diff --git a/README.rst b/README.rst
index 91583de..f7102e1 100644
--- a/README.rst
+++ b/README.rst
@@ -210,6 +210,18 @@
           max_processes: 4096
         host: node-12.domain.tld
 
+Group membership for user nova (upgrade related)
+
+.. code-block:: yaml
+
+    nova:
+      compute:
+        enabled: true
+        ...
+        user:
+          groups:
+          - libvirt
+
 Nova services on compute node with OpenContrail
 
 .. code-block:: yaml
@@ -347,6 +359,20 @@
             - aggregate1
             - aggregate2
 
+Upgrade levels
+
+.. code-block:: yaml
+
+    nova:
+      controller:
+        upgrade_levels:
+          compute: juno
+
+    nova:
+      compute:
+        upgrade_levels:
+          compute: juno
+
 SR-IOV
 ------
 
diff --git a/nova/compute.sls b/nova/compute.sls
index f2e9f18..128c570 100644
--- a/nova/compute.sls
+++ b/nova/compute.sls
@@ -43,8 +43,12 @@
   - name: nova
   - home: /var/lib/nova
   - shell: /bin/bash
+{%- if compute.user.groups is defined %}
+  - groups: {{ compute.user.groups }}
+{%- else %}
   - groups:
     - libvirtd
+{%- endif %}
 
 /var/lib/nova/.ssh/id_rsa:
   file.managed:
diff --git a/nova/files/juno/libvirtd.conf.Debian b/nova/files/juno/libvirtd.conf.Debian
index 8333dcb..4fab737 100644
--- a/nova/files/juno/libvirtd.conf.Debian
+++ b/nova/files/juno/libvirtd.conf.Debian
@@ -1,3 +1,4 @@
+{%- from "nova/map.jinja" import compute with context %}
 # Master libvirt daemon configuration file
 #
 # For further information consult http://libvirt.org/format.html
@@ -84,7 +85,7 @@
 # without becoming root.
 #
 # This is restricted to 'root' by default.
-unix_sock_group = "libvirtd"
+unix_sock_group = "{{ compute.get('libvirt_service_group', 'libvirtd') }}"
 
 # Set the UNIX socket permissions for the R/O socket. This is used
 # for monitoring VM status only
diff --git a/nova/files/juno/nova-compute.conf.Debian b/nova/files/juno/nova-compute.conf.Debian
index 01ca501..37fce03 100644
--- a/nova/files/juno/nova-compute.conf.Debian
+++ b/nova/files/juno/nova-compute.conf.Debian
@@ -154,3 +154,10 @@
 
 [cinder]
 catalog_info=volumev2:cinderv2:internalURL
+
+{%- if compute.upgrade_levels is defined %}
+[upgrade_levels]
+{%- for key, value in compute.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}
diff --git a/nova/files/juno/nova-controller.conf.Debian b/nova/files/juno/nova-controller.conf.Debian
index 263539b..d8eb174 100644
--- a/nova/files/juno/nova-controller.conf.Debian
+++ b/nova/files/juno/nova-controller.conf.Debian
@@ -154,3 +154,10 @@
 
 [cinder]
 catalog_info=volumev2:cinderv2:internalURL
+
+{%- if controller.upgrade_levels is defined %}
+[upgrade_levels]
+{%- for key, value in controller.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}
diff --git a/nova/files/kilo/libvirtd.conf.Debian b/nova/files/kilo/libvirtd.conf.Debian
index 8333dcb..4fab737 100644
--- a/nova/files/kilo/libvirtd.conf.Debian
+++ b/nova/files/kilo/libvirtd.conf.Debian
@@ -1,3 +1,4 @@
+{%- from "nova/map.jinja" import compute with context %}
 # Master libvirt daemon configuration file
 #
 # For further information consult http://libvirt.org/format.html
@@ -84,7 +85,7 @@
 # without becoming root.
 #
 # This is restricted to 'root' by default.
-unix_sock_group = "libvirtd"
+unix_sock_group = "{{ compute.get('libvirt_service_group', 'libvirtd') }}"
 
 # Set the UNIX socket permissions for the R/O socket. This is used
 # for monitoring VM status only
diff --git a/nova/files/kilo/nova-compute.conf.Debian b/nova/files/kilo/nova-compute.conf.Debian
index d7efd47..f87f5ad 100644
--- a/nova/files/kilo/nova-compute.conf.Debian
+++ b/nova/files/kilo/nova-compute.conf.Debian
@@ -195,3 +195,10 @@
 libvirt_inject_key=false
 libvirt_inject_partition=-2
 {%- endif %}
+
+{%- if compute.upgrade_levels is defined %}
+[upgrade_levels]
+{%- for key, value in compute.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}
diff --git a/nova/files/kilo/nova-controller.conf.Debian b/nova/files/kilo/nova-controller.conf.Debian
index c86039a..b57f1ed 100644
--- a/nova/files/kilo/nova-controller.conf.Debian
+++ b/nova/files/kilo/nova-controller.conf.Debian
@@ -210,3 +210,10 @@
 [cinder]
 os_region_name = {{ controller.identity.region }}
 catalog_info=volumev2:cinderv2:internalURL
+
+{%- if controller.upgrade_levels is defined %}
+[upgrade_levels]
+{%- for key, value in controller.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}
diff --git a/nova/files/liberty/libvirtd.conf.Debian b/nova/files/liberty/libvirtd.conf.Debian
index 8333dcb..4fab737 100644
--- a/nova/files/liberty/libvirtd.conf.Debian
+++ b/nova/files/liberty/libvirtd.conf.Debian
@@ -1,3 +1,4 @@
+{%- from "nova/map.jinja" import compute with context %}
 # Master libvirt daemon configuration file
 #
 # For further information consult http://libvirt.org/format.html
@@ -84,7 +85,7 @@
 # without becoming root.
 #
 # This is restricted to 'root' by default.
-unix_sock_group = "libvirtd"
+unix_sock_group = "{{ compute.get('libvirt_service_group', 'libvirtd') }}"
 
 # Set the UNIX socket permissions for the R/O socket. This is used
 # for monitoring VM status only
diff --git a/nova/files/liberty/nova-compute.conf.Debian b/nova/files/liberty/nova-compute.conf.Debian
index 772f1b8..3f2074c 100644
--- a/nova/files/liberty/nova-compute.conf.Debian
+++ b/nova/files/liberty/nova-compute.conf.Debian
@@ -217,3 +217,10 @@
 
 [vnc]
 keymap = {{ compute.get('vnc_keymap', 'en-us') }}
+
+{%- if compute.upgrade_levels is defined %}
+[upgrade_levels]
+{%- for key, value in compute.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}
diff --git a/nova/files/liberty/nova-controller.conf.Debian b/nova/files/liberty/nova-controller.conf.Debian
index e33c50e..90764b8 100644
--- a/nova/files/liberty/nova-controller.conf.Debian
+++ b/nova/files/liberty/nova-controller.conf.Debian
@@ -224,3 +224,10 @@
 
 [vnc]
 keymap = {{ controller.get('vnc_keymap', 'en-us') }}
+
+{%- if controller.upgrade_levels is defined %}
+[upgrade_levels]
+{%- for key, value in controller.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}
diff --git a/nova/files/mitaka/libvirtd.conf.Debian b/nova/files/mitaka/libvirtd.conf.Debian
index 8333dcb..4fab737 100644
--- a/nova/files/mitaka/libvirtd.conf.Debian
+++ b/nova/files/mitaka/libvirtd.conf.Debian
@@ -1,3 +1,4 @@
+{%- from "nova/map.jinja" import compute with context %}
 # Master libvirt daemon configuration file
 #
 # For further information consult http://libvirt.org/format.html
@@ -84,7 +85,7 @@
 # without becoming root.
 #
 # This is restricted to 'root' by default.
-unix_sock_group = "libvirtd"
+unix_sock_group = "{{ compute.get('libvirt_service_group', 'libvirtd') }}"
 
 # Set the UNIX socket permissions for the R/O socket. This is used
 # for monitoring VM status only
diff --git a/nova/files/mitaka/nova-compute.conf.Debian b/nova/files/mitaka/nova-compute.conf.Debian
index b4fb695..316ab71 100644
--- a/nova/files/mitaka/nova-compute.conf.Debian
+++ b/nova/files/mitaka/nova-compute.conf.Debian
@@ -200,3 +200,10 @@
 [workarounds]
 disable_libvirt_livesnapshot={{ compute.workaround.get('disable_libvirt_livesnapshot', True)|lower }}
 {%- endif %}
+
+{%- if compute.upgrade_levels is defined %}
+[upgrade_levels]
+{%- for key, value in compute.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}
diff --git a/nova/files/mitaka/nova-controller.conf.Debian b/nova/files/mitaka/nova-controller.conf.Debian
index 0cfc5eb..f44566e 100644
--- a/nova/files/mitaka/nova-controller.conf.Debian
+++ b/nova/files/mitaka/nova-controller.conf.Debian
@@ -254,3 +254,10 @@
 {% if controller.cors.allow_headers is defined %}
 allow_headers = {{ controller.cors.allow_headers }}
 {% endif %}
+
+{%- if controller.upgrade_levels is defined %}
+[upgrade_levels]
+{%- for key, value in controller.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}
diff --git a/nova/files/newton/libvirtd.conf.Debian b/nova/files/newton/libvirtd.conf.Debian
index 8333dcb..4fab737 100644
--- a/nova/files/newton/libvirtd.conf.Debian
+++ b/nova/files/newton/libvirtd.conf.Debian
@@ -1,3 +1,4 @@
+{%- from "nova/map.jinja" import compute with context %}
 # Master libvirt daemon configuration file
 #
 # For further information consult http://libvirt.org/format.html
@@ -84,7 +85,7 @@
 # without becoming root.
 #
 # This is restricted to 'root' by default.
-unix_sock_group = "libvirtd"
+unix_sock_group = "{{ compute.get('libvirt_service_group', 'libvirtd') }}"
 
 # Set the UNIX socket permissions for the R/O socket. This is used
 # for monitoring VM status only
diff --git a/nova/files/newton/nova-compute.conf.Debian b/nova/files/newton/nova-compute.conf.Debian
index c3669bd..ee4525d 100644
--- a/nova/files/newton/nova-compute.conf.Debian
+++ b/nova/files/newton/nova-compute.conf.Debian
@@ -224,3 +224,10 @@
 [workarounds]
 disable_libvirt_livesnapshot={{ compute.workaround.get('disable_libvirt_livesnapshot', True)|lower }}
 {%- endif %}
+
+{%- if compute.upgrade_levels is defined %}
+[upgrade_levels]
+{%- for key, value in compute.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}
diff --git a/nova/files/newton/nova-controller.conf.Debian b/nova/files/newton/nova-controller.conf.Debian
index 6bc11cf..801aab9 100644
--- a/nova/files/newton/nova-controller.conf.Debian
+++ b/nova/files/newton/nova-controller.conf.Debian
@@ -263,3 +263,10 @@
 {% if controller.cors.allow_headers is defined %}
 allow_headers = {{ controller.cors.allow_headers }}
 {% endif %}
+
+{%- if controller.upgrade_levels is defined %}
+[upgrade_levels]
+{%- for key, value in controller.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}
diff --git a/nova/files/newton/nova-controller.conf.RedHat b/nova/files/newton/nova-controller.conf.RedHat
index 6739f80..193d536 100644
--- a/nova/files/newton/nova-controller.conf.RedHat
+++ b/nova/files/newton/nova-controller.conf.RedHat
@@ -213,3 +213,10 @@
 
 [wsgi]
 api_paste_config=/etc/nova/api-paste.ini
+
+{%- if controller.upgrade_levels is defined %}
+[upgrade_levels]
+{%- for key, value in controller.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}
diff --git a/nova/files/ocata/libvirtd.conf.Debian b/nova/files/ocata/libvirtd.conf.Debian
index 8333dcb..4fab737 100644
--- a/nova/files/ocata/libvirtd.conf.Debian
+++ b/nova/files/ocata/libvirtd.conf.Debian
@@ -1,3 +1,4 @@
+{%- from "nova/map.jinja" import compute with context %}
 # Master libvirt daemon configuration file
 #
 # For further information consult http://libvirt.org/format.html
@@ -84,7 +85,7 @@
 # without becoming root.
 #
 # This is restricted to 'root' by default.
-unix_sock_group = "libvirtd"
+unix_sock_group = "{{ compute.get('libvirt_service_group', 'libvirtd') }}"
 
 # Set the UNIX socket permissions for the R/O socket. This is used
 # for monitoring VM status only
diff --git a/nova/files/ocata/nova-compute.conf.Debian b/nova/files/ocata/nova-compute.conf.Debian
index 65aa23a..0e21b2e 100644
--- a/nova/files/ocata/nova-compute.conf.Debian
+++ b/nova/files/ocata/nova-compute.conf.Debian
@@ -9396,7 +9396,11 @@
 
 
 [upgrade_levels]
-#
+{%- if compute.upgrade_levels is defined %}
+{%- for key, value in compute.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}#
 # upgrade_levels options are used to set version cap for RPC
 # messages sent between different nova services.
 #
diff --git a/nova/files/ocata/nova-controller.conf.Debian b/nova/files/ocata/nova-controller.conf.Debian
index 64cc4b8..78ce62b 100644
--- a/nova/files/ocata/nova-controller.conf.Debian
+++ b/nova/files/ocata/nova-controller.conf.Debian
@@ -9395,6 +9395,11 @@
 
 
 [upgrade_levels]
+{%- if controller.upgrade_levels is defined %}
+{%- for key, value in controller.upgrade_levels.iteritems() %}
+{{ key }}={{ value }}
+{%- endfor %}
+{%- endif -%}
 #
 # upgrade_levels options are used to set version cap for RPC
 # messages sent between different nova services.
diff --git a/tests/pillar/compute_cluster.sls b/tests/pillar/compute_cluster.sls
index c3a2485..1a3335f 100644
--- a/tests/pillar/compute_cluster.sls
+++ b/tests/pillar/compute_cluster.sls
@@ -66,3 +66,6 @@
         port: 11211
     libvirt:
       hw_disk_discard: unmap
+    upgrade_levels:
+      compute: liberty
+    libvirt_service_group: libvirtd
diff --git a/tests/pillar/control_cluster.sls b/tests/pillar/control_cluster.sls
index 9744dd1..07cb450 100644
--- a/tests/pillar/control_cluster.sls
+++ b/tests/pillar/control_cluster.sls
@@ -62,3 +62,5 @@
       'context_is_admin': 'role:admin or role:administrator'
       'compute:create': 'rule:admin_or_owner'
       'compute:create:attach_network':
+    upgrade_levels:
+      compute: liberty