🚨 OpenStack Error Guide: 'Stack CREATE_FAILED' / 'Resource CREATE failed' (Heat orchestration)

Overview

Heat is OpenStack’s orchestration engine: it takes a template and creates the resources — instances, networks, volumes, security groups — in dependency order. When any resource in that graph fails, Heat marks the whole stack CREATE_FAILED and records the reason against the resource that broke. The CLI shows:

Stack web-stack CREATE_FAILED
Resource CREATE failed: ResourceInError: resources.app_server: Went to status ERROR due to "Message: No valid host was found. There are not enough hosts available., Code: 500"

This error occurs whenever a resource Heat tries to create cannot be created. The single most common cause is a nested failure — Heat asked Nova, Neutron, or Cinder to do something and that service returned an error (Nova “No valid host”, Neutron IP exhaustion, Cinder volume failure). Other causes are template or parameter mistakes, exhausted quotas, operations that exceed the stack/resource timeout, broken dependency ordering, and references to images, flavors, or networks that don’t exist. The key skill is reading past the top-level “CREATE_FAILED” to the real underlying error.

Symptoms

• openstack stack list shows the stack in CREATE_FAILED.
• One resource in stack resource list is CREATE_FAILED while others are CREATE_COMPLETE or INIT_COMPLETE.
• The stack rolls back (deletes already-created resources) if rollback is enabled.
• The status reason references another service’s error verbatim.

openstack stack list -c "Stack Name" -c "Stack Status"

+-------------+-----------------+
| Stack Name  | Stack Status    |
+-------------+-----------------+
| web-stack   | CREATE_FAILED   |
+-------------+-----------------+

Common Root Causes

1. A nested resource failing (Nova / Neutron / Cinder)

By far the most common case: Heat’s request to another service failed. The resource list and event log carry the real message.

openstack stack resource list web-stack -c resource_name -c resource_status
openstack stack resource show web-stack app_server -c resource_status_reason -f value

+-------------+-----------------+
| app_server  | CREATE_FAILED   |
| app_port    | CREATE_COMPLETE |
| app_volume  | CREATE_COMPLETE |
+-------------+-----------------+

ResourceInError: resources.app_server: Went to status ERROR due to
"Message: No valid host was found. There are not enough hosts available."

Here Heat is fine — Nova scheduling failed. The fix lives in Nova (capacity, host aggregates, flavor sizing), not the template.

2. Template or parameter errors

A malformed template, an unknown property, or a missing/invalid parameter fails the stack at validation or during resource creation.

openstack stack create -t template.yaml --dry-run --enable-rollback web-stack
openstack orchestration template validate -t template.yaml

ERROR: Property error: resources.app_server.properties.flavor:
Error validating value 'm1.huge': The Flavor (m1.huge) could not be found.

template validate catches structural and property errors before you ever create resources.

3. Quota exceeded

The project hits its instance, core, RAM, volume, or floating-IP quota partway through stack creation.

openstack quota show --usage -c cores -c instances -c ram

ERROR (Forbidden): Quota exceeded for resources:
['cores: Requested 8, but already used 32 of 32 cores'].

The status reason will read Quota exceeded against whichever resource pushed past the limit.

4. Stack or resource timeout

A resource takes longer to reach a usable state than the configured timeout — common with WaitCondition/SoftwareDeployment resources that depend on in-guest signaling.

openstack stack event list web-stack --nested-depth 2 | grep -i timeout
openstack stack resource show web-stack wait_handle -c resource_status_reason -f value

CREATE aborted (Task create from WaitCondition wait_condition Stack
"web-stack" ... Timed out)
WaitConditionTimeout: resources.wait_condition: 0 of 1 received

The guest never signaled back (cloud-init failed, no route to the metadata service, or the timeout was simply too short).

5. Dependency ordering issues

When a resource references another that isn’t ready — or an implicit dependency is missing because get_resource/get_attr wasn’t used — Heat may create things in the wrong order.

openstack stack resource show web-stack app_server -c required_by -c resource_status_reason

required_by: ['app_floating_ip']
resource_status_reason: BadRequest: resources.app_server:
Port ... could not be found (the referenced port was deleted before the server attached)

Using { get_resource: app_port } instead of a hardcoded ID lets Heat infer the correct order.

6. Missing image, flavor, or network

A referenced image, flavor, or network simply doesn’t exist (deleted, renamed, or in another project).

openstack image list -f value -c Name | grep -i ubuntu
openstack flavor list -f value -c Name
openstack network list -f value -c Name

ubuntu-22.04
m1.small
m1.medium
private-net

If the template asks for ubuntu-20.04 or m1.huge and it’s not in these lists, the resource fails with could not be found.

Diagnostic Workflow

Step 1 — Find the failed resource

Don’t trust the top-level message; find which resource broke.

openstack stack resource list web-stack -n 3 \
  -c resource_name -c resource_type -c resource_status

| app_server | OS::Nova::Server | CREATE_FAILED   |
| app_port   | OS::Neutron::Port| CREATE_COMPLETE |

Step 2 — Read the real reason

Pull the failing resource’s status reason — this is the underlying service error.

openstack stack resource show web-stack app_server -c resource_status_reason -f value

Step 3 — Walk the event log, including nested stacks

The event timeline shows the exact order and any nested-stack failures.

openstack stack event list web-stack --nested-depth 3 --follow

Step 4 — Read Heat engine logs

If the resource reason is generic, the heat-engine log has the traceback.

# Kolla-Ansible (containerized)
docker logs heat_engine 2>&1 | grep -iE "ERROR|Traceback|web-stack" | tail -40
# Package-based
journalctl -u heat-engine --since "20 min ago" | tail -60
tail -100 /var/log/heat/heat-engine.log

ERROR heat.engine.resource [req-...] CREATE : Server "app_server" Stack "web-stack"
NoValidHost: No valid host was found. There are not enough hosts available.

Step 5 — Reproduce against the bare service

Confirm the nested cause by running the equivalent native command outside Heat.

# If Heat reported "No valid host", try the same boot directly:
openstack server create --flavor m1.medium --image ubuntu-22.04 \
  --network private-net repro-test
openstack compute service list --service nova-compute

Example Root Cause Analysis

Scenario. A previously working web-stack template starts failing for every deploy with Stack CREATE_FAILED. The team assumes the template is broken because nothing else changed in it.

Failing reason.

openstack stack resource show web-stack app_server -c resource_status_reason -f value

ResourceInError: resources.app_server: Went to status ERROR due to
"Message: No valid host was found. There are not enough hosts available., Code: 500"

Investigation. The message is a Nova scheduling failure, not a Heat or template problem. Reproducing the boot directly confirms it fails identically outside Heat:

openstack server create --flavor m1.medium --image ubuntu-22.04 --network private-net repro
# -> Error: No valid host was found.
openstack compute service list --service nova-compute

+----+--------------+-----------+------+---------+-------+
| ID | Binary       | Host      | Zone | Status  | State |
+----+--------------+-----------+------+---------+-------+
|  7 | nova-compute | compute01 | nova | enabled | up    |
|  8 | nova-compute | compute02 | nova | disabled| down  |
+----+--------------+-----------+------+---------+-------+

compute02 is down and disabled. Checking the scheduler shows the remaining host can’t fit m1.medium:

docker logs nova_scheduler 2>&1 | grep -i "filter" | tail

Filter RamFilter returned 0 hosts

compute01 is out of RAM and compute02 is offline — so Nova has no valid host, and Heat faithfully reports it as CREATE_FAILED. The template was never the problem.

Fix. Restore compute capacity, then re-create the stack:

# Bring compute02 back
docker restart nova_compute            # on compute02 (Kolla)
openstack compute service set --enable compute02 nova-compute
# Re-create the stack once capacity is healthy
openstack stack delete -y web-stack
openstack stack create -t template.yaml --enable-rollback web-stack

Prevention Best Practices

• Always openstack orchestration template validate and --dry-run in CI before deploying, so property and parameter errors fail fast instead of mid-stack.
• Enable rollback (--enable-rollback) so failed creates clean up after themselves and don’t leak half-built resources and quota.
• Monitor compute capacity (free vCPU/RAM per host) and alert before stacks start hitting “No valid host”; track quota usage per project with openstack quota show --usage.
• Reference images, flavors, and networks consistently — pin by ID where stability matters, and verify they exist as part of CI.
• Use get_resource/get_attr for inter-resource references so Heat computes dependency order correctly instead of hardcoding IDs.
• Set realistic timeouts for WaitCondition/SoftwareDeployment resources and ensure instances can reach the metadata service to signal completion.
• Feed CREATE_FAILED events into an automated runbook like /dashboard/incident-response/ so responders immediately see the nested service error rather than the generic Heat message.

Quick Command Reference

# Validate before deploying
openstack orchestration template validate -t template.yaml
openstack stack create -t template.yaml --dry-run --enable-rollback web-stack

# Find the failed resource and its real reason
openstack stack resource list web-stack -n 3 -c resource_name -c resource_status
openstack stack resource show web-stack <resource> -c resource_status_reason -f value

# Walk events including nested stacks
openstack stack event list web-stack --nested-depth 3 --follow

# Read Heat engine logs
docker logs heat_engine 2>&1 | grep -iE "ERROR|Traceback" | tail -40
journalctl -u heat-engine --since "20 min ago" | tail -60

# Check the usual nested culprits
openstack compute service list --service nova-compute
openstack quota show --usage -c cores -c instances -c ram
openstack image list; openstack flavor list; openstack network list

# Clean up and retry
openstack stack delete -y web-stack
openstack stack create -t template.yaml --enable-rollback web-stack

Conclusion

A Heat “Stack CREATE_FAILED” / “Resource CREATE failed” is almost always a wrapper around a more specific error. Typical root causes:

1. A nested resource failing in Nova (“No valid host”), Neutron (IP exhaustion), or Cinder (volume creation).
2. Template or parameter errors caught at validation or creation.
3. A quota exceeded partway through the stack.
4. A resource or stack timeout (often WaitCondition signaling).
5. Broken dependency ordering between resources.
6. References to a missing image, flavor, or network.

Read past the top-level status to the failing resource’s reason, reproduce against the bare service, and fix the real cause. More OpenStack troubleshooting lives at /categories/openstack/.