In newton and earlier, setting an empty string in the heat templates resulted in the puppet modules interpreting the hieradata as "unset" and the puppet module default value was used instead. This no longer works this way and the empty string is used as an actual configuration value. At least one setting (the firewall driver in the neutron ovs agent) has been affected.
Arguably, using an empty string as a mechanism for dealing with "leave as defaults" is wrong anyways and is no longer necessary. I'll fix for neutron-ovs-agent and do a quick survey for other things that might be affected. It probably would be a good idea for others to keep their eyes open for other parameters that might be affected.
Related fix proposed to branch: master /review. openstack. org/420947
Review: https:/