Validation prevents indirect references in provider templates

Bug #1407100 reported by Steven Hardy
30
This bug affects 4 people
Affects Status Importance Assigned to Milestone
OpenStack Heat
Fix Released
High
Randall Burt

Bug Description

Since https://github.com/openstack/heat/commit/8a56cafe2b99b39d1ad5705b9ad1a85b4781f76e we validate that the server id is correct for various resources, and in particular SoftwareDeployment now validates the server property.

This works OK when the deployment and server exist in the same stack, but in the event you want to abstract the server configuration by putting SoftwareDeployment(s) into a provider template, we eagerly validate and fail because prior to creating the provider resource, the server doesn't exist so the default resource name is passed instead.

This is breaking a pattern TripleO wish to adopt where SoftwareConfig and SoftwareDeployment resources are abstracted via provider templates to enable alternate impementations to be easily substituted.

Reproducer:

$ cat example-script-provider.yaml
heat_template_version: 2013-05-23
parameters:
  key_name:
    type: string
    default: default
  flavor:
    type: string
    default: m1.small
  image:
    type: string
    default: fedora-software-config

resources:
  config:
    type: My::Config
    properties:
        server: {get_resource: server}

  server:
    type: OS::Nova::Server
    properties:
      image: {get_param: image}
      flavor: {get_param: flavor}
      key_name: {get_param: key_name}
      user_data_format: SOFTWARE_CONFIG

$ cat example-script-env.yaml
resource_registry:
    My::Config: example-script-config.yaml

$ cat example-script-config.yaml
heat_template_version: 2013-05-23
parameters:
  server:
    type: string

resources:
  config:
    type: OS::Heat::SoftwareConfig
    properties:
      group: script
      inputs:
      - name: foo
      - name: bar
      outputs:
      - name: result
      config:
        get_file: config-scripts/example-script.sh

  deployment:
    type: OS::Heat::SoftwareDeployment
    properties:
      config:
        get_resource: config
      server:
        get_param: server
      input_values:
        foo: fooooo2
        bar: baaaaa34

$ heat stack-create sc2 -f example-script-provider.yaml -e example-script-env.yaml
ERROR: Failed to validate: Property error : deployment: server Error validating value u'server': The server (server) could not be found.

Tags: tripleo
Steven Hardy (shardy)
Changed in heat:
importance: Undecided → High
assignee: nobody → Steven Hardy (shardy)
status: New → Triaged
tags: added: tripleo
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to heat (master)

Fix proposed to branch: master
Review: https://review.openstack.org/144766

Changed in heat:
status: Triaged → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Fix proposed to branch: master
Review: https://review.openstack.org/144804

Angus Salkeld (asalkeld)
Changed in heat:
milestone: none → kilo-2
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to heat (master)

Reviewed: https://review.openstack.org/144804
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=35853f5223bd91e76b2064bc47b04c0caccaed6b
Submitter: Jenkins
Branch: master

commit 35853f5223bd91e76b2064bc47b04c0caccaed6b
Author: Steven Hardy <email address hidden>
Date: Fri Jan 2 18:16:40 2015 +0000

    Add a strict_validate flag to Stacks

    Enables optionally disabling strict validation, which atm just
    disables the value part of properties validation.

    This is needed for a similar reason to bug #1347571, which
    conditionally disables value validation when inter-resource
    references cause a default pre-create value to be evaluated by
    a custom constraint (e.g the default resource name returned by
    get_resource until a resource is actually created).

    This flag enables a similar fix for StackResource, so we avoid
    strictly validating before create, otherwise the nested stack
    validation fails when the default resource name is passed in
    during validation, even though create-time validation would succeed.

    Change-Id: I80b5b8969007319e9a8fa1d104f4eb4fcbf7ebad
    Partial-Bug: #1407100

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to heat (master)

Fix proposed to branch: master
Review: https://review.openstack.org/145589

Changed in heat:
assignee: Steven Hardy (shardy) → Randall Burt (randall-burt)
Changed in heat:
assignee: Randall Burt (randall-burt) → Steven Hardy (shardy)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on heat (master)

Change abandoned by Randall Burt (<email address hidden>) on branch: master
Review: https://review.openstack.org/145589

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to heat (master)

Fix proposed to branch: master
Review: https://review.openstack.org/145617

Changed in heat:
assignee: Steven Hardy (shardy) → Randall Burt (randall-burt)
Steven Hardy (shardy)
Changed in heat:
assignee: Randall Burt (randall-burt) → Steven Hardy (shardy)
Steven Hardy (shardy)
summary: - Validation prevents SoftwareDeployments in provider templates
+ Validation prevents indirect references in provider templates
Changed in heat:
assignee: Steven Hardy (shardy) → Randall Burt (randall-burt)
Changed in heat:
assignee: Randall Burt (randall-burt) → Steven Hardy (shardy)
Changed in heat:
assignee: Steven Hardy (shardy) → Randall Burt (randall-burt)
Changed in heat:
assignee: Randall Burt (randall-burt) → Steven Hardy (shardy)
Changed in heat:
assignee: Steven Hardy (shardy) → Randall Burt (randall-burt)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to heat (master)

Reviewed: https://review.openstack.org/144766
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=f3f9d68fc13d192650f1e4dca484da2efa635a38
Submitter: Jenkins
Branch: master

commit f3f9d68fc13d192650f1e4dca484da2efa635a38
Author: Steven Hardy <email address hidden>
Date: Mon Jan 12 16:32:56 2015 +0000

    Make StackResource less strict on initial validation

    When doing the initial validate(), skip validating values by setting
    the stack strict_validate to False, otherwise we incorrectly fail
    validation when values are passed in via properties/parameters which
    refer to resources in the parent stack.

    Co-Authored-by: Angus Salkeld <email address hidden>
    Change-Id: Ib75c2de6c32373de72901b9f7c5e3828bd9ee7d9
    Closes-Bug: #1407100
    Closes-Bug: #1407877
    Closes-Bug: #1405446

Changed in heat:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Reviewed: https://review.openstack.org/145617
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=ee3919823074d1c6440f087edc355d0534722d7a
Submitter: Jenkins
Branch: master

commit ee3919823074d1c6440f087edc355d0534722d7a
Author: Randall Burt <email address hidden>
Date: Wed Jan 7 16:46:08 2015 -0600

    Account for nested stack validation in ResourceGroup

    Due to the changes in StackResource, no special validation is
    needed in ResourceGroup anymore given that the parent class
    validates the nested template and also therefore accounts for
    0-count groups.

    Partial-Bug: #1407100
    Change-Id: Id80f24a0fbc86645e46cf9667d830c7a56bb2a12

Thierry Carrez (ttx)
Changed in heat:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in heat:
milestone: kilo-2 → 2015.1.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.