diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml
new file mode 100644
index 0000000000..e3f79e4c56
--- /dev/null
+++ b/zuul.d/jobs.yaml
@@ -0,0 +1,316 @@
+# Shared zuul config specific to the OpenStack Project
+# Contains definitions of trusted jobs
+# Overrides jobs from:
+#    https://git.openstack.org/cgit/openstack-infra/zuul-jobs
+- job:
+    name: base
+    parent: null
+    description: |
+      The base job for OpenStack's installation of Zuul.
+
+      All jobs ultimately inherit from this.  It runs a pre-playbook
+      which copies all of the job's prepared git repos on to all of
+      the nodes in the nodeset.  It runs a post-playbook which copies
+      all of the files in the logs/ subdirectory of the executor
+      work directory to the logserver.
+
+      It also sets default timeout and nodeset values (which may be
+      overidden).
+    pre-run: playbooks/base/pre
+    post-run:
+      - playbooks/base/post-ssh
+      - playbooks/base/post-logs
+    roles:
+      - zuul: openstack-infra/zuul-jobs
+      - zuul: openstack-infra/openstack-zuul-jobs
+    timeout: 1800
+    nodeset:
+      nodes:
+        - name: ubuntu-xenial
+          label: ubuntu-xenial
+    secrets:
+      - site_logs
+
+- job:
+    name: base-minimal
+    parent: null
+    description: |
+      A subset of what the 'base' job provides: the absolute minimum considered
+      required to run for any one job.
+      It doesn't set up cached git repositories, will not set up mirrors,
+      doesn't validate the node and does not generate an ARA report.
+      These tasks, if required, can be included by the dependant jobs
+      themselves on a need basis.
+    pre-run: playbooks/base-minimal/pre
+    post-run:
+      - playbooks/base-minimal/post-ssh
+      - playbooks/base-minimal/post-logs
+    roles:
+      - zuul: openstack-infra/zuul-jobs
+    timeout: 1800
+    nodeset:
+      nodes:
+        - name: ubuntu-xenial
+          label: ubuntu-xenial
+    secrets:
+      - site_logs
+
+- job:
+    name: base-test
+    parent: null
+    description: |
+      A job to test changes to the base job without disturbing the
+      main job in production.  Not for general use.
+    pre-run: playbooks/base-test/pre
+    post-run:
+      - playbooks/base-test/post-ssh
+      - playbooks/base-test/post-logs
+    roles:
+      - zuul: openstack-infra/zuul-jobs
+      - zuul: openstack-infra/openstack-zuul-jobs
+    timeout: 1800
+    nodeset:
+      nodes:
+        - name: ubuntu-xenial
+          label: ubuntu-xenial
+    secrets:
+      - site_logs
+
+- job:
+    name: publish-openstack-artifacts
+    description: |
+      Publish job to upload artifacts to tarballs.openstack.org
+    post-run: playbooks/publish/openstack-artifacts
+    secrets:
+      - secret: site_tarballs
+        name: fileserver
+
+- job:
+    name: release-openstack-python
+    parent: publish-openstack-artifacts
+    description: |
+      Release python tarballs / wheels to pypi.
+    pre-run: playbooks/python-tarball/pre
+    run: playbooks/python-tarball/run
+    post-run:
+      - playbooks/python-tarball/post
+      - playbooks/publish/pypi
+    secrets:
+      - secret: testpypi_secret
+        name: pypi_info
+      - gpg_key
+
+- job:
+    name: publish-openstack-python-docs
+    description: |
+      Publish the results of the openstack-build-doc job to
+      /afs/.openstack.org/docs/{{ zuul.project.short_name }}
+    final: True
+    pre-run: playbooks/python-docs/pre
+    run: playbooks/python-docs/run
+    post-run:
+      - playbooks/python-docs/post
+      - playbooks/publish/openstack-afs
+    required-projects:
+      - name: openstack/requirements
+    roles:
+      - zuul: openstack-infra/zuul-jobs
+      - zuul: openstack-infra/openstack-zuul-jobs
+    vars:
+      tox_constraints_file: "{{ ansible_user_dir }}/src/git.openstack.org/openstack/requirements/upper-constraints.txt"
+    secrets:
+      - secret: afsdocs_secret
+        name: afs
+
+- job:
+    name: publish-openstack-specs
+    description: |
+      Publish OpenStack specs to static.openstack.org
+      specs/{{ zuul.project.short_name }}
+    final: True
+    pre-run: playbooks/python-docs/pre
+    run: playbooks/python-docs/run
+    post-run: playbooks/publish/openstack-specs
+    required-projects:
+      - name: openstack/requirements
+    roles:
+      - zuul: openstack-infra/zuul-jobs
+      - zuul: openstack-infra/openstack-zuul-jobs
+    vars:
+      tox_constraints_file: "{{ ansible_user_dir }}/src/git.openstack.org/openstack/requirements/upper-constraints.txt"
+    secrets:
+      - site_logs
+
+- job:
+    name: publish-openstack-specs-site
+    description: |
+      Publish OpenStack specs site to static.openstack.org specs/
+    final: True
+    pre-run: playbooks/python-docs/pre
+    run: playbooks/python-docs/run
+    post-run: playbooks/publish/openstack-specs-site
+    required-projects:
+      - name: openstack/requirements
+    roles:
+      - zuul: openstack-infra/zuul-jobs
+      - zuul: openstack-infra/openstack-zuul-jobs
+    vars:
+      tox_constraints_file: "{{ ansible_user_dir }}/src/git.openstack.org/openstack/requirements/upper-constraints.txt"
+    secrets:
+      - site_logs
+
+- job:
+    name: publish-openstack-python-docs-infra
+    description: |
+      Publish the results of the tox-docs job to
+      /afs/.openstack.org/infra/{{ zuul.project.short_name }}
+    final: True
+    pre-run: playbooks/python-docs/pre
+    run: playbooks/python-docs/run
+    post-run:
+      - playbooks/python-docs/post-infra
+      - playbooks/publish/infra-afs
+    roles:
+      - zuul: openstack-infra/zuul-jobs
+      - zuul: openstack-infra/openstack-zuul-jobs
+    secrets:
+      - secret: afsdocs_secret
+        name: afs
+
+- job:
+    name: publish-service-types-authority
+    description: |
+      Publish OpenStack Service Types Authority to
+      https://service-types.openstack.org
+    final: True
+    pre-run: playbooks/python-docs/pre
+    run: playbooks/service-types/run
+    post-run: playbooks/publish/service-types
+    roles:
+      - zuul: openstack-infra/zuul-jobs
+      - zuul: openstack-infra/openstack-zuul-jobs
+    secrets:
+      - site_logs
+
+- job:
+    name: publish-openstack-python-docs-infra-index
+    description: |
+      Publish the results of the tox-docs job to /afs/.openstack.org/infra
+    final: True
+    pre-run: playbooks/python-docs/pre
+    run: playbooks/python-docs/run
+    post-run:
+      - playbooks/python-docs/post-infra
+      - playbooks/publish/infra-index
+    roles:
+      - zuul: openstack-infra/zuul-jobs
+      - zuul: openstack-infra/openstack-zuul-jobs
+    secrets:
+      - secret: afsdocs_secret
+        name: afs
+
+- job:
+    name: publish-openstack-python-branch-tarball
+    parent: publish-openstack-artifacts
+    description: |
+      Publish the results of the tox-tarball job to tarballs.openstack.org.
+    pre-run: playbooks/python-tarball/pre
+    run: playbooks/python-tarball/run
+    post-run: playbooks/python-branch-tarball/post
+
+- job:
+    name: publish-irc-meetings
+    description: |
+      Publish the IRC meeting calendars to eavesdrop.openstack.org.
+    final: True
+    pre-run: playbooks/yaml2ical/pre
+    run: playbooks/yaml2ical/run
+    post-run: playbooks/yaml2ical/post
+    secrets:
+      - eavesdrop_ssh_key
+
+- job:
+    name: propose-updates
+    pre-run: playbooks/proposal/pre
+    run: playbooks/proposal/propose-updates
+    secrets:
+      - secret: proposal_ssh_key
+        name: ssh_key
+
+- job:
+    name: propose-update-constraints
+    parent: propose-updates
+    run: playbooks/proposal/propose-update-constraints
+    dependencies:
+      - release-openstack-python
+
+- semaphore:
+    name: wheel-mirror
+    max: 1
+
+- job:
+    name: build-wheel-mirror
+    pre-run: playbooks/wheel/pre
+    run: playbooks/wheel/build
+    post-run: playbooks/wheel/release
+    nodeset:
+      # NOTE: The python2 and python3 suffix are important, they select the
+      # version of python to build in each job. (we pull the last character of
+      # the inventory_hostname)
+      # TODO(mordred): Replace the suffix with host_vars once we have them.
+      nodes:
+        - name: wheel-mirror-ubuntu-xenial-python2
+          label: ubuntu-xenial
+        - name: wheel-mirror-ubuntu-trusty-python2
+          label: ubuntu-trusty
+        - name: wheel-mirror-ubuntu-xenial-python3
+          label: ubuntu-xenial
+        - name: wheel-mirror-ubuntu-trusty-python3
+          label: ubuntu-trusty
+    # 2.5 hours
+    timeout: 9000
+    allowed-projects:
+      - openstack/requirements
+    roles:
+      - zuul: openstack-infra/ansible-puppet
+        name: puppet
+    required-projects:
+      - openstack-infra/system-config
+      - openstack-infra/puppet-kerberos
+      - openstack-infra/puppet-openafs
+    semaphore: wheel-mirror
+    secrets:
+      - name: afs
+        secret: wheel_keytab
+
+- job:
+    name: release-wheel-mirror
+    run: playbooks/wheel/release
+    nodeset:
+      nodes: []
+    secrets:
+      - name: afs
+        secret: afsadmin_keytab
+
+- job:
+    name: tag-releases
+    pre-run: playbooks/release/pre
+    run: playbooks/release/tag
+    post-run: playbooks/release/post
+    final: true
+    secrets:
+      - name: lp_creds
+        secret: lp_creds
+      - name: ssh_key
+        secret: release_ssh_key
+
+- job:
+    name: project-config-check-main-yaml
+    pre-run: playbooks/check-main-yaml/pre
+    run: playbooks/check-main-yaml/run
+    post-run: playbooks/check-main-yaml/post
+    allowed-projects:
+      - openstack-infra/project-config
+    files:
+      - zuul/main.yaml
+      - gerrit/projects.yaml
diff --git a/zuul.d/pipelines.yaml b/zuul.d/pipelines.yaml
new file mode 100644
index 0000000000..f925a2cff7
--- /dev/null
+++ b/zuul.d/pipelines.yaml
@@ -0,0 +1,281 @@
+# Shared zuul config specific to the OpenStack Project
+# Contains definitions of pipelines
+
+- pipeline:
+    name: check
+    description: |
+      Newly uploaded patchsets enter this pipeline to receive an
+      initial +/-1 Verified vote.
+    manager: independent
+    trigger:
+      gerrit:
+        - event: patchset-created
+        - event: change-restored
+        - event: comment-added
+          comment: (?i)^(Patch Set [0-9]+:)?( [\w\\+-]*)*(\n\n)?\s*recheck
+        - event: comment-added
+          require-approval:
+            - verified: [-1, -2]
+              username: zuul
+          approval:
+            - workflow: 1
+      github:
+        - event: pull_request
+          action:
+            - opened
+            - changed
+            - reopened
+        - event: pull_request
+          action: comment
+          comment: (?i)^\s*recheck\s*$
+    start:
+      github:
+        status: pending
+        comment: false
+    success:
+      gerrit:
+        # Note that gerrit keywords are case-sensitive.
+        Verified: 1
+      github:
+        status: 'success'
+      mysql:
+    failure:
+      gerrit:
+        Verified: -1
+      github:
+        status: 'failure'
+      mysql:
+
+- pipeline:
+    name: gate
+    description: |
+      Changes that have been approved by core developers are enqueued
+      in order in this pipeline, and if they pass tests, will be
+      merged.
+    success-message: Build succeeded (gate pipeline).
+    failure-message: |
+      Build failed (gate pipeline).  For information on how to proceed, see
+      http://docs.openstack.org/infra/manual/developers.html#automated-testing
+    manager: dependent
+    precedence: high
+    require:
+      gerrit:
+        open: True
+        current-patchset: True
+        approval:
+          - Verified: [1, 2]
+            username: zuul
+          - Workflow: 1
+    trigger:
+      gerrit:
+        - event: comment-added
+          approval:
+            - Workflow: 1
+        - event: comment-added
+          approval:
+            - Verified: 1
+          username: zuul
+    start:
+      gerrit:
+        Verified: 0
+    success:
+      gerrit:
+        Verified: 2
+        submit: true
+      mysql:
+    failure:
+      gerrit:
+        Verified: -2
+      mysql:
+    window-floor: 20
+    window-increase-factor: 2
+
+- pipeline:
+    name: post
+    description: This pipeline runs jobs that operate after each change is merged.
+    manager: independent
+    precedence: low
+    trigger:
+      gerrit:
+        - event: ref-updated
+          ref: ^refs/heads/.*$
+
+- pipeline:
+    name: pre-release
+    # NOTE(mordred): pre-release pipeline needs access to credentials (eg: pypi).
+    post-review: true
+    description: When a commit is tagged with a pre-release tag, this pipeline runs jobs that publish archives and documentation.
+    manager: independent
+    precedence: high
+    trigger:
+      gerrit:
+        - event: ref-updated
+          ref: ^refs/tags/[0-9]+(\.[0-9]+)*(a|b|rc)[0-9]+$
+    failure:
+      smtp:
+        from: zuul@openstack.org
+        to: release-job-failures@lists.openstack.org
+        subject: 'Pre-release of {change.project} failed'
+
+- pipeline:
+    name: release
+    # NOTE(pabelanger): release pipeline needs access to credentials (eg: pypi).
+    post-review: true
+    description: When a commit is tagged as a release, this pipeline runs jobs that publish archives and documentation.
+    manager: independent
+    precedence: high
+    trigger:
+      gerrit:
+        - event: ref-updated
+          ref: ^refs/tags/[0-9]+(\.[0-9]+)*$
+    failure:
+      smtp:
+        from: zuul@openstack.org
+        to: release-job-failures@lists.openstack.org
+        subject: 'Release of {change.project} failed'
+
+- pipeline:
+    name: periodic
+    post-review: true
+    description: Jobs in this queue are triggered on a timer.
+    manager: independent
+    precedence: low
+    trigger:
+      timer:
+        - time: '0 6 * * *'
+
+- pipeline:
+    name: release-post
+    # NOTE(mordred): release-post needs access to credentials (eg: pypi).
+    post-review: true
+    description: This pipeline runs release-process-critical jobs that operate after specific changes are merged.
+    manager: independent
+    precedence: high
+    trigger:
+      gerrit:
+        - event: ref-updated
+          ref: ^refs/heads/.*$
+    failure:
+      smtp:
+        from: zuul@openstack.org
+        to: release-job-failures@lists.openstack.org
+        subject: 'release-post job for {change.project} failed'
+
+- pipeline:
+    name: tag
+    post-review: true
+    description: This pipeline runs jobs in response to any tag event.
+    manager: independent
+    precedence: high
+    trigger:
+      gerrit:
+        - event: ref-updated
+          ref: ^refs/tags/.*$
+    failure:
+      smtp:
+        from: zuul@openstack.org
+        to: release-job-failures@lists.openstack.org
+        subject: 'Tag of {change.project} failed'
+
+- pipeline:
+    name: periodic-stable
+    post-review: true
+    description: Periodic checks of the stable branches.
+    manager: independent
+    precedence: low
+    trigger:
+      timer:
+        - time: '1 6 * * *'
+    failure:
+      smtp:
+        from: zuul@openstack.org
+        to: openstack-stable-maint@lists.openstack.org
+        subject: 'Stable check of {change.project} failed'
+
+- pipeline:
+    name: experimental
+    description: On-demand pipeline for requesting a run against a set of jobs that are not yet gating. Leave review comment of "check experimental" to run jobs in this pipeline.
+    success-message: Build succeeded (experimental pipeline).
+    failure-message: Build failed (experimental pipeline).
+    manager: independent
+    precedence: normal
+    trigger:
+      gerrit:
+        - event: comment-added
+          comment: (?i)^(Patch Set [0-9]+:)?( [\w\\+-]*)*(\n\n)?\s*check experimental\s*$
+    success:
+      gerrit: {}
+    failure:
+      gerrit: {}
+
+- pipeline:
+    name: check-tripleo
+    description: >
+      Newly uploaded patchsets enter this pipeline to receive an initial +/-1
+      Verified vote from the "zuul" user. This is used for TripleO patchsets
+      only so that if the TripleO cloud suffers a failure, folk looking can
+      tell that there isn't a system infra problem, only a TripleO specific
+      problem.
+      Once the TripleO test cloud is multi region and has some months of
+      proven stability this will be folded back into the normal check pipeline.
+    success-message: Build succeeded (check-tripleo pipeline).
+    failure-message: >
+      Build failed (check-tripleo pipeline).  For information on how to
+      proceed, see
+      http://docs.openstack.org/infra/manual/developers.html#automated-testing
+    manager: independent
+    precedence: normal
+    trigger:
+      gerrit:
+        - event: patchset-created
+        - event: change-restored
+        - event: comment-added
+          comment: (?i)^(Patch Set [0-9]+:)?( [\w\\+-]*)*(\n\n)?\s*recheck
+    require:
+      gerrit:
+        open: True
+        current-patchset: True
+    success:
+      gerrit: {}
+    failure:
+      gerrit: {}
+
+- pipeline:
+    name: experimental-tripleo
+    description: >
+      On-demand pipeline for requesting a run against a tripleo experimental
+      jobs - slower and running without redundancy - so not yet gating. Leave
+      review comment of "check experimental" to run jobs in this pipeline.
+    success-message: Build succeeded (experimental-tripleo).
+    failure-message: Build failed (experimental-tripleo).
+    manager: independent
+    precedence: low
+    trigger:
+      gerrit:
+        - event: comment-added
+          comment: (?i)^(Patch Set [0-9]+:)?( [\w\\+-]*)*(\n\n)?\s*check experimental\s*$
+    success:
+      gerrit: {}
+    failure:
+      gerrit: {}
+
+- pipeline:
+    name: merge-check
+    description: >
+      Each time a change merges, this pipeline verifies that all open changes
+      on the same project are still mergeable.
+    failure-message: Build failed (merge-check pipeline).
+    manager: independent
+    ignore-dependencies: true
+    precedence: low
+    require:
+      gerrit:
+        approval:
+          - verified: [1, 2]
+            username: zuul
+    trigger:
+      zuul:
+        - event: project-change-merged
+    merge-failure:
+      gerrit:
+        verified: -1
diff --git a/zuul.d/projects.yaml b/zuul.d/projects.yaml
new file mode 100644
index 0000000000..71faae63ca
--- /dev/null
+++ b/zuul.d/projects.yaml
@@ -0,0 +1,56 @@
+# Shared zuul config specific to the OpenStack Project
+# Contains project pipeline definitions
+
+# This project definition is here so that the only zuul config in
+# zuul-jobs are the jobs themselves (to make it easy for other users
+# to consume).
+- project:
+    name: openstack-infra/zuul-jobs
+    templates:
+      - publish-openstack-python-docs-infra
+    check:
+      jobs:
+        - base-integration-centos-7
+        - base-integration-debian-jessie
+        - base-integration-fedora-26
+        - base-integration-ubuntu-trusty
+        - base-integration-ubuntu-xenial
+        - base-integration-opensuse423
+        - tox-linters
+        - tox-py35-on-zuul
+    gate:
+      jobs:
+        - base-integration-centos-7
+        - base-integration-debian-jessie
+        - base-integration-fedora-26
+        - base-integration-ubuntu-trusty
+        - base-integration-ubuntu-xenial
+        - base-integration-opensuse423
+        - tox-linters
+        - tox-py35-on-zuul
+
+- project:
+    name: openstack-dev/sandbox
+    release:
+      jobs:
+        - release-openstack-python
+
+- project:
+    name: openstack/requirements
+    periodic:
+      jobs:
+        # This is a periodic job to ensure that our wheels are reasonably
+        # up-to-date. It uses the upper-constraints files from requirements.
+        - build-wheel-mirror
+        - release-wheel-mirror:
+            dependencies:
+              - build-wheel-mirror
+
+- project:
+    name: openstack-infra/project-config
+    check:
+      jobs:
+        - project-config-check-main-yaml
+        - zuul-migrate:
+            files:
+              - zuul/mapping.yaml
diff --git a/zuul.yaml b/zuul.d/secrets.yaml
similarity index 61%
rename from zuul.yaml
rename to zuul.d/secrets.yaml
index 92ed911614..995be938a9 100644
--- a/zuul.yaml
+++ b/zuul.d/secrets.yaml
@@ -1,593 +1,5 @@
 # Shared zuul config specific to the OpenStack Project
-# Contains definitions of trusted jobs
-# Overrides jobs from:
-#    https://git.openstack.org/cgit/openstack-infra/zuul-jobs
-
-- pipeline:
-    name: check
-    description: |
-      Newly uploaded patchsets enter this pipeline to receive an
-      initial +/-1 Verified vote.
-    manager: independent
-    trigger:
-      gerrit:
-        - event: patchset-created
-        - event: change-restored
-        - event: comment-added
-          comment: (?i)^(Patch Set [0-9]+:)?( [\w\\+-]*)*(\n\n)?\s*recheck
-        - event: comment-added
-          require-approval:
-            - verified: [-1, -2]
-              username: zuul
-          approval:
-            - workflow: 1
-      github:
-        - event: pull_request
-          action:
-            - opened
-            - changed
-            - reopened
-        - event: pull_request
-          action: comment
-          comment: (?i)^\s*recheck\s*$
-    start:
-      github:
-        status: pending
-        comment: false
-    success:
-      gerrit:
-        # Note that gerrit keywords are case-sensitive.
-        Verified: 1
-      github:
-        status: 'success'
-      mysql:
-    failure:
-      gerrit:
-        Verified: -1
-      github:
-        status: 'failure'
-      mysql:
-
-- pipeline:
-    name: gate
-    description: |
-      Changes that have been approved by core developers are enqueued
-      in order in this pipeline, and if they pass tests, will be
-      merged.
-    success-message: Build succeeded (gate pipeline).
-    failure-message: |
-      Build failed (gate pipeline).  For information on how to proceed, see
-      http://docs.openstack.org/infra/manual/developers.html#automated-testing
-    manager: dependent
-    precedence: high
-    require:
-      gerrit:
-        open: True
-        current-patchset: True
-        approval:
-          - Verified: [1, 2]
-            username: zuul
-          - Workflow: 1
-    trigger:
-      gerrit:
-        - event: comment-added
-          approval:
-            - Workflow: 1
-        - event: comment-added
-          approval:
-            - Verified: 1
-          username: zuul
-    start:
-      gerrit:
-        Verified: 0
-    success:
-      gerrit:
-        Verified: 2
-        submit: true
-      mysql:
-    failure:
-      gerrit:
-        Verified: -2
-      mysql:
-    window-floor: 20
-    window-increase-factor: 2
-
-- pipeline:
-    name: post
-    description: This pipeline runs jobs that operate after each change is merged.
-    manager: independent
-    precedence: low
-    trigger:
-      gerrit:
-        - event: ref-updated
-          ref: ^refs/heads/.*$
-
-- pipeline:
-    name: pre-release
-    # NOTE(mordred): pre-release pipeline needs access to credentials (eg: pypi).
-    post-review: true
-    description: When a commit is tagged with a pre-release tag, this pipeline runs jobs that publish archives and documentation.
-    manager: independent
-    precedence: high
-    trigger:
-      gerrit:
-        - event: ref-updated
-          ref: ^refs/tags/[0-9]+(\.[0-9]+)*(a|b|rc)[0-9]+$
-    failure:
-      smtp:
-        from: zuul@openstack.org
-        to: release-job-failures@lists.openstack.org
-        subject: 'Pre-release of {change.project} failed'
-
-- pipeline:
-    name: release
-    # NOTE(pabelanger): release pipeline needs access to credentials (eg: pypi).
-    post-review: true
-    description: When a commit is tagged as a release, this pipeline runs jobs that publish archives and documentation.
-    manager: independent
-    precedence: high
-    trigger:
-      gerrit:
-        - event: ref-updated
-          ref: ^refs/tags/[0-9]+(\.[0-9]+)*$
-    failure:
-      smtp:
-        from: zuul@openstack.org
-        to: release-job-failures@lists.openstack.org
-        subject: 'Release of {change.project} failed'
-
-- pipeline:
-    name: periodic
-    post-review: true
-    description: Jobs in this queue are triggered on a timer.
-    manager: independent
-    precedence: low
-    trigger:
-      timer:
-        - time: '0 6 * * *'
-
-- pipeline:
-    name: release-post
-    # NOTE(mordred): release-post needs access to credentials (eg: pypi).
-    post-review: true
-    description: This pipeline runs release-process-critical jobs that operate after specific changes are merged.
-    manager: independent
-    precedence: high
-    trigger:
-      gerrit:
-        - event: ref-updated
-          ref: ^refs/heads/.*$
-    failure:
-      smtp:
-        from: zuul@openstack.org
-        to: release-job-failures@lists.openstack.org
-        subject: 'release-post job for {change.project} failed'
-
-- pipeline:
-    name: tag
-    post-review: true
-    description: This pipeline runs jobs in response to any tag event.
-    manager: independent
-    precedence: high
-    trigger:
-      gerrit:
-        - event: ref-updated
-          ref: ^refs/tags/.*$
-    failure:
-      smtp:
-        from: zuul@openstack.org
-        to: release-job-failures@lists.openstack.org
-        subject: 'Tag of {change.project} failed'
-
-- pipeline:
-    name: periodic-stable
-    post-review: true
-    description: Periodic checks of the stable branches.
-    manager: independent
-    precedence: low
-    trigger:
-      timer:
-        - time: '1 6 * * *'
-    failure:
-      smtp:
-        from: zuul@openstack.org
-        to: openstack-stable-maint@lists.openstack.org
-        subject: 'Stable check of {change.project} failed'
-
-- pipeline:
-    name: experimental
-    description: On-demand pipeline for requesting a run against a set of jobs that are not yet gating. Leave review comment of "check experimental" to run jobs in this pipeline.
-    success-message: Build succeeded (experimental pipeline).
-    failure-message: Build failed (experimental pipeline).
-    manager: independent
-    precedence: normal
-    trigger:
-      gerrit:
-        - event: comment-added
-          comment: (?i)^(Patch Set [0-9]+:)?( [\w\\+-]*)*(\n\n)?\s*check experimental\s*$
-    success:
-      gerrit: {}
-    failure:
-      gerrit: {}
-
-- pipeline:
-    name: check-tripleo
-    description: >
-      Newly uploaded patchsets enter this pipeline to receive an initial +/-1
-      Verified vote from the "zuul" user. This is used for TripleO patchsets
-      only so that if the TripleO cloud suffers a failure, folk looking can
-      tell that there isn't a system infra problem, only a TripleO specific
-      problem.
-      Once the TripleO test cloud is multi region and has some months of
-      proven stability this will be folded back into the normal check pipeline.
-    success-message: Build succeeded (check-tripleo pipeline).
-    failure-message: >
-      Build failed (check-tripleo pipeline).  For information on how to
-      proceed, see
-      http://docs.openstack.org/infra/manual/developers.html#automated-testing
-    manager: independent
-    precedence: normal
-    trigger:
-      gerrit:
-        - event: patchset-created
-        - event: change-restored
-        - event: comment-added
-          comment: (?i)^(Patch Set [0-9]+:)?( [\w\\+-]*)*(\n\n)?\s*recheck
-    require:
-      gerrit:
-        open: True
-        current-patchset: True
-    success:
-      gerrit: {}
-    failure:
-      gerrit: {}
-
-- pipeline:
-    name: experimental-tripleo
-    description: >
-      On-demand pipeline for requesting a run against a tripleo experimental
-      jobs - slower and running without redundancy - so not yet gating. Leave
-      review comment of "check experimental" to run jobs in this pipeline.
-    success-message: Build succeeded (experimental-tripleo).
-    failure-message: Build failed (experimental-tripleo).
-    manager: independent
-    precedence: low
-    trigger:
-      gerrit:
-        - event: comment-added
-          comment: (?i)^(Patch Set [0-9]+:)?( [\w\\+-]*)*(\n\n)?\s*check experimental\s*$
-    success:
-      gerrit: {}
-    failure:
-      gerrit: {}
-
-- pipeline:
-    name: merge-check
-    description: >
-      Each time a change merges, this pipeline verifies that all open changes
-      on the same project are still mergeable.
-    failure-message: Build failed (merge-check pipeline).
-    manager: independent
-    ignore-dependencies: true
-    precedence: low
-    require:
-      gerrit:
-        approval:
-          - verified: [1, 2]
-            username: zuul
-    trigger:
-      zuul:
-        - event: project-change-merged
-    merge-failure:
-      gerrit:
-        verified: -1
-
-- job:
-    name: base
-    parent: null
-    description: |
-      The base job for OpenStack's installation of Zuul.
-
-      All jobs ultimately inherit from this.  It runs a pre-playbook
-      which copies all of the job's prepared git repos on to all of
-      the nodes in the nodeset.  It runs a post-playbook which copies
-      all of the files in the logs/ subdirectory of the executor
-      work directory to the logserver.
-
-      It also sets default timeout and nodeset values (which may be
-      overidden).
-    pre-run: playbooks/base/pre
-    post-run:
-      - playbooks/base/post-ssh
-      - playbooks/base/post-logs
-    roles:
-      - zuul: openstack-infra/zuul-jobs
-      - zuul: openstack-infra/openstack-zuul-jobs
-    timeout: 1800
-    nodeset:
-      nodes:
-        - name: ubuntu-xenial
-          label: ubuntu-xenial
-    secrets:
-      - site_logs
-
-- job:
-    name: base-minimal
-    parent: null
-    description: |
-      A subset of what the 'base' job provides: the absolute minimum considered
-      required to run for any one job.
-      It doesn't set up cached git repositories, will not set up mirrors,
-      doesn't validate the node and does not generate an ARA report.
-      These tasks, if required, can be included by the dependant jobs
-      themselves on a need basis.
-    pre-run: playbooks/base-minimal/pre
-    post-run:
-      - playbooks/base-minimal/post-ssh
-      - playbooks/base-minimal/post-logs
-    roles:
-      - zuul: openstack-infra/zuul-jobs
-    timeout: 1800
-    nodeset:
-      nodes:
-        - name: ubuntu-xenial
-          label: ubuntu-xenial
-    secrets:
-      - site_logs
-
-- job:
-    name: base-test
-    parent: null
-    description: |
-      A job to test changes to the base job without disturbing the
-      main job in production.  Not for general use.
-    pre-run: playbooks/base-test/pre
-    post-run:
-      - playbooks/base-test/post-ssh
-      - playbooks/base-test/post-logs
-    roles:
-      - zuul: openstack-infra/zuul-jobs
-      - zuul: openstack-infra/openstack-zuul-jobs
-    timeout: 1800
-    nodeset:
-      nodes:
-        - name: ubuntu-xenial
-          label: ubuntu-xenial
-    secrets:
-      - site_logs
-
-- job:
-    name: publish-openstack-artifacts
-    description: |
-      Publish job to upload artifacts to tarballs.openstack.org
-    post-run: playbooks/publish/openstack-artifacts
-    secrets:
-      - secret: site_tarballs
-        name: fileserver
-
-- job:
-    name: release-openstack-python
-    parent: publish-openstack-artifacts
-    description: |
-      Release python tarballs / wheels to pypi.
-    pre-run: playbooks/python-tarball/pre
-    run: playbooks/python-tarball/run
-    post-run:
-      - playbooks/python-tarball/post
-      - playbooks/publish/pypi
-    secrets:
-      - secret: testpypi_secret
-        name: pypi_info
-      - gpg_key
-
-- job:
-    name: publish-openstack-python-docs
-    description: |
-      Publish the results of the openstack-build-doc job to
-      /afs/.openstack.org/docs/{{ zuul.project.short_name }}
-    final: True
-    pre-run: playbooks/python-docs/pre
-    run: playbooks/python-docs/run
-    post-run:
-      - playbooks/python-docs/post
-      - playbooks/publish/openstack-afs
-    required-projects:
-      - name: openstack/requirements
-    roles:
-      - zuul: openstack-infra/zuul-jobs
-      - zuul: openstack-infra/openstack-zuul-jobs
-    vars:
-      tox_constraints_file: "{{ ansible_user_dir }}/src/git.openstack.org/openstack/requirements/upper-constraints.txt"
-    secrets:
-      - secret: afsdocs_secret
-        name: afs
-
-- job:
-    name: publish-openstack-specs
-    description: |
-      Publish OpenStack specs to static.openstack.org
-      specs/{{ zuul.project.short_name }}
-    final: True
-    pre-run: playbooks/python-docs/pre
-    run: playbooks/python-docs/run
-    post-run: playbooks/publish/openstack-specs
-    required-projects:
-      - name: openstack/requirements
-    roles:
-      - zuul: openstack-infra/zuul-jobs
-      - zuul: openstack-infra/openstack-zuul-jobs
-    vars:
-      tox_constraints_file: "{{ ansible_user_dir }}/src/git.openstack.org/openstack/requirements/upper-constraints.txt"
-    secrets:
-      - site_logs
-
-- job:
-    name: publish-openstack-specs-site
-    description: |
-      Publish OpenStack specs site to static.openstack.org specs/
-    final: True
-    pre-run: playbooks/python-docs/pre
-    run: playbooks/python-docs/run
-    post-run: playbooks/publish/openstack-specs-site
-    required-projects:
-      - name: openstack/requirements
-    roles:
-      - zuul: openstack-infra/zuul-jobs
-      - zuul: openstack-infra/openstack-zuul-jobs
-    vars:
-      tox_constraints_file: "{{ ansible_user_dir }}/src/git.openstack.org/openstack/requirements/upper-constraints.txt"
-    secrets:
-      - site_logs
-
-- job:
-    name: publish-openstack-python-docs-infra
-    description: |
-      Publish the results of the tox-docs job to
-      /afs/.openstack.org/infra/{{ zuul.project.short_name }}
-    final: True
-    pre-run: playbooks/python-docs/pre
-    run: playbooks/python-docs/run
-    post-run:
-      - playbooks/python-docs/post-infra
-      - playbooks/publish/infra-afs
-    roles:
-      - zuul: openstack-infra/zuul-jobs
-      - zuul: openstack-infra/openstack-zuul-jobs
-    secrets:
-      - secret: afsdocs_secret
-        name: afs
-
-- job:
-    name: publish-service-types-authority
-    description: |
-      Publish OpenStack Service Types Authority to
-      https://service-types.openstack.org
-    final: True
-    pre-run: playbooks/python-docs/pre
-    run: playbooks/service-types/run
-    post-run: playbooks/publish/service-types
-    roles:
-      - zuul: openstack-infra/zuul-jobs
-      - zuul: openstack-infra/openstack-zuul-jobs
-    secrets:
-      - site_logs
-
-- job:
-    name: publish-openstack-python-docs-infra-index
-    description: |
-      Publish the results of the tox-docs job to /afs/.openstack.org/infra
-    final: True
-    pre-run: playbooks/python-docs/pre
-    run: playbooks/python-docs/run
-    post-run:
-      - playbooks/python-docs/post-infra
-      - playbooks/publish/infra-index
-    roles:
-      - zuul: openstack-infra/zuul-jobs
-      - zuul: openstack-infra/openstack-zuul-jobs
-    secrets:
-      - secret: afsdocs_secret
-        name: afs
-
-- job:
-    name: publish-openstack-python-branch-tarball
-    parent: publish-openstack-artifacts
-    description: |
-      Publish the results of the tox-tarball job to tarballs.openstack.org.
-    pre-run: playbooks/python-tarball/pre
-    run: playbooks/python-tarball/run
-    post-run: playbooks/python-branch-tarball/post
-
-- job:
-    name: publish-irc-meetings
-    description: |
-      Publish the IRC meeting calendars to eavesdrop.openstack.org.
-    final: True
-    pre-run: playbooks/yaml2ical/pre
-    run: playbooks/yaml2ical/run
-    post-run: playbooks/yaml2ical/post
-    secrets:
-      - eavesdrop_ssh_key
-
-- job:
-    name: propose-updates
-    pre-run: playbooks/proposal/pre
-    run: playbooks/proposal/propose-updates
-    secrets:
-      - secret: proposal_ssh_key
-        name: ssh_key
-
-- job:
-    name: propose-update-constraints
-    parent: propose-updates
-    run: playbooks/proposal/propose-update-constraints
-    dependencies:
-      - release-openstack-python
-
-- semaphore:
-    name: wheel-mirror
-    max: 1
-
-- job:
-    name: build-wheel-mirror
-    pre-run: playbooks/wheel/pre
-    run: playbooks/wheel/build
-    post-run: playbooks/wheel/release
-    nodeset:
-      # NOTE: The python2 and python3 suffix are important, they select the
-      # version of python to build in each job. (we pull the last character of
-      # the inventory_hostname)
-      # TODO(mordred): Replace the suffix with host_vars once we have them.
-      nodes:
-        - name: wheel-mirror-ubuntu-xenial-python2
-          label: ubuntu-xenial
-        - name: wheel-mirror-ubuntu-trusty-python2
-          label: ubuntu-trusty
-        - name: wheel-mirror-ubuntu-xenial-python3
-          label: ubuntu-xenial
-        - name: wheel-mirror-ubuntu-trusty-python3
-          label: ubuntu-trusty
-    # 2.5 hours
-    timeout: 9000
-    allowed-projects:
-      - openstack/requirements
-    roles:
-      - zuul: openstack-infra/ansible-puppet
-        name: puppet
-    required-projects:
-      - openstack-infra/system-config
-      - openstack-infra/puppet-kerberos
-      - openstack-infra/puppet-openafs
-    semaphore: wheel-mirror
-    secrets:
-      - name: afs
-        secret: wheel_keytab
-
-- job:
-    name: release-wheel-mirror
-    run: playbooks/wheel/release
-    nodeset:
-      nodes: []
-    secrets:
-      - name: afs
-        secret: afsadmin_keytab
-
-- job:
-    name: tag-releases
-    pre-run: playbooks/release/pre
-    run: playbooks/release/tag
-    post-run: playbooks/release/post
-    final: true
-    secrets:
-      - name: lp_creds
-        secret: lp_creds
-      - name: ssh_key
-        secret: release_ssh_key
-
-- project:
-    name: openstack-infra/project-config
-    check:
-      jobs: []
+# Contains definitions of secrets
 
 - secret:
     name: afsdocs_secret
@@ -1001,56 +413,3 @@
           Nx5z/lAk0hzM5MWQj0ZtHsqWs/xqodo4i7ucLNWs9UInT+1e2Md9SphQa3COK9FadhmfM
           9zPvfZpEiF/0aC5VoZyKKwFUJvgTj+vxnN2P2JTQVQvTlxnIXxFZANV8LcHmBI=
       consumer_key: 'System-wide: Ubuntu (review.openstack.org)'
-
-# This project definition is here so that the only zuul config in
-# zuul-jobs are the jobs themselves (to make it easy for other users
-# to consume).
-- project:
-    name: openstack-infra/zuul-jobs
-    templates:
-      - publish-openstack-python-docs-infra
-    check:
-      jobs:
-        - base-integration-centos-7
-        - base-integration-debian-jessie
-        - base-integration-fedora-26
-        - base-integration-ubuntu-trusty
-        - base-integration-ubuntu-xenial
-        - base-integration-opensuse423
-        - tox-linters
-        - tox-py35-on-zuul
-    gate:
-      jobs:
-        - base-integration-centos-7
-        - base-integration-debian-jessie
-        - base-integration-fedora-26
-        - base-integration-ubuntu-trusty
-        - base-integration-ubuntu-xenial
-        - base-integration-opensuse423
-        - tox-linters
-        - tox-py35-on-zuul
-
-- project:
-    name: openstack-dev/sandbox
-    release:
-      jobs:
-        - release-openstack-python
-
-- project:
-    name: openstack/requirements
-    periodic:
-      jobs:
-        # This is a periodic job to ensure that our wheels are reasonably
-        # up-to-date. It uses the upper-constraints files from requirements.
-        - build-wheel-mirror
-        - release-wheel-mirror:
-            dependencies:
-              - build-wheel-mirror
-
-- project:
-    name: openstack-infra/project-config
-    check:
-      jobs:
-        - zuul-migrate:
-            files:
-              - zuul/mapping.yaml