diff --git a/cicd-lab-pipeline.groovy b/cicd-lab-pipeline.groovy
index fe99ecb..3ac17b5 100644
--- a/cicd-lab-pipeline.groovy
+++ b/cicd-lab-pipeline.groovy
@@ -167,7 +167,7 @@
                 // services are deployed
                 // XXX: for some weird unknown reason, refresh_pillar is
                 // required to execute here
-                salt.runSaltProcessStep(master, 'I@aptly:publisher', 'saltutil.refresh_pillar', [], null, true)
+                salt.runSaltProcessStep(saltMaster, 'I@aptly:publisher', 'saltutil.refresh_pillar', [], null, true)
                 salt.enforceState(saltMaster, 'I@aptly:publisher', 'aptly.publisher', true)
                 retry(3) {
                     sleep(5)
diff --git a/cloud-deploy-pipeline.groovy b/cloud-deploy-pipeline.groovy
index c04e5d2..7d331bf 100644
--- a/cloud-deploy-pipeline.groovy
+++ b/cloud-deploy-pipeline.groovy
@@ -209,6 +209,10 @@
                     print(kubernetes_control_address)
                     salt.runSaltProcessStep(saltMaster, 'I@salt:master', 'reclass.cluster_meta_set', ['kubernetes_control_address', kubernetes_control_address], null, true)
 
+                    // ensure certificates are generated properly
+                    salt.runSaltProcessStep(saltMaster, '*', 'saltutil.refresh_pillar', [], null, true)
+                    salt.enforceState(saltMaster, '*', ['salt.minion.cert'], true)
+
                     orchestrate.installKubernetesInfra(saltMaster)
                 }
 
diff --git a/lab-pipeline.groovy b/lab-pipeline.groovy
index 255335d..2a95a49 100644
--- a/lab-pipeline.groovy
+++ b/lab-pipeline.groovy
@@ -174,16 +174,6 @@
 
             // install k8s
             if (common.checkContains('STACK_INSTALL', 'k8s')) {
-
-                stage('Install Contrail for Kubernetes') {
-                    if (common.checkContains('STACK_INSTALL', 'contrail')) {
-                        stage('Install Contrail for Kubernetes') {
-                            orchestrate.installContrailNetwork(saltMaster)
-                            orchestrate.installContrailCompute(saltMaster)
-                        }
-                    }
-                }
-
                 stage('Install Kubernetes infra') {
                     orchestrate.installKubernetesInfra(saltMaster)
                 }
@@ -220,6 +210,12 @@
                 }
 
 
+                if (common.checkContains('STACK_INSTALL', 'contrail')) {
+                    state('Install Contrail for Kubernetes') {
+                        orchestrate.installContrailNetwork(saltMaster)
+                        orchestrate.installContrailCompute(saltMaster)
+                    }
+                }
             }
 
             // install openstack
diff --git a/openstack-compute-upgrade.groovy b/openstack-compute-upgrade.groovy
index 33e0825..fe7f471 100644
--- a/openstack-compute-upgrade.groovy
+++ b/openstack-compute-upgrade.groovy
@@ -110,7 +110,7 @@
         }
 
         command = "cmd.run"
-        args = "apt-get -y -q --allow-downgrades -o Dpkg::Options::=\"--force-confdef\" -o Dpkg::Options::=\"--force-confold\" dist-upgrade"
+        args = "'DEBIAN_FRONTEND=noninteractive'; apt-get -y -q --allow-downgrades -o Dpkg::Options::=\"--force-confdef\" -o Dpkg::Options::=\"--force-confold\" dist-upgrade"
 
         stage('Apply package upgrades on sample') {
             out = salt.runSaltCommand(saltMaster, 'local', ['expression': targetLiveSubset, 'type': 'compound'], command, null, args, commandKwargs)
@@ -132,37 +132,33 @@
                 out = salt.runSaltCommand(saltMaster, 'local', ['expression': targetLiveSubset, 'type': 'compound'], command, null, args, commandKwargs)
                 salt.printSaltCommandResult(out)
             }
-            stage("Run salt states on sample nodes and reboot them") {
+            stage("Run salt states on sample nodes") {
                 salt.enforceState(saltMaster, targetLiveSubset, ['nova', 'neutron'])
-                try {
-                    salt.runSaltProcessStep(saltMaster, targetLiveSubset, 'system.reboot', null, null, true, 5)
-                } catch (Exception er) {
-                    common.infoMsg("The following nodes did not return anything because they were rebooted: ${targetLiveSubset}")
-                }
+                //salt.enforceHighstate(saltMaster, targetLiveAll)
             }
         } else {
             stage("Run salt states on sample nodes") {
-                salt.enforceState(saltMaster, targetLiveSubset, ['nova'])
-                salt.enforceState(saltMaster, targetLiveSubset, 'linux.system.repo')
+                salt.enforceState(saltMaster, targetLiveSubset, ['nova', 'linux.system.repo'])
+                //salt.enforceHighstate(saltMaster, targetLiveAll)
             }
         }
 
-        stage('Confirm upgrade on all nodes') {
+        stage('Confirm upgrade on all targeted nodes') {
             timeout(time: 2, unit: 'HOURS') {
                input message: "Verify that the upgraded sample nodes are working correctly. If so, do you want to approve live upgrade on ${targetLiveAll} nodes?"
             }
         }
 
         if(opencontrail != null) { 
-            stage('Remove OC component from repos on sample nodes') {
+            stage('Remove OC component from repos on all targeted nodes') {
                 salt.cmdRun(saltMaster, targetLiveAll, "find /etc/apt/sources.list* -type f -print0 | xargs -0 sed -i -r -e 's/ oc([0-9]*) / /g'")
                 salt.runSaltProcessStep(saltMaster, targetLiveAll, 'pkg.refresh_db', [], null, true)
             }
         }
 
-        args = "apt-get -y -q --allow-downgrades -o Dpkg::Options::=\"--force-confdef\" -o Dpkg::Options::=\"--force-confold\" dist-upgrade"
+        args = "'DEBIAN_FRONTEND=noninteractive'; apt-get -y -q --allow-downgrades -o Dpkg::Options::=\"--force-confdef\" -o Dpkg::Options::=\"--force-confold\" dist-upgrade"
 
-        stage('Apply package upgrades on all nodes') {
+        stage('Apply package upgrades on all targeted nodes') {
             out = salt.runSaltCommand(saltMaster, 'local', ['expression': targetLiveAll, 'type': 'compound'], command, null, args, commandKwargs)
             salt.printSaltCommandResult(out)
         }
@@ -170,22 +166,18 @@
         if(openvswitch != null) {
             args = "sudo /usr/share/openvswitch/scripts/ovs-ctl start"
 
-            stage('Start ovs on sample nodes') {
+            stage('Start ovs on all targeted nodes') {
                 out = salt.runSaltCommand(saltMaster, 'local', ['expression': targetLiveAll, 'type': 'compound'], command, null, args, commandKwargs)
                 salt.printSaltCommandResult(out)
             }
-            stage("Run salt states on sample nodes and reboot them") {
+            stage("Run salt states on all targeted nodes") {
                 salt.enforceState(saltMaster, targetLiveAll, ['nova', 'neutron'])
-                try {
-                    salt.runSaltProcessStep(saltMaster, targetLiveAll, 'system.reboot', null, null, true, 5)
-                } catch (Exception er) {
-                    common.infoMsg("The following nodes did not return anything because they were rebooted: ${targetLiveAll}")
-                }
+                //salt.enforceHighstate(saltMaster, targetLiveAll)
             }
         } else {
-            stage("Run salt states on sample nodes") {
-                salt.enforceState(saltMaster, targetLiveAll, ['nova'])
-                salt.enforceState(saltMaster, targetLiveAll, 'linux.system.repo')
+            stage("Run salt states on all targeted nodes") {
+                salt.enforceState(saltMaster, targetLiveAll, ['nova', 'linux.system.repo'])
+                //salt.enforceHighstate(saltMaster, targetLiveAll)
             }
         }
 
@@ -196,4 +188,3 @@
     }
 }
 
-
diff --git a/openstack-control-upgrade.groovy b/openstack-control-upgrade.groovy
index bff17f1..a16a60e 100644
--- a/openstack-control-upgrade.groovy
+++ b/openstack-control-upgrade.groovy
@@ -437,6 +437,9 @@
 
                     // salt 'cmp*' cmd.run 'service nova-compute restart'
                     salt.runSaltProcessStep(saltMaster, 'cmp*', 'service.restart', ['nova-compute'], null, true)
+                    salt.runSaltProcessStep(saltMaster, 'ctl*', 'service.restart', ['nova-conductor'], null, true)
+                    salt.runSaltProcessStep(saltMaster, 'ctl*', 'service.restart', ['nova-scheduler'], null, true)
+
 
                     // salt 'prx*' state.sls linux,openssh,salt.minion,ntp,rsyslog
                     // salt 'ctl*' state.sls keepalived
@@ -557,6 +560,9 @@
 
                 sleep(70)
 
+                salt.runSaltProcessStep(saltMaster, 'ctl*', 'service.restart', ['nova-conductor'], null, true)
+                salt.runSaltProcessStep(saltMaster, 'ctl*', 'service.restart', ['nova-scheduler'], null, true)
+
                 salt.cmdRun(saltMaster, 'ctl01*', '. /root/keystonerc; nova service-list; glance image-list; nova flavor-list; nova hypervisor-list; nova list; neutron net-list; cinder list; heat service-list')
             }
         }