diff --git a/.travis.yml b/.travis.yml
index 513e74e..3262a14 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -21,8 +21,6 @@
   - bundle install
 
 env:
-  - PLATFORM=epcim/salt:saltstack-ubuntu-xenial-salt-2016.3 OS_VERSION=pike SUITE=server-cluster
-  - PLATFORM=epcim/salt:saltstack-ubuntu-xenial-salt-2016.3 OS_VERSION=pike SUITE=server-single
   - PLATFORM=epcim/salt:saltstack-ubuntu-xenial-salt-2017.7 OS_VERSION=pike SUITE=server-cluster
   - PLATFORM=epcim/salt:saltstack-ubuntu-xenial-salt-2017.7 OS_VERSION=pike SUITE=server-single
   - PLATFORM=epcim/salt:saltstack-ubuntu-xenial-salt-2018.3 OS_VERSION=pike SUITE=server-cluster
diff --git a/panko/client.sls b/panko/client.sls
new file mode 100644
index 0000000..54fc75f
--- /dev/null
+++ b/panko/client.sls
@@ -0,0 +1,8 @@
+{%- from "panko/map.jinja" import client with context %}
+{%- if client.enabled %}
+
+panko_client_packages:
+  pkg.installed:
+  - names: {{ client.pkgs }}
+
+{%- endif %}
\ No newline at end of file
diff --git a/panko/db/offline_sync.sls b/panko/db/offline_sync.sls
new file mode 100644
index 0000000..251e2bb
--- /dev/null
+++ b/panko/db/offline_sync.sls
@@ -0,0 +1,8 @@
+{%- from "panko/map.jinja" import server with context %}
+
+panko_syncdb:
+  cmd.run:
+  - name: panko-dbsync
+  {%- if grains.get('noservices') or server.get('role', 'primary') == 'secondary' %}
+  - onlyif: /bin/false
+  {%- endif %}
diff --git a/panko/init.sls b/panko/init.sls
index bfdf23f..00d92bf 100644
--- a/panko/init.sls
+++ b/panko/init.sls
@@ -3,3 +3,6 @@
 {%- if pillar.panko.server is defined %}
 - panko.server
 {%- endif %}
+{%- if pillar.panko.client is defined %}
+- panko.client
+{%- endif %}
diff --git a/panko/map.jinja b/panko/map.jinja
index c0f1e3f..2108f6d 100644
--- a/panko/map.jinja
+++ b/panko/map.jinja
@@ -3,6 +3,7 @@
 Debian:
   pkgs:
     - panko-api
+  service_name: apache2
   cacert_file: '/etc/ssl/certs/ca-certificates.crt'
   expirer:
     cron:
@@ -16,4 +17,14 @@
 
 {%- endload %}
 
+{%- load_yaml as client_defaults %}
+
+Debian:
+  enabled: false
+  pkgs:
+    - python-pankoclient
+{%- endload %}
+
 {%- set server = salt['grains.filter_by'](base_defaults, merge=salt['pillar.get']('panko:server')) %}
+{%- set client = salt['grains.filter_by'](client_defaults, merge=salt['pillar.get']('panko:client')) %}
+{%- set upgrade = pillar.get('panko', {}).get('upgrade', {}) %}
diff --git a/panko/meta/salt.yml b/panko/meta/salt.yml
new file mode 100644
index 0000000..4d48208
--- /dev/null
+++ b/panko/meta/salt.yml
@@ -0,0 +1,5 @@
+orchestration:
+  upgrade:
+    applications:
+      panko:
+        priority: 1900
diff --git a/panko/server.sls b/panko/server.sls
index c3efa2c..2e85687 100644
--- a/panko/server.sls
+++ b/panko/server.sls
@@ -5,12 +5,14 @@
 include:
   - apache
   - panko._ssl.mysql
+  - panko.db.offline_sync
 
 panko_server_packages:
   pkg.installed:
   - names: {{ server.pkgs }}
   - require_in:
     - sls: panko._ssl.mysql
+    - sls: panko.db.offline_sync
 
 /etc/panko/panko.conf:
   file.managed:
@@ -21,6 +23,8 @@
   - require:
     - sls: panko._ssl.mysql
     - pkg: panko_server_packages
+  - require_in:
+    - sls: panko.db.offline_sync
 
 {% if server.logging.log_appender %}
 
@@ -50,6 +54,8 @@
 {%- if server.logging.log_handlers.get('fluentd', {}).get('enabled', False) %}
       - pkg: panko_fluentd_logger_package
 {%- endif %}
+    - require_in:
+      - sls: panko.db.offline_sync
     - watch_in:
       - service: panko_apache_restart
 {% endif %}
@@ -78,15 +84,6 @@
       - file: /etc/panko/panko.conf
 {%- endif %}
 
-panko_syncdb:
-  cmd.run:
-  - name: panko-dbsync
-  {%- if grains.get('noservices') %}
-  - onlyif: /bin/false
-  {%- endif %}
-  - require:
-    - file: /etc/panko/panko.conf
-
 {#- Creation of sites using templates is deprecated, sites should be generated by apache pillar, and enabled by panko formula #}
 {%- if pillar.get('apache', {}).get('server', {}).get('site', {}).panko is defined %}
 
@@ -122,7 +119,7 @@
 panko_apache_restart:
   service.running:
   - enable: true
-  - name: apache2
+  - name: {{ server.service_name }}
   {%- if grains.get('noservices') %}
   - onlyif: /bin/false
   {%- endif %}
@@ -131,5 +128,6 @@
     - apache_enable_panko_wsgi
   - require:
     - sls: panko._ssl.mysql
+    - sls: panko.db.offline_sync
 
 {%- endif %}
diff --git a/panko/upgrade/pkgs_latest.sls b/panko/upgrade/pkgs_latest.sls
new file mode 100644
index 0000000..8607425
--- /dev/null
+++ b/panko/upgrade/pkgs_latest.sls
@@ -0,0 +1,33 @@
+{%- from "panko/map.jinja" import server,client,upgrade with context %}
+
+panko_task_pkg_latest:
+  test.show_notification:
+    - text: "Running panko.upgrade.pkg_latest"
+
+policy-rc.d_present:
+  file.managed:
+    - name: /usr/sbin/policy-rc.d
+    - mode: 755
+    - contents: |
+        #!/bin/sh
+        exit 101
+
+{%- set pkgs = [] %}
+{%- if server.enabled %}
+  {%- do pkgs.extend(server.pkgs) %}
+{%- endif %}
+{%- if client.enabled %}
+  {%- do pkgs.extend(client.pkgs) %}
+{%- endif %}
+
+panko_pkg_latest:
+  pkg.latest:
+  - names: {{ pkgs|unique }}
+  - require:
+    - file: policy-rc.d_present
+  - require_in:
+    - file: policy-rc.d_absent
+
+policy-rc.d_absent:
+  file.absent:
+    - name: /usr/sbin/policy-rc.d
diff --git a/panko/upgrade/post/init.sls b/panko/upgrade/post/init.sls
new file mode 100644
index 0000000..a0df2ce
--- /dev/null
+++ b/panko/upgrade/post/init.sls
@@ -0,0 +1,7 @@
+panko_post:
+  test.show_notification:
+    - text: "Running panko.upgrade.post"
+
+keystone_os_client_config_absent:
+  file.absent:
+    - name: /etc/openstack/clouds.yml
diff --git a/panko/upgrade/pre/init.sls b/panko/upgrade/pre/init.sls
new file mode 100644
index 0000000..2a7ec69
--- /dev/null
+++ b/panko/upgrade/pre/init.sls
@@ -0,0 +1,14 @@
+panko_pre:
+  test.show_notification:
+    - text: "Running panko.upgrade.pre"
+
+{%- set os_content = salt['mine.get']('I@keystone:client:os_client_config:enabled:true', 'keystone_os_client_config', 'compound').values()[0] %}
+keystone_os_client_config:
+  file.managed:
+    - name: /etc/openstack/clouds.yml
+    - contents: |
+        {{ os_content |yaml(False)|indent(8) }}
+    - user: 'root'
+    - group: 'root'
+    - makedirs: True
+    - unless: test -f /etc/openstack/clouds.yml
\ No newline at end of file
diff --git a/panko/upgrade/render_config.sls b/panko/upgrade/render_config.sls
new file mode 100644
index 0000000..c4683eb
--- /dev/null
+++ b/panko/upgrade/render_config.sls
@@ -0,0 +1,12 @@
+{%- from "panko/map.jinja" import server with context %}
+
+panko_render_config:
+  test.show_notification:
+    - text: "Running panko.upgrade.render_config"
+
+{%- if server.enabled %}
+/etc/panko/panko.conf:
+  file.managed:
+  - source: salt://panko/files/{{ server.version }}/panko.conf.{{ grains.os_family }}
+  - template: jinja
+{%- endif %}
diff --git a/panko/upgrade/service_running.sls b/panko/upgrade/service_running.sls
new file mode 100644
index 0000000..c9c8cc5
--- /dev/null
+++ b/panko/upgrade/service_running.sls
@@ -0,0 +1,12 @@
+{%- from "panko/map.jinja" import server,upgrade with context %}
+
+panko_task_service_running:
+  test.show_notification:
+    - text: "Running panko.upgrade.service_running"
+
+{%- if server.enabled %}
+panko_service_running_{{ server.service_name }}:
+  service.running:
+  - name: {{ server.service_name }}
+  - enable: True
+{%- endif %}
diff --git a/panko/upgrade/service_stopped.sls b/panko/upgrade/service_stopped.sls
new file mode 100644
index 0000000..ed1b9c6
--- /dev/null
+++ b/panko/upgrade/service_stopped.sls
@@ -0,0 +1,12 @@
+{%- from "panko/map.jinja" import server,upgrade with context %}
+
+panko_task_service_stopped:
+  test.show_notification:
+    - text: "Running panko.upgrade.service_stopped"
+
+{%- if server.enabled %}
+panko_service_stopped_{{ server.service_name }}:
+  service.dead:
+  - name: {{ server.service_name }}
+  - enable: False
+{%- endif %}
diff --git a/panko/upgrade/upgrade/init.sls b/panko/upgrade/upgrade/init.sls
new file mode 100644
index 0000000..a45935f
--- /dev/null
+++ b/panko/upgrade/upgrade/init.sls
@@ -0,0 +1,8 @@
+{%- from "panko/map.jinja" import server with context %}
+
+include:
+ - panko.upgrade.service_stopped
+ - panko.upgrade.pkgs_latest
+ - panko.upgrade.render_config
+ - panko.db.offline_sync
+ - panko.upgrade.service_running
diff --git a/panko/upgrade/upgrade/post.sls b/panko/upgrade/upgrade/post.sls
new file mode 100644
index 0000000..6ebaae0
--- /dev/null
+++ b/panko/upgrade/upgrade/post.sls
@@ -0,0 +1,3 @@
+panko_upgrade_uprade_post:
+  test.show_notification:
+    - text: "Running panko.upgrade.upgrade.post"
diff --git a/panko/upgrade/upgrade/pre.sls b/panko/upgrade/upgrade/pre.sls
new file mode 100644
index 0000000..4de2a38
--- /dev/null
+++ b/panko/upgrade/upgrade/pre.sls
@@ -0,0 +1,3 @@
+panko_upgrade_upgrade_pre:
+  test.show_notification:
+    - text: "Running panko.upgrade.upgrade.pre"
diff --git a/panko/upgrade/verify/_api.sls b/panko/upgrade/verify/_api.sls
new file mode 100644
index 0000000..3ed0036
--- /dev/null
+++ b/panko/upgrade/verify/_api.sls
@@ -0,0 +1,7 @@
+
+panko_upgrade_verify_api:
+  test.show_notification:
+    - text: "Running panko.upgrade.verify.api"
+
+# TODO: Implement api checks when panko salt
+# modules are implemented
diff --git a/panko/upgrade/verify/init.sls b/panko/upgrade/verify/init.sls
new file mode 100644
index 0000000..6337d18
--- /dev/null
+++ b/panko/upgrade/verify/init.sls
@@ -0,0 +1,2 @@
+include:
+ - panko.upgrade.verify._api