cloud-mu 3.1.3 → 3.3.0

data/modules/mu/config/user.rb

@@ -14,7 +14,7 @@
 
 module MU
   class Config
-    # Basket of Kittens config schema and parser logic. See modules/mu/clouds/*/user.rb
+    # Basket of Kittens config schema and parser logic. See modules/mu/providers/*/user.rb
     class User
 
       # Base configuration schema for a User
@@ -68,10 +68,10 @@ module MU
       end
 
       # Generic pre-processing of {MU::Config::BasketofKittens::user}, bare and unvalidated.
-      # @param user [Hash]: The resource to process and validate
-      # @param configurator [MU::Config]: The overall deployment configurator of which this resource is a member
+      # @param _user [Hash]: The resource to process and validate
+      # @param _configurator [MU::Config]: The overall deployment configurator of which this resource is a member
       # @return [Boolean]: True if validation succeeded, False otherwise
-      def self.validate(user, configurator)
+      def self.validate(_user, _configurator)
         ok = true
 
         ok

data/modules/mu/config/vpc.rb

@@ -14,7 +14,7 @@
 
 module MU
   class Config
-    # Basket of Kittens config schema and parser logic. See modules/mu/clouds/*/vpc.rb
+    # Basket of Kittens config schema and parser logic. See modules/mu/providers/*/vpc.rb
     class VPC
 
       # Base configuration schema for a VPC
@@ -417,10 +417,10 @@ module MU
         using_default_cidr = false
         if !vpc['ip_block']
           if configurator.updating and configurator.existing_deploy and
+             configurator.existing_deploy.original_config and
              configurator.existing_deploy.original_config['vpcs']
-            pieces = []
             configurator.existing_deploy.original_config['vpcs'].each { |v|
-              if v['name'] == vpc['name']
+              if v['name'].to_s == vpc['name'].to_s
                 vpc['ip_block'] = v['ip_block']
                 vpc['peers'] ||= []
                 vpc['peers'].concat(v['peers'])
@@ -432,6 +432,10 @@ module MU
                 break
               end
             }
+            if !vpc['ip_block']
+              MU.log "Loading existing deploy but can't find IP block of VPC #{vpc['name']}", MU::ERR
+              ok = false
+            end
           else
             using_default_cidr = true
             vpc['ip_block'] = "10.0.0.0/16"
@@ -494,6 +498,7 @@ module MU
           # See if we'll be able to create peering connections
           can_peer = false
           already_peered = false
+
           if MU.myCloud == vpc["cloud"] and MU.myVPCObj
             if vpc['peers']
               vpc['peers'].each { |peer|
@@ -539,7 +544,7 @@ module MU
           # Clouds that don't have some kind of native NAT gateway can also
           # leverage this host to honor "gateway" => "#NAT" situations.
           if !can_peer and !already_peered and have_public and vpc["create_bastion"]
-            serverclass = Object.const_get("MU").const_get("Cloud").const_get(vpc["cloud"]).const_get("Server")
+            serverclass = MU::Cloud.resourceClass(vpc["cloud"], "Server")
             bastion = serverclass.genericNAT.dup
             bastion["groomer_variables"] = {
               "nat_ip_block" => vpc["ip_block"].to_s
@@ -558,10 +563,7 @@ module MU
               "name" => vpc["name"],
               "subnet_pref" => "public"
             }
-            vpc["dependencies"] << {
-              "type" => "server",
-              "name" => bastion['name'],
-            }
+            MU::Config.addDependency(vpc, bastion['name'], "server", no_create_wait: true)
             vpc["bastion"] = MU::Config::Ref.get(
               name: bastion['name'],
               cloud: vpc['cloud'],
@@ -596,7 +598,7 @@ module MU
               MU.log "Skipping malformed VPC peer in #{vpc['name']}", MU::ERR, details: peer
               next
             end
-            peer["#MU_CLOUDCLASS"] = Object.const_get("MU").const_get("Cloud").const_get("VPC")
+            peer["#MU_CLOUDCLASS"] = MU::Cloud.loadBaseType("VPC")
             # We check for multiple siblings because some implementations
             # (Google) can split declared VPCs into parts to get the mimic the
             # routing behaviors we expect.
@@ -613,17 +615,11 @@ module MU
                     append_me = { "vpc" => peer["vpc"].dup }
                     append_me['vpc']['name'] = sib['name']
                     append << append_me
-                    vpc["dependencies"] << {
-                      "type" => "vpc",
-                      "name" => sib['name']
-                    }
+                    MU::Config.addDependency(vpc, sib['name'], "vpc", phase: "groom", no_create_wait: true)
                   end
                   delete << peer
                 else
-                  vpc["dependencies"] << {
-                    "type" => "vpc",
-                    "name" => peer['vpc']["name"]
-                  }
+                  MU::Config.addDependency(vpc, peer['vpc']['name'], "vpc", phase: "groom", no_create_wait: true)
                 end
                 delete << peer if sib['name'] == vpc['name']
               }
@@ -637,7 +633,7 @@ module MU
                   MU.log "VPC peering connections to non-local accounts must specify the vpc_id of the peer.", MU::ERR
                   ok = false
                 end
-              elsif !processReference(peer['vpc'], "vpcs", "vpc '#{vpc['name']}'", configurator, dflt_region: peer["vpc"]['region'])
+              elsif !processReference(peer['vpc'], "vpcs", vpc, configurator, dflt_region: peer["vpc"]['region'])
                 ok = false
               end
             end
@@ -736,8 +732,8 @@ module MU
            vpc_block["subnet_pref"] = "all_private" if vpc_block["subnet_pref"] == "private"
         end
 
-        flags = {}
-        flags["subnet_pref"] = vpc_block["subnet_pref"] if !vpc_block["subnet_pref"].nil?
+#        flags = {}
+#        flags["subnet_pref"] = vpc_block["subnet_pref"] if !vpc_block["subnet_pref"].nil?
         hab_arg = if vpc_block['habitat']
           if vpc_block['habitat'].is_a?(MU::Config::Ref)
             [vpc_block['habitat'].id] # XXX actually, findStray it
@@ -771,9 +767,9 @@ MU.log "VPC lookup cache hit", MU::WARN, details: vpc_block
                   tag_key: tag_key,
                   tag_value: tag_value,
                   region: vpc_block["region"],
-                  flags: flags,
                   habitats: hab_arg,
-                  dummy_ok: true
+                  dummy_ok: true,
+                  subnet_pref: vpc_block["subnet_pref"]
                 )
 
                 found.first if found and found.size == 1
@@ -799,8 +795,8 @@ MU.log "VPC lookup cache hit", MU::WARN, details: vpc_block
               end
               @@reference_cache[vpc_block] ||= ext_vpc if ok
             end
-          rescue Exception => e
-            raise MuError, e.inspect, e.backtrace
+          rescue StandardError => e
+            raise MuError.new e.inspect, details: { "my call stack" => caller, "exception call stack" => e.backtrace }
           ensure
             if !ext_vpc and vpc_block['cloud'] != "CloudFormation"
               MU.log "Couldn't resolve VPC reference to a unique live VPC in #{parent_type} #{parent['name']} (called by #{caller[0]})", MU::ERR, details: vpc_block
@@ -877,7 +873,7 @@ MU.log "VPC lookup cache hit", MU::WARN, details: vpc_block
             tag_key, tag_value = vpc_block['tag'].split(/=/, 2) if !vpc_block['tag'].nil?
             begin
               ext_subnet = ext_vpc.getSubnet(cloud_id: vpc_block['subnet_id'], name: vpc_block['subnet_name'], tag_key: tag_key, tag_value: tag_value)
-            rescue MuError => e
+            rescue MuError
             end
 
             if ext_subnet.nil?
@@ -918,14 +914,20 @@ MU.log "VPC lookup cache hit", MU::WARN, details: vpc_block
           public_subnets = []
           public_subnets_map = {}
           subnet_ptr = "subnet_id"
-          all_subnets = []
           if !is_sibling
             pub = priv = 0
             raise MuError, "No subnets found in #{ext_vpc}" if ext_vpc.subnets.nil?
             ext_vpc.subnets.each { |subnet|
               next if dflt_region and vpc_block["cloud"] == "Google" and subnet.az != dflt_region
               if subnet.private? and (vpc_block['subnet_pref'] != "all_public" and vpc_block['subnet_pref'] != "public")
-                private_subnets << { "subnet_id" => configurator.getTail("#{parent['name']} Private Subnet #{priv}", value: subnet.cloud_id, prettyname: "#{parent['name']} Private Subnet #{priv}",  cloudtype:  "AWS::EC2::Subnet::Id"), "az" => subnet.az }
+                private_subnets << {
+                  "subnet_id" => configurator.getTail(
+                    "#{parent['name']} Private Subnet #{priv}",
+                    value: subnet.cloud_id,
+                    prettyname: "#{parent['name']} Private Subnet #{priv}",
+                    cloudtype: "AWS::EC2::Subnet::Id"),
+                  "az" => subnet.az
+                }
                 private_subnets_map[subnet.cloud_id] = subnet
                 priv = priv + 1
               elsif !subnet.private? and vpc_block['subnet_pref'] != "all_private" and vpc_block['subnet_pref'] != "private"
@@ -1068,5 +1070,47 @@ MU.log "VPC lookup cache hit", MU::WARN, details: vpc_block
       end
 
     end
+
+    # Take an IP block and split it into a more-or-less arbitrary number of
+    # subnets.
+    # @param ip_block [String]: CIDR of the network to subdivide
+    # @param subnets_desired [Integer]: Number of subnets we want back
+    # @param max_mask [Integer]: The highest netmask we're allowed to use for a subnet (various by cloud provider)
+    # @return [MU::Config::Tail]: Resulting subnet tails, or nil if an error occurred.
+    def divideNetwork(ip_block, subnets_desired, max_mask = 28)
+      cidr = NetAddr::IPv4Net.parse(ip_block.to_s)
+
+      # Ugly but reliable method of landing on the right subnet size
+      subnet_bits = cidr.netmask.prefix_len
+      begin
+        subnet_bits += 1
+        if subnet_bits > max_mask
+          MU.log "Can't subdivide #{cidr.to_s} into #{subnets_desired.to_s}", MU::ERR
+          raise MuError, "Subnets smaller than /#{max_mask} not permitted"
+        end
+      end while cidr.subnet_count(subnet_bits) < subnets_desired
+
+      if cidr.subnet_count(subnet_bits) > subnets_desired
+        MU.log "Requested #{subnets_desired.to_s} subnets from #{cidr.to_s}, leaving #{(cidr.subnet_count(subnet_bits)-subnets_desired).to_s} unused /#{subnet_bits.to_s}s available", MU::NOTICE
+      end
+
+      begin
+        subnets = []
+        (0..subnets_desired).each { |x|
+          subnets << cidr.nth_subnet(subnet_bits, x).to_s
+        }
+      rescue RuntimeError => e
+        if e.message.match(/exceeds subnets available for allocation/)
+          MU.log e.message, MU::ERR
+          MU.log "I'm attempting to create #{subnets_desired} subnets (one public and one private for each Availability Zone), of #{subnet_size} addresses each, but that's too many for a /#{cidr.netmask.prefix_len} network. Either declare a larger network, or explicitly declare a list of subnets with few enough entries to fit.", MU::ERR
+          return nil
+        else
+          raise e
+        end
+      end
+
+      subnets = getTail("subnetblocks", value: subnets.join(","), cloudtype: "CommaDelimitedList", description: "IP Address ranges to be used for VPC subnets", prettyname: "SubnetIpBlocks", list_of: "ip_block").map { |tail| tail["ip_block"] }
+      subnets
+    end
   end
 end

data/modules/mu/config/vpc.yml

@@ -1,7 +1,6 @@
 <% if complexity == 'complex' %>
 name: <%= vpc_name %>
 create_nat_gateway: true
-ip_block: 10.231.0.0/16
 enable_traffic_logging: true
 region: us-east-2
 availability_zones:

data/modules/mu/defaults/AWS.yaml

@@ -1,5 +1,5 @@
 ---
-rhel71: &4
+rhel71: &5
   us-east-1: ami-0f05fce24aa75ba9f
   ap-northeast-1: ami-0c0ec19eb19055763
   ap-northeast-2: ami-0717ac5c67c99f745
@@ -16,41 +16,41 @@ rhel71: &4
   us-east-2: ami-02f6682c7816b3cfc
   us-west-1: ami-04898e596c06e802b
   us-west-2: ami-02db5457189a8a8c2
-centos6: &3
-  us-east-1: ami-06b6c01abc6998348
-  ap-northeast-1: ami-0c5da73fde2cb6437
-  ap-northeast-2: ami-0134fce6dc00eb00d
-  ap-south-1: ami-0e59a612e7c84836b
-  ap-southeast-1: ami-0e16974f528ae0dae
-  ap-southeast-2: ami-0e2feddf3dbf4d539
-  ca-central-1: ami-089236a344dadad5f
-  eu-central-1: ami-0c4eed3fe046c3917
-  eu-north-1: ami-05f636e89d0362c14
-  eu-west-1: ami-00c50b11d713f90d3
-  eu-west-2: ami-06cc78c32eed7f944
-  eu-west-3: ami-0ba626236ad786c54
-  sa-east-1: ami-07c3b2a5a41e92376
-  us-east-2: ami-01129e636778acfbc
-  us-west-1: ami-0632e646cd5089ffc
-  us-west-2: ami-0ce4c9f2e1037de53
+centos6: &4
+  us-east-1: ami-009723c5c7f8fbc75
+  us-east-2: ami-0781f11395714cd39
+  ap-northeast-1: ami-07fa5a8795da2b6bc
+  ap-northeast-2: ami-0219f0a7c979ff63f
+  ap-south-1: ami-0f24817242c401740
+  ap-southeast-1: ami-042ef2e0643e8e207
+  ap-southeast-2: ami-09fc51de648afa168
+  ca-central-1: ami-0dc643db74edc5aa5
+  eu-central-1: ami-0628759cb297569d5
+  eu-north-1: ami-0aed023791f886315
+  eu-west-1: ami-0f87f0f252ff03622
+  eu-west-2: ami-00abb555d5a460afe
+  eu-west-3: ami-0ccd93d454c2418a2
+  sa-east-1: ami-01e10ea6ea72534ae
+  us-west-1: ami-01fee56b9ee690ffe
+  us-west-2: ami-08bcdb944f185e2a8
 centos7:
-  us-east-1: ami-07e6f661e71ad964b
-  ap-northeast-1: ami-0988180d74897c639
-  ap-northeast-2: ami-0e77cd1c7024b8ae0
-  ap-south-1: ami-02bd479122041000a
-  ap-southeast-1: ami-017767778ef9db671
-  ap-southeast-2: ami-05b09a58c3964d67d
-  ca-central-1: ami-0a59a176d810fcc5f
-  eu-central-1: ami-0b48a421fb05d96af
-  eu-north-1: ami-02337601ea5dc4a5d
-  eu-west-1: ami-0b0a55b7423eeac07
-  eu-west-2: ami-060518b40b25b9eb4
-  eu-west-3: ami-060957bb3adacd831
-  sa-east-1: ami-0c706132b35071de6
-  us-east-2: ami-0db4c266ed0bb958b
-  us-west-1: ami-0980f6eb52c998793
-  us-west-2: ami-07f2ed4755c01c05c
-ubuntu16: &2
+  us-east-1: ami-067256ca1497c924d
+  ap-northeast-1: ami-07c1e51354fdfd362
+  ap-northeast-2: ami-042b761c93d6df2f1
+  ap-south-1: ami-02e879f52322e7c98
+  ap-southeast-1: ami-0487e9f84d0ffde89
+  ap-southeast-2: ami-0e854dab39fd6a427
+  ca-central-1: ami-05a27d311b585a70b
+  eu-central-1: ami-0e396d00c787b4f47
+  eu-north-1: ami-087763a2ba60b2bfe
+  eu-west-1: ami-04e3bd9335a14e635
+  eu-west-2: ami-0efd34a8d1fc2b104
+  eu-west-3: ami-08d0bcbc780448cf8
+  sa-east-1: ami-0284f4a0968263cf0
+  us-east-2: ami-0292786917d1e3015
+  us-west-1: ami-0ba622529dcdff2bb
+  us-west-2: ami-079a309ca6261d7f6
+ubuntu16: &3
   us-east-1: ami-bcdc16c6
   us-west-1: ami-1b17257b
   us-west-2: ami-19e92861
@@ -73,33 +73,56 @@ ubuntu14:
   ap-southeast-1: ami-2855964b
   ap-southeast-2: ami-d19fc4b2
 win2k12r2: &1
-  us-east-1: ami-055c10ae78f3a58a2
-  us-east-2: ami-fbbe929e
-  us-west-1: ami-ec91ac8c
-  us-west-2: ami-106ca068
-  eu-central-1: ami-59e15a36
-  eu-west-1: ami-65b16b1c
-  sa-east-1: ami-93d6afff
-  ap-northeast-1: ami-dcd375ba
-  ap-northeast-2: ami-fa2e8b94
-  ap-southeast-1: ami-b61657d5
-  ap-southeast-2: ami-9a7b97f8
-  ap-south-1: ami-99a8eaf6
-  ca-central-1: ami-608b3304
-win2k16:
-  us-east-1: ami-d2cb25a8
-  us-east-2: ami-2db59748
-  us-west-1: ami-2db59748
-  us-west-2: ami-3b47ba43
-  eu-central-1: ami-37d46558
-  eu-west-1: ami-06c5d662
-  sa-east-1: ami-53fd803f
-  ap-northeast-1: ami-ce8b42a8
-  ap-northeast-2: ami-c17ca7af
-  ap-southeast-1: ami-fe51279d
-  ap-southeast-2: ami-792bcd1b
-  ap-south-1: ami-448dcb2b
-  ca-central-1: ami-a39920c7
+  us-east-1: ami-003aea65bc2e7136a
+  us-east-2: ami-0163293e39ba504c2
+  ca-central-1: ami-055689dd92f29d2aa
+  us-west-2: ami-0ce87dda2c9244e57
+  us-west-1: ami-00d9cf64bd2fafa44
+  eu-west-1: ami-026d7427b9fadad40
+  eu-west-2: ami-036a22c0780551794
+  eu-west-3: ami-05e3d9b79bdc10861
+  eu-north-1: ami-063eb48504c7d73f1
+  sa-east-1: ami-0a8c1829a5e650bc5
+  eu-central-1: ami-0ea20cef52335b008
+  ap-northeast-1: ami-08db2dc67228dbb90
+  ap-south-1: ami-012241411db3f09c3
+  ap-northeast-2: ami-0368c224de1d20502
+  ap-southeast-1: ami-028ef74e1edc3943a
+  ap-southeast-2: ami-09e03eab1b1bc151b
+win2k16: &2
+  us-east-1: ami-02801a2c8dcbfb883
+  us-east-2: ami-0ca4f779a2a58a7ea
+  ca-central-1: ami-05d3854d9d6e9bcc5
+  us-west-2: ami-091f4a88ce32d28b6
+  eu-west-1: ami-0b938c9b23ed7d18c
+  us-west-1: ami-0fd744c3fbe8260f2
+  eu-west-2: ami-071a89b959c5eda27
+  eu-west-3: ami-0b206e3dbda9ff9eb
+  eu-central-1: ami-0dd9bdad31dd0d3ce
+  sa-east-1: ami-0d69b8d6c0f9a7bae
+  ap-northeast-1: ami-02eb4a6f519bc3190
+  ap-south-1: ami-0666fd543ac8b5501
+  ap-northeast-2: ami-01277c81f9b91cf77
+  ap-southeast-2: ami-0426a246f9b0ccadd
+  ap-southeast-1: ami-07ecb0d55c2eb7247
+  eu-north-1: ami-047811530583b6d08
+win2k19:
+  us-east-1: ami-00820419bf212df7e
+  us-east-2: ami-0a7916b90aa4629d5
+  ca-central-1: ami-0d704529661e19185
+  us-west-2: ami-0ee6a198d7ac35eb1
+  eu-west-2: ami-0f6ac1634bd7add92
+  us-west-1: ami-039e3816b4cac1e27
+  eu-west-1: ami-03a771d99091199b7
+  eu-central-1: ami-03b648d5b45f51a4f
+  eu-west-3: ami-068839907c18c3a6e
+  eu-north-1: ami-0db851ee76f7deefb
+  sa-east-1: ami-0c2cc60c62159f87c
+  ap-northeast-2: ami-06bdf8ae9ae9add92
+  ap-northeast-1: ami-02306d959c7f175b9
+  ap-southeast-1: ami-0d5b4a3d73e0f471f
+  ap-southeast-2: ami-00fa88caff4f64937
+  ap-south-1: ami-0b44feae4bb9f497a
 amazon:
   us-east-1: ami-b73b63a0
   us-east-2: ami-58277d3d
@@ -114,9 +137,9 @@ amazon:
   ap-southeast-1: ami-b953f2da
   ap-southeast-2: ami-db704cb8
 win2k12: *1
-windows: *1
-ubuntu: *2
-centos: *3
-rhel7: *4
-rhel: *4
-linux: *3
+windows: *2
+ubuntu: *3
+centos: *4
+rhel7: *5
+rhel: *5
+linux: *4

data/modules/mu/defaults/Azure.yaml

@@ -2,6 +2,7 @@
 centos6: &centos6 OpenLogic/CentOS/6
 #centos7: &centos7 westernoceansoftwaresprivatelimited/centos-7-6/centos-7-6-server
 centos7: &centos7 OpenLogic/CentOS/7
+centos8: &centos7 OpenLogic/CentOS/8
 rhel8: &rhel8 RedHat/RHEL/8
 rhel7: &rhel7 RedHat/RHEL/7
 rhel6: &rhel6 RedHat/RHEL/6

data/modules/mu/defaults/Google.yaml

@@ -1,6 +1,7 @@
 ---
-centos6: &centos6 centos-cloud/centos-6
-centos7: &centos7 centos-cloud/centos-7
+centos6: &centos6 egt-labs-admin/mu-centos-6
+centos7: &centos7 egt-labs-admin/mu-centos-7
+centos8: &centos8 centos-cloud/centos-8 
 rhel71: &rhel71 rhel-cloud/rhel-7
 rhel6: &rhel6 rhel-cloud/rhel-6
 debian10: &debian10 debian-cloud/debian-10

data/modules/mu/deploy.rb

@@ -126,7 +126,7 @@ module MU
           seedsize = 1 + (retries/10).abs
           seed = (0...seedsize+1).map { ('a'..'z').to_a[rand(26)] }.join
           deploy_id = @appname.upcase + "-" + @environment.upcase + "-" + @timestamp + "-" + seed.upcase
-        end while MU::MommaCat.deploy_exists?(deploy_id) or seed == "mu" or seed[0] == seed[1]
+        end while MU::MommaCat.deploy_exists?(deploy_id) or seed == "mu"
         MU.setVar("deploy_id", deploy_id)
         MU.setVar("appname", @appname.upcase)
         MU.setVar("environment", @environment.upcase)
@@ -140,7 +140,7 @@ module MU
 
       @fromName = MU.muCfg['mu_admin_email']
 
-      MU::Cloud.resource_types.each { |cloudclass, data|
+      MU::Cloud.resource_types.values.each { |data|
         if !@main_config[data[:cfg_plural]].nil? and @main_config[data[:cfg_plural]].size > 0
           @main_config[data[:cfg_plural]].each { |resource|
             if force_cloudformation
@@ -154,9 +154,10 @@ module MU
               end
             end
           }
-          shortclass, cfg_name, cfg_plural, classname = MU::Cloud.getResourceNames(data[:cfg_plural])
+          _shortclass, _cfg_name, _cfg_plural, classname = MU::Cloud.getResourceNames(data[:cfg_plural])
           @main_config[data[:cfg_plural]].each { |resource|
             resource["#MU_CLOUDCLASS"] = classname
+#            resource["#MU_CLOUDCLASS"] = MU::Cloud.resourceClass(resource['cloud'], data[:cfg_plural])
           }
           setThreadDependencies(@main_config[data[:cfg_plural]])
         end
@@ -265,7 +266,7 @@ module MU
         # Run cloud provider-specific deploy meta-artifact creation (ssh keys,
         # resource groups, etc)
         @mommacat.cloudsUsed.each { |cloud|
-          cloudclass = Object.const_get("MU").const_get("Cloud").const_get(cloud)
+          cloudclass = MU::Cloud.cloudClass(cloud)
           cloudclass.initDeploy(@mommacat)
         }
 
@@ -274,7 +275,7 @@ module MU
           MU.dupGlobals(parent_thread_id)
           Thread.current.thread_variable_set("name", "mu_create_container")
 #          Thread.abort_on_exception = false
-          MU::Cloud.resource_types.each { |cloudclass, data|
+          MU::Cloud.resource_types.values.each { |data|
             if !@main_config[data[:cfg_plural]].nil? and
                 @main_config[data[:cfg_plural]].size > 0 and
                 data[:instance].include?(:create)
@@ -288,7 +289,7 @@ module MU
           MU.dupGlobals(parent_thread_id)
           Thread.current.thread_variable_set("name", "mu_groom_container")
 #          Thread.abort_on_exception = false
-          MU::Cloud.resource_types.each { |cloudclass, data|
+          MU::Cloud.resource_types.values.each { |data|
             if !@main_config[data[:cfg_plural]].nil? and
                 @main_config[data[:cfg_plural]].size > 0 and
                 data[:instance].include?(:groom)
@@ -311,7 +312,20 @@ module MU
 
         @mommacat.save!
 
-      rescue Exception => e
+        # XXX Functions have a special behavior where we re-invoke their groom
+        # methods one more time at the end, so we can guarantee their
+        # environments are fully populated with all sibling resource idents
+        # regardless of dependency order. This is, obviously, a disgusting
+        # hack, and we should revisit our dependency language in the next big
+        # release.
+        if !@main_config["functions"].nil? and
+            @main_config["functions"].size > 0
+          createResources(@main_config["functions"], "groom")
+        end
+
+      rescue StandardError => e
+        MU.log e.class.name, MU::ERR, details: caller
+
         @my_threads.each do |t|
           if t.object_id != Thread.current.object_id and
              t.thread_variable_get("name") != "main_thread" and
@@ -338,6 +352,8 @@ module MU
             @nocleanup = true # so we don't run this again later
           end
         end
+
+
         @reraise_thread.raise MuError, e.inspect, e.backtrace if @reraise_thread
         Thread.current.exit
       ensure
@@ -390,7 +406,7 @@ module MU
           Thread.handle_interrupt(MU::Cloud::MuCloudResourceNotImplemented => :never) {
             begin
               Thread.handle_interrupt(MU::Cloud::MuCloudResourceNotImplemented => :immediate) {
-                MU.log "Cost calculator not available for this stack, as it uses a resource not implemented in Mu's CloudFormation layer.", MU::WARN, verbosity: MU::Logger::NORMAL
+                MU.log "Cost calculator not available for this stack, as it uses a resource not implemented in Mu's CloudFormation layer.", MU::DEBUG, verbosity: MU::Logger::NORMAL
                 Thread.current.exit
               }
             ensure
@@ -550,16 +566,9 @@ MESSAGE_END
         @dependency_threads["#{name}_groom"]=["#{name}_create", "mu_groom_container"]
 
         MU.log "Setting dependencies for #{name}", MU::DEBUG, details: resource["dependencies"]
-        if resource["dependencies"] != nil then
+        if !resource["dependencies"].nil? then
           resource["dependencies"].each { |dependency|
-            parent_class = nil
-            MU::Cloud.resource_types.each_pair { |res_class, attrs|
-              if attrs[:cfg_name] == dependency['type'] or
-                 attrs[:cfg_plural] == dependency['type']
-                parent_class = Object.const_get("MU").const_get("Cloud").const_get(res_class)
-                break
-              end
-            }
+            parent_class = MU::Cloud.loadBaseType(dependency['type'])
 
             parent_type = parent_class.cfg_name
 
@@ -568,10 +577,10 @@ MESSAGE_END
             addDependentThread(parent, "#{name}_groom")
 
             # should our creation thread also wait on our parent's create?
-            if !resource["no_create_wait"] and
+            if !dependency["no_create_wait"] and
                (resource["#MU_CLOUDCLASS"].waits_on_parent_completion or
                dependency['phase'] == "create" or
-               (parent_class.deps_wait_on_my_creation and parent_type != res_type))
+               parent_class.deps_wait_on_my_creation)
               addDependentThread(parent, "#{name}_create")
             end
 
@@ -580,12 +589,18 @@ MESSAGE_END
             if (dependency['phase'] == "groom" or resource["#MU_CLOUDCLASS"].waits_on_parent_completion) and parent_class.instance_methods(false).include?(:groom)
               parent = parent_type+"_"+dependency["name"]+"_groom"
               addDependentThread(parent, "#{name}_groom")
-              if (parent_class.deps_wait_on_my_creation and parent_type != res_type) or resource["#MU_CLOUDCLASS"].waits_on_parent_completion or dependency['phase'] == "groom"
+              if !dependency["no_create_wait"] and (
+                   parent_class.deps_wait_on_my_creation or
+                   resource["#MU_CLOUDCLASS"].waits_on_parent_completion or
+                   dependency['phase'] == "groom"
+                 )
                 addDependentThread(parent, "#{name}_create")
               end
             end
           }
         end
+        MU.log "Thread dependencies #{res_type}[#{name}]", MU::DEBUG, details: { "create" => @dependency_threads["#{name}_create"], "groom" => @dependency_threads["#{name}_groom"] }
+        @dependency_threads["#{name}_groom"]=["#{name}_create", "mu_groom_container"]
       }
     end
 
@@ -596,7 +611,6 @@ MESSAGE_END
       return if services.nil?
 
       parent_thread_id = Thread.current.object_id
-      parent_thread = Thread.current
       services.uniq!
       services.each do |service|
         begin
@@ -639,17 +653,18 @@ MESSAGE_END
               else
                 raise e
               end
-            rescue Exception => e
+            rescue StandardError => e
               MU::MommaCat.unlockAll
               @main_thread.raise MuError, "Error instantiating object from #{myservice["#MU_CLOUDCLASS"]} (#{e.inspect})", e.backtrace
               raise e
             end
             begin
               run_this_method = myservice['#MUOBJECT'].method(mode)
-            rescue Exception => e
+            rescue StandardError => e
               MU::MommaCat.unlockAll
-              @main_thread.raise MuError, "Error invoking #{myservice["#MU_CLOUDCLASS"]}.#{mode} for #{myservice['name']} (#{e.inspect})", e.backtrace
-              raise e
+              @main_thread.raise MuError, "Error invoking #{myservice["#MUOBJECT"].class.name}.#{mode} for #{myservice['name']} (#{e.inspect})", e.backtrace
+              return
+#              raise e
             end
             begin
               MU.log "Checking whether to run #{myservice['#MUOBJECT']}.#{mode} (updating: #{@updating})", MU::DEBUG
@@ -703,7 +718,7 @@ MESSAGE_END
               @my_threads.reject! { |thr| !thr.alive? }
               sleep 10+Random.rand(20)
               retry
-            rescue Exception => e
+            rescue StandardError => e
               MU.log e.inspect, MU::ERR, details: e.backtrace if @verbosity != MU::Logger::SILENT
               MU::MommaCat.unlockAll
               Thread.list.each do |t|
@@ -729,7 +744,9 @@ MESSAGE_END
           sleep 10+Random.rand(20)
           retry
         end
+
       end
+
     end
 
   end #class