diff --git a/releasenotes/notes/identity-feature-opt-cleanup-caracal-7afd283855a07025.yaml b/releasenotes/notes/identity-feature-opt-cleanup-caracal-7afd283855a07025.yaml
new file mode 100644
index 0000000..67f6ede
--- /dev/null
+++ b/releasenotes/notes/identity-feature-opt-cleanup-caracal-7afd283855a07025.yaml
@@ -0,0 +1,21 @@
+---
+upgrade:
+  - |
+    The following deprecated options in the ``[identity-feature-enabled]``
+    section have been removed. Project tags API and application credentials
+    API are now always tested if identity v3 API is available.
+
+    - ``project_tag``
+    - ``application_credentials``
+
+  - |
+    Default value of the ``[identity-feature-enabled] access_rule`` option has
+    been changed from ``False`` to ``True`` and now the access rule API is
+    always tested when identity API is available.
+
+deprecations:
+  - |
+    The Keystone access_rule is enabled by default since Train release and we
+    no longer need a separate config in Tempest to enable it. Therefore
+    the ``[identity-feature-enabled] access_rule`` option has been deprecated
+    and will be removed in a future release.
diff --git a/releasenotes/notes/remove-compute-feature-enabled-block-migrate-cinder-iscsi-882da88096019f3c.yaml b/releasenotes/notes/remove-compute-feature-enabled-block-migrate-cinder-iscsi-882da88096019f3c.yaml
new file mode 100644
index 0000000..2808677
--- /dev/null
+++ b/releasenotes/notes/remove-compute-feature-enabled-block-migrate-cinder-iscsi-882da88096019f3c.yaml
@@ -0,0 +1,8 @@
+---
+upgrade:
+  - |
+    The deprecated ``[compute-feature-enabled] block_migrate_cinder_iscsi``
+    option has been removed.
+    Now the ``[compute-feature-enabled] block_migration_for_live_migration``
+    option is solely used to determine when to run block migration based tests
+    during live migration.
diff --git a/releasenotes/notes/remove-nova_cert-e2ee70a40e117e8a.yaml b/releasenotes/notes/remove-nova_cert-e2ee70a40e117e8a.yaml
new file mode 100644
index 0000000..1a292f0
--- /dev/null
+++ b/releasenotes/notes/remove-nova_cert-e2ee70a40e117e8a.yaml
@@ -0,0 +1,6 @@
+---
+upgrade:
+  - |
+    The deprecated ``[compute-feature-enabled] nova_cert`` option has been
+    removed. The nova-cert service was removed from nova in 16.0.0 release.
+    Tests of compute root certificates API have also been removed.
diff --git a/releasenotes/notes/remove-rdp_console-34e11f58d525905a.yaml b/releasenotes/notes/remove-rdp_console-34e11f58d525905a.yaml
new file mode 100644
index 0000000..4f03150
--- /dev/null
+++ b/releasenotes/notes/remove-rdp_console-34e11f58d525905a.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    The deprecated ``[compute-feature-enabled] rdp_console`` config option has
+    been removed.
diff --git a/releasenotes/notes/remove-vnc-server-header-1a9731ba10242603.yaml b/releasenotes/notes/remove-vnc-server-header-1a9731ba10242603.yaml
new file mode 100644
index 0000000..cf14513
--- /dev/null
+++ b/releasenotes/notes/remove-vnc-server-header-1a9731ba10242603.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    The deprecated ``[compute-feature-enabled] vnc_server_header`` option has
+    been removed.
diff --git a/tempest/api/compute/admin/test_live_migration.py b/tempest/api/compute/admin/test_live_migration.py
index 429755a..f6a1ae9 100644
--- a/tempest/api/compute/admin/test_live_migration.py
+++ b/tempest/api/compute/admin/test_live_migration.py
@@ -175,9 +175,6 @@
     @testtools.skipIf(not CONF.compute_feature_enabled.
                       block_migration_for_live_migration,
                       'Block Live migration not available')
-    @testtools.skipIf(not CONF.compute_feature_enabled.
-                      block_migrate_cinder_iscsi,
-                      'Block Live migration not configured for iSCSI')
     @utils.services('volume')
     def test_live_block_migration_with_attached_volume(self):
         """Test the live-migration of an instance with an attached volume.
diff --git a/tempest/api/compute/certificates/test_certificates.py b/tempest/api/compute/certificates/test_certificates.py
deleted file mode 100644
index 5917931..0000000
--- a/tempest/api/compute/certificates/test_certificates.py
+++ /dev/null
@@ -1,40 +0,0 @@
-# Copyright 2012 OpenStack Foundation
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-from tempest.api.compute import base
-from tempest import config
-from tempest.lib import decorators
-
-CONF = config.CONF
-
-
-class CertificatesV2TestJSON(base.BaseV2ComputeTest):
-    """Test Certificates API"""
-
-    @classmethod
-    def skip_checks(cls):
-        super(CertificatesV2TestJSON, cls).skip_checks()
-        if not CONF.compute_feature_enabled.nova_cert:
-            raise cls.skipException("Nova cert is not available")
-
-    @decorators.idempotent_id('c070a441-b08e-447e-a733-905909535b1b')
-    def test_create_root_certificate(self):
-        """Test creating root certificate"""
-        self.certificates_client.create_certificate()
-
-    @decorators.idempotent_id('3ac273d0-92d2-4632-bdfc-afbc21d4606c')
-    def test_get_root_certificate(self):
-        """Test getting root certificate details"""
-        self.certificates_client.show_certificate('root')
diff --git a/tempest/api/identity/admin/v3/test_project_tags.py b/tempest/api/identity/admin/v3/test_project_tags.py
index 2cc7257..2004cbc 100644
--- a/tempest/api/identity/admin/v3/test_project_tags.py
+++ b/tempest/api/identity/admin/v3/test_project_tags.py
@@ -13,8 +13,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import testtools
-
 from tempest.api.identity import base
 from tempest import config
 from tempest.lib.common.utils import data_utils
@@ -33,8 +31,6 @@
     force_tenant_isolation = False
 
     @decorators.idempotent_id('7c123aac-999d-416a-a0fb-84b915ab10de')
-    @testtools.skipUnless(CONF.identity_feature_enabled.project_tags,
-                          'Project tags not available.')
     def test_list_update_delete_project_tags(self):
         """Test listing, updating and deleting of project tags"""
         project = self.setup_test_project()
diff --git a/tempest/api/identity/base.py b/tempest/api/identity/base.py
index c9e0e1c..9cdd917 100644
--- a/tempest/api/identity/base.py
+++ b/tempest/api/identity/base.py
@@ -322,13 +322,6 @@
 class BaseApplicationCredentialsV3Test(BaseIdentityV3Test):
 
     @classmethod
-    def skip_checks(cls):
-        super(BaseApplicationCredentialsV3Test, cls).skip_checks()
-        if not CONF.identity_feature_enabled.application_credentials:
-            raise cls.skipException("Application credentials are not available"
-                                    " in this environment")
-
-    @classmethod
     def resource_setup(cls):
         super(BaseApplicationCredentialsV3Test, cls).resource_setup()
         cls.user_id = cls.os_primary.credentials.user_id
diff --git a/tempest/config.py b/tempest/config.py
index 699e271..e4e7171 100644
--- a/tempest/config.py
+++ b/tempest/config.py
@@ -263,23 +263,11 @@
                 default=False,
                 help='Does the environment have the security compliance '
                      'settings enabled?'),
-    cfg.BoolOpt('project_tags',
-                default=True,
-                help='Is the project tags identity v3 API available?',
-                deprecated_for_removal=True,
-                deprecated_reason='Project tags API is a default feature '
-                                  'since Queens'),
-    cfg.BoolOpt('application_credentials',
-                default=True,
-                help='Does the environment have application credentials '
-                     'enabled?',
-                deprecated_for_removal=True,
-                deprecated_reason='Application credentials is a default '
-                                  'feature since Queens'),
-    # Access rules for application credentials is a default feature in Train.
-    # This config option can removed once Stein is EOL.
     cfg.BoolOpt('access_rules',
-                default=False,
+                default=True,
+                deprecated_for_removal=True,
+                deprecated_reason='Access rules for application credentials '
+                                  'is a default feature since Train',
                 help='Does the environment have access rules enabled?'),
     cfg.BoolOpt('immutable_user_source',
                 default=False,
@@ -501,18 +489,6 @@
                 default=False,
                 help="Does the test environment use block devices for live "
                      "migration"),
-    cfg.BoolOpt('block_migrate_cinder_iscsi',
-                default=False,
-                help="Does the test environment support block migration with "
-                "Cinder iSCSI volumes. Note: libvirt >= 1.2.17 is required "
-                "to support this if using the libvirt compute driver.",
-                deprecated_for_removal=True,
-                deprecated_reason='This option duplicates the more generic '
-                                  '[compute-feature-enabled]/block_migration '
-                                  '_for_live_migration now that '
-                                  'MIN_LIBVIRT_VERSION is >= 1.2.17 on all '
-                                  'branches from stable/rocky and will be '
-                                  'removed in a future release.'),
     cfg.BoolOpt('can_migrate_between_any_hosts',
                 default=True,
                 help="Does the test environment support migrating between "
@@ -523,15 +499,6 @@
                 default=False,
                 help='Enable VNC console. This configuration value should '
                      'be same as nova.conf: vnc.enabled'),
-    cfg.StrOpt('vnc_server_header',
-               default='WebSockify',
-               help='Expected VNC server name (WebSockify, nginx, etc) '
-                    'in response header.',
-               deprecated_for_removal=True,
-               deprecated_reason='This option will be ignored because the '
-                                 'usage of different response header fields '
-                                 'to accomplish the same goal (in accordance '
-                                 'with RFC7231 S6.2.2) makes it obsolete.'),
     cfg.BoolOpt('spice_console',
                 default=False,
                 help='Enable Spice console. This configuration value should '
@@ -540,14 +507,6 @@
                 deprecated_reason="This config option is not being used "
                                   "in Tempest, we can add it back when "
                                   "adding the test cases."),
-    cfg.BoolOpt('rdp_console',
-                default=False,
-                help='Enable RDP console. This configuration value should '
-                     'be same as nova.conf: rdp.enabled',
-                deprecated_for_removal=True,
-                deprecated_reason="This config option is not being used "
-                                  "in Tempest, we can add it back when "
-                                  "adding the test cases."),
     cfg.BoolOpt('serial_console',
                 default=False,
                 help='Enable serial console. This configuration value '
@@ -575,13 +534,6 @@
                 default=True,
                 help='Does the test environment support creating snapshot '
                      'images of running instances?'),
-    cfg.BoolOpt('nova_cert',
-                default=False,
-                help='Does the test environment have the nova cert running?',
-                deprecated_for_removal=True,
-                deprecated_reason="On Nova side, the nova-cert service is "
-                                  "deprecated and the service will be removed "
-                                  "as early as Ocata."),
     cfg.BoolOpt('personality',
                 default=False,
                 help='Does the test environment support server personality'),
@@ -909,10 +861,11 @@
                 help='Enable/disable security group rules.'),
     cfg.StrOpt('connect_method',
                default='floating',
-               choices=['fixed', 'floating'],
-               help='Default IP type used for validation: '
-                    '-fixed: uses the first IP belonging to the fixed network '
-                    '-floating: creates and uses a floating IP'),
+               choices=[('fixed',
+                         'uses the first IP belonging to the fixed network'),
+                        ('floating',
+                         'creates and uses a floating IP')],
+               help='Default IP type used for validation'),
     cfg.StrOpt('auth_method',
                default='keypair',
                choices=['keypair'],