diff --git a/keystone/api/os_ep_filter.py b/keystone/api/os_ep_filter.py
index c260983474..055d21debb 100644
--- a/keystone/api/os_ep_filter.py
+++ b/keystone/api/os_ep_filter.py
@@ -110,7 +110,7 @@ class EndpointGroupsResource(ks_flask.ResourceBase):
 
 class EPFilterEndpointProjectsResource(flask_restful.Resource):
     def get(self, endpoint_id):
-        """"Return a list of projects associated with the endpoint."""
+        """Return a list of projects associated with the endpoint."""
         ENFORCER.enforce_call(action='identity:list_projects_for_endpoint')
         PROVIDERS.catalog_api.get_endpoint(endpoint_id)
         refs = PROVIDERS.catalog_api.list_projects_for_endpoint(endpoint_id)
diff --git a/keystone/api/os_oauth2.py b/keystone/api/os_oauth2.py
index ed37eacaa6..43e3dfcbe9 100644
--- a/keystone/api/os_oauth2.py
+++ b/keystone/api/os_oauth2.py
@@ -32,7 +32,7 @@ _build_resource_relation = json_home_relations.os_oauth2_resource_rel_func
 class AccessTokenResource(ks_flask.ResourceBase):
 
     def _method_not_allowed(self):
-        """Raise a method not allowed error"""
+        """Raise a method not allowed error."""
         raise exception.OAuth2OtherError(
             int(http.client.METHOD_NOT_ALLOWED),
             http.client.responses[http.client.METHOD_NOT_ALLOWED],
@@ -40,27 +40,27 @@ class AccessTokenResource(ks_flask.ResourceBase):
 
     @ks_flask.unenforced_api
     def get(self):
-        """The method is not allowed"""
+        """The method is not allowed."""
         self._method_not_allowed()
 
     @ks_flask.unenforced_api
     def head(self):
-        """The method is not allowed"""
+        """The method is not allowed."""
         self._method_not_allowed()
 
     @ks_flask.unenforced_api
     def put(self):
-        """The method is not allowed"""
+        """The method is not allowed."""
         self._method_not_allowed()
 
     @ks_flask.unenforced_api
     def patch(self):
-        """The method is not allowed"""
+        """The method is not allowed."""
         self._method_not_allowed()
 
     @ks_flask.unenforced_api
     def delete(self):
-        """The method is not allowed"""
+        """The method is not allowed."""
         self._method_not_allowed()
 
     @ks_flask.unenforced_api
@@ -69,7 +69,6 @@ class AccessTokenResource(ks_flask.ResourceBase):
 
         POST /v3/OS-OAUTH2/token
         """
-
         client_auth = flask.request.authorization
         if not client_auth:
             error = exception.OAuth2InvalidClient(
diff --git a/keystone/cmd/doctor/database.py b/keystone/cmd/doctor/database.py
index e0def5d630..95c5bdd870 100644
--- a/keystone/cmd/doctor/database.py
+++ b/keystone/cmd/doctor/database.py
@@ -23,7 +23,7 @@ def symptom_database_connection_is_not_SQLite():
     migrations, making it unsuitable for use in keystone. Please change your
     `keystone.conf [database] connection` value to point to a supported
     database driver, such as MySQL.
-    """
+    """  # noqa: D403
     return (
         CONF.database.connection is not None
         and 'sqlite' in CONF.database.connection)
diff --git a/keystone/common/sql/migrations/versions/27e647c0fad4_initial_version.py b/keystone/common/sql/migrations/versions/27e647c0fad4_initial_version.py
index eec97c573b..0f4994903a 100644
--- a/keystone/common/sql/migrations/versions/27e647c0fad4_initial_version.py
+++ b/keystone/common/sql/migrations/versions/27e647c0fad4_initial_version.py
@@ -10,7 +10,7 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-"""Initial version
+"""Initial version.
 
 Revision ID: 27e647c0fad4
 Revises:
diff --git a/keystone/common/sql/upgrades.py b/keystone/common/sql/upgrades.py
index 41a0948193..a075716e97 100644
--- a/keystone/common/sql/upgrades.py
+++ b/keystone/common/sql/upgrades.py
@@ -51,7 +51,7 @@ VERSIONS_PATH = os.path.join(
 
 
 def _find_migrate_repo(branch):
-    """Get the project's change script repository
+    """Get the project's change script repository.
 
     :param branch: Name of the repository "branch" to be used; this will be
         transformed to repository path.
@@ -70,7 +70,7 @@ def _find_migrate_repo(branch):
 
 
 def _find_alembic_conf():
-    """Get the project's alembic configuration
+    """Get the project's alembic configuration.
 
     :returns: An instance of ``alembic.config.Config``
     """
diff --git a/keystone/federation/utils.py b/keystone/federation/utils.py
index 5f53dfbb54..7c1f0c901c 100644
--- a/keystone/federation/utils.py
+++ b/keystone/federation/utils.py
@@ -251,7 +251,7 @@ class DirectMaps(object):
         self._matches = []
 
     def __str__(self):
-        """return the direct map array as a string."""
+        """Return the direct map array as a string."""
         return '%s' % self._matches
 
     def add(self, values):
diff --git a/keystone/revoke/backends/base.py b/keystone/revoke/backends/base.py
index 228db4d5cd..52ee957dca 100644
--- a/keystone/revoke/backends/base.py
+++ b/keystone/revoke/backends/base.py
@@ -36,7 +36,7 @@ class RevokeDriverBase(object, metaclass=abc.ABCMeta):
 
     @abc.abstractmethod
     def list_events(self, last_fetch=None, token=None):
-        """return the revocation events, as a list of objects.
+        """Return the revocation events, as a list of objects.
 
         :param last_fetch:   Time of last fetch.  Return all events newer.
         :param token: dictionary of values from a token, normalized for
@@ -52,7 +52,7 @@ class RevokeDriverBase(object, metaclass=abc.ABCMeta):
 
     @abc.abstractmethod
     def revoke(self, event):
-        """register a revocation event.
+        """Register a revocation event.
 
         :param event: An instance of
             keystone.revoke.model.RevocationEvent
diff --git a/keystone/tests/unit/test_sql_upgrade.py b/keystone/tests/unit/test_sql_upgrade.py
index 55440c9558..5a8211881a 100644
--- a/keystone/tests/unit/test_sql_upgrade.py
+++ b/keystone/tests/unit/test_sql_upgrade.py
@@ -228,6 +228,7 @@ class MigrateBase(
     db_fixtures.OpportunisticDBTestMixin,
 ):
     """Test complete orchestration between all database phases."""
+
     def setUp(self):
         super().setUp()
 
diff --git a/keystone/tests/unit/test_v3_oauth2.py b/keystone/tests/unit/test_v3_oauth2.py
index 5d01e8953f..3dcee1a04f 100644
--- a/keystone/tests/unit/test_v3_oauth2.py
+++ b/keystone/tests/unit/test_v3_oauth2.py
@@ -113,8 +113,7 @@ class AccessTokenTests(OAuth2Tests):
     def _create_access_token(self, client):
         pass
 
-    def _get_access_token_method_not_allowed(self, app_cred,
-                                             http_func):
+    def _get_access_token_method_not_allowed(self, app_cred, http_func):
         client_id = app_cred.get('id')
         client_secret = app_cred.get('secret')
         b64str = b64encode(
@@ -139,7 +138,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token(self):
         """Test case when an access token can be successfully obtain."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         resp = self._get_access_token(
@@ -155,7 +153,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_without_client_auth(self):
         """Test case when there is no client authorization."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         headers = {
@@ -181,7 +178,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_auth_type_is_not_basic(self):
         """Test case when auth_type is not basic."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         client_id = app_cred.get('id')
@@ -215,7 +211,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_without_client_id(self):
         """Test case when there is no client_id."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         client_secret = app_cred.get('secret')
@@ -241,7 +236,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_without_client_secret(self):
         """Test case when there is no client_secret."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         client_id = app_cred.get('id')
@@ -267,7 +261,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_without_grant_type(self):
         """Test case when there is no grant_type."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         data = {}
@@ -288,7 +281,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_blank_grant_type(self):
         """Test case when grant_type is blank."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         data = {
@@ -312,7 +304,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_grant_type_is_not_client_credentials(self):
         """Test case when grant_type is not client_credentials."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         data = {
@@ -336,7 +327,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_failed_401(self):
         """Test case when client authentication failed."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         error = 'invalid_client'
@@ -376,7 +366,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_failed_400(self):
         """Test case when the called API is incorrect."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         error = 'invalid_request'
@@ -412,7 +401,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_failed_500_other(self):
         """Test case when unexpected error."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         error = 'other_error'
@@ -448,7 +436,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_failed_500(self):
         """Test case when internal server error."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         error = 'other_error'
@@ -484,7 +471,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_method_get_not_allowed(self):
         """Test case when the request is get method that is not allowed."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         json_resp = self._get_access_token_method_not_allowed(
@@ -496,7 +482,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_method_patch_not_allowed(self):
         """Test case when the request is patch method that is not allowed."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         json_resp = self._get_access_token_method_not_allowed(
@@ -508,7 +493,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_method_put_not_allowed(self):
         """Test case when the request is put method that is not allowed."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         json_resp = self._get_access_token_method_not_allowed(
@@ -520,7 +504,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_method_delete_not_allowed(self):
         """Test case when the request is delete method that is not allowed."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         json_resp = self._get_access_token_method_not_allowed(
@@ -532,7 +515,6 @@ class AccessTokenTests(OAuth2Tests):
 
     def test_get_access_token_method_head_not_allowed(self):
         """Test case when the request is head method that is not allowed."""
-
         client_name = 'client_name_test'
         app_cred = self._create_app_cred(self.user_id, client_name)
         client_id = app_cred.get('id')
diff --git a/test-requirements.txt b/test-requirements.txt
index 0213085b8c..1fca35803e 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,11 +1,6 @@
-# The order of packages is significant, because pip processes them in the order
-# of appearance. Changing the order has an impact on the overall integration
-# process, which may cause wedges in the gate later.
-
-hacking>=3.0.1,<3.1.0 # Apache-2.0
-pep257==0.7.0 # MIT License
-flake8-docstrings==0.2.1.post1 # MIT
-bashate>=0.5.1 # Apache-2.0
+hacking~=4.1.0 # Apache-2.0
+flake8-docstrings~=1.6.0 # MIT
+bashate~=2.1.0 # Apache-2.0
 stestr>=1.0.0 # Apache-2.0
 freezegun>=0.3.6 # Apache-2.0
 pytz>=2013.6 # MIT
diff --git a/tox.ini b/tox.ini
index 8f5ba12c04..6675acc368 100644
--- a/tox.ini
+++ b/tox.ini
@@ -25,7 +25,7 @@ deps =
   .[bandit]
   {[testenv]deps}
 commands =
-  flake8 --ignore=D100,D101,D102,D103,D104,E305,E402,W503,W504,W605
+  flake8
   # Run bash8 during pep8 runs to ensure violations are caught by
   # the check and gate queues
   bashate devstack/plugin.sh
@@ -112,14 +112,21 @@ enable-extensions = H203,H904
 # D102: Missing docstring in public method
 # D103: Missing docstring in public function
 # D104: Missing docstring in public package
+# D106: Missing docstring in public nested class
+# D107: Missing docstring in __init__
 # D203: 1 blank line required before class docstring (deprecated in pep257)
+# D401: First line should be in imperative mood; try rephrasing
 # TODO(wxy): Fix the pep8 issue.
+# E305:
 # E402: module level import not at top of file
+# H211: Use assert{Is,IsNot}instance
+# H214: Use assertIn/NotIn(A, B) rather than assertTrue/False(A in/not in B) when checking collection contents.
 # W503: line break before binary operator
-# W504 line break after binary operator
-ignore = D100,D101,D102,D103,D104,D203,E402,W503,W504
-exclude=.venv,.git,.tox,build,dist,*lib/python*,*egg,tools,vendor,.update-venv,*.ini,*.po,*.pot
-max-complexity=24
+# W504: line break after binary operator
+# W605:
+ignore = D100,D101,D102,D103,D104,D106,D107,D203,D401,E305,E402,H211,H214,W503,W504,W605
+exclude = .venv,.git,.tox,build,dist,*lib/python*,*egg,tools,vendor,.update-venv,*.ini,*.po,*.pot
+max-complexity = 24
 
 [testenv:docs]
 deps =
@@ -171,7 +178,6 @@ commands = oslopolicy-sample-generator --config-file config-generator/keystone-p
 [hacking]
 import_exceptions =
   keystone.i18n
-  six.moves
 
 [flake8:local-plugins]
 extension =