diff --git a/.stestr.conf b/.stestr.conf
new file mode 100644
index 0000000..3540661
--- /dev/null
+++ b/.stestr.conf
@@ -0,0 +1,3 @@
+[DEFAULT]
+test_path=${OS_TEST_PATH:-./cursive/tests/unit}
+top_dir=./
diff --git a/.zuul.yaml b/.zuul.yaml
index bc752ce..11117a7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,7 +1,10 @@
 - project:
+    templates:
+      - openstack-python3-wallaby-jobs
+      - check-requirements
     check:
       jobs:
-        - barbican-simple-crypto-devstack-tempest-cursive
+        - barbican-tempest-plugin-simple-crypto-cursive
     gate:
       jobs:
-        - barbican-simple-crypto-devstack-tempest-cursive
+        - barbican-tempest-plugin-simple-crypto-cursive
diff --git a/cursive/signature_utils.py b/cursive/signature_utils.py
index af27cbe..bb4cd02 100644
--- a/cursive/signature_utils.py
+++ b/cursive/signature_utils.py
@@ -334,7 +334,7 @@ def get_certificate(context, signature_certificate_uuid):
     try:
         # The certificate retrieved here is a castellan certificate object
         cert = keymgr_api.get(context, signature_certificate_uuid)
-    except ManagedObjectNotFoundError as e:
+    except ManagedObjectNotFoundError as e:  # noqa: F841
         raise exception.SignatureVerificationError(
             reason=_('Certificate not found with ID: %s')
             % signature_certificate_uuid)
diff --git a/doc/requirements.txt b/doc/requirements.txt
new file mode 100644
index 0000000..4ffbdec
--- /dev/null
+++ b/doc/requirements.txt
@@ -0,0 +1,9 @@
+# The order of packages is significant, because pip processes them in the order
+# of appearance. Changing the order has an impact on the overall integration
+# process, which may cause wedges in the gate later.
+
+sphinx>=1.6.2,!=1.6.6 # BSD
+openstackdocstheme>=1.17.0  # Apache-2.0
+
+# releasenotes
+reno>=1.8.0 # Apache2
diff --git a/requirements.txt b/requirements.txt
index 9d3b733..565149e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -3,7 +3,7 @@
 # process, which may cause wedges in the gate later.
 
 pbr>=1.6 # Apache-2.0
-cryptography!=1.3.0,>=1.0 # BSD/Apache-2.0
+cryptography>=2.1 # BSD/Apache-2.0
 oslo.serialization>=1.10.0 # Apache-2.0
 oslo.utils>=3.16.0 # Apache-2.0
 oslo.i18n>=2.1.0 # Apache-2.0
diff --git a/setup.cfg b/setup.cfg
index 59e7d65..73484b2 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -13,11 +13,11 @@ classifier =
     License :: OSI Approved :: Apache Software License
     Operating System :: POSIX :: Linux
     Programming Language :: Python
-    Programming Language :: Python :: 2
-    Programming Language :: Python :: 2.7
     Programming Language :: Python :: 3
-    Programming Language :: Python :: 3.3
-    Programming Language :: Python :: 3.4
+    Programming Language :: Python :: 3.6
+    Programming Language :: Python :: 3.7
+    Programming Language :: Python :: 3.8
+    Programming Language :: Python :: 3.9
 
 [files]
 packages =
diff --git a/test-requirements.txt b/test-requirements.txt
index 1a094ec..5f430d4 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -2,17 +2,13 @@
 # of appearance. Changing the order has an impact on the overall integration
 # process, which may cause wedges in the gate later.
 
-hacking<0.12,>=0.11.0 # Apache-2.0
+hacking>=3.1.0,<3.2.0 # Apache-2.0
 
+stestr>=3.0.1 # Apache-2.0
 coverage>=3.6 # Apache-2.0
 python-subunit>=0.0.18 # Apache-2.0/BSD
 mock>=2.0.0 # BSD
-sphinx>=1.6.2,!=1.6.6 # BSD
-openstackdocstheme>=1.17.0  # Apache-2.0
 oslotest>=1.10.0 # Apache-2.0
 testrepository>=0.0.18 # Apache-2.0/BSD
 testscenarios>=0.4 # Apache-2.0/BSD
 testtools>=1.4.0 # MIT
-
-# releasenotes
-reno>=1.8.0 # Apache2
diff --git a/tox.ini b/tox.ini
index 67cdd1e..ac74637 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,15 +1,21 @@
 [tox]
-minversion = 2.0
-envlist = py34,py27,pep8
+minversion = 3.1.0
+envlist = py38,py36,pep8
 skipsdist = True
+# this allows tox to infer the base python from the environment name
+# and override any basepython configured in this file
+ignore_basepython_conflict=true
 
 [testenv]
+basepython = python3
 usedevelop = True
 install_command = pip install -U {opts} {packages}
 setenv =
-   VIRTUAL_ENV={envdir}
+  VIRTUAL_ENV={envdir}
 deps = -r{toxinidir}/test-requirements.txt
-commands = python setup.py testr --slowest --testr-args='{posargs}'
+commands =
+  stestr run {posargs}
+  stestr slowest
 
 [testenv:pep8]
 commands = flake8 {posargs}
@@ -18,12 +24,26 @@ commands = flake8 {posargs}
 commands = {posargs}
 
 [testenv:cover]
-commands = python setup.py test --coverage --testr-args='{posargs}'
+setenv =
+  {[testenv]setenv}
+  PYTHON=coverage run --source cinder --parallel-mode
+commands =
+  stestr run {posargs}
+  coverage combine
+  coverage html -d cover
+  coverage xml -o cover/coverage.xml
 
 [testenv:docs]
-commands = python setup.py build_sphinx
+deps =
+  -c{env:UPPER_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+  -r{toxinidir}/doc/requirements.txt
+commands =
+  rm -fr doc/build/html doc/build/doctrees
+  sphinx-build -W -j auto -b html -d doc/build/doctrees doc/source doc/build/html
+whitelist_externals = rm
 
 [testenv:releasenotes]
+deps = {[testenv:docs]deps}
 commands =
   sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
 
@@ -33,6 +53,6 @@ commands = oslo_debug_helper {posargs}
 [flake8]
 
 show-source = True
-ignore = H301
+ignore = H301,W504
 builtins = _
 exclude=.venv,.git,.tox,dist,doc,*lib/python*,*egg,build