It happens because function _check_nodes_roles uses method TaskHelper.nodes_to_deploy(cluster) to get the list of nodes. Function nodes_to_deploy returns an empty list when all nodes in the cluster are in 'discovered' state. Thus, no checks are done.
Steps to reproduce:
- create cluster with role 'cinder' on some node;
- define a restriction for role 'cinder', e.g. 'cinder' role should be hidden or disabled according to restriction's condition;
- deploy cluster.
Expected results:
check_before_deployment task should fail with error that restriction was hit: "Role 'cinder' restrictions mismatch: <message_specified_in_restriction>".
Actual result:
Deployment passed. As a result, we have a cluster with node role that doesn't satisfy roles_metadata.
And further attempts to deploy changes for this cluster will fail with error described in "Expected results" above.
Even if we just add a new node with not-affected role 'compute' and run deploy, function _check_nodes_roles will go through all the nodes and will fail on node that has affected role 'cinder'.
Reproducibility:
100%
Description of the environment:
fuel-web branch is stable/mitaka
Additional information:
commit, where restrictions check was introduced: https://review.openstack.org/#/c/316870/2
commit, where the logic of nodes_to_deploy(cluster) was rewritten: https://review.openstack.org/#/c/309769/4
Let's postpone fixing the bug until end of next week. There is an refactoring in progress in this area that will make the fix easier.