diff --git a/common/major_upgrade_steps.j2.yaml b/common/major_upgrade_steps.j2.yaml
index 5eb93d3981..36b342f968 100644
--- a/common/major_upgrade_steps.j2.yaml
+++ b/common/major_upgrade_steps.j2.yaml
@@ -187,6 +187,43 @@ resources:
       role_data: {get_param: role_data}
       ctlplane_service_ips: {get_param: ctlplane_service_ips}
 
+{%- for step in range(0, upgrade_steps_max) %}
+  {%- for role in roles %}
+  {{role.name}}PostUpgradeConfig_Config{{step}}:
+    type: OS::TripleO::UpgradeConfig
+    depends_on:
+      {%- for role_inside in enabled_roles %}
+      {%- if step > 0 %}
+      - {{role_inside.name}}PostUpgradeConfig_Deployment{{step -1}}
+      {%- else %}
+      - AllNodesPostUpgradeSteps
+      {%- endif %}
+      {%- endfor %}
+    properties:
+      UpgradeStepConfig: {get_param: [role_data, {{role.name}}, post_upgrade_tasks]}
+      step: {{step}}
+  {%- endfor %}
+
+  {%- for role in enabled_roles %}
+  {{role.name}}PostUpgradeConfig_Deployment{{step}}:
+    type: OS::Heat::SoftwareDeploymentGroup
+    depends_on:
+      {%- for role_inside in enabled_roles %}
+      {%- if step > 0 %}
+      - {{role_inside.name}}PostUpgradeConfig_Deployment{{step -1}}
+      {%- else %}
+      - AllNodesPostUpgradeSteps
+      {%- endif %}
+      {%- endfor %}
+    properties:
+      servers: {get_param: [servers, {{role.name}}]}
+      config: {get_resource: {{role.name}}PostUpgradeConfig_Config{{step}}}
+      input_values:
+        role: {{role.name}}
+        update_identifier: {get_param: UpdateIdentifier}
+  {%- endfor %}
+{%- endfor %}
+
 outputs:
   # Output the config for each role, just use Step1 as the config should be
   # the same for all steps (only the tag provided differs)
diff --git a/common/services.yaml b/common/services.yaml
index 725f4e9888..a0015c7eff 100644
--- a/common/services.yaml
+++ b/common/services.yaml
@@ -193,6 +193,16 @@ resources:
           expression: coalesce($.data, []).where($ != null).select($.get('upgrade_tasks')).where($ != null).flatten().distinct()
           data: {get_attr: [ServiceChain, role_data]}
 
+  PostUpgradeTasks:
+    type: OS::Heat::Value
+    properties:
+      type: comma_delimited_list
+      value:
+        yaql:
+          # Note we use distinct() here to filter any identical tasks, e.g yum update for all services
+          expression: coalesce($.data, []).where($ != null).select($.get('post_upgrade_tasks')).where($ != null).flatten().distinct()
+          data: {get_attr: [ServiceChain, role_data]}
+
   UpdateTasks:
     type: OS::Heat::Value
     properties:
@@ -263,6 +273,7 @@ outputs:
       workflow_tasks: {get_attr: [WorkflowTasks, value]}
       step_config: {get_attr: [PuppetStepConfig, value]}
       upgrade_tasks: {get_attr: [UpgradeTasks, value]}
+      post_upgrade_tasks: {get_attr: [PostUpgradeTasks, value]}
       update_tasks: {get_attr: [UpdateTasks, value]}
       upgrade_batch_tasks: {get_attr: [UpgradeBatchTasks, value]}
       service_metadata_settings: {get_attr: [ServiceServerMetadataHook, metadata]}
diff --git a/puppet/services/pacemaker/cinder-volume.yaml b/puppet/services/pacemaker/cinder-volume.yaml
index 630f78cd68..cbbf2eaf24 100644
--- a/puppet/services/pacemaker/cinder-volume.yaml
+++ b/puppet/services/pacemaker/cinder-volume.yaml
@@ -66,16 +66,9 @@ outputs:
             resource: openstack-cinder-volume
             state: disable
             wait_for_resource: true
-        - name: get bootstrap nodeid
-          tags: step5
-          command: hiera bootstrap_nodeid
-          register: bootstrap_node
-        - block:
-          - name: Sync cinder DB
-            command: cinder-manage db sync
-          - name: Start cinder_volume service (pacemaker)
-            pacemaker_resource:
-              resource: openstack-cinder-volume
-              state: enable
-          tags: step5
-          when: bootstrap_node.stdout == ansible_hostname
+      post_upgrade_tasks:
+        - name: Start cinder_volume service (pacemaker)
+          tags: step1
+          pacemaker_resource:
+            resource: openstack-cinder-volume
+            state: enable
diff --git a/releasenotes/notes/adds-post_upgrade_tasks-eba0656012c861a1.yaml b/releasenotes/notes/adds-post_upgrade_tasks-eba0656012c861a1.yaml
new file mode 100644
index 0000000000..bdce1348f7
--- /dev/null
+++ b/releasenotes/notes/adds-post_upgrade_tasks-eba0656012c861a1.yaml
@@ -0,0 +1,12 @@
+---
+upgrade:
+  - |
+    This adds post_upgrade_tasks, ansible tasks that can be added to any
+    service manifest (currently, pacemaker/cinder-volume for bug 1706951).
+
+    These are similar to the existing upgrade_tasks in their format, however
+    they will be executed *after* the docker/puppet config. So the order is
+    upgrade_tasks, deployment steps (docker/puppet), then post_upgrade_tasks.
+
+    Also like the upgrade_tasks these are serialised and you can use 'tags'
+    with 'step0' to 'step6' (more can be added if needed).
diff --git a/tools/yaml-validate.py b/tools/yaml-validate.py
index a38fba2bb6..89a0c41611 100755
--- a/tools/yaml-validate.py
+++ b/tools/yaml-validate.py
@@ -44,9 +44,9 @@ OPTIONAL_SECTIONS = ['workflow_tasks']
 REQUIRED_DOCKER_SECTIONS = ['service_name', 'docker_config', 'puppet_config',
                             'config_settings', 'step_config']
 OPTIONAL_DOCKER_SECTIONS = ['docker_puppet_tasks', 'upgrade_tasks',
-                            'service_config_settings', 'host_prep_tasks',
-                            'metadata_settings', 'kolla_config',
-                            'global_config_settings']
+                            'post_upgrade_tasks', 'service_config_settings',
+                            'host_prep_tasks', 'metadata_settings',
+                            'kolla_config', 'global_config_settings']
 REQUIRED_DOCKER_PUPPET_CONFIG_SECTIONS = ['config_volume', 'step_config',
                                           'config_image']
 OPTIONAL_DOCKER_PUPPET_CONFIG_SECTIONS = [ 'puppet_tags', 'volumes' ]