diff --git a/README.rst b/README.rst
index 48cb5ff..c07a44d 100644
--- a/README.rst
+++ b/README.rst
@@ -22,6 +22,11 @@
           bind9:
             rndc_key: 4pc+X4PDqb2q+5o72dISm72LM1Ds9X2EYZjqg+nmsS7FhdTwzFFY8l/iEDmHxnyjkA33EQC8H+z0fLLBunoitw==
             rndc_algorithm: hmac-sha512
+        api:
+          base_uri: 'http://127.0.0.1:9001'
+        admin_api:
+          enabled: true
+          enabled_extensions_admin: quotas
         bind:
           api:
             address: 127.0.0.1
@@ -41,6 +46,9 @@
           tenant: service
           user: designate
           password: passw0rd
+        mdns:
+          address: 0.0.0.0
+          port: 5354
         message_queue:
           engine: rabbitmq
           members:
@@ -72,13 +80,39 @@
                   rndc_host: 127.0.0.1
                   rndc_port: 953
                   rndc_key_file: /etc/designate/rndc.key
-
+        quota:
+          zones: 40
+      worker:
+        enabled: true
 .. note::
-   *domain_id* parameter is UUID of DNS zone managed by designate-sink service. This zone will 
+   *domain_id* parameter is UUID of DNS zone managed by designate-sink service. This zone will
    be populated by A records for fixed and floating ip addresses of spawned VMs. After designate
    is deployed and zone is created, this parameter should be updated accordingly to UUID of
    newly created zone. Then designate state should be reapplied.
 
+.. note::
+   *server:api:base_uri* allows to set URL which is returned in designate-api responses, it is
+   useful in cases when, designate-api is deployed under proxy server. If not overriden in reclass,
+   it defaults to http://*server:bind:api:address*:9001/.
+
+.. note::
+   *server:mdns:address* and *server:mdns:port* options allow to change MDNS listening address and
+   port. Changes to server:pools:*:targets will be also required if the MDNS's address and port are
+   being used there.
+
+.. note::
+   *worker:enabled* sets worker role and installs designate-worker and designate-producer packages
+   which services will push changes to backend DNS servers.
+   *pool_manager:enabled* should be a default role for older releases of OpenStack, older than
+   Newton in which designate-worker and designate-producer were represented.
+   In releases starting from Newton, only Designate pool manager service still allows live syncs
+   with Power DNS server for now.
+
+.. note::
+   *server:quota:zones* allows to set default value for zones quota for all projects and users.
+   In case with Designate tempest plugin (0.2.0) zones quota should be increased to 40, so all
+   tests can pass.
+
 Pools pillar for BIND9 master and multiple slaves setup:
 
 .. code:: yaml
diff --git a/designate/agent.sls b/designate/agent.sls
new file mode 100644
index 0000000..4c96455
--- /dev/null
+++ b/designate/agent.sls
@@ -0,0 +1,14 @@
+{%- from "designate/map.jinja" import agent with context %}
+{%- if agent.enabled %}
+
+designate_agent_packages:
+  pkg.installed:
+  - names: {{ agent.pkgs }}
+
+designate_agent_services:
+  service.running:
+    - enable: true
+    - names: {{ agent.services }}
+    - watch:
+      - file: /etc/designate/designate.conf
+{%- endif %}
diff --git a/designate/files/liberty/designate.conf.Debian b/designate/files/liberty/designate.conf.Debian
index aee8b6d..e07ba60 100644
--- a/designate/files/liberty/designate.conf.Debian
+++ b/designate/files/liberty/designate.conf.Debian
@@ -35,6 +35,13 @@
 {%- endif %}
 {%- endif %}
 
+{%- if server.quota is defined %}
+# Default quotas
+{%- if server.quota.zones is defined %}
+quota_zones = {{ server.quota.zones }}
+{%- endif %}
+{%- endif %}
+
 # Use "sudo designate-rootwrap /etc/designate/rootwrap.conf" to use the real
 # root filter facility.
 # Change to "sudo" to skip the filtering and just run the comand directly
@@ -105,7 +112,7 @@
 #enable_host_header = False
 
 # The base uri used in responses
-api_base_uri = http://{{ server.bind.api.address }}:9001/
+api_base_uri = {{ server.api.base_uri }}
 
 # Address to bind the API server
 api_host = {{ server.bind.api.address }}
@@ -142,12 +149,16 @@
 #max_limit_v2 = 1000
 
 # Enable Admin API (experimental)
-#enable_api_admin = False
+enable_api_admin = {{ server.get('admin_api', {}).get('enabled', False) }}
 
 # Enabled Admin API extensions
 # Can be one or more of : reports, quotas, counts, tenants, zones
 # zone export is in zones extension
+{%- if server.get('admin_api', {}).get('enabled_extensions_admin', False) %}
+enabled_extensions_admin = {{ server.admin_api.enabled_extensions_admin }}
+{%- else %}
 #enabled_extensions_admin =
+{%- endif %}
 
 # Default per-page limit for the Admin API, a value of None means show all results
 # by default
@@ -192,10 +203,10 @@
 #threads = 1000
 
 # mDNS Bind Host
-#host = 0.0.0.0
+host = {{ server.mdns.address }}
 
 # mDNS Port Number
-#port = 5354
+port = {{ server.mdns.port }}
 
 # mDNS TCP Backlog
 #tcp_backlog = 100
@@ -319,7 +330,8 @@
 # SQLAlchemy Pool Manager Cache
 #-----------------------
 [pool_manager_cache:sqlalchemy]
-connection = {{ server.database.engine }}://{{ server.database.user }}:{{ server.database.password }}@{{ server.database.host }}/{{ server.database.name.pool_manager }}
+connection = {{ server.database.engine }}://{{ server.database.user }}:{{ server.database.password }}@{{ server.database.host }}/{{ server.database.name.pool_manager }}{%- if server.database.get('ssl',{}).get('enabled',False) %}?ssl_ca={{ server.database.ssl.get('cacert_file', server.cacert_file) }}{% endif %}
+
 #connection_debug = 100
 #connection_trace = False
 #sqlite_synchronous = True
diff --git a/designate/files/mitaka/designate.conf.Debian b/designate/files/mitaka/designate.conf.Debian
index c14eec2..2f5fb4a 100644
--- a/designate/files/mitaka/designate.conf.Debian
+++ b/designate/files/mitaka/designate.conf.Debian
@@ -35,6 +35,13 @@
 {%- endif %}
 {%- endif %}
 
+{%- if server.quota is defined %}
+# Default quotas
+{%- if server.quota.zones is defined %}
+quota_zones = {{ server.quota.zones }}
+{%- endif %}
+{%- endif %}
+
 # Use "sudo designate-rootwrap /etc/designate/rootwrap.conf" to use the real
 # root filter facility.
 # Change to "sudo" to skip the filtering and just run the comand directly
@@ -59,15 +66,26 @@
 rabbit_userid = {{ server.message_queue.user }}
 rabbit_password = {{ server.message_queue.password }}
 rabbit_virtual_host = {{ server.message_queue.virtual_host }}
-#rabbit_use_ssl = False
+
+{%- set rabbit_port = server.message_queue.get('port', 5671 if server.message_queue.get('ssl',{}).get('enabled', False)  else 5672) %}
 {%- if server.message_queue.members is defined %}
 rabbit_hosts = {% for member in server.message_queue.members -%}
-                   {{ member.host }}:{{ member.get('port', 5672) }}
+                   {{ member.host }}:{{ member.get('port', rabbit_port) }}
                    {%- if not loop.last -%},{%- endif -%}
                {%- endfor -%}
 {%- else %}
 rabbit_host = {{ server.message_queue.host }}
-rabbit_port = {{ server.message_queue.port }}
+rabbit_port = {{ rabbit_port }}
+{%- endif %}
+
+{%- if server.message_queue.get('ssl',{}).get('enabled', False) %}
+rabbit_use_ssl=true
+{%- if server.message_queue.ssl.version is defined %}
+kombu_ssl_version = {{ server.message_queue.ssl.version }}
+{%- elif salt['grains.get']('pythonversion') > [2,7,8] %}
+kombu_ssl_version = TLSv1_2
+{%- endif %}
+kombu_ssl_ca_certs = {{ server.message_queue.ssl.get('cacert_file', server.cacert_file) }}
 {%- endif %}
 
 ########################
@@ -122,7 +140,7 @@
 
 # The base uri used in responses
 #api_base_uri = 'http://127.0.0.1:9001/'
-api_base_uri = http://{{ server.bind.api.address }}:9001/
+api_base_uri = {{ server.api.base_uri }}
 
 # Address to bind the API server
 #api_host = 0.0.0.0
@@ -166,12 +184,16 @@
 #max_limit_v2 = 1000
 
 # Enable Admin API (experimental)
-#enable_api_admin = False
+enable_api_admin = {{ server.get('admin_api', {}).get('enabled', False) }}
 
 # Enabled Admin API extensions
 # Can be one or more of : reports, quotas, counts, tenants, target_sync
 # zone export is in zones extension
+{%- if server.get('admin_api', {}).get('enabled_extensions_admin', False) %}
+enabled_extensions_admin = {{ server.admin_api.enabled_extensions_admin }}
+{%- else %}
 #enabled_extensions_admin =
+{%- endif %}
 
 # Default per-page limit for the Admin API, a value of None means show all results
 # by default
@@ -267,10 +289,10 @@
 #threads = 1000
 
 # mDNS Bind Host
-#host = 0.0.0.0
+host = {{ server.mdns.address }}
 
 # mDNS Port Number
-#port = 5354
+port = {{ server.mdns.port }}
 
 # mDNS TCP Backlog
 #tcp_backlog = 100
@@ -406,7 +428,7 @@
 #-----------------------
 [pool_manager_cache:sqlalchemy]
 #connection = sqlite:///$state_path/designate_pool_manager.sqlite
-connection = {{ server.database.engine }}://{{ server.database.user }}:{{ server.database.password }}@{{ server.database.host }}/{{ server.database.name.pool_manager }}
+connection = {{ server.database.engine }}://{{ server.database.user }}:{{ server.database.password }}@{{ server.database.host }}/{{ server.database.name.pool_manager }}{%- if server.database.get('ssl',{}).get('enabled',False) %}?ssl_ca={{ server.database.ssl.get('cacert_file', server.cacert_file) }}{% endif %}
 
 #connection_debug = 100
 #connection_trace = False
diff --git a/designate/files/ocata/designate.conf.Debian b/designate/files/ocata/designate.conf.Debian
index 3c2ad84..65382f0 100644
--- a/designate/files/ocata/designate.conf.Debian
+++ b/designate/files/ocata/designate.conf.Debian
@@ -1,4 +1,5 @@
-{%- from "designate/map.jinja" import server with context %}
+{%- from "designate/map.jinja" import server, pool_manager with context %}
+
 [DEFAULT]
 # Where an option is commented out, but filled in this shows the default
 # value of that option
@@ -35,6 +36,13 @@
 {%- endif %}
 {%- endif %}
 
+{%- if server.quota is defined %}
+# Default quotas
+{%- if server.quota.zones is defined %}
+quota_zones = {{ server.quota.zones }}
+{%- endif %}
+{%- endif %}
+
 # Use "sudo designate-rootwrap /etc/designate/rootwrap.conf" to use the real
 # root filter facility.
 # Change to "sudo" to skip the filtering and just run the command directly
@@ -60,9 +68,11 @@
 rabbit_password = {{ server.message_queue.password }}
 rabbit_virtual_host = {{ server.message_queue.virtual_host }}
 #rabbit_use_ssl = False
+
+{%- set rabbit_port = server.message_queue.get('port', 5671 if server.message_queue.get('ssl',{}).get('enabled', False)  else 5672) %}
 {%- if server.message_queue.members is defined %}
 rabbit_hosts = {% for member in server.message_queue.members -%}
-                   {{ member.host }}:{{ member.get('port', 5672) }}
+                   {{ member.host }}:{{ member.get('port', rabbit_port) }}
                    {%- if not loop.last -%},{%- endif -%}
                {%- endfor -%}
 {%- else %}
@@ -70,6 +80,16 @@
 rabbit_port = {{ server.message_queue.port }}
 {%- endif %}
 
+{%- if server.message_queue.get('ssl',{}).get('enabled', False) %}
+rabbit_use_ssl=true
+{%- if server.message_queue.ssl.version is defined %}
+kombu_ssl_version = {{ server.message_queue.ssl.version }}
+{%- elif salt['grains.get']('pythonversion') > [2,7,8] %}
+kombu_ssl_version = TLSv1_2
+{%- endif %}
+kombu_ssl_ca_certs = {{ server.message_queue.ssl.get('cacert_file', server.cacert_file) }}
+{%- endif %}
+
 ########################
 ## Service Configuration
 ########################
@@ -122,7 +142,7 @@
 
 # The base uri used in responses
 #api_base_uri = 'http://127.0.0.1:9001/'
-api_base_uri = http://{{ server.bind.api.address }}:9001/
+api_base_uri = {{ server.api.base_uri }}
 
 # API bind host+port pairs, comma separated
 listen = {{ server.bind.api.address }}:9001
@@ -161,12 +181,16 @@
 #max_limit_v2 = 1000
 
 # Enable Admin API (experimental)
-#enable_api_admin = False
+enable_api_admin = {{ server.get('admin_api', {}).get('enabled', False) }}
 
 # Enabled Admin API extensions
 # Can be one or more of : reports, quotas, counts, tenants, target_sync
 # zone export is in zones extension
+{%- if server.get('admin_api', {}).get('enabled_extensions_admin', False) %}
+enabled_extensions_admin = {{ server.admin_api.enabled_extensions_admin }}
+{%- else %}
 #enabled_extensions_admin =
+{%- endif %}
 
 # Default per-page limit for the Admin API, a value of None means show all results
 # by default
@@ -263,7 +287,7 @@
 #threads = 1000
 
 # mDNS bind host+port pairs, comma separated
-#listen = 0.0.0.0:5354
+listen = {{ server.mdns.address }}:{{ server.mdns.port }}
 
 # mDNS TCP Backlog
 #tcp_backlog = 100
@@ -348,13 +372,21 @@
 #-----------------------
 [service:pool_manager]
 # Number of Pool Manager worker processes to spawn
+{%- if pool_manager.workers is defined %}
+workers = {{ pool_manager.workers }}
+{%- else %}
 #workers = None
+{%- endif %}
 
 # Number of Pool Manager greenthreads to spawn
 #threads = 1000
 
 # The ID of the pool managed by this instance of the Pool Manager
+{%- if pool_manager.pool_id is defined %}
+pool_id = {{ pool_manager.pool_id }}
+{%- else %}
 #pool_id = 794ccc2c-d751-44fe-b57f-8894c9f5c842
+{%- endif %}
 
 # The percentage of servers requiring a successful update for a domain change
 # to be considered active
@@ -381,17 +413,17 @@
 #periodic_recovery_interval = 120
 
 # Enable the sync thread
-#enable_sync_timer = True
+enable_sync_timer = {{ pool_manager.get('enable_sync_timer', 'True') }}
 
 # The time between synchronizing the servers with storage
-#periodic_sync_interval = 1800
+periodic_sync_interval = {{ pool_manager.get('periodic_sync_interval', '1800') }}
 
 # Zones Updated within last N seconds will be syncd. Use None to sync all zones
-#periodic_sync_seconds = None
+periodic_sync_seconds = {{ pool_manager.get('periodic_sync_seconds', '') }}
 
 # Perform multiple update attempts during periodic_sync
-#periodic_sync_max_attempts = 3
-#periodic_sync_retry_interval = 30
+periodic_sync_max_attempts = {{ pool_manager.get('periodic_sync_max_attempts', '3') }}
+periodic_sync_retry_interval = {{ pool_manager.get('periodic_sync_retry_interval', '30') }}
 
 # The cache driver to use
 #cache_driver = memcache
@@ -403,7 +435,11 @@
 [service:worker]
 {# TODO: remove enabled option when https://bugs.launchpad.net/designate/+bug/1676827 is fixed #}
 # Whether to send events to worker instead of Pool Manager
+{%- if pool_manager.enabled is defined and pool_manager.enabled == true %}
+enabled = False
+{%- else %}
 enabled = True
+{%- endif %}
 
 # Number of Worker processes to spawn
 #workers = None
@@ -440,7 +476,7 @@
 #-----------------------
 [pool_manager_cache:sqlalchemy]
 #connection = sqlite:///$state_path/designate_pool_manager.sqlite
-connection = {{ server.database.engine }}://{{ server.database.user }}:{{ server.database.password }}@{{ server.database.host }}/{{ server.database.name.pool_manager }}
+connection = {{ server.database.engine }}://{{ server.database.user }}:{{ server.database.password }}@{{ server.database.host }}/{{ server.database.name.pool_manager }}{%- if server.database.get('ssl',{}).get('enabled',False) %}?ssl_ca={{ server.database.ssl.get('cacert_file', server.cacert_file) }}{% endif %}
 
 #connection_debug = 100
 #connection_trace = False
diff --git a/designate/files/pike b/designate/files/pike
new file mode 120000
index 0000000..d5e8ce2
--- /dev/null
+++ b/designate/files/pike
@@ -0,0 +1 @@
+ocata
\ No newline at end of file
diff --git a/designate/init.sls b/designate/init.sls
index 58ccc9b..2d64202 100644
--- a/designate/init.sls
+++ b/designate/init.sls
@@ -6,4 +6,13 @@
 {%- if pillar.designate.client is defined %}
 - designate.client
 {%- endif %}
+{%- if pillar.designate.pool_manager is defined %}
+- designate.pool_manager
+{%- endif %}
+{%- if pillar.designate.worker is defined %}
+- designate.worker
+{%- endif %}
+{%- if pillar.designate.agent is defined %}
+- designate.agent
+{%- endif %}
 {%- endif %}
diff --git a/designate/map.jinja b/designate/map.jinja
index 30d73c3..c770dcc 100644
--- a/designate/map.jinja
+++ b/designate/map.jinja
@@ -1,27 +1,60 @@
 {%- set version = salt['pillar.get']('designate:server:version') -%}
-{%- if version not in ['mitaka','liberty', 'juno', 'kilo'] %}
+{%- set api_address = salt['pillar.get']('designate:server:bind:api:address', '127.0.0.1') -%}
+{%- set api_port = salt['pillar.get']('designate:server:bind:api:port', '9001') -%}
 {% set server = salt['grains.filter_by']({
+    'default': {
+        'api': {
+            'base_uri': 'http://' + api_address + ':' + api_port + '/'
+        },
+        'mdns' : {
+            'address': '0.0.0.0',
+            'port': '5354'
+        }
+    },
     'Debian': {
-        'pkgs': ['designate', 'designate-producer', 'designate-mdns', 'designate-sink', 'designate-worker'],
-        'services': ['designate-agent', 'designate-api', 'designate-central', 'designate-mdns', 'designate-producer', 'designate-sink', 'designate-worker'],
+        'pkgs': ['designate-api', 'designate-central', 'designate-sink'],
+        'services': ['designate-api', 'designate-central', 'designate-sink'],
+        'cacert_file': '/etc/ssl/certs/ca-certificates.crt',
     },
     'RedHat': {
-        'pkgs': ['openstack-designate-api', 'openstack-designate-central', 'openstack-designate-sink', 'openstack-designate-producer', 'openstack-designate-worker', 'openstack-designate-mdns', 'openstack-designate-common', 'python-designate', 'python-designateclient', 'openstack-designate-agent'],
-        'services': ['designate-central', 'designate-api', 'designate-mdns', 'designate-producer', 'designate-worker'],
+        'pkgs': ['openstack-designate-api', 'openstack-designate-central', 'openstack-designate-sink'],
+        'services': ['designate-api', 'designate-central', 'designate-sink'],
+        'cacert_file': '/etc/pki/tls/certs/ca-bundle.crt',
     },
-}, merge=pillar.designate.get('server', {})) %}
-{%- else %}
-{% set server = salt['grains.filter_by']({
+}, merge=pillar.designate.get('server', {}), base='default') %}
+
+{% set pool_manager = salt['grains.filter_by']({
     'Debian': {
-        'pkgs': ['designate', 'designate-pool-manager', 'designate-mdns', 'designate-sink', 'designate-zone-manager'],
-        'services': ['designate-agent', 'designate-api', 'designate-central', 'designate-mdns', 'designate-pool-manager', 'designate-sink', 'designate-zone-manager'],
+        'pkgs': ['designate-pool-manager', 'designate-mdns', 'designate-zone-manager'],
+        'services': ['designate-pool-manager', 'designate-mdns', 'designate-zone-manager'],
     },
     'RedHat': {
-        'pkgs': ['openstack-designate-api', 'openstack-designate-central', 'openstack-designate-sink', 'openstack-designate-pool-manager', 'openstack-designate-zone-manager', 'openstack-designate-mdns', 'openstack-designate-common', 'python-designate', 'python-designateclient', 'openstack-designate-agent'],
-        'services': ['designate-central', 'designate-api', 'designate-mdns', 'designate-pool-manager', 'designate-zone-manager'],
+        'pkgs': ['openstack-designate-pool-manager', 'openstack-designate-mdns', 'openstack-designate-zone-manager'],
+        'services': ['designate-pool-manager', 'designate-mdns', 'designate-zone-manager'],
     },
-}, merge=pillar.designate.get('server', {})) %}
-{%- endif %}
+}, merge=pillar.designate.get('pool_manager')) %}
+
+{% set worker = salt['grains.filter_by']({
+    'Debian': {
+        'pkgs': ['designate-worker', 'designate-mdns', 'designate-producer'],
+        'services': ['designate-worker', 'designate-mdns', 'designate-producer'],
+    },
+    'RedHat': {
+        'pkgs': ['openstack-designate-worker', 'openstack-designate-mdns', 'openstack-designate-producer'],
+        'services': ['designate-worker', 'designate-mdns', 'designate-producer'],
+    },
+}, merge=pillar.designate.get('worker', {})) %}
+
+{% set agent = salt['grains.filter_by']({
+    'Debian': {
+        'pkgs': ['designate-agent'],
+        'services': ['designate-agent'],
+    },
+    'RedHat': {
+        'pkgs': ['openstack-designate-agent'],
+        'services': ['designate-agent'],
+    },
+}, merge=pillar.designate.get('agent', {})) %}
 
 {% set client = salt['grains.filter_by']({
     'Debian': {
diff --git a/designate/pool_manager.sls b/designate/pool_manager.sls
new file mode 100644
index 0000000..6c293df
--- /dev/null
+++ b/designate/pool_manager.sls
@@ -0,0 +1,14 @@
+{%- from "designate/map.jinja" import pool_manager with context %}
+{%- if pool_manager.enabled %}
+
+designate_pool_manager_packages:
+  pkg.installed:
+  - names: {{ pool_manager.pkgs }}
+
+designate_pool_manager_services:
+  service.running:
+    - enable: true
+    - names: {{ pool_manager.services }}
+    - watch:
+      - file: /etc/designate/designate.conf
+{%- endif %}
diff --git a/designate/server.sls b/designate/server.sls
index fd9e7a0..0d998a3 100644
--- a/designate/server.sls
+++ b/designate/server.sls
@@ -65,6 +65,12 @@
       - cmd: designate_pool_sync
     - watch:
       - file: /etc/designate/designate.conf
+      {%- if server.message_queue.get('ssl',{}).get('enabled', False) %}
+      - file: rabbitmq_ca_designate_server
+      {%- endif %}
+      {%- if server.database.get('ssl',{}).get('enabled', False) %}
+      - file: mysql_ca_designate_server
+      {%- endif %}
 {%- endif %}
 
 {%- if server.version not in ['liberty', 'juno', 'kilo'] and server.pools is defined %}
@@ -86,4 +92,42 @@
       - file: /etc/designate/pools.yaml
 {%- endif %}
 {%- endif %}
+
+{%- if server.message_queue.get('ssl',{}).get('enabled', False) %}
+rabbitmq_ca_designate_server:
+{%- if server.message_queue.ssl.cacert is defined %}
+  file.managed:
+    - name: {{ server.message_queue.ssl.cacert_file }}
+    - contents_pillar: designate:server:message_queue:ssl:cacert
+    - mode: 0444
+    - makedirs: true
+    - require_in:
+      - file: /etc/designate/designate.conf
+{%- else %}
+  file.exists:
+   - name: {{ server.message_queue.ssl.get('cacert_file', server.cacert_file) }}
+   - require_in:
+     - file: /etc/designate/designate.conf
+{%- endif %}
+{%- endif %}
+
+
+{%- if server.database.get('ssl',{}).get('enabled', False) %}
+mysql_ca_designate_server:
+{%- if server.database.ssl.cacert is defined %}
+  file.managed:
+    - name: {{ server.database.ssl.cacert_file }}
+    - contents_pillar: designate:server:database:ssl:cacert
+    - mode: 0444
+    - makedirs: true
+    - require_in:
+      - file: /etc/designate/designate.conf
+{%- else %}
+  file.exists:
+   - name: {{ server.database.ssl.get('cacert_file', server.cacert_file) }}
+   - require_in:
+     - file: /etc/designate/designate.conf
+{%- endif %}
+{%- endif %}
+
 {%- endif %}
diff --git a/designate/worker.sls b/designate/worker.sls
new file mode 100644
index 0000000..abff6e4
--- /dev/null
+++ b/designate/worker.sls
@@ -0,0 +1,14 @@
+{%- from "designate/map.jinja" import worker with context %}
+{%- if worker.enabled %}
+
+designate_worker_packages:
+  pkg.installed:
+  - names: {{ worker.pkgs }}
+
+designate_worker_services:
+  service.running:
+    - enable: true
+    - names: {{ worker.services }}
+    - watch:
+      - file: /etc/designate/designate.conf
+{%- endif %}
diff --git a/tests/pillar/designate_liberty.sls b/tests/pillar/designate_liberty.sls
index be528eb..320489a 100644
--- a/tests/pillar/designate_liberty.sls
+++ b/tests/pillar/designate_liberty.sls
@@ -1,9 +1,26 @@
 designate:
+  pool_manager:
+    enabled: true
   server:
     enabled: true
     region: RegionOne
     domain_id: 5186883b-91fb-4891-bd49-e6769234a8fc
     version: liberty
+    mdns:
+      address: 0.0.0.0
+      port: 5354
+    admin_api:
+      enabled: true
+      enabled_extensions_admin: quotas
+    database:
+      engine: mysql
+      host: 127.0.0.1
+      port: 3306
+      name:
+        main_database: designate
+        pool_manager: designate_pool_manager
+      user: designate
+      password: passw0rd
     message_queue:
       members:
         - host: 127.0.0.1
@@ -25,4 +42,4 @@
         uuid: f26e0b32-736f-4f0a-831b-039a415c481e
         options: 'port: 53, host: 127.0.0.1'
         masters: 127.0.0.1:5354
-        type:  bind9
\ No newline at end of file
+        type:  bind9
diff --git a/tests/pillar/designate_mitaka.sls b/tests/pillar/designate_mitaka.sls
index 8543c76..7c8a53d 100644
--- a/tests/pillar/designate_mitaka.sls
+++ b/tests/pillar/designate_mitaka.sls
@@ -1,9 +1,26 @@
 designate:
+  pool_manager:
+    enabled: true
   server:
     enabled: true
     region: RegionOne
     domain_id: 5186883b-91fb-4891-bd49-e6769234a8fc
     version: mitaka
+    mdns:
+      address: 0.0.0.0
+      port: 5354
+    admin_api:
+      enabled: true
+      enabled_extensions_admin: quotas
+    database:
+        engine: mysql
+        host: 127.0.0.1
+        port: 3306
+        name:
+          main_database: designate
+          pool_manager: designate_pool_manager
+        user: designate
+        password: passw0rd
     message_queue:
       members:
         - host: 127.0.0.1
diff --git a/tests/pillar/designate_ocata.sls b/tests/pillar/designate_ocata.sls
index 630cccc..acf1f8f 100644
--- a/tests/pillar/designate_ocata.sls
+++ b/tests/pillar/designate_ocata.sls
@@ -10,6 +10,9 @@
     bind:
       api:
         address: 127.0.0.1
+    admin_api:
+      enabled: true
+      enabled_extensions_admin: quotas
     database:
       engine: mysql
       host: 127.0.0.1
@@ -26,6 +29,9 @@
       tenant: service
       user: designate
       password: passw0rd
+    mdns:
+      address: 0.0.0.0
+      port: 5354
     message_queue:
       engine: rabbitmq
       members:
@@ -65,6 +71,10 @@
         also_notifies:
           - host: 127.0.3.1
             port: 53
+    quota:
+      zones: 40
+  worker:
+    enabled: true
 mysql:
   client:
     enabled: true
diff --git a/tests/pillar/ssl.sls b/tests/pillar/ssl.sls
new file mode 100644
index 0000000..7168c35
--- /dev/null
+++ b/tests/pillar/ssl.sls
@@ -0,0 +1,12 @@
+include:
+  - .designate_ocata
+
+designate:
+  server:
+    database:
+      ssl:
+        enabled: True
+    message_queue:
+      port: 5671
+      ssl:
+        enabled: True
diff --git a/tests/run_tests.sh b/tests/run_tests.sh
index 3f42101..9451611 100755
--- a/tests/run_tests.sh
+++ b/tests/run_tests.sh
@@ -110,7 +110,7 @@
 }
 
 salt_run() {
-    [ -e ${VEN_DIR}/bin/activate ] && source ${VENV_DIR}/bin/activate
+    [ -e ${VENV_DIR}/bin/activate ] && source ${VENV_DIR}/bin/activate
     salt-call ${SALT_OPTS} $*
 }