...

1. Set heat::api::enabled: false and heat::engine::enabled: false and heat::api_cfn::enabled: false in hiera to stop all services
2. Run puppet with stein modules/tags
3. Run apt dist-upgrade
4. Run heat-manage db_sync on one of the api-nodes.

5. Remove the hiera keys that disabled the services and re-run puppet

...

1. Run puppet with the stein modules/tags
2. Perform a dist-upgrade
3. Run puppet again
4. Restart openstack services and ovsdb-server

...

Finalizing:

After all nodes are upgraded (including nova-compute), run:

...