diff --git a/.gitmodules b/.gitmodules
index 35a54d3..25e6559 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,5 +1,5 @@
 [submodule "jjb/global-jjb"]
-	path = jjb/global-jjb
+	path = global-jjb
 	url = https://github.com/lfit/releng-global-jjb.git
 [submodule "packer/common-packer"]
 	path = packer/common-packer
diff --git a/Makefile b/Makefile
index 2d8c2ba..0f8597c 100644
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,7 @@
 .PHONY: test clean
 
 VENV_DIR      ?= venv-jjb
-JJB_VERSION   ?= 2.0.3
+JJB_VERSION   ?= 3.2.0
 JOBCONFIG_DIR ?= job-configs
 
 $(VENV_DIR):
diff --git a/global-jjb b/global-jjb
new file mode 160000
index 0000000..ff33e05
--- /dev/null
+++ b/global-jjb
@@ -0,0 +1 @@
+Subproject commit ff33e05030b95c28f28f1317f6ac713080e8a5fa
diff --git a/jjb/ci-management/ci-management.yaml b/jjb/ci-management/ci-management.yaml
index f0357ad..1720721 100644
--- a/jjb/ci-management/ci-management.yaml
+++ b/jjb/ci-management/ci-management.yaml
@@ -18,4 +18,4 @@
     project: 'ci-management'
     project-name: 'ci-management'
 
-    jjb-version: 2.0.3
+    jjb-version: 3.2.0
diff --git a/jjb/defaults.yaml b/jjb/defaults.yaml
index eb719c5..3e9562a 100644
--- a/jjb/defaults.yaml
+++ b/jjb/defaults.yaml
@@ -7,6 +7,11 @@
     # lftools
     lftools-version: '~=0.26.2'
 
+    # global-jjb required variables
+    submodule-disable: false
+    submodule-recursive: true
+    submodule-timeout: 10
+
     # lf-infra-defaults
     jenkins-ssh-credential: 'onos-jenkins-ssh'
 
diff --git a/jjb/global-jjb b/jjb/global-jjb
deleted file mode 160000
index ad0ee7c..0000000
--- a/jjb/global-jjb
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit ad0ee7c792b24345f2b419b3418bd84eac0f6ac1
diff --git a/jjb/global-jjb/jenkins-admin b/jjb/global-jjb/jenkins-admin
new file mode 120000
index 0000000..8e7fe05
--- /dev/null
+++ b/jjb/global-jjb/jenkins-admin
@@ -0,0 +1 @@
+../../global-jjb/jenkins-admin
\ No newline at end of file
diff --git a/jjb/global-jjb/jenkins-init-scripts b/jjb/global-jjb/jenkins-init-scripts
new file mode 120000
index 0000000..c7c6a95
--- /dev/null
+++ b/jjb/global-jjb/jenkins-init-scripts
@@ -0,0 +1 @@
+../../global-jjb/jenkins-init-scripts
\ No newline at end of file
diff --git a/jjb/global-jjb/jjb b/jjb/global-jjb/jjb
new file mode 120000
index 0000000..23c884f
--- /dev/null
+++ b/jjb/global-jjb/jjb
@@ -0,0 +1 @@
+../../global-jjb/jjb
\ No newline at end of file
diff --git a/jjb/global-jjb/shell b/jjb/global-jjb/shell
new file mode 120000
index 0000000..d37c43f
--- /dev/null
+++ b/jjb/global-jjb/shell
@@ -0,0 +1 @@
+../../global-jjb/shell
\ No newline at end of file
diff --git a/jjb/onos/onos-buck-gerrit-pipeline.yaml b/jjb/onos/onos-buck-gerrit-pipeline.yaml
index ad1a681..c7957af 100644
--- a/jjb/onos/onos-buck-gerrit-pipeline.yaml
+++ b/jjb/onos/onos-buck-gerrit-pipeline.yaml
@@ -28,8 +28,9 @@
             git-url: '$GIT_URL/$GERRIT_PROJECT'
             refspec: '$GERRIT_REFSPEC'
             branch: '$GERRIT_BRANCH'
-            #submodule-recursive: '{submodule-recursive}'
-            submodule-recursive: false
+            submodule-disable: '{submodule-disable}'
+            submodule-recursive: '{submodule-recursive}'
+            submodule-timeout: '{submodule-timeout}'
             choosing-strategy: gerrit
             #jenkins-ssh-credential: '{jenkins-ssh-credential}'
             jenkins-ssh-credential: 'onos-jenkins-ssh'
diff --git a/jjb/onos/onos-verify.yaml b/jjb/onos/onos-verify.yaml
index d7c3efb..09196cc 100644
--- a/jjb/onos/onos-verify.yaml
+++ b/jjb/onos/onos-verify.yaml
@@ -11,7 +11,6 @@
     ######################
 
     branch: master
-    submodule-recursive: true
     git-url: '$GIT_URL/$GERRIT_PROJECT'
 
     #####################
@@ -48,7 +47,9 @@
           git-url: '{git-url}'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
+          submodule-disable: '{submodule-disable}'
           submodule-recursive: '{submodule-recursive}'
+          submodule-timeout: '{submodule-timeout}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{jenkins-ssh-credential}'
 
@@ -83,7 +84,9 @@
           git-url: '{git-url}'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
+          submodule-disable: '{submodule-disable}'
           submodule-recursive: '{submodule-recursive}'
+          submodule-timeout: '{submodule-timeout}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{jenkins-ssh-credential}'
 
@@ -129,7 +132,9 @@
           git-url: '{git-url}'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
+          submodule-disable: '{submodule-disable}'
           submodule-recursive: '{submodule-recursive}'
+          submodule-timeout: '{submodule-timeout}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{jenkins-ssh-credential}'
 
@@ -173,7 +178,9 @@
           git-url: '{git-url}'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
+          submodule-disable: '{submodule-disable}'
           submodule-recursive: '{submodule-recursive}'
+          submodule-timeout: '{submodule-timeout}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{jenkins-ssh-credential}'
 
@@ -208,7 +215,9 @@
           git-url: '{git-url}'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
+          submodule-disable: '{submodule-disable}'
           submodule-recursive: '{submodule-recursive}'
+          submodule-timeout: '{submodule-timeout}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{jenkins-ssh-credential}'
 
@@ -234,7 +243,9 @@
           git-url: '{git-url}'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
+          submodule-disable: '{submodule-disable}'
           submodule-recursive: '{submodule-recursive}'
+          submodule-timeout: '{submodule-timeout}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{jenkins-ssh-credential}'
 
@@ -332,7 +343,9 @@
           git-url: '{git-url}'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
+          submodule-disable: '{submodule-disable}'
           submodule-recursive: '{submodule-recursive}'
+          submodule-timeout: '{submodule-timeout}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{jenkins-ssh-credential}'
 
diff --git a/jjb/routing/routing-verify.yaml b/jjb/routing/routing-verify.yaml
index 218855d..97603e1 100644
--- a/jjb/routing/routing-verify.yaml
+++ b/jjb/routing/routing-verify.yaml
@@ -11,7 +11,6 @@
     ######################
 
     branch: master
-    submodule-recursive: true
     git-url: '$GIT_URL/$GERRIT_PROJECT'
 
     #####################
@@ -48,7 +47,9 @@
           git-url: '{git-url}'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
+          submodule-disable: '{submodule-disable}'
           submodule-recursive: '{submodule-recursive}'
+          submodule-timeout: '{submodule-timeout}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{jenkins-ssh-credential}'
 
diff --git a/jjb/shell/jflint.sh b/jjb/shell/jflint.sh
new file mode 100755
index 0000000..3f785bd
--- /dev/null
+++ b/jjb/shell/jflint.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# jflint.sh - lint for Jenkins declarative pipeline jobs
+#
+# curl commands from: https://jenkins.io/doc/book/pipeline/development/#linter
+
+set -e -u -o pipefail
+
+JENKINS_URL=https://jenkins.onosproject.org/
+JF_LIST=()
+
+JF_FAIL=0
+
+# if no args, and there's a Jenkinsfile in cwd, check it
+if [ ! -n "$1" ] && [ -f "Jenkinsfile" ] ; then
+  JF_LIST+=("Jenkinsfile")
+else
+# iterate over all args, check if they exist, then add to list of jenkinsfiles to check
+  for arg in "$@"; do
+    if [ -f "$arg" ]; then
+      JF_LIST+=($arg)
+    else
+      echo "File does not exist: ${arg}"
+      exit 1;
+    fi
+  done
+fi
+
+# JENKINS_CRUMB is needed if your Jenkins master has CRSF protection enabled as it should
+JENKINS_CRUMB=$(curl -s "$JENKINS_URL/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,\":\",//crumb)")
+
+for target in "${JF_LIST[@]-}"; do
+  echo "Checking: '${target}'"
+  CURL_OUT=$(curl -s -H "${JENKINS_CRUMB}" -F "jenkinsfile=<${target}" $JENKINS_URL/pipeline-model-converter/validate)
+
+  # Jenkins doesn't set a HTTP failure code when validation fails, so check output
+  if [[ $CURL_OUT =~ Jenkinsfile\ successfully\ validated ]]
+  then
+    echo "Validated successfully: '${target}'"
+  else
+    echo "Failed to validate: '${target}' - errors:"
+    echo "$CURL_OUT"
+    JF_FAIL=1
+  fi
+
+done
+
+exit $JF_FAIL
diff --git a/jjb/templates/make-test.yaml b/jjb/templates/make-test.yaml
index 2928e64..f8b1c69 100644
--- a/jjb/templates/make-test.yaml
+++ b/jjb/templates/make-test.yaml
@@ -32,7 +32,7 @@
           git-url: '$GIT_URL/$GERRIT_PROJECT'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
-          submodule-recursive: 'false'
+          submodule-recursive: '{submodule-recursive}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{jenkins-ssh-credential}'
           basedir: '{project}'
diff --git a/jjb/templates/sync-dir.yaml b/jjb/templates/sync-dir.yaml
index 8faa101..362ea0b 100644
--- a/jjb/templates/sync-dir.yaml
+++ b/jjb/templates/sync-dir.yaml
@@ -52,7 +52,9 @@
           git-url: '$GIT_URL/$GERRIT_PROJECT'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
-          submodule-recursive: 'false'
+          submodule-disable: '{submodule-disable}'
+          submodule-recursive: '{submodule-recursive}'
+          submodule-timeout: '{submodule-timeout}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{gerrit-ssh-credential}'
 
diff --git a/jjb/templates/verify-licensed.yaml b/jjb/templates/verify-licensed.yaml
index 48bf37a..fe4ef6d 100644
--- a/jjb/templates/verify-licensed.yaml
+++ b/jjb/templates/verify-licensed.yaml
@@ -30,7 +30,9 @@
           git-url: '$GIT_URL/$GERRIT_PROJECT'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
-          submodule-recursive: 'false'
+          submodule-disable: '{submodule-disable}'
+          submodule-recursive: '{submodule-recursive}'
+          submodule-timeout: '{submodule-timeout}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{jenkins-ssh-credential}'
 
diff --git a/jjb/templates/versioning.yaml b/jjb/templates/versioning.yaml
index 9e2f164..5c56f33 100644
--- a/jjb/templates/versioning.yaml
+++ b/jjb/templates/versioning.yaml
@@ -49,7 +49,9 @@
           git-url: '$GIT_URL/$GERRIT_PROJECT'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
-          submodule-recursive: 'false'
+          submodule-disable: '{submodule-disable}'
+          submodule-recursive: '{submodule-recursive}'
+          submodule-timeout: '{submodule-timeout}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{gerrit-ssh-credential}'
 
@@ -95,7 +97,9 @@
           git-url: '$GIT_URL/$GERRIT_PROJECT'
           refspec: '$GERRIT_REFSPEC'
           branch: '$GERRIT_BRANCH'
-          submodule-recursive: 'false'
+          submodule-disable: '{submodule-disable}'
+          submodule-recursive: '{submodule-recursive}'
+          submodule-timeout: '{submodule-timeout}'
           choosing-strategy: gerrit
           jenkins-ssh-credential: '{gerrit-ssh-credential}'
 
diff --git a/packer/provision/baseline.sh b/packer/provision/baseline.sh
index 4495165..6d8a759 100644
--- a/packer/provision/baseline.sh
+++ b/packer/provision/baseline.sh
@@ -112,7 +112,8 @@
     # group with dnf based systems (F21+) will fail the install if such
     # a group does not exist
     yum install -y unzip xz puppet git git-review perl-XML-XPath
-    yum install -y python-{devel,virtualenv,setuptools,pip}
+    yum install -y python-{devel,virtualenv}
+    yum install -y python3-{devel,setuptools,pip}
 
     # All of our systems require Java (because of Jenkins)
     # Install all versions of the OpenJDK devel but force 1.7.0 to be the