diff --git a/ironic/tests/unit/db/sqlalchemy/test_migrations.py b/ironic/tests/unit/db/sqlalchemy/test_migrations.py
index f4b4708fc9..fdffe4b99d 100644
--- a/ironic/tests/unit/db/sqlalchemy/test_migrations.py
+++ b/ironic/tests/unit/db/sqlalchemy/test_migrations.py
@@ -65,8 +65,8 @@ MIGRATIONS_TIMEOUT = 300
 
 @contextlib.contextmanager
 def patch_with_engine(engine):
-    with mock.patch.object(enginefacade.writer,
-                           'get_engine') as patch_engine:
+    with mock.patch.object(enginefacade.writer, 'get_engine',
+                           autospec=True) as patch_engine:
         patch_engine.return_value = engine
         yield
 
@@ -150,10 +150,10 @@ class TestWalkVersions(base.TestCase, WalkVersionsMixin):
         self._pre_upgrade_141.assert_called_with(self.engine)
         self._check_141.assert_called_with(self.engine, test_value)
 
-    @mock.patch.object(script, 'ScriptDirectory')
-    @mock.patch.object(WalkVersionsMixin, '_migrate_up')
+    @mock.patch.object(script, 'ScriptDirectory', autospec=True)
+    @mock.patch.object(WalkVersionsMixin, '_migrate_up', autospec=True)
     def test_walk_versions_all_default(self, _migrate_up, script_directory):
-        fc = script_directory.from_config()
+        fc = script_directory.from_config.return_value
         fc.walk_revisions.return_value = self.versions
         self.migration_api.version.return_value = None
 
@@ -161,20 +161,20 @@ class TestWalkVersions(base.TestCase, WalkVersionsMixin):
 
         self.migration_api.version.assert_called_with(self.config)
 
-        upgraded = [mock.call(self.engine, self.config, v.revision,
+        upgraded = [mock.call(self, self.engine, self.config, v.revision,
                     with_data=True) for v in reversed(self.versions)]
         self.assertEqual(self._migrate_up.call_args_list, upgraded)
 
-    @mock.patch.object(script, 'ScriptDirectory')
-    @mock.patch.object(WalkVersionsMixin, '_migrate_up')
+    @mock.patch.object(script, 'ScriptDirectory', autospec=True)
+    @mock.patch.object(WalkVersionsMixin, '_migrate_up', autospec=True)
     def test_walk_versions_all_false(self, _migrate_up, script_directory):
-        fc = script_directory.from_config()
+        fc = script_directory.from_config.return_value
         fc.walk_revisions.return_value = self.versions
         self.migration_api.version.return_value = None
 
         self._walk_versions(self.engine, self.config)
 
-        upgraded = [mock.call(self.engine, self.config, v.revision,
+        upgraded = [mock.call(self, self.engine, self.config, v.revision,
                     with_data=True) for v in reversed(self.versions)]
         self.assertEqual(upgraded, self._migrate_up.call_args_list)
 
diff --git a/ironic/tests/unit/dhcp/test_factory.py b/ironic/tests/unit/dhcp/test_factory.py
index 008efefced..02362efcb0 100644
--- a/ironic/tests/unit/dhcp/test_factory.py
+++ b/ironic/tests/unit/dhcp/test_factory.py
@@ -61,8 +61,8 @@ class TestDHCPFactory(base.TestCase):
                     group='dhcp')
         dhcp_factory.DHCPFactory()
 
-        with mock.patch.object(dhcp_factory.DHCPFactory,
-                               '_set_dhcp_provider') as mock_set_dhcp:
+        with mock.patch.object(dhcp_factory.DHCPFactory, '_set_dhcp_provider',
+                               autospec=True) as mock_set_dhcp:
             # There is already a dhcp_provider, so this shouldn't call
             # _set_dhcp_provider again.
             dhcp_factory.DHCPFactory()
diff --git a/lower-constraints.txt b/lower-constraints.txt
index 51cafb54c9..92714dec05 100644
--- a/lower-constraints.txt
+++ b/lower-constraints.txt
@@ -8,6 +8,7 @@ ddt==1.0.1
 doc8==0.6.0
 eventlet==0.18.2
 fixtures==3.0.0
+flake8==3.7.0
 flake8-import-order==0.17.1
 futurist==1.2.0
 hacking==3.0.0
diff --git a/test-requirements.txt b/test-requirements.txt
index 8e0eab73a3..c5e6d36619 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -18,6 +18,7 @@ testresources>=2.0.0 # Apache-2.0/BSD
 testscenarios>=0.4 # Apache-2.0/BSD
 WebTest>=2.0.27 # MIT
 bashate>=0.5.1 # Apache-2.0
+flake8>=3.7.0 # MIT
 flake8-import-order>=0.17.1 # LGPLv3
 Pygments>=2.2.0 # BSD
 bandit!=1.6.0,>=1.1.0,<2.0.0 # Apache-2.0
diff --git a/tox.ini b/tox.ini
index 2ce36f9f59..b54deec3e7 100644
--- a/tox.ini
+++ b/tox.ini
@@ -120,9 +120,17 @@ max-complexity=18
 # [H203] Use assertIs(Not)None to check for None.
 # [H204] Use assert(Not)Equal to check for equality.
 # [H205] Use assert(Greater|Less)(Equal) for comparison.
-# TODO(dtantsur): [H210] Require ‘autospec’, ‘spec’, or ‘spec_set’ in mock.patch/mock.patch.object calls
+# [H210] Require ‘autospec’, ‘spec’, or ‘spec_set’ in mock.patch/mock.patch.object calls
 # [H904] Delay string interpolations at logging calls.
-enable-extensions=H106,H203,H204,H205,H904
+enable-extensions=H106,H203,H204,H205,H210,H904
+# TODO(rpittau) remove the ignores below when we're ready to apply H210 to
+# the various modules. This can be done in batches changing the filters.
+per-file-ignores =
+    ironic/tests/unit/api/*:H210
+    ironic/tests/unit/conductor/*:H210
+    ironic/tests/unit/common/*:H210
+    ironic/tests/unit/drivers/modules/*:H210
+    ironic/tests/unit/drivers/third_party_driver_mocks.py:H210
 
 [hacking]
 import_exceptions = testtools.matchers, ironic.common.i18n