Merge ~ajkavanagh/ubuntu/+source/heat:master into ~ubuntu-openstack-dev/ubuntu/+source/heat:master

[James Page]

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 0ae225c..ee085de 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -22,7 +22,7 @@ repos:
       - id: flake8
         name: flake8
         additional_dependencies:
-          - hacking>=3.1.0,<3.2.0
+          - hacking>=6.1.0,<6.2.0
         language: python
         entry: flake8
         files: '^.*\.py$'
diff --git a/.zuul.yaml b/.zuul.yaml
index 5cc2149..6072137 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -188,6 +188,12 @@
       - ^releasenotes/.*$
 
 - job:
+    name: grenade-heat-multinode-skip-level
+    parent: grenade-heat-multinode
+    vars:
+      grenade_from_branch: stable/2023.1
+
+- job:
     name: heat-tox-py310-with-sqlalchemy-2x
     parent: openstack-tox-py310
     description: |
@@ -215,6 +221,7 @@
     check:
       jobs:
         - grenade-heat-multinode
+        - grenade-heat-multinode-skip-level
         - heat-functional
         - heat-functional-legacy
         - heat-functional-centos-9-stream
@@ -222,5 +229,6 @@
     gate:
       jobs:
         - grenade-heat-multinode
+        - grenade-heat-multinode-skip-level
         - heat-functional
         - heat-functional-legacy
diff --git a/AUTHORS b/AUTHORS
index b95d2a9..4807711 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -116,6 +116,7 @@ Dave Wilde <[e-mail]>
 David Hill <[e-mail]>
 David J Peacock <[e-mail]>
 David Rabel <[e-mail]>
+David Vallee Delisle <[e-mail]>
 Deepak Tiwari <[e-mail]>
 Deliang Fan <[e-mail]>
 Denes Nemeth <[e-mail]>
@@ -196,6 +197,7 @@ Jaime Guerrero <[e-mail]>
 Jake Yip <[e-mail]>
 James Combs <[e-mail]>
 James E. Blair <[e-mail]>
+James Page <[e-mail]>
 James Reeves <[e-mail]>
 James Slagle <[e-mail]>
 Jamie Lennox <[e-mail]>
@@ -563,6 +565,7 @@ liusheng <[e-mail]>
 liyi <[e-mail]>
 liyi <[e-mail]>
 lizheming <[e-mail]>
+lujiefsi <[e-mail]>
 lvdongbing <[e-mail]>
 maniksidana019 <[e-mail]>
 matthew-fuller <[e-mail]>
diff --git a/ChangeLog b/ChangeLog
index c4eb64a..3b1c682 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,31 @@
 CHANGES
 =======
 
+22.0.0.0rc1
+-----------
+
+* Update regex to detect closed branch
+* Restore tests disabled because of libvirt bug
+* Fix access by admin users to resources in different projects
+* reno: Update master for unmaintained/xena
+* reno: Update master for unmaintained/wallaby
+* reno: Update master for unmaintained/victoria
+* Stop using deprecated implicit\_prefix option
+* reno: Update master for unmaintained/yoga
+* Add skip level upgrade job
+* Fix minor typos in documentation
+* common: Replace deprecated importlib API (2/2)
+* Remove logic for cloud-init < 0.6.0
+* Drop unused default password in create\_stack\_user
+* Bump hacking (again)
+* Use zoneinfo instead of pytz if available
+* Allow more options to limit number of resources
+* Fix inconsistent naming in db api
+* Stop unnecessary usage of 'self'
+* tests: Fix unit tests using has\_calls
+* Deprecate resources for inactive services
+* Bump hacking
+* Adding oslo.config entry points for yaql and cache opts
 * Add recent release names
 * Drop remaining references to the removed bin scripts
 * Remove deprecated wrappertask decorator
diff --git a/HACKING.rst b/HACKING.rst
index 618cfa3..d16d300 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -50,8 +50,8 @@ done in the OpenStack CI systems.
 Heat Specific Commandments
 --------------------------
 
-- [Heat301] Use LOG.warning() rather than LOG.warn().
-- [Heat302] Python 3: do not use dict.iteritems.
-- [Heat303] Python 3: do not use dict.iterkeys.
-- [Heat304] Python 3: do not use dict.itervalues.
+- [HE301] Use LOG.warning() rather than LOG.warn().
+- [HE302] Python 3: do not use dict.iteritems.
+- [HE303] Python 3: do not use dict.iterkeys.
+- [HE304] Python 3: do not use dict.itervalues.
 
diff --git a/PKG-INFO b/PKG-INFO
index d68f1ed..9541147 100644
--- a/PKG-INFO
+++ b/PKG-INFO
@@ -1,10 +1,93 @@
-Metadata-Version: 2.1
+Metadata-Version: 1.2
 Name: openstack-heat
-Version: 21.1.0.dev70
+Version: 22.0.0.0rc1
 Summary: OpenStack Orchestration
 Home-page: https://docs.openstack.org/heat/latest/
 Author: OpenStack
 Author-email: [e-mail]
+License: UNKNOWN
+Description: ========================
+        Team and repository tags
+        ========================
+        
+        .. image:: https://governance.openstack.org/tc/badges/heat.svg
+            :target: https://governance.openstack.org/tc/reference/tags/index.html
+        
+        .. Change things from this point on
+        
+        ====
+        Heat
+        ====
+        
+        Heat is a service to orchestrate multiple composite cloud applications using
+        templates, through both an OpenStack-native REST API and a
+        CloudFormation-compatible Query API.
+        
+        Why heat? It makes the clouds rise and keeps them there.
+        
+        Getting Started
+        ---------------
+        
+        If you'd like to run from the master branch, you can clone the git repo:
+        
+            git clone https://opendev.org/openstack/heat
+        
+        
+        * Documentation: https://docs.openstack.org/heat/latest
+        * Template samples: https://opendev.org/openstack/heat-templates
+        * Agents: https://opendev.org/openstack/heat-agents
+        * Release Notes: https://docs.openstack.org/releasenotes/heat/
+        
+        Python client
+        -------------
+        
+        * Documentation: https://docs.openstack.org/python-heatclient/latest
+        * Source: https://opendev.org/openstack/python-heatclient
+        
+        Report a Story (a bug/blueprint)
+        --------------------------------
+        
+        If you'd like to report a Story (we used to call a bug/blueprint), you can
+        report it under Report a story in
+        `Heat's StoryBoard <https://storyboard.openstack.org/#!/project/989>`_.
+        If you must report the story under other sub-project of heat, you can find
+        them all in `Heat StoryBoard Group <https://storyboard.openstack.org/#!/project_group/82>`_.
+        if you encounter any issue.
+        
+        References
+        ----------
+        * https://docs.amazonwebservices.com/AWSCloudFormation/latest/APIReference/API_CreateStack.html
+        * https://docs.amazonwebservices.com/AWSCloudFormation/latest/UserGuide/create-stack.html
+        * https://docs.amazonwebservices.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html
+        * https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=tosca
+        
+        We have integration with
+        ------------------------
+        * https://opendev.org/openstack/python-novaclient (instance)
+        * https://opendev.org/openstack/python-keystoneclient (auth)
+        * https://opendev.org/openstack/python-swiftclient (object storage)
+        * https://opendev.org/openstack/python-neutronclient (networking)
+        * https://opendev.org/openstack/python-aodhclient (alarming service)
+        * https://opendev.org/openstack/python-cinderclient (block storage)
+        * https://opendev.org/openstack/python-glanceclient (image service)
+        * https://opendev.org/openstack/python-troveclient (database as a Service)
+        * https://opendev.org/openstack/python-saharaclient (hadoop cluster)
+        * https://opendev.org/openstack/python-barbicanclient (key management service)
+        * https://opendev.org/openstack/python-designateclient (DNS service)
+        * https://opendev.org/openstack/python-magnumclient (container service)
+        * https://opendev.org/openstack/python-manilaclient (shared file system service)
+        * https://opendev.org/openstack/python-mistralclient (workflow service)
+        * https://opendev.org/openstack/python-zaqarclient (messaging service)
+        * https://opendev.org/openstack/python-monascaclient (monitoring service)
+        * https://opendev.org/openstack/python-zunclient (container management service)
+        * https://opendev.org/openstack/python-blazarclient (reservation service)
+        * https://opendev.org/openstack/python-octaviaclient.git (Load-balancer service)
+        * https://opendev.org/openstack/python-senlinclient (Clustering service)
+        * https://opendev.org/openstack/python-vitrageclient.git (RCA service)
+        * https://opendev.org/openstack/python-ironicclient (baremetal provisioning service)
+        
+        
+Platform: UNKNOWN
 Classifier: Environment :: OpenStack
 Classifier: Intended Audience :: Information Technology
 Classifier: Intended Audience :: System Administrators
@@ -18,85 +101,3 @@ Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Requires-Python: >=3.8
-License-File: LICENSE
-
-========================
-Team and repository tags
-========================
-
-.. image:: https://governance.openstack.org/tc/badges/heat.svg
-    :target: https://governance.openstack.org/tc/reference/tags/index.html
-
-.. Change things from this point on
-
-====
-Heat
-====
-
-Heat is a service to orchestrate multiple composite cloud applications using
-templates, through both an OpenStack-native REST API and a
-CloudFormation-compatible Query API.
-
-Why heat? It makes the clouds rise and keeps them there.
-
-Getting Started
----------------
-
-If you'd like to run from the master branch, you can clone the git repo:
-
-    git clone https://opendev.org/openstack/heat
-
-
-* Documentation: https://docs.openstack.org/heat/latest
-* Template samples: https://opendev.org/openstack/heat-templates
-* Agents: https://opendev.org/openstack/heat-agents
-* Release Notes: https://docs.openstack.org/releasenotes/heat/
-
-Python client
--------------
-
-* Documentation: https://docs.openstack.org/python-heatclient/latest
-* Source: https://opendev.org/openstack/python-heatclient
-
-Report a Story (a bug/blueprint)
---------------------------------
-
-If you'd like to report a Story (we used to call a bug/blueprint), you can
-report it under Report a story in
-`Heat's StoryBoard <https://storyboard.openstack.org/#!/project/989>`_.
-If you must report the story under other sub-project of heat, you can find
-them all in `Heat StoryBoard Group <https://storyboard.openstack.org/#!/project_group/82>`_.
-if you encounter any issue.
-
-References
-----------
-* https://docs.amazonwebservices.com/AWSCloudFormation/latest/APIReference/API_CreateStack.html
-* https://docs.amazonwebservices.com/AWSCloudFormation/latest/UserGuide/create-stack.html
-* https://docs.amazonwebservices.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html
-* https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=tosca
-
-We have integration with
-------------------------
-* https://opendev.org/openstack/python-novaclient (instance)
-* https://opendev.org/openstack/python-keystoneclient (auth)
-* https://opendev.org/openstack/python-swiftclient (object storage)
-* https://opendev.org/openstack/python-neutronclient (networking)
-* https://opendev.org/openstack/python-aodhclient (alarming service)
-* https://opendev.org/openstack/python-cinderclient (block storage)
-* https://opendev.org/openstack/python-glanceclient (image service)
-* https://opendev.org/openstack/python-troveclient (database as a Service)
-* https://opendev.org/openstack/python-saharaclient (hadoop cluster)
-* https://opendev.org/openstack/python-barbicanclient (key management service)
-* https://opendev.org/openstack/python-designateclient (DNS service)
-* https://opendev.org/openstack/python-magnumclient (container service)
-* https://opendev.org/openstack/python-manilaclient (shared file system service)
-* https://opendev.org/openstack/python-mistralclient (workflow service)
-* https://opendev.org/openstack/python-zaqarclient (messaging service)
-* https://opendev.org/openstack/python-monascaclient (monitoring service)
-* https://opendev.org/openstack/python-zunclient (container management service)
-* https://opendev.org/openstack/python-blazarclient (reservation service)
-* https://opendev.org/openstack/python-octaviaclient.git (Load-balancer service)
-* https://opendev.org/openstack/python-senlinclient (Clustering service)
-* https://opendev.org/openstack/python-vitrageclient.git (RCA service)
-* https://opendev.org/openstack/python-ironicclient (baremetal provisioning service)
-
diff --git a/config-generator.conf b/config-generator.conf
index deb30da..115880d 100644
--- a/config-generator.conf
+++ b/config-generator.conf
@@ -1,16 +1,19 @@
 [DEFAULT]
 output_file = etc/heat/heat.conf.sample
 wrap_width = 79
+namespace = heat.common.cache
 namespace = heat.common.config
 namespace = heat.common.context
 namespace = heat.common.crypt
 namespace = heat.engine.clients.os.keystone.heat_keystoneclient
+namespace = heat.engine.hot.functions
 namespace = heat.common.wsgi
 namespace = heat.engine.clients
 namespace = heat.engine.notification
 namespace = heat.engine.resources
 namespace = heat.api.aws.ec2token
 namespace = keystonemiddleware.auth_token
+namespace = oslo.cache
 namespace = oslo.messaging
 namespace = oslo.middleware
 namespace = oslo.cache
diff --git a/debian/changelog b/debian/changelog
index 53d777f..c31a8e4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,8 +1,14 @@
-heat (1:21.0.0+git2024011916.2df46d4c-0ubuntu2) UNRELEASED; urgency=medium
+heat (1:22.0.0~rc1-0ubuntu1) UNRELEASED; urgency=medium
 
+  [ James Page ]
   * d/watch: Track Caracal series releases.
 
- -- James Page <[e-mail]>  Tue, 19 Mar 2024 15:37:42 +0000
+  [ Alex Kavanagh (Canonical Work Key) ]
+  * New upstream release canadidate (rc1) for OpenStack Caracal
+  * d/p/*: Refresh.
+  * d/p/python3.13-compat dropped as patch added upstream.
+
+ -- Alex Kavanagh (Canonical Work Key) <[e-mail]>  Mon, 25 Mar 2024 11:56:44 +0000
 
 heat (1:21.0.0+git2024011916.2df46d4c-0ubuntu1) noble; urgency=medium
 
diff --git a/debian/patches/drop-zun.patch b/debian/patches/drop-zun.patch
index 2e4d9f9..988ba4d 100644
--- a/debian/patches/drop-zun.patch
+++ b/debian/patches/drop-zun.patch
@@ -8,12 +8,12 @@ Forwarded: no
 
 --- a/requirements.txt
 +++ b/requirements.txt
-@@ -50,7 +50,6 @@
+@@ -50,7 +50,6 @@ python-swiftclient>=3.2.0 # Apache-2.0
  python-troveclient>=2.2.0 # Apache-2.0
  python-vitrageclient>=2.7.0 # Apache-2.0
  python-zaqarclient>=1.3.0 # Apache-2.0
 -python-zunclient>=3.4.0 # Apache-2.0
- pytz>=2013.6 # MIT
+ pytz>=2013.6;python_version<"3.9" # MIT
  PyYAML>=5.1 # MIT
  requests>=2.23.0 # Apache-2.0
 --- a/heat/tests/openstack/zun/test_container.py
@@ -1250,7 +1250,7 @@ Forwarded: no
 -    }
 --- a/setup.cfg
 +++ b/setup.cfg
-@@ -87,7 +87,6 @@
+@@ -89,7 +89,6 @@ heat.clients =
  	trove = heat.engine.clients.os.trove:TroveClientPlugin
  	vitrage = heat.engine.clients.os.vitrage:VitrageClientPlugin
  	zaqar = heat.engine.clients.os.zaqar:ZaqarClientPlugin
diff --git a/debian/patches/python3.12-compat.patch b/debian/patches/python3.12-compat.patch
deleted file mode 100644
index 2b056da..0000000
--- a/debian/patches/python3.12-compat.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-Description: Use assert_has_calls in unit tests
- Test when executed under Python 3.12 FAIL due to:
- AttributeError: 'has_calls' is not a valid assertion
- Use correct assert_has_calls instead
- 
- This also revealed a problem with the expected parameters
- on one of the calls in the test_software_config module.
-Author: James Page <[e-mail]>
-Forwarded: no
-
---- a/heat/tests/engine/service/test_software_config.py
-+++ b/heat/tests/engine/service/test_software_config.py
-@@ -753,12 +753,12 @@
-         }
-         self.engine.software_config._push_metadata_software_deployments(
-             self.ctx, '1234', None)
--        res_upd.has_calls(
-+        res_upd.assert_has_calls([
-             mock.call(self.ctx, '1234',
-                       {'rsrc_metadata': result_metadata}, 1),
-             mock.call(self.ctx, '1234',
--                      {'rsrc_metadata': result_metadata}, 2),
--        )
-+                      {}, 2),
-+        ])
- 
-         put.assert_called_once_with(
-             'http://192.168.2.2/foo/bar', json.dumps(result_metadata))
---- a/heat/tests/test_resource.py
-+++ b/heat/tests/test_resource.py
-@@ -4092,8 +4092,8 @@
-             service_type='test_type',
-             service_name=(generic_rsrc.ResourceWithDefaultClientName
-                           .default_client_name))
--        mock_client_plugin.has_extension.has_calls(
--            [('foo'), ('bar')])
-+        mock_client_plugin.has_extension.assert_has_calls(
-+            [mock.call('foo'), mock.call('bar')])
- 
-     @mock.patch.object(clients.OpenStackClients, 'client_plugin')
-     def test_service_deployed_required_extension_true_list(
-@@ -4118,8 +4118,8 @@
-             service_type='test_type',
-             service_name=(generic_rsrc.ResourceWithDefaultClientName
-                           .default_client_name))
--        mock_client_plugin.has_extension.has_calls(
--            [('foo'), ('bar')])
-+        mock_client_plugin.has_extension.assert_has_calls(
-+            [mock.call('foo'), mock.call('bar')])
- 
-     @mock.patch.object(clients.OpenStackClients, 'client_plugin')
-     def test_service_deployed_required_extension_true_list_fail(
-@@ -4144,8 +4144,8 @@
-             service_type='test_type',
-             service_name=(generic_rsrc.ResourceWithDefaultClientName
-                           .default_client_name))
--        mock_client_plugin.has_extension.has_calls(
--            [('foo'), ('bar')])
-+        mock_client_plugin.has_extension.assert_has_calls(
-+            [mock.call('foo'), mock.call('bar')])
- 
- 
- class TestLiveStateUpdate(common.HeatTestCase):
diff --git a/debian/patches/series b/debian/patches/series
index 33e20eb..e394474 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,4 +1,3 @@
 drop-zun.patch
 sudoers_patch.patch
 install-missing-files.patch
-python3.12-compat.patch
diff --git a/debian/patches/sudoers_patch.patch b/debian/patches/sudoers_patch.patch
index 02b91b4..4fc05da 100644
--- a/debian/patches/sudoers_patch.patch
+++ b/debian/patches/sudoers_patch.patch
@@ -3,7 +3,7 @@ Author: Chuck Short <[e-mail]>
 Forwarded: Not needed.
 --- a/heat/engine/clients/os/nova.py
 +++ b/heat/engine/clients/os/nova.py
-@@ -360,8 +360,8 @@
+@@ -360,8 +360,8 @@ class NovaClientPlugin(microversion_mixi
              #
              # See bug https://bugs.launchpad.net/heat/+bug/1257410
              boothook_custom_user = r"""useradd -m %s
diff --git a/devstack/lib/heat b/devstack/lib/heat
index 6d02e7d..198b3d3 100644
--- a/devstack/lib/heat
+++ b/devstack/lib/heat
@@ -449,20 +449,9 @@ function configure_tempest_for_heat {
     SKIP_SCENARIO_TEST_LIST+=',AodhAlarmTest'
     # Skip CfnInitIntegrationTest as latest fedora images don't have heat-cfntools
     SKIP_SCENARIO_TEST_LIST+=',CfnInitIntegrationTest'
-    if is_ubuntu; then
-        # Skip a few tests failing because of a known libvirt issue in Jammy
-        # https://bugs.launchpad.net/nova/+bug/1998274
-        SKIP_SCENARIO_TEST_LIST+=',BasicResourcesTest'
-    fi
     iniset $TEMPEST_CONFIG heat_plugin skip_scenario_test_list $SKIP_SCENARIO_TEST_LIST
 
     SKIP_FUNCTIONAL_TEST_LIST='NotificationTest'
-    if is_ubuntu; then
-        # Skip a few tests failing because of a known libvirt issue in Jammy
-        # https://bugs.launchpad.net/nova/+bug/1998274
-        SKIP_FUNCTIONAL_TEST_LIST+=',UpdateStackTest.test_stack_update_with_replacing_userdata'
-        SKIP_FUNCTIONAL_TEST_LIST+=',CancelUpdateTest.test_cancel_update_server_with_port'
-    fi
     iniset $TEMPEST_CONFIG heat_plugin skip_functional_test_list $SKIP_FUNCTIONAL_TEST_LIST
 
     openstack flavor show m1.heat_int || openstack flavor create m1.heat_int --ram 1024 --vcpus 2 --disk 10
diff --git a/doc/source/conf.py b/doc/source/conf.py
index 5c41d69..6d4c2d6 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -33,8 +33,9 @@ from oslo_config import cfg
 
 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
 ROOT = os.path.abspath(os.path.join(BASE_DIR, "..", ".."))
-CONTRIB_DIR = os.path.join(ROOT, 'contrib')
-PLUGIN_DIRS = glob.glob(os.path.join(CONTRIB_DIR, '*'))
+# TODO(tkajinam): Fix this
+# CONTRIB_DIR = os.path.join(ROOT, 'contrib')
+# PLUGIN_DIRS = glob.glob(os.path.join(CONTRIB_DIR, '*'))
 ENV_DIR = os.path.join(ROOT, "etc", "heat", "environment.d")
 TEMP_ENV_DIR = tempfile.mkdtemp()
 
@@ -48,7 +49,7 @@ sys.path.insert(0, ROOT)
 sys.path.insert(0, BASE_DIR)
 
 cfg.CONF.import_opt('plugin_dirs', 'heat.common.config')
-cfg.CONF.set_override(name='plugin_dirs', override=PLUGIN_DIRS)
+# cfg.CONF.set_override(name='plugin_dirs', override=PLUGIN_DIRS)
 
 cfg.CONF.import_opt('environment_dir', 'heat.common.config')
 cfg.CONF.set_override(name='environment_dir', override=TEMP_ENV_DIR)
diff --git a/doc/source/operating_guides/upgrades_guide.rst b/doc/source/operating_guides/upgrades_guide.rst
index e1dfa08..6144184 100644
--- a/doc/source/operating_guides/upgrades_guide.rst
+++ b/doc/source/operating_guides/upgrades_guide.rst
@@ -40,7 +40,7 @@ Cold Upgrades
 Heat already supports "`cold-upgrades`_", where the heat services have to be
 down during the upgrade. For time-consuming upgrades, it may be unacceptable
 for the services to be unavailable for a long period of time. This type of
-upgrade is quite simple, follow the bellow steps:
+upgrade is quite simple, follow the below steps:
 
 1. Stop all heat-api and heat-engine services.
 
diff --git a/doc/source/template_guide/multi-clouds.rst b/doc/source/template_guide/multi-clouds.rst
index e6266db..0038725 100644
--- a/doc/source/template_guide/multi-clouds.rst
+++ b/doc/source/template_guide/multi-clouds.rst
@@ -124,7 +124,7 @@ To create a remote stack, you can simply use an :ref:`OS::Heat::Stack` resource
 in your template.
 
 In resource properties, provide `credential_secret_id` (Barbican secret ID
-from the secret we just builded for credential) under `context` property.
+from the secret we just built for credential) under `context` property.
 
 Here is an template example for you:
 
diff --git a/heat/api/openstack/v1/util.py b/heat/api/openstack/v1/util.py
index ee2b92d..556f6f2 100644
--- a/heat/api/openstack/v1/util.py
+++ b/heat/api/openstack/v1/util.py
@@ -29,9 +29,15 @@ def registered_policy_enforce(handler):
     """
     @functools.wraps(handler)
     def handle_stack_method(controller, req, tenant_id, **kwargs):
+        # NOTE(tkajinam): Heat uses stack owner's project id in redirect URI.
+        # So admin might be redirected to different project id when accessing
+        # resources in a different project. Use project id in context to
+        # bypass project_id check, because admin should have access to all
+        # projects.
+        if req.context.is_admin and req.context.project_id:
+            tenant_id = req.context.tenant_id
         _target = {"project_id": tenant_id}
-
-        if req.context.tenant_id != tenant_id and not req.context.is_admin:
+        if req.context.tenant_id != tenant_id:
             raise exc.HTTPForbidden()
         allowed = req.context.policy.enforce(
             context=req.context,
diff --git a/heat/cloudinit/loguserdata.py b/heat/cloudinit/loguserdata.py
index 14d17f2..810e353 100755
--- a/heat/cloudinit/loguserdata.py
+++ b/heat/cloudinit/loguserdata.py
@@ -11,61 +11,19 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
-"true" '''\'
-# NOTE(vgridnev): ubuntu trusty by default has python3,
-# but pkg_resources can't be imported.
-echo "import pkg_resources" | python3 2>/dev/null
-has_py3=$?
-echo "import pkg_resources" | python2 2>/dev/null
-has_py2=$?
-echo "import pkg_resources" | /usr/libexec/platform-python 2>/dev/null
-has_platform-py=$?
-
-if [ $has_py3 = 0 ]; then
-    interpreter="python3"
-elif [ $has_py2 = 0 ]; then
-    interpreter="python"
-elif [ $has_platform-py = 0 ]; then
-    interpreter="/usr/libexec/platform-python"
-else
-    interpreter="python"
-fi
-exec $interpreter "$0"
-'''
 
 import datetime
 import errno
 import logging
 import os
-import re
 import subprocess
 import sys
 
-from packaging import version
-import pkg_resources
-
 
 VAR_PATH = '/var/lib/heat-cfntools'
 LOG = logging.getLogger('heat-provision')
 
 
-def chk_ci_version():
-    try:
-        v = version.Version(
-            pkg_resources.get_distribution('cloud-init').version)
-        return v >= version.Version('0.6.0')
-    except Exception:
-        pass
-    data = subprocess.Popen(['cloud-init', '--version'],
-                            stdout=subprocess.PIPE,
-                            stderr=subprocess.PIPE).communicate()
-    if data[0]:
-        raise Exception()
-    # data[1] has such format: 'cloud-init 0.7.5\n', need to parse version
-    v = re.split(' |\n', data[1])[1].split('.')
-    return tuple(v) >= tuple(['0', '6', '0'])
-
-
 def init_logging():
     LOG.setLevel(logging.INFO)
     LOG.addHandler(logging.StreamHandler())
@@ -106,17 +64,6 @@ def call(args):
 
 
 def main():
-
-    try:
-        if not chk_ci_version():
-            # pre 0.6.0 - user data executed via cloudinit, not this helper
-            LOG.error('Unable to log provisioning, need a newer version of '
-                      'cloud-init')
-            return -1
-    except Exception:
-        LOG.warning('Can not determine the version of cloud-init. It is '
-                    'possible to get errors while logging provisioning.')
-
     userdata_path = os.path.join(VAR_PATH, 'cfn-userdata')
     os.chmod(userdata_path, int("700", 8))
 
diff --git a/heat/cloudinit/part_handler.py b/heat/cloudinit/part_handler.py
index 50318f3..cf879fe 100644
--- a/heat/cloudinit/part_handler.py
+++ b/heat/cloudinit/part_handler.py
@@ -19,7 +19,7 @@ import sys
 
 
 def list_types():
-    return(["text/x-cfninitdata"])
+    return ["text/x-cfninitdata"]
 
 
 def handle_part(data, ctype, filename, payload):
diff --git a/heat/common/cache.py b/heat/common/cache.py
index 3e011fd..6dc1d95 100644
--- a/heat/common/cache.py
+++ b/heat/common/cache.py
@@ -21,6 +21,56 @@ from oslo_config import cfg
 
 from heat.common.i18n import _
 
+constraint_cache_group = cfg.OptGroup('constraint_validation_cache')
+constraint_cache_opts = [
+    cfg.IntOpt('expiration_time', default=60,
+               help=_(
+                   'TTL, in seconds, for any cached item in the '
+                   'dogpile.cache region used for caching of validation '
+                   'constraints.')),
+    cfg.BoolOpt("caching", default=True,
+                help=_(
+                    'Toggle to enable/disable caching when Orchestration '
+                    'Engine validates property constraints of stack. '
+                    'During property validation with constraints '
+                    'Orchestration Engine caches requests to other '
+                    'OpenStack services. Please note that the global '
+                    'toggle for oslo.cache(enabled=True in [cache] group) '
+                    'must be enabled to use this feature.'))
+]
+
+extension_cache_group = cfg.OptGroup('service_extension_cache')
+extension_cache_opts = [
+    cfg.IntOpt('expiration_time', default=3600,
+               help=_(
+                   'TTL, in seconds, for any cached item in the '
+                   'dogpile.cache region used for caching of service '
+                   'extensions.')),
+    cfg.BoolOpt('caching', default=True,
+                help=_(
+                    'Toggle to enable/disable caching when Orchestration '
+                    'Engine retrieves extensions from other OpenStack '
+                    'services. Please note that the global toggle for '
+                    'oslo.cache(enabled=True in [cache] group) must be '
+                    'enabled to use this feature.'))
+]
+
+find_cache_group = cfg.OptGroup('resource_finder_cache')
+find_cache_opts = [
+    cfg.IntOpt('expiration_time', default=3600,
+               help=_(
+                   'TTL, in seconds, for any cached item in the '
+                   'dogpile.cache region used for caching of OpenStack '
+                   'service finder functions.')),
+    cfg.BoolOpt('caching', default=True,
+                help=_(
+                    'Toggle to enable/disable caching when Orchestration '
+                    'Engine looks for other OpenStack service resources '
+                    'using name or id. Please note that the global '
+                    'toggle for oslo.cache(enabled=True in [cache] group) '
+                    'must be enabled to use this feature.'))
+]
+
 
 def register_cache_configurations(conf):
     """Register all configurations required for oslo.cache.
@@ -35,65 +85,24 @@ def register_cache_configurations(conf):
     core.configure(conf)
 
     # register heat specific configurations
-    constraint_cache_group = cfg.OptGroup('constraint_validation_cache')
-    constraint_cache_opts = [
-        cfg.IntOpt('expiration_time', default=60,
-                   help=_(
-                       'TTL, in seconds, for any cached item in the '
-                       'dogpile.cache region used for caching of validation '
-                       'constraints.')),
-        cfg.BoolOpt("caching", default=True,
-                    help=_(
-                        'Toggle to enable/disable caching when Orchestration '
-                        'Engine validates property constraints of stack. '
-                        'During property validation with constraints '
-                        'Orchestration Engine caches requests to other '
-                        'OpenStack services. Please note that the global '
-                        'toggle for oslo.cache(enabled=True in [cache] group) '
-                        'must be enabled to use this feature.'))
-    ]
     conf.register_group(constraint_cache_group)
     conf.register_opts(constraint_cache_opts, group=constraint_cache_group)
 
-    extension_cache_group = cfg.OptGroup('service_extension_cache')
-    extension_cache_opts = [
-        cfg.IntOpt('expiration_time', default=3600,
-                   help=_(
-                       'TTL, in seconds, for any cached item in the '
-                       'dogpile.cache region used for caching of service '
-                       'extensions.')),
-        cfg.BoolOpt('caching', default=True,
-                    help=_(
-                        'Toggle to enable/disable caching when Orchestration '
-                        'Engine retrieves extensions from other OpenStack '
-                        'services. Please note that the global toggle for '
-                        'oslo.cache(enabled=True in [cache] group) must be '
-                        'enabled to use this feature.'))
-    ]
     conf.register_group(extension_cache_group)
     conf.register_opts(extension_cache_opts, group=extension_cache_group)
 
-    find_cache_group = cfg.OptGroup('resource_finder_cache')
-    find_cache_opts = [
-        cfg.IntOpt('expiration_time', default=3600,
-                   help=_(
-                       'TTL, in seconds, for any cached item in the '
-                       'dogpile.cache region used for caching of OpenStack '
-                       'service finder functions.')),
-        cfg.BoolOpt('caching', default=True,
-                    help=_(
-                        'Toggle to enable/disable caching when Orchestration '
-                        'Engine looks for other OpenStack service resources '
-                        'using name or id. Please note that the global '
-                        'toggle for oslo.cache(enabled=True in [cache] group) '
-                        'must be enabled to use this feature.'))
-    ]
     conf.register_group(find_cache_group)
     conf.register_opts(find_cache_opts, group=find_cache_group)
 
     return conf
 
 
+def list_opts():
+    yield constraint_cache_group.name, constraint_cache_opts
+    yield extension_cache_group.name, extension_cache_opts
+    yield find_cache_group.name, find_cache_opts
+
+
 # variable that stores an initialized cache region for heat
 _REGION = None
 
diff --git a/heat/common/config.py b/heat/common/config.py
index 1e1df6f..c6a1dfc 100644
--- a/heat/common/config.py
+++ b/heat/common/config.py
@@ -152,6 +152,19 @@ engine_opts = [
                default=512,
                help=_('Maximum number of stacks any one tenant may have '
                       'active at one time. -1 stands for unlimited.')),
+    cfg.IntOpt('max_software_configs_per_tenant',
+               default=4096,
+               help=_('Maximum number of software configs any one tenant may '
+                      'have active at one time. -1 stands for unlimited.')),
+    cfg.IntOpt('max_software_deployments_per_tenant',
+               default=4096,
+               help=_('Maximum number of software deployments any one tenant '
+                      'may have active at one time.'
+                      '-1 stands for unlimited.')),
+    cfg.IntOpt('max_snapshots_per_stack',
+               default=32,
+               help=_('Maximum number of snapshot any one stack may have '
+                      'active at one time. -1 stands for unlimited.')),
     cfg.IntOpt('action_retry_limit',
                default=5,
                help=_('Number of times to retry to bring a '
diff --git a/heat/common/plugin_loader.py b/heat/common/plugin_loader.py
index 9023374..7ea933d 100644
--- a/heat/common/plugin_loader.py
+++ b/heat/common/plugin_loader.py
@@ -20,6 +20,7 @@ for them before loading them.
 """
 
 import functools
+import importlib.util
 import pkgutil
 import sys
 import types
@@ -70,7 +71,8 @@ def _import_module(importer, module_name, package):
     if module_spec is None:
         return None
 
-    module = module_spec.loader.load_module(module_name)
+    module = importlib.util.module_from_spec(module_spec)
+    module_spec.loader.exec_module(module)
 
     # Make this accessible through the parent package for static imports
     local_name = module_name.partition(package.__name__ + '.')[2]
diff --git a/heat/db/api.py b/heat/db/api.py
index 70aab59..0d03547 100644
--- a/heat/db/api.py
+++ b/heat/db/api.py
@@ -1431,6 +1431,14 @@ def software_config_get_all(context, limit=None, marker=None):
                            limit=limit, marker=marker).all()
 
 
+@context_manager.reader
+def software_config_count_all(context):
+    query = context.session.query(models.SoftwareConfig)
+    if not context.is_admin:
+        query = query.filter_by(tenant=context.tenant_id)
+    return query.count()
+
+
 @context_manager.writer
 def software_config_delete(context, config_id):
     config = _software_config_get(context, config_id)
@@ -1510,6 +1518,21 @@ def software_deployment_get_all(context, server_id=None):
     return query.all()
 
 
+@context_manager.reader
+def software_deployment_count_all(context):
+    sd = models.SoftwareDeployment
+    query = context.session.query(sd)
+    if not context.is_admin:
+        query = query.filter(
+            sqlalchemy.or_(
+                sd.tenant == context.tenant_id,
+                sd.stack_user_project_id == context.tenant_id,
+            )
+        )
+
+    return query.count()
+
+
 @context_manager.writer
 def software_deployment_update(context, deployment_id, values):
     deployment = _software_deployment_get(context, deployment_id)
@@ -1582,11 +1605,17 @@ def snapshot_delete(context, snapshot_id):
 
 
 @context_manager.reader
-def snapshot_get_all(context, stack_id):
+def snapshot_get_all_by_stack(context, stack_id):
     return context.session.query(models.Snapshot).filter_by(
         stack_id=stack_id, tenant=context.tenant_id)
 
 
+@context_manager.reader
+def snapshot_count_all_by_stack(context, stack_id):
+    return context.session.query(models.Snapshot).filter_by(
+        stack_id=stack_id, tenant=context.tenant_id).count()
+
+
 # service
 
 
diff --git a/heat/engine/clients/os/keystone/fake_keystoneclient.py b/heat/engine/clients/os/keystone/fake_keystoneclient.py
index 9715c95..d2d2879 100644
--- a/heat/engine/clients/os/keystone/fake_keystoneclient.py
+++ b/heat/engine/clients/os/keystone/fake_keystoneclient.py
@@ -51,7 +51,7 @@ class FakeKeystoneClient(object):
             secret = self.secret
         self.creds = FakeCred()
 
-    def create_stack_user(self, username, password=''):
+    def create_stack_user(self, username, password):
         self.username = username
         return self.user_id
 
diff --git a/heat/engine/clients/os/keystone/heat_keystoneclient.py b/heat/engine/clients/os/keystone/heat_keystoneclient.py
index 7f993ec..2cf8ee9 100644
--- a/heat/engine/clients/os/keystone/heat_keystoneclient.py
+++ b/heat/engine/clients/os/keystone/heat_keystoneclient.py
@@ -277,13 +277,13 @@ class KsClientWrapper(object):
         return trust_context
 
     def _get_username(self, username):
-        if(len(username) > 255):
+        if len(username) > 255:
             LOG.warning("Truncating the username %s to the last 255 "
                         "characters.", username)
         # get the last 255 characters of the username
         return username[-255:]
 
-    def create_stack_user(self, username, password=''):
+    def create_stack_user(self, username, password):
         """Create a user defined as part of a stack.
 
         The user is defined either via template or created internally by a
diff --git a/heat/engine/constraint/common_constraints.py b/heat/engine/constraint/common_constraints.py
index cef2571..5588ef7 100644
--- a/heat/engine/constraint/common_constraints.py
+++ b/heat/engine/constraint/common_constraints.py
@@ -14,7 +14,13 @@
 import croniter
 import eventlet
 import netaddr
-import pytz
+
+try:
+    import zoneinfo
+except ImportError:
+    # zoneinfo is available in Python >= 3.9
+    import pytz
+    zoneinfo = None
 
 from neutron_lib.api import validators
 from oslo_utils import timeutils
@@ -106,7 +112,7 @@ class CIDRConstraint(constraints.BaseCustomConstraint):
 
     def validate(self, value, context, template=None):
         try:
-            netaddr.IPNetwork(value, implicit_prefix=True)
+            netaddr.IPNetwork(netaddr.cidr_abbrev_to_verbose(value))
             msg = validators.validate_subnet(value)
             if msg is not None:
                 self._error_message = msg
@@ -167,7 +173,10 @@ class TimezoneConstraint(constraints.BaseCustomConstraint):
         if not value:
             return True
         try:
-            pytz.timezone(value)
+            if zoneinfo:
+                zoneinfo.ZoneInfo(value)
+            else:
+                pytz.timezone(value)
             return True
         except Exception as ex:
             self._error_message = _(
diff --git a/heat/engine/hot/functions.py b/heat/engine/hot/functions.py
index ec4bb9d..0e63574 100644
--- a/heat/engine/hot/functions.py
+++ b/heat/engine/hot/functions.py
@@ -31,7 +31,8 @@ from heat.engine import function
 
 LOG = logging.getLogger(__name__)
 
-opts = [
+yaql_group = cfg.OptGroup('yaql')
+yaql_opts = [
     cfg.IntOpt('limit_iterators',
                default=200,
                help=_('The maximum number of elements in collection '
@@ -41,7 +42,11 @@ opts = [
                help=_('The maximum size of memory in bytes that '
                       'expression can take for its evaluation.'))
 ]
-cfg.CONF.register_opts(opts, group='yaql')
+cfg.CONF.register_opts(yaql_opts, group=yaql_group)
+
+
+def list_opts():
+    yield yaql_group.name, yaql_opts
 
 
 class GetParam(function.Function):
diff --git a/heat/engine/resource.py b/heat/engine/resource.py
index c8e5c0e..e40fdb9 100644
--- a/heat/engine/resource.py
+++ b/heat/engine/resource.py
@@ -809,7 +809,7 @@ class Resource(status.ResourceStatus):
             if endpoint_exists:
                 req_extension = cls.required_service_extension
                 if not req_extension:
-                    return(True, None)
+                    return (True, None)
                 if isinstance(req_extension, str):
                     req_extension = re.split(' |,', req_extension)
                 for ext in req_extension:
diff --git a/heat/engine/resources/openstack/monasca/alarm_definition.py b/heat/engine/resources/openstack/monasca/alarm_definition.py
index 3af1fa2..dea669e 100644
--- a/heat/engine/resources/openstack/monasca/alarm_definition.py
+++ b/heat/engine/resources/openstack/monasca/alarm_definition.py
@@ -32,11 +32,15 @@ class MonascaAlarmDefinition(resource.Resource):
     """
 
     support_status = support.SupportStatus(
-        version='7.0.0',
+        version='22.0.0',
+        status=support.DEPRECATED,
+        message=_('Monasca project was marked inactive'),
         previous_status=support.SupportStatus(
-            version='5.0.0',
-            status=support.UNSUPPORTED
-        ))
+            version='7.0.0',
+            previous_status=support.SupportStatus(
+                version='5.0.0',
+                status=support.UNSUPPORTED
+            )))
 
     default_client_name = 'monasca'
 
diff --git a/heat/engine/resources/openstack/monasca/notification.py b/heat/engine/resources/openstack/monasca/notification.py
index 8074bd0..65a155d 100644
--- a/heat/engine/resources/openstack/monasca/notification.py
+++ b/heat/engine/resources/openstack/monasca/notification.py
@@ -32,11 +32,16 @@ class MonascaNotification(resource.Resource):
     """
 
     support_status = support.SupportStatus(
-        version='7.0.0',
+        version='22.0.0',
+        status=support.DEPRECATED,
+        message=_('Monasca project was marked inactive'),
         previous_status=support.SupportStatus(
-            version='5.0.0',
-            status=support.UNSUPPORTED
-        ))
+            version='7.0.0',
+            status=support.SUPPORTED,
+            previous_status=support.SupportStatus(
+                version='5.0.0',
+                status=support.SUPPORTED
+                )))
 
     default_client_name = 'monasca'
 
diff --git a/heat/engine/resources/openstack/neutron/port.py b/heat/engine/resources/openstack/neutron/port.py
index a06fbf3..58f3029 100644
--- a/heat/engine/resources/openstack/neutron/port.py
+++ b/heat/engine/resources/openstack/neutron/port.py
@@ -545,7 +545,7 @@ class Port(neutron.NeutronResource):
                     ).get_secgroup_uuids(['default'])
 
         if self.REPLACEMENT_POLICY in props:
-            del(props[self.REPLACEMENT_POLICY])
+            del props[self.REPLACEMENT_POLICY]
 
     def _store_config_default_properties(self, attrs):
         """A method for storing properties default values.
diff --git a/heat/engine/resources/openstack/neutron/security_group.py b/heat/engine/resources/openstack/neutron/security_group.py
index 0bd867c..f88d589 100644
--- a/heat/engine/resources/openstack/neutron/security_group.py
+++ b/heat/engine/resources/openstack/neutron/security_group.py
@@ -180,7 +180,7 @@ class SecurityGroup(neutron.NeutronResource):
 
         if 'remote_mode' in rule:
             remote_mode = rule.get(self.RULE_REMOTE_MODE)
-            del(rule[self.RULE_REMOTE_MODE])
+            del rule[self.RULE_REMOTE_MODE]
 
             if remote_mode == self.RULE_REMOTE_GROUP_ID:
                 rule[self.RULE_REMOTE_IP_PREFIX] = None
diff --git a/heat/engine/resources/openstack/sahara/cluster.py b/heat/engine/resources/openstack/sahara/cluster.py
index 05a0def..6dc45a6 100644
--- a/heat/engine/resources/openstack/sahara/cluster.py
+++ b/heat/engine/resources/openstack/sahara/cluster.py
@@ -49,6 +49,15 @@ class SaharaCluster(resource.Resource):
     should specify a keypair.
     """
 
+    support_status = support.SupportStatus(
+        version='22.0.0',
+        status=support.DEPRECATED,
+        message=_('Sahara project was marked inactive'),
+        previous_status=support.SupportStatus(
+            version='5.0.0',
+            status=support.SUPPORTED
+        ))
+
     PROPERTIES = (
         NAME, PLUGIN_NAME, HADOOP_VERSION, CLUSTER_TEMPLATE_ID,
         KEY_NAME, IMAGE, MANAGEMENT_NETWORK, IMAGE_ID,
diff --git a/heat/engine/resources/openstack/sahara/data_source.py b/heat/engine/resources/openstack/sahara/data_source.py
index ff41bf4..c793f89 100644
--- a/heat/engine/resources/openstack/sahara/data_source.py
+++ b/heat/engine/resources/openstack/sahara/data_source.py
@@ -26,7 +26,14 @@ class DataSource(resource.Resource):
     or output data and any credentials needed to access the location.
     """
 
-    support_status = support.SupportStatus(version='5.0.0')
+    support_status = support.SupportStatus(
+        version='22.0.0',
+        status=support.DEPRECATED,
+        message=_('Sahara project was marked inactive'),
+        previous_status=support.SupportStatus(
+            version='5.0.0',
+            status=support.SUPPORTED
+        ))
 
     PROPERTIES = (
         NAME, TYPE, URL, DESCRIPTION, CREDENTIALS
diff --git a/heat/engine/resources/openstack/sahara/image.py b/heat/engine/resources/openstack/sahara/image.py
index dc60c72..152fbb1 100644
--- a/heat/engine/resources/openstack/sahara/image.py
+++ b/heat/engine/resources/openstack/sahara/image.py
@@ -26,7 +26,14 @@ class SaharaImageRegistry(resource.Resource):
     Allows to register an image in the sahara image registry and add tags.
     """
 
-    support_status = support.SupportStatus(version='6.0.0')
+    support_status = support.SupportStatus(
+        version='22.0.0',
+        status=support.DEPRECATED,
+        message=_('Sahara project was marked inactive'),
+        previous_status=support.SupportStatus(
+            version='5.0.0',
+            status=support.SUPPORTED
+        ))
 
     PROPERTIES = (
         IMAGE, USERNAME, DESCRIPTION, TAGS
diff --git a/heat/engine/resources/openstack/sahara/job.py b/heat/engine/resources/openstack/sahara/job.py
index cda9679..63ca204 100644
--- a/heat/engine/resources/openstack/sahara/job.py
+++ b/heat/engine/resources/openstack/sahara/job.py
@@ -33,7 +33,14 @@ class SaharaJob(signal_responder.SignalResponder, resource.Resource):
     job binary objects. Can be launched using resource-signal.
     """
 
-    support_status = support.SupportStatus(version='8.0.0')
+    support_status = support.SupportStatus(
+        version='22.0.0',
+        status=support.DEPRECATED,
+        message=_('Sahara project was marked inactive'),
+        previous_status=support.SupportStatus(
+            version='8.0.0',
+            status=support.SUPPORTED
+            ))
 
     PROPERTIES = (
         NAME, TYPE, MAINS, LIBS, DESCRIPTION,
diff --git a/heat/engine/resources/openstack/sahara/job_binary.py b/heat/engine/resources/openstack/sahara/job_binary.py
index 85cf705..f1e05af 100644
--- a/heat/engine/resources/openstack/sahara/job_binary.py
+++ b/heat/engine/resources/openstack/sahara/job_binary.py
@@ -29,7 +29,14 @@ class JobBinary(resource.Resource):
     credentials needed to retrieve the file.
     """
 
-    support_status = support.SupportStatus(version='5.0.0')
+    support_status = support.SupportStatus(
+        version='22.0.0',
+        status=support.DEPRECATED,
+        message=_('Sahara project was marked inactive'),
+        previous_status=support.SupportStatus(
+            version='5.0.0',
+            status=support.SUPPORTED
+        ))
 
     PROPERTIES = (
         NAME, URL, DESCRIPTION, CREDENTIALS
diff --git a/heat/engine/resources/openstack/sahara/templates.py b/heat/engine/resources/openstack/sahara/templates.py
index 0f52a2a..c49ee01 100644
--- a/heat/engine/resources/openstack/sahara/templates.py
+++ b/heat/engine/resources/openstack/sahara/templates.py
@@ -44,7 +44,14 @@ class SaharaNodeGroupTemplate(resource.Resource):
     configurations for those processes.
     """
 
-    support_status = support.SupportStatus(version='2014.2')
+    support_status = support.SupportStatus(
+        version='22.0.0',
+        status=support.DEPRECATED,
+        message=_('Sahara project was marked inactive'),
+        previous_status=support.SupportStatus(
+            version='2014.2',
+            status=support.SUPPORTED
+        ))
 
     PROPERTIES = (
         NAME, PLUGIN_NAME, HADOOP_VERSION, FLAVOR, DESCRIPTION,
diff --git a/heat/engine/resources/openstack/senlin/res_base.py b/heat/engine/resources/openstack/senlin/res_base.py
index a294df1..3df3fd6 100644
--- a/heat/engine/resources/openstack/senlin/res_base.py
+++ b/heat/engine/resources/openstack/senlin/res_base.py
@@ -14,6 +14,7 @@
 
 from oslo_log import log as logging
 
+from heat.common.i18n import _
 from heat.engine import resource
 from heat.engine import support
 
@@ -23,7 +24,13 @@ LOG = logging.getLogger(__name__)
 class BaseSenlinResource(resource.Resource):
     """A base class for Senlin resources."""
 
-    support_status = support.SupportStatus(version='6.0.0')
+    support_status = support.SupportStatus(
+        version='22.0.0',
+        status=support.DEPRECATED,
+        message=_('Senlin project was marked inactive'),
+        previous_status=support.SupportStatus(
+            version='6.0.0',
+            ))
 
     default_client_name = 'senlin'
 
diff --git a/heat/engine/service.py b/heat/engine/service.py
index 9019ddb..037c912 100644
--- a/heat/engine/service.py
+++ b/heat/engine/service.py
@@ -73,6 +73,10 @@ from heat.rpc import worker_api as rpc_worker_api
 cfg.CONF.import_opt('engine_life_check_timeout', 'heat.common.config')
 cfg.CONF.import_opt('max_resources_per_stack', 'heat.common.config')
 cfg.CONF.import_opt('max_stacks_per_tenant', 'heat.common.config')
+cfg.CONF.import_opt('max_snapshots_per_stack', 'heat.common.config')
+cfg.CONF.import_opt('max_software_configs_per_tenant', 'heat.common.config')
+cfg.CONF.import_opt('max_software_deployments_per_tenant',
+                    'heat.common.config')
 cfg.CONF.import_opt('enable_stack_abandon', 'heat.common.config')
 cfg.CONF.import_opt('enable_stack_adopt', 'heat.common.config')
 cfg.CONF.import_opt('convergence_engine', 'heat.common.config')
@@ -2124,6 +2128,17 @@ class EngineService(service.ServiceBase):
             raise exception.ActionInProgress(stack_name=stack.name,
                                              action=stack.action)
 
+        # Do not enforce the limit, following the stack limit
+        if not cnxt.is_admin:
+            stack_limit = cfg.CONF.max_snapshots_per_stack
+            count_all = snapshot_object.Snapshot.count_all_by_stack(cnxt,
+                                                                    stack.id)
+            if (stack_limit >= 0 and count_all >= stack_limit):
+                message = _("You have reached the maximum snapshots "
+                            "per stack, %d. Please delete some "
+                            "snapshots.") % stack_limit
+                raise exception.RequestLimitExceeded(message=message)
+
         lock = stack_lock.StackLock(cnxt, stack.id, self.engine_id)
 
         with lock.thread_lock():
@@ -2198,7 +2213,7 @@ class EngineService(service.ServiceBase):
     @context.request_context
     def stack_list_snapshots(self, cnxt, stack_identity):
         s = self._get_stack(cnxt, stack_identity)
-        data = snapshot_object.Snapshot.get_all(cnxt, s.id)
+        data = snapshot_object.Snapshot.get_all_by_stack(cnxt, s.id)
         return [api.format_snapshot(snapshot) for snapshot in data]
 
     @context.request_context
@@ -2219,6 +2234,15 @@ class EngineService(service.ServiceBase):
     @context.request_context
     def create_software_config(self, cnxt, group, name, config,
                                inputs, outputs, options):
+        # Do not enforce the limit, following the stack limit
+        if not cnxt.is_admin:
+            tenant_limit = cfg.CONF.max_software_configs_per_tenant
+            count_all = self.software_config.count_software_config(cnxt)
+            if (tenant_limit >= 0 and count_all >= tenant_limit):
+                message = _("You have reached the maximum software configs "
+                            "per tenant, %d. "
+                            "Please delete some configs.") % tenant_limit
+                raise exception.RequestLimitExceeded(message=message)
         return self.software_config.create_software_config(
             cnxt,
             group=group,
@@ -2257,6 +2281,16 @@ class EngineService(service.ServiceBase):
                                    input_values, action, status,
                                    status_reason, stack_user_project_id,
                                    deployment_id=None):
+        # Do not enforce the limit, following the stack limit
+        if not cnxt.is_admin:
+            tenant_limit = cfg.CONF.max_software_deployments_per_tenant
+            count_all = self.software_config.count_software_deployment(cnxt)
+            if (tenant_limit >= 0 and
+                    count_all >= tenant_limit):
+                message = _("You have reached the maximum software "
+                            "deployments per tenant, %d. "
+                            "Please delete some deployments.") % tenant_limit
+                raise exception.RequestLimitExceeded(message=message)
         return self.software_config.create_software_deployment(
             cnxt, server_id=server_id,
             config_id=config_id,
diff --git a/heat/engine/service_software_config.py b/heat/engine/service_software_config.py
index 1c1fcb4..ce5001b 100644
--- a/heat/engine/service_software_config.py
+++ b/heat/engine/service_software_config.py
@@ -52,6 +52,9 @@ class SoftwareConfigService(object):
                   for sc in scs]
         return result
 
+    def count_software_config(self, cnxt):
+        return software_config_object.SoftwareConfig.count_all(cnxt)
+
     def create_software_config(self, cnxt, group, name, config,
                                inputs, outputs, options):
 
@@ -81,6 +84,10 @@ class SoftwareConfigService(object):
         result = [api.format_software_deployment(sd) for sd in all_sd]
         return result
 
+    def count_software_deployment(self, cnxt):
+        return software_deployment_object.SoftwareDeployment.count_all(
+            cnxt)
+
     def metadata_software_deployments(self, cnxt, server_id):
         if not server_id:
             raise ValueError(_('server_id must be specified'))
diff --git a/heat/engine/stack.py b/heat/engine/stack.py
index c7ebec1..caad797 100644
--- a/heat/engine/stack.py
+++ b/heat/engine/stack.py
@@ -1343,7 +1343,7 @@ class Stack(collections.abc.Mapping):
         elif create_if_missing:
             kwargs = self.get_kwargs_for_cloning(keep_tags=True)
             kwargs['owner_id'] = self.id
-            del(kwargs['prev_raw_template_id'])
+            del kwargs['prev_raw_template_id']
             prev = type(self)(self.context, self._backup_name(),
                               copy.deepcopy(self.t),
                               **kwargs)
@@ -2132,7 +2132,8 @@ class Stack(collections.abc.Mapping):
 
     def delete_all_snapshots(self):
         """Remove all snapshots for this stack."""
-        snapshots = snapshot_object.Snapshot.get_all(self.context, self.id)
+        snapshots = snapshot_object.Snapshot.get_all_by_stack(
+            self.context, self.id)
         for snapshot in snapshots:
             self.delete_snapshot(snapshot)
             snapshot_object.Snapshot.delete(self.context, snapshot.id)
diff --git a/heat/hacking/checks.py b/heat/hacking/checks.py
index 4c39435..dcce567 100644
--- a/heat/hacking/checks.py
+++ b/heat/hacking/checks.py
@@ -26,7 +26,7 @@ Guidelines for writing new hacking checks
 - Pick numbers in the range H3xx. Find the current test with
   the highest allocated number and then pick the next value.
 - Keep the test method code in the source file ordered based
-  on the Heat3xx value.
+  on the HE3xx value.
 - List the new rule in the top level HACKING.rst file
 - Add test cases for each new rule to heat/tests/test_hacking.py
 
@@ -39,31 +39,31 @@ def no_log_warn(logical_line):
 
     https://bugs.launchpad.net/tempest/+bug/1508442
 
-    Heat301
+    HE301
     """
     if logical_line.startswith('LOG.warn('):
-        yield(0, 'Heat301 Use LOG.warning() rather than LOG.warn()')
+        yield (0, 'HE301 Use LOG.warning() rather than LOG.warn()')
 
 
 @core.flake8ext
 def check_python3_no_iteritems(logical_line):
-    msg = ("Heat302: Use dict.items() instead of dict.iteritems().")
+    msg = ("HE302: Use dict.items() instead of dict.iteritems().")
 
     if re.search(r".*\.iteritems\(\)", logical_line):
-        yield(0, msg)
+        yield (0, msg)
 
 
 @core.flake8ext
 def check_python3_no_iterkeys(logical_line):
-    msg = ("Heat303: Use dict.keys() instead of dict.iterkeys().")
+    msg = ("HE303: Use dict.keys() instead of dict.iterkeys().")
 
     if re.search(r".*\.iterkeys\(\)", logical_line):
-        yield(0, msg)
+        yield (0, msg)
 
 
 @core.flake8ext
 def check_python3_no_itervalues(logical_line):
-    msg = ("Heat304: Use dict.values() instead of dict.itervalues().")
+    msg = ("HE304: Use dict.values() instead of dict.itervalues().")
 
     if re.search(r".*\.itervalues\(\)", logical_line):
-        yield(0, msg)
+        yield (0, msg)
diff --git a/heat/objects/snapshot.py b/heat/objects/snapshot.py
index 23d569a..8cd53aa 100644
--- a/heat/objects/snapshot.py
+++ b/heat/objects/snapshot.py
@@ -70,6 +70,11 @@ class Snapshot(
         db_api.snapshot_delete(context, snapshot_id)
 
     @classmethod
-    def get_all(cls, context, stack_id):
+    def get_all_by_stack(cls, context, stack_id):
         return [cls._from_db_object(context, cls(), db_snapshot)
-                for db_snapshot in db_api.snapshot_get_all(context, stack_id)]
+                for db_snapshot
+                in db_api.snapshot_get_all_by_stack(context, stack_id)]
+
+    @classmethod
+    def count_all_by_stack(cls, context, stack_id):
+        return db_api.snapshot_count_all_by_stack(context, stack_id)
diff --git a/heat/objects/software_config.py b/heat/objects/software_config.py
index e0d9d42..df2cafb 100644
--- a/heat/objects/software_config.py
+++ b/heat/objects/software_config.py
@@ -66,5 +66,9 @@ class SoftwareConfig(
         return [cls._from_db_object(context, cls(), sc) for sc in scs]
 
     @classmethod
+    def count_all(cls, context, **kwargs):
+        return db_api.software_config_count_all(context, **kwargs)
+
+    @classmethod
     def delete(cls, context, config_id):
         db_api.software_config_delete(context, config_id)
diff --git a/heat/objects/software_deployment.py b/heat/objects/software_deployment.py
index 564a484..d7cbc65 100644
--- a/heat/objects/software_deployment.py
+++ b/heat/objects/software_deployment.py
@@ -78,6 +78,11 @@ class SoftwareDeployment(
                     context, server_id)]
 
     @classmethod
+    def count_all(cls, context):
+        return db_api.software_deployment_count_all(
+            context)
+
+    @classmethod
     def update_by_id(cls, context, deployment_id, values):
         """Note this is a bit unusual as it returns the object.
 
diff --git a/heat/tests/api/cfn/test_api_cfn_v1.py b/heat/tests/api/cfn/test_api_cfn_v1.py
index 88d3764..f078521 100644
--- a/heat/tests/api/cfn/test_api_cfn_v1.py
+++ b/heat/tests/api/cfn/test_api_cfn_v1.py
@@ -266,8 +266,8 @@ class CfnStackControllerTest(common.HeatTestCase):
                         u'stack_status': u'COMPLETE',
                         u'description': u'blah',
                         u'disable_rollback': 'true',
-                        u'timeout_mins':60,
-                        u'capabilities':[]}]
+                        u'timeout_mins': 60,
+                        u'capabilities': []}]
 
         self.m_call.side_effect = [identity, engine_resp]
 
@@ -358,8 +358,8 @@ class CfnStackControllerTest(common.HeatTestCase):
                         u'stack_status': u'COMPLETE',
                         u'description': u'blah',
                         u'disable_rollback': 'true',
-                        u'timeout_mins':60,
-                        u'capabilities':[]}]
+                        u'timeout_mins': 60,
+                        u'capabilities': []}]
 
         self.m_call.return_value = engine_resp
 
diff --git a/heat/tests/api/openstack_v1/test_routes.py b/heat/tests/api/openstack_v1/test_routes.py
index 29d1ae4..e929423 100644
--- a/heat/tests/api/openstack_v1/test_routes.py
+++ b/heat/tests/api/openstack_v1/test_routes.py
@@ -28,8 +28,8 @@ class RoutesTest(common.HeatTestCase):
         class_name = reflection.get_class_name(route['controller'].controller,
                                                fully_qualified=False)
         self.assertEqual(controller, class_name)
-        del(route['action'])
-        del(route['controller'])
+        del route['action']
+        del route['controller']
         self.assertEqual(params, route)
 
     def setUp(self):
diff --git a/heat/tests/api/openstack_v1/test_stacks.py b/heat/tests/api/openstack_v1/test_stacks.py
index ff0a575..da92d27 100644
--- a/heat/tests/api/openstack_v1/test_stacks.py
+++ b/heat/tests/api/openstack_v1/test_stacks.py
@@ -1608,7 +1608,7 @@ class StackControllerTest(tools.ControllerTest, common.HeatTestCase):
                 u'stack_status': u'COMPLETE',
                 u'description': u'blah',
                 u'disable_rollback': True,
-                u'timeout_mins':60,
+                u'timeout_mins': 60,
                 u'capabilities': [],
             }
         ]
@@ -1674,7 +1674,7 @@ class StackControllerTest(tools.ControllerTest, common.HeatTestCase):
                 u'stack_status': u'COMPLETE',
                 u'description': u'blah',
                 u'disable_rollback': True,
-                u'timeout_mins':60,
+                u'timeout_mins': 60,
                 u'capabilities': [],
             }
         ]
diff --git a/heat/tests/clients/test_swift_client.py b/heat/tests/clients/test_swift_client.py
index ae04ae4..8ad43f7 100644
--- a/heat/tests/clients/test_swift_client.py
+++ b/heat/tests/clients/test_swift_client.py
@@ -14,7 +14,13 @@
 import datetime
 from unittest import mock
 
-import pytz
+try:
+    import zoneinfo
+except ImportError:
+    # zoneinfo is available in Python >= 3.9
+    import pytz
+    zoneinfo = None
+
 from testtools import matchers
 
 from heat.engine.clients.os import swift
@@ -126,8 +132,12 @@ class SwiftUtilsTest(SwiftClientPluginTestCase):
 
     def test_parse_last_modified(self):
         self.assertIsNone(self.swift_plugin.parse_last_modified(None))
+        if zoneinfo:
+            tz = zoneinfo.ZoneInfo('GMT')
+        else:
+            tz = pytz.timezone('GMT')
         now = datetime.datetime(
-            2015, 2, 5, 1, 4, 40, 0, pytz.timezone('GMT'))
+            2015, 2, 5, 1, 4, 40, 0, tz)
         now_naive = datetime.datetime(
             2015, 2, 5, 1, 4, 40, 0)
         last_modified = now.strftime('%a, %d %b %Y %H:%M:%S %Z')
diff --git a/heat/tests/constraints/test_common_constraints.py b/heat/tests/constraints/test_common_constraints.py
index c466b06..03399bf 100644
--- a/heat/tests/constraints/test_common_constraints.py
+++ b/heat/tests/constraints/test_common_constraints.py
@@ -13,6 +13,12 @@
 
 from unittest import mock
 
+try:
+    import zoneinfo
+except ImportError:
+    # zoneinfo is available in Python >= 3.9
+    zoneinfo = None
+
 from heat.engine.constraint import common_constraints as cc
 from heat.tests import common
 from heat.tests import utils
@@ -279,7 +285,10 @@ class TimezoneConstraintTest(common.HeatTestCase):
 
     def test_validation_error(self):
         timezone = "wrong_timezone"
-        expected = "Invalid timezone: '%s'" % timezone
+        err = timezone
+        if zoneinfo:
+            err = "No time zone found with key %s" % timezone
+        expected = "Invalid timezone: '%s'" % err
 
         self.assertFalse(self.constraint.validate(timezone, self.ctx))
         self.assertEqual(
diff --git a/heat/tests/convergence/framework/engine_wrapper.py b/heat/tests/convergence/framework/engine_wrapper.py
index c1fb47c..062229c 100644
--- a/heat/tests/convergence/framework/engine_wrapper.py
+++ b/heat/tests/convergence/framework/engine_wrapper.py
@@ -54,13 +54,13 @@ class Engine(message_processor.MessageProcessor):
             if props:
                 props_def = {}
                 for prop_name, prop_value in props.items():
-                    if type(prop_value) == scenario_template.GetRes:
-                        prop_res = getattr(prop_value, "target_name")
-                        prop_value = {'get_resource': prop_res}
-                    elif type(prop_value) == scenario_template.GetAtt:
+                    if isinstance(prop_value, scenario_template.GetAtt):
                         prop_res = getattr(prop_value, "target_name")
                         prop_attr = getattr(prop_value, "attr")
                         prop_value = {'get_attr': [prop_res, prop_attr]}
+                    elif isinstance(prop_value, scenario_template.GetRes):
+                        prop_res = getattr(prop_value, "target_name")
+                        prop_value = {'get_resource': prop_res}
                     props_def[prop_name] = prop_value
                 res_defn["properties"] = props_def
             if depends:
diff --git a/heat/tests/db/test_sqlalchemy_api.py b/heat/tests/db/test_sqlalchemy_api.py
index 5689f2e..26166a9 100644
--- a/heat/tests/db/test_sqlalchemy_api.py
+++ b/heat/tests/db/test_sqlalchemy_api.py
@@ -1121,6 +1121,13 @@ class SqlAlchemyTest(common.HeatTestCase):
                                         tenant_id='admin_tenant')
         self._test_software_config_get_all(get_ctx=admin_ctx)
 
+    def test_software_config_count_all(self):
+        self.assertEqual(0, db_api.software_config_count_all(self.ctx))
+        self._create_software_config_record()
+        self._create_software_config_record()
+        self._create_software_config_record()
+        self.assertEqual(3, db_api.software_config_count_all(self.ctx))
+
     def test_software_config_delete(self):
         scf_id = self._create_software_config_record()
 
@@ -1250,6 +1257,17 @@ class SqlAlchemyTest(common.HeatTestCase):
         deployments = db_api.software_deployment_get_all(admin_ctx)
         self.assertEqual(1, len(deployments))
 
+    def test_software_deployment_count_all(self):
+        self.assertEqual(0, db_api.software_deployment_count_all(self.ctx))
+        values = self._deployment_values()
+        deployment = db_api.software_deployment_create(self.ctx, values)
+        self.assertIsNotNone(deployment)
+        deployment = db_api.software_deployment_create(self.ctx, values)
+        self.assertIsNotNone(deployment)
+        deployment = db_api.software_deployment_create(self.ctx, values)
+        self.assertIsNotNone(deployment)
+        self.assertEqual(3, db_api.software_deployment_count_all(self.ctx))
+
     def test_software_deployment_update(self):
         deployment_id = str(uuid.uuid4())
         err = self.assertRaises(exception.NotFound,
@@ -1421,7 +1439,7 @@ class SqlAlchemyTest(common.HeatTestCase):
 
         self.assertIn(snapshot_id, str(err))
 
-    def test_snapshot_get_all(self):
+    def test_snapshot_get_all_by_stack(self):
         template = create_raw_template(self.ctx)
         user_creds = create_user_creds(self.ctx)
         stack = create_stack(self.ctx, template, user_creds)
@@ -1429,12 +1447,44 @@ class SqlAlchemyTest(common.HeatTestCase):
                   'stack_id': stack.id}
         snapshot = db_api.snapshot_create(self.ctx, values)
         self.assertIsNotNone(snapshot)
-        [snapshot] = db_api.snapshot_get_all(self.ctx, stack.id)
+        [snapshot] = db_api.snapshot_get_all_by_stack(self.ctx, stack.id)
         self.assertIsNotNone(snapshot)
         self.assertEqual(values['tenant'], snapshot.tenant)
         self.assertEqual(values['status'], snapshot.status)
         self.assertIsNotNone(snapshot.created_at)
 
+    def test_snapshot_count_all_by_stack(self):
+        template = create_raw_template(self.ctx)
+        user_creds = create_user_creds(self.ctx)
+        stack1 = create_stack(self.ctx, template, user_creds)
+        stack2 = create_stack(self.ctx, template, user_creds)
+        values = [
+            {
+                'tenant': self.ctx.tenant_id,
+                'status': 'IN_PROGRESS',
+                'stack_id': stack1.id,
+                'name': 'snp1'
+            },
+            {
+                'tenant': self.ctx.tenant_id,
+                'status': 'IN_PROGRESS',
+                'stack_id': stack1.id,
+                'name': 'snp1'
+            },
+            {
+                'tenant': self.ctx.tenant_id,
+                'status': 'IN_PROGRESS',
+                'stack_id': stack2.id,
+                'name': 'snp2'
+            }
+        ]
+        for val in values:
+            self.assertIsNotNone(db_api.snapshot_create(self.ctx, val))
+        self.assertEqual(2, db_api.snapshot_count_all_by_stack(self.ctx,
+                                                               stack1.id))
+        self.assertEqual(1, db_api.snapshot_count_all_by_stack(self.ctx,
+                                                               stack2.id))
+
 
 def create_raw_template(context, **kwargs):
     t = template_format.parse(wp_template)
@@ -2493,13 +2543,13 @@ class DBAPIResourceTest(common.HeatTestCase):
         [self.assertIn(val['name'], names) for val in values]
 
     def test_resource_get_all_by_stack(self):
-        self.stack1 = create_stack(self.ctx, self.template, self.user_creds)
-        self.stack2 = create_stack(self.ctx, self.template, self.user_creds)
+        stack1 = create_stack(self.ctx, self.template, self.user_creds)
+        stack2 = create_stack(self.ctx, self.template, self.user_creds)
         values = [
             {'name': 'res1', 'stack_id': self.stack.id},
             {'name': 'res2', 'stack_id': self.stack.id},
             {'name': 'res3', 'stack_id': self.stack.id},
-            {'name': 'res4', 'stack_id': self.stack1.id},
+            {'name': 'res4', 'stack_id': stack1.id},
         ]
         [create_resource(self.ctx, self.stack, False, **val)
          for val in values]
@@ -2530,7 +2580,7 @@ class DBAPIResourceTest(common.HeatTestCase):
         self.assertEqual('res2', resources.get('res2').name)
 
         self.assertEqual({}, db_api.resource_get_all_by_stack(
-            self.ctx, self.stack2.id))
+            self.ctx, stack2.id))
 
     def test_resource_get_all_active_by_stack(self):
         values = [
@@ -2555,8 +2605,8 @@ class DBAPIResourceTest(common.HeatTestCase):
             self.assertIn(res.name, ['res2', 'res3', 'res4', 'res5', 'res6'])
 
     def test_resource_get_all_by_root_stack(self):
-        self.stack1 = create_stack(self.ctx, self.template, self.user_creds)
-        self.stack2 = create_stack(self.ctx, self.template, self.user_creds)
+        stack1 = create_stack(self.ctx, self.template, self.user_creds)
+        stack2 = create_stack(self.ctx, self.template, self.user_creds)
 
         create_resource(self.ctx, self.stack, name='res1',
                         root_stack_id=self.stack.id)
@@ -2564,7 +2614,7 @@ class DBAPIResourceTest(common.HeatTestCase):
                         root_stack_id=self.stack.id)
         create_resource(self.ctx, self.stack, name='res3',
                         root_stack_id=self.stack.id)
-        create_resource(self.ctx, self.stack1, name='res4',
+        create_resource(self.ctx, stack1, name='res4',
                         root_stack_id=self.stack.id)
 
         # Test for all resources in a stack
@@ -2596,7 +2646,7 @@ class DBAPIResourceTest(common.HeatTestCase):
                          sorted(resource_names))
 
         self.assertEqual({}, db_api.resource_get_all_by_root_stack(
-            self.ctx, self.stack2.id))
+            self.ctx, stack2.id))
 
     def test_resource_purge_deleted_by_stack(self):
         val = {'name': 'res1', 'action': rsrc.Resource.DELETE,
@@ -2944,14 +2994,14 @@ class DBAPIEventTest(common.HeatTestCase):
         self.assertEqual({'foo2': 'ev_bar'}, ret_event.rsrc_prop_data.data)
 
     def test_event_get_all_by_tenant(self):
-        self.stack1 = create_stack(self.ctx, self.template, self.user_creds,
-                                   tenant='tenant1')
-        self.stack2 = create_stack(self.ctx, self.template, self.user_creds,
-                                   tenant='tenant2')
+        stack1 = create_stack(self.ctx, self.template, self.user_creds,
+                              tenant='tenant1')
+        stack2 = create_stack(self.ctx, self.template, self.user_creds,
+                              tenant='tenant2')
         values = [
-            {'stack_id': self.stack1.id, 'resource_name': 'res1'},
-            {'stack_id': self.stack1.id, 'resource_name': 'res2'},
-            {'stack_id': self.stack2.id, 'resource_name': 'res3'},
+            {'stack_id': stack1.id, 'resource_name': 'res1'},
+            {'stack_id': stack1.id, 'resource_name': 'res2'},
+            {'stack_id': stack2.id, 'resource_name': 'res3'},
         ]
         [create_event(self.ctx, **val) for val in values]
 
@@ -2984,38 +3034,38 @@ class DBAPIEventTest(common.HeatTestCase):
         self.assertEqual(1, len(events))
 
     def test_event_get_all_by_stack(self):
-        self.stack1 = create_stack(self.ctx, self.template, self.user_creds)
-        self.stack2 = create_stack(self.ctx, self.template, self.user_creds)
+        stack1 = create_stack(self.ctx, self.template, self.user_creds)
+        stack2 = create_stack(self.ctx, self.template, self.user_creds)
         values = [
-            {'stack_id': self.stack1.id, 'resource_name': 'res1'},
-            {'stack_id': self.stack1.id, 'resource_name': 'res2'},
-            {'stack_id': self.stack2.id, 'resource_name': 'res3'},
+            {'stack_id': stack1.id, 'resource_name': 'res1'},
+            {'stack_id': stack1.id, 'resource_name': 'res2'},
+            {'stack_id': stack2.id, 'resource_name': 'res3'},
         ]
         [create_event(self.ctx, **val) for val in values]
 
         self.ctx.project_id = 'tenant1'
-        events = db_api.event_get_all_by_stack(self.ctx, self.stack1.id)
+        events = db_api.event_get_all_by_stack(self.ctx, stack1.id)
         self.assertEqual(2, len(events))
 
         self.ctx.project_id = 'tenant2'
-        events = db_api.event_get_all_by_stack(self.ctx, self.stack2.id)
+        events = db_api.event_get_all_by_stack(self.ctx, stack2.id)
         self.assertEqual(1, len(events))
 
     def test_event_count_all_by_stack(self):
-        self.stack1 = create_stack(self.ctx, self.template, self.user_creds)
-        self.stack2 = create_stack(self.ctx, self.template, self.user_creds)
+        stack1 = create_stack(self.ctx, self.template, self.user_creds)
+        stack2 = create_stack(self.ctx, self.template, self.user_creds)
         values = [
-            {'stack_id': self.stack1.id, 'resource_name': 'res1'},
-            {'stack_id': self.stack1.id, 'resource_name': 'res2'},
-            {'stack_id': self.stack2.id, 'resource_name': 'res3'},
+            {'stack_id': stack1.id, 'resource_name': 'res1'},
+            {'stack_id': stack1.id, 'resource_name': 'res2'},
+            {'stack_id': stack2.id, 'resource_name': 'res3'},
         ]
         [create_event(self.ctx, **val) for val in values]
 
         self.assertEqual(2, db_api.event_count_all_by_stack(self.ctx,
-                                                            self.stack1.id))
+                                                            stack1.id))
 
         self.assertEqual(1, db_api.event_count_all_by_stack(self.ctx,
-                                                            self.stack2.id))
+                                                            stack2.id))
 
 
 class DBAPIServiceTest(common.HeatTestCase):
@@ -3440,9 +3490,9 @@ class ResetStackStatusTests(common.HeatTestCase):
         db_api.reset_stack_status(self.ctx, self.stack.id)
 
         grandchild = db_api.stack_get(self.ctx, grandchild.id)
-        self.stack = db_api.stack_get(self.ctx, self.stack.id)
+        stack = db_api.stack_get(self.ctx, self.stack.id)
         resource = db_api.resource_get(self.ctx, resource.id)
         self.assertEqual('FAILED', grandchild.status)
         self.assertEqual('FAILED', resource.status)
         self.assertIsNone(resource.engine_id)
-        self.assertEqual('FAILED', self.stack.status)
+        self.assertEqual('FAILED', stack.status)
diff --git a/heat/tests/engine/service/test_software_config.py b/heat/tests/engine/service/test_software_config.py
index 470f3e9..90645c3 100644
--- a/heat/tests/engine/service/test_software_config.py
+++ b/heat/tests/engine/service/test_software_config.py
@@ -15,6 +15,7 @@ import datetime
 from unittest import mock
 import uuid
 
+from oslo_config import cfg
 from oslo_messaging.rpc import dispatcher
 from oslo_serialization import jsonutils as json
 from oslo_utils import timeutils
@@ -169,6 +170,14 @@ class SoftwareConfigServiceTest(common.HeatTestCase):
                          config['outputs'])
         self.assertEqual(kwargs['options'], config['options'])
 
+    def test_create_config_exceeds_max_per_tenant(self):
+        cfg.CONF.set_override('max_software_configs_per_tenant', 0)
+        ex = self.assertRaises(dispatcher.ExpectedException,
+                               self._create_software_config)
+        self.assertEqual(exception.RequestLimitExceeded, ex.exc_info[0])
+        self.assertIn("You have reached the maximum software configs "
+                      "per tenant", str(ex.exc_info[1]))
+
     def test_create_software_config_structured(self):
         kwargs = {
             'group': 'json-file',
@@ -504,6 +513,14 @@ class SoftwareConfigServiceTest(common.HeatTestCase):
         self.assertEqual(deployment_id, deployment['id'])
         self.assertEqual(kwargs['input_values'], deployment['input_values'])
 
+    def test_create_deployment_exceeds_max_per_tenant(self):
+        cfg.CONF.set_override('max_software_deployments_per_tenant', 0)
+        ex = self.assertRaises(dispatcher.ExpectedException,
+                               self._create_software_deployment)
+        self.assertEqual(exception.RequestLimitExceeded, ex.exc_info[0])
+        self.assertIn("You have reached the maximum software deployments"
+                      " per tenant", str(ex.exc_info[1]))
+
     def test_create_software_deployment_invalid_stack_user_project_id(self):
         sc_kwargs = {
             'group': 'Heat::Chef',
@@ -753,12 +770,12 @@ class SoftwareConfigServiceTest(common.HeatTestCase):
         }
         self.engine.software_config._push_metadata_software_deployments(
             self.ctx, '1234', None)
-        res_upd.has_calls(
+        res_upd.assert_has_calls([
             mock.call(self.ctx, '1234',
                       {'rsrc_metadata': result_metadata}, 1),
             mock.call(self.ctx, '1234',
-                      {'rsrc_metadata': result_metadata}, 2),
-        )
+                      {}, 2),
+        ])
 
         put.assert_called_once_with(
             'http://192.168.2.2/foo/bar', json.dumps(result_metadata))
diff --git a/heat/tests/engine/service/test_stack_snapshot.py b/heat/tests/engine/service/test_stack_snapshot.py
index 57e2e26..2d0e0b4 100644
--- a/heat/tests/engine/service/test_stack_snapshot.py
+++ b/heat/tests/engine/service/test_stack_snapshot.py
@@ -99,6 +99,19 @@ class SnapshotServiceTest(common.HeatTestCase):
         mock_load.assert_called_once_with(self.ctx, stack=mock.ANY)
 
     @mock.patch.object(stack.Stack, 'load')
+    def test_create_snapshot_exceeds_max_per_stack(self, mock_load):
+        stk = self._create_stack('stack_snapshot_exceeds_max')
+        mock_load.return_value = stk
+
+        cfg.CONF.set_override('max_snapshots_per_stack', 0)
+        ex = self.assertRaises(dispatcher.ExpectedException,
+                               self.engine.stack_snapshot,
+                               self.ctx, stk.identifier(), 'snap_none')
+        self.assertEqual(exception.RequestLimitExceeded, ex.exc_info[0])
+        self.assertIn("You have reached the maximum snapshots per stack",
+                      str(ex.exc_info[1]))
+
+    @mock.patch.object(stack.Stack, 'load')
     def test_create_snapshot_action_in_progress(self, mock_load):
         stack_name = 'stack_snapshot_action_in_progress'
         stk = self._create_stack(stack_name)
diff --git a/heat/tests/engine/test_resource_type.py b/heat/tests/engine/test_resource_type.py
index eab8ea8..ff23e70 100644
--- a/heat/tests/engine/test_resource_type.py
+++ b/heat/tests/engine/test_resource_type.py
@@ -42,8 +42,7 @@ class ResourceTypeTest(common.HeatTestCase):
                                             mock_is_service_available):
         mock_is_service_available.return_value = (True, None)
         resources = self.eng.list_resource_types(self.ctx, "DEPRECATED")
-        self.assertEqual(set(['OS::Aodh::Alarm']),
-                         set(resources))
+        self.assertIn('OS::Aodh::Alarm', resources)
 
     @mock.patch.object(res.Resource, 'is_service_available')
     def test_list_resource_types_supported(self,
diff --git a/heat/tests/openstack/aodh/test_alarm.py b/heat/tests/openstack/aodh/test_alarm.py
index 48b756f..609cc9d 100644
--- a/heat/tests/openstack/aodh/test_alarm.py
+++ b/heat/tests/openstack/aodh/test_alarm.py
@@ -16,6 +16,12 @@ import copy
 import json
 from unittest import mock
 
+try:
+    import zoneinfo
+except ImportError:
+    # zoneinfo is available in Python >= 3.9
+    zoneinfo = None
+
 from heat.common import exception
 from heat.common import template_format
 from heat.engine.clients.os import aodh
@@ -579,11 +585,14 @@ class AodhAlarmTest(common.HeatTestCase):
             exception.ResourceFailure,
             scheduler.TaskRunner(rsrc.update, snippet)
         )
+        err = timezone
+        if zoneinfo:
+            err = "No time zone found with key %s" % timezone
         self.assertEqual(
             "StackValidationFailed: resources.MEMAlarmHigh: Property error: "
             "Properties.time_constraints[0].timezone: Error "
             "validating value '%s': Invalid timezone: '%s'"
-            % (timezone, timezone),
+            % (timezone, err),
             error.message)
 
     def test_alarm_live_state(self):
diff --git a/heat/tests/openstack/heat/test_none_resource.py b/heat/tests/openstack/heat/test_none_resource.py
index 7344b36..28e0879 100644
--- a/heat/tests/openstack/heat/test_none_resource.py
+++ b/heat/tests/openstack/heat/test_none_resource.py
@@ -76,7 +76,7 @@ outputs:
         before_refid = self.rsrc.FnGetRefId()
         self.assertIsNotNone(before_refid)
         new_t = self.t.copy()
-        del(new_t['resources']['none']['properties']['ignored'])
+        del new_t['resources']['none']['properties']['ignored']
         utils.update_stack(self.stack, new_t)
         self.assertEqual((self.stack.UPDATE, self.stack.COMPLETE),
                          self.stack.state)
diff --git a/heat/tests/openstack/heat/test_remote_stack.py b/heat/tests/openstack/heat/test_remote_stack.py
index b5df410..bbfb0e3 100644
--- a/heat/tests/openstack/heat/test_remote_stack.py
+++ b/heat/tests/openstack/heat/test_remote_stack.py
@@ -368,7 +368,7 @@ class RemoteStackTest(tests_common.HeatTestCase):
             ca_cert=ca_cert)
         self.assertEqual(ca_cert, rsrc._cacert)
         self.assertEqual(ca_cert, rsrc.cacert)
-        self.assertTrue('/tmp/' in rsrc._ssl_verify)
+        self.assertIn('/tmp/', rsrc._ssl_verify)
 
     def test_create_with_insecure(self):
         rsrc = self._create_with_remote_credential(insecure=True)
diff --git a/heat/tests/openstack/heat/test_software_deployment.py b/heat/tests/openstack/heat/test_software_deployment.py
index 307ec57..db9cf50 100644
--- a/heat/tests/openstack/heat/test_software_deployment.py
+++ b/heat/tests/openstack/heat/test_software_deployment.py
@@ -1318,7 +1318,7 @@ class SoftwareDeploymentTest(common.HeatTestCase):
              mock.call('swift_signal_url')],
             self.deployment.data_delete.mock_calls)
 
-        del(dep_data['swift_signal_object_name'])
+        del dep_data['swift_signal_object_name']
         self.deployment.physical_resource_name = mock.Mock()
         self.deployment._delete_swift_signal_url()
         self.assertFalse(self.deployment.physical_resource_name.called)
diff --git a/heat/tests/openstack/neutron/test_neutron_floating_ip.py b/heat/tests/openstack/neutron/test_neutron_floating_ip.py
index 6915c10..2ffdf1d 100644
--- a/heat/tests/openstack/neutron/test_neutron_floating_ip.py
+++ b/heat/tests/openstack/neutron/test_neutron_floating_ip.py
@@ -156,10 +156,10 @@ class NeutronFloatingIPTest(common.HeatTestCase):
                     raise ex
 
             def find_network_port(self, value):
-                return('9c1eb3fe-7bba-479d-bd43-fdb0bc7cd151')
+                return '9c1eb3fe-7bba-479d-bd43-fdb0bc7cd151'
 
             def find_network_ip(self, value):
-                return('477e8273-60a7-4c41-b683-1d497e53c384')
+                return '477e8273-60a7-4c41-b683-1d497e53c384'
 
         self.ctx = utils.dummy_context()
         tpl = template_format.parse(neutron_floating_template)
@@ -694,7 +694,7 @@ class NeutronFloatingIPTest(common.HeatTestCase):
 
         # test update FloatingIp with None port_id
         props = copy.deepcopy(fip.properties.data)
-        del(props['port_id'])
+        del props['port_id']
         update_snippet = rsrc_defn.ResourceDefinition(fip.name, fip.type(),
                                                       stack.t.parse(stack.defn,
                                                                     props))
diff --git a/heat/tests/test_common_context.py b/heat/tests/test_common_context.py
index 95a08ec..91401d2 100644
--- a/heat/tests/test_common_context.py
+++ b/heat/tests/test_common_context.py
@@ -125,7 +125,7 @@ class TestRequestContext(common.HeatTestCase):
             user_domain_id=ctx_origin.get('user_domain_id'),
             project_domain_id=ctx_origin.get('project_domain_id'))
         ctx_dict = ctx.to_dict()
-        del(ctx_dict['request_id'])
+        del ctx_dict['request_id']
         self.assertEqual(ctx_origin, ctx_dict)
 
     def test_request_context_from_dict(self):
diff --git a/heat/tests/test_convg_stack.py b/heat/tests/test_convg_stack.py
index c001af1..722da9a 100644
--- a/heat/tests/test_convg_stack.py
+++ b/heat/tests/test_convg_stack.py
@@ -549,14 +549,14 @@ class StackConvergenceCreateUpdateDeleteTest(common.HeatTestCase):
 
         # Ensure that snapshot is not deleted on stack update
         stack.converge_stack(template=stack.t, action=stack.UPDATE)
-        db_snapshot_obj = snapshot_objects.Snapshot.get_all(
+        db_snapshot_obj = snapshot_objects.Snapshot.get_all_by_stack(
             stack.context, stack.id)
         self.assertEqual('fake_snapshot', db_snapshot_obj[0].name)
         self.assertEqual(stack.id, db_snapshot_obj[0].stack_id)
 
         # Ensure that snapshot is deleted on stack delete
         stack.converge_stack(template=stack.t, action=stack.DELETE)
-        self.assertEqual([], snapshot_objects.Snapshot.get_all(
+        self.assertEqual([], snapshot_objects.Snapshot.get_all_by_stack(
             stack.context, stack.id))
         self.assertTrue(mock_cr.called)
 
diff --git a/heat/tests/test_environment.py b/heat/tests/test_environment.py
index 6de00dc..de39e15 100644
--- a/heat/tests/test_environment.py
+++ b/heat/tests/test_environment.py
@@ -12,7 +12,6 @@
 #    under the License.
 
 import os.path
-import sys
 from unittest import mock
 
 import fixtures
@@ -47,7 +46,7 @@ class EnvironmentTest(common.HeatTestCase):
                     u'resource_registry': {u'resources': {}}}
         env = environment.Environment(old)
         self.assertEqual(expected, env.env_as_dict())
-        del(expected['encrypted_param_names'])
+        del expected['encrypted_param_names']
         self.assertEqual(expected, env.user_env_as_dict())
 
     def test_load_new_env(self):
@@ -59,7 +58,7 @@ class EnvironmentTest(common.HeatTestCase):
                                           u'resources': {}}}
         env = environment.Environment(new_env)
         self.assertEqual(new_env, env.env_as_dict())
-        del(new_env['encrypted_param_names'])
+        del new_env['encrypted_param_names']
         self.assertEqual(new_env, env.user_env_as_dict())
 
     def test_global_registry(self):
@@ -183,7 +182,6 @@ def constraint_mapping():
         plugin_file = os.path.join(plugin_dir.path, 'test.py')
         with open(plugin_file, 'w+') as ef:
             ef.write(constraint_content)
-        self.addCleanup(sys.modules.pop, "heat.engine.plugins.test")
         cfg.CONF.set_override('plugin_dirs', plugin_dir.path)
 
         env = environment.Environment({})
@@ -202,7 +200,6 @@ def constraint_mapping():
         plugin_file = os.path.join(plugin_dir.path, 'test.py')
         with open(plugin_file, 'w+') as ef:
             ef.write(constraint_content)
-        self.addCleanup(sys.modules.pop, "heat.engine.plugins.test")
         cfg.CONF.set_override('plugin_dirs', plugin_dir.path)
 
         env = environment.Environment({})
diff --git a/heat/tests/test_loguserdata.py b/heat/tests/test_loguserdata.py
index 7bb1700..09b214a 100644
--- a/heat/tests/test_loguserdata.py
+++ b/heat/tests/test_loguserdata.py
@@ -21,68 +21,8 @@ from heat.cloudinit import loguserdata
 from heat.tests import common
 
 
-class FakeCiVersion(object):
-    def __init__(self, version):
-        self.version = version
-
-
 class LoguserdataTest(common.HeatTestCase):
 
-    @mock.patch('pkg_resources.get_distribution')
-    def test_ci_version_with_pkg_resources(self, mock_get):
-        # Setup
-        returned_versions = [
-            FakeCiVersion('0.5.0'),
-            FakeCiVersion('0.5.9'),
-            FakeCiVersion('0.6.0'),
-            FakeCiVersion('0.7.0'),
-            FakeCiVersion('1.0'),
-            FakeCiVersion('2.0'),
-        ]
-        mock_get.side_effect = returned_versions
-
-        # Test & Verify
-        self.assertFalse(loguserdata.chk_ci_version())
-        self.assertFalse(loguserdata.chk_ci_version())
-        self.assertTrue(loguserdata.chk_ci_version())
-        self.assertTrue(loguserdata.chk_ci_version())
-        self.assertTrue(loguserdata.chk_ci_version())
-        self.assertTrue(loguserdata.chk_ci_version())
-        self.assertEqual(6, mock_get.call_count)
-
-    @mock.patch('pkg_resources.get_distribution')
-    @mock.patch('subprocess.Popen')
-    def test_ci_version_with_subprocess(self, mock_popen,
-                                        mock_get_distribution):
-        # Setup
-        mock_get_distribution.side_effect = Exception()
-
-        popen_return = [
-            [None, 'cloud-init 0.0.5\n'],
-            [None, 'cloud-init 0.7.5\n'],
-        ]
-        mock_popen.return_value = mock.MagicMock()
-        mock_popen.return_value.communicate.side_effect = popen_return
-
-        # Test & Verify
-        self.assertFalse(loguserdata.chk_ci_version())
-        self.assertTrue(loguserdata.chk_ci_version())
-        self.assertEqual(2, mock_get_distribution.call_count)
-
-    @mock.patch('pkg_resources.get_distribution')
-    @mock.patch('subprocess.Popen')
-    def test_ci_version_with_subprocess_exception(self, mock_popen,
-                                                  mock_get_distribution):
-        # Setup
-        mock_get_distribution.side_effect = Exception()
-        mock_popen.return_value = mock.MagicMock()
-        mock_popen.return_value.communicate.return_value = ['non-empty',
-                                                            'irrelevant']
-
-        # Test
-        self.assertRaises(Exception, loguserdata.chk_ci_version)  # noqa
-        self.assertEqual(1, mock_get_distribution.call_count)
-
     @mock.patch('subprocess.Popen')
     def test_call(self, mock_popen):
         # Setup
@@ -141,12 +81,10 @@ class LoguserdataTest(common.HeatTestCase):
         # Verify
         self.assertEqual(os.EX_SOFTWARE, return_code)
 
-    @mock.patch('pkg_resources.get_distribution')
     @mock.patch('os.chmod')
     @mock.patch('heat.cloudinit.loguserdata.call')
-    def test_main(self, mock_call, mock_chmod, mock_get):
+    def test_main(self, mock_call, mock_chmod):
         # Setup
-        mock_get.return_value = FakeCiVersion('1.0')
         mock_call.return_value = 10
 
         # Test
@@ -156,14 +94,3 @@ class LoguserdataTest(common.HeatTestCase):
         expected_path = os.path.join(loguserdata.VAR_PATH, 'cfn-userdata')
         mock_chmod.assert_called_once_with(expected_path, int('700', 8))
         self.assertEqual(10, return_code)
-
-    @mock.patch('pkg_resources.get_distribution')
-    def test_main_failed_ci_version(self, mock_get):
-        # Setup
-        mock_get.return_value = FakeCiVersion('0.0.0')
-
-        # Test
-        return_code = loguserdata.main()
-
-        # Verify
-        self.assertEqual(-1, return_code)
diff --git a/heat/tests/test_resource.py b/heat/tests/test_resource.py
index d360916..231d728 100644
--- a/heat/tests/test_resource.py
+++ b/heat/tests/test_resource.py
@@ -4092,8 +4092,8 @@ class ResourceAvailabilityTest(common.HeatTestCase):
             service_type='test_type',
             service_name=(generic_rsrc.ResourceWithDefaultClientName
                           .default_client_name))
-        mock_client_plugin.has_extension.has_calls(
-            [('foo'), ('bar')])
+        mock_client_plugin.has_extension.assert_has_calls(
+            [mock.call('foo'), mock.call('bar')])
 
     @mock.patch.object(clients.OpenStackClients, 'client_plugin')
     def test_service_deployed_required_extension_true_list(
@@ -4118,8 +4118,8 @@ class ResourceAvailabilityTest(common.HeatTestCase):
             service_type='test_type',
             service_name=(generic_rsrc.ResourceWithDefaultClientName
                           .default_client_name))
-        mock_client_plugin.has_extension.has_calls(
-            [('foo'), ('bar')])
+        mock_client_plugin.has_extension.assert_has_calls(
+            [mock.call('foo'), mock.call('bar')])
 
     @mock.patch.object(clients.OpenStackClients, 'client_plugin')
     def test_service_deployed_required_extension_true_list_fail(
@@ -4144,8 +4144,8 @@ class ResourceAvailabilityTest(common.HeatTestCase):
             service_type='test_type',
             service_name=(generic_rsrc.ResourceWithDefaultClientName
                           .default_client_name))
-        mock_client_plugin.has_extension.has_calls(
-            [('foo'), ('bar')])
+        mock_client_plugin.has_extension.assert_has_calls(
+            [mock.call('foo'), mock.call('bar')])
 
 
 class TestLiveStateUpdate(common.HeatTestCase):
diff --git a/heat/tests/test_stack_delete.py b/heat/tests/test_stack_delete.py
index 51fb26a..d509ed2 100644
--- a/heat/tests/test_stack_delete.py
+++ b/heat/tests/test_stack_delete.py
@@ -73,7 +73,7 @@ class StackTest(common.HeatTestCase):
         }
         snapshot_object.Snapshot.create(self.ctx, snapshot_fake)
 
-        self.assertIsNotNone(snapshot_object.Snapshot.get_all(
+        self.assertIsNotNone(snapshot_object.Snapshot.get_all_by_stack(
             self.ctx, stack_id))
 
         self.stack.delete()
@@ -81,7 +81,7 @@ class StackTest(common.HeatTestCase):
         self.assertIsNone(db_s)
         self.assertEqual((stack.Stack.DELETE, stack.Stack.COMPLETE),
                          self.stack.state)
-        self.assertEqual([], snapshot_object.Snapshot.get_all(
+        self.assertEqual([], snapshot_object.Snapshot.get_all_by_stack(
             self.ctx, stack_id))
 
     def test_delete_with_snapshot_after_stack_add_resource(self):
@@ -104,7 +104,7 @@ class StackTest(common.HeatTestCase):
         }
         snapshot_object.Snapshot.create(self.ctx, snapshot_fake)
 
-        self.assertIsNotNone(snapshot_object.Snapshot.get_all(
+        self.assertIsNotNone(snapshot_object.Snapshot.get_all_by_stack(
             self.ctx, stack_id))
 
         new_tmpl = {'heat_template_version': 'queens',
@@ -121,7 +121,7 @@ class StackTest(common.HeatTestCase):
         self.assertIsNone(db_s)
         self.assertEqual((stack.Stack.DELETE, stack.Stack.COMPLETE),
                          self.stack.state)
-        self.assertEqual([], snapshot_object.Snapshot.get_all(
+        self.assertEqual([], snapshot_object.Snapshot.get_all_by_stack(
             self.ctx, stack_id))
 
     def test_delete_user_creds(self):
diff --git a/heat/tests/test_template_format.py b/heat/tests/test_template_format.py
index 3ce127c..aeb2368 100644
--- a/heat/tests/test_template_format.py
+++ b/heat/tests/test_template_format.py
@@ -56,12 +56,12 @@ class JsonToYamlTest(common.HeatTestCase):
 
         self.assertEqual(u'2012-12-12', yml[u'HeatTemplateFormatVersion'])
         self.assertNotIn(u'AWSTemplateFormatVersion', yml)
-        del(yml[u'HeatTemplateFormatVersion'])
+        del yml[u'HeatTemplateFormatVersion']
 
         jsn = template_format.parse(json_str)
 
         if u'AWSTemplateFormatVersion' in jsn:
-            del(jsn[u'AWSTemplateFormatVersion'])
+            del jsn[u'AWSTemplateFormatVersion']
 
         self.assertEqual(yml, jsn)
 
@@ -189,7 +189,7 @@ class JsonYamlResolvedCompareTest(common.HeatTestCase):
     def compare_stacks(self, json_file, yaml_file, parameters):
         t1 = self.load_template(json_file)
         t2 = self.load_template(yaml_file)
-        del(t1[u'AWSTemplateFormatVersion'])
+        del t1[u'AWSTemplateFormatVersion']
         t1[u'HeatTemplateFormatVersion'] = t2[u'HeatTemplateFormatVersion']
         stack1 = utils.parse_stack(t1, parameters)
         stack2 = utils.parse_stack(t2, parameters)
@@ -197,10 +197,10 @@ class JsonYamlResolvedCompareTest(common.HeatTestCase):
         # compare resources separately so that resolved static data
         # is compared
         t1nr = dict(stack1.t.t)
-        del(t1nr['Resources'])
+        del t1nr['Resources']
 
         t2nr = dict(stack2.t.t)
-        del(t2nr['Resources'])
+        del t2nr['Resources']
         self.assertEqual(t1nr, t2nr)
 
         self.assertEqual(set(stack1), set(stack2))
diff --git a/openstack_heat.egg-info/PKG-INFO b/openstack_heat.egg-info/PKG-INFO
index d68f1ed..9541147 100644
--- a/openstack_heat.egg-info/PKG-INFO
+++ b/openstack_heat.egg-info/PKG-INFO
@@ -1,10 +1,93 @@
-Metadata-Version: 2.1
+Metadata-Version: 1.2
 Name: openstack-heat
-Version: 21.1.0.dev70
+Version: 22.0.0.0rc1
 Summary: OpenStack Orchestration
 Home-page: https://docs.openstack.org/heat/latest/
 Author: OpenStack
 Author-email: [e-mail]
+License: UNKNOWN
+Description: ========================
+        Team and repository tags
+        ========================
+        
+        .. image:: https://governance.openstack.org/tc/badges/heat.svg
+            :target: https://governance.openstack.org/tc/reference/tags/index.html
+        
+        .. Change things from this point on
+        
+        ====
+        Heat
+        ====
+        
+        Heat is a service to orchestrate multiple composite cloud applications using
+        templates, through both an OpenStack-native REST API and a
+        CloudFormation-compatible Query API.
+        
+        Why heat? It makes the clouds rise and keeps them there.
+        
+        Getting Started
+        ---------------
+        
+        If you'd like to run from the master branch, you can clone the git repo:
+        
+            git clone https://opendev.org/openstack/heat
+        
+        
+        * Documentation: https://docs.openstack.org/heat/latest
+        * Template samples: https://opendev.org/openstack/heat-templates
+        * Agents: https://opendev.org/openstack/heat-agents
+        * Release Notes: https://docs.openstack.org/releasenotes/heat/
+        
+        Python client
+        -------------
+        
+        * Documentation: https://docs.openstack.org/python-heatclient/latest
+        * Source: https://opendev.org/openstack/python-heatclient
+        
+        Report a Story (a bug/blueprint)
+        --------------------------------
+        
+        If you'd like to report a Story (we used to call a bug/blueprint), you can
+        report it under Report a story in
+        `Heat's StoryBoard <https://storyboard.openstack.org/#!/project/989>`_.
+        If you must report the story under other sub-project of heat, you can find
+        them all in `Heat StoryBoard Group <https://storyboard.openstack.org/#!/project_group/82>`_.
+        if you encounter any issue.
+        
+        References
+        ----------
+        * https://docs.amazonwebservices.com/AWSCloudFormation/latest/APIReference/API_CreateStack.html
+        * https://docs.amazonwebservices.com/AWSCloudFormation/latest/UserGuide/create-stack.html
+        * https://docs.amazonwebservices.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html
+        * https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=tosca
+        
+        We have integration with
+        ------------------------
+        * https://opendev.org/openstack/python-novaclient (instance)
+        * https://opendev.org/openstack/python-keystoneclient (auth)
+        * https://opendev.org/openstack/python-swiftclient (object storage)
+        * https://opendev.org/openstack/python-neutronclient (networking)
+        * https://opendev.org/openstack/python-aodhclient (alarming service)
+        * https://opendev.org/openstack/python-cinderclient (block storage)
+        * https://opendev.org/openstack/python-glanceclient (image service)
+        * https://opendev.org/openstack/python-troveclient (database as a Service)
+        * https://opendev.org/openstack/python-saharaclient (hadoop cluster)
+        * https://opendev.org/openstack/python-barbicanclient (key management service)
+        * https://opendev.org/openstack/python-designateclient (DNS service)
+        * https://opendev.org/openstack/python-magnumclient (container service)
+        * https://opendev.org/openstack/python-manilaclient (shared file system service)
+        * https://opendev.org/openstack/python-mistralclient (workflow service)
+        * https://opendev.org/openstack/python-zaqarclient (messaging service)
+        * https://opendev.org/openstack/python-monascaclient (monitoring service)
+        * https://opendev.org/openstack/python-zunclient (container management service)
+        * https://opendev.org/openstack/python-blazarclient (reservation service)
+        * https://opendev.org/openstack/python-octaviaclient.git (Load-balancer service)
+        * https://opendev.org/openstack/python-senlinclient (Clustering service)
+        * https://opendev.org/openstack/python-vitrageclient.git (RCA service)
+        * https://opendev.org/openstack/python-ironicclient (baremetal provisioning service)
+        
+        
+Platform: UNKNOWN
 Classifier: Environment :: OpenStack
 Classifier: Intended Audience :: Information Technology
 Classifier: Intended Audience :: System Administrators
@@ -18,85 +101,3 @@ Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Requires-Python: >=3.8
-License-File: LICENSE
-
-========================
-Team and repository tags
-========================
-
-.. image:: https://governance.openstack.org/tc/badges/heat.svg
-    :target: https://governance.openstack.org/tc/reference/tags/index.html
-
-.. Change things from this point on
-
-====
-Heat
-====
-
-Heat is a service to orchestrate multiple composite cloud applications using
-templates, through both an OpenStack-native REST API and a
-CloudFormation-compatible Query API.
-
-Why heat? It makes the clouds rise and keeps them there.
-
-Getting Started
----------------
-
-If you'd like to run from the master branch, you can clone the git repo:
-
-    git clone https://opendev.org/openstack/heat
-
-
-* Documentation: https://docs.openstack.org/heat/latest
-* Template samples: https://opendev.org/openstack/heat-templates
-* Agents: https://opendev.org/openstack/heat-agents
-* Release Notes: https://docs.openstack.org/releasenotes/heat/
-
-Python client
--------------
-
-* Documentation: https://docs.openstack.org/python-heatclient/latest
-* Source: https://opendev.org/openstack/python-heatclient
-
-Report a Story (a bug/blueprint)
---------------------------------
-
-If you'd like to report a Story (we used to call a bug/blueprint), you can
-report it under Report a story in
-`Heat's StoryBoard <https://storyboard.openstack.org/#!/project/989>`_.
-If you must report the story under other sub-project of heat, you can find
-them all in `Heat StoryBoard Group <https://storyboard.openstack.org/#!/project_group/82>`_.
-if you encounter any issue.
-
-References
-----------
-* https://docs.amazonwebservices.com/AWSCloudFormation/latest/APIReference/API_CreateStack.html
-* https://docs.amazonwebservices.com/AWSCloudFormation/latest/UserGuide/create-stack.html
-* https://docs.amazonwebservices.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html
-* https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=tosca
-
-We have integration with
-------------------------
-* https://opendev.org/openstack/python-novaclient (instance)
-* https://opendev.org/openstack/python-keystoneclient (auth)
-* https://opendev.org/openstack/python-swiftclient (object storage)
-* https://opendev.org/openstack/python-neutronclient (networking)
-* https://opendev.org/openstack/python-aodhclient (alarming service)
-* https://opendev.org/openstack/python-cinderclient (block storage)
-* https://opendev.org/openstack/python-glanceclient (image service)
-* https://opendev.org/openstack/python-troveclient (database as a Service)
-* https://opendev.org/openstack/python-saharaclient (hadoop cluster)
-* https://opendev.org/openstack/python-barbicanclient (key management service)
-* https://opendev.org/openstack/python-designateclient (DNS service)
-* https://opendev.org/openstack/python-magnumclient (container service)
-* https://opendev.org/openstack/python-manilaclient (shared file system service)
-* https://opendev.org/openstack/python-mistralclient (workflow service)
-* https://opendev.org/openstack/python-zaqarclient (messaging service)
-* https://opendev.org/openstack/python-monascaclient (monitoring service)
-* https://opendev.org/openstack/python-zunclient (container management service)
-* https://opendev.org/openstack/python-blazarclient (reservation service)
-* https://opendev.org/openstack/python-octaviaclient.git (Load-balancer service)
-* https://opendev.org/openstack/python-senlinclient (Clustering service)
-* https://opendev.org/openstack/python-vitrageclient.git (RCA service)
-* https://opendev.org/openstack/python-ironicclient (baremetal provisioning service)
-
diff --git a/openstack_heat.egg-info/SOURCES.txt b/openstack_heat.egg-info/SOURCES.txt
index adfe427..04faf9d 100644
--- a/openstack_heat.egg-info/SOURCES.txt
+++ b/openstack_heat.egg-info/SOURCES.txt
@@ -1144,6 +1144,7 @@ releasenotes/notes/delay-resource-7d44c512081026c8.yaml
 releasenotes/notes/delay-resource-e20ba61f31799f6e.yaml
 releasenotes/notes/deployment-swift-data-server-property-51fd4f9d1671fc90.yaml
 releasenotes/notes/deprecate-heat-manage-migrate_properties_data-command-754c94ef87626a82.yaml
+releasenotes/notes/deprecate-inactive-project-rsc-caracal-ba0b0005f67580f9.yaml
 releasenotes/notes/deprecate-json-formatted-policy-file-ac2f98b31ece0baf.yaml
 releasenotes/notes/deprecate-nova-floatingip-resources-d5c9447a199be402.yaml
 releasenotes/notes/deprecate-nova-quota-injected_file-properties-6c6fd7f5231e4c40.yaml
@@ -1190,6 +1191,7 @@ releasenotes/notes/know-limit-releasenote-4d21fc4d91d136d9.yaml
 releasenotes/notes/lbaasv2-hidden-a8f82ddfdba911eb.yaml
 releasenotes/notes/legacy-client-races-ba7a60cef5ec1694.yaml
 releasenotes/notes/legacy-stack-user-id-cebbad8b0f2ed490.yaml
+releasenotes/notes/limit-resources-aeb2f24e705840de.yaml
 releasenotes/notes/magnum-resource-update-0f617eec45ef8ef7.yaml
 releasenotes/notes/make_url-function-d76737adb1e54801.yaml
 releasenotes/notes/manual-rollback-failed-replacement-08ebb9271617fe9d.yaml
diff --git a/openstack_heat.egg-info/entry_points.txt b/openstack_heat.egg-info/entry_points.txt
index 46a5aef..f3bb439 100644
--- a/openstack_heat.egg-info/entry_points.txt
+++ b/openstack_heat.egg-info/entry_points.txt
@@ -117,6 +117,9 @@ zaqar.queue = heat.engine.clients.os.zaqar:QueueConstraint
 [heat.event_sinks]
 zaqar-queue = heat.engine.clients.os.zaqar:ZaqarEventSink
 
+[heat.stack_lifecycle_plugins]
+
+
 [heat.templates]
 AWSTemplateFormatVersion.2010-09-09 = heat.engine.cfn.template:CfnTemplate
 HeatTemplateFormatVersion.2012-12-12 = heat.engine.cfn.template:HeatTemplate
@@ -140,12 +143,14 @@ heat_template_version.wallaby = heat.engine.hot.template:HOTemplate20210416
 
 [oslo.config.opts]
 heat.api.aws.ec2token = heat.api.aws.ec2token:list_opts
+heat.common.cache = heat.common.cache:list_opts
 heat.common.config = heat.common.config:list_opts
 heat.common.context = heat.common.context:list_opts
 heat.common.crypt = heat.common.crypt:list_opts
 heat.common.wsgi = heat.common.wsgi:list_opts
 heat.engine.clients = heat.engine.clients:list_opts
 heat.engine.clients.os.keystone.heat_keystoneclient = heat.engine.clients.os.keystone.heat_keystoneclient:list_opts
+heat.engine.hot.functions = heat.engine.hot.functions:list_opts
 heat.engine.notification = heat.engine.notification:list_opts
 heat.engine.resources = heat.engine.resources:list_opts
 heat_integrationtests.common.config = heat_integrationtests.common.config:list_opts
@@ -162,3 +167,4 @@ heat = heat.policies:list_rules
 [wsgi_scripts]
 heat-wsgi-api = heat.httpd.heat_api:init_application
 heat-wsgi-api-cfn = heat.httpd.heat_api_cfn:init_application
+
diff --git a/openstack_heat.egg-info/pbr.json b/openstack_heat.egg-info/pbr.json
index a9140ec..3a193c6 100644
--- a/openstack_heat.egg-info/pbr.json
+++ b/openstack_heat.egg-info/pbr.json
@@ -1 +1 @@
-{"git_version": "2df46d4c5", "is_release": false}
\ No newline at end of file
+{"git_version": "8892f32a2", "is_release": true}
\ No newline at end of file
diff --git a/openstack_heat.egg-info/requires.txt b/openstack_heat.egg-info/requires.txt
index 0f71ad6..481fafb 100644
--- a/openstack_heat.egg-info/requires.txt
+++ b/openstack_heat.egg-info/requires.txt
@@ -55,8 +55,13 @@ python-troveclient>=2.2.0
 python-vitrageclient>=2.7.0
 python-zaqarclient>=1.3.0
 python-zunclient>=3.4.0
-pytz>=2013.6
 requests>=2.23.0
 stevedore>=3.1.0
 tenacity>=6.1.0
 yaql>=1.1.3
+
+[:(python_version<"3.9")]
+pytz>=2013.6
+
+[:(python_version>="3.9")]
+tzdata>=2022.4
diff --git a/releasenotes/config.yaml b/releasenotes/config.yaml
index 225dc0e..d72ed66 100644
--- a/releasenotes/config.yaml
+++ b/releasenotes/config.yaml
@@ -1,4 +1,4 @@
 ---
 branch_name_re: '^stable/\w+$'
 release_tag_re: '((?:[\d.ab]|rc)+)'
-closed_branch_tag_re: '^(\w+)-eol$'
+closed_branch_tag_re: '^(\w+)-eo[lm]$'
diff --git a/releasenotes/notes/deprecate-inactive-project-rsc-caracal-ba0b0005f67580f9.yaml b/releasenotes/notes/deprecate-inactive-project-rsc-caracal-ba0b0005f67580f9.yaml
new file mode 100644
index 0000000..edfa948
--- /dev/null
+++ b/releasenotes/notes/deprecate-inactive-project-rsc-caracal-ba0b0005f67580f9.yaml
@@ -0,0 +1,10 @@
+---
+deprecations:
+  - |
+    The following resources have been deprecated, because monasca, sahara and
+    senlin were marked inactive and will not get deliverables for the 2024.1
+    release. These resources will be removed in ``23.0.0`` release.
+
+    - ``OS::Monasca::*``
+    - ``OS::Sahara::*``
+    - ``OS::Senlin::*``
diff --git a/releasenotes/notes/limit-resources-aeb2f24e705840de.yaml b/releasenotes/notes/limit-resources-aeb2f24e705840de.yaml
new file mode 100644
index 0000000..7e9a02b
--- /dev/null
+++ b/releasenotes/notes/limit-resources-aeb2f24e705840de.yaml
@@ -0,0 +1,26 @@
+---
+features:
+  - |
+    Heat now supports limiting number of software configs, software
+    deployments, stack snapshots which users can create, by the following
+    config options. These limits are not enforced for users with admin role.
+
+    - ``[DEFAULT] max_software_configis_per_tenant``
+    - ``[DEFAULT] max_software_deployments_per_tenant``
+    - ``[DEFAULT] max_snapshots_per_stack``
+
+upgrade:
+  - |
+    Now the following limits are enforced by default, unless a request user
+    has admin role.
+
+    - Maximum number of software configs per project is 4096
+    - Maximum number of software deployments per project is 4096
+    - Maximum number of stack snapshots per tenant is 32
+
+    Set the following options in case the limits should be increased. Limits
+    can be disabled by setting -1 to these options.
+
+    - ``[DEFAULT] max_software_configis_per_tenant``
+    - ``[DEFAULT] max_software_deployments_per_tenant``
+    - ``[DEFAULT] max_snapshots_per_stack``
diff --git a/releasenotes/source/victoria.rst b/releasenotes/source/victoria.rst
index 4efc7b6..8ce9334 100644
--- a/releasenotes/source/victoria.rst
+++ b/releasenotes/source/victoria.rst
@@ -3,4 +3,4 @@ Victoria Series Release Notes
 =============================
 
 .. release-notes::
-   :branch: stable/victoria
+   :branch: unmaintained/victoria
diff --git a/releasenotes/source/wallaby.rst b/releasenotes/source/wallaby.rst
index d77b565..bcf35c5 100644
--- a/releasenotes/source/wallaby.rst
+++ b/releasenotes/source/wallaby.rst
@@ -3,4 +3,4 @@ Wallaby Series Release Notes
 ============================
 
 .. release-notes::
-   :branch: stable/wallaby
+   :branch: unmaintained/wallaby
diff --git a/releasenotes/source/xena.rst b/releasenotes/source/xena.rst
index 1be85be..d19eda4 100644
--- a/releasenotes/source/xena.rst
+++ b/releasenotes/source/xena.rst
@@ -3,4 +3,4 @@ Xena Series Release Notes
 =========================
 
 .. release-notes::
-   :branch: stable/xena
+   :branch: unmaintained/xena
diff --git a/releasenotes/source/yoga.rst b/releasenotes/source/yoga.rst
index 7cd5e90..43cafde 100644
--- a/releasenotes/source/yoga.rst
+++ b/releasenotes/source/yoga.rst
@@ -3,4 +3,4 @@ Yoga Series Release Notes
 =========================
 
 .. release-notes::
-   :branch: stable/yoga
+   :branch: unmaintained/yoga
diff --git a/requirements.txt b/requirements.txt
index 04ebf4e..f25280d 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -51,10 +51,11 @@ python-troveclient>=2.2.0 # Apache-2.0
 python-vitrageclient>=2.7.0 # Apache-2.0
 python-zaqarclient>=1.3.0 # Apache-2.0
 python-zunclient>=3.4.0 # Apache-2.0
-pytz>=2013.6 # MIT
+pytz>=2013.6;python_version<"3.9" # MIT
 PyYAML>=5.1 # MIT
 requests>=2.23.0 # Apache-2.0
 tenacity>=6.1.0 # Apache-2.0
+tzdata>=2022.4;python_version>="3.9" # MIT
 Routes>=2.3.1 # MIT
 SQLAlchemy>=1.4.0 # MIT
 stevedore>=3.1.0 # Apache-2.0
diff --git a/setup.cfg b/setup.cfg
index b89a99c..8e8cf4e 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -47,10 +47,12 @@ wsgi_scripts =
 	heat-wsgi-api = heat.httpd.heat_api:init_application
 	heat-wsgi-api-cfn = heat.httpd.heat_api_cfn:init_application
 oslo.config.opts = 
+	heat.common.cache = heat.common.cache:list_opts
 	heat.common.config = heat.common.config:list_opts
 	heat.common.context = heat.common.context:list_opts
 	heat.common.crypt = heat.common.crypt:list_opts
 	heat.engine.clients.os.keystone.heat_keystoneclient = heat.engine.clients.os.keystone.heat_keystoneclient:list_opts
+	heat.engine.hot.functions = heat.engine.hot.functions:list_opts
 	heat.common.wsgi = heat.common.wsgi:list_opts
 	heat.engine.clients = heat.engine.clients:list_opts
 	heat.engine.notification = heat.engine.notification:list_opts
diff --git a/test-requirements.txt b/test-requirements.txt
index 10f00a0..bea7ec6 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,13 +1,5 @@
-# The order of packages is significant, because pip processes them in the order
-# of appearance. Changing the order has an impact on the overall integration
-# process, which may cause wedges in the gate later.
-
 # Hacking already pins down pep8, pyflakes and flake8
-hacking>=3.0.1,<3.1.0 # Apache-2.0
-# remove this pyflakes from here once you bump the
-# hacking to 3.2.0 or above. hacking 3.2.0 takes
-# care of pyflakes version compatibilty.
-pyflakes>=2.1.1
+hacking>=6.1.0,<6.2.0 # Apache-2.0
 
 bandit!=1.6.0,>=1.1.0 # Apache-2.0
 coverage!=4.4,>=4.0 # Apache-2.0
diff --git a/tox.ini b/tox.ini
index 6cd81ae..7dbbd6c 100644
--- a/tox.ini
+++ b/tox.ini
@@ -101,7 +101,6 @@ deps =
 # The following bandit tests are being skipped:
 # B101: Test for use of assert
 # B104: Test for binding to all interfaces
-# B107: Test for use of hard-coded password argument defaults
 # B110: Try, Except, Pass detected.
 # B113: Requests call without timeout
 # B310: Audit url open for permitted schemes
@@ -112,7 +111,7 @@ deps =
 # B506: Test for use of yaml load
 # B603: Test for use of subprocess with shell equals true
 # B607: Test for starting a process with a partial path
-commands = bandit -r heat -x tests --skip B101,B104,B107,B110,B113,B310,B311,B404,B410,B504,B506,B603,B607
+commands = bandit -r heat -x tests --skip B101,B104,B110,B113,B310,B311,B404,B410,B504,B506,B603,B607
 
 [flake8]
 show-source = true
@@ -132,10 +131,10 @@ import_exceptions = heat.common.i18n
 
 [flake8:local-plugins]
 extension =
-    Heat301 = checks:no_log_warn
-    Heat302 = checks:check_python3_no_iteritems
-    Heat303 = checks:check_python3_no_iterkeys
-    Heat304 = checks:check_python3_no_itervalues
+    HE301 = checks:no_log_warn
+    HE302 = checks:check_python3_no_iteritems
+    HE303 = checks:check_python3_no_iterkeys
+    HE304 = checks:check_python3_no_itervalues
 paths = ./heat/hacking
 
 [testenv:debug]