diff --git a/jenkins/jobs/keystone.yaml b/jenkins/jobs/keystone.yaml
index 27f469a5b6..4e8a8ab75d 100644
--- a/jenkins/jobs/keystone.yaml
+++ b/jenkins/jobs/keystone.yaml
@@ -155,3 +155,70 @@
       - test-results
       - devstack-logs
       - console-log
+
+- builder:
+    name: openstack-ansible-os_keystone-checkout
+    builders:
+      - shell: |
+          #!/bin/bash -xe
+          CLONEMAP=`mktemp`
+          REQS_DIR=`mktemp -d`
+          function cleanup {
+              rm -f $CLONEMAP
+              rm -rf $REQS_DIR
+          }
+          trap cleanup EXIT
+          cat > $CLONEMAP << EOF
+          clonemap:
+            - name: openstack/openstack-ansible-os_keystone
+              dest: .
+            - name: openstack/requirements
+              dest: $REQS_DIR
+          EOF
+          /usr/zuul-env/bin/zuul-cloner -m $CLONEMAP \
+              --cache-dir /opt/git git://git.openstack.org \
+              openstack/openstack-ansible-os_keystone \
+              openstack/requirements
+          cp $REQS_DIR/upper-constraints.txt ./
+
+- job-template:
+    name: '{pipeline}-keystone-osa-rolling-upgrade-{node-release}{suffix}'
+    node: '{node}'
+
+    wrappers:
+      - build-timeout:
+          timeout: 70
+      - timestamps
+
+    builders:
+      - link-logs
+      - net-info
+      - openstack-ansible-os_keystone-checkout
+      - shell: |
+          # Allow Jenkins user to ssh into localhost
+          ssh-keygen -f ~/.ssh/id_rsa -N ""
+          cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
+          ssh-keyscan localhost >> ~/.ssh/known_hosts
+          ssh-keyscan 127.0.0.1 >> ~/.ssh/known_hosts
+      - shell: |
+          # Get the keystone change in review and place it in ~/git/openstack/keystone,
+          # which is where the openstack-ansible-os_keystone role expects the
+          # upgrade source to be.
+          #!/bin/bash -xe
+          cat > $CLONEMAP << EOF
+          clonemap:
+            - name: openstack/keystone
+              dest: .
+          EOF
+          /usr/zuul-env/bin/zuul-cloner -m $CLONEMAP \
+              --cache-dir /opt/git git://git.openstack.org \
+              openstack/keystone
+      - shell: |
+          /usr/local/jenkins/slave_scripts/run-tox.sh upgrade
+
+    publishers:
+      # Even though this isn't a devstack job, capturing the logs can still be
+      # useful.
+      - devstack-logs
+      - test-results
+      - console-log
diff --git a/jenkins/jobs/projects.yaml b/jenkins/jobs/projects.yaml
index 6c109358ce..d9cf6be233 100644
--- a/jenkins/jobs/projects.yaml
+++ b/jenkins/jobs/projects.yaml
@@ -6185,6 +6185,12 @@
           node: ubuntu-xenial-2-node
           node-release: ubuntu-xenial
       - periodic-python-jobs-with-oslo-master
+      - '{pipeline}-keystone-osa-rolling-upgrade-{node-release}{suffix}':
+          pipeline: gate
+          suffix: '-nv'
+          node: ubuntu-xenial-2-node
+          branch-override: default
+          node-release: ubuntu-xenial
 
 - project:
     name: keystone-specs
diff --git a/zuul/layout.yaml b/zuul/layout.yaml
index 07ac39569f..ff5983d430 100755
--- a/zuul/layout.yaml
+++ b/zuul/layout.yaml
@@ -11321,6 +11321,7 @@ projects:
       - gate-keystone-tox-patch_cover-ubuntu-trusty
       - gate-keystone-tox-patch_cover-ubuntu-xenial
       - gate-keystone-dsvm-grenade-multinode-ubuntu-xenial-nv
+      - gate-keystone-osa-rolling-upgrade-ubuntu-xenial-nv
 
   - name: openstack/keystone-specs
     template: