Comment 23 for bug 1681769

Hi Rabi,

It's good that you don't experience this error in your installations but
it seems I pulled a lucky ticket and won the lottery. I want to return
this ticket. How it's possible? :)

To make check one more time I've reinstalled Heat

<stopped all heat services>
apt purge heat* python-heat*

cd /usr/lib/python2.7/dist-packages/
rm -rf heat*
find . -name '*heat*' -- return nothing

then put configs back to /etc/heat ('purge' remove configs) and
installed heat back. Sometimes ago on these serverswas Newton, but
before installing Ocata we apt-removed/purged all packages of Openstack,
removed all MySQL databases and rebooted servers (so no information left
in memcached), installed Ocata and wrote all config files from scratch
(no copy/paste from old installation). At the moment, there is

# apt show heat-engine
Package: heat-engine
Version: 1:8.0.0-0ubuntu1~cloud0
Priority: optional
Section: web
Source: heat
Maintainer: Ubuntu Developers <email address hidden>
Original-Maintainer: PKG OpenStack <email address hidden>
Installed-Size: 38.9 kB
Depends: adduser, heat-common (= 1:8.0.0-0ubuntu1~cloud0),
init-system-helpers (>= 1.18~), python:any
Supported: 48m
Download-Size: 5,360 B
APT-Manual-Installed: yes
APT-Sources: http://ubuntu-cloud.archive.canonical.com/ubuntu
xenial-updates/ocata/main amd64 Packages
Description: OpenStack orchestration service - engine
  Heat is a service to orchestrate multiple composite cloud applications
using
  templates, through both an OpenStack-native ReST API and a
  CloudFormation-compatible Query API.
  .
  This package contains the heat engine, which is the core service of
heat, and
  which the API servers will use.

Then, I simplified template and removed any mentions about other
resources like security groups in port definition:

   node1:
     type: OS::Nova::Server
     properties:
       [ ... ]
       networks:
         - port: { get_resource: node1-wan }

   node1-wan:
     type: OS::Neutron::Port
     properties:
       name: jadm-node1-wan
       network: e-net
       port_security_enabled: False

as usual, creation of port is successful:

2017-04-21 12:29:15.898 26265 DEBUG
heat.engine.resources.openstack.neutron.port
[req-29d762a3-e6b5-4215-9fcd-4b9d3a8fd28c - bush - - -] creating port
with {'admin_state_up': True, 'network_id':
u'260a32d6-2a2b-4e7e-b809-b504bb8c2587', 'port_security_enabled': False,
'name': u'jadm-node1-wan'} handle_create
/usr/lib/python2.7/dist-packages/heat/engine/resources/openstack/neutron/port.py:424

$ openstack port show jadm-node1-wan
[ ... ]
| port_security_enabled | False
| security_groups |
+-----------------------+-----------

and since there is no port security, I can ping it:

$ ping x.x.x.253
PING x.x.x.253 (x.x.x.253): 56 data bytes
64 bytes from x.x.x.253: icmp_seq=0 ttl=52 time=42.507 ms
64 bytes from x.x.x.253: icmp_seq=1 ttl=52 time=40.990 ms

then I change JUST and ONLY single parameter: set
'port_security_enabled' to 'True' (without quotes). No other changes,
additions or deletions to other parameters and sections of template.
Update causes an error from Neutron since there are keys with None value:

2017-04-21 12:34:16.913 26272 DEBUG
heat.engine.resources.openstack.neutron.port
[req-81805e11-2370-495d-87c4-a00969d9c8f9 - bush - - -] updating port
with {'allowed_address_pairs': [], 'binding:vnic_type': None,
'device_owner': None, 'mac_address': None, 'port_security_enabled':
True, 'security_groups': [u'53ede63e-b08f-4c95-b5fe-29cd21ed442a'],
'device_id': None} handle_update
/usr/lib/python2.7/dist-packages/heat/engine/resources/openstack/neutron/port.py:527

No any changes to Heat, just installed it using apt-get and configured
using vim (no any automation).

Any ideas on this?

When I apply my changes to port.py, everything is ok:

2017-04-21 12:56:03.050 30374 DEBUG
heat.engine.resources.openstack.neutron.port
[req-f249c46c-c3d6-48b0-a388-bded991d9dbd - bush - - -] updating port
with {'port_security_enabled': True, 'security_groups':
[u'53ede63e-b08f-4c95-b5fe-29cd21ed442a'], 'allowed_address_pairs': []}
handle_update
/usr/lib/python2.7/dist-packages/heat/engine/resources/openstack/neutron/port.py:525

$ openstack port show jadm-node1-wan
[ ... ]
| port_security_enabled | True
| security_groups | 53ede63e-b08f-4c95-b5fe-29cd21ed442a
+-----------------------+-----------

and since there is default openstack security group on the port, ping
don't work anymore which means that update is really successful:

$ ping x.x.x.253
PING x.x.x.253 (x.x.x.253): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
^C

Thanks.

On 4/21/17 2:25 PM, Rabi Mishra wrote:
> Volodymor,
>
> As I mentioned earlier, we don't need to clean prop_diff for None
> values. There would not be any None value in prop_diff, if you've not
> removed a property from the template before update(which was there for
> create). Your template works fine for me(on fedora). We also tests for
> port update at the gate(ubuntu xenial) that works fine.
>
> So there is something wrong with your setup. Is this a clean install or
> an upgarde? May be you can reinstall and check.
>
> The reason this bug is tracked is because there are scenarios when some
> properties like device_owner is removed from the template before update
> and neutron throws an error.
>

--
Volodymyr Litovka
   "Vision without Execution is Hallucination." -- Thomas Edison