diff --git a/fixtures/scenario001.pp b/fixtures/scenario001.pp
index a8dae02a1..ba3503e82 100644
--- a/fixtures/scenario001.pp
+++ b/fixtures/scenario001.pp
@@ -24,7 +24,8 @@ case $::osfamily {
   'RedHat': {
     $ipv6            = true
     $enable_panko    = true
-    $enable_vitrage  = true
+    # TODO(EmilienM) enable vitrage again when it's stable
+    $enable_vitrage  = false
   }
   default: {
     fail("Unsupported osfamily (${::osfamily})")
diff --git a/manifests/designate.pp b/manifests/designate.pp
index 849c21536..4a1ed115d 100644
--- a/manifests/designate.pp
+++ b/manifests/designate.pp
@@ -21,6 +21,8 @@ class openstack_integration::designate {
     require              => Class['::rabbitmq'],
   }
 
+  Rabbitmq_user_permissions['designate@/'] -> Service<| tag == 'designate-service' |>
+
   class { '::designate::db::mysql':
     password => 'designate',
   }
diff --git a/run_tests.sh b/run_tests.sh
index 5fc77c090..ea1f8f8c1 100755
--- a/run_tests.sh
+++ b/run_tests.sh
@@ -275,7 +275,7 @@ if uses_debs; then
   # TODO(aschultz): check this after ocata-m3 is published for UCA
   # 1) this will disable the lbaas listeners tests for ubuntu only due to flakey
   # failures
-  EXCLUDES="--regex=^(?!neutron_lbaas.tests.tempest.v2.api.test_listeners_.*admin.ListenersTestJSON.*$)(?!ceilometer.tests.tempest.api.test_telemetry_notification_api.TelemetryNotificationAPITest.test_check_glance_v2_notifications.*$).*"
+  EXCLUDES="--regex=^(?!neutron_lbaas.tests.tempest.v2.api.test_listeners_.*admin.ListenersTestJSON.*$)(?!neutron_fwaas.tests.tempest_plugin.tests.api.test_fwaas_extensions.*$)(?!ceilometer.tests.tempest.api.test_telemetry_notification_api.TelemetryNotificationAPITest.test_check_glance_v2_notifications.*$).*"
 else
   EXCLUDES="--regex=^(?!mistral_tempest_tests.tests.api.v2.test_executions.ExecutionTestsV2.test_get_list_executions.*$)(?!ceilometer.tests.tempest.api.test_telemetry_notification_api.TelemetryNotificationAPITest.test_check_glance_v2_notifications.*$).*"
 fi