composable glance services

Adds new puppet and puppet pacemaker specific services for
Glance API and Glance Registry.

The Pacemaker templates extend the default glance services and
swap in the pacemaker specific puppet-tripleo profile instead.
In the case of pacemaker glance-registry there is no separate
puppet manifest so only the configuration parameters are maintained
there. (Due to the way the pacemaker glance constraints are written
the pacemaker varients of this service can't be split out...)

Depends-On: Ifc388f7058ccfff2818f531bcbc00c7179874bbc
Change-Id: I00a8c916129af43cda225754eb10370289bb4b41

10 files changed, 240 insertions, 220 deletions

diff --git a/environments/puppet-pacemaker.yaml b/environments/puppet-pacemaker.yaml
index e3188090..2e6e5ec9 100644
--- a/environments/puppet-pacemaker.yaml
+++ b/environments/puppet-pacemaker.yaml
@@ -10,3 +10,5 @@ resource_registry:
   # which use pacemaker. In the future (with upcoming HA light work) this
   # list will hopefully be much smaller however.
   OS::TripleO::Services::Keystone: ../puppet/services/pacemaker/keystone.yaml
+  OS::TripleO::Services::GlanceApi: ../puppet/services/pacemaker/glance-api.yaml
+  OS::TripleO::Services::GlanceRegistry: ../puppet/services/pacemaker/glance-registry.yaml
diff --git a/overcloud-resource-registry-puppet.yaml b/overcloud-resource-registry-puppet.yaml
index 55cefc76..4f79e516 100644
--- a/overcloud-resource-registry-puppet.yaml
+++ b/overcloud-resource-registry-puppet.yaml
@@ -124,6 +124,8 @@ resource_registry:
   # services
   OS::TripleO::Services: puppet/services/services.yaml
   OS::TripleO::Services::Keystone: puppet/services/keystone.yaml
+  OS::TripleO::Services::GlanceApi: puppet/services/glance-api.yaml
+  OS::TripleO::Services::GlanceRegistry: puppet/services/glance-registry.yaml
 
 parameter_defaults:
   EnablePackageInstall: false
diff --git a/overcloud.yaml b/overcloud.yaml
index 20c853cd..e1520477 100644
--- a/overcloud.yaml
+++ b/overcloud.yaml
@@ -470,25 +470,6 @@ parameters:
           ]
         }
     type: json
-  GlanceLogFile:
-    description: The filepath of the file to use for logging messages from Glance.
-    type: string
-    default: ''
-  GlanceNotifierStrategy:
-    description: Strategy to use for Glance notification queue
-    type: string
-    default: noop
-  GlancePassword:
-    description: The password for the glance service account, used by the glance services.
-    type: string
-    hidden: true
-  GlanceBackend:
-    default: swift
-    description: The short name of the Glance backend to use. Should be one
-      of swift, rbd or file
-    type: string
-    constraints:
-    - allowed_values: ['swift', 'file', 'rbd']
   GnocchiBackend:
     default: file
     description: The short name of the Gnocchi backend to use. Should be one
@@ -700,6 +681,8 @@ parameters:
   ControllerServices:
     default:
       - OS::TripleO::Services::Keystone
+      - OS::TripleO::Services::GlanceApi
+      - OS::TripleO::Services::GlanceRegistry
     description: A list of service resources (configured in the Heat
                  resource_registry) which represent nested stacks
                  for each service that should get installed on the Controllers.
@@ -932,10 +915,6 @@ resources:
           ExtraConfig: {get_param: ExtraConfig}
           FencingConfig: {get_param: FencingConfig}
           Flavor: {get_param: OvercloudControlFlavor}
-          GlancePassword: {get_param: GlancePassword}
-          GlanceBackend: {get_param: GlanceBackend}
-          GlanceNotifierStrategy: {get_param: GlanceNotifierStrategy}
-          GlanceLogFile: {get_param: GlanceLogFile}
           GnocchiPassword: {get_param: GnocchiPassword}
           GnocchiBackend: {get_param: GnocchiBackend}
           GnocchiIndexerBackend: {get_param: GnocchiIndexerBackend}
@@ -1023,8 +1002,6 @@ resources:
           CinderApiVirtualIP: {get_attr: [VipMap, net_ip_map, {get_param: [ServiceNetMap, CinderApiNetwork]}]}
           HeatApiVirtualIP: {get_attr: [VipMap, net_ip_map, {get_param: [ServiceNetMap, HeatApiNetwork]}]}
           HeatApiVirtualIPUri: {get_attr: [VipMap, net_ip_uri_map, {get_param: [ServiceNetMap, HeatApiNetwork]}]}
-          GlanceApiVirtualIP: {get_attr: [VipMap, net_ip_map, {get_param: [ServiceNetMap, GlanceApiNetwork]}]}
-          GlanceRegistryVirtualIP: {get_attr: [VipMap, net_ip_map, {get_param: [ServiceNetMap, GlanceRegistryNetwork]}]}
           NovaApiVirtualIP: {get_attr: [VipMap, net_ip_map, {get_param: [ServiceNetMap, NovaApiNetwork]}]}
           SwiftProxyVirtualIP: {get_attr: [VipMap, net_ip_map, {get_param: [ServiceNetMap, SwiftProxyNetwork]}]}
           MysqlVirtualIP: {get_attr: [VipMap, net_ip_map, {get_param: [ServiceNetMap, MysqlNetwork]}]}
diff --git a/puppet/controller.yaml b/puppet/controller.yaml
index 8ad0ef28..dcfe094d 100644
--- a/puppet/controller.yaml
+++ b/puppet/controller.yaml
@@ -186,49 +186,6 @@ parameters:
     type: string
     constraints:
       - custom_constraint: nova.flavor
-  GlanceNotifierStrategy:
-    description: Strategy to use for Glance notification queue
-    type: string
-    default: noop
-  GlanceLogFile:
-    description: The filepath of the file to use for logging messages from Glance.
-    type: string
-    default: ''
-  GlancePassword:
-    description: The password for the glance service and db account, used by the glance services.
-    type: string
-    hidden: true
-  GlanceBackend:
-    default: swift
-    description: The short name of the Glance backend to use. Should be one
-      of swift, rbd, or file
-    type: string
-    constraints:
-    - allowed_values: ['swift', 'file', 'rbd']
-  GlanceFilePcmkDevice:
-    default: ''
-    description: >
-      An exported storage device that should be mounted by Pacemaker
-      as Glance storage. Effective when GlanceFilePcmkManage is true.
-    type: string
-  GlanceFilePcmkFstype:
-    default: 'nfs'
-    description: >
-      Filesystem type for Pacemaker mount used as Glance storage.
-      Effective when GlanceFilePcmkManage is true.
-    type: string
-  GlanceFilePcmkManage:
-    default: false
-    description: >
-      Whether to make Glance file backend a mount managed by Pacemaker.
-      Effective when GlanceBackend is 'file'.
-    type: boolean
-  GlanceFilePcmkOptions:
-    default: ''
-    description: >
-      Mount options for Pacemaker mount used as Glance storage.
-      Effective when GlanceFilePcmkManage is true.
-    type: string
   GnocchiBackend:
     default: file
     description: The short name of the Gnocchi backend to use. Should be one
@@ -258,10 +215,6 @@ parameters:
     default: /dev/log
     description: Syslog address where HAproxy will send its log
     type: string
-  GlanceWorkers:
-    default: 0
-    description: Number of workers for Glance service.
-    type: number
   HeatPassword:
     description: The password for the Heat service and db account, used by the Heat services.
     type: string
@@ -685,12 +638,6 @@ parameters:
   HeatApiVirtualIPUri:
     type: string
     default: ''
-  GlanceApiVirtualIP:
-    type: string
-    default: ''
-  GlanceRegistryVirtualIP:
-    type: string
-    default: ''
   MysqlVirtualIP:
     type: string
     default: ''
@@ -922,7 +869,6 @@ resources:
         bootstack_nodeid: {get_attr: [Controller, name]}
         ceilometer_workers: {get_param: CeilometerWorkers}
         cinder_workers: {get_param: CinderWorkers}
-        glance_workers: {get_param: GlanceWorkers}
         heat_workers: {get_param: HeatWorkers}
         nova_workers: {get_param: NovaWorkers}
         neutron_workers: {get_param: NeutronWorkers}
@@ -980,23 +926,6 @@ resources:
               - '@'
               - {get_param: MysqlVirtualIPUri}
               - '/cinder'
-        glance_port: {get_param: [EndpointMap, GlanceInternal, port]}
-        glance_password: {get_param: GlancePassword}
-        glance_backend: {get_param: GlanceBackend}
-        glance_file_pcmk_device: {get_param: GlanceFilePcmkDevice}
-        glance_file_pcmk_fstype: {get_param: GlanceFilePcmkFstype}
-        glance_file_pcmk_manage: {get_param: GlanceFilePcmkManage}
-        glance_file_pcmk_options: {get_param: GlanceFilePcmkOptions}
-        glance_notifier_strategy: {get_param: GlanceNotifierStrategy}
-        glance_log_file: {get_param: GlanceLogFile}
-        glance_dsn:
-          list_join:
-            - ''
-            - - 'mysql+pymysql://glance:'
-              - {get_param: GlancePassword}
-              - '@'
-              - {get_param: MysqlVirtualIPUri}
-              - '/glance'
         heat_password: {get_param: HeatPassword}
         heat_stack_domain_admin_password: {get_param: HeatStackDomainAdminPassword}
         heat_dsn:
@@ -1220,7 +1149,6 @@ resources:
         glance_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, GlanceApiNetwork]}]}
         glance_registry_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, GlanceRegistryNetwork]}]}
         glance_api_servers: { get_param: [EndpointMap, GlanceInternal, uri]}
-        glance_registry_host: {get_param: GlanceRegistryVirtualIP}
         heat_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, HeatApiNetwork]}]}
         keystone_public_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, KeystonePublicApiNetwork]}]}
         keystone_admin_api_network: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, KeystoneAdminApiNetwork]}]}
@@ -1350,38 +1278,8 @@ resources:
                 cinder::db::mysql::password: {get_input: cinder_password}
 
                 # Glance
-                glance::api::bind_port: {get_input: glance_port}
                 glance::api::bind_host: {get_input: glance_api_network}
-                glance::api::auth_uri: {get_input: keystone_auth_uri}
-                glance::api::identity_uri: {get_input: keystone_identity_uri}
-                glance::api::registry_host: {get_input: glance_registry_host}
-                glance::api::keystone_password: {get_input: glance_password}
-                glance::api::debug: {get_input: debug}
-                glance::api::workers: {get_input: glance_workers}
-                glance_notifier_strategy: {get_input: glance_notifier_strategy}
-                glance_log_file: {get_input: glance_log_file}
-                glance_log_file: {get_input: glance_log_file}
-                glance::api::database_connection: {get_input: glance_dsn}
-                glance::registry::keystone_password: {get_input: glance_password}
-                glance::registry::database_connection: {get_input: glance_dsn}
                 glance::registry::bind_host: {get_input: glance_registry_network}
-                glance::registry::auth_uri: {get_input: keystone_auth_uri}
-                glance::registry::identity_uri: {get_input: keystone_identity_uri}
-                glance::registry::debug: {get_input: debug}
-                glance::backend::swift::swift_store_auth_address: {get_input: keystone_auth_uri}
-                glance::registry::workers: {get_input: glance_workers}
-                glance::backend::swift::swift_store_user: service:glance
-                glance::backend::swift::swift_store_key: {get_input: glance_password}
-                glance_backend: {get_input: glance_backend}
-                glance::db::mysql::password: {get_input: glance_password}
-                glance_file_pcmk_device: {get_input: glance_file_pcmk_device}
-                glance_file_pcmk_fstype: {get_input: glance_file_pcmk_fstype}
-                glance_file_pcmk_manage: {get_input: glance_file_pcmk_manage}
-                glance_file_pcmk_options: {get_input: glance_file_pcmk_options}
-                glance::notify::rabbitmq::rabbit_userid: {get_input: rabbit_username}
-                glance::notify::rabbitmq::rabbit_password: {get_input: rabbit_password}
-                glance::notify::rabbitmq::rabbit_use_ssl: {get_input: rabbit_client_use_ssl}
-
                 # Heat
                 heat_stack_domain_admin_password: {get_input: heat_stack_domain_admin_password}
                 heat::engine::heat_watch_server_url: {get_input: heat.watch_server_url}
diff --git a/puppet/manifests/overcloud_controller.pp b/puppet/manifests/overcloud_controller.pp
index d7bb025a..94a9f239 100644
--- a/puppet/manifests/overcloud_controller.pp
+++ b/puppet/manifests/overcloud_controller.pp
@@ -215,26 +215,6 @@ if hiera('step') >= 2 {
 
 if hiera('step') >= 4 {
 
-  $glance_backend = downcase(hiera('glance_backend', 'swift'))
-  case $glance_backend {
-      'swift': { $backend_store = 'glance.store.swift.Store' }
-      'file': { $backend_store = 'glance.store.filesystem.Store' }
-      'rbd': { $backend_store = 'glance.store.rbd.Store' }
-      default: { fail('Unrecognized glance_backend parameter.') }
-  }
-  $http_store = ['glance.store.http.Store']
-  $glance_store = concat($http_store, $backend_store)
-
-  # TODO: scrubber and other additional optional features
-  include ::glance
-  include ::glance::config
-  class { '::glance::api':
-    known_stores => $glance_store,
-  }
-  include ::glance::registry
-  include ::glance::notify::rabbitmq
-  include join(['::glance::backend::', $glance_backend])
-
   $nova_ipv6 = hiera('nova::use_ipv6', false)
   if $nova_ipv6 {
     $memcached_servers = suffix(hiera('memcache_node_ips_v6'), ':11211')
diff --git a/puppet/manifests/overcloud_controller_pacemaker.pp b/puppet/manifests/overcloud_controller_pacemaker.pp
index 3a6dbc06..310d03cf 100644
--- a/puppet/manifests/overcloud_controller_pacemaker.pp
+++ b/puppet/manifests/overcloud_controller_pacemaker.pp
@@ -475,32 +475,6 @@ MYSQL_HOST=localhost\n",
 
 if hiera('step') >= 4 {
 
-  $glance_backend = downcase(hiera('glance_backend', 'swift'))
-  case $glance_backend {
-      'swift': { $backend_store = 'glance.store.swift.Store' }
-      'file': { $backend_store = 'glance.store.filesystem.Store' }
-      'rbd': { $backend_store = 'glance.store.rbd.Store' }
-      default: { fail('Unrecognized glance_backend parameter.') }
-  }
-  $http_store = ['glance.store.http.Store']
-  $glance_store = concat($http_store, $backend_store)
-
-  # TODO: notifications, scrubber, etc.
-  include ::glance
-  include ::glance::config
-  class { '::glance::api':
-    known_stores   => $glance_store,
-    manage_service => false,
-    enabled        => false,
-  }
-  class { '::glance::registry' :
-    sync_db        => $sync_db,
-    manage_service => false,
-    enabled        => false,
-  }
-  include ::glance::notify::rabbitmq
-  include join(['::glance::backend::', $glance_backend])
-
   $nova_ipv6 = hiera('nova::use_ipv6', false)
   if $nova_ipv6 {
     $memcached_servers = suffix(hiera('memcache_node_ips_v6'), ':11211')
@@ -1178,53 +1152,6 @@ if hiera('step') >= 5 {
                           Pacemaker::Resource::Service[$::sahara::params::engine_service_name]],
     }
 
-    # Glance
-    if $glance_backend == 'file' and hiera('glance_file_pcmk_manage', false) {
-      $secontext = 'context="system_u:object_r:glance_var_lib_t:s0"'
-      pacemaker::resource::filesystem { 'glance-fs':
-        device           => hiera('glance_file_pcmk_device'),
-        directory        => hiera('glance_file_pcmk_directory'),
-        fstype           => hiera('glance_file_pcmk_fstype'),
-        fsoptions        => join([$secontext, hiera('glance_file_pcmk_options', '')],','),
-        verify_on_create => true,
-        clone_params     => '',
-      }
-    }
-
-    pacemaker::resource::service { $::glance::params::registry_service_name :
-      clone_params => 'interleave=true',
-      require      => Pacemaker::Resource::Ocf['openstack-core'],
-    }
-    pacemaker::resource::service { $::glance::params::api_service_name :
-      clone_params => 'interleave=true',
-    }
-
-    pacemaker::constraint::base { 'keystone-then-glance-registry-constraint':
-      constraint_type => 'order',
-      first_resource  => 'openstack-core-clone',
-      second_resource => "${::glance::params::registry_service_name}-clone",
-      first_action    => 'start',
-      second_action   => 'start',
-      require         => [Pacemaker::Resource::Service[$::glance::params::registry_service_name],
-                          Pacemaker::Resource::Ocf['openstack-core']],
-    }
-    pacemaker::constraint::base { 'glance-registry-then-glance-api-constraint':
-      constraint_type => 'order',
-      first_resource  => "${::glance::params::registry_service_name}-clone",
-      second_resource => "${::glance::params::api_service_name}-clone",
-      first_action    => 'start',
-      second_action   => 'start',
-      require         => [Pacemaker::Resource::Service[$::glance::params::registry_service_name],
-                          Pacemaker::Resource::Service[$::glance::params::api_service_name]],
-    }
-    pacemaker::constraint::colocation { 'glance-api-with-glance-registry-colocation':
-      source  => "${::glance::params::api_service_name}-clone",
-      target  => "${::glance::params::registry_service_name}-clone",
-      score   => 'INFINITY',
-      require => [Pacemaker::Resource::Service[$::glance::params::registry_service_name],
-                  Pacemaker::Resource::Service[$::glance::params::api_service_name]],
-    }
-
     if hiera('step') == 5 {
       # Neutron
       # NOTE(gfidente): Neutron will try to populate the database with some data
diff --git a/puppet/services/glance-api.yaml b/puppet/services/glance-api.yaml
new file mode 100644
index 00000000..a1ab1a20
--- /dev/null
+++ b/puppet/services/glance-api.yaml
@@ -0,0 +1,93 @@
+heat_template_version: 2016-04-08
+
+description: >
+  OpenStack Glance API service configured with Puppet
+
+parameters:
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  MysqlVirtualIPUri:
+    type: string
+    default: ''
+  Debug:
+    default: ''
+    description: Set to True to enable debugging on all services.
+    type: string
+  GlanceNotifierStrategy:
+    description: Strategy to use for Glance notification queue
+    type: string
+    default: noop
+  GlanceLogFile:
+    description: The filepath of the file to use for logging messages from Glance.
+    type: string
+    default: ''
+  GlancePassword:
+    description: The password for the glance service and db account, used by the glance services.
+    type: string
+    hidden: true
+  GlanceBackend:
+    default: swift
+    description: The short name of the Glance backend to use. Should be one
+      of swift, rbd, or file
+    type: string
+    constraints:
+    - allowed_values: ['swift', 'file', 'rbd']
+  GlanceWorkers:
+    default: 0
+    description: Number of workers for Glance service.
+    type: number
+  RabbitPassword:
+    description: The password for RabbitMQ
+    type: string
+    hidden: true
+  RabbitUserName:
+    default: guest
+    description: The username for RabbitMQ
+    type: string
+  RabbitClientUseSSL:
+    default: false
+    description: >
+        Rabbit client subscriber parameter to specify
+        an SSL connection to the RabbitMQ host.
+    type: string
+
+outputs:
+  role_data:
+    description: Role data for the Glance API role.
+    value:
+      config_settings:
+        glance_dsn: &glance_dsn
+          list_join:
+            - ''
+            - - 'mysql+pymysql://glance:'
+              - {get_param: GlancePassword}
+              - '@'
+              - {get_param: MysqlVirtualIPUri}
+              - '/glance'
+        glance::api::bind_port: {get_param: [EndpointMap, GlanceInternal, port]}
+        glance::api::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri] }
+        glance::api::identity_uri: { get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix] }
+        glance::api::registry_host:
+          str_replace:
+            template: "'REGISTRY_HOST'"
+            params:
+              REGISTRY_HOST: {get_param: [EndpointMap, GlanceRegistryInternal, host]}
+        glance::api::keystone_password: {get_param: GlancePassword}
+        glance::api::debug: {get_param: Debug}
+        glance::api::workers: {get_param: GlanceWorkers}
+        glance_notifier_strategy: {get_param: GlanceNotifierStrategy}
+        glance_log_file: {get_param: GlanceLogFile}
+        glance::api::database_connection: *glance_dsn
+        glance::backend::swift::swift_store_auth_address: {get_param: [EndpointMap, KeystoneInternal, uri] }
+        glance::backend::swift::swift_store_user: service:glance
+        glance::backend::swift::swift_store_key: {get_param: GlancePassword}
+        glance_backend: {get_param: GlanceBackend}
+        glance::db::mysql::password: {get_param: GlancePassword}
+        glance::notify::rabbitmq::rabbit_userid: {get_param: RabbitUserName}
+        glance::notify::rabbitmq::rabbit_password: {get_param: RabbitPassword}
+        glance::notify::rabbitmq::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
+      step_config: |
+        include ::tripleo::profile::base::glance::api
diff --git a/puppet/services/glance-registry.yaml b/puppet/services/glance-registry.yaml
new file mode 100644
index 00000000..1a1a515a
--- /dev/null
+++ b/puppet/services/glance-registry.yaml
@@ -0,0 +1,48 @@
+heat_template_version: 2016-04-08
+
+description: >
+  OpenStack Glance Registry service configured with Puppet
+
+parameters:
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  MysqlVirtualIPUri:
+    type: string
+    default: ''
+  Debug:
+    default: ''
+    description: Set to True to enable debugging on all services.
+    type: string
+  GlancePassword:
+    description: The password for the glance service and db account, used by the glance services.
+    type: string
+    hidden: true
+  GlanceWorkers:
+    default: 0
+    description: Number of workers for Glance service.
+    type: number
+
+outputs:
+  role_data:
+    description: Role data for the Glance Registry role.
+    value:
+      config_settings:
+        glance_dsn: &glance_dsn
+          list_join:
+            - ''
+            - - 'mysql+pymysql://glance:'
+              - {get_param: GlancePassword}
+              - '@'
+              - {get_param: MysqlVirtualIPUri}
+              - '/glance'
+        glance::registry::keystone_password: {get_param: GlancePassword}
+        glance::registry::database_connection: *glance_dsn
+        glance::registry::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri] }
+        glance::registry::identity_uri: { get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix] }
+        glance::registry::debug: {get_param: Debug}
+        glance::registry::workers: {get_param: GlanceWorkers}
+      step_config: |
+        include ::tripleo::profile::base::glance::registry
diff --git a/puppet/services/pacemaker/glance-api.yaml b/puppet/services/pacemaker/glance-api.yaml
new file mode 100644
index 00000000..815eb5bf
--- /dev/null
+++ b/puppet/services/pacemaker/glance-api.yaml
@@ -0,0 +1,60 @@
+heat_template_version: 2016-04-08
+
+description: >
+  OpenStack Glance API service with Pacemaker configured with Puppet.
+
+parameters:
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  MysqlVirtualIPUri:
+    type: string
+    default: ''
+  GlanceFilePcmkDevice:
+    default: ''
+    description: >
+      An exported storage device that should be mounted by Pacemaker
+      as Glance storage. Effective when GlanceFilePcmkManage is true.
+    type: string
+  GlanceFilePcmkFstype:
+    default: 'nfs'
+    description: >
+      Filesystem type for Pacemaker mount used as Glance storage.
+      Effective when GlanceFilePcmkManage is true.
+    type: string
+  GlanceFilePcmkManage:
+    default: false
+    description: >
+      Whether to make Glance file backend a mount managed by Pacemaker.
+      Effective when GlanceBackend is 'file'.
+    type: boolean
+  GlanceFilePcmkOptions:
+    default: ''
+    description: >
+      Mount options for Pacemaker mount used as Glance storage.
+      Effective when GlanceFilePcmkManage is true.
+    type: string
+
+resources:
+
+  GlanceApiBase:
+    type: ../glance-api.yaml
+    properties:
+      EndpointMap: {get_param: EndpointMap}
+      MysqlVirtualIPUri: {get_param: MysqlVirtualIPUri}
+
+outputs:
+  role_data:
+    description: Role data for the Glance role.
+    value:
+      config_settings:
+        map_merge:
+          - get_attr: [GlanceApiBase, role_data, config_settings]
+          - glance_file_pcmk_device: {get_param: GlanceFilePcmkDevice}
+            glance_file_pcmk_fstype: {get_param: GlanceFilePcmkFstype}
+            glance_file_pcmk_manage: {get_param: GlanceFilePcmkManage}
+            glance_file_pcmk_options: {get_param: GlanceFilePcmkOptions}
+      step_config: |
+        include ::tripleo::profile::pacemaker::glance
diff --git a/puppet/services/pacemaker/glance-registry.yaml b/puppet/services/pacemaker/glance-registry.yaml
new file mode 100644
index 00000000..56353459
--- /dev/null
+++ b/puppet/services/pacemaker/glance-registry.yaml
@@ -0,0 +1,33 @@
+heat_template_version: 2016-04-08
+
+description: >
+  OpenStack Glance Registry service with Pacemaker configured with Puppet
+
+parameters:
+  EndpointMap:
+    default: {}
+    description: Mapping of service endpoint -> protocol. Typically set
+                 via parameter_defaults in the resource registry.
+    type: json
+  MysqlVirtualIPUri:
+    type: string
+    default: ''
+
+resources:
+
+  GlanceRegistryBase:
+    type: ../glance-registry.yaml
+    properties:
+      EndpointMap: {get_param: EndpointMap}
+      MysqlVirtualIPUri: {get_param: MysqlVirtualIPUri}
+
+outputs:
+  role_data:
+    description: Role data for the Glance role.
+    value:
+      config_settings:
+        get_attr: [GlanceRegistryBase, role_data, config_settings]
+      # No puppet manifests since glance-registry is included in
+      # ::tripleo::profile::pacemaker::glance which is maintained alongside of
+      # pacemaker/glance-api.yaml.
+      step_config: