diff --git a/.kitchen.travis.yml b/.kitchen.travis.yml
new file mode 100644
index 0000000..f847543
--- /dev/null
+++ b/.kitchen.travis.yml
@@ -0,0 +1,6 @@
+suites:
+
+  - name: <%= ENV['SUITE'] %>
+    provisioner:
+      pillars-from-files:
+        neutron.sls: tests/pillar/<%= ENV['SUITE'] %>.sls
diff --git a/.kitchen.yml b/.kitchen.yml
index be889a8..7284f4b 100644
--- a/.kitchen.yml
+++ b/.kitchen.yml
@@ -33,21 +33,60 @@
   sudo: true
 
 platforms:
-  - name: ubuntu-trusty
+  - name: <%=ENV['PLATFORM'] || 'ubuntu-xenial'%>
     driver_config:
-      image: trevorj/salty-whales:trusty
-      platform: ubuntu
-
-  - name: ubuntu-xenial
-    driver_config:
-      image: trevorj/salty-whales:xenial
+      image: <%=ENV['PLATFORM'] || 'trevorj/salty-whales:xenial'%>
       platform: ubuntu
 
 suites:
 
-  - name: <%=ENV['SUITE'] || 'ceph_single'%>
+  - name: ceph_single
     provisioner:
       pillars-from-files:
-        cinder.sls: tests/pillar/<%=ENV['SUITE'] || 'ceph_single'%>.sls
+        cinder.sls: tests/pillar/ceph_single.sls
 
+  - name: control_cluster
+    provisioner:
+      pillars-from-files:
+        cinder.sls: tests/pillar/control_cluster.sls
+
+  - name: control_single
+    provisioner:
+      pillars-from-files:
+        cinder.sls: tests/pillar/control_single.sls
+
+  - name: gpfs_single
+    provisioner:
+      pillars-from-files:
+        cinder.sls: tests/pillar/gpfs_single.sls
+
+  - name: hp3par_single
+    provisioner:
+      pillars-from-files:
+        cinder.sls: tests/pillar/hp3par_single.sls
+
+  - name: lefthand_single
+    provisioner:
+      pillars-from-files:
+        cinder.sls: tests/pillar/lefthand_single.sls
+
+  - name: solidfire_single
+    provisioner:
+      pillars-from-files:
+        cinder.sls: tests/pillar/solidfire_single.sls
+
+  - name: storwize_single
+    provisioner:
+      pillars-from-files:
+        cinder.sls: tests/pillar/storwize_single.sls
+
+  - name: volume_single
+    provisioner:
+      pillars-from-files:
+        cinder.sls: tests/pillar/volume_single.sls
+
+  - name: vsp_single
+    provisioner:
+      pillars-from-files:
+        cinder.sls: tests/pillar/vsp_single.sls
 # vim: ft=yaml sw=2 ts=2 sts=2 tw=125
diff --git a/.travis.yml b/.travis.yml
index c1872fe..77f72c9 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,23 +17,33 @@
   - bundle install
 
 env:
-    - SUITE=ceph_single
-    - SUITE=control_cluster
-    - SUITE=control_single
-    - SUITE=gpfs_single
-    - SUITE=hp3par_single
-    - SUITE=lefthand_single
-    - SUITE=solidfire_single
-    - SUITE=storwize_single
-    - SUITE=volume_single
-    - SUITE=vsp_single
+    - PLATFORM=trevorj/salty-whales:trusty SUITE=ceph_single
+    - PLATFORM=trevorj/salty-whales:xenial SUITE=ceph_single
+    - PLATFORM=trevorj/salty-whales:trusty SUITE=control_cluster
+    - PLATFORM=trevorj/salty-whales:xenial SUITE=control_cluster
+    - PLATFORM=trevorj/salty-whales:trusty SUITE=control_single
+    - PLATFORM=trevorj/salty-whales:xenial SUITE=control_single
+    - PLATFORM=trevorj/salty-whales:trusty SUITE=gpfs_single
+    - PLATFORM=trevorj/salty-whales:xenial SUITE=gpfs_single
+    - PLATFORM=trevorj/salty-whales:trusty SUITE=hp3par_single
+    - PLATFORM=trevorj/salty-whales:xenial SUITE=hp3par_single
+    - PLATFORM=trevorj/salty-whales:trusty SUITE=lefthand_single
+    - PLATFORM=trevorj/salty-whales:xenial SUITE=lefthand_single
+    - PLATFORM=trevorj/salty-whales:trusty SUITE=solidfire_single
+    - PLATFORM=trevorj/salty-whales:xenial SUITE=solidfire_single
+    - PLATFORM=trevorj/salty-whales:trusty SUITE=storwize_single
+    - PLATFORM=trevorj/salty-whales:xenial SUITE=storwize_single
+    - PLATFORM=trevorj/salty-whales:trusty SUITE=volume_single
+    - PLATFORM=trevorj/salty-whales:xenial SUITE=volume_single
+    - PLATFORM=trevorj/salty-whales:trusty SUITE=vsp_single
+    - PLATFORM=trevorj/salty-whales:xenial SUITE=vsp_single
 
 before_script:
   - set -o pipefail
   - make test | tail
 
 script:
-  - test ! -e .kitchen.yml || bundle exec kitchen test -t tests/integration
+  - KITCHEN_LOCAL_YAML=.kitchen.travis.yml bundle exec kitchen test -t tests/integration
 
 notifications:
   webhooks:
diff --git a/README.rst b/README.rst
index 7a19ad0..899d5c1 100644
--- a/README.rst
+++ b/README.rst
@@ -20,6 +20,10 @@
         version: juno
         cinder_uid: 304
         cinder_gid: 304
+        nas_secure_file_permissions: false
+        nas_secure_file_operations: false
+        cinder_internal_tenant_user_id: f46924c112a14c80ab0a24a613d95eef
+        cinder_internal_tenant_project_id: b7455b8974bb4064ad247c8f375eae6c
         default_volume_type: 7k2SaS
         availability_zone_fallback: True
         database:
@@ -65,6 +69,10 @@
         version: juno
         cinder_uid: 304
         cinder_gid: 304
+        nas_secure_file_permissions: false
+        nas_secure_file_operations: false
+        cinder_internal_tenant_user_id: f46924c112a14c80ab0a24a613d95eef
+        cinder_internal_tenant_project_id: b7455b8974bb4064ad247c8f375eae6c
         default_volume_type: 7k2SaS
         database:
           engine: mysql
diff --git a/cinder/files/grafana_dashboards/cinder_prometheus.json b/cinder/files/grafana_dashboards/cinder_prometheus.json
index de1e2f8..4869750 100644
--- a/cinder/files/grafana_dashboards/cinder_prometheus.json
+++ b/cinder/files/grafana_dashboards/cinder_prometheus.json
@@ -1,5 +1,8 @@
 {% raw %}
 {
+  "annotations": {
+    "list": []
+  },
   "description": "Monitors Cinder cluster using Prometheus. Shows overall cluster processes and usage.",
   "editable": true,
   "gnetId": 315,
@@ -74,7 +77,7 @@
               "intervalFactor": 2,
               "legendFormat": "{{ service }}",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "1,0",
@@ -99,7 +102,7 @@
             }
           ],
           "valueName": "current"
-        },    
+        },
         {
           "cacheTimeout": null,
           "colorBackground": false,
@@ -161,7 +164,7 @@
               "intervalFactor": 2,
               "legendFormat": "per sec",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -176,27 +179,6 @@
             }
           ],
           "valueName": "current"
-        }
-    ],
-      "repeat": null,
-      "repeatIteration": null,
-      "repeatRowId": null,
-      "showTitle": true,
-      "title": "Service Status",
-      "titleSize": "h6"
-    },
-    {
-      "collapse": false,
-      "height": "100px",
-      "panels": [
-        {
-          "content": "<br />\n<h3 align=\"center\"> Up </h3>",
-          "id": 3,
-          "links": [],
-          "mode": "html",
-          "span": 1,
-          "title": "",
-          "type": "text"
         },
         {
           "cacheTimeout": null,
@@ -216,7 +198,7 @@
             "thresholdLabels": false,
             "thresholdMarkers": true
           },
-          "id": 4,
+          "id": 3,
           "interval": null,
           "links": [],
           "mappingType": 1,
@@ -259,11 +241,11 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
-          "title": "API",
+          "title": "Cinder API backends",
           "type": "singlestat",
           "valueFontSize": "80%",
           "valueMaps": [
@@ -280,7 +262,171 @@
       "repeatIteration": null,
       "repeatRowId": null,
       "showTitle": true,
-      "title": "Cinder API",
+      "title": "Service Status",
+      "titleSize": "h6"
+    },
+    {
+      "collapse": false,
+      "height": "250",
+      "panels": [
+        {
+          "aliasColors": {},
+          "bars": false,
+          "dashLength": 10,
+          "dashes": false,
+          "datasource": "prometheus",
+          "fill": 1,
+          "id": 4,
+          "legend": {
+            "avg": false,
+            "current": false,
+            "max": false,
+            "min": false,
+            "show": true,
+            "total": false,
+            "values": false
+          },
+          "lines": true,
+          "linewidth": 1,
+          "links": [],
+          "nullPointMode": "null",
+          "percentage": false,
+          "pointradius": 5,
+          "points": false,
+          "renderer": "flot",
+          "seriesOverrides": [],
+          "spaceLength": 10,
+          "span": 6,
+          "stack": false,
+          "steppedLine": false,
+          "targets": [
+            {
+              "expr": "sum(openstack_cinder_http_response_times_rate{host=~\"^$host$\"})  by (http_status)",
+              "format": "time_series",
+              "intervalFactor": 2,
+              "legendFormat": "{{ http_status }}",
+              "refId": "A",
+              "step": 10
+            }
+          ],
+          "thresholds": [],
+          "timeFrom": null,
+          "timeShift": null,
+          "title": "Throughput",
+          "tooltip": {
+            "shared": true,
+            "sort": 0,
+            "value_type": "individual"
+          },
+          "type": "graph",
+          "xaxis": {
+            "buckets": null,
+            "mode": "time",
+            "name": null,
+            "show": true,
+            "values": []
+          },
+          "yaxes": [
+            {
+              "format": "ops",
+              "label": null,
+              "logBase": 1,
+              "max": null,
+              "min": "0",
+              "show": true
+            },
+            {
+              "format": "short",
+              "label": null,
+              "logBase": 1,
+              "max": null,
+              "min": null,
+              "show": true
+            }
+          ]
+        },
+        {
+          "aliasColors": {},
+          "bars": false,
+          "dashLength": 10,
+          "dashes": false,
+          "datasource": "prometheus",
+          "fill": 1,
+          "id": 5,
+          "legend": {
+            "avg": false,
+            "current": false,
+            "max": false,
+            "min": false,
+            "show": true,
+            "total": false,
+            "values": false
+          },
+          "lines": true,
+          "linewidth": 1,
+          "links": [],
+          "nullPointMode": "null",
+          "percentage": false,
+          "pointradius": 5,
+          "points": false,
+          "renderer": "flot",
+          "seriesOverrides": [],
+          "spaceLength": 10,
+          "span": 6,
+          "stack": false,
+          "steppedLine": false,
+          "targets": [
+            {
+              "expr": "max(openstack_cinder_http_response_times_upper_90{host=~\"^$host$\"})  by (http_method)",
+              "format": "time_series",
+              "intervalFactor": 2,
+              "legendFormat": "{{ http_method }}",
+              "refId": "A",
+              "step": 10
+            }
+          ],
+          "thresholds": [],
+          "timeFrom": null,
+          "timeShift": null,
+          "title": "Latency",
+          "tooltip": {
+            "shared": true,
+            "sort": 0,
+            "value_type": "individual"
+          },
+          "type": "graph",
+          "xaxis": {
+            "buckets": null,
+            "mode": "time",
+            "name": null,
+            "show": true,
+            "values": []
+          },
+          "yaxes": [
+            {
+              "format": "s",
+              "label": null,
+              "logBase": 1,
+              "max": null,
+              "min": "0",
+              "show": true
+            },
+            {
+              "format": "short",
+              "label": null,
+              "logBase": 1,
+              "max": null,
+              "min": null,
+              "show": true
+            }
+          ]
+        }
+      ],
+      "repeat": null,
+      "repeatIteration": null,
+      "repeatRowId": null,
+      "showTitle": true,
+      "title": "API Performances",
       "titleSize": "h6"
     },
     {
@@ -357,7 +503,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "1,1",
@@ -434,7 +580,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "1,1",
@@ -511,7 +657,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "1,1",
@@ -543,7 +689,7 @@
             "min": false,
             "show": true,
             "total": false,
-            "values": false         
+            "values": false
           },
           "lines": true,
           "linewidth": 1,
@@ -566,7 +712,7 @@
               "legendFormat": "{{ state }}",
               "metric": "openstack_cinder_services",
               "refId": "A",
-              "step": 2
+              "step": 4
             }
           ],
           "thresholds": [],
@@ -576,7 +722,7 @@
           "tooltip": {
             "shared": true,
             "sort": 0,
-            "value_type": "individual"            
+            "value_type": "individual"
           },
           "type": "graph",
           "xaxis": {
@@ -584,7 +730,7 @@
             "mode": "time",
             "name": null,
             "show": true,
-            "values": []            
+            "values": []
           },
           "yaxes": [
             {
@@ -613,7 +759,7 @@
           "span": 2,
           "title": "",
           "type": "text"
-        },      
+        },
         {
           "cacheTimeout": null,
           "colorBackground": false,
@@ -675,7 +821,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "1,1",
@@ -752,7 +898,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "1,1",
@@ -829,7 +975,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "1,1",
@@ -861,7 +1007,7 @@
             "min": false,
             "show": true,
             "total": false,
-            "values": false         
+            "values": false
           },
           "lines": true,
           "linewidth": 1,
@@ -884,7 +1030,7 @@
               "legendFormat": "{{ state }}",
               "metric": "openstack_cinder_services",
               "refId": "A",
-              "step": 2
+              "step": 4
             }
           ],
           "thresholds": [],
@@ -894,7 +1040,7 @@
           "tooltip": {
             "shared": true,
             "sort": 0,
-            "value_type": "individual"            
+            "value_type": "individual"
           },
           "type": "graph",
           "xaxis": {
@@ -902,7 +1048,7 @@
             "mode": "time",
             "name": null,
             "show": true,
-            "values": []            
+            "values": []
           },
           "yaxes": [
             {
@@ -996,7 +1142,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -1073,7 +1219,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -1150,7 +1296,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -1205,7 +1351,7 @@
               "legendFormat": "{{ status }}",
               "metric": "openstack_cinder_volumes",
               "refId": "A",
-              "step": 2
+              "step": 4
             }
           ],
           "thresholds": [],
@@ -1303,7 +1449,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -1380,7 +1526,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -1457,7 +1603,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -1512,7 +1658,7 @@
               "legendFormat": "{{ status }}",
               "metric": "openstack_cinder_volumes_size",
               "refId": "A",
-              "step": 2
+              "step": 4
             }
           ],
           "thresholds": [],
@@ -1610,7 +1756,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -1687,7 +1833,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -1764,7 +1910,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -1819,7 +1965,7 @@
               "legendFormat": "{{ status }}",
               "metric": "openstack_cinder_snapshots",
               "refId": "A",
-              "step": 2
+              "step": 4
             }
           ],
           "thresholds": [],
@@ -1917,7 +2063,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -1994,7 +2140,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -2071,7 +2217,7 @@
               "intervalFactor": 2,
               "legendFormat": "",
               "refId": "A",
-              "step": 20
+              "step": 60
             }
           ],
           "thresholds": "",
@@ -2126,7 +2272,7 @@
               "legendFormat": "{{ status }}",
               "metric": "openstack_cinder_snapshots_size",
               "refId": "A",
-              "step": 2
+              "step": 4
             }
           ],
           "thresholds": [],
@@ -2179,7 +2325,29 @@
     "cinder"
   ],
   "templating": {
-    "list": []
+    "list": [
+      {
+        "allValue": null,
+        "current": {},
+        "datasource": "prometheus",
+        "hide": 0,
+        "includeAll": true,
+        "label": null,
+        "multi": true,
+        "name": "host",
+        "options": [],
+        "query": "label_values(openstack_cinder_http_response_times_count,host)",
+        "refresh": 1,
+        "refresh_on_load": true,
+        "regex": "",
+        "sort": 1,
+        "tagValuesQuery": "",
+        "tags": [],
+        "tagsQuery": "",
+        "type": "query",
+        "useTags": false
+      }
+    ]
   },
   "time": {
     "from": "now-1h",
@@ -2212,6 +2380,6 @@
   },
   "timezone": "browser",
   "title": "Cinder",
-  "version": 2
+  "version": 3
 }
 {% endraw %}
diff --git a/cinder/files/juno/cinder.conf.controller.Debian b/cinder/files/juno/cinder.conf.controller.Debian
index 65bceb1..d83df84 100644
--- a/cinder/files/juno/cinder.conf.controller.Debian
+++ b/cinder/files/juno/cinder.conf.controller.Debian
@@ -92,6 +92,18 @@
 use_syslog=false
 verbose=True
 lock_path=/var/lock/cinder
+{%- if controller.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ controller.nas_secure_file_permissions }}
+{%- endif %}
+{%- if controller.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ controller.nas_secure_file_operations }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ controller.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ controller.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [keystone_authtoken]
 signing_dir=/tmp/keystone-signing-cinder
diff --git a/cinder/files/juno/cinder.conf.volume.Debian b/cinder/files/juno/cinder.conf.volume.Debian
index 9888ad8..9766c2e 100644
--- a/cinder/files/juno/cinder.conf.volume.Debian
+++ b/cinder/files/juno/cinder.conf.volume.Debian
@@ -101,6 +101,18 @@
 use_syslog=false
 verbose=True
 lock_path=/var/lock/cinder
+{%- if volume.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ volume.nas_secure_file_permissions }}
+{%- endif %}
+{%- if volume.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ volume.nas_secure_file_operations }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ volume.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ volume.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [keystone_authtoken]
 signing_dir=/tmp/keystone-signing-cinder
diff --git a/cinder/files/kilo/cinder.conf.controller.Debian b/cinder/files/kilo/cinder.conf.controller.Debian
index bb8320f..71902e2 100644
--- a/cinder/files/kilo/cinder.conf.controller.Debian
+++ b/cinder/files/kilo/cinder.conf.controller.Debian
@@ -86,6 +86,18 @@
 use_syslog=false
 verbose=True
 lock_path=/var/lock/cinder
+{%- if controller.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ controller.nas_secure_file_permissions }}
+{%- endif %}
+{%- if controller.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ controller.nas_secure_file_operations }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ controller.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ controller.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_concurrency]
 
diff --git a/cinder/files/kilo/cinder.conf.volume.Debian b/cinder/files/kilo/cinder.conf.volume.Debian
index f820362..3c8c720 100644
--- a/cinder/files/kilo/cinder.conf.volume.Debian
+++ b/cinder/files/kilo/cinder.conf.volume.Debian
@@ -95,6 +95,18 @@
 
 use_syslog=false
 verbose=True
+{%- if volume.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ volume.nas_secure_file_permissions }}
+{%- endif %}
+{%- if volume.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ volume.nas_secure_file_operations }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ volume.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ volume.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_concurrency]
 
diff --git a/cinder/files/liberty/cinder.conf.controller.Debian b/cinder/files/liberty/cinder.conf.controller.Debian
index 460f0b0..4e86745 100644
--- a/cinder/files/liberty/cinder.conf.controller.Debian
+++ b/cinder/files/liberty/cinder.conf.controller.Debian
@@ -105,6 +105,18 @@
 use_syslog=false
 verbose=True
 lock_path=/var/lock/cinder
+{%- if controller.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ controller.nas_secure_file_permissions }}
+{%- endif %}
+{%- if controller.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ controller.nas_secure_file_operations }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ controller.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ controller.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_concurrency]
 
diff --git a/cinder/files/liberty/cinder.conf.volume.Debian b/cinder/files/liberty/cinder.conf.volume.Debian
index 12582c1..7d8c9d3 100644
--- a/cinder/files/liberty/cinder.conf.volume.Debian
+++ b/cinder/files/liberty/cinder.conf.volume.Debian
@@ -89,6 +89,18 @@
 
 use_syslog=false
 verbose=True
+{%- if volume.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ volume.nas_secure_file_permissions }}
+{%- endif %}
+{%- if volume.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ volume.nas_secure_file_operations }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ volume.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ volume.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_concurrency]
 
diff --git a/cinder/files/mitaka/cinder.conf.controller.Debian b/cinder/files/mitaka/cinder.conf.controller.Debian
index 344ec83..b1ba8c2 100644
--- a/cinder/files/mitaka/cinder.conf.controller.Debian
+++ b/cinder/files/mitaka/cinder.conf.controller.Debian
@@ -94,6 +94,18 @@
 {%- set backup_backend_fragment = "cinder/files/backup_backend/_" + controller.backup.engine + ".conf" %}
 {%- include backup_backend_fragment %}
 {%- endif %}
+{%- if controller.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ controller.nas_secure_file_permissions }}
+{%- endif %}
+{%- if controller.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ controller.nas_secure_file_operations }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ controller.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ controller.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_messaging_notifications]
 {%- if controller.notification is mapping %}
diff --git a/cinder/files/mitaka/cinder.conf.volume.Debian b/cinder/files/mitaka/cinder.conf.volume.Debian
index f3633e6..5eee92a 100644
--- a/cinder/files/mitaka/cinder.conf.volume.Debian
+++ b/cinder/files/mitaka/cinder.conf.volume.Debian
@@ -79,6 +79,18 @@
 {%- set backup_backend_fragment = "cinder/files/backup_backend/_" + volume.backup.engine + ".conf" %}
 {%- include backup_backend_fragment %}
 {%- endif %}
+{%- if volume.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ volume.nas_secure_file_permissions }}
+{%- endif %}
+{%- if volume.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ volume.nas_secure_file_operations }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ volume.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ volume.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_messaging_notifications]
 {%- if volume.notification is mapping %}
diff --git a/cinder/files/newton/cinder.conf.controller.Debian b/cinder/files/newton/cinder.conf.controller.Debian
index 528d8a6..c8f137c 100644
--- a/cinder/files/newton/cinder.conf.controller.Debian
+++ b/cinder/files/newton/cinder.conf.controller.Debian
@@ -110,6 +110,18 @@
 {%- set backup_backend_fragment = "cinder/files/backup_backend/_" + controller.backup.engine + ".conf" %}
 {%- include backup_backend_fragment %}
 {%- endif %}
+{%- if controller.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ controller.nas_secure_file_permissions }}
+{%- endif %}
+{%- if controller.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ controller.nas_secure_file_operations }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ controller.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ controller.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_messaging_notifications]
 {%- if controller.notification is mapping %}
diff --git a/cinder/files/newton/cinder.conf.volume.Debian b/cinder/files/newton/cinder.conf.volume.Debian
index 5a02b87..d5ff9cf 100644
--- a/cinder/files/newton/cinder.conf.volume.Debian
+++ b/cinder/files/newton/cinder.conf.volume.Debian
@@ -99,6 +99,18 @@
 {%- set backup_backend_fragment = "cinder/files/backup_backend/_" + volume.backup.engine + ".conf" %}
 {%- include backup_backend_fragment %}
 {%- endif %}
+{%- if volume.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ volume.nas_secure_file_permissions }}
+{%- endif %}
+{%- if volume.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ volume.nas_secure_file_operations }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ volume.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ volume.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_messaging_notifications]
 {%- if volume.notification is mapping %}
diff --git a/cinder/files/ocata/cinder-wsgi.conf b/cinder/files/ocata/cinder-wsgi.conf
index 3e4de23..153adde 100644
--- a/cinder/files/ocata/cinder-wsgi.conf
+++ b/cinder/files/ocata/cinder-wsgi.conf
@@ -1,6 +1,5 @@
 {%- from "cinder/map.jinja" import controller with context %}
 Listen {{ controller.osapi.host }}:8776
-LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D(us)" cinder_combined
 
 <VirtualHost {{ controller.osapi.host }}:8776>
     WSGIDaemonProcess cinder-wsgi processes=5 threads=1 user=cinder display-name=%{GROUP}
@@ -13,10 +12,10 @@
     </IfVersion>
 
     ErrorLog /var/log/apache2/cinder_error.log
-    CustomLog /var/log/apache2/cinder.log cinder_combined
+    CustomLog /var/log/apache2/cinder.log "%v:%p %h %l %u %t \"%r\" %>s %D %O \"%{Referer}i\" \"%{User-Agent}i\""
 
     <Directory /usr/bin>
-	<IfVersion >= 2.4>
+        <IfVersion >= 2.4>
             Require all granted
         </IfVersion>
         <IfVersion < 2.4>
diff --git a/cinder/files/ocata/cinder.conf.controller.Debian b/cinder/files/ocata/cinder.conf.controller.Debian
index 528d8a6..c8f137c 100644
--- a/cinder/files/ocata/cinder.conf.controller.Debian
+++ b/cinder/files/ocata/cinder.conf.controller.Debian
@@ -110,6 +110,18 @@
 {%- set backup_backend_fragment = "cinder/files/backup_backend/_" + controller.backup.engine + ".conf" %}
 {%- include backup_backend_fragment %}
 {%- endif %}
+{%- if controller.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ controller.nas_secure_file_permissions }}
+{%- endif %}
+{%- if controller.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ controller.nas_secure_file_operations }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ controller.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if controller.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ controller.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_messaging_notifications]
 {%- if controller.notification is mapping %}
diff --git a/cinder/files/ocata/cinder.conf.volume.Debian b/cinder/files/ocata/cinder.conf.volume.Debian
index 5a02b87..d5ff9cf 100644
--- a/cinder/files/ocata/cinder.conf.volume.Debian
+++ b/cinder/files/ocata/cinder.conf.volume.Debian
@@ -99,6 +99,18 @@
 {%- set backup_backend_fragment = "cinder/files/backup_backend/_" + volume.backup.engine + ".conf" %}
 {%- include backup_backend_fragment %}
 {%- endif %}
+{%- if volume.nas_secure_file_permissions is defined %}
+nas_secure_file_permissions={{ volume.nas_secure_file_permissions }}
+{%- endif %}
+{%- if volume.nas_secure_file_operations is defined %}
+nas_secure_file_operations={{ volume.nas_secure_file_operations }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_user_id is defined %}
+cinder_internal_tenant_user_id={{ volume.cinder_internal_tenant_user_id }}
+{%- endif %}
+{%- if volume.cinder_internal_tenant_project_id is defined %}
+cinder_internal_tenant_project_id={{ volume.cinder_internal_tenant_project_id }}
+{%- endif %}
 
 [oslo_messaging_notifications]
 {%- if volume.notification is mapping %}
diff --git a/cinder/map.jinja b/cinder/map.jinja
index a19420a..d0ea11a 100644
--- a/cinder/map.jinja
+++ b/cinder/map.jinja
@@ -81,3 +81,9 @@
         'pkgs': ['python-cinderclient']
     },
 }, merge=pillar.cinder.get('client', {})) %}
+
+{% set monitoring = salt['grains.filter_by']({
+    'default': {
+        'error_log_rate': 0.2,
+    },
+}, grain='os_family', merge=salt['pillar.get']('cinder:monitoring')) %}
diff --git a/cinder/meta/collectd.yml b/cinder/meta/collectd.yml
index 5f0ee4b..ee9a2a9 100644
--- a/cinder/meta/collectd.yml
+++ b/cinder/meta/collectd.yml
@@ -1,12 +1,15 @@
 {%- if pillar.cinder.controller is defined %}
 {%- from "cinder/map.jinja" import controller with context %}
-{%- if pillar.cinder.controller.get('enabled', False) %}
+{%- if controller.get('enabled', False) %}
+{%- if controller.get('osapi') %}
 local_plugin:
   collectd_check_local_endpoint:
     endpoint:
       cinder-api:
         expected_code: {% if controller.version in ('juno', 'kilo', 'liberty') %}200{% else %}300{% endif %}
         url: "http://{{ controller.osapi.host|replace('0.0.0.0', '127.0.0.1') }}:8776/"
+{%- endif %}
+{%- if controller.get('identity') %}
 remote_plugin:
   openstack_cinder:
     plugin: python
@@ -26,3 +29,4 @@
     region: {{ controller.identity.region }}
 {%- endif %}
 {%- endif %}
+{%- endif %}
diff --git a/cinder/meta/heka.yml b/cinder/meta/heka.yml
index 7186c50..5a87914 100644
--- a/cinder/meta/heka.yml
+++ b/cinder/meta/heka.yml
@@ -2,6 +2,7 @@
 {%- from "cinder/map.jinja" import volume as _volume with context %}
 {%- set controller = _controller.get('enabled', False) %}
 {%- set volume = _volume.get('enabled', False) %}
+{%- set apache_wsgi = controller and _controller.version not in ('juno', 'kilo', 'liberty', 'mitaka', 'newton') %}
 log_collector:
   decoder:
     cinder:
@@ -9,6 +10,16 @@
       module_file: /usr/share/lma_collector/decoders/openstack_log.lua
       module_dir: /usr/share/lma_collector/common;/usr/share/heka/lua_modules
       adjust_timezone: true
+{%- if apache_wsgi %}
+    cinder_wsgi:
+      engine: sandbox
+      module_file: /usr/share/lma_collector/decoders/apache_wsgi_log.lua
+      module_dir: /usr/share/lma_collector/common;/usr/share/heka/lua_modules
+      config:
+        logger: openstack.cinder
+        apache_log_pattern: >-
+          %v:%p %h %l %u %t \"%r\" %>s %D %O \"%{Referer}i\" \"%{User-Agent}i\"
+{%- endif %}
   splitter:
     cinder:
       engine: token
@@ -22,6 +33,16 @@
       priority: ["^Seq"]
       decoder: "cinder_decoder"
       splitter: "cinder_splitter"
+{%- if apache_wsgi %}
+    cinder_wsgi_log:
+      engine: logstreamer
+      log_directory: "/var/log/apache2"
+      file_match: 'cinder\.log'
+      differentiator: ['cinder-wsgi']
+      priority: ["^Seq"]
+      decoder: "cinder_wsgi_decoder"
+      splitter: "TokenSplitter"
+{%- endif %}
 metric_collector:
   trigger:
     {%- if controller or volume %}
diff --git a/cinder/meta/prometheus.yml b/cinder/meta/prometheus.yml
index 6269b8a..d655a6f 100644
--- a/cinder/meta/prometheus.yml
+++ b/cinder/meta/prometheus.yml
@@ -1,5 +1,4 @@
-{%- from "cinder/map.jinja" import controller as controller with context %}
-{%- from "cinder/map.jinja" import volume as volume with context %}
+{%- from "cinder/map.jinja" import controller, volume, monitoring with context %}
 {%- set is_controller = controller.get('enabled', False) %}
 {%- set is_volume = volume.get('enabled', False) %}
 
@@ -22,7 +21,7 @@
 {%- endraw %}
 {%- endif %}
     CinderErrorLogsTooHigh:
-      {%- set log_threshold = prometheus_server.get('alert', {}).get('CinderErrorLogsTooHigh', {}).get('var', {}).get('threshold', 0.2 ) %}
+      {%- set log_threshold = monitoring.error_log_rate|float %}
       if: >-
         sum(rate(log_messages{service="cinder",level=~"error|emergency|fatal"}[5m])) without (level) > {{ log_threshold }}
 {%- raw %}
diff --git a/cinder/meta/telegraf.yml b/cinder/meta/telegraf.yml
index c315be5..c626eaf 100644
--- a/cinder/meta/telegraf.yml
+++ b/cinder/meta/telegraf.yml
@@ -1,9 +1,9 @@
 {%- from "cinder/map.jinja" import controller with context %}
-{%- if controller.get('enabled', False) %}
+{%- if controller.get('enabled', False) and controller.get('osapi') %}
 agent:
   input:
     http_response:
       cinder-api:
         address: "http://{{ controller.osapi.host|replace('0.0.0.0', '127.0.0.1') }}:8776/"
         expected_code: {% if controller.version in ('juno', 'kilo', 'liberty') %}200{% else %}300{% endif %}
-{%- endif %}
\ No newline at end of file
+{%- endif %}