diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..a3b2e6d
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,31 @@
+AUTHORS
+build/*
+build-stamp
+ChangeLog
+cover/
+covhtml/
+dist/
+doc/build
+etc/*.sample
+*.DS_Store
+*.pyc
+vmware_nsx_tempest_plugin.egg-info/
+pbr*.egg/
+run_tests.err.log
+run_tests.log
+setuptools*.egg/
+subunit.log
+*.mo
+*.sw?
+*~
+/.*
+!/.coveragerc
+!/.gitignore
+!/.gitreview
+!/.mailmap
+!/.pylintrc
+!/.testr.conf
+!/.zuul.yaml
+
+# Files created by releasenotes build
+releasenotes/build
diff --git a/doc/requirements.txt b/doc/requirements.txt
new file mode 100644
index 0000000..1a7c6cf
--- /dev/null
+++ b/doc/requirements.txt
@@ -0,0 +1,4 @@
+sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD
+openstackdocstheme>=1.18.1 # Apache-2.0
+reno>=2.5.0 # Apache-2.0
+mock>=2.0.0 # BSD
\ No newline at end of file
diff --git a/test-requirements.txt b/test-requirements.txt
index 5874fe5..e9b22bd 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -4,12 +4,11 @@
 
 hacking<0.13,>=0.12.0 # Apache-2.0
 
+bandit>=1.1.0 # Apache-2.0
 coverage!=4.4,>=4.0 # Apache-2.0
 python-subunit>=1.0.0 # Apache-2.0/BSD
-sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD
 oslotest>=3.2.0 # Apache-2.0
 testtools>=2.2.0 # MIT
-openstackdocstheme>=1.18.1 # Apache-2.0
 # releasenotes
 reno>=2.5.0 # Apache-2.0
 tempest>=17.1.0 # Apache-2.0
diff --git a/tox.ini b/tox.ini
index 691b352..3d4ce20 100644
--- a/tox.ini
+++ b/tox.ini
@@ -3,20 +3,25 @@ minversion = 2.0
 envlist = py35,py27,pep8,docs
 skipsdist = True
 
+
 [testenv]
 usedevelop = True
-install_command = pip install -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt} {opts} {packages}
+install_command =  pip install {opts} {packages}
 setenv =
-   VIRTUAL_ENV={envdir}
-   PYTHONWARNINGS=default::DeprecationWarning
-deps = -r{toxinidir}/test-requirements.txt
-       -r{toxinidir}/requirements.txt
+  PYTHONWARNINGS=default::DeprecationWarning
+  OS_LOG_CAPTURE={env:OS_LOG_CAPTURE:true}
+  OS_STDOUT_CAPTURE={env:OS_STDOUT_CAPTURE:true}
+  OS_STDERR_CAPTURE={env:OS_STDERR_CAPTURE:true}
+deps =
+  -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt}
+  -r{toxinidir}/requirements.txt
+  -r{toxinidir}/test-requirements.txt
 whitelist_externals = sh
                       rm
                       find
 commands =
-   find . -type f -name "*.pyc" -delete
-   stestr run --slowest {posargs}
+  find . -type f -name "*.pyc" -delete
+  stestr run --slowest {posargs}
 passenv = http_proxy
           HTTP_PROXY
           https_proxy
@@ -27,9 +32,13 @@ passenv = http_proxy
           OS_LOG_CAPTURE
           OS_STDERR_CAPTURE
           OS_STDOUT_CAPTURE
+          TRACE_FAILONLY
 
 [testenv:pep8]
-commands = flake8 {posargs}
+basepython = python3
+commands =
+  flake8
+  {[testenv:bandit]commands}
 
 [testenv:py27]
 setenv = OS_FAIL_ON_MISSING_DEPS=1
@@ -38,14 +47,31 @@ setenv = OS_FAIL_ON_MISSING_DEPS=1
 commands = {posargs}
 
 [testenv:cover]
-commands = python setup.py test --coverage --testr-args='{posargs}'
+basepython = python3
+setenv =
+  {[testenv]setenv}
+  PYTHON=coverage run --source vmware_nsx_tempest --parallel-mode
+commands =
+  stestr run --no-subunit-trace {posargs}
+  coverage combine
+  coverage html -d cover
+  coverage xml -o cover/coverage.xml
 
 [testenv:docs]
-commands = python setup.py build_sphinx
+basepython = python3
+deps =
+  -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt}
+  -r{toxinidir}/requirements.txt
+  -r{toxinidir}/doc/requirements.txt
+commands = sphinx-build -W -b html doc/source doc/build/html
 
 [testenv:releasenotes]
-commands =
-  sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
+basepython = python3
+deps =
+  -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt}
+  -r{toxinidir}/requirements.txt
+  -r{toxinidir}/doc/requirements.txt
+commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
 
 [testenv:debug]
 commands = oslo_debug_helper {posargs}
@@ -58,3 +84,10 @@ ignore = E125,E126,E128,E129,E265,H305,H307,H404,H405,H904,N530,N531
 builtins = _
 exclude=.venv,.git,.tox,dist,doc,*lib/python*,*egg,build,.ropeproject
 import-order-style = pep8
+
+[testenv:bandit]
+# B108 hardcoded_tmp_directory - remove when fixed
+# B109 password_config_option_not_marked_secret
+# B602 subprocess_popen_with_shell_equals_true - removed when fixed
+# B605 start_process_with_a_shell - remove when fixed
+commands = bandit -r vmware_nsx_tempest -n 5 -s B108,B109,B602,B605 -ll
diff --git a/vmware_nsx_tempest/lib/traffic_manager.py b/vmware_nsx_tempest/lib/traffic_manager.py
index 5f3561a..24ff882 100644
--- a/vmware_nsx_tempest/lib/traffic_manager.py
+++ b/vmware_nsx_tempest/lib/traffic_manager.py
@@ -291,10 +291,12 @@ class IperfManager(TrafficManager):
 
         if self.traffic == 'udp':
             cmd = ('iperf -p 49162 -c %s -b %sM -t 1 -u | grep %%'
-                   % (unicode(destination_ip), unicode(traffic_send_rate)))
+                   % (unicode(destination_ip),  # noqa
+                      unicode(traffic_send_rate)))  # noqa
         else:
             cmd = ('iperf -p 49162 -c %s -b %sM -t 1 '
-                   % (unicode(destination_ip), unicode(traffic_send_rate)))
+                   % (unicode(destination_ip),  # noqa
+                      unicode(traffic_send_rate)))  # noqa
         output = ssh_source.exec_command(cmd)
         if output is None or float(output.split()[7]) < 0:
             LOG.error('Incorrect IPERF output %s' % output)
@@ -310,7 +312,7 @@ class IperfManager(TrafficManager):
             if 'iperf -p 49162 -s' in line:
                 LOG.info("Killing iperf process")
                 iperf_process_id = line.split()[1]
-                cmd = ('kill %s' % (unicode(iperf_process_id)))
+                cmd = ('kill %s' % (unicode(iperf_process_id)))  # noqa
                 ssh_source.exec_command(cmd)
 
     def kill_tcpdump_process(self, ssh_source):
@@ -321,7 +323,7 @@ class IperfManager(TrafficManager):
             if 'tcpdump -ni eth0 -w' in line:
                 LOG.info("Killing TCPDUMP process")
                 tcpdump_process_id = line.split()[1]
-                cmd = ('kill %s' % (unicode(tcpdump_process_id)))
+                cmd = ('kill %s' % (unicode(tcpdump_process_id)))  # noqa
                 ssh_source.exec_command(cmd)
 
     def use_iperf_send_traffic(
diff --git a/vmware_nsx_tempest/tests/nsxv/api/test_l2_gateway.py b/vmware_nsx_tempest/tests/nsxv/api/test_l2_gateway.py
index 6003e55..a74e3db 100644
--- a/vmware_nsx_tempest/tests/nsxv/api/test_l2_gateway.py
+++ b/vmware_nsx_tempest/tests/nsxv/api/test_l2_gateway.py
@@ -108,14 +108,15 @@ class L2GatewayTest(base.BaseAdminNetworkTest):
                          MSG_DIFF % ('name', _res_new['name'], _name))
         # w/wo vlan provided, need to check it is assigned/not-assigned
         _seg_list = self.get_segmentation_id(_res_new, 0, 0)
-        self.assertEqual(0, cmp(_vlan_id_list, _seg_list),
-                         MSG_DIFF % ('vlan', _seg_list, _vlan_id_list))
+        self.assertItemsEqual(_vlan_id_list, _seg_list,
+                              MSG_DIFF % ('vlan', _seg_list, _vlan_id_list))
         _res_show = self.l2gw_client.show_l2_gateway(
             _res_new['id'])[L2GW_RID]
         _if_created = _res_new['devices'][0]['interfaces']
         _if_shown = _res_show['devices'][0]['interfaces']
-        self.assertEqual(0, cmp(_if_created, _if_shown),
-                         MSG_DIFF % ('interfaces', _if_created, _if_shown))
+        self.assertItemsEqual(_if_created, _if_shown,
+                              MSG_DIFF % ('interfaces',
+                                          _if_created, _if_shown))
         _name2 = _name + "-day2"
         _res_upd = self.l2gw_client.update_l2_gateway(
             _res_new['id'], name=_name2)[L2GW_RID]
diff --git a/vmware_nsx_tempest/tests/nsxv/api/test_l2_gateway_connection.py b/vmware_nsx_tempest/tests/nsxv/api/test_l2_gateway_connection.py
index d0377ab..1f99f12 100644
--- a/vmware_nsx_tempest/tests/nsxv/api/test_l2_gateway_connection.py
+++ b/vmware_nsx_tempest/tests/nsxv/api/test_l2_gateway_connection.py
@@ -241,8 +241,8 @@ class L2GatewayConnectionTest(base.BaseAdminNetworkTest):
         (_gw, _seg_list) = self.create_l2gw_switch(_name, _devices)
         (_res_new, _seg_id_list) = self.create_l2gw_connection(_gw)
         _seg_id_list = _res_new.get('segmentation_id')
-        self.assertEqaul(0, cmp(_vlan_id_list, _seg_id_list),
-                         MSG_DIFF % ('vlan', _vlan_id_list, _seg_id_list))
+        self.assertItemsEqual(_vlan_id_list, _seg_id_list,
+                              MSG_DIFF % ('vlan', _vlan_id_list, _seg_id_list))
         self.do_suld_l2gw_connection(_res_new)
         self.addCleanup(self.l2gw_cleanup)
 
diff --git a/vmware_nsx_tempest/tests/nsxv/scenario/manager_topo_deployment.py b/vmware_nsx_tempest/tests/nsxv/scenario/manager_topo_deployment.py
index f7470df..74fdb24 100644
--- a/vmware_nsx_tempest/tests/nsxv/scenario/manager_topo_deployment.py
+++ b/vmware_nsx_tempest/tests/nsxv/scenario/manager_topo_deployment.py
@@ -263,7 +263,7 @@ class TopoDeployScenarioManager(manager.NetworkScenarioTest):
         flavor = flavor or CONF.compute.flavor_ref
         servers_client = servers_client or self.servers_client
         create_kwargs = create_kwargs or {}
-        if type(tenant_id) in (str, unicode):
+        if type(tenant_id) in (str, unicode):  # noqa
             if servers_client.tenant_id != tenant_id:
                 create_kwargs['tenant_id'] = tenant_id
 
@@ -465,7 +465,7 @@ class TopoDeployScenarioManager(manager.NetworkScenarioTest):
         PING_INSESSION = 'ping-progress-in-session'
         PING_DONE = 'ping-progress-completed'
         PING_TIMEOUT = 'ping-progress-timeout'
-        if msg and type(msg) in (str, unicode):
+        if msg and type(msg) in (str, unicode):  # noqa
             xmsg = ("waitfor_host_connected ip=%(ip)s! %(msg)s" %
                     {'ip': host_ip, 'msg': msg})
             LOG.debug(xmsg)
@@ -677,8 +677,9 @@ def check_hosts_connectivity(host, dest_list, ignore_helper=None,
     n_not_reachable = 0
     for dest in dest_list:
         # caller can say to ignore dest ipaddr
-        if ('helper' in dest and type(ignore_helper) in (str, unicode) and
-                re.search(ignore_helper, dest['helper'], re.I)):
+        if ('helper' in dest and
+                type(ignore_helper) in (str, unicode) and  # noqa
+                re.search(ignore_helper, dest['helper'], re.I)):  # noqa
             dest['reachable'] = None
             continue
         dest['reachable'] = is_reachable(ssh_client, dest['ipaddr'],