter:authtoken auth_host
-    inicomment $CINDER_API_PASTE_INI filter:authtoken auth_port
-    inicomment $CINDER_API_PASTE_INI filter:authtoken auth_protocol
-    inicomment $CINDER_API_PASTE_INI filter:authtoken cafile
-    inicomment $CINDER_API_PASTE_INI filter:authtoken admin_tenant_name
-    inicomment $CINDER_API_PASTE_INI filter:authtoken admin_user
-    inicomment $CINDER_API_PASTE_INI filter:authtoken admin_password
-    inicomment $CINDER_API_PASTE_INI filter:authtoken signing_dir
-
     configure_keystone_authtoken_middleware $CINDER_CONF cinder
 
     iniset $CINDER_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
@@ -321,7 +313,6 @@ function configure_cinder {
     iniset $CINDER_CONF DEFAULT api_paste_config $CINDER_API_PASTE_INI
     iniset $CINDER_CONF DEFAULT rootwrap_config "$CINDER_CONF_DIR/rootwrap.conf"
     iniset $CINDER_CONF DEFAULT osapi_volume_extension cinder.api.contrib.standard_extensions
-    iniset $CINDER_CONF DEFAULT osapi_volume_listen $CINDER_SERVICE_LISTEN_ADDRESS
     iniset $CINDER_CONF DEFAULT state_path $CINDER_STATE_PATH
     iniset $CINDER_CONF oslo_concurrency lock_path $CINDER_STATE_PATH
     iniset $CINDER_CONF DEFAULT my_ip "$CINDER_MY_IP"
@@ -389,7 +380,6 @@ function configure_cinder {
     if is_service_enabled tls-proxy; then
         if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
             # Set the service port for a proxy to take the original
-            iniset $CINDER_CONF DEFAULT osapi_volume_listen_port $CINDER_SERVICE_PORT_INT
             iniset $CINDER_CONF oslo_middleware enable_proxy_headers_parsing True
         fi
     fi
@@ -404,23 +394,24 @@ function configure_cinder {
     setup_logging $CINDER_CONF
 
     if is_service_enabled c-api; then
-        write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume"
+        write_uwsgi_config "$CINDER_UWSGI_CONF" "$CINDER_UWSGI" "/volume" "" "cinder-api"
     fi
 
     if [[ -r $CINDER_PLUGINS/$CINDER_DRIVER ]]; then
         configure_cinder_driver
     fi
 
-    iniset $CINDER_CONF DEFAULT osapi_volume_workers "$API_WORKERS"
-
     iniset $CINDER_CONF DEFAULT glance_api_servers "$GLANCE_URL"
     if is_service_enabled tls-proxy; then
         iniset $CINDER_CONF DEFAULT glance_protocol https
         iniset $CINDER_CONF DEFAULT glance_ca_certificates_file $SSL_BUNDLE_FILE
     fi
 
+    # Set glance credentials (used for location APIs)
+    configure_keystone_authtoken_middleware $CINDER_CONF glance glance
+
     # Set nova credentials (used for os-assisted-snapshots)
-    configure_keystone_authtoken_middleware $CINDER_CONF nova nova
+    configure_keystoneauth $CINDER_CONF nova nova
     iniset $CINDER_CONF nova region_name "$REGION_NAME"
     iniset $CINDER_CONF DEFAULT graceful_shutdown_timeout "$SERVICE_GRACEFUL_SHUTDOWN_TIMEOUT"
 
@@ -511,6 +502,21 @@ function init_cinder {
     mkdir -p $CINDER_STATE_PATH/volumes
 }
 
+
+function init_os_brick {
+    mkdir -p $OS_BRICK_LOCK_PATH
+    if is_service_enabled cinder; then
+        iniset $CINDER_CONF os_brick lock_path $OS_BRICK_LOCK_PATH
+    fi
+    if is_service_enabled nova; then
+        iniset $NOVA_CONF os_brick lock_path $OS_BRICK_LOCK_PATH
+    fi
+    if is_service_enabled glance; then
+        iniset $GLANCE_API_CONF os_brick lock_path $OS_BRICK_LOCK_PATH
+        iniset $GLANCE_CACHE_CONF os_brick lock_path $OS_BRICK_LOCK_PATH
+    fi
+}
+
 # install_cinder() - Collect source and prepare
 function install_cinder {
     git_clone $CINDER_REPO $CINDER_DIR $CINDER_BRANCH
@@ -592,9 +598,6 @@ function _configure_tgt_for_config_d {
 
 # start_cinder() - Start running processes
 function start_cinder {
-    local service_port=$CINDER_SERVICE_PORT
-    local service_protocol=$CINDER_SERVICE_PROTOCOL
-    local cinder_url
     if [ "$CINDER_TARGET_HELPER" = "tgtadm" ]; then
         if is_service_enabled c-vol; then
             # Delete any old stack.conf
@@ -610,12 +613,12 @@ function start_cinder {
         fi
     fi
 
-    if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
-        run_process "c-api" "$(which uwsgi) --procname-prefix cinder-api --ini $CINDER_UWSGI_CONF"
-        cinder_url=$service_protocol://$SERVICE_HOST/volume/v3
-    fi
+    run_process "c-api" "$(which uwsgi) --procname-prefix cinder-api --ini $CINDER_UWSGI_CONF"
 
     echo "Waiting for Cinder API to start..."
+    # Check that the cinder API service is running,
+    local cinder_url=$CINDER_SERVICE_PROTOCOL://$SERVICE_HOST/volume/v3/
+
     if ! wait_for_service $SERVICE_TIMEOUT $cinder_url; then
         die $LINENO "c-api did not start"
     fi
@@ -653,7 +656,7 @@ function create_one_type {
         # TODO (e0ne): use openstack client once it will support cinder in noauth mode:
         # https://bugs.launchpad.net/python-cinderclient/+bug/1755279
         local cinder_url
-        cinder_url=$CINDER_SERVICE_PROTOCOL://$SERVICE_HOST:$CINDER_SERVICE_PORT/v3
+        cinder_url=$CINDER_SERVICE_PROTOCOL://$SERVICE_HOST/volume/v3
         OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-create $type_name
         OS_USER_ID=$OS_USERNAME OS_PROJECT_ID=$OS_PROJECT_NAME cinder --os-auth-type noauth --os-endpoint=$cinder_url type-key $type_name set $property_key="$property_value"
     fi
@@ -730,9 +733,8 @@ function configure_cinder_volume_upload {
 }
 
 function init_cinder_service_user_conf {
-    configure_keystone_authtoken_middleware $CINDER_CONF cinder service_user
     iniset $CINDER_CONF service_user send_service_user_token True
-    iniset $CINDER_CONF service_user auth_strategy keystone
+    configure_keystoneauth $CINDER_CONF cinder service_user
 }
 
 # Restore xtrace
diff --git a/lib/cinder_backends/ceph b/lib/cinder_backends/ceph
index 0b465730c0..adcff1883b 100644
--- a/lib/cinder_backends/ceph
+++ b/lib/cinder_backends/ceph
@@ -40,7 +40,6 @@ function configure_cinder_backend_ceph {
     iniset $CINDER_CONF $be_name rbd_secret_uuid "$CINDER_CEPH_UUID"
     iniset $CINDER_CONF $be_name rbd_flatten_volume_from_snapshot False
     iniset $CINDER_CONF $be_name rbd_max_clone_depth 5
-    iniset $CINDER_CONF DEFAULT glance_api_version 2
 }
 
 # Restore xtrace
diff --git a/lib/cinder_backends/ceph_iscsi b/lib/cinder_backends/ceph_iscsi
index 94412e0da6..10806f26e0 100644
--- a/lib/cinder_backends/ceph_iscsi
+++ b/lib/cinder_backends/ceph_iscsi
@@ -43,7 +43,6 @@ function configure_cinder_backend_ceph_iscsi {
     iniset $CINDER_CONF $be_name rbd_iscsi_target_iqn "$CEPH_ISCSI_TARGET_IQN"
     iniset $CINDER_CONF $be_name rbd_flatten_volume_from_snapshot False
     iniset $CINDER_CONF $be_name rbd_max_clone_depth 5
-    iniset $CINDER_CONF DEFAULT glance_api_version 2
 
     pip_install rbd-iscsi-client
 }
diff --git a/lib/cinder_backups/ceph b/lib/cinder_backups/ceph
index 4b180490d7..e4d6b96407 100644
--- a/lib/cinder_backups/ceph
+++ b/lib/cinder_backups/ceph
@@ -19,6 +19,7 @@ set +o xtrace
 # Defaults
 # --------
 
+CINDER_BAK_CEPH_MAX_SNAPSHOTS=${CINDER_BAK_CEPH_MAX_SNAPSHOTS:-0}
 CINDER_BAK_CEPH_POOL=${CINDER_BAK_CEPH_POOL:-backups}
 CINDER_BAK_CEPH_POOL_PG=${CINDER_BAK_CEPH_POOL_PG:-8}
 CINDER_BAK_CEPH_POOL_PGP=${CINDER_BAK_CEPH_POOL_PGP:-8}
@@ -32,12 +33,13 @@ function configure_cinder_backup_ceph {
         if [[ "$REMOTE_CEPH" = "False" && "$CEPH_REPLICAS" -ne 1 ]]; then
             sudo ceph -c ${CEPH_CONF_FILE} osd pool set ${CINDER_BAK_CEPH_POOL} crush_ruleset ${RULE_ID}
         fi
-        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "allow r" osd "allow class-read object_prefix rbd_children, allow rwx pool=${CINDER_BAK_CEPH_POOL}, allow rwx pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
-        sudo chown $(whoami):$(whoami) ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+        sudo ceph -c ${CEPH_CONF_FILE} auth get-or-create client.${CINDER_BAK_CEPH_USER} mon "profile rbd" osd "profile rbd pool=${CINDER_BAK_CEPH_POOL}, profile rbd pool=${CINDER_CEPH_POOL}" | sudo tee ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
+        sudo chown $STACK_USER ${CEPH_CONF_DIR}/ceph.client.${CINDER_BAK_CEPH_USER}.keyring
     fi
 
     iniset $CINDER_CONF DEFAULT backup_driver "cinder.backup.drivers.ceph.CephBackupDriver"
     iniset $CINDER_CONF DEFAULT backup_ceph_conf "$CEPH_CONF_FILE"
+    iniset $CINDER_CONF DEFAULT backup_ceph_max_snapshots "$CINDER_BAK_CEPH_MAX_SNAPSHOTS"
     iniset $CINDER_CONF DEFAULT backup_ceph_pool "$CINDER_BAK_CEPH_POOL"
     iniset $CINDER_CONF DEFAULT backup_ceph_user "$CINDER_BAK_CEPH_USER"
     iniset $CINDER_CONF DEFAULT backup_ceph_stripe_unit 0
diff --git a/lib/databases/mysql b/lib/databases/mysql
index e069e128e9..4def1842a7 100644
--- a/lib/databases/mysql
+++ b/lib/databases/mysql
@@ -18,9 +18,9 @@ register_database mysql
 
 if [[ -z "$MYSQL_SERVICE_NAME" ]]; then
     MYSQL_SERVICE_NAME=mysql
-    if is_fedora && ! is_oraclelinux; then
+    if is_fedora; then
         MYSQL_SERVICE_NAME=mariadb
-    elif [[ "$DISTRO" =~ bookworm|bullseye ]]; then
+    elif [[ "$DISTRO" =~ trixie|bookworm|bullseye ]]; then
         MYSQL_SERVICE_NAME=mariadb
     fi
 fi
@@ -44,15 +44,9 @@ function cleanup_database_mysql {
         apt_get purge -y mysql* mariadb*
         sudo rm -rf /var/lib/mysql
         sudo rm -rf /etc/mysql
-        return
-    elif is_oraclelinux; then
-        uninstall_package mysql-community-server
-        sudo rm -rf /var/lib/mysql
     elif is_fedora; then
         uninstall_package mariadb-server
         sudo rm -rf /var/lib/mysql
-    else
-        return
     fi
 }
 
@@ -68,8 +62,6 @@ function configure_database_mysql {
 
     if is_ubuntu; then
         my_conf=/etc/mysql/my.cnf
-    elif is_oraclelinux; then
-        my_conf=/etc/my.cnf
     elif is_fedora; then
         my_conf=/etc/my.cnf
         local cracklib_conf=/etc/my.cnf.d/cracklib_password_check.cnf
@@ -101,13 +93,20 @@ function configure_database_mysql {
         restart_service $MYSQL_SERVICE_NAME
     fi
 
+    # MariaDB 10.4+ on modern Debian/Ubuntu uses unix_socket auth by default
+    # See https://mariadb.org/authentication-in-mariadb-10-4/
+    local use_mariadb_socket_auth=False
+    if is_ubuntu && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
+        if [[ ! "$DISTRO" =~ bookworm|bullseye ]]; then
+            use_mariadb_socket_auth=True
+        fi
+    fi
+
     # Set the root password - only works the first time. For Ubuntu, we already
     # did that with debconf before installing the package, but we still try,
     # because the package might have been installed already. We don't do this
-    # for Ubuntu 22.04 (jammy) because the authorization model change in
-    # version 10.4 of mariadb. See
-    # https://mariadb.org/authentication-in-mariadb-10-4/
-    if ! (is_ubuntu && [[ "$DISTRO" == "jammy" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
+    # for MariaDB with socket auth because the root password is managed differently.
+    if [[ "$use_mariadb_socket_auth" != "True" ]]; then
         sudo mysqladmin -u root password $DATABASE_PASSWORD || true
     fi
 
@@ -119,24 +118,30 @@ function configure_database_mysql {
         local cmd_args="-uroot -p$DATABASE_PASSWORD -h$SERVICE_LOCAL_HOST "
     fi
 
-    # In mariadb e.g. on Ubuntu socket plugin is used for authentication
-    # as root so it works only as sudo. To restore old "mysql like" behaviour,
-    # we need to change auth plugin for root user
-    # TODO(frickler): simplify this logic
-    if is_ubuntu && [[ ! "$DISTRO" =~ bookworm|bullseye ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]; then
-        if [[ "$DISTRO" == "jammy" ]]; then
-            # For Ubuntu 22.04 (jammy) we follow the model outlined in
-            # https://mariadb.org/authentication-in-mariadb-10-4/
-            sudo mysql -e "ALTER USER $DATABASE_USER@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD('$DATABASE_PASSWORD');"
-        else
-            sudo mysql $cmd_args -e "UPDATE mysql.user SET plugin='' WHERE user='$DATABASE_USER' AND host='localhost';"
-            sudo mysql $cmd_args -e "FLUSH PRIVILEGES;"
-        fi
+    # Workaround for mariadb > 11.6.2,
+    # see https://bugs.launchpad.net/nova/+bug/2116186/comments/3
+    min_db_ver="11.6.2"
+    db_version=$(sudo mysql ${cmd_args} -e "select version();" -sN | cut -d '-' -f 1)
+    max_db_ver=$(printf '%s\n' ${min_db_ver} ${db_version} | sort -V | tail -n 1)
+    if [[ "${min_db_ver}" != "${max_db_ver}" ]]; then
+        iniset -sudo $my_conf mysqld innodb_snapshot_isolation OFF
+        restart_service $MYSQL_SERVICE_NAME
+    fi
+
+    # Configure database user authentication
+    if [[ "$use_mariadb_socket_auth" == "True" ]]; then
+        # Allow both unix_socket (for sudo mysql) and password auth
+        # Using OR allows restacking without needing to reset auth in unstack
+        sudo mysql -e "ALTER USER $DATABASE_USER@localhost IDENTIFIED VIA unix_socket OR mysql_native_password USING PASSWORD('$DATABASE_PASSWORD');"
     fi
-    if ! (is_ubuntu && [[ "$DISTRO" == "jammy" ]] && [ "$MYSQL_SERVICE_NAME" == "mariadb" ]); then
-        # Create DB user if it does not already exist
+
+    # Create remote access user and grant privileges (needed for all distros)
+    if [[ "$use_mariadb_socket_auth" == "True" ]]; then
+        # Use sudo mysql since we have socket auth
+        sudo mysql -e "CREATE USER IF NOT EXISTS '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
+        sudo mysql -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%';"
+    else
         sudo mysql $cmd_args -e "CREATE USER IF NOT EXISTS '$DATABASE_USER'@'%' identified by '$DATABASE_PASSWORD';"
-        # Update the DB to give user '$DATABASE_USER'@'%' full control of the all databases:
         sudo mysql $cmd_args -e "GRANT ALL PRIVILEGES ON *.* TO '$DATABASE_USER'@'%';"
     fi
 
@@ -221,9 +226,7 @@ EOF
     fi
     # Install mysql-server
     if [[ "$INSTALL_DATABASE_SERVER_PACKAGES" == "True" ]]; then
-        if is_oraclelinux; then
-            install_package mysql-community-server
-        elif is_fedora; then
+        if is_fedora; then
             install_package mariadb-server mariadb-devel mariadb
             sudo systemctl enable $MYSQL_SERVICE_NAME
         elif is_ubuntu; then
diff --git a/lib/dstat b/lib/dstat
index 870c901d2a..9bd0370847 100644
--- a/lib/dstat
+++ b/lib/dstat
@@ -33,7 +33,7 @@ function start_dstat {
     # To enable memory_tracker add:
     #    enable_service memory_tracker
     # to your localrc
-    run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root"
+    run_process memory_tracker "$TOP_DIR/tools/memory_tracker.sh" "" "root" "PYTHON=python${PYTHON3_VERSION}"
 
     # TODO(jh): Fail when using the old service name otherwise consumers might
     # never notice that is has been removed.
diff --git a/lib/glance b/lib/glance
index 2eb4954f4a..9422c22141 100644
--- a/lib/glance
+++ b/lib/glance
@@ -41,6 +41,12 @@ else
     GLANCE_BIN_DIR=$(get_python_exec_prefix)
 fi
 
+#S3 for Glance
+GLANCE_USE_S3=$(trueorfalse False GLANCE_USE_S3)
+GLANCE_S3_DEFAULT_BACKEND=${GLANCE_S3_DEFAULT_BACKEND:-s3_fast}
+GLANCE_S3_BUCKET_ON_PUT=$(trueorfalse True GLANCE_S3_BUCKET_ON_PUT)
+GLANCE_S3_BUCKET_NAME=${GLANCE_S3_BUCKET_NAME:-images}
+
 # Cinder for Glance
 USE_CINDER_FOR_GLANCE=$(trueorfalse False USE_CINDER_FOR_GLANCE)
 # GLANCE_CINDER_DEFAULT_BACKEND should be one of the values
@@ -77,13 +83,6 @@ GLANCE_DEFAULT_BACKEND=${GLANCE_DEFAULT_BACKEND:-fast}
 GLANCE_CACHE_DIR=${GLANCE_CACHE_DIR:=$DATA_DIR/glance/cache}
 GLANCE_CACHE_DRIVER=${GLANCE_CACHE_DRIVER:-centralized_db}
 
-# Full Glance functionality requires running in standalone mode. If we are
-# not in uwsgi mode, then we are standalone, otherwise allow separate control.
-if [[ "$WSGI_MODE" != "uwsgi" ]]; then
-    GLANCE_STANDALONE=True
-fi
-GLANCE_STANDALONE=${GLANCE_STANDALONE:-False}
-
 # File path for each store specified in GLANCE_MULTIPLE_FILE_STORES, the store
 # identifier will be appended to this path at runtime. If GLANCE_MULTIPLE_FILE_STORES
 # has fast,cheap specified then filepath will be generated like $DATA_DIR/glance/fast
@@ -127,20 +126,13 @@ GLANCE_SERVICE_PORT=${GLANCE_SERVICE_PORT:-9292}
 GLANCE_SERVICE_PORT_INT=${GLANCE_SERVICE_PORT_INT:-19292}
 GLANCE_HOSTPORT=${GLANCE_HOSTPORT:-$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT}
 GLANCE_SERVICE_PROTOCOL=${GLANCE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
-GLANCE_UWSGI=$GLANCE_BIN_DIR/glance-wsgi-api
+GLANCE_UWSGI=glance.wsgi.api:application
 GLANCE_UWSGI_CONF=$GLANCE_CONF_DIR/glance-uwsgi.ini
 
 # Glance default limit for Devstack
-GLANCE_LIMIT_IMAGE_SIZE_TOTAL=${GLANCE_LIMIT_IMAGE_SIZE_TOTAL:-1000}
+GLANCE_LIMIT_IMAGE_SIZE_TOTAL=${GLANCE_LIMIT_IMAGE_SIZE_TOTAL:-2000}
 
-# If wsgi mode is uwsgi run glance under uwsgi, else default to eventlet
-# TODO(mtreinish): Remove the eventlet path here and in all the similar
-# conditionals below after the Pike release
-if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_SERVICE_HOST/image"
-else
-    GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_HOSTPORT"
-fi
+GLANCE_URL="$GLANCE_SERVICE_PROTOCOL://$GLANCE_SERVICE_HOST/image"
 
 # Functions
 # ---------
@@ -174,6 +166,34 @@ function cleanup_glance {
     remove_uwsgi_config "$GLANCE_UWSGI_CONF" "glance-wsgi-api"
 }
 
+# Set multiple s3 store related config options
+#
+function configure_multiple_s3_stores {
+    enabled_backends="${GLANCE_S3_DEFAULT_BACKEND}:s3"
+
+    iniset $GLANCE_API_CONF DEFAULT enabled_backends ${enabled_backends}
+    iniset $GLANCE_API_CONF glance_store default_backend $GLANCE_S3_DEFAULT_BACKEND
+}
+
+# Set common S3 store options to given config section
+#
+# Arguments:
+# config_section
+#
+function set_common_s3_store_params {
+    local config_section="$1"
+    openstack ec2 credential create
+    iniset $GLANCE_API_CONF $config_section s3_store_host "$SWIFT_SERVICE_PROTOCOL://$SERVICE_HOST:$S3_SERVICE_PORT"
+    iniset $GLANCE_API_CONF $config_section s3_store_access_key "$(openstack ec2 credential list -c Access -f value)"
+    iniset $GLANCE_API_CONF $config_section s3_store_secret_key "$(openstack ec2 credential list -c Secret -f value)"
+    iniset $GLANCE_API_CONF $config_section s3_store_create_bucket_on_put $GLANCE_S3_BUCKET_ON_PUT
+    iniset $GLANCE_API_CONF $config_section s3_store_bucket $GLANCE_S3_BUCKET_NAME
+    iniset $GLANCE_API_CONF $config_section s3_store_bucket_url_format "path"
+    if is_service_enabled tls-proxy; then
+        iniset $GLANCE_API_CONF $config_section s3_store_cacert $SSL_BUNDLE_FILE
+    fi
+}
+
 # Set multiple cinder store related config options for each of the cinder store
 #
 function configure_multiple_cinder_stores {
@@ -258,7 +278,6 @@ function configure_glance_store {
     local be
 
     if [[ "$glance_enable_multiple_stores" == "False" ]]; then
-        # Configure traditional glance_store
         if [[ "$use_cinder_for_glance" == "True" ]]; then
             # set common glance_store parameters
             iniset $GLANCE_API_CONF glance_store stores "cinder,file,http"
@@ -281,7 +300,7 @@ function configure_glance_store {
         if [[ "$use_cinder_for_glance" == "True" ]]; then
             # Configure multiple cinder stores for glance
             configure_multiple_cinder_stores
-        else
+        elif ! is_service_enabled s-proxy && [[ "$GLANCE_USE_S3" == "False" ]]; then
             # Configure multiple file stores for glance
             configure_multiple_file_stores
         fi
@@ -360,8 +379,15 @@ function configure_glance {
 
     # No multiple stores for swift yet
     if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "False" ]]; then
-        # Store the images in swift if enabled.
-        if is_service_enabled s-proxy; then
+        # Return if s3api is enabled for glance
+        if [[ "$GLANCE_USE_S3" == "True" ]]; then
+            if is_service_enabled s3api; then
+                # set common glance_store parameters
+                iniset $GLANCE_API_CONF glance_store stores "s3,file,http"
+                iniset $GLANCE_API_CONF glance_store default_store s3
+            fi
+        elif is_service_enabled s-proxy; then
+            # Store the images in swift if enabled.
             iniset $GLANCE_API_CONF glance_store default_store swift
             iniset $GLANCE_API_CONF glance_store swift_store_create_container_on_put True
 
@@ -379,6 +405,12 @@ function configure_glance {
             iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_address $KEYSTONE_SERVICE_URI/v3
             iniset $GLANCE_SWIFT_STORE_CONF ref1 auth_version 3
         fi
+    else
+        if [[ "$GLANCE_USE_S3" == "True" ]]; then
+            if is_service_enabled s3api; then
+                configure_multiple_s3_stores
+            fi
+        fi
     fi
 
     # We need to tell glance what it's public endpoint is so that the version
@@ -400,21 +432,16 @@ function configure_glance {
     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/
     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_driver $GLANCE_CACHE_DRIVER
-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_SERVICE_URI
-    iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME
-    iniset $GLANCE_CACHE_CONF DEFAULT admin_user glance
-    iniset $GLANCE_CACHE_CONF DEFAULT admin_password $SERVICE_PASSWORD
 
     # Store specific confs
     iniset $GLANCE_CACHE_CONF glance_store filesystem_store_datadir $GLANCE_IMAGE_DIR/
 
     # Set default configuration options for the glance-image-import
-    iniset $GLANCE_IMAGE_IMPORT_CONF image_import_opts image_import_plugins []
+    iniset $GLANCE_IMAGE_IMPORT_CONF image_import_opts image_import_plugins "[]"
     iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties ignore_user_roles admin
     iniset $GLANCE_IMAGE_IMPORT_CONF inject_metadata_properties inject
 
     cp -p $GLANCE_DIR/etc/schema-image.json $GLANCE_SCHEMA_JSON
-
     cp -p $GLANCE_DIR/etc/metadefs/*.json $GLANCE_METADEF_DIR
 
     if is_service_enabled tls-proxy; then
@@ -425,20 +452,15 @@ function configure_glance {
         iniset $GLANCE_CACHE_CONF DEFAULT cinder_endpoint_template "https://$CINDER_SERVICE_HOST:$CINDER_SERVICE_PORT/v3/%(project_id)s"
     fi
 
-    if [[ "$GLANCE_STANDALONE" == False ]]; then
-        write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image"
-        # Grab our uwsgi listen address and use that to fill out our
-        # worker_self_reference_url config
-        iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url \
-               $(awk '-F= ' '/^http-socket/ { print "http://"$2}' \
-                    $GLANCE_UWSGI_CONF)
-    else
-        write_local_proxy_http_config glance "http://$GLANCE_SERVICE_HOST:$GLANCE_SERVICE_PORT_INT" "/image"
-        iniset $GLANCE_API_CONF DEFAULT bind_host $GLANCE_SERVICE_LISTEN_ADDRESS
-        iniset $GLANCE_API_CONF DEFAULT bind_port $GLANCE_SERVICE_PORT_INT
-        iniset $GLANCE_API_CONF DEFAULT workers "$API_WORKERS"
-        iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url $GLANCE_URL
-    fi
+    write_local_uwsgi_http_config "$GLANCE_UWSGI_CONF" "$GLANCE_UWSGI" "/image" "glance-api"
+
+    # Grab our uwsgi listen address and use that to fill out our
+    # worker_self_reference_url config
+    iniset $GLANCE_API_CONF DEFAULT worker_self_reference_url $(awk '-F= ' '/^http-socket/ { print "http://"$2}' $GLANCE_UWSGI_CONF)
+
+    # Configure the Python binary used for "import" plugins. If unset, these
+    # will attempt the uwsgi binary instead.
+    iniset $GLANCE_API_CONF wsgi python_interpreter $PYTHON
 
     if [[ "$GLANCE_ENFORCE_SCOPE" == True || "$ENFORCE_SCOPE" == True ]] ; then
         iniset $GLANCE_API_CONF oslo_policy enforce_scope true
@@ -462,7 +484,9 @@ function configure_glance {
 function create_glance_accounts {
     if is_service_enabled g-api; then
 
-        create_service_user "glance"
+        # When cinder talk to glance service APIs user needs service
+        # role for RBAC checks and admin role for cinder to access images.
+        create_service_user "glance" "admin"
 
         # required for swift access
         if is_service_enabled s-proxy; then
@@ -484,6 +508,13 @@ function create_glance_accounts {
             configure_glance_quotas
         fi
 
+        if is_service_enabled s3api && [[ "$GLANCE_USE_S3" == "True" ]]; then
+            if [[ "$GLANCE_ENABLE_MULTIPLE_STORES" == "False" ]]; then
+                set_common_s3_store_params glance_store
+            else
+                set_common_s3_store_params $GLANCE_S3_DEFAULT_BACKEND
+            fi
+        fi
     fi
 }
 
@@ -616,17 +647,8 @@ function start_glance_remote_clone {
 # start_glance() - Start running processes
 function start_glance {
     local service_protocol=$GLANCE_SERVICE_PROTOCOL
-    if is_service_enabled tls-proxy; then
-        if [[ "$WSGI_MODE" != "uwsgi" ]]; then
-            start_tls_proxy glance-service '*' $GLANCE_SERVICE_PORT $GLANCE_SERVICE_HOST $GLANCE_SERVICE_PORT_INT
-        fi
-    fi
 
-    if [[ "$GLANCE_STANDALONE" == False ]]; then
-        run_process g-api "$(which uwsgi) --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
-    else
-        run_process g-api "$GLANCE_BIN_DIR/glance-api --config-dir=$GLANCE_CONF_DIR"
-    fi
+    run_process g-api "$(which uwsgi) --procname-prefix glance-api --ini $GLANCE_UWSGI_CONF"
 
     if is_service_enabled g-api-r; then
         echo "Starting the g-api-r clone service..."
diff --git a/lib/host b/lib/host
index a812c39612..58062eff6b 100644
--- a/lib/host
+++ b/lib/host
@@ -35,7 +35,7 @@ ENABLE_ZSWAP=$(trueorfalse False ENABLE_ZSWAP)
 # lz4 is very fast although it does not have the best compression
 # zstd has much better compression but more latency
 ZSWAP_COMPRESSOR=${ZSWAP_COMPRESSOR:="lz4"}
-ZSWAP_ZPOOL=${ZSWAP_ZPOOL:="z3fold"}
+ZSWAP_ZPOOL=${ZSWAP_ZPOOL:="zsmalloc"}
 function configure_zswap {
     if [[ $ENABLE_ZSWAP == "True" ]] ; then
         # Centos 9 stream seems to only support enabling but not run time
diff --git a/lib/infra b/lib/infra
index 2aad00354a..f4760c352c 100644
--- a/lib/infra
+++ b/lib/infra
@@ -31,7 +31,7 @@ function install_infra {
     local PIP_VIRTUAL_ENV="$REQUIREMENTS_DIR/.venv"
     [ ! -d $PIP_VIRTUAL_ENV ] && ${VIRTUALENV_CMD} $PIP_VIRTUAL_ENV
     # We don't care about testing git pbr in the requirements venv.
-    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr setuptools
+    PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install -U pbr setuptools[core]
     PIP_VIRTUAL_ENV=$PIP_VIRTUAL_ENV pip_install $REQUIREMENTS_DIR
 
     # Unset the PIP_VIRTUAL_ENV so that PBR does not end up trapped
diff --git a/lib/keystone b/lib/keystone
index 7d6b05fd41..791abeb0d7 100644
--- a/lib/keystone
+++ b/lib/keystone
@@ -11,13 +11,11 @@
 # - ``FILES``
 # - ``BASE_SQL_CONN``
 # - ``SERVICE_HOST``, ``SERVICE_PROTOCOL``
-# - ``S3_SERVICE_PORT`` (template backend only)
 
 # ``stack.sh`` calls the entry points in this order:
 #
 # - install_keystone
 # - configure_keystone
-# - _config_keystone_apache_wsgi
 # - init_keystone
 # - start_keystone
 # - bootstrap_keystone
@@ -49,16 +47,7 @@ fi
 KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
 KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
 KEYSTONE_PUBLIC_UWSGI_CONF=$KEYSTONE_CONF_DIR/keystone-uwsgi-public.ini
-KEYSTONE_PUBLIC_UWSGI=$KEYSTONE_BIN_DIR/keystone-wsgi-public
-
-# KEYSTONE_DEPLOY defines how keystone is deployed, allowed values:
-# - mod_wsgi : Run keystone under Apache HTTPd mod_wsgi
-# - uwsgi : Run keystone under uwsgi
-if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-    KEYSTONE_DEPLOY=uwsgi
-else
-    KEYSTONE_DEPLOY=mod_wsgi
-fi
+KEYSTONE_PUBLIC_UWSGI=keystone.wsgi.api:application
 
 # Select the Identity backend driver
 KEYSTONE_IDENTITY_BACKEND=${KEYSTONE_IDENTITY_BACKEND:-sql}
@@ -144,47 +133,9 @@ function is_keystone_enabled {
 # cleanup_keystone() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_keystone {
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        # These files will be created if we are running WSGI_MODE="mod_wsgi"
-        disable_apache_site keystone
-        sudo rm -f $(apache_site_config_for keystone)
-    else
-        stop_process "keystone"
-        remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "keystone-wsgi-public"
-        sudo rm -f $(apache_site_config_for keystone-wsgi-public)
-    fi
-}
-
-# _config_keystone_apache_wsgi() - Set WSGI config files of Keystone
-function _config_keystone_apache_wsgi {
-    local keystone_apache_conf
-    keystone_apache_conf=$(apache_site_config_for keystone)
-    keystone_ssl_listen="#"
-    local keystone_ssl=""
-    local keystone_certfile=""
-    local keystone_keyfile=""
-    local keystone_service_port=$KEYSTONE_SERVICE_PORT
-    local venv_path=""
-
-    if is_service_enabled tls-proxy; then
-        keystone_service_port=$KEYSTONE_SERVICE_PORT_INT
-    fi
-    if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["keystone"]}/lib/$(python_version)/site-packages"
-    fi
-
-    sudo cp $FILES/apache-keystone.template $keystone_apache_conf
-    sudo sed -e "
-        s|%PUBLICPORT%|$keystone_service_port|g;
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%SSLLISTEN%|$keystone_ssl_listen|g;
-        s|%SSLENGINE%|$keystone_ssl|g;
-        s|%SSLCERTFILE%|$keystone_certfile|g;
-        s|%SSLKEYFILE%|$keystone_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-        s|%KEYSTONE_BIN%|$KEYSTONE_BIN_DIR|g
-    " -i $keystone_apache_conf
+    stop_process "keystone"
+    remove_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "keystone-wsgi-public"
+    sudo rm -f $(apache_site_config_for keystone-wsgi-public)
 }
 
 # configure_keystone() - Set config files, create data dirs, etc
@@ -210,14 +161,11 @@ function configure_keystone {
     iniset $KEYSTONE_CONF cache backend $CACHE_BACKEND
     iniset $KEYSTONE_CONF cache memcache_servers $MEMCACHE_SERVERS
 
-    iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
-
-    local service_port=$KEYSTONE_SERVICE_PORT
+    # Enable errors if response validation fails. We want this enabled in CI
+    # and development contexts to highlights bugs in our response schemas.
+    iniset $KEYSTONE_CONF api response_validation error
 
-    if is_service_enabled tls-proxy; then
-        # Set the service ports for a proxy to take the originals
-        service_port=$KEYSTONE_SERVICE_PORT_INT
-    fi
+    iniset_rpc_backend keystone $KEYSTONE_CONF oslo_messaging_notifications
 
     # Override the endpoints advertised by keystone so that clients use the correct
     # endpoint. By default, the keystone server uses the public_port which isn't
@@ -241,12 +189,7 @@ function configure_keystone {
 
     iniset $KEYSTONE_CONF DEFAULT debug $ENABLE_DEBUG_LOG_LEVEL
 
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s"
-        _config_keystone_apache_wsgi
-    else # uwsgi
-        write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity"
-    fi
+    write_uwsgi_config "$KEYSTONE_PUBLIC_UWSGI_CONF" "$KEYSTONE_PUBLIC_UWSGI" "/identity" "" "keystone-api"
 
     iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
 
@@ -441,17 +384,13 @@ function create_service_user {
     fi
 }
 
-# Configure a service to use the auth token middleware.
-#
-# configure_keystone_authtoken_middleware conf_file admin_user IGNORED [section]
+# Configure options for keystoneauth
 #
-# section defaults to keystone_authtoken, which is where auth_token looks in
-# the .conf file. If the paste config file is used (api-paste.ini) then
-# provide the section name for the auth_token filter.
-function configure_keystone_authtoken_middleware {
+# configure_keystoneauth conf_file admin_user section
+function configure_keystoneauth {
     local conf_file=$1
     local admin_user=$2
-    local section=${3:-keystone_authtoken}
+    local section=$3
 
     iniset $conf_file $section auth_type password
     iniset $conf_file $section interface public
@@ -461,9 +400,28 @@ function configure_keystone_authtoken_middleware {
     iniset $conf_file $section user_domain_name "$SERVICE_DOMAIN_NAME"
     iniset $conf_file $section project_name $SERVICE_PROJECT_NAME
     iniset $conf_file $section project_domain_name "$SERVICE_DOMAIN_NAME"
+}
 
+# Configure a service to use the auth token middleware.
+#
+# configure_keystone_authtoken_middleware conf_file admin_user [section]
+#
+# section defaults to keystone_authtoken, which is where auth_token looks in
+# the .conf file. If the paste config file is used (api-paste.ini) then
+# provide the section name for the auth_token filter.
+function configure_keystone_authtoken_middleware {
+    local conf_file=$1
+    local admin_user=$2
+    local section=${3:-keystone_authtoken}
+    local service_type=$4
+
+    configure_keystoneauth $conf_file $admin_user $section
+    iniset $conf_file $section www_authenticate_uri $KEYSTONE_SERVICE_URI
     iniset $conf_file $section cafile $SSL_BUNDLE_FILE
     iniset $conf_file $section memcached_servers $MEMCACHE_SERVERS
+    if [[ -n "$service_type" ]]; then
+        iniset $conf_file $section service_type $service_type
+    fi
 }
 
 # configure_auth_token_middleware conf_file admin_user IGNORED [section]
@@ -543,36 +501,17 @@ function install_keystone {
     if is_service_enabled ldap; then
         setup_develop $KEYSTONE_DIR ldap
     fi
-
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        install_apache_wsgi
-    fi
 }
 
 # start_keystone() - Start running processes
 function start_keystone {
-    # Get right service port for testing
-    local service_port=$KEYSTONE_SERVICE_PORT
-    local auth_protocol=$KEYSTONE_SERVICE_PROTOCOL
-    if is_service_enabled tls-proxy; then
-        service_port=$KEYSTONE_SERVICE_PORT_INT
-        auth_protocol="http"
-    fi
-
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        enable_apache_site keystone
-        restart_apache_server
-    else # uwsgi
-        run_process keystone "$(which uwsgi) --procname-prefix keystone --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
-    fi
+    run_process keystone "$(which uwsgi) --procname-prefix keystone --ini $KEYSTONE_PUBLIC_UWSGI_CONF" ""
 
     echo "Waiting for keystone to start..."
     # Check that the keystone service is running. Even if the tls tunnel
     # should be enabled, make sure the internal port is checked using
-    # unencryted traffic at this point.
-    # If running in Apache, use the path rather than port.
-
-    local service_uri=$auth_protocol://$KEYSTONE_SERVICE_HOST/identity/v3/
+    # unencryted traffic at this point (ignore KEYSTONE_SERVICE_PROTOCOL).
+    local service_uri=http://$KEYSTONE_SERVICE_HOST/identity/v3/
 
     if ! wait_for_service $SERVICE_TIMEOUT $service_uri; then
         die $LINENO "keystone did not start"
@@ -589,12 +528,7 @@ function start_keystone {
 
 # stop_keystone() - Stop running processes
 function stop_keystone {
-    if [ "$KEYSTONE_DEPLOY" == "mod_wsgi" ]; then
-        disable_apache_site keystone
-        restart_apache_server
-    else
-        stop_process keystone
-    fi
+    stop_process keystone
 }
 
 # bootstrap_keystone() - Initialize user, role and project
@@ -626,7 +560,7 @@ function bootstrap_keystone {
 # create_ldap_domain() - Create domain file and initialize domain with a user
 function create_ldap_domain {
     # Creates domain Users
-    openstack --os-identity-api-version=3 domain create --description "LDAP domain" Users
+    openstack domain create --description "LDAP domain" Users
 
     # Create domain file inside etc/keystone/domains
     KEYSTONE_LDAP_DOMAIN_FILE=$KEYSTONE_CONF_DIR/domains/keystone.Users.conf
@@ -642,6 +576,7 @@ function create_ldap_domain {
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_name_attribute "cn"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_mail_attribute "mail"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_id_attribute "uid"
+    iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user_enabled_emulation "True"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap user "cn=Manager,dc=openstack,dc=org"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap url "ldap://localhost"
     iniset $KEYSTONE_LDAP_DOMAIN_FILE ldap suffix $LDAP_BASE_DN
diff --git a/lib/ldap b/lib/ldap
index b0195db258..66c2afc4d5 100644
--- a/lib/ldap
+++ b/lib/ldap
@@ -82,6 +82,14 @@ function init_ldap {
 
     # Remove data but not schemas
     clear_ldap_state
+    if is_ubuntu; then
+        # a bug in OpenLDAP 2.6.7+
+        # (https://bugs.openldap.org/show_bug.cgi?id=10336) causes slapd crash
+        # after deleting nonexisting tree. It is fixed upstream, but Ubuntu is
+        # still not having a fix in Noble. Try temporarily simly restarting the
+        # process.
+        sudo service $LDAP_SERVICE_NAME restart
+    fi
 
     # Add our top level ldap nodes
     if ldapsearch -x -w $LDAP_PASSWORD -D "$LDAP_MANAGER_DN" -H $LDAP_URL -b "$LDAP_BASE_DN" | grep -q "Success"; then
diff --git a/lib/libraries b/lib/libraries
index 9ea32304fc..ffc004b24c 100755
--- a/lib/libraries
+++ b/lib/libraries
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# lib/oslo
+# lib/libraries
 #
 # Functions to install libraries from git
 #
@@ -27,6 +27,7 @@ GITDIR["castellan"]=$DEST/castellan
 GITDIR["cliff"]=$DEST/cliff
 GITDIR["cursive"]=$DEST/cursive
 GITDIR["debtcollector"]=$DEST/debtcollector
+GITDIR["etcd3gw"]=$DEST/etcd3gw
 GITDIR["futurist"]=$DEST/futurist
 GITDIR["openstacksdk"]=$DEST/openstacksdk
 GITDIR["os-client-config"]=$DEST/os-client-config
@@ -131,13 +132,12 @@ function install_libs {
     # python client libraries we might need from git can go here
     _install_lib_from_source "python-barbicanclient"
 
-
-    # etcd (because tooz does not have a hard dependency on these)
-    #
-    # NOTE(sdague): this is currently a work around because tooz
-    # doesn't pull in etcd3.
-    pip_install etcd3
-    pip_install etcd3gw
+    if use_library_from_git etcd3gw ; then
+        _install_lib_from_source "etcd3gw"
+    else
+        # etcd (because tooz does not have a hard dependency on these)
+        pip_install etcd3gw
+    fi
 }
 
 # Restore xtrace
diff --git a/lib/neutron b/lib/neutron
index bcef8a5042..6a7f057ad7 100644
--- a/lib/neutron
+++ b/lib/neutron
@@ -62,11 +62,9 @@ if is_service_enabled tls-proxy; then
     Q_PROTOCOL="https"
 fi
 
-
 # Set up default directories
 GITDIR["python-neutronclient"]=$DEST/python-neutronclient
 
-
 NEUTRON_DIR=$DEST/neutron
 NEUTRON_FWAAS_DIR=$DEST/neutron-fwaas
 
@@ -81,13 +79,6 @@ NEUTRON_CONF_DIR=/etc/neutron
 NEUTRON_CONF=$NEUTRON_CONF_DIR/neutron.conf
 export NEUTRON_TEST_CONFIG_FILE=${NEUTRON_TEST_CONFIG_FILE:-"$NEUTRON_CONF_DIR/debug.ini"}
 
-# NEUTRON_DEPLOY_MOD_WSGI defines how neutron is deployed, allowed values:
-# - False (default) : Run neutron under Eventlet
-# - True : Run neutron under uwsgi
-# TODO(annp): Switching to uwsgi in next cycle if things turn out to be stable
-# enough
-NEUTRON_DEPLOY_MOD_WSGI=$(trueorfalse False NEUTRON_DEPLOY_MOD_WSGI)
-
 NEUTRON_UWSGI=neutron.wsgi.api:application
 NEUTRON_UWSGI_CONF=$NEUTRON_CONF_DIR/neutron-api-uwsgi.ini
 
@@ -119,10 +110,6 @@ Q_META_CONF_FILE=$NEUTRON_CONF_DIR/metadata_agent.ini
 Q_DB_NAME=${Q_DB_NAME:-neutron}
 # Default Neutron Plugin
 Q_PLUGIN=${Q_PLUGIN:-ml2}
-# Default Neutron Port
-Q_PORT=${Q_PORT:-9696}
-# Default Neutron Internal Port when using TLS proxy
-Q_PORT_INT=${Q_PORT_INT:-19696}
 # Default Neutron Host
 Q_HOST=${Q_HOST:-$SERVICE_HOST}
 # Default protocol
@@ -155,7 +142,7 @@ _Q_PLUGIN_EXTRA_CONF_PATH=/etc/neutron
 
 # The name of the service in the endpoint URL
 NEUTRON_ENDPOINT_SERVICE_NAME=${NEUTRON_ENDPOINT_SERVICE_NAME-"networking"}
-if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" && -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
+if [[ -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
     NEUTRON_ENDPOINT_SERVICE_NAME="networking"
 fi
 
@@ -210,44 +197,43 @@ fi
 # --------------------------------
 
 # The following variables control the Neutron ML2 plugins' allocation
-# of tenant networks and availability of provider networks. If these
-# are not configured in ``localrc``, tenant networks will be local to
+# of project networks and availability of provider networks. If these
+# are not configured in ``localrc``, project networks will be local to
 # the host (with no remote connectivity), and no physical resources
 # will be available for the allocation of provider networks.
 
-# To disable tunnels (GRE or VXLAN) for tenant networks,
+# To disable tunnels (GRE or VXLAN) for project networks,
 # set to False in ``local.conf``.
 # GRE tunnels are only supported by the openvswitch.
 ENABLE_TENANT_TUNNELS=${ENABLE_TENANT_TUNNELS:-True}
 
-# If using GRE, VXLAN or GENEVE tunnels for tenant networks,
-# specify the range of IDs from which tenant networks are
+# If using GRE, VXLAN or GENEVE tunnels for project networks,
+# specify the range of IDs from which project networks are
 # allocated. Can be overridden in ``localrc`` if necessary.
 TENANT_TUNNEL_RANGES=${TENANT_TUNNEL_RANGES:-1:1000}
 
-# To use VLANs for tenant networks, set to True in localrc. VLANs
+# To use VLANs for project networks, set to True in localrc. VLANs
 # are supported by the ML2 plugins, requiring additional configuration
 # described below.
 ENABLE_TENANT_VLANS=${ENABLE_TENANT_VLANS:-False}
 
-# If using VLANs for tenant networks, set in ``localrc`` to specify
-# the range of VLAN VIDs from which tenant networks are
+# If using VLANs for project networks, set in ``localrc`` to specify
+# the range of VLAN VIDs from which project networks are
 # allocated. An external network switch must be configured to
 # trunk these VLANs between hosts for multi-host connectivity.
 #
 # Example: ``TENANT_VLAN_RANGE=1000:1999``
 TENANT_VLAN_RANGE=${TENANT_VLAN_RANGE:-}
 
-# If using VLANs for tenant networks, or if using flat or VLAN
+# If using VLANs for project networks, or if using flat or VLAN
 # provider networks, set in ``localrc`` to the name of the physical
 # network, and also configure ``OVS_PHYSICAL_BRIDGE`` for the
-# openvswitch agent or ``LB_PHYSICAL_INTERFACE`` for the linuxbridge
-# agent, as described below.
+# openvswitch agent, as described below.
 #
 # Example: ``PHYSICAL_NETWORK=default``
 PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 
-# With the openvswitch agent, if using VLANs for tenant networks,
+# With the openvswitch agent, if using VLANs for project networks,
 # or if using flat or VLAN provider networks, set in ``localrc`` to
 # the name of the OVS bridge to use for the physical network. The
 # bridge will be created if it does not already exist, but a
@@ -257,18 +243,6 @@ PHYSICAL_NETWORK=${PHYSICAL_NETWORK:-public}
 # Example: ``OVS_PHYSICAL_BRIDGE=br-eth1``
 OVS_PHYSICAL_BRIDGE=${OVS_PHYSICAL_BRIDGE:-br-ex}
 
-# With the linuxbridge agent, if using VLANs for tenant networks,
-# or if using flat or VLAN provider networks, set in ``localrc`` to
-# the name of the network interface to use for the physical
-# network.
-#
-# Example: ``LB_PHYSICAL_INTERFACE=eth1``
-if [[ $Q_AGENT == "linuxbridge" && -z ${LB_PHYSICAL_INTERFACE} ]]; then
-    default_route_dev=$( (ip route; ip -6 route) | grep ^default | head -n 1 | awk '{print $5}')
-    die_if_not_set $LINENO default_route_dev "Failure retrieving default route device"
-    LB_PHYSICAL_INTERFACE=$default_route_dev
-fi
-
 # With the openvswitch plugin, set to True in ``localrc`` to enable
 # provider GRE tunnels when ``ENABLE_TENANT_TUNNELS`` is False.
 #
@@ -305,6 +279,7 @@ source $TOP_DIR/lib/neutron_plugins/services/placement
 source $TOP_DIR/lib/neutron_plugins/services/trunk
 source $TOP_DIR/lib/neutron_plugins/services/qos
 source $TOP_DIR/lib/neutron_plugins/services/segments
+source $TOP_DIR/lib/neutron_plugins/services/ovn-bgp
 
 # Use security group or not
 if has_neutron_plugin_security_group; then
@@ -370,12 +345,6 @@ function _determine_config_l3 {
     echo "$opts"
 }
 
-function _enable_ovn_maintenance {
-    if [[ $Q_AGENT == "ovn" ]]; then
-        enable_service neutron-ovn-maintenance-worker
-    fi
-}
-
 function _run_ovn_maintenance {
     if [[ $Q_AGENT == "ovn" ]]; then
         run_process neutron-ovn-maintenance-worker "$NEUTRON_BIN_DIR/neutron-ovn-maintenance-worker $cfg_file_options"
@@ -454,6 +423,9 @@ function configure_neutron {
         configure_placement_neutron
         configure_segments_extension
     fi
+    if is_service_enabled q-ovn-bgp; then
+        configure_ovn_bgp_service_plugin
+    fi
 
     # Finally configure Neutron server and core plugin
     if is_service_enabled q-agt neutron-agent q-svc neutron-api; then
@@ -466,9 +438,7 @@ function configure_neutron {
     # for state reports is more than adequate.
     iniset $NEUTRON_CONF DEFAULT rpc_state_report_workers 0
 
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_UWSGI" "/networking" "" "neutron-api"
-    fi
+    write_uwsgi_config "$NEUTRON_UWSGI_CONF" "$NEUTRON_UWSGI" "/networking" "" "neutron-api"
 }
 
 function configure_neutron_nova {
@@ -484,14 +454,7 @@ function configure_neutron_nova {
 
 function create_nova_conf_neutron {
     local conf=${1:-$NOVA_CONF}
-    iniset $conf neutron auth_type "password"
-    iniset $conf neutron auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf neutron username nova
-    iniset $conf neutron password "$SERVICE_PASSWORD"
-    iniset $conf neutron user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf neutron project_name "$SERVICE_PROJECT_NAME"
-    iniset $conf neutron project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf neutron auth_strategy "$Q_AUTH_STRATEGY"
+    configure_keystoneauth $conf nova neutron
     iniset $conf neutron region_name "$REGION_NAME"
 
     # optionally set options in nova_conf
@@ -514,11 +477,7 @@ function create_nova_conf_neutron {
 # Migrated from keystone_data.sh
 function create_neutron_accounts {
     local neutron_url
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        neutron_url=$Q_PROTOCOL://$SERVICE_HOST/
-    else
-        neutron_url=$Q_PROTOCOL://$SERVICE_HOST:$Q_PORT/
-    fi
+    neutron_url=$Q_PROTOCOL://$SERVICE_HOST/
     if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
         neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
     fi
@@ -634,55 +593,63 @@ function start_ovn_services {
     fi
 }
 
+# Enable neutron server services based on configuration
+# This function determines which neutron services should be enabled
+# and adds them to ENABLED_SERVICES. It reads the neutron configuration
+# to determine if RPC workers should be enabled.
+# This must be called after configure_neutron has created the config files.
+function enable_neutron_server_services {
+    local rpc_workers
+
+    # The default value of "rpc_workers" is None (not defined). If
+    # "rpc_workers" is explicitly set to 0, the RPC workers process
+    # should not be executed.
+    if [[ -f $NEUTRON_CONF ]]; then
+        rpc_workers=$(iniget_multiline $NEUTRON_CONF DEFAULT rpc_workers)
+    else
+        # If config doesn't exist yet, assume default behavior (enable rpc workers)
+        rpc_workers=""
+    fi
+
+    # Always enable these core services
+    enable_service neutron-api
+    enable_service neutron-periodic-workers
+
+    # Conditionally enable RPC server based on configuration
+    if [[ "$rpc_workers" != "0" ]]; then
+        enable_service neutron-rpc-server
+    fi
+
+    # Enable OVN maintenance worker if using OVN
+    if [[ $Q_AGENT == "ovn" ]]; then
+        enable_service neutron-ovn-maintenance-worker
+    fi
+}
+
 # Start running processes
 function start_neutron_service_and_check {
-    local service_port=$Q_PORT
-    local service_protocol=$Q_PROTOCOL
     local cfg_file_options
     local neutron_url
 
     cfg_file_options="$(determine_config_files neutron-server)"
 
-    if is_service_enabled tls-proxy; then
-        service_port=$Q_PORT_INT
-        service_protocol="http"
-    fi
+    # Enable neutron server services based on configuration
+    enable_neutron_server_services
 
-    # Start the Neutron service
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        # The default value of "rpc_workers" is None (not defined). If
-        # "rpc_workers" is explicitly set to 0, the RPC workers process
-        # should not be executed.
-        local rpc_workers
-        rpc_workers=$(iniget_multiline $NEUTRON_CONF DEFAULT rpc_workers)
+    # Start the Neutron service processes
+    run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
+    neutron_url=$Q_PROTOCOL://$Q_HOST/
 
-        enable_service neutron-api
-        run_process neutron-api "$(which uwsgi) --procname-prefix neutron-api --ini $NEUTRON_UWSGI_CONF"
-        neutron_url=$Q_PROTOCOL://$Q_HOST/
-        if [ "$rpc_workers" != "0" ]; then
-            enable_service neutron-rpc-server
-        fi
-        enable_service neutron-periodic-workers
-        _enable_ovn_maintenance
-        if [ "$rpc_workers" != "0" ]; then
-            run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
-        fi
-        run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
-        _run_ovn_maintenance
-    else
-        run_process q-svc "$NEUTRON_BIN_DIR/neutron-server $cfg_file_options"
-        neutron_url=$service_protocol://$Q_HOST:$service_port/
-        # Start proxy if enabled
-        if is_service_enabled tls-proxy; then
-            start_tls_proxy neutron '*' $Q_PORT $Q_HOST $Q_PORT_INT
-        fi
-    fi
+    # Start RPC server if enabled (run_process checks is_service_enabled internally)
+    run_process neutron-rpc-server "$NEUTRON_BIN_DIR/neutron-rpc-server $cfg_file_options"
+    run_process neutron-periodic-workers "$NEUTRON_BIN_DIR/neutron-periodic-workers $cfg_file_options"
+    _run_ovn_maintenance
     if [ ! -z "$NEUTRON_ENDPOINT_SERVICE_NAME" ]; then
         neutron_url=$neutron_url$NEUTRON_ENDPOINT_SERVICE_NAME
     fi
     echo "Waiting for Neutron to start..."
 
-    local testcmd="wget ${ssl_ca} --no-proxy -q -O- $neutron_url"
+    local testcmd="wget --no-proxy -q -O- $neutron_url"
     test_with_retry "$testcmd" "Neutron did not start" $SERVICE_TIMEOUT
 }
 
@@ -738,14 +705,10 @@ function stop_other {
         [ ! -z "$pid" ] && sudo kill -9 $pid
     fi
 
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        stop_process neutron-rpc-server
-        stop_process neutron-periodic-workers
-        stop_process neutron-api
-        _stop_ovn_maintenance
-    else
-        stop_process q-svc
-    fi
+    stop_process neutron-rpc-server
+    stop_process neutron-periodic-workers
+    stop_process neutron-api
+    _stop_ovn_maintenance
 
     if is_service_enabled q-l3 neutron-l3; then
         sudo pkill -f "radvd -C $DATA_DIR/neutron/ra"
@@ -856,14 +819,12 @@ function _configure_public_network_connectivity {
 # cleanup_neutron() - Remove residual data files, anything left over from previous
 # runs that a clean run would need to clean up
 function cleanup_neutron {
-    if [ "$NEUTRON_DEPLOY_MOD_WSGI" == "True" ]; then
-        stop_process neutron-api
-        stop_process neutron-rpc-server
-        stop_process neutron-periodic-workers
-        _stop_ovn_maintenance
-        remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "neutron-api"
-        sudo rm -f $(apache_site_config_for neutron-api)
-    fi
+    stop_process neutron-api
+    stop_process neutron-rpc-server
+    stop_process neutron-periodic-workers
+    _stop_ovn_maintenance
+    remove_uwsgi_config "$NEUTRON_UWSGI_CONF" "neutron-api"
+    sudo rm -f $(apache_site_config_for neutron-api)
 
     if [[ -n "$OVS_PHYSICAL_BRIDGE" ]]; then
         _move_neutron_addresses_route "$OVS_PHYSICAL_BRIDGE" "$PUBLIC_INTERFACE" False True "inet"
@@ -889,10 +850,6 @@ function cleanup_neutron {
         neutron_ovs_base_cleanup
     fi
 
-    if [[ $Q_AGENT == "linuxbridge" ]]; then
-        neutron_lb_cleanup
-    fi
-
     # delete all namespaces created by neutron
     for ns in $(sudo ip netns list | grep -o -E '(qdhcp|qrouter|fip|snat)-[0-9a-f-]*'); do
         sudo ip netns delete ${ns}
@@ -974,12 +931,6 @@ function _configure_neutron_common {
     # Format logging
     setup_logging $NEUTRON_CONF
 
-    if is_service_enabled tls-proxy && [ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" ]; then
-        # Set the service port for a proxy to take the original
-        iniset $NEUTRON_CONF DEFAULT bind_port "$Q_PORT_INT"
-        iniset $NEUTRON_CONF oslo_middleware enable_proxy_headers_parsing True
-    fi
-
     _neutron_setup_rootwrap
 }
 
@@ -1045,24 +996,11 @@ function _configure_neutron_plugin_agent {
     neutron_plugin_configure_plugin_agent
 }
 
-function _replace_api_paste_composite {
-    local sep
-    sep=$(echo -ne "\x01")
-    # Replace it
-    $sudo sed -i -e "s/\/\: neutronversions_composite/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/\: neutronversions_composite/" "$Q_API_PASTE_FILE"
-    $sudo sed -i -e "s/\/healthcheck\: healthcheck/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/healthcheck\: healthcheck/" "$Q_API_PASTE_FILE"
-    $sudo sed -i -e "s/\/v2.0\: neutronapi_v2_0/\/"${NEUTRON_ENDPOINT_SERVICE_NAME}"\/v2.0\: neutronapi_v2_0/" "$Q_API_PASTE_FILE"
-}
-
 # _configure_neutron_service() - Set config files for neutron service
 # It is called when q-svc is enabled.
 function _configure_neutron_service {
     Q_API_PASTE_FILE=$NEUTRON_CONF_DIR/api-paste.ini
-    cp $NEUTRON_DIR/etc/api-paste.ini $Q_API_PASTE_FILE
-
-    if [[ "$NEUTRON_DEPLOY_MOD_WSGI" == "False" && -n "$NEUTRON_ENDPOINT_SERVICE_NAME" ]]; then
-        _replace_api_paste_composite
-    fi
+    cp $NEUTRON_DIR/etc/neutron/api-paste.ini $Q_API_PASTE_FILE
 
     # Update either configuration file with plugin
     iniset $NEUTRON_CONF DEFAULT core_plugin $Q_PLUGIN_CLASS
@@ -1077,10 +1015,10 @@ function _configure_neutron_service {
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_status_changes $Q_NOTIFY_NOVA_PORT_STATUS_CHANGES
     iniset $NEUTRON_CONF DEFAULT notify_nova_on_port_data_changes $Q_NOTIFY_NOVA_PORT_DATA_CHANGES
 
-    configure_keystone_authtoken_middleware $NEUTRON_CONF nova nova
+    configure_keystoneauth $NEUTRON_CONF nova nova
 
     # Configuration for placement client
-    configure_keystone_authtoken_middleware $NEUTRON_CONF placement placement
+    configure_keystoneauth $NEUTRON_CONF placement placement
 
     # Configure plugin
     neutron_plugin_configure_service
@@ -1139,11 +1077,7 @@ function _neutron_setup_rootwrap {
 
     # Set up ``rootwrap.conf``, pointing to ``$NEUTRON_CONF_DIR/rootwrap.d``
     # location moved in newer versions, prefer new location
-    if test -r $NEUTRON_DIR/etc/neutron/rootwrap.conf; then
-        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
-    else
-        sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/rootwrap.conf $Q_RR_CONF_FILE
-    fi
+    sudo install -o root -g root -m 644 $NEUTRON_DIR/etc/neutron/rootwrap.conf $Q_RR_CONF_FILE
     sudo sed -e "s:^filters_path=.*$:filters_path=$Q_CONF_ROOTWRAP_D:" -i $Q_RR_CONF_FILE
     # Rely on $PATH set by devstack to determine what is safe to execute
     # by rootwrap rather than use explicit whitelist of paths in
diff --git a/lib/neutron_plugins/linuxbridge_agent b/lib/neutron_plugins/linuxbridge_agent
deleted file mode 100644
index a392bd0baf..0000000000
--- a/lib/neutron_plugins/linuxbridge_agent
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/bin/bash
-#
-# Neutron Linux Bridge L2 agent
-# -----------------------------
-
-# Save trace setting
-_XTRACE_NEUTRON_LB=$(set +o | grep xtrace)
-set +o xtrace
-
-function neutron_lb_cleanup {
-    sudo ip link delete $PUBLIC_BRIDGE
-
-    bridge_list=`ls /sys/class/net/*/bridge/bridge_id 2>/dev/null | cut -f5 -d/`
-    if [[ -z "$bridge_list" ]]; then
-        return
-    fi
-    if [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vxlan" ]]; then
-        for port in $(echo $bridge_list | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e vxlan-[0-9a-f\-]*); do
-            sudo ip link delete $port
-        done
-    elif [[ "$Q_ML2_TENANT_NETWORK_TYPE" = "vlan" ]]; then
-        for port in $(echo $bridge_list | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e ${LB_PHYSICAL_INTERFACE}\.[0-9a-f\-]*); do
-            sudo ip link delete $port
-        done
-    fi
-    for bridge in $(echo $bridge_list |grep -o -e brq[0-9a-f\-]*); do
-        sudo ip link delete $bridge
-    done
-}
-
-function is_neutron_ovs_base_plugin {
-    # linuxbridge doesn't use OVS
-    return 1
-}
-
-function neutron_plugin_create_nova_conf {
-    :
-}
-
-function neutron_plugin_install_agent_packages {
-    :
-}
-
-function neutron_plugin_configure_dhcp_agent {
-    local conf_file=$1
-    :
-}
-
-function neutron_plugin_configure_l3_agent {
-    local conf_file=$1
-    sudo ip link add $PUBLIC_BRIDGE type bridge
-    set_mtu $PUBLIC_BRIDGE $PUBLIC_BRIDGE_MTU
-}
-
-function neutron_plugin_configure_plugin_agent {
-    # Setup physical network interface mappings.  Override
-    # ``LB_VLAN_RANGES`` and ``LB_INTERFACE_MAPPINGS`` in ``localrc`` for more
-    # complex physical network configurations.
-    if [[ "$LB_INTERFACE_MAPPINGS" == "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$LB_PHYSICAL_INTERFACE" != "" ]]; then
-        LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
-    fi
-    if [[ "$PUBLIC_BRIDGE" != "" ]] && [[ "$PUBLIC_PHYSICAL_NETWORK" != "" ]]; then
-        if is_service_enabled q-l3 || is_service_enabled neutron-l3; then
-            iniset /$Q_PLUGIN_CONF_FILE linux_bridge bridge_mappings "$PUBLIC_PHYSICAL_NETWORK:$PUBLIC_BRIDGE"
-        fi
-    fi
-    if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE linux_bridge physical_interface_mappings $LB_INTERFACE_MAPPINGS
-    fi
-    if [[ "$Q_USE_SECGROUP" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
-        if ! running_in_container; then
-            enable_kernel_bridge_firewall
-        fi
-    else
-        iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver neutron.agent.firewall.NoopFirewallDriver
-    fi
-    AGENT_BINARY="$NEUTRON_BIN_DIR/neutron-linuxbridge-agent"
-    iniset /$Q_PLUGIN_CONF_FILE agent tunnel_types $Q_TUNNEL_TYPES
-
-    # Configure vxlan tunneling
-    if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
-        if [[ "$Q_ML2_TENANT_NETWORK_TYPE" == "vxlan" ]]; then
-            iniset /$Q_PLUGIN_CONF_FILE vxlan enable_vxlan "True"
-            iniset /$Q_PLUGIN_CONF_FILE vxlan local_ip $TUNNEL_ENDPOINT_IP
-        else
-            iniset /$Q_PLUGIN_CONF_FILE vxlan enable_vxlan "False"
-        fi
-    else
-        iniset /$Q_PLUGIN_CONF_FILE vxlan enable_vxlan "False"
-    fi
-}
-
-function neutron_plugin_setup_interface_driver {
-    local conf_file=$1
-    iniset $conf_file DEFAULT interface_driver linuxbridge
-}
-
-function neutron_plugin_check_adv_test_requirements {
-    is_service_enabled q-agt neutron-agent && is_service_enabled q-dhcp neutron-dhcp && return 0
-}
-
-# Restore xtrace
-$_XTRACE_NEUTRON_LB
diff --git a/lib/neutron_plugins/ml2 b/lib/neutron_plugins/ml2
index c2e78c65cc..71bede842e 100644
--- a/lib/neutron_plugins/ml2
+++ b/lib/neutron_plugins/ml2
@@ -72,16 +72,16 @@ function neutron_plugin_configure_common {
 
 function neutron_plugin_configure_service {
     if [[ "$Q_ML2_TENANT_NETWORK_TYPE" != "local" ]]; then
-        Q_SRV_EXTRA_OPTS+=(tenant_network_types=$Q_ML2_TENANT_NETWORK_TYPE)
+        Q_SRV_EXTRA_OPTS+=(project_network_types=$Q_ML2_TENANT_NETWORK_TYPE)
     elif [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
         # This assumes you want a simple configuration, and will overwrite
         # Q_SRV_EXTRA_OPTS if set in addition to ENABLE_TENANT_TUNNELS.
-        Q_SRV_EXTRA_OPTS+=(tenant_network_types=gre)
+        Q_SRV_EXTRA_OPTS+=(project_network_types=gre)
         Q_ML2_PLUGIN_GRE_TYPE_OPTIONS=(tunnel_id_ranges=$TENANT_TUNNEL_RANGES)
     elif [[ "$ENABLE_TENANT_VLANS" == "True" ]]; then
-        Q_SRV_EXTRA_OPTS+=(tenant_network_types=vlan)
+        Q_SRV_EXTRA_OPTS+=(project_network_types=vlan)
     else
-        echo "WARNING - The ml2 plugin is using local tenant networks, with no connectivity between hosts."
+        echo "WARNING - The ml2 plugin is using local project networks, with no connectivity between hosts."
     fi
 
     # Allow for overrding VLAN configuration (for example, to configure provider
@@ -114,9 +114,6 @@ function neutron_plugin_configure_service {
     populate_ml2_config /$Q_PLUGIN_CONF_FILE securitygroup enable_security_group=$Q_USE_SECGROUP
 
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 mechanism_drivers=$Q_ML2_PLUGIN_MECHANISM_DRIVERS
-    if [[ "$Q_ML2_PLUGIN_MECHANISM_DRIVERS" == *"linuxbridge"* ]]; then
-        iniset $NEUTRON_CONF experimental linuxbridge True
-    fi
     populate_ml2_config /$Q_PLUGIN_CONF_FILE ml2 overlay_ip_version=$TUNNEL_IP_VERSION
 
     if [[ -n "$Q_ML2_PLUGIN_TYPE_DRIVERS" ]]; then
diff --git a/lib/neutron_plugins/openvswitch b/lib/neutron_plugins/openvswitch
index 130eaacab3..c661a1a600 100644
--- a/lib/neutron_plugins/openvswitch
+++ b/lib/neutron_plugins/openvswitch
@@ -20,12 +20,12 @@ function neutron_plugin_configure_common {
 
 function neutron_plugin_configure_service {
     if [[ "$ENABLE_TENANT_TUNNELS" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE ovs tenant_network_type gre
+        iniset /$Q_PLUGIN_CONF_FILE ovs project_network_type gre
         iniset /$Q_PLUGIN_CONF_FILE ovs tunnel_id_ranges $TENANT_TUNNEL_RANGES
     elif [[ "$ENABLE_TENANT_VLANS" == "True" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE ovs tenant_network_type vlan
+        iniset /$Q_PLUGIN_CONF_FILE ovs project_network_type vlan
     else
-        echo "WARNING - The openvswitch plugin is using local tenant networks, with no connectivity between hosts."
+        echo "WARNING - The openvswitch plugin is using local project networks, with no connectivity between hosts."
     fi
 
     # Override ``OVS_VLAN_RANGES`` and ``OVS_BRIDGE_MAPPINGS`` in ``localrc``
diff --git a/lib/neutron_plugins/ovn_agent b/lib/neutron_plugins/ovn_agent
index be3a9e78b2..3f1d6d8b6b 100644
--- a/lib/neutron_plugins/ovn_agent
+++ b/lib/neutron_plugins/ovn_agent
@@ -28,7 +28,7 @@ source ${TOP_DIR}/lib/neutron_plugins/ovs_source
 OVN_REPO=${OVN_REPO:-https://github.com/ovn-org/ovn.git}
 OVN_REPO_NAME=$(basename ${OVN_REPO} | cut -f1 -d'.')
 OVN_REPO_NAME=${OVN_REPO_NAME:-ovn}
-OVN_BRANCH=${OVN_BRANCH:-v20.06.1}
+OVN_BRANCH=${OVN_BRANCH:-branch-24.03}
 # The commit removing OVN bits from the OVS tree, it is the commit that is not
 # present in OVN tree and is used to distinguish if OVN is part of OVS or not.
 # https://github.com/openvswitch/ovs/commit/05bf1dbb98b0635a51f75e268ef8aed27601401d
@@ -96,13 +96,26 @@ OVN_META_CONF=$NEUTRON_CONF_DIR/neutron_ovn_metadata_agent.ini
 OVN_META_DATA_HOST=${OVN_META_DATA_HOST:-$(ipv6_unquote $SERVICE_HOST)}
 
 # OVN agent configuration
+# The OVN agent is configured, by default, with the "metadata" extension.
 OVN_AGENT_CONF=$NEUTRON_CONF_DIR/plugins/ml2/ovn_agent.ini
-OVN_AGENT_EXTENSIONS=${OVN_AGENT_EXTENSIONS:-}
+OVN_AGENT_EXTENSIONS=${OVN_AGENT_EXTENSIONS:-metadata}
+# The variable TARGET_ENABLE_OVN_AGENT, if True, overrides the OVN Metadata
+# agent service (q-ovn-metadata-agent neutron-ovn-metadata-agent) and the OVN
+# agent service (q-ovn-agent neutron-ovn-agent) configuration, always disabling
+# the first one (OVN Metadata agent) and enabling the second (OVN agent).
+# This variable will be removed in 2026.2, along with the OVN Metadata agent
+# removal.
+TARGET_ENABLE_OVN_AGENT=$(trueorfalse False TARGET_ENABLE_OVN_AGENT)
 
 # If True (default) the node will be considered a gateway node.
 ENABLE_CHASSIS_AS_GW=$(trueorfalse True ENABLE_CHASSIS_AS_GW)
 OVN_L3_CREATE_PUBLIC_NETWORK=$(trueorfalse True OVN_L3_CREATE_PUBLIC_NETWORK)
 
+# The variable NEUTRON_BGP_PEER_BRIDGES only applies when OVN_AGENT_EXTENSIONS
+# includes "ovn-bgp". When the "ovn-bgp" extension is configured, it should be
+# set to some non-empty value.
+NEUTRON_BGP_PEER_BRIDGES=${NEUTRON_BGP_PEER_BRIDGES:-}
+
 export OVSDB_SERVER_LOCAL_HOST=$SERVICE_LOCAL_HOST
 TUNNEL_IP=$TUNNEL_ENDPOINT_IP
 if [[ "$SERVICE_IP_VERSION" == 6 ]]; then
@@ -161,8 +174,10 @@ fi
 
 # Defaults Overwrite
 # ------------------
-
-Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn,logger}
+# NOTE(ralonsoh): during the eventlet removal, the "logger" mech
+# driver has been removed from this list. Re-add it once the removal
+# is finished or the mech driver does not call monkey_patch().
+Q_ML2_PLUGIN_MECHANISM_DRIVERS=${Q_ML2_PLUGIN_MECHANISM_DRIVERS:-ovn}
 Q_ML2_PLUGIN_TYPE_DRIVERS=${Q_ML2_PLUGIN_TYPE_DRIVERS:-local,flat,vlan,geneve}
 Q_ML2_TENANT_NETWORK_TYPE=${Q_ML2_TENANT_NETWORK_TYPE:-"geneve"}
 Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS=${Q_ML2_PLUGIN_GENEVE_TYPE_OPTIONS:-"vni_ranges=1:65536"}
@@ -298,18 +313,21 @@ function create_public_bridge {
     _configure_public_network_connectivity
 }
 
-function _disable_libvirt_apparmor {
-    if ! sudo aa-status --enabled ; then
+function is_ovn_metadata_agent_enabled {
+    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent && [[ "$TARGET_ENABLE_OVN_AGENT" == "False" ]]; then
         return 0
     fi
-    # NOTE(arosen): This is used as a work around to allow newer versions
-    # of libvirt to work with ovs configured ports. See LP#1466631.
-    # requires the apparmor-utils
-    install_package apparmor-utils
-    # disables apparmor for libvirtd
-    sudo aa-complain /etc/apparmor.d/usr.sbin.libvirtd
+    return 1
 }
 
+function is_ovn_agent_enabled {
+    if is_service_enabled q-ovn-agent neutron-ovn-agent || [[ "$TARGET_ENABLE_OVN_AGENT" == "True" ]]; then
+        enable_service q-ovn-agent
+        return 0
+    fi
+    return 1
+
+}
 
 # OVN compilation functions
 # -------------------------
@@ -388,9 +406,6 @@ function install_ovn {
     # Check the OVN configuration
     ovn_sanity_check
 
-    # Install tox, used to generate the config (see devstack/override-defaults)
-    pip_install tox
-
     sudo mkdir -p $OVS_RUNDIR
     sudo chown $(whoami) $OVS_RUNDIR
 
@@ -416,9 +431,6 @@ function install_ovn {
         sudo mkdir -p $OVS_PREFIX/var/log/ovn
         sudo chown $(whoami) $OVS_PREFIX/var/log/ovn
     else
-        # Load fixup_ovn_centos
-        source ${TOP_DIR}/tools/fixup_stuff.sh
-        fixup_ovn_centos
         install_package $(get_packages openvswitch)
         install_package $(get_packages ovn)
     fi
@@ -507,9 +519,9 @@ function configure_ovn_plugin {
             inicomment /$Q_PLUGIN_CONF_FILE network_log local_output_log_base="$Q_LOG_DRIVER_LOG_BASE"
         fi
 
-        if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
+        if is_ovn_metadata_agent_enabled; then
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
-        elif is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
+        elif is_ovn_agent_enabled && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=True
         else
             populate_ml2_config /$Q_PLUGIN_CONF_FILE ovn ovn_metadata_enabled=False
@@ -530,9 +542,9 @@ function configure_ovn_plugin {
     fi
 
     if is_service_enabled n-api-meta ; then
-        if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
+        if is_ovn_metadata_agent_enabled; then
             iniset $NOVA_CONF neutron service_metadata_proxy True
-        elif is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
+        elif is_ovn_agent_enabled && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]]; then
             iniset $NOVA_CONF neutron service_metadata_proxy True
         fi
     fi
@@ -567,10 +579,10 @@ function configure_ovn {
     # Metadata
     local sample_file=""
     local config_file=""
-    if is_service_enabled q-ovn-agent neutron-ovn-agent && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]] && is_service_enabled ovn-controller; then
+    if is_ovn_agent_enabled && [[ "$OVN_AGENT_EXTENSIONS" =~ 'metadata' ]] && is_service_enabled ovn-controller; then
         sample_file=$NEUTRON_DIR/etc/neutron/plugins/ml2/ovn_agent.ini.sample
         config_file=$OVN_AGENT_CONF
-    elif is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent && is_service_enabled ovn-controller; then
+    elif is_ovn_metadata_agent_enabled && is_service_enabled ovn-controller; then
         sample_file=$NEUTRON_DIR/etc/neutron_ovn_metadata_agent.ini.sample
         config_file=$OVN_META_CONF
     fi
@@ -612,7 +624,6 @@ function init_ovn {
     # in the ovn, ovn-nb, or ovs databases.  We're going to trash them and
     # create new ones on each devstack run.
 
-    _disable_libvirt_apparmor
     local mkdir_cmd="mkdir -p ${OVN_DATADIR}"
 
     if [[ "$OVN_BUILD_FROM_SOURCE" == "False" ]]; then
@@ -685,7 +696,13 @@ function _start_ovs {
             sudo ovs-vsctl --no-wait set open_vswitch . external-ids:ovn-cms-options="enable-chassis-as-gw"
         fi
 
-        if is_provider_network || [[ $Q_USE_PROVIDERNET_FOR_PUBLIC == "True" ]]; then
+        if [[ "$OVN_AGENT_EXTENSIONS" =~ 'ovn-bgp' ]]; then
+            if [[ -z "$NEUTRON_BGP_PEER_BRIDGES" ]]; then
+                echo "NEUTRON_BGP_PEER_BRIDGES must be set when ovn-bgp extension is enabled"
+                return 1
+            fi
+            sudo ovs-vsctl --no-wait -- set Open_vSwitch . external-ids:neutron-bgp-peer-bridges=$NEUTRON_BGP_PEER_BRIDGES
+        elif is_provider_network || [[ $Q_USE_PROVIDERNET_FOR_PUBLIC == "True" ]]; then
             ovn_base_setup_bridge $OVS_PHYSICAL_BRIDGE
             sudo ovs-vsctl set open . external-ids:ovn-bridge-mappings=${PHYSICAL_NETWORK}:${OVS_PHYSICAL_BRIDGE}
         fi
@@ -704,28 +721,23 @@ function _start_ovs {
     fi
 }
 
-function _start_ovn_services {
-    _start_process "$OVSDB_SERVER_SERVICE"
-    _start_process "$OVS_VSWITCHD_SERVICE"
+function _wait_for_ovn_and_set_custom_config {
+    # Wait for the service to be ready
+    # Check for socket and db files for both OVN NB and SB
+    wait_for_sock_file $OVN_RUNDIR/ovnnb_db.sock
+    wait_for_sock_file $OVN_RUNDIR/ovnsb_db.sock
+    wait_for_db_file $OVN_DATADIR/ovnnb_db.db
+    wait_for_db_file $OVN_DATADIR/ovnsb_db.db
 
-    if is_service_enabled ovn-northd ; then
-        _start_process "$OVN_NORTHD_SERVICE"
-    fi
-    if is_service_enabled ovn-controller ; then
-        _start_process "$OVN_CONTROLLER_SERVICE"
-    fi
-    if is_service_enabled ovn-controller-vtep ; then
-        _start_process "$OVN_CONTROLLER_VTEP_SERVICE"
-    fi
-    if is_service_enabled ovs-vtep ; then
-        _start_process "devstack@ovs-vtep.service"
-    fi
-    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent ; then
-        _start_process "devstack@q-ovn-metadata-agent.service"
-    fi
-    if is_service_enabled q-ovn-agent neutron-ovn-agent ; then
-        _start_process "devstack@q-ovn-agent.service"
+    if is_service_enabled tls-proxy; then
+        sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
+        sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
     fi
+
+    sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+    sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
+    sudo ovs-appctl -t $OVN_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
+    sudo ovs-appctl -t $OVN_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
 }
 
 # start_ovn() - Start running processes, including screen
@@ -749,21 +761,8 @@ function start_ovn {
             _start_process "$OVN_NORTHD_SERVICE"
         fi
 
-        # Wait for the service to be ready
-        # Check for socket and db files for both OVN NB and SB
-        wait_for_sock_file $OVN_RUNDIR/ovnnb_db.sock
-        wait_for_sock_file $OVN_RUNDIR/ovnsb_db.sock
-        wait_for_db_file $OVN_DATADIR/ovnnb_db.db
-        wait_for_db_file $OVN_DATADIR/ovnsb_db.db
+        _wait_for_ovn_and_set_custom_config
 
-        if is_service_enabled tls-proxy; then
-            sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
-            sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-ssl $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/ca-chain.pem
-        fi
-        sudo ovn-nbctl --db=unix:$OVN_RUNDIR/ovnnb_db.sock set-connection p${OVN_PROTO}:6641:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
-        sudo ovn-sbctl --db=unix:$OVN_RUNDIR/ovnsb_db.sock set-connection p${OVN_PROTO}:6642:$SERVICE_LISTEN_ADDRESS -- set connection . inactivity_probe=60000
-        sudo ovs-appctl -t $OVN_RUNDIR/ovnnb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
-        sudo ovs-appctl -t $OVN_RUNDIR/ovnsb_db.ctl vlog/set console:off syslog:$OVN_DBS_LOG_LEVEL file:$OVN_DBS_LOG_LEVEL
     fi
 
     if is_service_enabled ovn-controller ; then
@@ -786,19 +785,17 @@ function start_ovn {
         fi
     fi
 
-    if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
+    if is_ovn_metadata_agent_enabled; then
         run_process q-ovn-metadata-agent "$NEUTRON_OVN_BIN_DIR/$NEUTRON_OVN_METADATA_BINARY --config-file $OVN_META_CONF"
         # Format logging
         setup_logging $OVN_META_CONF
     fi
 
-    if is_service_enabled q-ovn-agent neutron-ovn-agent; then
+    if is_ovn_agent_enabled; then
         run_process q-ovn-agent "$NEUTRON_OVN_BIN_DIR/$NEUTRON_OVN_AGENT_BINARY --config-file $OVN_AGENT_CONF"
         # Format logging
         setup_logging $OVN_AGENT_CONF
     fi
-
-    _start_ovn_services
 }
 
 function _stop_ovs_dp {
@@ -809,20 +806,27 @@ function _stop_ovs_dp {
 function _stop_process {
     local service=$1
     echo "Stopping process $service"
-    if $SYSTEMCTL is-enabled $service; then
+    # Stop if running, regardless of enabled state
+    if $SYSTEMCTL is-active $service; then
         $SYSTEMCTL stop $service
+    fi
+    if $SYSTEMCTL is-enabled $service; then
         $SYSTEMCTL disable $service
     fi
 }
 
 function stop_ovn {
+    # NOTE(ralonsoh): this check doesn't use "is_ovn_metadata_agent_enabled",
+    # instead it relies only in the configured services, disregarding the
+    # flag "TARGET_ENABLE_OVN_AGENT". It is needed to force the OVN Metadata
+    # agent stop in case the flag "TARGET_ENABLE_OVN_AGENT" is set.
     if is_service_enabled q-ovn-metadata-agent neutron-ovn-metadata-agent; then
         # pkill takes care not to kill itself, but it may kill its parent
         # sudo unless we use the "ps | grep [f]oo" trick
         sudo pkill -9 -f "[h]aproxy" || :
         _stop_process "devstack@q-ovn-metadata-agent.service"
     fi
-    if is_service_enabled q-ovn-agent neutron-ovn-agent; then
+    if is_ovn_agent_enabled; then
         # pkill takes care not to kill itself, but it may kill its parent
         # sudo unless we use the "ps | grep [f]oo" trick
         sudo pkill -9 -f "[h]aproxy" || :
@@ -841,10 +845,22 @@ function stop_ovn {
         _stop_process "devstack@ovs-vtep.service"
     fi
 
+    # Clear OVS external-ids before stopping to prevent stale config on restack
+    if sudo ovs-vsctl show &>/dev/null; then
+        sudo ovs-vsctl --if-exists clear open_vswitch . external-ids
+    fi
+
     _stop_process "$OVS_VSWITCHD_SERVICE"
     _stop_process "$OVSDB_SERVER_SERVICE"
 
     _stop_ovs_dp
+
+    # Clean up runtime files that can prevent restart
+    sudo rm -f $OVS_RUNDIR/*.sock $OVS_RUNDIR/*.pid $OVS_RUNDIR/*.ctl
+    sudo rm -f $OVN_RUNDIR/*.sock $OVN_RUNDIR/*.pid $OVN_RUNDIR/*.ctl
+    # Clean up database lock files
+    sudo rm -f $OVS_DATADIR/.*.db.~lock~
+    sudo rm -f $OVN_DATADIR/.*.db.~lock~
 }
 
 function _cleanup {
diff --git a/lib/neutron_plugins/ovs_source b/lib/neutron_plugins/ovs_source
index 75e7d7cb36..6b6f531a01 100644
--- a/lib/neutron_plugins/ovs_source
+++ b/lib/neutron_plugins/ovs_source
@@ -20,7 +20,7 @@ Q_BUILD_OVS_FROM_GIT=$(trueorfalse False Q_BUILD_OVS_FROM_GIT)
 OVS_REPO=${OVS_REPO:-https://github.com/openvswitch/ovs.git}
 OVS_REPO_NAME=$(basename ${OVS_REPO} | cut -f1 -d'.')
 OVS_REPO_NAME=${OVS_REPO_NAME:-ovs}
-OVS_BRANCH=${OVS_BRANCH:-0047ca3a0290f1ef954f2c76b31477cf4b9755f5}
+OVS_BRANCH=${OVS_BRANCH:-branch-3.3}
 
 # Functions
 
diff --git a/lib/neutron_plugins/services/l3 b/lib/neutron_plugins/services/l3
index c6d4663114..d0a5d6b8c2 100644
--- a/lib/neutron_plugins/services/l3
+++ b/lib/neutron_plugins/services/l3
@@ -35,7 +35,7 @@ Q_PUBLIC_VETH_INT=${Q_PUBLIC_VETH_INT:-veth-pub-int}
 # The next variable is configured by plugin
 # e.g.  _configure_neutron_l3_agent or lib/neutron_plugins/*
 #
-# L3 routers exist per tenant
+# L3 routers exist per project
 Q_L3_ROUTER_PER_TENANT=${Q_L3_ROUTER_PER_TENANT:-True}
 
 
@@ -94,6 +94,7 @@ NETWORK_GATEWAY=${NETWORK_GATEWAY:-}
 PUBLIC_NETWORK_GATEWAY=${PUBLIC_NETWORK_GATEWAY:-}
 PRIVATE_SUBNET_NAME=${PRIVATE_SUBNET_NAME:-"private-subnet"}
 PUBLIC_SUBNET_NAME=${PUBLIC_SUBNET_NAME:-"public-subnet"}
+PUBLIC_SUBNET_ENABLE_DHCP=${PUBLIC_SUBNET_ENABLE_DHCP:-False}
 
 # Subnetpool defaults
 USE_SUBNETPOOL=${USE_SUBNETPOOL:-True}
@@ -216,7 +217,7 @@ function create_neutron_initial_network {
     if is_networking_extension_supported "router" && is_networking_extension_supported "external-net"; then
         # Create a router, and add the private subnet as one of its interfaces
         if [[ "$Q_L3_ROUTER_PER_TENANT" == "True" ]]; then
-            # create a tenant-owned router.
+            # create a project-owned router.
             ROUTER_ID=$(openstack --os-cloud devstack --os-region "$REGION_NAME" router create $Q_ROUTER_NAME -f value -c id)
             die_if_not_set $LINENO ROUTER_ID "Failure creating router $Q_ROUTER_NAME"
         else
@@ -291,12 +292,16 @@ function _neutron_create_private_subnet_v6 {
 
 # Create public IPv4 subnet
 function _neutron_create_public_subnet_v4 {
+    local dhcp_param="--no-dhcp"
+    if [[ "$PUBLIC_SUBNET_ENABLE_DHCP" == "True" ]]; then
+        dhcp_param="--dhcp"
+    fi
     local subnet_params="--ip-version 4 "
     subnet_params+="${Q_FLOATING_ALLOCATION_POOL:+--allocation-pool $Q_FLOATING_ALLOCATION_POOL} "
     if [[ -n "$PUBLIC_NETWORK_GATEWAY" ]]; then
         subnet_params+="--gateway $PUBLIC_NETWORK_GATEWAY "
     fi
-    subnet_params+="--network $EXT_NET_ID --subnet-range $FLOATING_RANGE --no-dhcp "
+    subnet_params+="--network $EXT_NET_ID --subnet-range $FLOATING_RANGE $dhcp_param "
     subnet_params+="$PUBLIC_SUBNET_NAME"
     local id_and_ext_gw_ip
     id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
@@ -306,9 +311,13 @@ function _neutron_create_public_subnet_v4 {
 
 # Create public IPv6 subnet
 function _neutron_create_public_subnet_v6 {
+    local dhcp_param="--no-dhcp"
+    if [[ "$PUBLIC_SUBNET_ENABLE_DHCP" == "True" ]]; then
+        dhcp_param="--dhcp"
+    fi
     local subnet_params="--ip-version 6 "
     subnet_params+="--gateway $IPV6_PUBLIC_NETWORK_GATEWAY "
-    subnet_params+="--network $EXT_NET_ID --subnet-range $IPV6_PUBLIC_RANGE --no-dhcp "
+    subnet_params+="--network $EXT_NET_ID --subnet-range $IPV6_PUBLIC_RANGE $dhcp_param "
     subnet_params+="$IPV6_PUBLIC_SUBNET_NAME"
     local ipv6_id_and_ext_gw_ip
     ipv6_id_and_ext_gw_ip=$(openstack --os-cloud devstack-admin --os-region "$REGION_NAME" subnet create $subnet_params | grep -e 'gateway_ip' -e ' id ')
@@ -334,16 +343,6 @@ function _neutron_configure_router_v4 {
         local ext_gw_interface="none"
         if is_neutron_ovs_base_plugin; then
             ext_gw_interface=$(_neutron_get_ext_gw_interface)
-        elif [[ "$Q_AGENT" = "linuxbridge" ]]; then
-            # Get the device the neutron router and network for $FIXED_RANGE
-            # will be using.
-            if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" = "True" ]; then
-                # in provider nets a bridge mapping uses the public bridge directly
-                ext_gw_interface=$PUBLIC_BRIDGE
-            else
-                # e.x. brq3592e767-da for NET_ID 3592e767-da66-4bcb-9bec-cdb03cd96102
-                ext_gw_interface=brq${EXT_NET_ID:0:11}
-            fi
         fi
         if [[ "$ext_gw_interface" != "none" ]]; then
             local cidr_len=${FLOATING_RANGE#*/}
@@ -397,7 +396,7 @@ function _neutron_configure_router_v6 {
         # Override global IPV6_ROUTER_GW_IP with the true value from neutron
         # NOTE(slaweq): when enforce scopes is enabled in Neutron, router's
         # gateway ports aren't visible in API because such ports don't belongs
-        # to any tenant. Because of that, at least temporary we need to find
+        # to any project. Because of that, at least temporary we need to find
         # IPv6 address of the router's gateway in a bit different way.
         # It can be reverted when bug
         # https://bugs.launchpad.net/neutron/+bug/1959332 will be fixed
diff --git a/lib/neutron_plugins/services/ovn-bgp b/lib/neutron_plugins/services/ovn-bgp
new file mode 100644
index 0000000000..dc6a2c58fc
--- /dev/null
+++ b/lib/neutron_plugins/services/ovn-bgp
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+function configure_ovn_bgp_service_plugin {
+    neutron_service_plugin_class_add "ovn-bgp"
+}
diff --git a/lib/nova b/lib/nova
index 20e19da9a4..dcb4f46935 100644
--- a/lib/nova
+++ b/lib/nova
@@ -127,6 +127,9 @@ QEMU_CONF=/etc/libvirt/qemu.conf
 # ``NOVA_VNC_ENABLED`` can be used to forcibly enable VNC configuration.
 # In multi-node setups allows compute hosts to not run ``n-novnc``.
 NOVA_VNC_ENABLED=$(trueorfalse False NOVA_VNC_ENABLED)
+# same as ``NOVA_VNC_ENABLED`` but for Spice and serial console respectively.
+NOVA_SPICE_ENABLED=$(trueorfalse False NOVA_SPICE_ENABLED)
+NOVA_SERIAL_ENABLED=$(trueorfalse False NOVA_SERIAL_ENABLED)
 
 # Get hypervisor configuration
 # ----------------------------
@@ -450,6 +453,10 @@ function create_nova_conf {
     iniset $NOVA_CONF DEFAULT metadata_listen "$NOVA_SERVICE_LISTEN_ADDRESS"
     iniset $NOVA_CONF DEFAULT shutdown_timeout $NOVA_SHUTDOWN_TIMEOUT
 
+    # Enable errors if response validation fails. We want this enabled in CI
+    # and development contexts to highlights bugs in our response schemas.
+    iniset $NOVA_CONF api response_validation error
+
     iniset $NOVA_CONF key_manager backend nova.keymgr.conf_key_mgr.ConfKeyManager
 
     iniset $NOVA_CONF DEFAULT report_interval $NOVA_SERVICE_REPORT_INTERVAL
@@ -464,7 +471,7 @@ function create_nova_conf {
     # only setup database connections and cache backend if there are services
     # that require them running on the host. The ensures that n-cpu doesn't
     # leak a need to use the db in a multinode scenario.
-    if is_service_enabled n-api n-cond n-sched; then
+    if is_service_enabled n-api n-cond n-sched n-spice n-novnc n-sproxy; then
         # If we're in multi-tier cells mode, we want our control services pointing
         # at cell0 instead of cell1 to ensure isolation. If not, we point everything
         # at the main database like normal.
@@ -509,6 +516,10 @@ function create_nova_conf {
         configure_cinder_access
     fi
 
+    if is_service_enabled manila; then
+        configure_manila_access
+    fi
+
     if [ -n "$NOVA_STATE_PATH" ]; then
         iniset $NOVA_CONF DEFAULT state_path "$NOVA_STATE_PATH"
         iniset $NOVA_CONF oslo_concurrency lock_path "$NOVA_STATE_PATH"
@@ -621,32 +632,19 @@ function create_nova_conf {
 function configure_placement_nova_compute {
     # Use the provided config file path or default to $NOVA_CONF.
     local conf=${1:-$NOVA_CONF}
-    iniset $conf placement auth_type "password"
-    iniset $conf placement auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $conf placement username nova
-    iniset $conf placement password "$SERVICE_PASSWORD"
-    iniset $conf placement user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf placement project_name "$SERVICE_TENANT_NAME"
-    iniset $conf placement project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $conf placement region_name "$REGION_NAME"
+    configure_keystoneauth $conf nova placement
 }
 
 # Configure access to cinder.
 function configure_cinder_access {
     iniset $NOVA_CONF cinder os_region_name "$REGION_NAME"
-    iniset $NOVA_CONF cinder auth_type "password"
-    iniset $NOVA_CONF cinder auth_url "$KEYSTONE_SERVICE_URI"
     # NOTE(mriedem): This looks a bit weird but we use the nova user here
     # since it has the admin role and the cinder user does not. This is
     # similar to using the nova user in init_nova_service_user_conf. We need
     # to use a user with the admin role for background tasks in nova to
     # be able to GET block-storage API resources owned by another project
     # since cinder has low-level "is_admin" checks in its DB API.
-    iniset $NOVA_CONF cinder username nova
-    iniset $NOVA_CONF cinder password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF cinder user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF cinder project_name "$SERVICE_TENANT_NAME"
-    iniset $NOVA_CONF cinder project_domain_name "$SERVICE_DOMAIN_NAME"
+    configure_keystoneauth $NOVA_CONF nova cinder
     if is_service_enabled tls-proxy; then
         CINDER_SERVICE_HOST=${CINDER_SERVICE_HOST:-$SERVICE_HOST}
         CINDER_SERVICE_PORT=${CINDER_SERVICE_PORT:-8776}
@@ -654,6 +652,11 @@ function configure_cinder_access {
     fi
 }
 
+# Configure access to manila.
+function configure_manila_access {
+    configure_keystoneauth $NOVA_CONF nova manila
+}
+
 function configure_console_compute {
     # If we are running multiple cells (and thus multiple console proxies) on a
     # single host, we offset the ports to avoid collisions.  We need to
@@ -700,7 +703,7 @@ function configure_console_compute {
         iniset $NOVA_CPU_CONF vnc enabled false
     fi
 
-    if is_service_enabled n-spice; then
+    if is_service_enabled n-spice || [ "$NOVA_SPICE_ENABLED" != False ]; then
         # Address on which instance spiceservers will listen on compute hosts.
         # For multi-host, this should be the management ip of the compute host.
         SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS:-$default_proxyclient_addr}
@@ -710,7 +713,7 @@ function configure_console_compute {
         iniset $NOVA_CPU_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
     fi
 
-    if is_service_enabled n-sproxy; then
+    if is_service_enabled n-sproxy || [ "$NOVA_SERIAL_ENABLED" != False ]; then
         iniset $NOVA_CPU_CONF serial_console enabled True
         iniset $NOVA_CPU_CONF serial_console base_url "ws://$SERVICE_HOST:$((6082 + offset))/"
     fi
@@ -806,25 +809,16 @@ function configure_nova_unified_limits {
     iniset $NOVA_CONF oslo_limit username nova
     iniset $NOVA_CONF oslo_limit auth_type password
     iniset $NOVA_CONF oslo_limit auth_url $KEYSTONE_SERVICE_URI
-    iniset $NOVA_CONF oslo_limit system_scope all
-    iniset $NOVA_CONF oslo_limit endpoint_id \
-           $(openstack endpoint list --service nova -f value -c ID)
-
-    # Allow the nova service user to read quotas
-    openstack --os-cloud devstack-system-admin role add --user nova \
-        --user-domain $SERVICE_DOMAIN_NAME --system all reader
+    iniset $NOVA_CONF oslo_limit project_name service
+    iniset $NOVA_CONF oslo_limit project_domain_name $SERVICE_DOMAIN_NAME
+    iniset $NOVA_CONF oslo_limit endpoint_interface public
+    iniset $NOVA_CONF oslo_limit endpoint_service_type compute
+    iniset $NOVA_CONF oslo_limit endpoint_region_name $REGION_NAME
 }
 
 function init_nova_service_user_conf {
     iniset $NOVA_CONF service_user send_service_user_token True
-    iniset $NOVA_CONF service_user auth_type password
-    iniset $NOVA_CONF service_user auth_url "$KEYSTONE_SERVICE_URI"
-    iniset $NOVA_CONF service_user username nova
-    iniset $NOVA_CONF service_user password "$SERVICE_PASSWORD"
-    iniset $NOVA_CONF service_user user_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF service_user project_name "$SERVICE_PROJECT_NAME"
-    iniset $NOVA_CONF service_user project_domain_name "$SERVICE_DOMAIN_NAME"
-    iniset $NOVA_CONF service_user auth_strategy keystone
+    configure_keystoneauth $NOVA_CONF nova service_user
 }
 
 function conductor_conf {
@@ -968,24 +962,17 @@ function install_nova {
 
 # start_nova_api() - Start the API process ahead of other things
 function start_nova_api {
-    # Get right service port for testing
-    local service_port=$NOVA_SERVICE_PORT
-    local service_protocol=$NOVA_SERVICE_PROTOCOL
-    local nova_url
-    if is_service_enabled tls-proxy; then
-        service_port=$NOVA_SERVICE_PORT_INT
-        service_protocol="http"
-    fi
-
     # Hack to set the path for rootwrap
     local old_path=$PATH
     export PATH=$NOVA_BIN_DIR:$PATH
 
     run_process "n-api" "$(which uwsgi) --procname-prefix nova-api --ini $NOVA_UWSGI_CONF"
-    nova_url=$service_protocol://$SERVICE_HOST/compute/v2.1/
 
     echo "Waiting for nova-api to start..."
-    if ! wait_for_service $SERVICE_TIMEOUT $nova_url; then
+    # Check that the nova API service is running.
+    local service_url=$NOVA_SERVICE_PROTOCOL://$SERVICE_HOST/compute/v2.1/
+
+    if ! wait_for_service $SERVICE_TIMEOUT $service_url; then
         die $LINENO "nova-api did not start"
     fi
 
@@ -1067,6 +1054,15 @@ function start_nova_compute {
             # gets its own configuration and own log file.
             local fake_conf="${NOVA_FAKE_CONF}-${i}"
             iniset $fake_conf DEFAULT host "${HOSTNAME}${i}"
+            # Ensure that each fake compute has its own state path so that it
+            # can have its own compute_id file
+            local state_path
+            state_path="$NOVA_STATE_PATH/${HOSTNAME}${i}"
+            COMPUTE_ID=$(uuidgen)
+            sudo mkdir -p "$state_path"
+            iniset $fake_conf DEFAULT state_path "$state_path"
+            # use the generated UUID as the stable compute node UUID
+            echo "$COMPUTE_ID" | sudo tee "$state_path/compute_id"
             run_process "n-cpu-${i}" "$NOVA_BIN_DIR/nova-compute --config-file $NOVA_CPU_CONF --config-file $fake_conf"
         done
     else
diff --git a/lib/nova_plugins/functions-libvirt b/lib/nova_plugins/functions-libvirt
index ba2e98e304..e421c5bac0 100644
--- a/lib/nova_plugins/functions-libvirt
+++ b/lib/nova_plugins/functions-libvirt
@@ -53,9 +53,33 @@ EOF
     sudo systemctl daemon-reload
 }
 
+function enable_debian_12_backports {
+    # we are using debian backport repos to work around a qemu-img bug
+    # related to luks encrypted volumes, this requires us to use newer
+    # versions of qemu libvirt and the supporting packages for vm firmware
+    # This is related to https://bugs.launchpad.net/ceph/+bug/2116852
+    # and https://gitlab.com/qemu-project/qemu/-/commit/145f12e
+    if ! grep -qr "bookworm-backports" /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null; then
+        echo "deb http://deb.debian.org/debian bookworm-backports main" | \
+            sudo tee /etc/apt/sources.list.d/bookworm-backports.list
+    fi
+
+    sudo tee /etc/apt/preferences.d/99-nova-backports <<EOF
+Package: qemu* libvirt* ovmf* seabios* opensbi
+Pin: release n=bookworm-backports
+Pin-Priority: 990
+EOF
+
+    # Force apt-get update to pick up the backports repository
+    sudo apt-get update
+}
+
 
 # Installs required distro-specific libvirt packages.
 function install_libvirt {
+    if [[ ${DISTRO} =~ "bookworm" ]]; then
+        enable_debian_12_backports
+    fi
     # NOTE(yoctozepto): The common consensus [1] is that libvirt-python should
     # be installed from distro packages. However, various projects might be
     # trying to ensure it is installed using pip AND use upper-constraints
@@ -70,10 +94,19 @@ function install_libvirt {
 
     if is_ubuntu; then
         install_package qemu-system libvirt-clients libvirt-daemon-system libvirt-dev python3-libvirt systemd-coredump
+        install_package ovmf swtpm swtpm-tools mdevctl
         if is_arch "aarch64"; then
-            install_package qemu-efi
+            install_package qemu-efi-aarch64
         fi
         #pip_install_gr <there-si-no-guestfs-in-pypi>
+
+        if [[ ${DISTRO} =~ "bookworm" ]] || [[ ${DISTRO} =~ "trixie" ]]; then
+            # Since debian 13 spice is supported in qemu through an additional
+            # package. We also enabled backports on debian 12 which makes the
+            # same change.
+            install_package qemu-system-modules-spice
+        fi
+
     elif is_fedora; then
 
         # Optionally enable the virt-preview repo when on Fedora
@@ -93,11 +126,20 @@ function install_libvirt {
         # as the base system version is too old.  We should have
         # pre-installed these
         install_package $qemu_package
-        install_package libvirt libvirt-devel python3-libvirt
+        install_package libvirt libvirt-devel
+        install_package edk2-ovmf
+
+        if [[ $DISTRO =~ rhel9 ]]; then
+            pip_install_gr libvirt-python
+        else
+            install_package python3-libvirt
+        fi
 
         if is_arch "aarch64"; then
             install_package edk2-aarch64
         fi
+
+        install_package swtpm swtpm-tools mdevctl
     fi
 
     if [[ $DEBUG_LIBVIRT_COREDUMPS == True ]]; then
diff --git a/lib/nova_plugins/hypervisor-fake b/lib/nova_plugins/hypervisor-fake
index 87ee49fa4b..39cb45ca67 100644
--- a/lib/nova_plugins/hypervisor-fake
+++ b/lib/nova_plugins/hypervisor-fake
@@ -36,7 +36,7 @@ function cleanup_nova_hypervisor {
 
 # configure_nova_hypervisor - Set config files, create data dirs, etc
 function configure_nova_hypervisor {
-    iniset $NOVA_CONF DEFAULT compute_driver "fake.FakeDriver"
+    iniset $NOVA_CONF DEFAULT compute_driver "fake.FakeDriverWithoutFakeNodes"
     # Disable arbitrary limits
     iniset $NOVA_CONF quota driver nova.quota.NoopQuotaDriver
 }
diff --git a/lib/nova_plugins/hypervisor-libvirt b/lib/nova_plugins/hypervisor-libvirt
index 4b44c1f86f..163688f7f2 100644
--- a/lib/nova_plugins/hypervisor-libvirt
+++ b/lib/nova_plugins/hypervisor-libvirt
@@ -41,7 +41,7 @@ function configure_nova_hypervisor {
     iniset $NOVA_CONF libvirt virt_type "$LIBVIRT_TYPE"
     iniset $NOVA_CONF libvirt cpu_mode "$LIBVIRT_CPU_MODE"
     if [ "$LIBVIRT_CPU_MODE" == "custom" ] ; then
-        iniset $NOVA_CONF libvirt cpu_model "$LIBVIRT_CPU_MODEL"
+        iniset $NOVA_CONF libvirt cpu_models "$LIBVIRT_CPU_MODEL"
     fi
     # Do not enable USB tablet input devices to avoid QEMU CPU overhead.
     iniset $NOVA_CONF DEFAULT pointer_model "ps2mouse"
@@ -56,10 +56,10 @@ function configure_nova_hypervisor {
     # arm64-specific configuration
     if is_arch "aarch64"; then
         iniset $NOVA_CONF libvirt cpu_mode "host-passthrough"
-        # NOTE(mnaser): We cannot have `cpu_model` set if the `cpu_mode` is
+        # NOTE(mnaser): We cannot have `cpu_models` set if the `cpu_mode` is
         #               set to `host-passthrough`, or `nova-compute` refuses to
         #               start.
-        inidelete $NOVA_CONF libvirt cpu_model
+        inidelete $NOVA_CONF libvirt cpu_models
     fi
 
     if isset ENABLE_FILE_INJECTION; then
diff --git a/lib/oslo b/lib/oslo
deleted file mode 100644
index 3ae64c8210..0000000000
--- a/lib/oslo
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/bash
-#
-# lib/oslo
-#
-# Functions to install **Oslo** libraries from git
-#
-# We need this to handle the fact that projects would like to use
-# pre-released versions of oslo libraries.
-#
-# Included for compatibility with grenade, remove in Queens
-source $TOP_DIR/lib/libraries
diff --git a/lib/placement b/lib/placement
index 63fdfb6c1a..03aaa0344b 100644
--- a/lib/placement
+++ b/lib/placement
@@ -37,7 +37,7 @@ if [[ ${USE_VENV} = True ]]; then
 else
     PLACEMENT_BIN_DIR=$(get_python_exec_prefix)
 fi
-PLACEMENT_UWSGI=$PLACEMENT_BIN_DIR/placement-api
+PLACEMENT_UWSGI=placement.wsgi.api:application
 PLACEMENT_UWSGI_CONF=$PLACEMENT_CONF_DIR/placement-uwsgi.ini
 
 if is_service_enabled tls-proxy; then
@@ -71,32 +71,6 @@ function cleanup_placement {
     remove_uwsgi_config "$PLACEMENT_UWSGI_CONF" "placement-api"
 }
 
-# _config_placement_apache_wsgi() - Set WSGI config files
-function _config_placement_apache_wsgi {
-    local placement_api_apache_conf
-    local venv_path=""
-    local placement_bin_dir=""
-    placement_bin_dir=$(get_python_exec_prefix)
-    placement_api_apache_conf=$(apache_site_config_for placement-api)
-
-    if [[ ${USE_VENV} = True ]]; then
-        venv_path="python-path=${PROJECT_VENV["placement"]}/lib/$(python_version)/site-packages"
-        placement_bin_dir=${PROJECT_VENV["placement"]}/bin
-    fi
-
-    sudo cp $FILES/apache-placement-api.template $placement_api_apache_conf
-    sudo sed -e "
-        s|%APACHE_NAME%|$APACHE_NAME|g;
-        s|%PUBLICWSGI%|$placement_bin_dir/placement-api|g;
-        s|%SSLENGINE%|$placement_ssl|g;
-        s|%SSLCERTFILE%|$placement_certfile|g;
-        s|%SSLKEYFILE%|$placement_keyfile|g;
-        s|%USER%|$STACK_USER|g;
-        s|%VIRTUALENV%|$venv_path|g
-        s|%APIWORKERS%|$API_WORKERS|g
-    " -i $placement_api_apache_conf
-}
-
 # create_placement_conf() - Write config
 function create_placement_conf {
     rm -f $PLACEMENT_CONF
@@ -112,11 +86,7 @@ function configure_placement {
     sudo install -d -o $STACK_USER $PLACEMENT_CONF_DIR
     create_placement_conf
 
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement"
-    else
-        _config_placement_apache_wsgi
-    fi
+    write_uwsgi_config "$PLACEMENT_UWSGI_CONF" "$PLACEMENT_UWSGI" "/placement" "" "placement-api"
     if [[ "$PLACEMENT_ENFORCE_SCOPE" == "True" || "$ENFORCE_SCOPE" == "True" ]]; then
         iniset $PLACEMENT_CONF oslo_policy enforce_new_defaults True
         iniset $PLACEMENT_CONF oslo_policy enforce_scope True
@@ -147,7 +117,6 @@ function init_placement {
 
 # install_placement() - Collect source and prepare
 function install_placement {
-    install_apache_wsgi
     # Install the openstackclient placement client plugin for CLI
     pip_install_gr osc-placement
     git_clone $PLACEMENT_REPO $PLACEMENT_DIR $PLACEMENT_BRANCH
@@ -156,12 +125,7 @@ function install_placement {
 
 # start_placement_api() - Start the API processes ahead of other things
 function start_placement_api {
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        run_process "placement-api" "$(which uwsgi) --procname-prefix placement --ini $PLACEMENT_UWSGI_CONF"
-    else
-        enable_apache_site placement-api
-        restart_apache_server
-    fi
+    run_process "placement-api" "$(which uwsgi) --procname-prefix placement --ini $PLACEMENT_UWSGI_CONF"
 
     echo "Waiting for placement-api to start..."
     if ! wait_for_service $SERVICE_TIMEOUT $PLACEMENT_SERVICE_PROTOCOL://$PLACEMENT_SERVICE_HOST/placement; then
@@ -175,12 +139,7 @@ function start_placement {
 
 # stop_placement() - Disable the api service and stop it.
 function stop_placement {
-    if [[ "$WSGI_MODE" == "uwsgi" ]]; then
-        stop_process "placement-api"
-    else
-        disable_apache_site placement-api
-        restart_apache_server
-    fi
+    stop_process "placement-api"
 }
 
 # Restore xtrace
diff --git a/lib/swift b/lib/swift
index 3659624d5b..2710346451 100644
--- a/lib/swift
+++ b/lib/swift
@@ -318,8 +318,8 @@ function generate_swift_config_services {
     iniuncomment ${swift_node_config} DEFAULT mount_check
     iniset ${swift_node_config} DEFAULT mount_check false
 
-    iniuncomment ${swift_node_config} ${server_type}-replicator vm_test_mode
-    iniset ${swift_node_config} ${server_type}-replicator vm_test_mode yes
+    iniuncomment ${swift_node_config} ${server_type}-replicator rsync_module
+    iniset ${swift_node_config} ${server_type}-replicator rsync_module "{replication_ip}::${server_type}{replication_port}"
 
     # Using a sed and not iniset/iniuncomment because we want to a global
     # modification and make sure it works for new sections.
@@ -434,6 +434,13 @@ function configure_swift {
             swift_pipeline+=" s3token"
             iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token auth_uri ${KEYSTONE_SERVICE_URI_V3}
             iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token delay_auth_decision true
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token secret_cache_duration 900
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token auth_url ${KEYSTONE_SERVICE_URI}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token project_name 'service'
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token project_domain_name ${SERVICE_DOMAIN_NAME}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token username 'swift'
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token user_domain_name ${SERVICE_DOMAIN_NAME}
+            iniset ${SWIFT_CONFIG_PROXY_SERVER} filter:s3token password ${SERVICE_PASSWORD}
         fi
         swift_pipeline+=" keystoneauth"
     fi
@@ -477,6 +484,9 @@ function configure_swift {
     iniset ${SWIFT_CONF_DIR}/swift.conf swift-constraints max_header_size ${SWIFT_MAX_HEADER_SIZE}
     iniset ${SWIFT_CONF_DIR}/swift.conf swift-constraints max_file_size ${SWIFT_MAX_FILE_SIZE}
 
+    # Create an additional storage policy
+    iniset ${SWIFT_CONF_DIR}/swift.conf storage-policy:1 name silver
+
     local node_number
     for node_number in ${SWIFT_REPLICAS_SEQ}; do
         local swift_node_config=${SWIFT_CONF_DIR}/object-server/${node_number}.conf
@@ -713,6 +723,10 @@ function init_swift {
         $SWIFT_BIN_DIR/swift-ring-builder object.builder rebalance 42
         $SWIFT_BIN_DIR/swift-ring-builder container.builder rebalance 42
         $SWIFT_BIN_DIR/swift-ring-builder account.builder rebalance 42
+
+        # An additional storage policy requires an object ring as well.
+        # Re-using the previously created one to use the same devices.
+        cp object.ring.gz object-1.ring.gz
     } && popd >/dev/null
 }
 
@@ -838,6 +852,8 @@ function stop_swift {
     for type in proxy object container account; do
         stop_process s-${type}
     done
+    # Stop the container-sync daemon if it was started
+    stop_process s-container-sync
     # Blast out any stragglers
     pkill -f swift- || true
 }
diff --git a/lib/tempest b/lib/tempest
index eeeef67a8b..1ebe9c5f1f 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -105,6 +105,8 @@ TEMPEST_CONCURRENCY=${TEMPEST_CONCURRENCY:-$(nproc)}
 TEMPEST_FLAVOR_RAM=${TEMPEST_FLAVOR_RAM:-192}
 TEMPEST_FLAVOR_ALT_RAM=${TEMPEST_FLAVOR_ALT_RAM:-256}
 
+TEMPEST_USE_ISO_IMAGE=$(trueorfalse False TEMPEST_USE_ISO_IMAGE)
+
 # Functions
 # ---------
 
@@ -161,12 +163,20 @@ function get_active_images {
     # start with a fresh array in case we are called multiple times
     img_array=()
 
-    while read -r IMAGE_NAME IMAGE_UUID; do
+    # NOTE(gmaan): Most of the iso image require ssh to be enabled explicitly
+    # and if we set those iso images in image_ref and image_ref_alt that can
+    # cause test to fail because many tests using image_ref and image_ref_alt
+    # to boot server also perform ssh. We skip to set iso image in tempest
+    # unless it is requested via TEMPEST_USE_ISO_IMAGE.
+    while read -r IMAGE_NAME IMAGE_UUID DISK_FORMAT; do
+        if [[ "$DISK_FORMAT" == "iso"  ]] && [[ "$TEMPEST_USE_ISO_IMAGE" == False ]]; then
+            continue
+        fi
         if [ "$IMAGE_NAME" = "$DEFAULT_IMAGE_NAME" ]; then
             img_id="$IMAGE_UUID"
         fi
         img_array+=($IMAGE_UUID)
-    done < <(openstack --os-cloud devstack-admin image list --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2 }')
+    done < <(openstack --os-cloud devstack-admin image list --long --property status=active | awk -F'|' '!/^(+--)|ID|aki|ari/ { print $3,$2,$4 }')
 }
 
 function poll_glance_images {
@@ -197,6 +207,8 @@ function configure_tempest {
         pip_install_gr testrepository
     fi
 
+    local ENABLED_SERVICES=${SERVICES_FOR_TEMPEST:=$ENABLED_SERVICES}
+
     local image_lines
     local images
     local num_images
@@ -512,9 +524,19 @@ function configure_tempest {
         iniset $TEMPEST_CONFIG compute-feature-enabled volume_multiattach True
     fi
 
-    if is_service_enabled n-novnc; then
+    if is_service_enabled n-novnc || [ "$NOVA_VNC_ENABLED" != False ]; then
         iniset $TEMPEST_CONFIG compute-feature-enabled vnc_console True
     fi
+    if is_service_enabled n-spice || [ "$NOVA_SPICE_ENABLED" != False ]; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled spice_console True
+    fi
+    if is_service_enabled n-sproxy || [ "$NOVA_SERIAL_ENABLED" != False ]; then
+        iniset $TEMPEST_CONFIG compute-feature-enabled serial_console True
+    fi
+
+    # NOTE(gmaan): Since 2025.2, 'manager' role is available in nova.
+    local nova_policy_roles="admin,manager,member,reader,service"
+    iniset $TEMPEST_CONFIG compute-feature-enabled nova_policy_roles $nova_policy_roles
 
     # Network
     iniset $TEMPEST_CONFIG network project_networks_reachable false
@@ -578,6 +600,7 @@ function configure_tempest {
         TEMPEST_VOLUME_REVERT_TO_SNAPSHOT=${TEMPEST_VOLUME_REVERT_TO_SNAPSHOT:-True}
     fi
     iniset $TEMPEST_CONFIG volume-feature-enabled volume_revert $(trueorfalse False TEMPEST_VOLUME_REVERT_TO_SNAPSHOT)
+    iniset $TEMPEST_CONFIG volume-feature-enabled extend_attached_encrypted_volume ${TEMPEST_EXTEND_ATTACHED_ENCRYPTED_VOLUME:-False}
     if [[ "$CINDER_BACKUP_DRIVER" == *"swift"* ]]; then
         iniset $TEMPEST_CONFIG volume backup_driver swift
     fi
diff --git a/lib/tls b/lib/tls
index 0a598e14f7..fa0a448d7d 100644
--- a/lib/tls
+++ b/lib/tls
@@ -367,7 +367,7 @@ function fix_system_ca_bundle_path {
         if [[ "$GLOBAL_VENV" == "True" ]] ; then
             capath=$($DEVSTACK_VENV/bin/python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
         else
-            capath=$(python3 -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
+            capath=$(python$PYTHON3_VERSION -c $'try:\n from requests import certs\n print (certs.where())\nexcept ImportError: pass')
         fi
         if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
             if is_fedora; then
@@ -452,6 +452,7 @@ function enable_mod_ssl {
 # ===============
 
 function tune_apache_connections {
+    local should_restart=$1
     local tuning_file=$APACHE_SETTINGS_DIR/connection-tuning.conf
     if ! [ -f $tuning_file ] ; then
         sudo bash -c "cat > $tuning_file" << EOF
@@ -494,7 +495,12 @@ ThreadLimit          64
 MaxRequestsPerChild   0
 </IfModule>
 EOF
-        restart_apache_server
+        if [ "$should_restart" != "norestart" ] ; then
+            # Only restart the apache server if we know we really want to
+            # do so. Too many restarts in a short period of time is treated
+            # as an error by systemd.
+            restart_apache_server
+        fi
     fi
 }
 
@@ -509,7 +515,8 @@ function start_tls_proxy {
     # 8190 is the default apache size.
     local f_header_size=${6:-8190}
 
-    tune_apache_connections
+    # We don't restart apache here as we'll do it at the end of the function.
+    tune_apache_connections norestart
 
     local config_file
     config_file=$(apache_site_config_for $b_service)
@@ -558,7 +565,9 @@ $listen_string
 </VirtualHost>
 EOF
     for mod in headers ssl proxy proxy_http; do
-        enable_apache_mod $mod
+        # We don't need to restart here as we will restart once at the end
+        # of the function.
+        enable_apache_mod $mod norestart
     done
     enable_apache_site $b_service
     restart_apache_server
diff --git a/openrc b/openrc
index 5ec7634638..e800abeb3d 100644
--- a/openrc
+++ b/openrc
@@ -72,8 +72,3 @@ if [[ ! -v OS_CACERT ]] ; then
         export OS_CACERT=$DEFAULT_OS_CACERT
     fi
 fi
-
-# Currently cinderclient needs you to specify the *volume api* version. This
-# needs to match the config of your catalog returned by Keystone.
-export CINDER_VERSION=${CINDER_VERSION:-3}
-export OS_VOLUME_API_VERSION=${OS_VOLUME_API_VERSION:-$CINDER_VERSION}
diff --git a/roles/capture-system-logs/tasks/main.yaml b/roles/capture-system-logs/tasks/main.yaml
index 77b5ec5098..4b5ec4836b 100644
--- a/roles/capture-system-logs/tasks/main.yaml
+++ b/roles/capture-system-logs/tasks/main.yaml
@@ -4,7 +4,13 @@
     executable: /bin/bash
     cmd: |
       sudo iptables-save > {{ stage_dir }}/iptables.txt
-      df -h > {{ stage_dir }}/df.txt
+
+      # NOTE(sfernand): Run 'df' with a 60s timeout to prevent hangs from
+      # stale NFS mounts.
+      timeout -s 9 60s df -h > {{ stage_dir }}/df.txt || true
+      # If 'df' times out, the mount output helps debug which NFS share
+      # is unresponsive.
+      mount > {{ stage_dir }}/mount.txt
 
       for py_ver in 2 3; do
           if [[ `which python${py_ver}` ]]; then
diff --git a/roles/orchestrate-devstack/tasks/main.yaml b/roles/orchestrate-devstack/tasks/main.yaml
index 2b8ae01a62..b8ee7e35a7 100644
--- a/roles/orchestrate-devstack/tasks/main.yaml
+++ b/roles/orchestrate-devstack/tasks/main.yaml
@@ -4,6 +4,7 @@
   when: inventory_hostname == 'controller'
 
 - name: Setup devstack on sub-nodes
+  any_errors_fatal: true
   block:
 
   - name: Distribute the build sshkey for the user "stack"
diff --git a/stack.sh b/stack.sh
index dcfd398c01..c6d37611c9 100755
--- a/stack.sh
+++ b/stack.sh
@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 
-
 # ``stack.sh`` is an opinionated OpenStack developer installation.  It
 # installs and configures various combinations of **Cinder**, **Glance**,
 # **Horizon**, **Keystone**, **Nova**, **Neutron**, and **Swift**
@@ -230,7 +229,7 @@ write_devstack_version
 
 # Warn users who aren't on an explicitly supported distro, but allow them to
 # override check and attempt installation with ``FORCE=yes ./stack``
-SUPPORTED_DISTROS="bookworm|jammy|noble|rhel9"
+SUPPORTED_DISTROS="trixie|bookworm|noble|rhel9|rhel10"
 
 if [[ ! ${DISTRO} =~ $SUPPORTED_DISTROS ]]; then
     echo "WARNING: this script has not been tested on $DISTRO"
@@ -302,14 +301,18 @@ function _install_epel {
 }
 
 function _install_rdo {
-    if [[ $DISTRO == "rhel9" ]]; then
+    if [[ $DISTRO =~ "rhel" ]]; then
+        VERSION=${DISTRO:4:2}
         rdo_release=${TARGET_BRANCH#*/}
         if [[ "$TARGET_BRANCH" == "master" ]]; then
             # adding delorean-deps repo to provide current master rpms
-            sudo wget https://trunk.rdoproject.org/centos9-master/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
+            sudo wget https://trunk.rdoproject.org/centos${VERSION}-master/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
         else
-            # For stable/unmaintained branches use corresponding release rpm
-            sudo dnf -y install centos-release-openstack-${rdo_release}
+            if sudo dnf provides centos-release-openstack-${rdo_release} >/dev/null 2>&1; then
+                sudo dnf -y install centos-release-openstack-${rdo_release}
+            else
+                sudo wget https://trunk.rdoproject.org/centos${VERSION}-${rdo_release}/delorean-deps.repo -O /etc/yum.repos.d/delorean-deps.repo
+            fi
         fi
     fi
     sudo dnf -y update
@@ -353,7 +356,7 @@ async_init
 # Certain services such as rabbitmq require that the local hostname resolves
 # correctly.  Make sure it exists in /etc/hosts so that is always true.
 LOCAL_HOSTNAME=`hostname -s`
-if ! fgrep -qwe "$LOCAL_HOSTNAME" /etc/hosts; then
+if ! grep -Fqwe "$LOCAL_HOSTNAME" /etc/hosts; then
     sudo sed -i "s/\(^127.0.0.1.*\)/\1 $LOCAL_HOSTNAME/" /etc/hosts
 fi
 
@@ -362,36 +365,7 @@ fi
 # to speed things up
 SKIP_EPEL_INSTALL=$(trueorfalse False SKIP_EPEL_INSTALL)
 
-if [[ $DISTRO == "rhel8" ]]; then
-    # If we have /etc/ci/mirror_info.sh assume we're on a OpenStack CI
-    # node, where EPEL is installed (but disabled) and already
-    # pointing at our internal mirror
-    if [[ -f /etc/ci/mirror_info.sh ]]; then
-        SKIP_EPEL_INSTALL=True
-        sudo dnf config-manager --set-enabled epel
-    fi
-
-    # PowerTools repo provides libyaml-devel required by devstack itself and
-    # EPEL packages assume that the PowerTools repository is enable.
-    sudo dnf config-manager --set-enabled PowerTools
-
-    # CentOS 8.3 changed the repository name to lower case.
-    sudo dnf config-manager --set-enabled powertools
-
-    if [[ ${SKIP_EPEL_INSTALL} != True ]]; then
-        _install_epel
-    fi
-    # Along with EPEL, CentOS (and a-likes) require some packages only
-    # available in RDO repositories (e.g. OVS, or later versions of
-    # kvm) to run.
-    _install_rdo
-
-    # NOTE(cgoncalves): workaround RHBZ#1154272
-    # dnf fails for non-privileged users when expired_repos.json doesn't exist.
-    # RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1154272
-    # Patch: https://github.com/rpm-software-management/dnf/pull/1448
-    echo "[]" | sudo tee /var/cache/dnf/expired_repos.json
-elif [[ $DISTRO == "rhel9" ]]; then
+if [[ $DISTRO == "rhel9" ]]; then
     # for CentOS Stream 9 repository
     sudo dnf config-manager --set-enabled crb
     # for RHEL 9 repository
@@ -405,6 +379,11 @@ elif [[ $DISTRO == "rhel9" ]]; then
     if is_package_installed curl-minimal; then
         sudo dnf swap -y curl-minimal curl
     fi
+elif [[ $DISTRO == "rhel10" ]]; then
+    # for CentOS Stream 10 repository
+    sudo dnf config-manager --set-enabled crb
+    # rabbitmq and other packages are provided by RDO repositories.
+    _install_rdo
 elif [[ $DISTRO == "openEuler-22.03" ]]; then
     # There are some problem in openEuler. We should fix it first. Some required
     # package/action runs before fixup script. So we can't fix there.
@@ -638,6 +617,7 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/atop
 source $TOP_DIR/lib/tcpdump
 source $TOP_DIR/lib/etcd3
 source $TOP_DIR/lib/os-vif
@@ -1001,6 +981,11 @@ if is_service_enabled tls-proxy; then
     fix_system_ca_bundle_path
 fi
 
+if is_service_enabled cinder || [[ "$USE_CINDER_FOR_GLANCE" == "True" ]]; then
+    # os-brick setup required by glance, cinder, and nova
+    init_os_brick
+fi
+
 # Extras Install
 # --------------
 
@@ -1090,6 +1075,12 @@ save_stackenv $LINENO
 # A better kind of sysstat, with the top process per time slice
 start_dstat
 
+if is_service_enabled atop; then
+    configure_atop
+    install_atop
+    start_atop
+fi
+
 # Run a background tcpdump for debugging
 # Note: must set TCPDUMP_ARGS with the enabled service
 if is_service_enabled tcpdump; then
@@ -1304,10 +1295,7 @@ if is_service_enabled ovn-controller ovn-controller-vtep; then
     start_ovn_services
 fi
 
-if is_service_enabled neutron-api; then
-    echo_summary "Starting Neutron"
-    start_neutron_api
-elif is_service_enabled q-svc; then
+if is_service_enabled q-svc neutron-api; then
     echo_summary "Starting Neutron"
     configure_neutron_after_post_config
     start_neutron_service_and_check
@@ -1324,7 +1312,7 @@ if is_service_enabled neutron; then
     start_neutron
 fi
 # Once neutron agents are started setup initial network elements
-if is_service_enabled q-svc && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
+if is_service_enabled q-svc neutron-api && [[ "$NEUTRON_CREATE_INITIAL_NETWORKS" == "True" ]]; then
     echo_summary "Creating initial neutron network elements"
     # Here's where plugins can wire up their own networks instead
     # of the code in lib/neutron_plugins/services/l3
diff --git a/stackrc b/stackrc
index c05d4e2d98..ac9b7ee8ce 100644
--- a/stackrc
+++ b/stackrc
@@ -75,7 +75,7 @@ if ! isset ENABLED_SERVICES ; then
     # OVN
     ENABLED_SERVICES+=,ovn-controller,ovn-northd,ovs-vswitchd,ovsdb-server
     # Neutron
-    ENABLED_SERVICES+=,q-svc,q-ovn-metadata-agent
+    ENABLED_SERVICES+=,q-svc,q-ovn-agent
     # Dashboard
     ENABLED_SERVICES+=,horizon
     # Additional services
@@ -133,7 +133,7 @@ export PYTHON3_VERSION=${PYTHON3_VERSION:-${_DEFAULT_PYTHON3_VERSION:-3}}
 
 # Create a virtualenv with this
 # Use the built-in venv to avoid more dependencies
-export VIRTUALENV_CMD="python3 -m venv"
+export VIRTUALENV_CMD="python$PYTHON3_VERSION -m venv"
 
 # Default for log coloring is based on interactive-or-not.
 # Baseline assumption is that non-interactive invocations are for CI,
@@ -252,7 +252,7 @@ REQUIREMENTS_DIR=${REQUIREMENTS_DIR:-$DEST/requirements}
 # Setting the variable to 'ALL' will activate the download for all
 # libraries.
 
-DEVSTACK_SERIES="2025.1"
+DEVSTACK_SERIES="2026.2"
 
 ##############
 #
@@ -395,6 +395,10 @@ GITBRANCH["futurist"]=${FUTURIST_BRANCH:-$TARGET_BRANCH}
 GITREPO["debtcollector"]=${DEBTCOLLECTOR_REPO:-${GIT_BASE}/openstack/debtcollector.git}
 GITBRANCH["debtcollector"]=${DEBTCOLLECTOR_BRANCH:-$TARGET_BRANCH}
 
+# etcd3gw library
+GITREPO["etcd3gw"]=${ETCD3GW_REPO:-${GIT_BASE}/openstack/etcd3gw.git}
+GITBRANCH["etcd3gw"]=${ETCD3GW_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
+
 # helpful state machines
 GITREPO["automaton"]=${AUTOMATON_REPO:-${GIT_BASE}/openstack/automaton.git}
 GITBRANCH["automaton"]=${AUTOMATON_BRANCH:-$TARGET_BRANCH}
@@ -615,12 +619,13 @@ case "$VIRT_DRIVER" in
         LIBVIRT_TYPE=${LIBVIRT_TYPE:-kvm}
         LIBVIRT_CPU_MODE=${LIBVIRT_CPU_MODE:-custom}
         LIBVIRT_CPU_MODEL=${LIBVIRT_CPU_MODEL:-Nehalem}
+
+        if [[ -z "$os_VENDOR" ]]; then
+            GetOSVersion
+        fi
+
         if [[ "$os_VENDOR" =~ (Debian|Ubuntu) ]]; then
-            # The groups change with newer libvirt. Older Ubuntu used
-            # 'libvirtd', but now uses libvirt like Debian. Do a quick check
-            # to see if libvirtd group already exists to handle grenade's case.
-            LIBVIRT_GROUP=$(cut -d ':' -f 1 /etc/group | grep 'libvirtd$' || true)
-            LIBVIRT_GROUP=${LIBVIRT_GROUP:-libvirt}
+            LIBVIRT_GROUP=libvirt
         else
             LIBVIRT_GROUP=libvirtd
         fi
@@ -705,12 +710,11 @@ fi
 EXTRA_CACHE_URLS=""
 
 # etcd3 defaults
-ETCD_VERSION=${ETCD_VERSION:-v3.4.27}
-ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"a32d21e006252dbc3405b0645ba8468021ed41376974b573285927bf39b39eb9"}
-ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"ed7e257c225b9b9545fac22246b97f4074a4b5109676e92dbaebfb9315b69cc0"}
-ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"eb8825e0bc2cbaf9e55947f5ee373ebc9ca43b6a2ea5ced3b992c81855fff37e"}
-# etcd v3.2.x and later doesn't have anything for s390x
-ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-""}
+ETCD_VERSION=${ETCD_VERSION:-v3.5.21}
+ETCD_SHA256_AMD64=${ETCD_SHA256_AMD64:-"adddda4b06718e68671ffabff2f8cee48488ba61ad82900e639d108f2148501c"}
+ETCD_SHA256_ARM64=${ETCD_SHA256_ARM64:-"95bf6918623a097c0385b96f139d90248614485e781ec9bee4768dbb6c79c53f"}
+ETCD_SHA256_PPC64=${ETCD_SHA256_PPC64:-"6fb6ecb3d1b331eb177dc610a8efad3aceb1f836d6aeb439ba0bfac5d5c2a38c"}
+ETCD_SHA256_S390X=${ETCD_SHA256_S390X:-"a211a83961ba8a7e94f7d6343ad769e699db21a715ba4f3b68cf31ea28f9c951"}
 # Make sure etcd3 downloads the correct architecture
 if is_arch "x86_64"; then
     ETCD_ARCH="amd64"
@@ -722,15 +726,8 @@ elif is_arch "ppc64le"; then
     ETCD_ARCH="ppc64le"
     ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_PPC64}
 elif is_arch "s390x"; then
-    # An etcd3 binary for s390x is not available on github like it is
-    # for other arches. Only continue if a custom download URL was
-    # provided.
-    if [[ -n "${ETCD_DOWNLOAD_URL}" ]]; then
-        ETCD_ARCH="s390x"
-        ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_S390X}
-    else
-        exit_distro_not_supported "etcd3. No custom ETCD_DOWNLOAD_URL provided."
-    fi
+    ETCD_ARCH="s390x"
+    ETCD_SHA256=${ETCD_SHA256:-$ETCD_SHA256_S390X}
 else
     exit_distro_not_supported "invalid hardware type - $ETCD_ARCH"
 fi
diff --git a/tests/test_ini_config.sh b/tests/test_ini_config.sh
index 6367cde441..fd3896d6ba 100755
--- a/tests/test_ini_config.sh
+++ b/tests/test_ini_config.sh
@@ -47,6 +47,9 @@ multi = foo2
 [fff]
 ampersand =
 
+[ggg]
+backslash =
+
 [key_with_spaces]
 rgw special key = something
 
@@ -88,7 +91,7 @@ fi
 
 # test iniget_sections
 VAL=$(iniget_sections "${TEST_INI}")
-assert_equal "$VAL" "default aaa bbb ccc ddd eee fff key_with_spaces \
+assert_equal "$VAL" "default aaa bbb ccc ddd eee fff ggg key_with_spaces \
 del_separate_options del_same_option del_missing_option \
 del_missing_option_multi del_no_options"
 
@@ -134,6 +137,16 @@ done
 VAL=$(iniget ${TEST_INI} fff ampersand)
 assert_equal "$VAL" "&y" "iniset ampersands in option"
 
+# Test with backslash in value
+iniset ${TEST_INI} ggg backslash 'foo\bar'
+VAL=$(iniget ${TEST_INI} ggg backslash)
+assert_equal "$VAL" 'foo\bar' "iniset backslash in value"
+
+# Test with both ampersand and backslash
+iniset ${TEST_INI} ggg backslash 'foo\bar&baz'
+VAL=$(iniget ${TEST_INI} ggg backslash)
+assert_equal "$VAL" 'foo\bar&baz' "iniset ampersand and backslash in value"
+
 # test empty option
 if ini_has_option ${SUDO_ARG} ${TEST_INI} ddd empty; then
     passed "ini_has_option: ddd.empty present"
diff --git a/tests/test_libs_from_pypi.sh b/tests/test_libs_from_pypi.sh
index 839e3a1328..9552c93c4f 100755
--- a/tests/test_libs_from_pypi.sh
+++ b/tests/test_libs_from_pypi.sh
@@ -45,7 +45,7 @@ ALL_LIBS+=" oslo.cache oslo.reports osprofiler cursive"
 ALL_LIBS+=" keystoneauth ironic-lib neutron-lib oslo.privsep"
 ALL_LIBS+=" diskimage-builder os-vif python-brick-cinderclient-ext"
 ALL_LIBS+=" castellan python-barbicanclient ovsdbapp os-ken os-resource-classes"
-ALL_LIBS+=" oslo.limit"
+ALL_LIBS+=" oslo.limit etcd3gw"
 
 # Generate the above list with
 # echo ${!GITREPO[@]}
diff --git a/tests/test_meta_config.sh b/tests/test_meta_config.sh
index 087aaf468b..30479f245a 100755
--- a/tests/test_meta_config.sh
+++ b/tests/test_meta_config.sh
@@ -137,6 +137,9 @@ foo=bar
 [some]
 random=config
 
+[[test12|run_tests.sh/test.conf]]
+foo=bar
+
 [[test-multi-sections|test-multi-sections.conf]]
 [sec-1]
 cfg_item1 = abcd
@@ -389,13 +392,12 @@ EXPECT_VAL=0
 check_result "$VAL" "$EXPECT_VAL"
 set -e
 
-echo -n "merge_config_group test10 not directory: "
+echo -n "merge_config_group test10 create directory: "
 set +e
-# function is expected to fail and exit, running it
-# in a subprocess to let this script proceed
-(merge_config_group test.conf test10)
+STACK_USER=$(id -u -n)
+merge_config_group test.conf test10
 VAL=$?
-EXPECT_VAL=255
+EXPECT_VAL=0
 check_result "$VAL" "$EXPECT_VAL"
 set -e
 
@@ -414,9 +416,21 @@ random = config
 non = sense'
 check_result "$VAL" "$EXPECT_VAL"
 
+echo -n "merge_config_group test12 directory as file: "
+set +e
+# function is expected to fail and exit, running it
+# in a subprocess to let this script proceed
+(merge_config_group test.conf test12)
+VAL=$?
+EXPECT_VAL=255
+check_result "$VAL" "$EXPECT_VAL"
+set -e
+
 
 rm -f test.conf test1c.conf test2a.conf \
     test-space.conf test-equals.conf test-strip.conf \
     test-colon.conf test-env.conf test-multiline.conf \
     test-multi-sections.conf test-same.conf
 rm -rf test-etc
+rm -rf does-not-exist-dir
+
diff --git a/tools/build_venv.sh b/tools/build_venv.sh
index cfa39a82e0..a439163b5d 100755
--- a/tools/build_venv.sh
+++ b/tools/build_venv.sh
@@ -38,7 +38,7 @@ if [[ -z "$TOP_DIR" ]]; then
 fi
 
 # Build new venv
-virtualenv $VENV_DEST
+python$PYTHON3_VERSION -m venv --system-site-packages $VENV_DEST
 
 # Install modern pip
 PIP_VIRTUAL_ENV=$VENV_DEST pip_install -U pip
diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh
index faea44f1e0..9e2818f2cc 100755
--- a/tools/fixup_stuff.sh
+++ b/tools/fixup_stuff.sh
@@ -84,24 +84,11 @@ EOF
     # python3-setuptools RPM are deleted, it breaks some tools such as semanage
     # (used in diskimage-builder) that use the -s flag of the python
     # interpreter, enforcing the use of the packages from /usr/lib.
-    # Importing setuptools/pkg_resources in a such environment fails.
+    # Importing setuptools in a such environment fails.
     # Enforce the package re-installation to fix those applications.
     if is_package_installed python3-setuptools; then
         sudo dnf reinstall -y python3-setuptools
     fi
-    # Workaround CentOS 8-stream iputils and systemd Bug
-    # https://bugzilla.redhat.com/show_bug.cgi?id=2037807
-    if [[ $os_VENDOR == "CentOSStream" && $os_RELEASE -eq 8 ]]; then
-        sudo sysctl -w net.ipv4.ping_group_range='0 2147483647'
-    fi
-}
-
-function fixup_ovn_centos {
-    if [[ $os_VENDOR != "CentOS" ]]; then
-        return
-    fi
-    # OVN packages are part of this release for CentOS
-    yum_install centos-release-openstack-victoria
 }
 
 function fixup_ubuntu {
diff --git a/tools/generate-devstack-plugins-list.sh b/tools/generate-devstack-plugins-list.sh
index 3307943df9..45a926392e 100755
--- a/tools/generate-devstack-plugins-list.sh
+++ b/tools/generate-devstack-plugins-list.sh
@@ -38,6 +38,17 @@
 # current working directory, it will be prepended or appended to
 # the generated reStructuredText plugins table respectively.
 
+# Setup virtual environment
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+VENV_DIR="${SCRIPT_DIR}/.venv"
+
+if [[ ! -d "${VENV_DIR}" ]]; then
+    python3 -m venv "${VENV_DIR}"
+fi
+
+source "${VENV_DIR}/bin/activate"
+pip install -q -r "${SCRIPT_DIR}/requirements.txt"
+
 # Print the title underline for a RST table.  Argument is the length
 # of the first column, second column is assumed to be "URL"
 function title_underline {
@@ -54,7 +65,7 @@ if [[ -r data/devstack-plugins-registry.header ]]; then
     cat data/devstack-plugins-registry.header
 fi
 
-sorted_plugins=$(python3 tools/generate-devstack-plugins-list.py)
+sorted_plugins=$("${VENV_DIR}/bin/python3" tools/generate-devstack-plugins-list.py)
 
 # find the length of the name column & pad
 name_col_len=$(echo "${sorted_plugins}" | wc -L)
diff --git a/tools/install_pip.sh b/tools/install_pip.sh
index 91b180c06f..027693fc0a 100755
--- a/tools/install_pip.sh
+++ b/tools/install_pip.sh
@@ -38,7 +38,6 @@ FILES=$TOP_DIR/files
 # [1] https://opendev.org/openstack/project-config/src/branch/master/nodepool/elements/cache-devstack/source-repository-pip
 
 PIP_GET_PIP_URL=${PIP_GET_PIP_URL:-"https://bootstrap.pypa.io/get-pip.py"}
-PIP_GET_PIP36_URL=${PIP_GET_PIP36_URL:-"https://bootstrap.pypa.io/pip/3.6/get-pip.py"}
 
 GetDistro
 echo "Distro: $DISTRO"
@@ -57,14 +56,8 @@ function get_versions {
 
 
 function install_get_pip {
-    if [[ "$PYTHON3_VERSION" = "3.6" ]]; then
-        _pip_url=$PIP_GET_PIP36_URL
-        _local_pip="$FILES/$(basename $_pip_url)-py36"
-    else
-        _pip_url=$PIP_GET_PIP_URL
-        _local_pip="$FILES/$(basename $_pip_url)"
-    fi
-
+    _pip_url=$PIP_GET_PIP_URL
+    _local_pip="$FILES/$(basename $_pip_url)"
 
     # If get-pip.py isn't python, delete it. This was probably an
     # outage on the server.
@@ -127,7 +120,7 @@ if [[ -n $PYPI_ALTERNATIVE_URL ]]; then
     configure_pypi_alternative_url
 fi
 
-if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel9 ]]; then
+if is_fedora && [[ ${DISTRO} == f* || ${DISTRO} == rhel* ]]; then
     # get-pip.py will not install over the python3-pip package in
     # Fedora 34 any more.
     #  https://bugzilla.redhat.com/show_bug.cgi?id=1988935
diff --git a/tools/mlock_report.py b/tools/mlock_report.py
index 1b081bbe6f..8cbda15895 100644
--- a/tools/mlock_report.py
+++ b/tools/mlock_report.py
@@ -6,7 +6,7 @@
 
 
 LCK_SUMMARY_REGEX = re.compile(
-    "^VmLck:\s+(?P<locked>[\d]+)\s+kB", re.MULTILINE)
+    r"^VmLck:\s+(?P<locked>[\d]+)\s+kB", re.MULTILINE)
 
 
 def main():
diff --git a/tools/outfilter.py b/tools/outfilter.py
index 55f9ee1487..3955d39794 100644
--- a/tools/outfilter.py
+++ b/tools/outfilter.py
@@ -26,8 +26,8 @@
 import re
 import sys
 
-IGNORE_LINES = re.compile('(set \+o|xtrace)')
-HAS_DATE = re.compile('^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3} \|')
+IGNORE_LINES = re.compile(r'(set \+o|xtrace)')
+HAS_DATE = re.compile(r'^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3} \|')
 
 
 def get_options():
@@ -90,13 +90,10 @@ def main():
 
         if outfile:
             # We've opened outfile as a binary file to get the
-            # non-buffered behaviour.  on python3, sys.stdin was
+            # non-buffered behaviour. on python3, sys.stdin was
             # opened with the system encoding and made the line into
             # utf-8, so write the logfile out in utf-8 bytes.
-            if sys.version_info < (3,):
-                outfile.write(ts_line)
-            else:
-                outfile.write(ts_line.encode('utf-8'))
+            outfile.write(ts_line.encode('utf-8'))
             outfile.flush()
 
 
diff --git a/tools/ping_neutron.sh b/tools/ping_neutron.sh
index ab8e8dfca8..2b65fd0fb3 100755
--- a/tools/ping_neutron.sh
+++ b/tools/ping_neutron.sh
@@ -21,7 +21,7 @@ set -o pipefail
 
 TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
 
-# This *must* be run as the admin tenant
+# This *must* be run as the admin project
 source $TOP_DIR/openrc admin admin
 
 function usage {
@@ -29,7 +29,7 @@ function usage {
 ping_neutron.sh <net_name> [ping args]
 
 This provides a wrapper to ping neutron guests that are on isolated
-tenant networks that the caller can't normally reach. It does so by
+project networks that the caller can't normally reach. It does so by
 using either the DHCP or Metadata network namespace to support both
 ML2/OVS and OVN.
 
diff --git a/tools/requirements.txt b/tools/requirements.txt
new file mode 100644
index 0000000000..f2293605cf
--- /dev/null
+++ b/tools/requirements.txt
@@ -0,0 +1 @@
+requests
diff --git a/tools/update_clouds_yaml.py b/tools/update_clouds_yaml.py
index 74dcdb2a07..87312d9469 100755
--- a/tools/update_clouds_yaml.py
+++ b/tools/update_clouds_yaml.py
@@ -14,14 +14,14 @@
 
 # Update the clouds.yaml file.
 
-
 import argparse
 import os.path
+import sys
 
 import yaml
 
 
-class UpdateCloudsYaml(object):
+class UpdateCloudsYaml:
     def __init__(self, args):
         if args.file:
             self._clouds_path = args.file
@@ -35,25 +35,26 @@ def __init__(self, args):
         self._cloud = args.os_cloud
         self._cloud_data = {
             'region_name': args.os_region_name,
-            'identity_api_version': args.os_identity_api_version,
-            'volume_api_version': args.os_volume_api_version,
             'auth': {
                 'auth_url': args.os_auth_url,
                 'username': args.os_username,
+                'user_domain_id': 'default',
                 'password': args.os_password,
             },
         }
+
         if args.os_project_name and args.os_system_scope:
             print(
-                "WARNING: os_project_name and os_system_scope were both"
-                " given. os_system_scope will take priority.")
-        if args.os_project_name and not args.os_system_scope:
+                "WARNING: os_project_name and os_system_scope were both "
+                "given. os_system_scope will take priority."
+            )
+
+        if args.os_system_scope:  # system-scoped
+            self._cloud_data['auth']['system_scope'] = args.os_system_scope
+        elif args.os_project_name:  # project-scoped
             self._cloud_data['auth']['project_name'] = args.os_project_name
-        if args.os_identity_api_version == '3' and not args.os_system_scope:
-            self._cloud_data['auth']['user_domain_id'] = 'default'
             self._cloud_data['auth']['project_domain_id'] = 'default'
-        if args.os_system_scope:
-            self._cloud_data['auth']['system_scope'] = args.os_system_scope
+
         if args.os_cacert:
             self._cloud_data['cacert'] = args.os_cacert
 
@@ -89,8 +90,6 @@ def main():
     parser.add_argument('--file')
     parser.add_argument('--os-cloud', required=True)
     parser.add_argument('--os-region-name', default='RegionOne')
-    parser.add_argument('--os-identity-api-version', default='3')
-    parser.add_argument('--os-volume-api-version', default='3')
     parser.add_argument('--os-cacert')
     parser.add_argument('--os-auth-url', required=True)
     parser.add_argument('--os-username', required=True)
diff --git a/tools/verify-ipv6-address.py b/tools/verify-ipv6-address.py
new file mode 100644
index 0000000000..dc18fa6d8a
--- /dev/null
+++ b/tools/verify-ipv6-address.py
@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+
+import argparse
+import ipaddress
+import sys
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Check if a given string is a valid IPv6 address.",
+        formatter_class=argparse.RawTextHelpFormatter,
+    )
+    parser.add_argument(
+        "address",
+        help=(
+            "The IPv6 address string to validate.\n"
+            "Examples:\n"
+            "  2001:0db8:85a3:0000:0000:8a2e:0370:7334\n"
+            "  2001:db8::1\n"
+            "  ::1\n"
+            "  fe80::1%eth0 (scope IDs are handled)"
+        ),
+    )
+    args = parser.parse_args()
+
+    try:
+        # try to create a IPv6Address: if we fail to parse or get an
+        # IPv4Address then die
+        ip_obj = ipaddress.ip_address(args.address.strip('[]'))
+        if isinstance(ip_obj, ipaddress.IPv6Address):
+            sys.exit(0)
+        else:
+            sys.exit(1)
+    except ValueError:
+        sys.exit(1)
+    except Exception as e:
+        print(f"An unexpected error occurred during validation: {e}", file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/verify-ipv6-only-deployments.sh b/tools/verify-ipv6-only-deployments.sh
index 0f0cba8afe..a1acecbb3f 100755
--- a/tools/verify-ipv6-only-deployments.sh
+++ b/tools/verify-ipv6-only-deployments.sh
@@ -33,28 +33,23 @@ function verify_devstack_ipv6_setting {
         echo $TUNNEL_IP_VERSION "TUNNEL_IP_VERSION is not set to 6 so TUNNEL_ENDPOINT_IP cannot be an IPv6 address."
         exit 1
     fi
-    is_service_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_host'"))')
-    if [[ "$is_service_host_ipv6" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_service_host"; then
         echo $SERVICE_HOST "SERVICE_HOST is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
-    is_host_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_host_ipv6'"))')
-    if [[ "$is_host_ipv6" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_host_ipv6"; then
         echo $HOST_IPV6 "HOST_IPV6 is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
-    is_service_listen_address=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_listen_address'"))')
-    if [[ "$is_service_listen_address" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_service_listen_address"; then
         echo $SERVICE_LISTEN_ADDRESS "SERVICE_LISTEN_ADDRESS is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
-    is_service_local_host=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_service_local_host'"))')
-    if [[ "$is_service_local_host" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_service_local_host"; then
         echo $SERVICE_LOCAL_HOST "SERVICE_LOCAL_HOST is not IPv6 which means devstack cannot deploy services on IPv6 addresses."
         exit 1
     fi
-    is_tunnel_endpoint_ip=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$_tunnel_endpoint_ip'"))')
-    if [[ "$is_tunnel_endpoint_ip" != "True" ]]; then
+    if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$_tunnel_endpoint_ip"; then
         echo $TUNNEL_ENDPOINT_IP "TUNNEL_ENDPOINT_IP is not IPv6 which means devstack will not deploy with an IPv6 endpoint address."
         exit 1
     fi
@@ -63,8 +58,7 @@ function verify_devstack_ipv6_setting {
 }
 
 function sanity_check_system_ipv6_enabled {
-    system_ipv6_enabled=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_ipv6_enabled())')
-    if [[ $system_ipv6_enabled != "True" ]]; then
+    if [ ! -f "/proc/sys/net/ipv6/conf/default/disable_ipv6" ] || [ "$(cat /proc/sys/net/ipv6/conf/default/disable_ipv6)" -ne "0" ]; then
         echo "IPv6 is disabled in system"
         exit 1
     fi
@@ -78,10 +72,8 @@ function verify_service_listen_address_is_ipv6 {
     for endpoint in ${endpoints}; do
         local endpoint_address=''
         endpoint_address=$(echo "$endpoint" | awk -F/ '{print $3}' | awk -F] '{print $1}')
-        endpoint_address=$(echo $endpoint_address | tr -d [])
-        local is_endpoint_ipv6=''
-        is_endpoint_ipv6=$(python3 -c 'import oslo_utils.netutils as nutils; print(nutils.is_valid_ipv6("'$endpoint_address'"))')
-        if [[ "$is_endpoint_ipv6" != "True" ]]; then
+        endpoint_address=$(echo $endpoint_address | tr -d '[]')
+        if ! python3 ${TOP_DIR}/tools/verify-ipv6-address.py "$endpoint_address"; then
             all_ipv6=False
             echo $endpoint ": This is not an IPv6 endpoint which means corresponding service is not listening on an IPv6 address."
             continue
diff --git a/tools/worlddump.py b/tools/worlddump.py
index edbfa268db..26ced3f653 100755
--- a/tools/worlddump.py
+++ b/tools/worlddump.py
@@ -31,7 +31,6 @@
     'nova-compute',
     'neutron-dhcp-agent',
     'neutron-l3-agent',
-    'neutron-linuxbridge-agent',
     'neutron-metadata-agent',
     'neutron-openvswitch-agent',
     'cinder-volume',
diff --git a/unstack.sh b/unstack.sh
index 1b2d8dd62a..1919ef8ad7 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -61,7 +61,6 @@ source $TOP_DIR/lib/tls
 
 # Source project function libraries
 source $TOP_DIR/lib/infra
-source $TOP_DIR/lib/oslo
 source $TOP_DIR/lib/lvm
 source $TOP_DIR/lib/horizon
 source $TOP_DIR/lib/keystone
@@ -73,6 +72,8 @@ source $TOP_DIR/lib/swift
 source $TOP_DIR/lib/neutron
 source $TOP_DIR/lib/ldap
 source $TOP_DIR/lib/dstat
+source $TOP_DIR/lib/atop
+source $TOP_DIR/lib/tcpdump
 source $TOP_DIR/lib/etcd3
 
 # Extras Source
@@ -87,6 +88,12 @@ fi
 
 load_plugin_settings
 
+# Enable neutron server services so they can be properly stopped
+# This replicates the service enabling logic from stack.sh
+if is_service_enabled neutron; then
+    enable_neutron_server_services
+fi
+
 set -o xtrace
 
 # Run extras
@@ -156,6 +163,11 @@ if [[ -n "$UNSTACK_ALL" ]]; then
     if is_service_enabled rabbit; then
         stop_service rabbitmq-server
     fi
+
+    # Stop LDAP server
+    if is_service_enabled ldap; then
+        stop_ldap
+    fi
 fi
 
 if is_service_enabled neutron; then
@@ -172,8 +184,16 @@ if is_service_enabled openstack-cli-server; then
     stop_service devstack@openstack-cli-server
 fi
 
+if is_service_enabled tcpdump; then
+    stop_tcpdump
+fi
+
 stop_dstat
 
+if is_service_enabled atop; then
+    stop_atop
+fi
+
 # NOTE: Cinder automatically installs the lvm2 package, independently of the
 # enabled backends. So if Cinder is enabled, and installed successfully we are
 # sure lvm2 (lvremove, /etc/lvm/lvm.conf, etc.) is here.