diff --git a/docker/ironic-upgrade/Dockerfile.j2 b/docker/ironic-upgrade/Dockerfile.j2
new file mode 100644
index 0000000..999f642
--- /dev/null
+++ b/docker/ironic-upgrade/Dockerfile.j2
@@ -0,0 +1,7 @@
+FROM {{ image_spec("ironic-base") }}
+MAINTAINER {{ maintainer }}
+
+RUN apt-get install -y --no-install-recommends \
+        mysql-client \
+    && apt-get clean
+
diff --git a/service/files/backup.sh.j2 b/service/files/backup.sh.j2
new file mode 100644
index 0000000..454bae3
--- /dev/null
+++ b/service/files/backup.sh.j2
@@ -0,0 +1,7 @@
+#!/bin/bash -ex
+set -o pipefail
+BACKUP_FILE="/var/ccp/backup/ironic/backup-$(date "+%Y%m%d%H%M%S").sql"
+mysqldump {% if db.tls.enabled %} --ssl-mode REQUIRED {% endif %} -h {{ address("database") }} \
+    -u {{ ironic.db.username }} -p{{ ironic.db.password }} \
+    --single-transaction {{ ironic.db.name }} > "${BACKUP_FILE}"
+
diff --git a/service/upgrade/default.yaml b/service/upgrade/default.yaml
new file mode 100644
index 0000000..3141427
--- /dev/null
+++ b/service/upgrade/default.yaml
@@ -0,0 +1,39 @@
+upgrade:
+  name: upgrade-ironic
+  image: ironic-upgrade
+  steps:
+    - name: backup
+      command: /opt/ccp/bin/backup.sh
+      files:
+        - backup-sh
+      volumes:
+        - name: backup-dir
+          path: /var/ccp/backup/ironic
+          type: host
+          readOnly: false
+      topology_key: backup
+    - name: kill-services
+      type: kill-services
+    - name: db-sync
+      type: single
+      command: ironic-dbsync
+      files:
+        - ironic.conf
+    - name: roll-api
+      type: rolling-upgrade
+      services:
+        - ironic-api
+    - name: roll-conductor
+      type: rolling-upgrade
+      services:
+        - ironic-conductor
+files:
+  ironic.conf:
+    path: /etc/ironic/ironic.conf
+    content: ironic.conf.j2
+    perm: "0600"
+
+  backup-sh:
+    path: /opt/ccp/bin/backup.sh
+    content: backup.sh.j2
+    perm: "500"