diff --git a/designate/map.jinja b/designate/map.jinja
index c299c7e..74f0f59 100644
--- a/designate/map.jinja
+++ b/designate/map.jinja
@@ -100,3 +100,5 @@
         'pkgs': ['python-designateclient'],
     },
 }, merge=pillar.designate.get('client', {})) %}
+
+{% set upgrade = pillar.get('designate', {}).get('upgrade', {}) %}
diff --git a/designate/meta/salt.yml b/designate/meta/salt.yml
new file mode 100644
index 0000000..b9c88ed
--- /dev/null
+++ b/designate/meta/salt.yml
@@ -0,0 +1,5 @@
+orchestration:
+  upgrade:
+    applications:
+      designate:
+        priority: 1300
diff --git a/designate/server.sls b/designate/server.sls
index fed7379..2f56638 100644
--- a/designate/server.sls
+++ b/designate/server.sls
@@ -19,6 +19,8 @@
   file.managed:
     - source: salt://designate/files/rndc.key
     - template: jinja
+    - mode: 0640
+    - group: designate
     - require:
       - pkg: designate_server_packages
 
@@ -56,11 +58,14 @@
     - name: /etc/designate/logging.conf
     - source: salt://oslo_templates/files/logging/_logging.conf
     - template: jinja
-    - user: designate
+    - mode: 0640
+    - user: root
     - group: designate
     - defaults:
         service_name: designate
         _data: {{ server.logging }}
+    - require_in:
+      - sls: designate.db.offline_sync
     - require:
       - pkg: designate_server_packages
 {%- if server.logging.log_handlers.get('fluentd', {}).get('enabled', False) %}
@@ -83,7 +88,8 @@
     - source: salt://oslo_templates/files/logging/_logging.conf
     - template: jinja
     - makedirs: True
-    - user: designate
+    - mode: 0640
+    - user: root
     - group: designate
     - defaults:
         service_name: {{ service_name }}
@@ -108,6 +114,8 @@
   file.managed:
   - source: salt://designate/files/{{ server.version }}/designate.conf.{{ grains.os_family }}
   - template: jinja
+  - mode: 0640
+  - group: designate
   - require:
     - pkg: designate_server_packages
   - require_in:
@@ -117,6 +125,8 @@
   file.managed:
   - source: salt://designate/files/{{ server.version }}/api-paste.ini
   - template: jinja
+  - mode: 0640
+  - group: designate
   - require:
     - pkg: designate_server_packages
   - require_in:
@@ -156,6 +166,8 @@
   file.managed:
   - source: salt://designate/files/{{ server.version }}/pools.yaml
   - template: jinja
+  - mode: 0640
+  - group: designate
   - require:
     - pkg: designate_server_packages
 
diff --git a/designate/upgrade/pkgs_latest.sls b/designate/upgrade/pkgs_latest.sls
new file mode 100644
index 0000000..ae85199
--- /dev/null
+++ b/designate/upgrade/pkgs_latest.sls
@@ -0,0 +1,48 @@
+{%- from "designate/map.jinja" import server, client, pool_manager, agent, worker with context %}
+
+designate_task_pkgs_latest:
+  test.show_notification:
+    - name: "dump_message_pkgs_latest"
+    - text: "Running designate.upgrade.pkgs_latest"
+
+policy-rc.d_present:
+  file.managed:
+    - name: /usr/sbin/policy-rc.d
+    - mode: 755
+    - contents: |
+        #!/bin/sh
+        exit 101
+
+{%- set pkgs = [] %}
+
+{%- if server.get('enabled', false) %}
+  {%- do pkgs.extend(server.pkgs) %}
+{%- endif %}
+
+{%- if client.get('enabled', false) %}
+  {%- do pkgs.extend(client.pkgs) %}
+{%- endif %}
+
+{%- if pool_manager.get('enabled', false) %}
+  {%- do pkgs.extend(pool_manager.pkgs) %}
+{%- endif %}
+
+{%- if worker.get('enabled', false) %}
+  {%- do pkgs.extend(worker.pkgs) %}
+{%- endif %}
+
+{%- if agent.get('enabled', false) %}
+  {%- do pkgs.extend(agent.pkgs) %}
+{%- endif %}
+
+designate_packages:
+  pkg.latest:
+  - names: {{ pkgs|unique }}
+  - require:
+    - file: policy-rc.d_present
+  - require_in:
+    - file: policy-rc.d_absent
+
+policy-rc.d_absent:
+  file.absent:
+    - name: /usr/sbin/policy-rc.d
diff --git a/designate/upgrade/post/init.sls b/designate/upgrade/post/init.sls
new file mode 100644
index 0000000..39ce5be
--- /dev/null
+++ b/designate/upgrade/post/init.sls
@@ -0,0 +1,4 @@
+designate_post:
+  test.show_notification:
+    - name: "dump_post-upgrade_message_designate"
+    - text: "Running designate.upgrade.post"
diff --git a/designate/upgrade/pre/init.sls b/designate/upgrade/pre/init.sls
new file mode 100644
index 0000000..7c30d8f
--- /dev/null
+++ b/designate/upgrade/pre/init.sls
@@ -0,0 +1,4 @@
+designate_pre:
+  test.show_notification:
+    - name: "dump_pre-upgrade_message_designate"
+    - text: "Running designate.upgrade.pre"
diff --git a/designate/upgrade/render_config.sls b/designate/upgrade/render_config.sls
new file mode 100644
index 0000000..98c08ac
--- /dev/null
+++ b/designate/upgrade/render_config.sls
@@ -0,0 +1,20 @@
+{%- from "designate/map.jinja" import server, upgrade with context %}
+
+designate_render_config:
+  test.show_notification:
+    - name: "dump_message_render_config_designate"
+    - text: "Running designate.upgrade.render_config"
+
+{%- if server.get('enabled', False) %}
+
+/etc/designate/designate.conf:
+  file.managed:
+  - source: salt://designate/files/{{ server.version }}/designate.conf.{{ grains.os_family }}
+  - template: jinja
+
+/etc/designate/api-paste.ini:
+  file.managed:
+  - source: salt://designate/files/{{ server.version }}/api-paste.ini
+  - template: jinja
+
+{%- endif %}
diff --git a/designate/upgrade/service_running.sls b/designate/upgrade/service_running.sls
new file mode 100644
index 0000000..4d5dcb1
--- /dev/null
+++ b/designate/upgrade/service_running.sls
@@ -0,0 +1,28 @@
+{%- from "designate/map.jinja" import server, pool_manager, agent with context %}
+
+designate_task_service_running:
+  test.show_notification:
+    - name: "dump_message_service_running_designate"
+    - text: "Running designate.upgrade.service_running"
+
+{%- if server.get('enabled', false) %}
+  {%- set dservices = server.services %}
+{%- endif %}
+
+{%- if pool_manager.get('enabled', false) %}
+  {%- do dservices.append(pool_manager.services) %}
+{%- endif %}
+
+{%- if agent.get('enabled', false) %}
+  {%- do dservices.append(agent.services) %}
+{%- endif %}
+
+{%- for dservice in dservices %}
+designate_service_running_{{ dservice }}:
+  service.running:
+    - enable: true
+    - name: {{ dservice }}
+    {%- if grains.get('noservices') %}
+    - onlyif: /bin/false
+    {%- endif %}
+{%- endfor %}
diff --git a/designate/upgrade/service_stopped.sls b/designate/upgrade/service_stopped.sls
new file mode 100644
index 0000000..83cee90
--- /dev/null
+++ b/designate/upgrade/service_stopped.sls
@@ -0,0 +1,28 @@
+{%- from "designate/map.jinja" import server, pool_manager, agent with context %}
+
+designate_task_service_stopped:
+  test.show_notification:
+    - name: "dump_message_service_stopped_designate"
+    - text: "Running dsignate.upgrade.service_stopped"
+
+{%- if server.get('enabled', false) %}
+  {%- set dservices = server.services %}
+{%- endif %}
+
+{%- if pool_manager.get('enabled', false) %}
+  {%- do dservices.append(pool_manager.services) %}
+{%- endif %}
+
+{%- if agent.get('enabled', false) %}
+  {%- do dservices.append(agent.services) %}
+{%- endif %}
+
+{%- for dservice in dservices %}
+designate_service_stopped_{{ dservice }}:
+  service.dead:
+    - enable: false
+    - name: {{ dservice }}
+    {%- if grains.get('noservices') %}
+    - onlyif: /bin/false
+    {%- endif %}
+{%- endfor %}
diff --git a/designate/upgrade/upgrade/init.sls b/designate/upgrade/upgrade/init.sls
new file mode 100644
index 0000000..c6bb6d4
--- /dev/null
+++ b/designate/upgrade/upgrade/init.sls
@@ -0,0 +1,13 @@
+{%- from "designate/map.jinja" import server with context %}
+
+designate_upgrade:
+  test.show_notification:
+    - name: "dump_message_upgrade_designate"
+    - text: "Running designate.upgrade.upgrade"
+
+include:
+ - designate.upgrade.service_stopped
+ - designate.upgrade.pkgs_latest
+ - designate.upgrade.render_config
+ - designate.db.offline_sync
+ - designate.upgrade.service_running
diff --git a/designate/upgrade/verify/api.sls b/designate/upgrade/verify/api.sls
new file mode 100644
index 0000000..810026c
--- /dev/null
+++ b/designate/upgrade/verify/api.sls
@@ -0,0 +1,7 @@
+designate_upgrade_verify_api:
+  test.show_notification:
+    - name: "dump_message_verify_api"
+    - text: "Running designate.upgrade.verify.api"
+
+#TODO: comprehensive designate module should be created to have
+#      a chanse perform managment and monitor actions
diff --git a/designate/worker.sls b/designate/worker.sls
index fb3f91c..b1f52b6 100644
--- a/designate/worker.sls
+++ b/designate/worker.sls
@@ -42,7 +42,8 @@
     - source: salt://oslo_templates/files/logging/_logging.conf
     - template: jinja
     - makedirs: True
-    - user: designate
+    - mode: 0640
+    - user: root
     - group: designate
     - defaults:
         service_name: {{ service_name }}