OS::Heat::ResourceGroup validation failed if group "0" is removed

[Istvan Imre]

*Use case*

1) Create a stack with resource group which contains two ("0", "1") OS::Nova::Server.
   Each server has different image, which comes from stack parameters, and indexed by %index% at resource group.

2) Try to update stack with removal policy ["0"], so basically scale-in the first Server.
   Leave out Image parameter for first server due to it will be removed, so we do not need image for a removed server.

It fails with input validation due to image of removed server is not found:
ERROR: Failed to validate: Failed to validate: resources[0]: Neither image nor bootable volume is specified for instance server

+ Even in later updates you need to specify image for the none-existing server.

*Reproduce with stack-create*

main_template.yaml:
---
heat_template_version: 2015-04-30

parameters:
  images:
    type: json
    default: { "1": "cirros" }
resources:

  simple_aspect_group:
    type: OS::Heat::ResourceGroup
    properties:
      count: 1
      removal_policies: [ { "resource_list": ["0"] } ]
      resource_def:
        type: simple.hot.server.yaml
        properties:
          images: { get_param: images }
          rg_index: '%index%'

simple.hot.server.yaml:
---
heat_template_version: 2015-04-30

parameters:
  images:
    type: json
  rg_index:
    type: string
    description: the current index of the resource group ( ex. "0", "2")
    default: invalid

resources:
  server:
    type: OS::Nova::Server
    properties:
      name: {get_param: rg_index}
      flavor: m1.small
      image: { get_param: [ images, {get_param: rg_index} ] }
      networks:
        - network: preservedNetwork

*Bug in the heat code*
https://github.com/openstack/heat/blob/master/heat/engine/resources/openstack/heat/resource_group.py#L281

Here always the group "0" is validated and removal policy is not applied at all.

[Rabi Mishra (rabi)]

Yeah, we should use the first non blacklisted item.

[Rabi Mishra (rabi)]

Honestly such a use of %index% in RG is not generally expected. We only validate the first resource in the group (to avoid unnecessary validation of similar resources). if you use %index% to build image names, only one image would be validated. As I mentioned above we can validate the first non-blacklisted resource.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/464533

[Istvan Imre (istvan.imre)]

Hi Rabi,

The image name was just an example. If you for example distribute fixed IPs or some other parameters which is verified in the sub-stack that could cause same problem about template validation.

Br,
István

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/464533
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=655fd8f53d4bf416c99114eacde12beed1f5cc3f
Submitter: Jenkins
Branch: master

commit 655fd8f53d4bf416c99114eacde12beed1f5cc3f
Author: rabi <email address hidden>
Date: Fri May 12 19:20:17 2017 +0530

    Use non-blacklisted resources for RG validation

    We should validate first of the non-blacklisted resources
    in the group.

    Change-Id: I1d15cb238125aff6c211f84b16da105d91fb4127
    Closes-Bug: #1690369

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/heat 9.0.0.0b2 development milestone.