diff --git a/doc/source/client.rst b/doc/source/client.rst
index 5fe2252..6b62360 100644
--- a/doc/source/client.rst
+++ b/doc/source/client.rst
@@ -28,7 +28,7 @@
 
 Example::
 
-  zuul enqueue --trigger gerrit --pipeline check --project example_project --change 12345,1
+  zuul enqueue --tenant openstack --trigger gerrit --pipeline check --project example_project --change 12345,1
 
 Note that the format of change id is <number>,<patchset>.
 
@@ -38,7 +38,7 @@
 
 Example::
 
-  zuul promote --pipeline check --changes 12345,1 13336,3
+  zuul promote --tenant openstack --pipeline check --changes 12345,1 13336,3
 
 Note that the format of changes id is <number>,<patchset>.
 
diff --git a/doc/source/launchers.rst b/doc/source/launchers.rst
index 78d5839..8a8c932 100644
--- a/doc/source/launchers.rst
+++ b/doc/source/launchers.rst
@@ -273,9 +273,7 @@
   build:FUNCTION_NAME:NODE_NAME
 
 where **NODE_NAME** is the name or class of node on which the job
-should be run.  This can be specified by setting the ZUUL_NODE
-parameter in a parameter-function (see :ref:`includes` section in
-:ref:`zuulconf`).
+should be run.
 
 Zuul sends the ZUUL_* parameters described in `Zuul Parameters`_
 encoded in JSON format as the argument included with the
diff --git a/doc/source/zuul.rst b/doc/source/zuul.rst
index 73a7030..8906dac 100644
--- a/doc/source/zuul.rst
+++ b/doc/source/zuul.rst
@@ -261,26 +261,6 @@
 Zuul should perform.  There are three sections: pipelines, jobs, and
 projects.
 
-.. _includes:
-
-Includes
-""""""""
-
-Custom functions to be used in Zuul's configuration may be provided
-using the ``includes`` directive.  It accepts a list of files to
-include, and currently supports one type of inclusion, a python file::
-
-  includes:
-    - python-file: local_functions.py
-
-**python-file**
-  The path to a python file (either an absolute path or relative to the
-  directory name of :ref:`layout_config <layout_config>`).  The
-  file will be loaded and objects that it defines will be placed in a
-  special environment which can be referenced in the Zuul configuration.
-  Currently only the parameter-function attribute of a Job uses this
-  feature.
-
 Pipelines
 """""""""
 
@@ -805,33 +785,6 @@
 
 **tags (optional)**
   A list of arbitrary strings which will be associated with the job.
-  Can be used by the parameter-function to alter behavior based on
-  their presence on a job.  If the job name is a regular expression,
-  tags will accumulate on jobs that match.
-
-**parameter-function (optional)**
-  Specifies a function that should be applied to the parameters before
-  the job is launched.  The function should be defined in a python file
-  included with the :ref:`includes` directive.  The function
-  should have the following signature:
-
-  .. function:: parameters(item, job, parameters)
-
-     Manipulate the parameters passed to a job before a build is
-     launched.  The ``parameters`` dictionary will already contain the
-     standard Zuul job parameters, and is expected to be modified
-     in-place.
-
-     :param item: the current queue item
-     :type item: zuul.model.QueueItem
-     :param job: the job about to be run
-     :type job: zuul.model.Job
-     :param parameters: parameters to be passed to the job
-     :type parameters: dict
-
-  If the parameter **ZUUL_NODE** is set by this function, then it will
-  be used to specify on what node (or class of node) the job should be
-  run.
 
 **swift**
   If :ref:`swift` is configured then each job can define a destination
diff --git a/tests/fixtures/config/single-tenant/git/common-config/zuul.yaml b/tests/fixtures/config/single-tenant/git/common-config/zuul.yaml
index 0ddb6e5..7f32876 100644
--- a/tests/fixtures/config/single-tenant/git/common-config/zuul.yaml
+++ b/tests/fixtures/config/single-tenant/git/common-config/zuul.yaml
@@ -37,6 +37,16 @@
     precedence: high
 
 - pipeline:
+    name: post
+    manager: independent
+    source:
+      gerrit
+    trigger:
+      gerrit:
+        - event: ref-updated
+          ref: ^(?!refs/).*$
+
+- pipeline:
     name: experimental
     manager: independent
     source:
@@ -67,6 +77,12 @@
         image: image2
 
 - job:
+    name: project-post
+    nodes:
+      - name: static
+        image: ubuntu-xenial
+
+- job:
     name: project-test2
 
 - job:
@@ -90,6 +106,9 @@
             jobs:
               - project-test1
               - project-test2
+    post:
+      jobs:
+        - project-post
 
 - project:
     name: org/project1
diff --git a/tests/fixtures/config/single-tenant/git/layout-irrelevant-files/zuul.yaml b/tests/fixtures/config/single-tenant/git/layout-irrelevant-files/zuul.yaml
new file mode 100644
index 0000000..f243bcc
--- /dev/null
+++ b/tests/fixtures/config/single-tenant/git/layout-irrelevant-files/zuul.yaml
@@ -0,0 +1,27 @@
+- pipeline:
+    name: check
+    manager: independent
+    source:
+      gerrit
+    trigger:
+      gerrit:
+        - event: patchset-created
+    success:
+      gerrit:
+        verified: 1
+    failure:
+      gerrit:
+        verified: -1
+
+
+- job:
+    name: project-test-irrelevant-files
+
+- project:
+    name: org/project
+    check:
+      jobs:
+        - project-test-irrelevant-files:
+            irrelevant-files:
+              - ^README$
+              - ^ignoreme$
diff --git a/tests/fixtures/layout-skip-if.yaml b/tests/fixtures/layout-skip-if.yaml
deleted file mode 100644
index 0cfb445..0000000
--- a/tests/fixtures/layout-skip-if.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-pipelines:
-  - name: check
-    manager: IndependentPipelineManager
-    trigger:
-      gerrit:
-        - event: patchset-created
-    success:
-      gerrit:
-        verified: 1
-    failure:
-      gerrit:
-        verified: -1
-
-
-jobs:
-  # Defining a metajob will validate that the skip-if attribute of the
-  # metajob is correctly copied to the job.
-  - name: ^.*skip-if$
-    skip-if:
-      - project: ^org/project$
-        branch: ^master$
-        all-files-match-any:
-          - ^README$
-  - name: project-test-skip-if
-
-projects:
-  - name: org/project
-    check:
-      - project-test-skip-if
diff --git a/tests/test_model.py b/tests/test_model.py
index fa670a4..0d4c7b6 100644
--- a/tests/test_model.py
+++ b/tests/test_model.py
@@ -136,9 +136,9 @@
             'parent': 'base',
             'timeout': 40,
             'auth': {
-                'password': {
-                    'pypipassword': 'dummypassword'
-                }
+                'secrets': [
+                    'pypi-credentials',
+                ]
             }
         })
         layout.addJob(pypi_upload_without_inherit)
@@ -149,9 +149,9 @@
             'timeout': 40,
             'auth': {
                 'inherit': True,
-                'password': {
-                    'pypipassword': 'dummypassword'
-                }
+                'secrets': [
+                    'pypi-credentials',
+                ]
             }
         })
         layout.addJob(pypi_upload_with_inherit)
@@ -163,9 +163,9 @@
                 'timeout': 40,
                 'auth': {
                     'inherit': False,
-                    'password': {
-                        'pypipassword': 'dummypassword'
-                    }
+                    'secrets': [
+                        'pypi-credentials',
+                    ]
                 }
             })
         layout.addJob(pypi_upload_with_inherit_false)
@@ -190,9 +190,9 @@
         layout.addJob(in_repo_job_with_inherit_false)
 
         self.assertNotIn('auth', in_repo_job_without_inherit.auth)
-        self.assertIn('password', in_repo_job_with_inherit.auth)
-        self.assertEquals(in_repo_job_with_inherit.auth['password'],
-                          {'pypipassword': 'dummypassword'})
+        self.assertIn('secrets', in_repo_job_with_inherit.auth)
+        self.assertEquals(in_repo_job_with_inherit.auth['secrets'],
+                          ['pypi-credentials'])
         self.assertNotIn('auth', in_repo_job_with_inherit_false.auth)
 
     def test_job_inheritance_job_tree(self):
diff --git a/tests/test_requirements.py b/tests/test_requirements.py
index 1cad659..1f179e6 100644
--- a/tests/test_requirements.py
+++ b/tests/test_requirements.py
@@ -16,6 +16,7 @@
 
 import logging
 import time
+from unittest import skip
 
 from tests.base import ZuulTestCase
 
@@ -27,14 +28,13 @@
 class TestRequirements(ZuulTestCase):
     """Test pipeline and trigger requirements"""
 
-    def setUp(self):
-        self.skip("Disabled for early v3 development")
-
+    @skip("Disabled for early v3 development")
     def test_pipeline_require_approval_newer_than(self):
         "Test pipeline requirement: approval newer than"
         return self._test_require_approval_newer_than('org/project1',
                                                       'project1-pipeline')
 
+    @skip("Disabled for early v3 development")
     def test_trigger_require_approval_newer_than(self):
         "Test trigger requirement: approval newer than"
         return self._test_require_approval_newer_than('org/project2',
@@ -68,11 +68,13 @@
         self.assertEqual(len(self.history), 1)
         self.assertEqual(self.history[0].name, job)
 
+    @skip("Disabled for early v3 development")
     def test_pipeline_require_approval_older_than(self):
         "Test pipeline requirement: approval older than"
         return self._test_require_approval_older_than('org/project1',
                                                       'project1-pipeline')
 
+    @skip("Disabled for early v3 development")
     def test_trigger_require_approval_older_than(self):
         "Test trigger requirement: approval older than"
         return self._test_require_approval_older_than('org/project2',
@@ -106,11 +108,13 @@
         self.assertEqual(len(self.history), 1)
         self.assertEqual(self.history[0].name, job)
 
+    @skip("Disabled for early v3 development")
     def test_pipeline_require_approval_username(self):
         "Test pipeline requirement: approval username"
         return self._test_require_approval_username('org/project1',
                                                     'project1-pipeline')
 
+    @skip("Disabled for early v3 development")
     def test_trigger_require_approval_username(self):
         "Test trigger requirement: approval username"
         return self._test_require_approval_username('org/project2',
@@ -137,11 +141,13 @@
         self.assertEqual(len(self.history), 1)
         self.assertEqual(self.history[0].name, job)
 
+    @skip("Disabled for early v3 development")
     def test_pipeline_require_approval_email(self):
         "Test pipeline requirement: approval email"
         return self._test_require_approval_email('org/project1',
                                                  'project1-pipeline')
 
+    @skip("Disabled for early v3 development")
     def test_trigger_require_approval_email(self):
         "Test trigger requirement: approval email"
         return self._test_require_approval_email('org/project2',
@@ -168,11 +174,13 @@
         self.assertEqual(len(self.history), 1)
         self.assertEqual(self.history[0].name, job)
 
+    @skip("Disabled for early v3 development")
     def test_pipeline_require_approval_vote1(self):
         "Test pipeline requirement: approval vote with one value"
         return self._test_require_approval_vote1('org/project1',
                                                  'project1-pipeline')
 
+    @skip("Disabled for early v3 development")
     def test_trigger_require_approval_vote1(self):
         "Test trigger requirement: approval vote with one value"
         return self._test_require_approval_vote1('org/project2',
@@ -205,11 +213,13 @@
         self.assertEqual(len(self.history), 1)
         self.assertEqual(self.history[0].name, job)
 
+    @skip("Disabled for early v3 development")
     def test_pipeline_require_approval_vote2(self):
         "Test pipeline requirement: approval vote with two values"
         return self._test_require_approval_vote2('org/project1',
                                                  'project1-pipeline')
 
+    @skip("Disabled for early v3 development")
     def test_trigger_require_approval_vote2(self):
         "Test trigger requirement: approval vote with two values"
         return self._test_require_approval_vote2('org/project2',
@@ -262,6 +272,7 @@
         self.assertEqual(len(self.history), 2)
         self.assertEqual(self.history[1].name, job)
 
+    @skip("Disabled for early v3 development")
     def test_pipeline_require_current_patchset(self):
         "Test pipeline requirement: current-patchset"
         self.updateConfigLayout(
@@ -290,6 +301,7 @@
         self.waitUntilSettled()
         self.assertEqual(len(self.history), 3)
 
+    @skip("Disabled for early v3 development")
     def test_pipeline_require_open(self):
         "Test pipeline requirement: open"
         self.updateConfigLayout(
@@ -308,6 +320,7 @@
         self.waitUntilSettled()
         self.assertEqual(len(self.history), 1)
 
+    @skip("Disabled for early v3 development")
     def test_pipeline_require_status(self):
         "Test pipeline requirement: status"
         self.updateConfigLayout(
@@ -358,11 +371,13 @@
         self.waitUntilSettled()
         self.assertEqual(len(self.history), 1)
 
+    @skip("Disabled for early v3 development")
     def test_pipeline_reject_username(self):
         "Test negative pipeline requirement: no comment from jenkins"
         return self._test_require_reject_username('org/project1',
                                                   'project1-pipeline')
 
+    @skip("Disabled for early v3 development")
     def test_trigger_reject_username(self):
         "Test negative trigger requirement: no comment from jenkins"
         return self._test_require_reject_username('org/project2',
@@ -418,10 +433,12 @@
         self.assertEqual(len(self.history), 3)
         self.assertEqual(self.history[2].name, job)
 
+    @skip("Disabled for early v3 development")
     def test_pipeline_require_reject(self):
         "Test pipeline requirement: rejections absent"
         return self._test_require_reject('org/project1', 'project1-pipeline')
 
+    @skip("Disabled for early v3 development")
     def test_trigger_require_reject(self):
         "Test trigger requirement: rejections absent"
         return self._test_require_reject('org/project2', 'project2-trigger')
diff --git a/tests/test_scheduler.py b/tests/test_scheduler.py
index acbc144..57bc884 100755
--- a/tests/test_scheduler.py
+++ b/tests/test_scheduler.py
@@ -20,7 +20,6 @@
 import re
 import shutil
 import time
-import yaml
 from unittest import skip
 
 import git
@@ -723,37 +722,6 @@
         self.assertEqual(B.reported, 2)
         self.assertEqual(C.reported, 2)
 
-    @skip("Disabled for early v3 development")
-    def test_parse_skip_if(self):
-        job_yaml = """
-jobs:
-  - name: job_name
-    skip-if:
-      - project: ^project_name$
-        branch: ^stable/icehouse$
-        all-files-match-any:
-          - ^filename$
-      - project: ^project2_name$
-        all-files-match-any:
-          - ^filename2$
-    """.strip()
-        data = yaml.load(job_yaml)
-        config_job = data.get('jobs')[0]
-        cm = zuul.change_matcher
-        expected = cm.MatchAny([
-            cm.MatchAll([
-                cm.ProjectMatcher('^project_name$'),
-                cm.BranchMatcher('^stable/icehouse$'),
-                cm.MatchAllFiles([cm.FileMatcher('^filename$')]),
-            ]),
-            cm.MatchAll([
-                cm.ProjectMatcher('^project2_name$'),
-                cm.MatchAllFiles([cm.FileMatcher('^filename2$')]),
-            ]),
-        ])
-        matcher = self.sched._parseSkipIf(config_job)
-        self.assertEqual(expected, matcher)
-
     def test_patch_order(self):
         "Test that dependent patches are tested in the right order"
         A = self.fake_gerrit.addFakeChange('org/project', 'master', 'A')
@@ -2242,35 +2210,36 @@
         self.assertEqual(B.data['status'], 'MERGED')
         self.assertEqual(B.reported, 2)
 
-    @skip("Disabled for early v3 development")
-    def _test_skip_if_jobs(self, branch, should_skip):
-        "Test that jobs with a skip-if filter run only when appropriate"
-        self.updateConfigLayout(
-            'tests/fixtures/layout-skip-if.yaml')
+    def _test_irrelevant_files_jobs(self, should_skip):
+        "Test that jobs with irrelevant-files filter run only when appropriate"
+        self.updateConfigLayout('layout-irrelevant-files')
         self.sched.reconfigure(self.config)
-        self.registerJobs()
+
+        if should_skip:
+            files = {'ignoreme': 'ignored\n'}
+        else:
+            files = {'respectme': 'please!\n'}
 
         change = self.fake_gerrit.addFakeChange('org/project',
-                                                branch,
-                                                'test skip-if')
+                                                'master',
+                                                'test irrelevant-files',
+                                                files=files)
         self.fake_gerrit.addEvent(change.getPatchsetCreatedEvent(1))
         self.waitUntilSettled()
 
         tested_change_ids = [x.changes[0] for x in self.history
-                             if x.name == 'project-test-skip-if']
+                             if x.name == 'project-test-irrelevant-files']
 
         if should_skip:
             self.assertEqual([], tested_change_ids)
         else:
             self.assertIn(change.data['number'], tested_change_ids)
 
-    @skip("Disabled for early v3 development")
-    def test_skip_if_match_skips_job(self):
-        self._test_skip_if_jobs(branch='master', should_skip=True)
+    def test_irrelevant_files_match_skips_job(self):
+        self._test_irrelevant_files_jobs(should_skip=True)
 
-    @skip("Disabled for early v3 development")
-    def test_skip_if_no_match_runs_job(self):
-        self._test_skip_if_jobs(branch='mp', should_skip=False)
+    def test_irrelevant_files_no_match_runs_job(self):
+        self._test_irrelevant_files_jobs(should_skip=False)
 
     @skip("Disabled for early v3 development")
     def test_test_config(self):
@@ -3089,7 +3058,6 @@
         self.launch_server.release('.*')
         self.waitUntilSettled()
 
-    @skip("Disabled for early v3 development")
     def test_client_enqueue_change(self):
         "Test that the RPC client can enqueue a change"
         A = self.fake_gerrit.addFakeChange('org/project', 'master', 'A')
@@ -3098,7 +3066,8 @@
 
         client = zuul.rpcclient.RPCClient('127.0.0.1',
                                           self.gearman_server.port)
-        r = client.enqueue(pipeline='gate',
+        r = client.enqueue(tenant='tenant-one',
+                           pipeline='gate',
                            project='org/project',
                            trigger='gerrit',
                            change='1,1')
@@ -3120,6 +3089,7 @@
         client = zuul.rpcclient.RPCClient('127.0.0.1',
                                           self.gearman_server.port)
         r = client.enqueue_ref(
+            tenant='tenant-one',
             pipeline='post',
             project='org/project',
             trigger='gerrit',
@@ -3132,14 +3102,24 @@
         self.assertIn('project-post', job_names)
         self.assertEqual(r, True)
 
-    @skip("Disabled for early v3 development")
     def test_client_enqueue_negative(self):
         "Test that the RPC client returns errors"
         client = zuul.rpcclient.RPCClient('127.0.0.1',
                                           self.gearman_server.port)
         with testtools.ExpectedException(zuul.rpcclient.RPCFailure,
+                                         "Invalid tenant"):
+            r = client.enqueue(tenant='tenant-foo',
+                               pipeline='gate',
+                               project='org/project',
+                               trigger='gerrit',
+                               change='1,1')
+            client.shutdown()
+            self.assertEqual(r, False)
+
+        with testtools.ExpectedException(zuul.rpcclient.RPCFailure,
                                          "Invalid project"):
-            r = client.enqueue(pipeline='gate',
+            r = client.enqueue(tenant='tenant-one',
+                               pipeline='gate',
                                project='project-does-not-exist',
                                trigger='gerrit',
                                change='1,1')
@@ -3148,7 +3128,8 @@
 
         with testtools.ExpectedException(zuul.rpcclient.RPCFailure,
                                          "Invalid pipeline"):
-            r = client.enqueue(pipeline='pipeline-does-not-exist',
+            r = client.enqueue(tenant='tenant-one',
+                               pipeline='pipeline-does-not-exist',
                                project='org/project',
                                trigger='gerrit',
                                change='1,1')
@@ -3157,7 +3138,8 @@
 
         with testtools.ExpectedException(zuul.rpcclient.RPCFailure,
                                          "Invalid trigger"):
-            r = client.enqueue(pipeline='gate',
+            r = client.enqueue(tenant='tenant-one',
+                               pipeline='gate',
                                project='org/project',
                                trigger='trigger-does-not-exist',
                                change='1,1')
@@ -3166,7 +3148,8 @@
 
         with testtools.ExpectedException(zuul.rpcclient.RPCFailure,
                                          "Invalid change"):
-            r = client.enqueue(pipeline='gate',
+            r = client.enqueue(tenant='tenant-one',
+                               pipeline='gate',
                                project='org/project',
                                trigger='gerrit',
                                change='1,1')
@@ -3177,7 +3160,6 @@
         self.assertEqual(len(self.history), 0)
         self.assertEqual(len(self.builds), 0)
 
-    @skip("Disabled for early v3 development")
     def test_client_promote(self):
         "Test that the RPC client can promote a change"
         self.launch_server.hold_jobs_in_build = True
@@ -3194,18 +3176,20 @@
 
         self.waitUntilSettled()
 
-        items = self.sched.layout.pipelines['gate'].getAllItems()
+        tenant = self.sched.abide.tenants.get('tenant-one')
+        items = tenant.layout.pipelines['gate'].getAllItems()
         enqueue_times = {}
         for item in items:
             enqueue_times[str(item.change)] = item.enqueue_time
 
         client = zuul.rpcclient.RPCClient('127.0.0.1',
                                           self.gearman_server.port)
-        r = client.promote(pipeline='gate',
+        r = client.promote(tenant='tenant-one',
+                           pipeline='gate',
                            change_ids=['2,1', '3,1'])
 
         # ensure that enqueue times are durable
-        items = self.sched.layout.pipelines['gate'].getAllItems()
+        items = tenant.layout.pipelines['gate'].getAllItems()
         for item in items:
             self.assertEqual(
                 enqueue_times[str(item.change)], item.enqueue_time)
@@ -3226,17 +3210,17 @@
         self.assertEqual(self.builds[4].name, 'project-test1')
         self.assertEqual(self.builds[5].name, 'project-test2')
 
-        self.assertTrue(self.job_has_changes(self.builds[0], B))
-        self.assertFalse(self.job_has_changes(self.builds[0], A))
-        self.assertFalse(self.job_has_changes(self.builds[0], C))
+        self.assertTrue(self.builds[0].hasChanges(B))
+        self.assertFalse(self.builds[0].hasChanges(A))
+        self.assertFalse(self.builds[0].hasChanges(C))
 
-        self.assertTrue(self.job_has_changes(self.builds[2], B))
-        self.assertTrue(self.job_has_changes(self.builds[2], C))
-        self.assertFalse(self.job_has_changes(self.builds[2], A))
+        self.assertTrue(self.builds[2].hasChanges(B))
+        self.assertTrue(self.builds[2].hasChanges(C))
+        self.assertFalse(self.builds[2].hasChanges(A))
 
-        self.assertTrue(self.job_has_changes(self.builds[4], B))
-        self.assertTrue(self.job_has_changes(self.builds[4], C))
-        self.assertTrue(self.job_has_changes(self.builds[4], A))
+        self.assertTrue(self.builds[4].hasChanges(B))
+        self.assertTrue(self.builds[4].hasChanges(C))
+        self.assertTrue(self.builds[4].hasChanges(A))
 
         self.launch_server.release()
         self.waitUntilSettled()
@@ -3251,7 +3235,6 @@
         client.shutdown()
         self.assertEqual(r, True)
 
-    @skip("Disabled for early v3 development")
     def test_client_promote_dependent(self):
         "Test that the RPC client can promote a dependent change"
         # C (depends on B) -> B -> A ; then promote C to get:
@@ -3275,7 +3258,8 @@
 
         client = zuul.rpcclient.RPCClient('127.0.0.1',
                                           self.gearman_server.port)
-        r = client.promote(pipeline='gate',
+        r = client.promote(tenant='tenant-one',
+                           pipeline='gate',
                            change_ids=['3,1'])
 
         self.waitUntilSettled()
@@ -3294,17 +3278,17 @@
         self.assertEqual(self.builds[4].name, 'project-test1')
         self.assertEqual(self.builds[5].name, 'project-test2')
 
-        self.assertTrue(self.job_has_changes(self.builds[0], B))
-        self.assertFalse(self.job_has_changes(self.builds[0], A))
-        self.assertFalse(self.job_has_changes(self.builds[0], C))
+        self.assertTrue(self.builds[0].hasChanges(B))
+        self.assertFalse(self.builds[0].hasChanges(A))
+        self.assertFalse(self.builds[0].hasChanges(C))
 
-        self.assertTrue(self.job_has_changes(self.builds[2], B))
-        self.assertTrue(self.job_has_changes(self.builds[2], C))
-        self.assertFalse(self.job_has_changes(self.builds[2], A))
+        self.assertTrue(self.builds[2].hasChanges(B))
+        self.assertTrue(self.builds[2].hasChanges(C))
+        self.assertFalse(self.builds[2].hasChanges(A))
 
-        self.assertTrue(self.job_has_changes(self.builds[4], B))
-        self.assertTrue(self.job_has_changes(self.builds[4], C))
-        self.assertTrue(self.job_has_changes(self.builds[4], A))
+        self.assertTrue(self.builds[4].hasChanges(B))
+        self.assertTrue(self.builds[4].hasChanges(C))
+        self.assertTrue(self.builds[4].hasChanges(A))
 
         self.launch_server.release()
         self.waitUntilSettled()
@@ -3319,7 +3303,6 @@
         client.shutdown()
         self.assertEqual(r, True)
 
-    @skip("Disabled for early v3 development")
     def test_client_promote_negative(self):
         "Test that the RPC client returns errors for promotion"
         self.launch_server.hold_jobs_in_build = True
@@ -3332,13 +3315,15 @@
                                           self.gearman_server.port)
 
         with testtools.ExpectedException(zuul.rpcclient.RPCFailure):
-            r = client.promote(pipeline='nonexistent',
+            r = client.promote(tenant='tenant-one',
+                               pipeline='nonexistent',
                                change_ids=['2,1', '3,1'])
             client.shutdown()
             self.assertEqual(r, False)
 
         with testtools.ExpectedException(zuul.rpcclient.RPCFailure):
-            r = client.promote(pipeline='gate',
+            r = client.promote(tenant='tenant-one',
+                               pipeline='gate',
                                change_ids=['4,1'])
             client.shutdown()
             self.assertEqual(r, False)
diff --git a/tests/test_webapp.py b/tests/test_webapp.py
index 555c08f..e191244 100644
--- a/tests/test_webapp.py
+++ b/tests/test_webapp.py
@@ -16,6 +16,7 @@
 # under the License.
 
 import json
+from unittest import skip
 
 from six.moves import urllib
 
@@ -23,24 +24,23 @@
 
 
 class TestWebapp(ZuulTestCase):
+    tenant_config_file = 'config/single-tenant/main.yaml'
 
     def _cleanup(self):
-        self.worker.hold_jobs_in_build = False
-        self.worker.release()
+        self.launch_server.hold_jobs_in_build = False
+        self.launch_server.release()
         self.waitUntilSettled()
 
     def setUp(self):
-        self.skip("Disabled for early v3 development")
-
         super(TestWebapp, self).setUp()
         self.addCleanup(self._cleanup)
-        self.worker.hold_jobs_in_build = True
+        self.launch_server.hold_jobs_in_build = True
         A = self.fake_gerrit.addFakeChange('org/project', 'master', 'A')
-        A.addApproval('CRVW', 2)
-        self.fake_gerrit.addEvent(A.addApproval('APRV', 1))
+        A.addApproval('code-review', 2)
+        self.fake_gerrit.addEvent(A.addApproval('approved', 1))
         B = self.fake_gerrit.addFakeChange('org/project1', 'master', 'B')
-        B.addApproval('CRVW', 2)
-        self.fake_gerrit.addEvent(B.addApproval('APRV', 1))
+        A.addApproval('code-review', 2)
+        self.fake_gerrit.addEvent(B.addApproval('approved', 1))
         self.waitUntilSettled()
         self.port = self.webapp.server.socket.getsockname()[1]
 
@@ -48,7 +48,7 @@
         "Test that we can filter to only certain changes in the webapp."
 
         req = urllib.request.Request(
-            "http://localhost:%s/status" % self.port)
+            "http://localhost:%s/tenant-one/status" % self.port)
         f = urllib.request.urlopen(req)
         data = json.loads(f.read())
 
@@ -57,7 +57,7 @@
     def test_webapp_status_compat(self):
         # testing compat with status.json
         req = urllib.request.Request(
-            "http://localhost:%s/status.json" % self.port)
+            "http://localhost:%s/tenant-one/status.json" % self.port)
         f = urllib.request.urlopen(req)
         data = json.loads(f.read())
 
@@ -69,6 +69,7 @@
             "http://localhost:%s/status/foo" % self.port)
         self.assertRaises(urllib.error.HTTPError, urllib.request.urlopen, req)
 
+    @skip("Disabled for early v3 development")
     def test_webapp_find_change(self):
         # can we filter by change id
         req = urllib.request.Request(
diff --git a/zuul/cmd/client.py b/zuul/cmd/client.py
index 1ce2828..cc8edaa 100644
--- a/zuul/cmd/client.py
+++ b/zuul/cmd/client.py
@@ -46,6 +46,8 @@
                                            help='additional help')
 
         cmd_enqueue = subparsers.add_parser('enqueue', help='enqueue a change')
+        cmd_enqueue.add_argument('--tenant', help='tenant name',
+                                 required=True)
         cmd_enqueue.add_argument('--trigger', help='trigger name',
                                  required=True)
         cmd_enqueue.add_argument('--pipeline', help='pipeline name',
@@ -58,6 +60,8 @@
 
         cmd_enqueue = subparsers.add_parser('enqueue-ref',
                                             help='enqueue a ref')
+        cmd_enqueue.add_argument('--tenant', help='tenant name',
+                                 required=True)
         cmd_enqueue.add_argument('--trigger', help='trigger name',
                                  required=True)
         cmd_enqueue.add_argument('--pipeline', help='pipeline name',
@@ -76,6 +80,8 @@
 
         cmd_promote = subparsers.add_parser('promote',
                                             help='promote one or more changes')
+        cmd_promote.add_argument('--tenant', help='tenant name',
+                                 required=True)
         cmd_promote.add_argument('--pipeline', help='pipeline name',
                                  required=True)
         cmd_promote.add_argument('--changes', help='change ids',
@@ -127,7 +133,8 @@
 
     def enqueue(self):
         client = zuul.rpcclient.RPCClient(self.server, self.port)
-        r = client.enqueue(pipeline=self.args.pipeline,
+        r = client.enqueue(tenant=self.args.tenant,
+                           pipeline=self.args.pipeline,
                            project=self.args.project,
                            trigger=self.args.trigger,
                            change=self.args.change)
@@ -135,7 +142,8 @@
 
     def enqueue_ref(self):
         client = zuul.rpcclient.RPCClient(self.server, self.port)
-        r = client.enqueue_ref(pipeline=self.args.pipeline,
+        r = client.enqueue_ref(tenant=self.args.tenant,
+                               pipeline=self.args.pipeline,
                                project=self.args.project,
                                trigger=self.args.trigger,
                                ref=self.args.ref,
@@ -145,7 +153,8 @@
 
     def promote(self):
         client = zuul.rpcclient.RPCClient(self.server, self.port)
-        r = client.promote(pipeline=self.args.pipeline,
+        r = client.promote(tenant=self.args.tenant,
+                           pipeline=self.args.pipeline,
                            change_ids=self.args.changes)
         return r
 
diff --git a/zuul/configloader.py b/zuul/configloader.py
index 7841162..534bd1a 100644
--- a/zuul/configloader.py
+++ b/zuul/configloader.py
@@ -74,9 +74,7 @@
                         'logserver-prefix': str,
                         }
 
-        password = {str: str}
-
-        auth = {'password': to_list(password),
+        auth = {'secrets': to_list(str),
                 'inherit': bool,
                 'swift-tmpurl': to_list(swift_tmpurl),
                 }
diff --git a/zuul/launcher/client.py b/zuul/launcher/client.py
index 80cd420..3776b7c 100644
--- a/zuul/launcher/client.py
+++ b/zuul/launcher/client.py
@@ -13,7 +13,6 @@
 # under the License.
 
 import gear
-import inspect
 import json
 import logging
 import os
@@ -284,16 +283,6 @@
                 for key, value in swift_instructions.items():
                     params['_'.join(['SWIFT', name, key])] = value
 
-        if callable(job.parameter_function):
-            pargs = inspect.getargspec(job.parameter_function)
-            if len(pargs.args) == 2:
-                job.parameter_function(item, params)
-            else:
-                job.parameter_function(item, job, params)
-            self.log.debug("Custom parameter function used for job %s, "
-                           "change: %s, params: %s" % (job, item.change,
-                                                       params))
-
     def launch(self, job, item, pipeline, dependent_items=[]):
         uuid = str(uuid4().hex)
         self.log.info(
diff --git a/zuul/layoutvalidator.py b/zuul/layoutvalidator.py
index ca23fbc..32b6a9e 100644
--- a/zuul/layoutvalidator.py
+++ b/zuul/layoutvalidator.py
@@ -50,9 +50,6 @@
 
 
 class LayoutSchema(object):
-    include = {'python-file': str}
-    includes = [include]
-
     manager = v.Any('IndependentPipelineManager',
                     'DependentPipelineManager')
 
@@ -130,7 +127,6 @@
            'attempts': int,
            'mutex': str,
            'tags': toList(str),
-           'parameter-function': str,
            'branch': toList(str),
            'files': toList(str),
            'swift': toList(swift),
diff --git a/zuul/model.py b/zuul/model.py
index 0c2e1e8..1408cf2 100644
--- a/zuul/model.py
+++ b/zuul/model.py
@@ -424,7 +424,6 @@
         branch_matcher=None,
         file_matcher=None,
         irrelevant_file_matcher=None,  # skip-if
-        parameter_function=None,  # TODOv3(jeblair): remove
         tags=set(),
         mutex=None,
         attempts=3,
@@ -1239,6 +1238,8 @@
         self.data = None
         # common
         self.type = None
+        # For management events (eg: enqueue / promote)
+        self.tenant_name = None
         self.project_name = None
         self.trigger_name = None
         # Representation of the user account that performed the event.
diff --git a/zuul/rpcclient.py b/zuul/rpcclient.py
index 609f636..9d81520 100644
--- a/zuul/rpcclient.py
+++ b/zuul/rpcclient.py
@@ -48,16 +48,19 @@
         self.log.debug("Job complete, success: %s" % (not job.failure))
         return job
 
-    def enqueue(self, pipeline, project, trigger, change):
-        data = {'pipeline': pipeline,
+    def enqueue(self, tenant, pipeline, project, trigger, change):
+        data = {'tenant': tenant,
+                'pipeline': pipeline,
                 'project': project,
                 'trigger': trigger,
                 'change': change,
                 }
         return not self.submitJob('zuul:enqueue', data).failure
 
-    def enqueue_ref(self, pipeline, project, trigger, ref, oldrev, newrev):
-        data = {'pipeline': pipeline,
+    def enqueue_ref(
+            self, tenant, pipeline, project, trigger, ref, oldrev, newrev):
+        data = {'tenant': tenant,
+                'pipeline': pipeline,
                 'project': project,
                 'trigger': trigger,
                 'ref': ref,
@@ -66,8 +69,9 @@
                 }
         return not self.submitJob('zuul:enqueue_ref', data).failure
 
-    def promote(self, pipeline, change_ids):
-        data = {'pipeline': pipeline,
+    def promote(self, tenant, pipeline, change_ids):
+        data = {'tenant': tenant,
+                'pipeline': pipeline,
                 'change_ids': change_ids,
                 }
         return not self.submitJob('zuul:promote', data).failure
diff --git a/zuul/rpclistener.py b/zuul/rpclistener.py
index 716dcfb..90e17dc 100644
--- a/zuul/rpclistener.py
+++ b/zuul/rpclistener.py
@@ -88,24 +88,34 @@
         args = json.loads(job.arguments)
         event = model.TriggerEvent()
         errors = ''
+        tenant = None
+        project = None
+        pipeline = None
 
-        trigger = self.sched.triggers.get(args['trigger'])
-        if trigger:
-            event.trigger_name = args['trigger']
-        else:
-            errors += 'Invalid trigger: %s\n' % (args['trigger'],)
+        tenant = self.sched.abide.tenants.get(args['tenant'])
+        if tenant:
+            event.tenant_name = args['tenant']
 
-        project = self.sched.layout.projects.get(args['project'])
-        if project:
-            event.project_name = args['project']
-        else:
-            errors += 'Invalid project: %s\n' % (args['project'],)
+            project = tenant.layout.project_configs.get(args['project'])
+            if project:
+                event.project_name = args['project']
+            else:
+                errors += 'Invalid project: %s\n' % (args['project'],)
 
-        pipeline = self.sched.layout.pipelines.get(args['pipeline'])
-        if pipeline:
-            event.forced_pipeline = args['pipeline']
+            pipeline = tenant.layout.pipelines.get(args['pipeline'])
+            if pipeline:
+                event.forced_pipeline = args['pipeline']
+
+                for trigger in pipeline.triggers:
+                    if trigger.name == args['trigger']:
+                        event.trigger_name = args['trigger']
+                        continue
+                if not event.trigger_name:
+                    errors += 'Invalid trigger: %s\n' % (args['trigger'],)
+            else:
+                errors += 'Invalid pipeline: %s\n' % (args['pipeline'],)
         else:
-            errors += 'Invalid pipeline: %s\n' % (args['pipeline'],)
+            errors += 'Invalid tenant: %s\n' % (args['tenant'],)
 
         return (args, event, errors, pipeline, project)
 
@@ -141,9 +151,10 @@
 
     def handle_promote(self, job):
         args = json.loads(job.arguments)
+        tenant_name = args['tenant']
         pipeline_name = args['pipeline']
         change_ids = args['change_ids']
-        self.sched.promote(pipeline_name, change_ids)
+        self.sched.promote(tenant_name, pipeline_name, change_ids)
         job.sendWorkComplete()
 
     def handle_get_running_jobs(self, job):
diff --git a/zuul/scheduler.py b/zuul/scheduler.py
index 7fcdf5e..3f78e8d 100644
--- a/zuul/scheduler.py
+++ b/zuul/scheduler.py
@@ -128,13 +128,15 @@
 class PromoteEvent(ManagementEvent):
     """Promote one or more changes to the head of the queue.
 
+    :arg str tenant_name: the name of the tenant
     :arg str pipeline_name: the name of the pipeline
     :arg list change_ids: a list of strings of change ids in the form
         1234,1
     """
 
-    def __init__(self, pipeline_name, change_ids):
+    def __init__(self, tenant_name, pipeline_name, change_ids):
         super(PromoteEvent, self).__init__()
+        self.tenant_name = tenant_name
         self.pipeline_name = pipeline_name
         self.change_ids = change_ids
 
@@ -370,8 +372,8 @@
         self.log.debug("Reconfiguration complete")
         self.last_reconfigured = int(time.time())
 
-    def promote(self, pipeline_name, change_ids):
-        event = PromoteEvent(pipeline_name, change_ids)
+    def promote(self, tenant_name, pipeline_name, change_ids):
+        event = PromoteEvent(tenant_name, pipeline_name, change_ids)
         self.management_event_queue.put(event)
         self.wake_event.set()
         self.log.debug("Waiting for promotion")
@@ -547,7 +549,8 @@
                                    "pipeline stats:")
 
     def _doPromoteEvent(self, event):
-        pipeline = self.layout.pipelines[event.pipeline_name]
+        tenant = self.abide.tenants.get(event.tenant_name)
+        pipeline = tenant.layout.pipelines[event.pipeline_name]
         change_ids = [c.split(',') for c in event.change_ids]
         items_to_enqueue = []
         change_queue = None
@@ -586,8 +589,9 @@
                 ignore_requirements=True)
 
     def _doEnqueueEvent(self, event):
-        project = self.layout.projects.get(event.project_name)
-        pipeline = self.layout.pipelines[event.forced_pipeline]
+        tenant = self.abide.tenants.get(event.tenant_name)
+        project = tenant.layout.project_configs.get(event.project_name)
+        pipeline = tenant.layout.pipelines[event.forced_pipeline]
         change = pipeline.source.getChange(event, project)
         self.log.debug("Event %s for change %s was directly assigned "
                        "to pipeline %s" % (event, change, self))
@@ -804,7 +808,7 @@
             return
         pipeline.manager.onNodesProvisioned(event)
 
-    def formatStatusJSON(self):
+    def formatStatusJSON(self, tenant_name):
         # TODOv3(jeblair): use tenants
         if self.config.has_option('zuul', 'url_pattern'):
             url_pattern = self.config.get('zuul', 'url_pattern')
@@ -835,6 +839,7 @@
 
         pipelines = []
         data['pipelines'] = pipelines
-        for pipeline in self.layout.pipelines.values():
+        tenant = self.abide.tenants.get(tenant_name)
+        for pipeline in tenant.layout.pipelines.values():
             pipelines.append(pipeline.formatStatusJSON(url_pattern))
         return json.dumps(data)
diff --git a/zuul/webapp.py b/zuul/webapp.py
index c1c848b..a63f102 100644
--- a/zuul/webapp.py
+++ b/zuul/webapp.py
@@ -51,7 +51,7 @@
         self.port = port
         self.cache_expiry = cache_expiry
         self.cache_time = 0
-        self.cache = None
+        self.cache = {}
         self.daemon = True
         self.server = httpserver.serve(
             dec.wsgify(self.app), host=self.listen_address, port=self.port,
@@ -97,14 +97,17 @@
         return None
 
     def app(self, request):
-        path = self._normalize_path(request.path)
+        tenant_name = request.path.split('/')[1]
+        path = request.path.replace('/' + tenant_name, '')
+        path = self._normalize_path(path)
         if path is None:
             raise webob.exc.HTTPNotFound()
 
-        if (not self.cache or
+        if (tenant_name not in self.cache or
             (time.time() - self.cache_time) > self.cache_expiry):
             try:
-                self.cache = self.scheduler.formatStatusJSON()
+                self.cache[tenant_name] = self.scheduler.formatStatusJSON(
+                    tenant_name)
                 # Call time.time() again because formatting above may take
                 # longer than the cache timeout.
                 self.cache_time = time.time()
@@ -113,7 +116,7 @@
                 raise
 
         if path == 'status':
-            response = webob.Response(body=self.cache,
+            response = webob.Response(body=self.cache[tenant_name],
                                       content_type='application/json')
         else:
             status = self._status_for_change(path)