diff --git a/keystone/map.jinja b/keystone/map.jinja
index 5e89f10..e5e05af 100644
--- a/keystone/map.jinja
+++ b/keystone/map.jinja
@@ -67,7 +67,13 @@
     },
 }, merge=pillar.get('keystone', {}).get('server', {}), base='BaseDefaults') %}
 
+{%- set client_default_params = {
+      'enabled': false
+    }
+%}
+
 {% set client = salt['grains.filter_by']({
+    'BaseDefaults': client_default_params,
     'Debian': {
         'pkgs': ['python-keystoneclient', 'python-openstackclient'],
         'service': 'keystone',
@@ -80,7 +86,7 @@
         'pkgs': ['python-keystoneclient'],
         'roles': ['admin', 'Member'],
     },
-}, merge=pillar.get('keystone', {}).get('client', {})) %}
+}, merge=pillar.get('keystone', {}).get('client', {}), base='BaseDefaults') %}
 
 {% set control = salt['grains.filter_by']({
     'Debian': {
diff --git a/keystone/meta/salt.yml b/keystone/meta/salt.yml
index 554ed23..7950e8a 100644
--- a/keystone/meta/salt.yml
+++ b/keystone/meta/salt.yml
@@ -1,17 +1,12 @@
-orchestrate:
-  server:
-    priority: 500
-    batch: 1
-  client:
-    priority: 510
-  control:
-    priority: 520
-
 orchestration:
   deploy:
     applications:
       keystone:
         priority: 1000
+  upgrade:
+    applications:
+      keystone:
+        priority: 1000
 
 minion:
   {%- if pillar.get('keystone', {}).get('server') or pillar.get('keystone', {}).get('client') %}
diff --git a/keystone/upgrade/pkgs_latest.sls b/keystone/upgrade/pkgs_latest.sls
new file mode 100644
index 0000000..ac41dee
--- /dev/null
+++ b/keystone/upgrade/pkgs_latest.sls
@@ -0,0 +1,35 @@
+{%- from "keystone/map.jinja" import server,client with context %}
+
+keystone_task_pkg_latest:
+  test.show_notification:
+    - text: "Running keystone.upgrade.pkg_latest"
+
+policy-rc.d_present:
+  file.managed:
+    - name: /usr/sbin/policy-rc.d
+    - mode: 755
+    - contents: |
+        #!/bin/sh
+        exit 101
+
+{%- set pkgs = [] %}
+{%- if server.enabled %}
+  {%- do pkgs.extend(server.pkgs) %}
+{%- endif %}
+{%- if client.get('enabled', false) %}
+  {%- do pkgs.extend(client.pkgs) %}
+{%- endif %}
+
+{%- for kpkg in pkgs|unique %}
+keystone_package_{{ kpkg }}:
+  pkg.latest:
+  - name: {{ kpkg }}
+  - require:
+    - file: policy-rc.d_present
+  - require_in:
+    - file: policy-rc.d_absent
+{%- endfor %}
+
+policy-rc.d_absent:
+  file.absent:
+    - name: /usr/sbin/policy-rc.d
diff --git a/keystone/upgrade/post/init.sls b/keystone/upgrade/post/init.sls
new file mode 100644
index 0000000..1e6fdbf
--- /dev/null
+++ b/keystone/upgrade/post/init.sls
@@ -0,0 +1,15 @@
+{%- from "keystone/map.jinja" import server with context %}
+
+keystone_post:
+  test.show_notification:
+    - text: "Running keystone.upgrade.post"
+
+{%- if server.enabled %}
+
+keystone_doctor:
+  cmd.run:
+    - name: keystone-manage doctor
+  {%- if grains.get('noservices') or server.get('role', 'primary') == 'secondary' %}
+    - onlyif: /bin/false
+  {%- endif %}
+{%- endif %}
diff --git a/keystone/upgrade/pre/init.sls b/keystone/upgrade/pre/init.sls
new file mode 100644
index 0000000..2ad6ad2
--- /dev/null
+++ b/keystone/upgrade/pre/init.sls
@@ -0,0 +1,18 @@
+{%- from "keystone/map.jinja" import server with context %}
+
+keystone_pre:
+  test.show_notification:
+    - text: "Running keystone.upgrade.pre"
+
+include:
+ - keystone.upgrade.verify.api
+
+{%- if server.enabled %}
+
+keystone_doctor:
+  cmd.run:
+    - name: keystone-manage doctor
+  {%- if grains.get('noservices') or server.get('role', 'primary') == 'secondary' %}
+    - onlyif: /bin/false
+  {%- endif %}
+{%- endif %}
diff --git a/keystone/upgrade/render_config.sls b/keystone/upgrade/render_config.sls
new file mode 100644
index 0000000..cdb6b09
--- /dev/null
+++ b/keystone/upgrade/render_config.sls
@@ -0,0 +1,19 @@
+{%- from "keystone/map.jinja" import server with context %}
+
+keystone_render_config:
+  test.show_notification:
+    - text: "Running keystone.upgrade.render_config"
+
+{%- if server.enabled %}
+/etc/keystone/keystone.conf:
+  file.managed:
+  - source: salt://keystone/files/{{ server.version }}/keystone.conf.{{ grains.os_family }}
+  - template: jinja
+
+/etc/keystone/keystone-paste.ini:
+  file.managed:
+  - source: salt://keystone/files/{{ server.version }}/keystone-paste.ini.{{ grains.os_family }}
+  - user: keystone
+  - group: keystone
+  - template: jinja
+{%- endif %}
diff --git a/keystone/upgrade/service_running.sls b/keystone/upgrade/service_running.sls
new file mode 100644
index 0000000..04e9306
--- /dev/null
+++ b/keystone/upgrade/service_running.sls
@@ -0,0 +1,13 @@
+{%- from "keystone/map.jinja" import server with context %}
+
+keystone_task_service_running:
+  test.show_notification:
+    - text: "Running keystone.upgrade.service_running"
+
+{%- if server.enabled %}
+
+keystone_service:
+  service.running:
+  - enable: True
+  - name: {{ server.service_name }}
+{%- endif %}
diff --git a/keystone/upgrade/service_stopped.sls b/keystone/upgrade/service_stopped.sls
new file mode 100644
index 0000000..55c91ec
--- /dev/null
+++ b/keystone/upgrade/service_stopped.sls
@@ -0,0 +1,12 @@
+{%- from "keystone/map.jinja" import server with context %}
+
+keystone_task_service_stopped:
+  test.show_notification:
+    - text: "Running keystone.upgrade.service_stopped"
+
+{%- if server.enabled %}
+keystone_service_stopped:
+  service.dead:
+  - name: {{ server.service_name }}
+  - enable: False
+{%- endif %}
diff --git a/keystone/upgrade/upgrade/init.sls b/keystone/upgrade/upgrade/init.sls
new file mode 100644
index 0000000..b0de616
--- /dev/null
+++ b/keystone/upgrade/upgrade/init.sls
@@ -0,0 +1,12 @@
+{%- from "keystone/map.jinja" import server with context %}
+
+keystone_upgrade:
+  test.show_notification:
+    - text: "Running keystone.upgrade.upgrade"
+
+include:
+ - keystone.upgrade.service_stopped
+ - keystone.upgrade.pkgs_latest
+ - keystone.upgrade.render_config
+ - keystone.db.offline_sync
+ - keystone.upgrade.service_running
diff --git a/keystone/upgrade/verify/api.sls b/keystone/upgrade/verify/api.sls
new file mode 100644
index 0000000..eba4bf0
--- /dev/null
+++ b/keystone/upgrade/verify/api.sls
@@ -0,0 +1,39 @@
+{%- from "keystone/map.jinja" import client with context %}
+
+keystone_upgrade_verify_api:
+  test.show_notification:
+    - text: "Running keystone.upgrade.verify.api"
+
+{%- if client.enabled and client.get('os_client_config', {}).get('enabled', False)  %}
+
+{%- set Keystone_Test_Project = 'TestProject' %}
+{%- set Keystone_Test_User = 'TestKeystoneUser' %}
+
+keystonev3_project_present:
+  keystonev3.project_present:
+  - name: {{ Keystone_Test_Project }}
+  - cloud_name: admin_identity
+  - domain_id: default
+
+keystonev3_user_present:
+  keystonev3.user_present:
+  - name: {{ Keystone_Test_User }}
+  - cloud_name: admin_identity
+  - default_project_id: {{ Keystone_Test_Project }}
+  - require:
+    - keystonev3_project_present
+
+keystonev3_project_absent:
+  keystonev3.project_absent:
+  - name: {{ Keystone_Test_Project }}
+  - cloud_name: admin_identity
+  - require:
+    - keystonev3_user_present
+
+keystonev3_user_absent:
+  keystonev3.user_absent:
+  - name: {{ Keystone_Test_User }}
+  - cloud_name: admin_identity
+  - require:
+    - keystonev3_project_absent
+{%- endif %}