Ability to enable/disable debug mode per OpenStack service

Add ServiceDebug parameters for each services that will allow operators to enable/disable Debug for specific services. We keep the Debug parameters for backward compatibility. Operators want to enable Debug everywhere: Debug: true Operators want to disable Debug everywhere: Debug: false Operators want to disable Debug everywhere except Glance: GlanceDebug: true Operators want to enable Debug everywhere except Glance: Debug: true GlanceDebug: false New parameters: AodhDebug, BarbicanDebug, CeilometerDebug, CinderDebug, CongressDebug, GlanceDebug, GnocchiDebug, HeatDebug, HorizonDebug, IronicDebug, KeystoneDebug, ManilaDebug, MistralDebug, NeutronDebug, NovaDebug, OctaviaDebug, PankoDebug, SaharaDebug, TackerDebug, ZaqarDebug. Note: for backward compatibility in Horizon, HorizonDebug is set to false, so we maintain previous behavior. Change-Id: Icbf4a38afcdbd8471d1afc11743df9705451db52 Implement-blueprint: composable-debug Closes-Bug: #1634567
2017-05-24 13:42:07 -04:00 · 2017-05-24 13:42:07 -04:00 · 1e899703cc
parent da86aacb66
commit 1e899703cc
21 changed files with 235 additions and 27 deletions
--- a/puppet/services/aodh-base.yaml
+++ b/puppet/services/aodh-base.yaml
@ -56,11 +56,18 @@ parameters:
    default: ''
    description: Set to True to enable debugging on all services.
    type: string
+  AodhDebug:
+    default: ''
+    description: Set to True to enable debugging Aodh services.
+    type: string
  KeystoneRegion:
    type: string
    default: 'regionOne'
    description: Keystone region for endpoint

+conditions:
+  service_debug_unset: {equals : [{get_param: AodhDebug}, '']}
+
 outputs:
  role_data:
    description: Role data for the Aodh role.
@ -78,7 +85,11 @@ outputs:
            query:
              read_default_file: /etc/my.cnf.d/tripleo.cnf
              read_default_group: tripleo
-        aodh::debug: {get_param: Debug}
+        aodh::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: AodhDebug }
        aodh::auth::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] }
        aodh::rabbit_userid: {get_param: RabbitUserName}
        aodh::rabbit_password: {get_param: RabbitPassword}
--- a/puppet/services/barbican-api.yaml
+++ b/puppet/services/barbican-api.yaml
@ -38,6 +38,10 @@ parameters:
    default: ''
    description: Set to True to enable debugging on all services.
    type: string
+  BarbicanDebug:
+    default: ''
+    description: Set to True to enable debugging Barbican service.
+    type: string
  KeystoneRegion:
    type: string
    default: 'regionOne'
@ -81,6 +85,9 @@ resources:
      RoleName: {get_param: RoleName}
      RoleParameters: {get_param: RoleParameters}

+conditions:
+  service_debug_unset: {equals : [{get_param: BarbicanDebug}, '']}
+
 outputs:
  role_data:
    description: Role data for the Barbican API role.
@ -97,7 +104,11 @@ outputs:
            barbican::api::host_href: {get_param: [EndpointMap, BarbicanPublic, uri]}
            barbican::api::db_auto_create: false
            barbican::api::enabled_certificate_plugins: ['simple_certificate']
-            barbican::api::logging::debug: {get_param: Debug}
+            barbican::api::logging::debug:
+              if:
+              - service_debug_unset
+              - {get_param: Debug }
+              - {get_param: BarbicanDebug }
            barbican::api::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
            barbican::api::rabbit_userid: {get_param: RabbitUserName}
            barbican::api::rabbit_password: {get_param: RabbitPassword}
--- a/puppet/services/ceilometer-base.yaml
+++ b/puppet/services/ceilometer-base.yaml
@ -64,6 +64,10 @@ parameters:
    default: ''
    description: Set to True to enable debugging on all services.
    type: string
+  CeilometerDebug:
+    default: ''
+    description: Set to True to enable debugging Ceilometer services.
+    type: string
  KeystoneRegion:
    type: string
    default: 'regionOne'
@ -100,13 +104,20 @@ parameters:
    type: string
    hidden: true

+conditions:
+  service_debug_unset: {equals : [{get_param: CeilometerDebug}, '']}
+
 outputs:
  role_data:
    description: Role data for the Ceilometer role.
    value:
      service_name: ceilometer_base
      config_settings:
-        ceilometer::debug: {get_param: Debug}
+        ceilometer::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: CeilometerDebug }
        ceilometer::keystone::authtoken::project_name: 'service'
        ceilometer::keystone::authtoken::user_domain_name: 'Default'
        ceilometer::keystone::authtoken::project_domain_name: 'Default'
--- a/puppet/services/cinder-base.yaml
+++ b/puppet/services/cinder-base.yaml
@ -12,6 +12,10 @@ parameters:
    default: ''
    description: Set to True to enable debugging on all services.
    type: string
+  CinderDebug:
+    default: ''
+    description: Set to True to enable debugging on Cinder services.
+    type: string
  ServiceNetMap:
    default: {}
    description: Mapping of service_name -> network name. Typically set
@ -93,6 +97,9 @@ parameters:
        Cron to move deleted instances to another table - Log destination
    default: '/var/log/cinder/cinder-rowsflush.log'

+conditions:
+  service_debug_unset: {equals : [{get_param: CinderDebug}, '']}
+
 outputs:
  role_data:
    description: Role data for the Cinder base service.
@ -109,7 +116,11 @@ outputs:
            query:
              read_default_file: /etc/my.cnf.d/tripleo.cnf
              read_default_group: tripleo
-        cinder::debug: {get_param: Debug}
+        cinder::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: CinderDebug }
        cinder::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
        cinder::rabbit_userid: {get_param: RabbitUserName}
        cinder::rabbit_password: {get_param: RabbitPassword}
--- a/puppet/services/congress.yaml
+++ b/puppet/services/congress.yaml
@ -33,6 +33,10 @@ parameters:
  Debug:
    type: string
    default: ''
+  CongressDebug:
+    default: ''
+    description: Set to True to enable debugging Glance service.
+    type: string
  KeystoneRegion:
    type: string
    default: 'regionOne'
@ -62,6 +66,9 @@ parameters:
    default: {}
    type: json

+conditions:
+  service_debug_unset: {equals : [{get_param: CongressDebug}, '']}
+
 outputs:
  role_data:
    description: Role data for the Congress role.
@ -79,7 +86,11 @@ outputs:
            query:
              read_default_file: /etc/my.cnf.d/tripleo.cnf
              read_default_group: tripleo
-        congress::debug: {get_param: Debug}
+        congress::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: CongressDebug }
        congress::rpc_backend: rabbit
        congress::rabbit_userid: {get_param: RabbitUserName}
        congress::rabbit_password: {get_param: RabbitPassword}
--- a/puppet/services/glance-api.yaml
+++ b/puppet/services/glance-api.yaml
@ -30,6 +30,10 @@ parameters:
    default: ''
    description: Set to True to enable debugging on all services.
    type: string
+  GlanceDebug:
+    default: ''
+    description: Set to True to enable debugging Glance service.
+    type: string
  GlancePassword:
    description: The password for the glance service and db account, used by the glance services.
    type: string
@ -59,10 +63,6 @@ parameters:
  CephClientUserName:
    default: openstack
    type: string
-  Debug:
-    default: ''
-    description: Set to True to enable debugging on all services.
-    type: string
  GlanceNotifierStrategy:
    description: Strategy to use for Glance notification queue
    type: string
@ -128,6 +128,7 @@ parameters:
 conditions:
  use_tls_proxy: {equals : [{get_param: EnableInternalTLS}, true]}
  glance_workers_unset: {equals : [{get_param: GlanceWorkers}, '']}
+  service_debug_unset: {equals : [{get_param: GlanceDebug}, '']}

 resources:

@ -170,7 +171,11 @@ outputs:
            glance::api::enable_v2_api: true
            glance::api::authtoken::password: {get_param: GlancePassword}
            glance::api::enable_proxy_headers_parsing: true
-            glance::api::debug: {get_param: Debug}
+            glance::api::debug:
+              if:
+              - service_debug_unset
+              - {get_param: Debug }
+              - {get_param: GlanceDebug }
            glance::policy::policies: {get_param: GlanceApiPolicies}
            tripleo.glance_api.firewall_rules:
              '112 glance_api':
--- a/puppet/services/gnocchi-base.yaml
+++ b/puppet/services/gnocchi-base.yaml
@ -52,6 +52,13 @@ parameters:
    type: string
    default: ''
    description: Set to True to enable debugging on all services.
+  GnocchiDebug:
+    default: ''
+    description: Set to True to enable debugging Gnocchi services.
+    type: string
+
+conditions:
+  service_debug_unset: {equals : [{get_param: GnocchiDebug}, '']}

 outputs:
  aux_parameters:
@ -65,7 +72,11 @@ outputs:
      config_settings:
        #Gnocchi engine
        gnocchi_redis_password: {get_param: RedisPassword}
-        gnocchi::debug: {get_param: Debug}
+        gnocchi::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: GnocchiDebug }
        gnocchi::db::database_connection:
          make_url:
            scheme: {get_param: [EndpointMap, MysqlInternal, protocol]}
--- a/puppet/services/heat-base.yaml
+++ b/puppet/services/heat-base.yaml
@ -8,6 +8,10 @@ parameters:
    default: ''
    description: Set to True to enable debugging on all services.
    type: string
+  HeatDebug:
+    default: ''
+    description: Set to True to enable debugging Heat services.
+    type: string
  RabbitPassword:
    description: The password for RabbitMQ
    type: string
@ -112,6 +116,9 @@ parameters:
    description: Maximum raw byte size of the Heat API JSON request body.
    type: number

+conditions:
+  service_debug_unset: {equals : [{get_param: HeatDebug}, '']}
+
 outputs:
  role_data:
    description: Shared role data for the Heat services.
@ -122,7 +129,11 @@ outputs:
        heat::rabbit_password: {get_param: RabbitPassword}
        heat::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
        heat::rabbit_port: {get_param: RabbitClientPort}
-        heat::debug: {get_param: Debug}
+        heat::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: HeatDebug }
        heat::enable_proxy_headers_parsing: true
        heat::rpc_response_timeout: 600
        # We need this because the default heat policy.json no longer works on TripleO
--- a/puppet/services/horizon.yaml
+++ b/puppet/services/horizon.yaml
@ -14,6 +14,10 @@ parameters:
    default: ''
    description: Set to True to enable debugging on all services.
    type: string
+  HorizonDebug:
+    default: false
+    description: Set to True to enable debugging Horizon service.
+    type: string
  DefaultPasswords:
    default: {}
    type: json
@ -62,7 +66,7 @@ parameters:

 conditions:

-  debug_empty: {equals : [{get_param: Debug}, '']}
+  debug_unset: {equals : [{get_param: Debug}, '']}

 outputs:
  role_data:
@ -104,9 +108,9 @@ outputs:
          memcached_ipv6: {get_param: MemcachedIPv6}
        -
          if:
-          - debug_empty
-          - {}
-          - horizon::django_debug: {get_param: Debug}
+          - debug_unset
+          - horizon::django_debug: { get_param: HorizonDebug }
+          - horizon::django_debug: { get_param: Debug }
      step_config: |
        include ::tripleo::profile::base::horizon
      # Ansible tasks to handle upgrade
--- a/puppet/services/ironic-base.yaml
+++ b/puppet/services/ironic-base.yaml
@ -30,6 +30,10 @@ parameters:
    default: ''
    description: Set to True to enable debugging on all services.
    type: string
+  IronicDebug:
+    default: ''
+    description: Set to True to enable debugging Ironic services.
+    type: string
  IronicPassword:
    description: The password for the Ironic service and db account, used by the Ironic services
    type: string
@ -53,6 +57,9 @@ parameters:
        an SSL connection to the RabbitMQ host.
    type: string

+conditions:
+  service_debug_unset: {equals : [{get_param: IronicDebug}, '']}
+
 outputs:
  role_data:
    description: Role data for the Ironic role.
@ -69,7 +76,11 @@ outputs:
            query:
              read_default_file: /etc/my.cnf.d/tripleo.cnf
              read_default_group: tripleo
-        ironic::debug: {get_param: Debug}
+        ironic::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: IronicDebug }
        ironic::rabbit_userid: {get_param: RabbitUserName}
        ironic::rabbit_password: {get_param: RabbitPassword}
        ironic::rabbit_port: {get_param: RabbitClientPort}
--- a/puppet/services/keystone.yaml
+++ b/puppet/services/keystone.yaml
@ -63,6 +63,10 @@ parameters:
  Debug:
    type: string
    default: ''
+  KeystoneDebug:
+    default: ''
+    description: Set to True to enable debugging Keystone service.
+    type: string
  AdminEmail:
    default: 'admin@example.com'
    description: The email for the keystone admin account.
@ -198,6 +202,7 @@ resources:
 conditions:
  keystone_fernet_tokens: {equals: [{get_param: KeystoneTokenProvider}, "fernet"]}
  keystone_ldap_domain_enabled: {equals: [{get_param: KeystoneLDAPDomainEnable}, True]}
+  service_debug_unset: {equals : [{get_param: KeystoneDebug}, '']}

 outputs:
  role_data:
@ -242,7 +247,11 @@ outputs:
              '/etc/keystone/fernet-keys/1':
                content: {get_param: KeystoneFernetKey1}
            keystone::fernet_replace_keys: false
-            keystone::debug: {get_param: Debug}
+            keystone::debug:
+              if:
+              - service_debug_unset
+              - {get_param: Debug }
+              - {get_param: KeystoneDebug }
            keystone::rabbit_userid: {get_param: RabbitUserName}
            keystone::rabbit_password: {get_param: RabbitPassword}
            keystone::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
--- a/puppet/services/manila-base.yaml
+++ b/puppet/services/manila-base.yaml
@ -30,6 +30,10 @@ parameters:
    default: ''
    description: Set to True to enable debugging on all services.
    type: string
+  ManilaDebug:
+    default: ''
+    description: Set to True to enable debugging Manila services.
+    type: string
  RabbitPassword:
    description: The password for RabbitMQ
    type: string
@ -53,6 +57,9 @@ parameters:
    type: string
    hidden: true

+conditions:
+  service_debug_unset: {equals : [{get_param: ManilaDebug}, '']}
+
 outputs:
  role_data:
    description: Role data for the Manila Base service.
@ -63,7 +70,11 @@ outputs:
        manila::rabbit_password: {get_param: RabbitPassword}
        manila::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
        manila::rabbit_port: {get_param: RabbitClientPort}
-        manila::debug: {get_param: Debug}
+        manila::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: ManilaDebug }
        manila::db::database_db_max_retries: -1
        manila::db::database_max_retries: -1
        manila::sql_connection:
--- a/puppet/services/mistral-base.yaml
+++ b/puppet/services/mistral-base.yaml
@ -31,6 +31,10 @@ parameters:
    default: ''
    description: Set to True to enable debugging on all services.
    type: string
+  MistralDebug:
+    default: ''
+    description: Set to True to enable debugging Mistral services.
+    type: string
  RabbitPassword:
    description: The password for RabbitMQ
    type: string
@ -58,6 +62,9 @@ parameters:
    default: 'regionOne'
    description: Keystone region for endpoint

+conditions:
+  service_debug_unset: {equals : [{get_param: MistralDebug}, '']}
+
 outputs:
  role_data:
    description: Shared role data for the Mistral services.
@ -78,7 +85,11 @@ outputs:
        mistral::rabbit_password: {get_param: RabbitPassword}
        mistral::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
        mistral::rabbit_port: {get_param: RabbitClientPort}
-        mistral::debug: {get_param: Debug}
+        mistral::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: MistralDebug }
        mistral::keystone_password: {get_param: MistralPassword}
        mistral::keystone_tenant: 'service'
        mistral::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri]}
--- a/puppet/services/neutron-base.yaml
+++ b/puppet/services/neutron-base.yaml
@ -50,6 +50,10 @@ parameters:
    type: string
    default: ''
    description: Set to True to enable debugging on all services.
+  NeutronDebug:
+    default: ''
+    description: Set to True to enable debugging Neutron services.
+    type: string
  EnableConfigPurge:
    type: boolean
    default: false
@ -90,6 +94,7 @@ parameters:

 conditions:
  dhcp_agents_zero: {equals : [{get_param: NeutronDhcpAgentsPerNetwork}, 0]}
+  service_debug_unset: {equals : [{get_param: NeutronDebug}, '']}

 outputs:
  role_data:
@ -104,7 +109,11 @@ outputs:
            neutron::rabbit_port: {get_param: RabbitClientPort}
            neutron::core_plugin: {get_param: NeutronCorePlugin}
            neutron::service_plugins: {get_param: NeutronServicePlugins}
-            neutron::debug: {get_param: Debug}
+            neutron::debug:
+              if:
+              - service_debug_unset
+              - {get_param: Debug }
+              - {get_param: NeutronDebug }
            neutron::purge_config: {get_param: EnableConfigPurge}
            neutron::allow_overlapping_ips: true
            neutron::dns_domain: {get_param: NeutronDnsDomain}
--- a/puppet/services/nova-base.yaml
+++ b/puppet/services/nova-base.yaml
@ -68,6 +68,10 @@ parameters:
    type: string
    default: ''
    description: Set to True to enable debugging on all services.
+  NovaDebug:
+    default: ''
+    description: Set to True to enable debugging Nova services.
+    type: string
  EnableConfigPurge:
    type: boolean
    default: false
@ -136,6 +140,7 @@ parameters:
 conditions:

  compute_upgrade_level_empty: {equals : [{get_param: UpgradeLevelNovaCompute}, '']}
+  service_debug_unset: {equals : [{get_param: NovaDebug}, '']}

 outputs:
  role_data:
@ -193,7 +198,11 @@ outputs:
              query:
                read_default_file: /etc/my.cnf.d/tripleo.cnf
                read_default_group: tripleo
-          nova::debug: {get_param: Debug}
+          nova::debug:
+            if:
+            - service_debug_unset
+            - {get_param: Debug }
+            - {get_param: NovaDebug }
          nova::purge_config: {get_param: EnableConfigPurge}
          nova::network::neutron::neutron_project_name: 'service'
          nova::network::neutron::neutron_username: 'neutron'
--- a/puppet/services/octavia-base.yaml
+++ b/puppet/services/octavia-base.yaml
@ -30,6 +30,10 @@ parameters:
    type: string
    default: ''
    description: Set to True to enable debugging on all services.
+  OctaviaDebug:
+    default: ''
+    description: Set to True to enable debugging Octavia services.
+    type: string
  EnableConfigPurge:
    type: boolean
    default: false
@ -55,13 +59,20 @@ parameters:
    description: Set rabbit subscriber port, change this if using SSL
    type: number

+conditions:
+  service_debug_unset: {equals : [{get_param: OctaviaDebug}, '']}
+
 outputs:
  role_data:
    description: Base role data for Octavia services
    value:
       service_name: octavia_base
       config_settings:
-         octavia::debug: {get_param: Debug}
+         octavia::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: OctaviaDebug }
         octavia::purge_config: {get_param: EnableConfigPurge}
         octavia::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
         octavia::rabbit_userid: {get_param: RabbitUserName}
--- a/puppet/services/panko-base.yaml
+++ b/puppet/services/panko-base.yaml
@ -34,11 +34,18 @@ parameters:
    default: ''
    description: Set to True to enable debugging on all services.
    type: string
+  PankoDebug:
+    default: ''
+    description: Set to True to enable debugging Panko services.
+    type: string
  KeystoneRegion:
    type: string
    default: 'regionOne'
    description: Keystone region for endpoint

+conditions:
+  service_debug_unset: {equals : [{get_param: PankoDebug}, '']}
+
 outputs:
  role_data:
    description: Role data for the Panko role.
@ -55,7 +62,11 @@ outputs:
            query:
              read_default_file: /etc/my.cnf.d/tripleo.cnf
              read_default_group: tripleo
-        panko::debug: {get_param: Debug}
+        panko::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: PankoDebug }
        panko::auth::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix] }
        panko::keystone::authtoken::project_name: 'service'
        panko::keystone::authtoken::user_domain_name: 'Default'
--- a/puppet/services/sahara-base.yaml
+++ b/puppet/services/sahara-base.yaml
@ -52,11 +52,18 @@ parameters:
    type: string
    default: ''
    description: Set to True to enable debugging on all services.
+  SaharaDebug:
+    default: ''
+    description: Set to True to enable debugging Sahara services.
+    type: string
  SaharaPlugins:
    default: ["ambari","cdh","mapr","vanilla","spark","storm"]
    description: Sahara enabled plugin list
    type: comma_delimited_list

+conditions:
+  service_debug_unset: {equals : [{get_param: SaharaDebug}, '']}
+
 outputs:
  role_data:
    description: Role data for the Sahara base service.
@ -77,7 +84,11 @@ outputs:
        sahara::rabbit_user: {get_param: RabbitUserName}
        sahara::rabbit_use_ssl: {get_param: RabbitClientUseSSL}
        sahara::rabbit_port: {get_param: RabbitClientPort}
-        sahara::debug: {get_param: Debug}
+        sahara::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: SaharaDebug }
        # Remove admin_password when https://review.openstack.org/442619 is merged.
        sahara::admin_password: {get_param: SaharaPassword}
        sahara::use_neutron: true
--- a/puppet/services/tacker.yaml
+++ b/puppet/services/tacker.yaml
@ -33,6 +33,10 @@ parameters:
  Debug:
    type: string
    default: ''
+  TackerDebug:
+    default: ''
+    description: Set to True to enable debugging Tacker service.
+    type: string
  KeystoneRegion:
    type: string
    default: 'regionOne'
@ -62,6 +66,9 @@ parameters:
    default: {}
    type: json

+conditions:
+  service_debug_unset: {equals : [{get_param: TackerDebug}, '']}
+
 outputs:
  role_data:
    description: Role data for the Tacker role.
@ -80,7 +87,11 @@ outputs:
              read_default_file: /etc/my.cnf.d/tripleo.cnf
              read_default_group: tripleo

-        tacker::debug: {get_param: Debug}
+        tacker::debug:
+          if:
+          - service_debug_unset
+          - {get_param: Debug }
+          - {get_param: TackerDebug }
        tacker::rpc_backend: rabbit
        tacker::rabbit_userid: {get_param: RabbitUserName}
        tacker::rabbit_password: {get_param: RabbitPassword}
--- a/puppet/services/zaqar.yaml
+++ b/puppet/services/zaqar.yaml
@ -30,6 +30,10 @@ parameters:
    default: ''
    description: Set to True to enable debugging on all services.
    type: string
+  ZaqarDebug:
+    default: ''
+    description: Set to True to enable debugging Zaqar service.
+    type: string
  ZaqarPassword:
    description: The password for Zaqar
    type: string
@ -54,6 +58,7 @@ parameters:

 conditions:
  zaqar_workers_zero: {equals : [{get_param: ZaqarWorkers}, 0]}
+  service_debug_unset: {equals : [{get_param: ZaqarDebug}, '']}

 resources:

@ -78,7 +83,11 @@ outputs:
            zaqar::keystone::authtoken::project_name: 'service'
            zaqar::keystone::authtoken::auth_url: {get_param: [EndpointMap, KeystoneInternal, uri_no_suffix]}
            zaqar::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri]}
-            zaqar::debug: {get_param: Debug}
+            zaqar::debug:
+              if:
+              - service_debug_unset
+              - {get_param: Debug }
+              - {get_param: ZaqarDebug }
            zaqar::server::service_name: 'httpd'
            zaqar::transport::websocket::bind: {get_param: [EndpointMap, ZaqarInternal, host]}
            zaqar::wsgi::apache::ssl: false
--- a/releasenotes/notes/debug_per_service-54a260917c4a7e3a.yaml
+++ b/releasenotes/notes/debug_per_service-54a260917c4a7e3a.yaml
@ -0,0 +1,9 @@
+---
+features:
+  - |
+    Allow to configure debug per service.
+    The feature is backward compatible with existing Debug parameter.
+    Adding a new parameter per service, e.g. GlanceDebug. Set to False,
+    it will disable debug for the service, even if Debug is set to True.
+    If Debug is set to False but GlanceDebug is set to True, Glance debug
+    will be enabled.