From b1ce9b093b9875a15d5da4978002048671a3711b Mon Sep 17 00:00:00 2001
From: Pete Birley <pete@port.direct>
Date: Fri, 20 Jan 2017 01:19:37 +0000
Subject: [PATCH] Add glance registry config

---
 glance/templates/configmap-etc.yaml           |  2 ++
 glance/templates/deployment-api.yaml          |  2 +-
 glance/templates/deployment-registry.yaml     |  8 +++++
 .../etc/_glance-registry-paste.ini.tpl        | 35 +++++++++++++++++++
 4 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 glance/templates/etc/_glance-registry-paste.ini.tpl

diff --git a/glance/templates/configmap-etc.yaml b/glance/templates/configmap-etc.yaml
index 9b622b1785..ba8b86c42e 100644
--- a/glance/templates/configmap-etc.yaml
+++ b/glance/templates/configmap-etc.yaml
@@ -13,5 +13,7 @@ data:
 {{ tuple "etc/_glance-api-paste.ini.tpl" . | include "template" | indent 4 }}
   glance-registry.conf: |+
 {{ tuple "etc/_glance-registry.conf.tpl" . | include "template" | indent 4 }}
+  glance-registry-paste.ini: |+
+{{ tuple "etc/_glance-registry-paste.ini.tpl" . | include "template" | indent 4 }}
   policy.json: |+
 {{ tuple "etc/_policy.json.tpl" . | include "template" | indent 4 }}
diff --git a/glance/templates/deployment-api.yaml b/glance/templates/deployment-api.yaml
index 34a510eaf8..46086de678 100644
--- a/glance/templates/deployment-api.yaml
+++ b/glance/templates/deployment-api.yaml
@@ -36,7 +36,7 @@ spec:
           command:
           - glance-api
           - --config-file
-          - /etc/glance/glance-registry.conf
+          - /etc/glance/glance-api.conf
           ports:
             - containerPort: {{ .Values.network.port.api }}
           readinessProbe:
diff --git a/glance/templates/deployment-registry.yaml b/glance/templates/deployment-registry.yaml
index 05615548df..51aa3269e9 100644
--- a/glance/templates/deployment-registry.yaml
+++ b/glance/templates/deployment-registry.yaml
@@ -41,6 +41,14 @@ spec:
               mountPath: /etc/glance/glance-registry.conf
               subPath: glance-registry.conf
               readOnly: true
+            - name: glanceregistrypaste
+              mountPath: /etc/glance/glance-registry-paste.ini
+              subPath: glance-registry-paste.ini
+              readOnly: true
+            - name: glancepolicy
+              mountPath: /etc/glance/policy.json
+              subPath: policy.json
+              readOnly: true
       volumes:
         - name: etcglance
           emptyDir: {}
diff --git a/glance/templates/etc/_glance-registry-paste.ini.tpl b/glance/templates/etc/_glance-registry-paste.ini.tpl
new file mode 100644
index 0000000000..492dbc6f53
--- /dev/null
+++ b/glance/templates/etc/_glance-registry-paste.ini.tpl
@@ -0,0 +1,35 @@
+# Use this pipeline for no auth - DEFAULT
+[pipeline:glance-registry]
+pipeline = healthcheck osprofiler unauthenticated-context registryapp
+
+# Use this pipeline for keystone auth
+[pipeline:glance-registry-keystone]
+pipeline = healthcheck osprofiler authtoken context registryapp
+
+# Use this pipeline for authZ only. This means that the registry will treat a
+# user as authenticated without making requests to keystone to reauthenticate
+# the user.
+[pipeline:glance-registry-trusted-auth]
+pipeline = healthcheck osprofiler context registryapp
+
+[app:registryapp]
+paste.app_factory = glance.registry.api:API.factory
+
+[filter:healthcheck]
+paste.filter_factory = oslo_middleware:Healthcheck.factory
+backends = disable_by_file
+disable_by_file_path = /etc/glance/healthcheck_disable
+
+[filter:context]
+paste.filter_factory = glance.api.middleware.context:ContextMiddleware.factory
+
+[filter:unauthenticated-context]
+paste.filter_factory = glance.api.middleware.context:UnauthenticatedContextMiddleware.factory
+
+[filter:authtoken]
+paste.filter_factory = keystonemiddleware.auth_token:filter_factory
+
+[filter:osprofiler]
+paste.filter_factory = osprofiler.web:WsgiMiddleware.factory
+hmac_keys = SECRET_KEY  #DEPRECATED
+enabled = yes  #DEPRECATED