OC with BMaaS and TLS Everywhere fails to deploy: "The error was: 'python_interpreter' is undefined"

Environment:
python2-mistral-lib-1.0.0-0.20180821152751.d1ccfd0.el7ost.noarch
python2-mistralclient-3.7.0-0.20180810140142.f0ee48f.el7ost.noarch
puppet-mistral-13.3.2-0.20190420084920.324f29a.el7ost.noarch
python-tripleoclient-heat-installer-10.6.2-0.20190425150604.ba03c5e.el7ost.noarch
openstack-tripleo-heat-templates-9.3.1-0.20190513171729.9995be9.el7ost.noarch



Steps to reproduce:

Attempt to deploy OC with BMaaS and TLS everywhere.

openstack overcloud deploy \
--timeout 100 \
--templates /usr/share/openstack-tripleo-heat-templates \
--stack overcloud \
--libvirt-type kvm \
--ntp-server clock.redhat.com \
-e /home/stack/virt/config_lvm.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/network-isolation.yaml \
-e /home/stack/virt/network/network-environment.yaml \
-e /home/stack/virt/enable-tls.yaml \
-e /home/stack/virt/inject-trust-anchor.yaml \
-e /home/stack/virt/public_vip.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-ip.yaml \
-e /home/stack/virt/hostnames.yml \
-e /home/stack/virt/debug.yaml \
-e /home/stack/virt/nodes_data.yaml \
--environment-file /usr/share/openstack-tripleo-heat-templates/environments/services/ironic.yaml \
-e ~/containers-prepare-parameter.yaml \
-e /home/stack/virt/ironic-custom.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/services/haproxy-public-tls-certmonger.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml \
-e /home/stack/virt/cloud-names.yaml

Result:

The OC deployment fails:
/var/lib/mistral/overcloud/ansible.log shows:
2019-06-12 16:26:12,963 p=1630 u=mistral |  fatal: [controller-2]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'python_interpreter' is undefined\n\nThe error appears to have been in '/var/lib/mistral/overcloud/Controller/host_prep_tasks.yaml': line 391, column 5, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n    - hostname\n  - copy:\n    ^ here\n"}
2019-06-12 16:26:13,019 p=1630 u=mistral |  fatal: [controller-1]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'python_interpreter' is undefined\n\nThe error appears to have been in '/var/lib/mistral/overcloud/Controller/host_prep_tasks.yaml': line 391, column 5, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n    - hostname\n  - copy:\n    ^ here\n"}
2019-06-12 16:26:13,066 p=1630 u=mistral |  fatal: [controller-0]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'python_interpreter' is undefined\n\nThe error appears to have been in '/var/lib/mistral/overcloud/Controller/host_prep_tasks.yaml': line 391, column 5, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n    - hostname\n  - copy:\n    ^ here\n"}


The respective entry in /var/lib/mistral/overcloud/Controller/host_prep_tasks.yaml


  - copy:
      content: "#!/bin/sh\nset -x\n\nfunction get_metadata_config_drive {\n    if\
        \ [ -f /run/cloud-init/status.json ]; then\n    # Get metadata from config\
        \ drive\n    data=`cat /run/cloud-init/status.json`\n    config_drive=`echo\
        \ $data | python -c 'import json,re,sys;obj=json.load(sys.stdin);ds=obj.get(\"\
        v1\", {}).get(\"datasource\"); print re.findall(r\"source=(.*)]\", ds)[0]'`\n\
        \    if [[ -b $config_drive ]]; then\n  temp_dir=`mktemp -d`\n  mount $config_drive\
        \ $temp_dir\n  if [ -f $temp_dir/openstack/latest/vendor_data2.json ]; then\n\
        \  data=`cat $temp_dir/openstack/latest/vendor_data2.json`\n  umount $config_drive\n\
        \  rmdir $temp_dir\n  else\n  umount $config_drive\n  rmdir $temp_dir\n  fi\n\
        \    else\n  echo \"Unable to retrieve metadata from config drive.\"\n  return\
        \ 1\n    fi\n    else\n    echo \"Unable to retrieve metadata from config\
        \ drive.\"\n    return 1\n    fi\n\n    return 0\n}\n\nfunction get_metadata_network\
        \ {\n    # Get metadata over the network\n    data=$(timeout 300 /bin/bash\
        \ -c 'data=\"\"; while [ -z \"$data\" ]; do sleep $[ ( $RANDOM % 10 )  + 1\
        \ ]s; data=`curl -s http://169.254.169.254/openstack/2016-10-06/vendor_data2.json\
        \ 2>/dev/null`; done; echo $data')\n\n    if [[ $? != 0 ]] ; then\n    echo\
        \ \"Unable to retrieve metadata from metadata service.\"\n    return 1\n \
        \   fi\n}\n\nfunction get_fqdn {\n    # Get the instance hostname out of the\
        \ metadata\n    fqdn=`echo $data | {{ python_interpreter }} -c 'import json,sys;obj=json.load(sys.stdin);print(obj.get(\"\
        join\", {}).get(\"hostname\", \"\"))'`\n    if [ -z \"$fqdn\"]; then\n   \
        \     echo \"Unable to determine hostname\"\n        return 1\n    fi\n  \
        \  return 0\n}\n\nif ! get_metadata_config_drive || ! get_fqdn; then\n   if\
        \ ! get_metadata_network || ! get_fqdn; then\n       echo \"FATAL: No metadata\
        \ available or could not read the hostname from the metadata\"\n       exit\
        \ 1\n   fi\nfi\n\n# Get the instance hostname out of the metadata\nfqdn=`echo\
        \ $data | python -c 'import json,sys;obj=json.load(sys.stdin);print obj.get(\"\
        join\", {}).get(\"hostname\", \"\")'`\n\nif [ -z \"$fqdn\" ]; then\n    echo\
        \ \"Unable to determine hostname\"\n    exit 1\nfi\n\nrealm=`echo $data |\
        \ python -c 'import json,sys;obj=json.load(sys.stdin);print obj.get(\"join\"\
        , {}).get(\"krb_realm\", \"\")'`\notp=`echo $data | python -c 'import json,sys;obj=json.load(sys.stdin);print\
        \ obj.get(\"join\", {}).get(\"ipaotp\", \"\")'`\n\n# Force hostname to use\
        \ the FQDN\nhostnamectl set-hostname $fqdn\n\n# run ipa-client-install\nOPTS=\"\
        -U -w $otp --hostname $fqdn\"\n\nif [ -n \"$realm\" ]; then\n    OPTS=\"$OPTS\
        \ --realm=$realm\"\nfi\nif [ -n \"$idm_domain\" ]; then\n    OPTS=\"$OPTS\
        \ --domain=$idm_domain\"\nfi\nif [ \"${makehomedir,,}\" = \"true\" ]; then\n\
        \    OPTS=\"$OPTS --mkhomedir\"\nfi\nif [ \"${idm_no_ntp,,}\" = \"true\" ];\
        \ then\n    OPTS=\"$OPTS --no-ntp\"\nfi\n\n\n# Ensure we have the proper domain\
        \ in /etc/resolv.conf\ndomain=$(hostname -d)\nif [ -n \"$idm_domain\" ]; then\n\
        \    domain = \"$domain $idm_domain\"\nfi\nif ! grep -q ${domain} /etc/resolv.conf\
        \ ; then\n    sed -i \"0,/nameserver/s/\\(nameserver.*\\)/search ${domain}\\\
        n\\1/\" /etc/resolv.conf\nfi\n\nipa-client-install $OPTS\n"
      dest: /root/setup-ipa-client.sh
      mode: '0700'
    name: create enrollment script