diff --git a/README.rst b/README.rst
index 5c1e46d..d43206c 100644
--- a/README.rst
+++ b/README.rst
@@ -252,7 +252,7 @@
 
 You can read more about it here:
     https://docs.openstack.org/security-guide/messaging/security.html
-    
+
 Using designate client to create zones and install client packages
 -------------------------------------------------------------------
 
@@ -268,36 +268,82 @@
             name: test.zone.
             email: admin@test.zone
 
+Upgrades
+========
 
-Documentation and Bugs
-======================
+Each openstack formula provide set of phases (logical bloks) that will help to
+build flexible upgrade orchestration logic for particular components. The list
+of phases might and theirs descriptions are listed in table below:
 
-To learn how to install and update salt-formulas, consult the documentation
-available online at:
++-------------------------------+------------------------------------------------------+
+| State                         | Description                                          |
++===============================+======================================================+
+| <app>.upgrade.service_running | Ensure that all services for particular application  |
+|                               | are enabled for autostart and running                |
++-------------------------------+------------------------------------------------------+
+| <app>.upgrade.service_stopped | Ensure that all services for particular application  |
+|                               | disabled for autostart and dead                      |
++-------------------------------+------------------------------------------------------+
+| <app>.upgrade.pkgs_latest     | Ensure that packages used by particular application  |
+|                               | are installed to latest available version.           |
+|                               | This will not upgrade data plane packages like qemu  |
+|                               | and openvswitch as usually minimal required version  |
+|                               | in openstack services is really old. The data plane  |
+|                               | packages should be upgraded separately by `apt-get   |
+|                               | upgrade` or `apt-get dist-upgrade`                   |
+|                               | Applying this state will not autostart service.      |
++-------------------------------+------------------------------------------------------+
+| <app>.upgrade.render_config   | Ensure configuration is rendered actual version.     +
++-------------------------------+------------------------------------------------------+
+| <app>.upgrade.pre             | We assume this state is applied on all nodes in the  |
+|                               | cloud before running upgrade.                        |
+|                               | Only non destructive actions will be applied during  |
+|                               | this phase. Perform service built in service check   |
+|                               | like (keystone-manage doctor and nova-status upgrade)|
++-------------------------------+------------------------------------------------------+
+| <app>.upgrade.upgrade.pre     | Mostly applicable for data plane nodes. During this  |
+|                               | phase resources will be gracefully removed from      |
+|                               | current node if it is allowed. Services for upgraded |
+|                               | application will be set to admin disabled state to   |
+|                               | make sure node will not participate in resources     |
+|                               | scheduling. For example on gtw nodes this will set   |
+|                               | all agents to admin disable state and will move all  |
+|                               | routers to other agents.                             |
++-------------------------------+------------------------------------------------------+
+| <app>.upgrade.upgrade         | This state will basically upgrade application on     |
+|                               | particular target. Stop services, render             |
+|                               | configuration, install new packages, run offline     |
+|                               | dbsync (for ctl), start services. Data plane should  |
+|                               | not be affected, only OpenStack python services.     |
++-------------------------------+------------------------------------------------------+
+| <app>.upgrade.upgrade.post    | Add services back to scheduling.                     |
++-------------------------------+------------------------------------------------------+
+| <app>.upgrade.post            | This phase should be launched only when upgrade of   |
+|                               | the cloud is completed. Cleanup temporary files,     |
+|                               | perform other post upgrade tasks.                    |
++-------------------------------+------------------------------------------------------+
+| <app>.upgrade.verify          | Here we will do basic health checks (API CRUD        |
+|                               | operations, verify do not have dead network          |
+|                               | agents/compute services)                             |
++-------------------------------+------------------------------------------------------+
 
-    http://salt-formulas.readthedocs.io/
 
-In the unfortunate event that bugs are discovered, they should be reported to
-the appropriate issue tracker. Use Github issue tracker for specific salt
-formula:
+Upgrade pillar example:
 
-    https://github.com/salt-formulas/salt-formula-letsencrypt/issues
+.. code-block:: yaml
 
-For feature requests, bug reports or blueprints affecting entire ecosystem,
-use Launchpad salt-formulas project:
+designate:
+  upgrade:
+    enabled: true
+    old_release: pike
+    new_release: queens
+    verify:
+      zone:
+        enabled: true
+        name: upgradetest.com.
 
-    https://launchpad.net/salt-formulas
-
-You can also join salt-formulas-users team and subscribe to mailing list:
-
-    https://launchpad.net/~salt-formulas-users
-
-Developers wishing to work on the salt-formulas projects should always base
-their work on master branch and submit pull request against specific formula.
-
-    https://github.com/salt-formulas/salt-formula-letsencrypt
-
-Any questions or feedback is always welcome so feel free to join our IRC
-channel:
-
-    #salt-formulas @ irc.freenode.net
+.. note::
+   During upgrade zone creation testing is disabled by default,
+   because conditions for zone successfull creation, are very specific to each environment.
+   When enabling zone testing, allowed tlds in Designate should be considered.
+   More details about TLDS - https://docs.openstack.org/designate/pike/admin/tlds.html
diff --git a/debian/control b/debian/control
index 0e731e4..2938795 100644
--- a/debian/control
+++ b/debian/control
@@ -1,10 +1,10 @@
 Source: salt-formula-designate
-Maintainer: Alexander Noskov <anoskov@mirantis.com>
+Maintainer: Mirantis Dev <dev@mirantis.com>
 Section: admin
 Priority: optional
 Build-Depends: salt-master, python, python-yaml, debhelper (>= 9)
 Standards-Version: 3.9.6
-Homepage: http://www.mirantis.com
+Homepage: https://www.mirantis.com
 Vcs-Browser: https://github.com/Mirantis/salt-formula-designate
 Vcs-Git: https://github.com/Mirantis/salt-formula-designate.git
 
diff --git a/debian/copyright b/debian/copyright
index 7051ee2..70939e7 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -4,9 +4,9 @@
 Source: https://github.com/Mirantis/salt-formula-designate
 
 Files: *
-Copyright: 2014-2015 tcp cloud a.s.
+Copyright: 2014-2019 Mirantis Inc. et al
 License: Apache-2.0
-  Copyright (C) 2014-2015 tcp cloud a.s.
+  Copyright (C) 2014-2019 Mirantis Inc. et al
   .
   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
diff --git a/designate/db/offline_sync.sls b/designate/db/offline_sync.sls
index fd49a7f..06f2615 100644
--- a/designate/db/offline_sync.sls
+++ b/designate/db/offline_sync.sls
@@ -3,6 +3,7 @@
 designate_syncdb:
   cmd.run:
     - name: designate-manage database sync
+    - runas: designate
     {%- if grains.get('noservices') or server.get('role', 'primary') == 'secondary' %}
     - onlyif: /bin/false
     {%- endif %}
diff --git a/designate/map.jinja b/designate/map.jinja
index e103006..614aaee 100644
--- a/designate/map.jinja
+++ b/designate/map.jinja
@@ -125,4 +125,13 @@
     },
 }, merge=pillar.designate.get('client', {})) %}
 
-{% set upgrade = pillar.get('designate', {}).get('upgrade', {}) %}
+{% set upgrade = salt['grains.filter_by']({
+    'default': {
+        'verify': {
+            'zone': {
+                 'enabled': false,
+                 'name': 'upgradetest.com.'
+            },
+        },
+    },
+}, merge=pillar.designate.get('upgrade', {}), base='default') %}
diff --git a/designate/server.sls b/designate/server.sls
index 7d08007..dbdedbc 100644
--- a/designate/server.sls
+++ b/designate/server.sls
@@ -144,6 +144,7 @@
 designate_pool_sync:
   cmd.run:
     - name: designate-manage pool-manager-cache sync
+    - runas: designate
     {%- if grains.get('noservices') %}
     - onlyif: /bin/false
     {%- endif %}
@@ -180,6 +181,7 @@
 designate_pool_update:
   cmd.run:
     - name: "attempts=3; for i in $(seq 1 $attempts); do if designate-manage pool update; then exit 0; else if [[ $i -ge $attempts ]]; then exit 1; else sleep 10; fi; fi; done"
+    - runas: designate
     - shell: /bin/bash
     - require:
       - service: designate_server_services
diff --git a/designate/upgrade/verify/_api.sls b/designate/upgrade/verify/_api.sls
index 927f4e1..9a8e4a3 100644
--- a/designate/upgrade/verify/_api.sls
+++ b/designate/upgrade/verify/_api.sls
@@ -1,4 +1,4 @@
-{%- from "designate/map.jinja" import server with context %}
+{%- from "designate/map.jinja" import server,upgrade with context %}
 
 designate_upgrade_verify_api:
   test.show_notification:
@@ -6,36 +6,37 @@
     - text: "Running designate.upgrade.verify.api"
 
 {%- if server.get('role', 'primary') == 'primary' %}
-{% set Designate_Test_Zone = 'upgradetest.tld.' %}
+  {%- if upgrade.verify.zone.enabled %}
+
 designatev2_zone_present:
   designatev2.zone_present:
   - cloud_name: admin_identity
-  - name: {{ Designate_Test_Zone }}
+  - name: {{ upgrade.verify.zone.name }}
   - email: 'example@doc.com'
 
-designatev2_zone_list:
-  module.run:
-    - name: designatev2.zone_list
-    - kwargs:
-        cloud_name: admin_identity
-
 designatev2_zone_get_details:
   module.run:
     - name: designatev2.zone_get_details
     - kwargs:
         cloud_name: admin_identity
-        zone_id: {{ Designate_Test_Zone }}
+        zone_id: {{ upgrade.verify.zone.name }}
 
 designatev2_zone_get_name_servers:
   module.run:
     - name: designatev2.zone_get_name_servers
     - kwargs:
         cloud_name: admin_identity
-        zone_id: {{ Designate_Test_Zone }}
-
+        zone_id: {{ upgrade.verify.zone.name }}
 
 designatev2_zone_absent:
   designatev2.zone_absent:
   - cloud_name: admin_identity
-  - name: {{ Designate_Test_Zone }}
-{%- endif %}
\ No newline at end of file
+  - name: {{ upgrade.verify.zone.name }}
+  {%- endif %}
+
+designatev2_zone_list:
+  module.run:
+    - name: designatev2.zone_list
+    - kwargs:
+        cloud_name: admin_identity
+{%- endif %}