Ability to enable/disable debug mode per OpenStack service

Add ServiceDebug parameters for each services that will allow operators
to enable/disable Debug for specific services.

We keep the Debug parameters for backward compatibility.

Operators want to enable Debug everywhere:
  Debug: true
Operators want to disable Debug everywhere:
  Debug: false
Operators want to disable Debug everywhere except Glance:
  GlanceDebug: true
Operators want to enable Debug everywhere except Glance:
  Debug: true
  GlanceDebug: false

New parameters: AodhDebug, BarbicanDebug, CeilometerDebug, CinderDebug,
CongressDebug, GlanceDebug, GnocchiDebug, HeatDebug, HorizonDebug,
IronicDebug, KeystoneDebug, ManilaDebug, MistralDebug, NeutronDebug,
NovaDebug, OctaviaDebug, PankoDebug, SaharaDebug, TackerDebug,
ZaqarDebug.

Note: for backward compatibility in Horizon, HorizonDebug is set to
false, so we maintain previous behavior.

Change-Id: Icbf4a38afcdbd8471d1afc11743df9705451db52
Implement-blueprint: composable-debug
Closes-Bug: #1634567

21 files changed, 235 insertions, 27 deletions

diff --git a/puppet/services/aodh-base.yaml b/puppet/services/aodh-base.yaml
index 331fe9a9..0563d08b 100644
--- a/puppet/services/aodh-base.yaml
+++ b/puppet/services/aodh-base.yaml
@@ -56,11 +56,18 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  AodhDebug:
+    default: ''
+    description: Set to True to enable debugging Aodh services.
+    type: string
   KeystoneRegion:
     type: string
     default: 'regionOne'
     description: Keystone region for endpoint
 
+conditions:
+  service_debug_unset: {equals : [{get_param: AodhDebug}, '']}
+
 outputs:
   role_data:
     description: Role data for the Aodh role.
@@ -78,7 +85,11 @@ outputs:
             query:
               read_default_file: /etc/my.cnf.d/tripleo.cnf
               read_default_group: tripleo
-        aodh::debug: {get_param: Debug}
+        aodh::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: AodhDebug }
         aodh::auth::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] }
         aodh::rabbit_userid: {get_param: RabbitUserName}
         aodh::rabbit_password: {get_param: RabbitPassword}
diff --git a/puppet/services/barbican-api.yaml b/puppet/services/barbican-api.yaml
index 53fba63e..51331242 100644
--- a/puppet/services/barbican-api.yaml
+++ b/puppet/services/barbican-api.yaml
@@ -38,6 +38,10 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  BarbicanDebug:
+    default: ''
+    description: Set to True to enable debugging Barbican service.
+    type: string
   KeystoneRegion:
     type: string
     default: 'regionOne'
@@ -81,6 +85,9 @@ resources:
       RoleName: {get_param: RoleName}
       RoleParameters: {get_param: RoleParameters}
 
+conditions:
+  service_debug_unset: {equals : [{get_param: BarbicanDebug}, '']}
+
 outputs:
   role_data:
     description: Role data for the Barbican API role.
@@ -97,7 +104,11 @@ outputs:
             barbican::api::host_href: {get_param: [EndpointMap, BarbicanPublic, uri]}
             barbican::api::db_auto_create: false
             barbican::api::enabled_certificate_plugins: ['simple_certificate']
-            barbican::api::logging::debug: {get_param: Debug}
+            barbican::api::logging::debug:
+              if:
+              - service_debug_unset
+              - {get_param: Debug }
+              - {get_param: BarbicanDebug }
             barbican::api::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
             barbican::api::rabbit_userid: {get_param: RabbitUserName}
             barbican::api::rabbit_password: {get_param: RabbitPassword}
diff --git a/puppet/services/ceilometer-base.yaml b/puppet/services/ceilometer-base.yaml
index b3e2c3a4..1d86369b 100644
--- a/puppet/services/ceilometer-base.yaml
+++ b/puppet/services/ceilometer-base.yaml
@@ -64,6 +64,10 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  CeilometerDebug:
+    default: ''
+    description: Set to True to enable debugging Ceilometer services.
+    type: string
   KeystoneRegion:
     type: string
     default: 'regionOne'
@@ -100,13 +104,20 @@ parameters:
     type: string
     hidden: true
 
+conditions:
+  service_debug_unset: {equals : [{get_param: CeilometerDebug}, '']}
+
 outputs:
   role_data:
     description: Role data for the Ceilometer role.
     value:
       service_name: ceilometer_base
       config_settings:
-        ceilometer::debug: {get_param: Debug}
+        ceilometer::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: CeilometerDebug }
         ceilometer::keystone::authtoken::project_name: 'service'
         ceilometer::keystone::authtoken::user_domain_name: 'Default'
         ceilometer::keystone::authtoken::project_domain_name: 'Default'
diff --git a/puppet/services/cinder-base.yaml b/puppet/services/cinder-base.yaml
index 2ba5aa52..f7dfe5e1 100644
--- a/puppet/services/cinder-base.yaml
+++ b/puppet/services/cinder-base.yaml
@@ -12,6 +12,10 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  CinderDebug:
+    default: ''
+    description: Set to True to enable debugging on Cinder services.
+    type: string
   ServiceNetMap:
     default: {}
     description: Mapping of service_name -> network name. Typically set
@@ -93,6 +97,9 @@ parameters:
         Cron to move deleted instances to another table - Log destination
     default: '/var/log/cinder/cinder-rowsflush.log'
 
+conditions:
+  service_debug_unset: {equals : [{get_param: CinderDebug}, '']}
+
 outputs:
   role_data:
     description: Role data for the Cinder base service.
@@ -109,7 +116,11 @@ outputs:
             query:
               read_default_file: /etc/my.cnf.d/tripleo.cnf
               read_default_group: tripleo
-        cinder::debug: {get_param: Debug}
+        cinder::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: CinderDebug }
         cinder::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
         cinder::rabbit_userid: {get_param: RabbitUserName}
         cinder::rabbit_password: {get_param: RabbitPassword}
diff --git a/puppet/services/congress.yaml b/puppet/services/congress.yaml
index 8fbcd99d..5bca94d7 100644
--- a/puppet/services/congress.yaml
+++ b/puppet/services/congress.yaml
@@ -33,6 +33,10 @@ parameters:
   Debug:
     type: string
     default: ''
+  CongressDebug:
+    default: ''
+    description: Set to True to enable debugging Glance service.
+    type: string
   KeystoneRegion:
     type: string
     default: 'regionOne'
@@ -62,6 +66,9 @@ parameters:
     default: {}
     type: json
 
+conditions:
+  service_debug_unset: {equals : [{get_param: CongressDebug}, '']}
+
 outputs:
   role_data:
     description: Role data for the Congress role.
@@ -79,7 +86,11 @@ outputs:
             query:
               read_default_file: /etc/my.cnf.d/tripleo.cnf
               read_default_group: tripleo
-        congress::debug: {get_param: Debug}
+        congress::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: CongressDebug }
         congress::rpc_backend: rabbit
         congress::rabbit_userid: {get_param: RabbitUserName}
         congress::rabbit_password: {get_param: RabbitPassword}
diff --git a/puppet/services/glance-api.yaml b/puppet/services/glance-api.yaml
index 28151744..7812c8e2 100644
--- a/puppet/services/glance-api.yaml
+++ b/puppet/services/glance-api.yaml
@@ -30,6 +30,10 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  GlanceDebug:
+    default: ''
+    description: Set to True to enable debugging Glance service.
+    type: string
   GlancePassword:
     description: The password for the glance service and db account, used by the glance services.
     type: string
@@ -59,10 +63,6 @@ parameters:
   CephClientUserName:
     default: openstack
     type: string
-  Debug:
-    default: ''
-    description: Set to True to enable debugging on all services.
-    type: string
   GlanceNotifierStrategy:
     description: Strategy to use for Glance notification queue
     type: string
@@ -128,6 +128,7 @@ parameters:
 conditions:
   use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]}
   glance_workers_unset: {equals : [{get_param: GlanceWorkers}, '']}
+  service_debug_unset: {equals : [{get_param: GlanceDebug}, '']}
 
 resources:
 
@@ -170,7 +171,11 @@ outputs:
             glance::api::enable_v2_api: true
             glance::api::authtoken::password: {get_param: GlancePassword}
             glance::api::enable_proxy_headers_parsing: true
-            glance::api::debug: {get_param: Debug}
+            glance::api::debug:
+              if:
+              - service_debug_unset
+              - {get_param: Debug }
+              - {get_param: GlanceDebug }
             glance::policy::policies: {get_param: GlanceApiPolicies}
             tripleo.glance_api.firewall_rules:
               '112 glance_api':
diff --git a/puppet/services/gnocchi-base.yaml b/puppet/services/gnocchi-base.yaml
index 80ef7171..f4067ef6 100644
--- a/puppet/services/gnocchi-base.yaml
+++ b/puppet/services/gnocchi-base.yaml
@@ -52,6 +52,13 @@ parameters:
     type: string
     default: ''
     description: Set to True to enable debugging on all services.
+  GnocchiDebug:
+    default: ''
+    description: Set to True to enable debugging Gnocchi services.
+    type: string
+
+conditions:
+  service_debug_unset: {equals : [{get_param: GnocchiDebug}, '']}
 
 outputs:
   aux_parameters:
@@ -65,7 +72,11 @@ outputs:
       config_settings:
         #Gnocchi engine
         gnocchi_redis_password: {get_param: RedisPassword}
-        gnocchi::debug: {get_param: Debug}
+        gnocchi::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: GnocchiDebug }
         gnocchi::db::database_connection:
           make_url:
             scheme: {get_param: [EndpointMap, MysqlInternal, protocol]}
diff --git a/puppet/services/heat-base.yaml b/puppet/services/heat-base.yaml
index dfd823db..d89fe46a 100644
--- a/puppet/services/heat-base.yaml
+++ b/puppet/services/heat-base.yaml
@@ -8,6 +8,10 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  HeatDebug:
+    default: ''
+    description: Set to True to enable debugging Heat services.
+    type: string
   RabbitPassword:
     description: The password for RabbitMQ
     type: string
@@ -112,6 +116,9 @@ parameters:
     description: Maximum raw byte size of the Heat API JSON request body.
     type: number
 
+conditions:
+  service_debug_unset: {equals : [{get_param: HeatDebug}, '']}
+
 outputs:
   role_data:
     description: Shared role data for the Heat services.
@@ -122,7 +129,11 @@ outputs:
         heat::rabbit_password: {get_param: RabbitPassword}
         heat::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
         heat::rabbit_port: {get_param: RabbitClientPort}
-        heat::debug: {get_param: Debug}
+        heat::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: HeatDebug }
         heat::enable_proxy_headers_parsing: true
         heat::rpc_response_timeout: 600
         # We need this because the default heat policy.json no longer works on TripleO
diff --git a/puppet/services/horizon.yaml b/puppet/services/horizon.yaml
index 562afe16..93bced8b 100644
--- a/puppet/services/horizon.yaml
+++ b/puppet/services/horizon.yaml
@@ -14,6 +14,10 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  HorizonDebug:
+    default: false
+    description: Set to True to enable debugging Horizon service.
+    type: string
   DefaultPasswords:
     default: {}
     type: json
@@ -62,7 +66,7 @@ parameters:
 
 conditions:
 
-  debug_empty: {equals : [{get_param: Debug}, '']}
+  debug_unset: {equals : [{get_param: Debug}, '']}
 
 outputs:
   role_data:
@@ -104,9 +108,9 @@ outputs:
           memcached_ipv6: {get_param: MemcachedIPv6}
         -
           if:
-          - debug_empty
-          - {}
-          - horizon::django_debug: {get_param: Debug}
+          - debug_unset
+          - horizon::django_debug: { get_param: HorizonDebug }
+          - horizon::django_debug: { get_param: Debug }
       step_config: |
         include ::tripleo::profile::base::horizon
       # Ansible tasks to handle upgrade
diff --git a/puppet/services/ironic-base.yaml b/puppet/services/ironic-base.yaml
index da485161..41d6cedc 100644
--- a/puppet/services/ironic-base.yaml
+++ b/puppet/services/ironic-base.yaml
@@ -30,6 +30,10 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  IronicDebug:
+    default: ''
+    description: Set to True to enable debugging Ironic services.
+    type: string
   IronicPassword:
     description: The password for the Ironic service and db account, used by the Ironic services
     type: string
@@ -53,6 +57,9 @@ parameters:
         an SSL connection to the RabbitMQ host.
     type: string
 
+conditions:
+  service_debug_unset: {equals : [{get_param: IronicDebug}, '']}
+
 outputs:
   role_data:
     description: Role data for the Ironic role.
@@ -69,7 +76,11 @@ outputs:
             query:
               read_default_file: /etc/my.cnf.d/tripleo.cnf
               read_default_group: tripleo
-        ironic::debug: {get_param: Debug}
+        ironic::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: IronicDebug }
         ironic::rabbit_userid: {get_param: RabbitUserName}
         ironic::rabbit_password: {get_param: RabbitPassword}
         ironic::rabbit_port: {get_param: RabbitClientPort}
diff --git a/puppet/services/keystone.yaml b/puppet/services/keystone.yaml
index 7262e478..f3a9cbc4 100644
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@@ -63,6 +63,10 @@ parameters:
   Debug:
     type: string
     default: ''
+  KeystoneDebug:
+    default: ''
+    description: Set to True to enable debugging Keystone service.
+    type: string
   AdminEmail:
     default: 'admin@example.com'
     description: The email for the keystone admin account.
@@ -198,6 +202,7 @@ resources:
 conditions:
   keystone_fernet_tokens: {equals: [{get_param: KeystoneTokenProvider}, "fernet"]}
   keystone_ldap_domain_enabled: {equals: [{get_param: KeystoneLDAPDomainEnable}, True]}
+  service_debug_unset: {equals : [{get_param: KeystoneDebug}, '']}
 
 outputs:
   role_data:
@@ -242,7 +247,11 @@ outputs:
               '/etc/keystone/fernet-keys/1':
                 content: {get_param: KeystoneFernetKey1}
             keystone::fernet_replace_keys: false
-            keystone::debug: {get_param: Debug}
+            keystone::debug:
+              if:
+              - service_debug_unset
+              - {get_param: Debug }
+              - {get_param: KeystoneDebug }
             keystone::rabbit_userid: {get_param: RabbitUserName}
             keystone::rabbit_password: {get_param: RabbitPassword}
             keystone::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
diff --git a/puppet/services/manila-base.yaml b/puppet/services/manila-base.yaml
index a299fffa..d0ee2125 100644
--- a/puppet/services/manila-base.yaml
+++ b/puppet/services/manila-base.yaml
@@ -30,6 +30,10 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  ManilaDebug:
+    default: ''
+    description: Set to True to enable debugging Manila services.
+    type: string
   RabbitPassword:
     description: The password for RabbitMQ
     type: string
@@ -53,6 +57,9 @@ parameters:
     type: string
     hidden: true
 
+conditions:
+  service_debug_unset: {equals : [{get_param: ManilaDebug}, '']}
+
 outputs:
   role_data:
     description: Role data for the Manila Base service.
@@ -63,7 +70,11 @@ outputs:
         manila::rabbit_password: {get_param: RabbitPassword}
         manila::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
         manila::rabbit_port: {get_param: RabbitClientPort}
-        manila::debug: {get_param: Debug}
+        manila::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: ManilaDebug }
         manila::db::database_db_max_retries: -1
         manila::db::database_max_retries: -1
         manila::sql_connection:
diff --git a/puppet/services/mistral-base.yaml b/puppet/services/mistral-base.yaml
index 2e708650..8b3655dd 100644
--- a/puppet/services/mistral-base.yaml
+++ b/puppet/services/mistral-base.yaml
@@ -31,6 +31,10 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  MistralDebug:
+    default: ''
+    description: Set to True to enable debugging Mistral services.
+    type: string
   RabbitPassword:
     description: The password for RabbitMQ
     type: string
@@ -58,6 +62,9 @@ parameters:
     default: 'regionOne'
     description: Keystone region for endpoint
 
+conditions:
+  service_debug_unset: {equals : [{get_param: MistralDebug}, '']}
+
 outputs:
   role_data:
     description: Shared role data for the Mistral services.
@@ -78,7 +85,11 @@ outputs:
         mistral::rabbit_password: {get_param: RabbitPassword}
         mistral::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
         mistral::rabbit_port: {get_param: RabbitClientPort}
-        mistral::debug: {get_param: Debug}
+        mistral::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: MistralDebug }
         mistral::keystone_password: {get_param: MistralPassword}
         mistral::keystone_tenant: 'service'
         mistral::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri]}
diff --git a/puppet/services/neutron-base.yaml b/puppet/services/neutron-base.yaml
index 57581b58..3c7518b3 100644
--- a/puppet/services/neutron-base.yaml
+++ b/puppet/services/neutron-base.yaml
@@ -50,6 +50,10 @@ parameters:
     type: string
     default: ''
     description: Set to True to enable debugging on all services.
+  NeutronDebug:
+    default: ''
+    description: Set to True to enable debugging Neutron services.
+    type: string
   EnableConfigPurge:
     type: boolean
     default: false
@@ -90,6 +94,7 @@ parameters:
 
 conditions:
   dhcp_agents_zero: {equals : [{get_param: NeutronDhcpAgentsPerNetwork}, 0]}
+  service_debug_unset: {equals : [{get_param: NeutronDebug}, '']}
 
 outputs:
   role_data:
@@ -104,7 +109,11 @@ outputs:
             neutron::rabbit_port: {get_param: RabbitClientPort}
             neutron::core_plugin: {get_param: NeutronCorePlugin}
             neutron::service_plugins: {get_param: NeutronServicePlugins}
-            neutron::debug: {get_param: Debug}
+            neutron::debug:
+              if:
+              - service_debug_unset
+              - {get_param: Debug }
+              - {get_param: NeutronDebug }
             neutron::purge_config: {get_param: EnableConfigPurge}
             neutron::allow_overlapping_ips: true
             neutron::dns_domain: {get_param: NeutronDnsDomain}
diff --git a/puppet/services/nova-base.yaml b/puppet/services/nova-base.yaml
index ea21af8a..ea584932 100644
--- a/puppet/services/nova-base.yaml
+++ b/puppet/services/nova-base.yaml
@@ -68,6 +68,10 @@ parameters:
     type: string
     default: ''
     description: Set to True to enable debugging on all services.
+  NovaDebug:
+    default: ''
+    description: Set to True to enable debugging Nova services.
+    type: string
   EnableConfigPurge:
     type: boolean
     default: false
@@ -136,6 +140,7 @@ parameters:
 conditions:
 
   compute_upgrade_level_empty: {equals : [{get_param: UpgradeLevelNovaCompute}, '']}
+  service_debug_unset: {equals : [{get_param: NovaDebug}, '']}
 
 outputs:
   role_data:
@@ -193,7 +198,11 @@ outputs:
               query:
                 read_default_file: /etc/my.cnf.d/tripleo.cnf
                 read_default_group: tripleo
-          nova::debug: {get_param: Debug}
+          nova::debug:
+            if:
+            - service_debug_unset
+            - {get_param: Debug }
+            - {get_param: NovaDebug }
           nova::purge_config: {get_param: EnableConfigPurge}
           nova::network::neutron::neutron_project_name: 'service'
           nova::network::neutron::neutron_username: 'neutron'
diff --git a/puppet/services/octavia-base.yaml b/puppet/services/octavia-base.yaml
index 19dc5b47..0809b3e4 100644
--- a/puppet/services/octavia-base.yaml
+++ b/puppet/services/octavia-base.yaml
@@ -30,6 +30,10 @@ parameters:
     type: string
     default: ''
     description: Set to True to enable debugging on all services.
+  OctaviaDebug:
+    default: ''
+    description: Set to True to enable debugging Octavia services.
+    type: string
   EnableConfigPurge:
     type: boolean
     default: false
@@ -55,13 +59,20 @@ parameters:
     description: Set rabbit subscriber port, change this if using SSL
     type: number
 
+conditions:
+  service_debug_unset: {equals : [{get_param: OctaviaDebug}, '']}
+
 outputs:
   role_data:
     description: Base role data for Octavia services
     value:
        service_name: octavia_base
        config_settings:
-         octavia::debug: {get_param: Debug}
+         octavia::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: OctaviaDebug }
          octavia::purge_config: {get_param: EnableConfigPurge}
          octavia::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
          octavia::rabbit_userid: {get_param: RabbitUserName}
diff --git a/puppet/services/panko-base.yaml b/puppet/services/panko-base.yaml
index 84817bcf..a94d4ea5 100644
--- a/puppet/services/panko-base.yaml
+++ b/puppet/services/panko-base.yaml
@@ -34,11 +34,18 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  PankoDebug:
+    default: ''
+    description: Set to True to enable debugging Panko services.
+    type: string
   KeystoneRegion:
     type: string
     default: 'regionOne'
     description: Keystone region for endpoint
 
+conditions:
+  service_debug_unset: {equals : [{get_param: PankoDebug}, '']}
+
 outputs:
   role_data:
     description: Role data for the Panko role.
@@ -55,7 +62,11 @@ outputs:
             query:
               read_default_file: /etc/my.cnf.d/tripleo.cnf
               read_default_group: tripleo
-        panko::debug: {get_param: Debug}
+        panko::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: PankoDebug }
         panko::auth::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] }
         panko::keystone::authtoken::project_name: 'service'
         panko::keystone::authtoken::user_domain_name: 'Default'
diff --git a/puppet/services/sahara-base.yaml b/puppet/services/sahara-base.yaml
index 1ee6d175..c294e744 100644
--- a/puppet/services/sahara-base.yaml
+++ b/puppet/services/sahara-base.yaml
@@ -52,11 +52,18 @@ parameters:
     type: string
     default: ''
     description: Set to True to enable debugging on all services.
+  SaharaDebug:
+    default: ''
+    description: Set to True to enable debugging Sahara services.
+    type: string
   SaharaPlugins:
     default: ["ambari","cdh","mapr","vanilla","spark","storm"]
     description: Sahara enabled plugin list
     type: comma_delimited_list
 
+conditions:
+  service_debug_unset: {equals : [{get_param: SaharaDebug}, '']}
+
 outputs:
   role_data:
     description: Role data for the Sahara base service.
@@ -77,7 +84,11 @@ outputs:
         sahara::rabbit_user: {get_param: RabbitUserName}
         sahara::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
         sahara::rabbit_port: {get_param: RabbitClientPort}
-        sahara::debug: {get_param: Debug}
+        sahara::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: SaharaDebug }
         # Remove admin_password when https://review.openstack.org/442619 is merged.
         sahara::admin_password: {get_param: SaharaPassword}
         sahara::use_neutron: true
diff --git a/puppet/services/tacker.yaml b/puppet/services/tacker.yaml
index e121feb3..5ced8c3c 100644
--- a/puppet/services/tacker.yaml
+++ b/puppet/services/tacker.yaml
@@ -33,6 +33,10 @@ parameters:
   Debug:
     type: string
     default: ''
+  TackerDebug:
+    default: ''
+    description: Set to True to enable debugging Tacker service.
+    type: string
   KeystoneRegion:
     type: string
     default: 'regionOne'
@@ -62,6 +66,9 @@ parameters:
     default: {}
     type: json
 
+conditions:
+  service_debug_unset: {equals : [{get_param: TackerDebug}, '']}
+
 outputs:
   role_data:
     description: Role data for the Tacker role.
@@ -80,7 +87,11 @@ outputs:
               read_default_file: /etc/my.cnf.d/tripleo.cnf
               read_default_group: tripleo
 
-        tacker::debug: {get_param: Debug}
+        tacker::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: TackerDebug }
         tacker::rpc_backend: rabbit
         tacker::rabbit_userid: {get_param: RabbitUserName}
         tacker::rabbit_password: {get_param: RabbitPassword}
diff --git a/puppet/services/zaqar.yaml b/puppet/services/zaqar.yaml
index 6bc296a3..416d86df 100644
--- a/puppet/services/zaqar.yaml
+++ b/puppet/services/zaqar.yaml
@@ -30,6 +30,10 @@ parameters:
     default: ''
     description: Set to True to enable debugging on all services.
     type: string
+  ZaqarDebug:
+    default: ''
+    description: Set to True to enable debugging Zaqar service.
+    type: string
   ZaqarPassword:
     description: The password for Zaqar
     type: string
@@ -54,6 +58,7 @@ parameters:
 
 conditions:
   zaqar_workers_zero: {equals : [{get_param: ZaqarWorkers}, 0]}
+  service_debug_unset: {equals : [{get_param: ZaqarDebug}, '']}
 
 resources:
 
@@ -78,7 +83,11 @@ outputs:
             zaqar::keystone::authtoken::project_name: 'service'
             zaqar::keystone::authtoken::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
             zaqar::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri]}
-            zaqar::debug: {get_param: Debug}
+            zaqar::debug:
+              if:
+              - service_debug_unset
+              - {get_param: Debug }
+              - {get_param: ZaqarDebug }
             zaqar::server::service_name: 'httpd'
             zaqar::transport::websocket::bind: {get_param: [EndpointMap, ZaqarInternal, host]}
             zaqar::wsgi::apache::ssl: false
diff --git a/releasenotes/notes/debug_per_service-54a260917c4a7e3a.yaml b/releasenotes/notes/debug_per_service-54a260917c4a7e3a.yaml
new file mode 100644
index 00000000..da9af4a3
--- /dev/null
+++ b/releasenotes/notes/debug_per_service-54a260917c4a7e3a.yaml
@@ -0,0 +1,9 @@
+---
+features:
+  - |
+    Allow to configure debug per service.
+    The feature is backward compatible with existing Debug parameter.
+    Adding a new parameter per service, e.g. GlanceDebug. Set to False,
+    it will disable debug for the service, even if Debug is set to True.
+    If Debug is set to False but GlanceDebug is set to True, Glance debug
+    will be enabled.