diff --git a/README.rst b/README.rst
index 7a19ad0..899d5c1 100644
--- a/README.rst
+++ b/README.rst
@@ -20,6 +20,10 @@
         version: juno
         cinder_uid: 304
         cinder_gid: 304
+        nas_secure_file_permissions: false
+        nas_secure_file_operations: false
+        cinder_internal_tenant_user_id: f46924c112a14c80ab0a24a613d95eef
+        cinder_internal_tenant_project_id: b7455b8974bb4064ad247c8f375eae6c
         default_volume_type: 7k2SaS
         availability_zone_fallback: True
         database:
@@ -65,6 +69,10 @@
         version: juno
         cinder_uid: 304
         cinder_gid: 304
+        nas_secure_file_permissions: false
+        nas_secure_file_operations: false
+        cinder_internal_tenant_user_id: f46924c112a14c80ab0a24a613d95eef
+        cinder_internal_tenant_project_id: b7455b8974bb4064ad247c8f375eae6c
         default_volume_type: 7k2SaS
         database:
           engine: mysql
diff --git a/cinder/files/juno/cinder.conf.controller.Debian b/cinder/files/juno/cinder.conf.controller.Debian
index 65bceb1..d83df84 100644
--- a/cinder/files/juno/cinder.conf.controller.Debian
+++ b/cinder/files/juno/cinder.conf.controller.Debian
@@ -92,6 +92,18 @@
 use_syslog=false
 verbose=True
 lock_path=/var/lock/cinder
+{%- if controller.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ controller.nas_secure_file_permissions }}
+{%- endif %}
+{%- if controller.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ controller.nas_secure_file_operations }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ controller.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ controller.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [keystone_authtoken]
 signing_dir=/tmp/keystone-signing-cinder
diff --git a/cinder/files/juno/cinder.conf.volume.Debian b/cinder/files/juno/cinder.conf.volume.Debian
index 9888ad8..9766c2e 100644
--- a/cinder/files/juno/cinder.conf.volume.Debian
+++ b/cinder/files/juno/cinder.conf.volume.Debian
@@ -101,6 +101,18 @@
 use_syslog=false
 verbose=True
 lock_path=/var/lock/cinder
+{%- if volume.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ volume.nas_secure_file_permissions }}
+{%- endif %}
+{%- if volume.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ volume.nas_secure_file_operations }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ volume.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ volume.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [keystone_authtoken]
 signing_dir=/tmp/keystone-signing-cinder
diff --git a/cinder/files/kilo/cinder.conf.controller.Debian b/cinder/files/kilo/cinder.conf.controller.Debian
index bb8320f..71902e2 100644
--- a/cinder/files/kilo/cinder.conf.controller.Debian
+++ b/cinder/files/kilo/cinder.conf.controller.Debian
@@ -86,6 +86,18 @@
 use_syslog=false
 verbose=True
 lock_path=/var/lock/cinder
+{%- if controller.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ controller.nas_secure_file_permissions }}
+{%- endif %}
+{%- if controller.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ controller.nas_secure_file_operations }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ controller.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ controller.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_concurrency]
 
diff --git a/cinder/files/kilo/cinder.conf.volume.Debian b/cinder/files/kilo/cinder.conf.volume.Debian
index f820362..3c8c720 100644
--- a/cinder/files/kilo/cinder.conf.volume.Debian
+++ b/cinder/files/kilo/cinder.conf.volume.Debian
@@ -95,6 +95,18 @@
 
 use_syslog=false
 verbose=True
+{%- if volume.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ volume.nas_secure_file_permissions }}
+{%- endif %}
+{%- if volume.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ volume.nas_secure_file_operations }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ volume.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ volume.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_concurrency]
 
diff --git a/cinder/files/liberty/cinder.conf.controller.Debian b/cinder/files/liberty/cinder.conf.controller.Debian
index 460f0b0..4e86745 100644
--- a/cinder/files/liberty/cinder.conf.controller.Debian
+++ b/cinder/files/liberty/cinder.conf.controller.Debian
@@ -105,6 +105,18 @@
 use_syslog=false
 verbose=True
 lock_path=/var/lock/cinder
+{%- if controller.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ controller.nas_secure_file_permissions }}
+{%- endif %}
+{%- if controller.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ controller.nas_secure_file_operations }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ controller.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ controller.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_concurrency]
 
diff --git a/cinder/files/liberty/cinder.conf.volume.Debian b/cinder/files/liberty/cinder.conf.volume.Debian
index 12582c1..7d8c9d3 100644
--- a/cinder/files/liberty/cinder.conf.volume.Debian
+++ b/cinder/files/liberty/cinder.conf.volume.Debian
@@ -89,6 +89,18 @@
 
 use_syslog=false
 verbose=True
+{%- if volume.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ volume.nas_secure_file_permissions }}
+{%- endif %}
+{%- if volume.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ volume.nas_secure_file_operations }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ volume.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ volume.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_concurrency]
 
diff --git a/cinder/files/mitaka/cinder.conf.controller.Debian b/cinder/files/mitaka/cinder.conf.controller.Debian
index 24aed63..274fe17 100644
--- a/cinder/files/mitaka/cinder.conf.controller.Debian
+++ b/cinder/files/mitaka/cinder.conf.controller.Debian
@@ -94,6 +94,18 @@
 {%- set backup_backend_fragment = "cinder/files/backup_backend/_" + controller.backup.engine + ".conf" %}
 {%- include backup_backend_fragment %}
 {%- endif %}
+{%- if controller.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ controller.nas_secure_file_permissions }}
+{%- endif %}
+{%- if controller.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ controller.nas_secure_file_operations }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ controller.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ controller.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_messaging_notifications]
 {%- if controller.notification is mapping %}
diff --git a/cinder/files/mitaka/cinder.conf.volume.Debian b/cinder/files/mitaka/cinder.conf.volume.Debian
index f3633e6..5eee92a 100644
--- a/cinder/files/mitaka/cinder.conf.volume.Debian
+++ b/cinder/files/mitaka/cinder.conf.volume.Debian
@@ -79,6 +79,18 @@
 {%- set backup_backend_fragment = "cinder/files/backup_backend/_" + volume.backup.engine + ".conf" %}
 {%- include backup_backend_fragment %}
 {%- endif %}
+{%- if volume.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ volume.nas_secure_file_permissions }}
+{%- endif %}
+{%- if volume.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ volume.nas_secure_file_operations }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ volume.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ volume.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_messaging_notifications]
 {%- if volume.notification is mapping %}
diff --git a/cinder/files/newton/cinder.conf.controller.Debian b/cinder/files/newton/cinder.conf.controller.Debian
index 528d8a6..c8f137c 100644
--- a/cinder/files/newton/cinder.conf.controller.Debian
+++ b/cinder/files/newton/cinder.conf.controller.Debian
@@ -110,6 +110,18 @@
 {%- set backup_backend_fragment = "cinder/files/backup_backend/_" + controller.backup.engine + ".conf" %}
 {%- include backup_backend_fragment %}
 {%- endif %}
+{%- if controller.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ controller.nas_secure_file_permissions }}
+{%- endif %}
+{%- if controller.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ controller.nas_secure_file_operations }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ controller.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ controller.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_messaging_notifications]
 {%- if controller.notification is mapping %}
diff --git a/cinder/files/newton/cinder.conf.volume.Debian b/cinder/files/newton/cinder.conf.volume.Debian
index 5a02b87..d5ff9cf 100644
--- a/cinder/files/newton/cinder.conf.volume.Debian
+++ b/cinder/files/newton/cinder.conf.volume.Debian
@@ -99,6 +99,18 @@
 {%- set backup_backend_fragment = "cinder/files/backup_backend/_" + volume.backup.engine + ".conf" %}
 {%- include backup_backend_fragment %}
 {%- endif %}
+{%- if volume.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ volume.nas_secure_file_permissions }}
+{%- endif %}
+{%- if volume.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ volume.nas_secure_file_operations }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ volume.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ volume.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_messaging_notifications]
 {%- if volume.notification is mapping %}
diff --git a/cinder/files/ocata/cinder-wsgi.conf b/cinder/files/ocata/cinder-wsgi.conf
index 3e4de23..153adde 100644
--- a/cinder/files/ocata/cinder-wsgi.conf
+++ b/cinder/files/ocata/cinder-wsgi.conf
@@ -1,6 +1,5 @@
 {%- from "cinder/map.jinja" import controller with context %}
 Listen {{ controller.osapi.host }}:8776
-LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" cinder_combined
 
 <VirtualHost {{ controller.osapi.host }}:8776>
     WSGIDaemonProcess cinder-wsgi processes=5 threads=1 user=cinder display-name=%{GROUP}
@@ -13,10 +12,10 @@
     </IfVersion>
 
     ErrorLog /var/log/apache2/cinder_error.log
-    CustomLog /var/log/apache2/cinder.log cinder_combined
+    CustomLog /var/log/apache2/cinder.log "%v:%p %h %l %u %t \"%r\" %>s %D %O \"%{Referer}i\" \"%{User-Agent}i\""
 
     <Directory /usr/bin>
-	<IfVersion >= 2.4>
+        <IfVersion >= 2.4>
             Require all granted
         </IfVersion>
         <IfVersion < 2.4>
diff --git a/cinder/files/ocata/cinder.conf.controller.Debian b/cinder/files/ocata/cinder.conf.controller.Debian
index 528d8a6..c8f137c 100644
--- a/cinder/files/ocata/cinder.conf.controller.Debian
+++ b/cinder/files/ocata/cinder.conf.controller.Debian
@@ -110,6 +110,18 @@
 {%- set backup_backend_fragment = "cinder/files/backup_backend/_" + controller.backup.engine + ".conf" %}
 {%- include backup_backend_fragment %}
 {%- endif %}
+{%- if controller.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ controller.nas_secure_file_permissions }}
+{%- endif %}
+{%- if controller.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ controller.nas_secure_file_operations }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ controller.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ controller.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_messaging_notifications]
 {%- if controller.notification is mapping %}
diff --git a/cinder/files/ocata/cinder.conf.volume.Debian b/cinder/files/ocata/cinder.conf.volume.Debian
index 5a02b87..d5ff9cf 100644
--- a/cinder/files/ocata/cinder.conf.volume.Debian
+++ b/cinder/files/ocata/cinder.conf.volume.Debian
@@ -99,6 +99,18 @@
 {%- set backup_backend_fragment = "cinder/files/backup_backend/_" + volume.backup.engine + ".conf" %}
 {%- include backup_backend_fragment %}
 {%- endif %}
+{%- if volume.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ volume.nas_secure_file_permissions }}
+{%- endif %}
+{%- if volume.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ volume.nas_secure_file_operations }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ volume.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ volume.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_messaging_notifications]
 {%- if volume.notification is mapping %}
diff --git a/cinder/meta/heka.yml b/cinder/meta/heka.yml
index 7186c50..5a87914 100644
--- a/cinder/meta/heka.yml
+++ b/cinder/meta/heka.yml
@@ -2,6 +2,7 @@
 {%- from "cinder/map.jinja" import volume as _volume with context %}
 {%- set controller = _controller.get('enabled', False) %}
 {%- set volume = _volume.get('enabled', False) %}
+{%- set apache_wsgi = controller and _controller.version not in ('juno', 'kilo', 'liberty', 'mitaka', 'newton') %}
 log_collector:
   decoder:
     cinder:
@@ -9,6 +10,16 @@
       module_file: /usr/share/lma_collector/decoders/openstack_log.lua
       module_dir: /usr/share/lma_collector/common;/usr/share/heka/lua_modules
       adjust_timezone: true
+{%- if apache_wsgi %}
+    cinder_wsgi:
+      engine: sandbox
+      module_file: /usr/share/lma_collector/decoders/apache_wsgi_log.lua
+      module_dir: /usr/share/lma_collector/common;/usr/share/heka/lua_modules
+      config:
+        logger: openstack.cinder
+        apache_log_pattern: >-
+          %v:%p %h %l %u %t \"%r\" %>s %D %O \"%{Referer}i\" \"%{User-Agent}i\"
+{%- endif %}
   splitter:
     cinder:
       engine: token
@@ -22,6 +33,16 @@
       priority: ["^Seq"]
       decoder: "cinder_decoder"
       splitter: "cinder_splitter"
+{%- if apache_wsgi %}
+    cinder_wsgi_log:
+      engine: logstreamer
+      log_directory: "/var/log/apache2"
+      file_match: 'cinder\.log'
+      differentiator: ['cinder-wsgi']
+      priority: ["^Seq"]
+      decoder: "cinder_wsgi_decoder"
+      splitter: "TokenSplitter"
+{%- endif %}
 metric_collector:
   trigger:
     {%- if controller or volume %}