Property values in nested stacks are no longer validated prior to creation

[Zane Bitter]

In bug 1645336 I assumed that the validation for a tree of nested stacks went like this:

  create
   -> validate ----------> validate --------------> validate
   -> Resource.create ===> create
                            -> validate ----------> validate
                            -> Resource.create ===> create
                                                     -> validate

but in fact there is a piece of hidden state (sigh) to control whether the validation actually validates property values or not. So the real flow looked like:

  create
   -> validate ----------> validate* -------------> validate*
   -> Resource.create ===> create
                            -> validate ----------> validate*
                            -> Resource.create ===> create
                                                     -> validate

(where 'validate*' doesn't check the property values.)

So the fix for bug 1645336 actually changed it to this:

  create
   -> validate ----------> validate* -------------> validate*
   -> Resource.create ===> create
                            -> Resource.create ===> create

but what we really want is probably:

  create
   -> validate ----------> validate* -------------> validate*
   -> Resource.create ===> create
                            -> validate
                            -> Resource.create ===> create
                                                     -> validate

which does exactly 2 passes on nested stacks (instead of one per level of depth, as it originally did).

Alternatively, we'd need to find a way to validate the property values in nested stacks at the beginning (i.e. revert https://review.openstack.org/#/c/144766/) without breaking the fixes for bug 1407100, bug 1407877, and bug 1405446.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/452307

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/452307
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=ea2673fb9a04588e0e294d159945d075657b9112
Submitter: Jenkins
Branch: master

commit ea2673fb9a04588e0e294d159945d075657b9112
Author: Zane Bitter <email address hidden>
Date: Fri Mar 31 15:57:54 2017 -0400

    Validate property values in nested stacks again

    In ced6f78aa065c1a7e6400c3be9ec3322e1e87416 we stopped doing validations of
    nested stacks at stack creation time, on the assumption that they had been
    validated when the parent stack was created. This assumption was incorrect;
    for children of the stack being created, the strict_validate global is
    always set during validation, so property values of resources will not be
    validated until it comes time to create the resource.

    Instead, prevent only redundant non-strict validations of stacks at nested
    depth 2 and greater. This means that every stack other than the root will
    be validated exactly twice - once without validating property values when
    the root is created, and again including property validation when the
    nested stack itself is created.

    Most of the performance benefits should remain; in the case of a large
    ResourceGroup using index substitution, we will now have to validate a lot
    of nearly-identical resource properties, however we still will not load
    into memory and validate a nested stack for each one as we originally did.
    Since that happens synchronously, it was likely the main contributor to RPC
    timeouts when dealing with large scaling groups. (During the validation at
    the creation of the root stack, only a single member of a ResourceGroup is
    validated even when index substitution is used. For scaling groups with
    identical members, only one member is validated since
    3aebdabf2e78ac9e920b9dd8c748c4fad0d723c3.)

    This change reverts commit ced6f78aa065c1a7e6400c3be9ec3322e1e87416.

    Change-Id: I97cf789cee75931edef58b78c88f02da204d2a08
    Closes-Bug: #1675589
    Related-Bug: #1645336

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/heat 9.0.0.0b1 development milestone.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/464263

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/462293
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=c1ef46f9be63eabb066ecd0b9069a5fb68fe175f
Submitter: Jenkins
Branch: master

commit c1ef46f9be63eabb066ecd0b9069a5fb68fe175f
Author: Zane Bitter <email address hidden>
Date: Wed May 3 17:08:58 2017 -0400

    Don't always validate property values in ResourceChain

    Generally with nested stacks, when validating the parent stack we don't
    validate the property *values* in the nested stack as we recurse down (i.e.
    the strict_validate flag is set to False on the nested stack). We validate
    the values when we come to actually create the nested stack.

    ResourceChain is an exception - the line of code to do this was commented
    out without explanation during initial development of the resource. This
    has two consequences:

    * Resources in the child stack always have their property values validated
      during the validation of the root stack, as well as when the child stack
      is created. (Property values should be examined only in the latter
      validation pass).
    * Since ea2673fb9a04588e0e294d159945d075657b9112, any grandchild stacks
      (i.e. where a member of the ResourceChain is itself a StackResource of
      type) will not be validated at all during the validation of the root
      stack. (They should be still validated, though property values will not
      be examined.)

    This change makes ResourceChain behave like other StackResources.

    Change-Id: Icc9c698a9f787b211af5dc2e190f03eb8d841610
    Related-Bug: #1675589

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/464263
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=7f2a94fb0ecadad3e61653b08d2b5a737ddcabcd
Submitter: Jenkins
Branch: stable/ocata

commit 7f2a94fb0ecadad3e61653b08d2b5a737ddcabcd
Author: Zane Bitter <email address hidden>
Date: Fri Mar 31 15:57:54 2017 -0400

    Validate property values in nested stacks again

    In ced6f78aa065c1a7e6400c3be9ec3322e1e87416 we stopped doing validations of
    nested stacks at stack creation time, on the assumption that they had been
    validated when the parent stack was created. This assumption was incorrect;
    for children of the stack being created, the strict_validate global is
    always set during validation, so property values of resources will not be
    validated until it comes time to create the resource.

    Instead, prevent only redundant non-strict validations of stacks at nested
    depth 2 and greater. This means that every stack other than the root will
    be validated exactly twice - once without validating property values when
    the root is created, and again including property validation when the
    nested stack itself is created.

    Most of the performance benefits should remain; in the case of a large
    ResourceGroup using index substitution, we will now have to validate a lot
    of nearly-identical resource properties, however we still will not load
    into memory and validate a nested stack for each one as we originally did.
    Since that happens synchronously, it was likely the main contributor to RPC
    timeouts when dealing with large scaling groups. (During the validation at
    the creation of the root stack, only a single member of a ResourceGroup is
    validated even when index substitution is used. For scaling groups with
    identical members, only one member is validated since
    3aebdabf2e78ac9e920b9dd8c748c4fad0d723c3.)

    This change reverts commit ced6f78aa065c1a7e6400c3be9ec3322e1e87416.

     Conflicts:
     heat/engine/stack.py

    Change-Id: I97cf789cee75931edef58b78c88f02da204d2a08
    Closes-Bug: #1675589
    Related-Bug: #1645336
    (cherry picked from commit ea2673fb9a04588e0e294d159945d075657b9112)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/heat 8.0.4 release.