fix: tweak glance policy to allow for intra-service image download

Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

Author: cloudnull

base-helm-configs/glance/glance-helm-overrides.yaml

@@ -123,7 +123,9 @@ conf:
     "default": "role:admin or role:glance_admin"
     "context_is_admin": "role:admin or role:glance_admin"
     "publicize_image": "role:glance_admin"
-    "download_image": rule:context_is_admin or (role:member and (project_id:%(project_id)s or project_id:%(member_id)s))
+    "communitize_image": "role:glance_admin"
+    "download_image": "role:service or role:glance_admin or rule:context_is_admin or rule:service_api or (role:member and (project_id:%(project_id)s or project_id:%(member_id)s or 'community':%(visibility)s or 'public':%(visibility)s or 'shared':%(visibility)s))"
+    "get_image":      "role:service or role:glance_admin or rule:context_is_admin or rule:service_api or (role:reader and (project_id:%(project_id)s or project_id:%(member_id)s or 'community':%(visibility)s or 'public':%(visibility)s or 'shared':%(visibility)s))"
   logging:
     logger_root:
       level: INFO