This is a specless blueprint for adding service token to be used to solve the user token expiration issue for long running tasks.

Some operations in Cinder could take a long time to complete. During this
time user token associated with this request could expire. When Cinder tries
to communicate with other services using the same user token, Keystone fails
to validate the request due to expired token.
Service token will be passed along with user token to communicate with
cross projects services when dealing with long running tasks like:

Glance service:
Create image by volume
Create volume by image

Nova service:
update_server_volume
create_volume_snapshot
delete_volume_snapshot

Keystone middleware trusts that the service got the user token when
it was valid, don't check the expiry date of cert.

P.S: Service token is already used by nova for interacting with glance which is implemented by this BP: https://blueprints.launchpad.net/nova/+spec/use-service-tokens-pike.
The below long pending blueprint also solves the same problem, but their design is totally different from ours.https://blueprints.launchpad.net/cinder/+spec/image-trust-authentication