diff --git a/test-requirements.txt b/test-requirements.txt
index af4d44a5..c1b238ac 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,5 +1,3 @@
-ansible-lint<=2.3.9
-ansible>=1.9.1,<2.0.0,!=1.9.6
 bashate>=0.2 # Apache-2.0
 flake8>=2.5.4,<2.6.0  # MIT
 
diff --git a/tests/ansible-role-requirements.yml b/tests/ansible-role-requirements.yml
index f573a8a5..855cce0a 100644
--- a/tests/ansible-role-requirements.yml
+++ b/tests/ansible-role-requirements.yml
@@ -2,6 +2,10 @@
   src: https://git.openstack.org/openstack/openstack-ansible-apt_package_pinning
   scm: git
   version: master
+- name: pip_install
+  src: https://git.openstack.org/openstack/openstack-ansible-pip_install
+  scm: git
+  version: master
 - name: galera_client
   src: https://git.openstack.org/openstack/openstack-ansible-galera_client
   scm: git
@@ -34,10 +38,6 @@
   src: https://git.openstack.org/openstack/openstack-ansible-os_keystone
   scm: git
   version: master
-- name: pip_install
-  src: https://git.openstack.org/openstack/openstack-ansible-pip_install
-  scm: git
-  version: master
 - name: rabbitmq_server
   src: https://git.openstack.org/openstack/openstack-ansible-rabbitmq_server
   scm: git
diff --git a/tox.ini b/tox.ini
index 2a57b798..76a77222 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,50 +1,59 @@
 [tox]
-minversion = 1.6
+minversion = 2.0
 skipsdist = True
 envlist = docs,linters,functional
 
 
 [testenv]
 usedevelop = True
-install_command = pip install -U {opts} {packages}
-deps = -r{toxinidir}/test-requirements.txt
-commands = /usr/bin/find . -type f -name "*.pyc" -delete
+install_command =
+    pip install -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt} {opts} {packages}
+deps =
+    -r{toxinidir}/test-requirements.txt
+commands =
+    /usr/bin/find . -type f -name "*.pyc" -delete
 passenv =
     HOME
+    http_proxy
+    HTTP_PROXY
+    https_proxy
+    HTTPS_PROXY
+    no_proxy
+    NO_PROXY
 whitelist_externals =
     bash
     git
     rm
-    echo
-    curl
+    wget
 setenv =
     VIRTUAL_ENV={envdir}
-    ANSIBLE_HOST_KEY_CHECKING = False
-    ANSIBLE_SSH_CONTROL_PATH = /tmp/%%h-%%r
-    # TODO (odyssey4me) These are only here as they are non-standard folder
-    # names for Ansible 1.9.x. We are using the standard folder names for
-    # Ansible v2.x. We can remove this when we move to Ansible 2.x.
-    ANSIBLE_ACTION_PLUGINS = {homedir}/.ansible/plugins/action
-    ANSIBLE_CALLBACK_PLUGINS = {homedir}/.ansible/plugins/callback
-    ANSIBLE_FILTER_PLUGINS = {homedir}/.ansible/plugins/filter
-    ANSIBLE_LOOKUP_PLUGINS = {homedir}/.ansible/plugins/lookup
-    # This is required as the default is the current path or a path specified
-    # in ansible.cfg
-    ANSIBLE_LIBRARY = {homedir}/.ansible/plugins/library
-    # This is required as the default is '/etc/ansible/roles' or a path
-    # specified in ansible.cfg
-    ANSIBLE_ROLES_PATH = {homedir}/.ansible/roles:{toxinidir}/..
 
 
 [testenv:docs]
 commands=
+    bash -c "rm -rf doc/build"
     python setup.py build_sphinx
 
 
+[testenv:releasenotes]
+# NOTE(sdague): this target does not use constraints because
+# upstream infra does not yet support it. Once that's fixed, we can
+# drop the install_command.
+install_command =
+    pip install -U --force-reinstall {opts} {packages}
+commands =
+    sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
+
+
 # environment used by the -infra templated docs job
 [testenv:venv]
-deps = -r{toxinidir}/test-requirements.txt
-commands = {posargs}
+# NOTE(jaegerandi): this target does not use constraints because
+# upstream infra does not yet support it. Once that's fixed, we can
+# drop the install_command.
+install_command =
+    pip install -U --force-reinstall {opts} {packages}
+commands =
+    {posargs}
 
 
 [testenv:pep8]
@@ -59,15 +68,14 @@ commands =
         --exclude-dir doc \
         {toxinidir} | xargs flake8 --verbose"
 
+
 [flake8]
 # Ignores the following rules due to how ansible modules work in general
 #     F403 'from ansible.module_utils.basic import *' used;
 #          unable to detect undefined names
 #     H303 No wildcard (*) import.
 ignore=F403,H303
-# The max-line-length is being set at a greater width in order to accommodate
-# jinja templating in python files, especially in the shebang.
-max-line-length = 120
+
 
 [testenv:bashate]
 commands =
@@ -86,15 +94,48 @@ commands =
         {toxinidir} | xargs bashate --error . --verbose --ignore=E003,E006,E040"
 
 
-[testenv:ansible-syntax]
+[testenv:ansible]
+deps =
+    {[testenv]deps}
+    ansible==1.9.4
+    ansible-lint>=2.7.0,<3.0.0
+setenv =
+    {[testenv]setenv}
+    ANSIBLE_HOST_KEY_CHECKING = False
+    ANSIBLE_SSH_CONTROL_PATH = /tmp/%%h-%%r
+    # TODO (odyssey4me) These are only here as they are non-standard folder
+    # names for Ansible 1.9.x. We are using the standard folder names for
+    # Ansible v2.x. We can remove this when we move to Ansible 2.x.
+    ANSIBLE_ACTION_PLUGINS = {homedir}/.ansible/plugins/action
+    ANSIBLE_CALLBACK_PLUGINS = {homedir}/.ansible/plugins/callback
+    ANSIBLE_FILTER_PLUGINS = {homedir}/.ansible/plugins/filter
+    ANSIBLE_LOOKUP_PLUGINS = {homedir}/.ansible/plugins/lookup
+    # This is required as the default is the current path or a path specified
+    # in ansible.cfg
+    ANSIBLE_LIBRARY = {homedir}/.ansible/plugins/library
+    # This is required as the default is '/etc/ansible/roles' or a path
+    # specified in ansible.cfg
+    ANSIBLE_ROLES_PATH = {homedir}/.ansible/roles:{toxinidir}/..
 commands =
-    rm -rf {homedir}/.ansible
+    rm -rf {homedir}/.ansible/plugins
     git clone https://git.openstack.org/openstack/openstack-ansible-plugins \
               {homedir}/.ansible/plugins
+    # This plugin makes the ansible-playbook output easier to read
+    wget -O {homedir}/.ansible/plugins/callback/human_log.py \
+      https://gist.githubusercontent.com/cliffano/9868180/raw/f360f306b3c6d689734a6aa8773a00edf16a0054/human_log.py
+    rm -rf {homedir}/.ansible/roles
     ansible-galaxy install \
                    --role-file={toxinidir}/tests/ansible-role-requirements.yml \
-                   --ignore-errors \
                    --force
+
+
+[testenv:ansible-syntax]
+deps =
+    {[testenv:ansible]deps}
+setenv =
+    {[testenv:ansible]setenv}
+commands =
+    {[testenv:ansible]commands}
     ansible-playbook -i {toxinidir}/tests/inventory \
                      --syntax-check \
                      --list-tasks \
@@ -103,31 +144,37 @@ commands =
 
 
 [testenv:ansible-lint]
+deps =
+    {[testenv:ansible]deps}
 commands =
-    ansible-lint {toxinidir}/tests/test.yml
+    ansible-lint {toxinidir}
 
 
 [testenv:functional]
+# NOTE(odyssey4me): this target does not use constraints because
+# it doesn't work in OpenStack-CI yet. Once that's fixed, we can
+# drop the install_command.
+install_command =
+    pip install -U --force-reinstall {opts} {packages}
+deps =
+    {[testenv:ansible]deps}
+setenv =
+    {[testenv:ansible]setenv}
 commands =
-    rm -rf {homedir}/.ansible
-    git clone https://git.openstack.org/openstack/openstack-ansible-plugins \
-              {homedir}/.ansible/plugins
-    ansible-galaxy install \
-                   --role-file={toxinidir}/tests/ansible-role-requirements.yml \
-                   --ignore-errors \
-                   --force
+    {[testenv:ansible]commands}
     ansible-playbook -i {toxinidir}/tests/inventory \
                      -e "rolename={toxinidir}" \
-                     -vv \
-                     {toxinidir}/tests/test.yml
+                     -e "install_test_packages=True" \
+                     {toxinidir}/tests/test.yml -vvvv
 
 
 [testenv:linters]
+deps =
+    {[testenv:ansible]deps}
+setenv =
+    {[testenv:ansible]setenv}
 commands =
     {[testenv:pep8]commands}
     {[testenv:bashate]commands}
     {[testenv:ansible-lint]commands}
     {[testenv:ansible-syntax]commands}
-
-[testenv:releasenotes]
-commands = sphinx-build -a -E -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html