nested validation requires parameters, but they are not accepted

[Steven Hardy]

The new template-validate --show-nested mode enables validation of more complex structures of templates, however in this mode, validate fails if mandatory paramters aren't provided (normally this is not required for the non-nested mode).

Attempting to pass the parameters fails (unless you put them in an environment file) because heatclient doesn't parse them for template-validate.

[stack@instack tripleo-heat-templates]$ heat template-validate --show-nested -f overcloud-without-mergepy.yaml -e overcloud-resource-registry-puppet.yaml -e keystone_pki.json -e environments/enable-tls.yaml -e environments/inject-trust-anchor-red-hat.yaml ERROR: The Parameter (OvercloudBlockStorageFlavor) was not provided.

[stack@instack tripleo-heat-templates]$ heat template-validate --show-nested -f overcloud-without-mergepy.yaml -e overcloud-resource-registry-puppet.yaml -e keystone_pki.json -e environments/enable-tls.yaml -e environments/inject-trust-anchor-red-hat.yaml -P "OvercloudBlockStorageFlavor=baremetal"
usage: heat [--version] [-d] [-v] [--api-timeout API_TIMEOUT]
            [--os-no-client-auth] [--heat-url HEAT_URL]
            [--heat-api-version HEAT_API_VERSION] [--include-password] [-k]
            [--os-cert OS_CERT] [--cert-file OS_CERT] [--os-key OS_KEY]
            [--key-file OS_KEY] [--os-cacert <ca-certificate-file>]
            [--ca-file OS_CACERT] [--os-username OS_USERNAME]
            [--os-user-id OS_USER_ID] [--os-user-domain-id OS_USER_DOMAIN_ID]
            [--os-user-domain-name OS_USER_DOMAIN_NAME]
            [--os-project-id OS_PROJECT_ID]
            [--os-project-name OS_PROJECT_NAME]
            [--os-project-domain-id OS_PROJECT_DOMAIN_ID]
            [--os-project-domain-name OS_PROJECT_DOMAIN_NAME]
            [--os-password OS_PASSWORD] [--os-tenant-id OS_TENANT_ID]
            [--os-tenant-name OS_TENANT_NAME] [--os-auth-url OS_AUTH_URL]
            [--os-region-name OS_REGION_NAME] [--os-auth-token OS_AUTH_TOKEN]
            [--os-service-type OS_SERVICE_TYPE]
            [--os-endpoint-type OS_ENDPOINT_TYPE] [--profile HMAC_KEY]
            <subcommand> ...
heat: error: unrecognized arguments: -P OvercloudBlockStorageFlavor=baremetal

The workaround is to put the parameters into an environment file.

[Steven Hardy (shardy)]

So, some IRC discussion highlights there are several issues:

1. As reported above, passing required parameters doesn't work unless in an environment file

2. Parameters shouldn't be required anyway, we should tolerate them being missing like in the non-nested case, but I guess end up with "Value": None in the NestedParameters.

3. Parameters passed via referencing an attribute in the parent temlate don't work as expected (there is no "Value" in the NestedParameters", e.g here

https://github.com/openstack/tripleo-heat-templates/blob/master/overcloud.yaml#L1426

we pass blockstorage_servers: {get_attr: [BlockStorage, attributes, nova_server_resource]} to AllNodesExtraConfig, but in the NestedParameters it looks like this:

"NestedParameters": {
      "AllNodesExtraConfig": {
        "Description": "Noop extra config for allnodes extra cluster config\n",
        "Parameters": {
          "blockstorage_servers": {
            "Description": "",
            "Label": "blockstorage_servers",
            "NoEcho": "false",
            "Type": "Json"
          },

Note, no "Value", despite being passed in from the parent, so we need a way to work out a dummy result from the get_attr which will be interpreted as a value for the nested template.

Some cases do work tho, e.g

      "AllNodesValidationConfig": {
        "Description": "Software Config to drive validations that occur on all nodes. Note, you need the heat-config-script element built into your images, due to the script group below.\n",
        "Parameters": {
          "PingTestIps": {
            "Default": "",
            "Description": "A string containing a space separated list of IP addresses used to ping test each available network interface.",
            "Label": "PingTestIps",
            "NoEcho": "false",
            "Type": "String",
            "Value": " "
          }
        },

Here we can see the output of the list_join passing through OK, presumably because it doesn't evaluate to None.

Examples above are from validation of tripleo-heat-templates.

[Jay Dobies (jdob)]

Just a quick clarification, this is only an issue when the nested stack is in a resource group. The following validates correctly:

  heat_template_version: 2015-04-30
  parameters:
    top-level:
      type: string

  resources:
    nested-1:
      type: jdob::Nested1
      properties:
        nested-1-param: {get_param: top-level}

(I won't include the nested stack, but it simply takes a parameter named nested-1-param and has a dummy resource)

That example validates with and without --show-nested. I played around with setting parameter values in a few ways and it seemed to work correctly (I do have to look more closely at #3 that Steve described above).

What *doesn't* work is the same set up when resource groups are used:

  heat_template_version: 2015-04-30
  parameters:
    top-level:
      type: string

  resources:
    nested-group:
      type: OS::Heat::ResourceGroup
      properties:
        count: 1
        resource_def:
          type: jdob::Nested1
          properties:
            nested-1-param: {get_param: top-level}

That passes validation normally, but fails when -n is specified with the (not surprising) error: ERROR: The Parameter (top-level) was not provided.

The relevant logs in that failure case are below:

2015-12-10 15:36:14.467 DEBUG heat.engine.parameter_groups [req-b7106395-13a3-4739-812e-3c48c9357c03 None demo] Validating Parameter Groups: OS::project_id, OS::stack_id, top-level fro
m (pid=21759) validate /opt/stack/heat/heat/engine/parameter_groups.py:42
2015-12-10 15:36:14.472 DEBUG oslo_messaging._drivers.amqpdriver [req-b7106395-13a3-4739-812e-3c48c9357c03 None demo] sending reply msg_id: 02fb1215197645dbb16b8cdc884a47a9 reply queue
: reply_de74d73a8aba4c02bf0cf9241eafceb3 from (pid=21759) _send_reply /usr/lib/python2.7/site-packages/oslo_messaging/_drivers/amqpdriver.py:79
2015-12-10 15:36:16.904 DEBUG oslo_messaging._drivers.amqpdriver [-] received message msg_id: 89ff3423be6247f4b960209062e86bc5 reply to reply_d7916ee95d3e4a73a40c1f6ebdb28a22 from (pid
=21761) __call__ /usr/lib/python2.7/site-packages/oslo_messaging/_drivers/amqpdriver.py:193
2015-12-10 15:36:16.906 INFO heat.engine.service [req-86f833dd-98ee-45b7-af3f-09cc5d15a011 None demo] validate_template
2015-12-10 15:36:16.908 DEBUG heat.engine.parameter_groups [req-86f833dd-98ee-45b7-af3f-09cc5d15a011 None demo] Validating Parameter Groups: OS::project_id, OS::stack_id, top-level fro
m (pid=21761) validate /opt/stack/heat/heat/engine/parameter_groups.py:42
2015-12-10 15:36:16.909 ERROR oslo_messaging.rpc.dispatcher [req-86f833dd-98ee-45b7-af3f-09cc5d15a011 None demo] Exception during message handling: The Parameter (top-level) was not pr
ovided.
2015-12-10 15:36:16.909 TRACE oslo_messaging.rpc.dispatcher Traceback (most recent call last):
2015-12-10 15:36:16.909 TRACE oslo_messaging.rpc.dispatcher File "/usr/lib/python2.7/site-packages/oslo_messaging/rpc/dispatcher.py", line 142, in _dispatch_and_reply
2015-12-10 15:36:16.909 TRACE oslo_messaging.rpc.dispatcher executor_callback))
2015-12-10 15:36:16.909 TRACE oslo_messaging.rpc.dispatcher File "/usr/lib/python2.7/site-packages/oslo_messaging/rpc/dispatcher.py", line 186, in _dispatch
2015-1...

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/257928

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/264261

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/264261
Committed: https://git.openstack.org/cgit/openstack/python-heatclient/commit/?id=b06c3daeb78ce15b6a77ebfe75056d3ebed6a023
Submitter: Jenkins
Branch: master

commit b06c3daeb78ce15b6a77ebfe75056d3ebed6a023
Author: Jay Dobies <email address hidden>
Date: Wed Jan 6 11:41:56 2016 -0500

    Added -P support to template-validate

    Change-Id: Ia6945d6b3f86966a6e585866447db245b1efab2d
    Partial-Bug: #1508857

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/257928
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=a259ad55d8ba8eae75f888ed65f1461f9fefa6c2
Submitter: Jenkins
Branch: master

commit a259ad55d8ba8eae75f888ed65f1461f9fefa6c2
Author: Jay Dobies <email address hidden>
Date: Tue Dec 15 09:40:48 2015 -0500

    Fix resource definition loading in resource groups

    When using template-validate, values do not need to be specified for
    each parameter. However, when resource groups were used, an error was
    raised for parameters in the resource-def that did not have a value.
    This fix ignores missing parameter values when parsing through the
    resource definition.

    Change-Id: I0b455baa78ee53724678a4476063bb7429ec03f8
    Partial-Bug: #1508857

[Jay Dobies (jdob)]

I'm going to treat this bug as having the first two points of comment #1. The third point [1] is considerably more difficult to handle. I'll split that into its own bug to address in Newton.

[1] "3. Parameters passed via referencing an attribute in the parent temlate don't work as expected (there is no "Value" in the NestedParameters", e.g here"